ominfra 0.0.0.dev175__py3-none-any.whl → 0.0.0.dev177__py3-none-any.whl

ominfra/scripts/manage.py

@@ -129,12 +129,12 @@ AtomicPathSwapState = ta.Literal['open', 'committed', 'aborted']  # ta.TypeAlias
 # ../configs.py
 ConfigMapping = ta.Mapping[str, ta.Any]
 
-# deploy/specs.py
-KeyDeployTagT = ta.TypeVar('KeyDeployTagT', bound='KeyDeployTag')
-
 # ../../omlish/subprocesses.py
 SubprocessChannelOption = ta.Literal['pipe', 'stdout', 'devnull']  # ta.TypeAlias
 
+# deploy/specs.py
+KeyDeployTagT = ta.TypeVar('KeyDeployTagT', bound='KeyDeployTag')
+
 # system/packages.py
 SystemPackageOrStr = ta.Union['SystemPackage', str]
 
@@ -1384,7 +1384,7 @@ class MainConfig:
 
 @dc.dataclass(frozen=True)
 class DeployConfig:
-    deploy_home: ta.Optional[str] = None
+    pass
 
 
 ########################################
@@ -4251,229 +4251,6 @@ def build_command_name_map(crs: CommandRegistrations) -> CommandNameMap:
     return CommandNameMap(dct)
 
 
-########################################
-# ../deploy/tags.py
-
-
-##
-
-
-DEPLOY_TAG_SIGIL = '@'
-
-DEPLOY_TAG_SEPARATOR = '--'
-
-DEPLOY_TAG_DELIMITERS: ta.AbstractSet[str] = frozenset([
-    DEPLOY_TAG_SEPARATOR,
-    '.',
-])
-
-DEPLOY_TAG_ILLEGAL_STRS: ta.AbstractSet[str] = frozenset([
-    DEPLOY_TAG_SIGIL,
-    *DEPLOY_TAG_DELIMITERS,
-    '/',
-])
-
-
-##
-
-
-@dc.dataclass(frozen=True)
-class DeployTag(abc.ABC):  # noqa
-    s: str
-
-    def __post_init__(self) -> None:
-        check.not_in(abc.ABC, type(self).__bases__)
-        check.non_empty_str(self.s)
-        for ch in DEPLOY_TAG_ILLEGAL_STRS:
-            check.state(ch not in self.s)
-
-    #
-
-    tag_name: ta.ClassVar[str]
-    tag_kwarg: ta.ClassVar[str]
-
-    def __init_subclass__(cls, **kwargs: ta.Any) -> None:
-        super().__init_subclass__(**kwargs)
-
-        if abc.ABC in cls.__bases__:
-            return
-
-        for b in cls.__bases__:
-            if issubclass(b, DeployTag):
-                check.in_(abc.ABC, b.__bases__)
-
-        check.non_empty_str(tn := cls.tag_name)
-        check.equal(tn, tn.lower().strip())
-        check.not_in('_', tn)
-
-        check.state(not hasattr(cls, 'tag_kwarg'))
-        cls.tag_kwarg = tn.replace('-', '_')
-
-
-##
-
-
-_DEPLOY_TAGS: ta.Set[ta.Type[DeployTag]] = set()
-DEPLOY_TAGS: ta.AbstractSet[ta.Type[DeployTag]] = _DEPLOY_TAGS
-
-_DEPLOY_TAGS_BY_NAME: ta.Dict[str, ta.Type[DeployTag]] = {}
-DEPLOY_TAGS_BY_NAME: ta.Mapping[str, ta.Type[DeployTag]] = _DEPLOY_TAGS_BY_NAME
-
-_DEPLOY_TAGS_BY_KWARG: ta.Dict[str, ta.Type[DeployTag]] = {}
-DEPLOY_TAGS_BY_KWARG: ta.Mapping[str, ta.Type[DeployTag]] = _DEPLOY_TAGS_BY_KWARG
-
-
-def _register_deploy_tag(cls):
-    check.not_in(cls.tag_name, _DEPLOY_TAGS_BY_NAME)
-    check.not_in(cls.tag_kwarg, _DEPLOY_TAGS_BY_KWARG)
-
-    _DEPLOY_TAGS.add(cls)
-    _DEPLOY_TAGS_BY_NAME[cls.tag_name] = cls
-    _DEPLOY_TAGS_BY_KWARG[cls.tag_kwarg] = cls
-
-    return cls
-
-
-##
-
-
-@_register_deploy_tag
-class DeployTime(DeployTag):
-    tag_name: ta.ClassVar[str] = 'time'
-
-
-##
-
-
-class NameDeployTag(DeployTag, abc.ABC):  # noqa
-    pass
-
-
-@_register_deploy_tag
-class DeployApp(NameDeployTag):
-    tag_name: ta.ClassVar[str] = 'app'
-
-
-@_register_deploy_tag
-class DeployConf(NameDeployTag):
-    tag_name: ta.ClassVar[str] = 'conf'
-
-
-##
-
-
-class KeyDeployTag(DeployTag, abc.ABC):  # noqa
-    pass
-
-
-@_register_deploy_tag
-class DeployKey(KeyDeployTag):
-    tag_name: ta.ClassVar[str] = 'deploy-key'
-
-
-@_register_deploy_tag
-class DeployAppKey(KeyDeployTag):
-    tag_name: ta.ClassVar[str] = 'app-key'
-
-
-##
-
-
-class RevDeployTag(DeployTag, abc.ABC):  # noqa
-    pass
-
-
-@_register_deploy_tag
-class DeployAppRev(RevDeployTag):
-    tag_name: ta.ClassVar[str] = 'app-rev'
-
-
-##
-
-
-class DeployTagMap:
-    def __init__(
-            self,
-            *args: DeployTag,
-            **kwargs: str,
-    ) -> None:
-        super().__init__()
-
-        dct: ta.Dict[ta.Type[DeployTag], DeployTag] = {}
-
-        for a in args:
-            c = type(check.isinstance(a, DeployTag))
-            check.not_in(c, dct)
-            dct[c] = a
-
-        for k, v in kwargs.items():
-            c = DEPLOY_TAGS_BY_KWARG[k]
-            check.not_in(c, dct)
-            dct[c] = c(v)
-
-        self._dct = dct
-        self._tup = tuple(sorted((type(t).tag_kwarg, t.s) for t in dct.values()))
-
-    #
-
-    def add(self, *args: ta.Any, **kwargs: ta.Any) -> 'DeployTagMap':
-        return DeployTagMap(
-            *self,
-            *args,
-            **kwargs,
-        )
-
-    def remove(self, *tags_or_names: ta.Union[ta.Type[DeployTag], str]) -> 'DeployTagMap':
-        dcs = {
-            check.issubclass(a, DeployTag) if isinstance(a, type) else DEPLOY_TAGS_BY_NAME[a]
-            for a in tags_or_names
-        }
-
-        return DeployTagMap(*[
-            t
-            for t in self._dct.values()
-            if t not in dcs
-        ])
-
-    #
-
-    def __repr__(self) -> str:
-        return f'{self.__class__.__name__}({", ".join(f"{k}={v!r}" for k, v in self._tup)})'
-
-    def __hash__(self) -> int:
-        return hash(self._tup)
-
-    def __eq__(self, other: object) -> bool:
-        if isinstance(other, DeployTagMap):
-            return self._tup == other._tup
-        else:
-            return NotImplemented
-
-    #
-
-    def __len__(self) -> int:
-        return len(self._dct)
-
-    def __iter__(self) -> ta.Iterator[DeployTag]:
-        return iter(self._dct.values())
-
-    def __getitem__(self, key: ta.Union[ta.Type[DeployTag], str]) -> DeployTag:
-        if isinstance(key, str):
-            return self._dct[DEPLOY_TAGS_BY_NAME[key]]
-        elif isinstance(key, type):
-            return self._dct[key]
-        else:
-            raise TypeError(key)
-
-    def __contains__(self, key: ta.Union[ta.Type[DeployTag], str]) -> bool:
-        if isinstance(key, str):
-            return DEPLOY_TAGS_BY_NAME[key] in self._dct
-        elif isinstance(key, type):
-            return key in self._dct
-        else:
-            raise TypeError(key)
-
-
 ########################################
 # ../remote/config.py
 
@@ -6135,6 +5912,18 @@ class FieldsObjMarshaler(ObjMarshaler):
         })
 
 
+@dc.dataclass(frozen=True)
+class SingleFieldObjMarshaler(ObjMarshaler):
+    ty: type
+    fld: str
+
+    def marshal(self, o: ta.Any, ctx: 'ObjMarshalContext') -> ta.Any:
+        return getattr(o, self.fld)
+
+    def unmarshal(self, o: ta.Any, ctx: 'ObjMarshalContext') -> ta.Any:
+        return self.ty(**{self.fld: o})
+
+
 @dc.dataclass(frozen=True)
 class PolymorphicObjMarshaler(ObjMarshaler):
     class Impl(ta.NamedTuple):
@@ -6209,7 +5998,7 @@ _DEFAULT_OBJ_MARSHALERS: ta.Dict[ta.Any, ObjMarshaler] = {
     **{t: IterableObjMarshaler(t, DynamicObjMarshaler()) for t in (list, tuple, set, frozenset)},
     **{t: MappingObjMarshaler(t, DynamicObjMarshaler(), DynamicObjMarshaler()) for t in (dict,)},
 
-    ta.Any: DynamicObjMarshaler(),
+    **{t: DynamicObjMarshaler() for t in (ta.Any, object)},
 
     **{t: DatetimeObjMarshaler(t) for t in (datetime.date, datetime.time, datetime.datetime)},
     decimal.Decimal: DecimalObjMarshaler(),
@@ -6234,6 +6023,16 @@ _OBJ_MARSHALER_GENERIC_ITERABLE_TYPES: ta.Dict[ta.Any, type] = {
 ##
 
 
+_REGISTERED_OBJ_MARSHALERS_BY_TYPE: ta.MutableMapping[type, ObjMarshaler] = weakref.WeakKeyDictionary()
+
+
+def register_type_obj_marshaler(ty: type, om: ObjMarshaler) -> None:
+    _REGISTERED_OBJ_MARSHALERS_BY_TYPE[ty] = om
+
+
+##
+
+
 class ObjMarshalerManager:
     def __init__(
             self,
@@ -6243,6 +6042,8 @@ class ObjMarshalerManager:
             default_obj_marshalers: ta.Dict[ta.Any, ObjMarshaler] = _DEFAULT_OBJ_MARSHALERS,  # noqa
             generic_mapping_types: ta.Dict[ta.Any, type] = _OBJ_MARSHALER_GENERIC_MAPPING_TYPES,  # noqa
             generic_iterable_types: ta.Dict[ta.Any, type] = _OBJ_MARSHALER_GENERIC_ITERABLE_TYPES,  # noqa
+
+            registered_obj_marshalers: ta.Mapping[type, ObjMarshaler] = _REGISTERED_OBJ_MARSHALERS_BY_TYPE,
     ) -> None:
         super().__init__()
 
@@ -6251,6 +6052,7 @@ class ObjMarshalerManager:
         self._obj_marshalers = dict(default_obj_marshalers)
         self._generic_mapping_types = generic_mapping_types
         self._generic_iterable_types = generic_iterable_types
+        self._registered_obj_marshalers = registered_obj_marshalers
 
         self._lock = threading.RLock()
         self._marshalers: ta.Dict[ta.Any, ObjMarshaler] = dict(_DEFAULT_OBJ_MARSHALERS)
@@ -6266,6 +6068,9 @@ class ObjMarshalerManager:
             non_strict_fields: bool = False,
     ) -> ObjMarshaler:
         if isinstance(ty, type):
+            if (reg := self._registered_obj_marshalers.get(ty)) is not None:
+                return reg
+
             if abc.ABC in ty.__bases__:
                 impls = [ity for ity in deep_subclasses(ty) if abc.ABC not in ity.__bases__]  # type: ignore
                 if all(ity.__qualname__.endswith(ty.__name__) for ity in impls):
@@ -6330,9 +6135,15 @@ class ObjMarshalerManager:
 
     #
 
-    def register_opj_marshaler(self, ty: ta.Any, m: ObjMarshaler) -> None:
+    def set_obj_marshaler(
+            self,
+            ty: ta.Any,
+            m: ObjMarshaler,
+            *,
+            override: bool = False,
+    ) -> None:
         with self._lock:
-            if ty in self._obj_marshalers:
+            if not override and ty in self._obj_marshalers:
                 raise KeyError(ty)
             self._obj_marshalers[ty] = m
 
@@ -6423,7 +6234,7 @@ class ObjMarshalContext:
 
 OBJ_MARSHALER_MANAGER = ObjMarshalerManager()
 
-register_opj_marshaler = OBJ_MARSHALER_MANAGER.register_opj_marshaler
+set_obj_marshaler = OBJ_MARSHALER_MANAGER.set_obj_marshaler
 get_obj_marshaler = OBJ_MARSHALER_MANAGER.get_obj_marshaler
 
 marshal_obj = OBJ_MARSHALER_MANAGER.marshal_obj
@@ -6825,6 +6636,7 @@ def read_config_file(
         cls: ta.Type[T],
         *,
         prepare: ta.Optional[ta.Callable[[ConfigMapping], ConfigMapping]] = None,
+        msh: ObjMarshalerManager = OBJ_MARSHALER_MANAGER,
 ) -> T:
     with open(path) as cf:
         config_dct = parse_config_file(os.path.basename(path), cf)
@@ -6832,7 +6644,7 @@ def read_config_file(
     if prepare is not None:
         config_dct = prepare(config_dct)
 
-    return unmarshal_obj(config_dct, cls)
+    return msh.unmarshal_obj(config_dct, cls)
 
 
 def build_config_named_children(
@@ -6885,7 +6697,7 @@ def install_command_marshaling(
         lambda c: c,
         lambda c: c.Output,
     ]:
-        msh.register_opj_marshaler(
+        msh.set_obj_marshaler(
             fn(Command),
             PolymorphicObjMarshaler.of([
                 PolymorphicObjMarshaler.Impl(
@@ -6927,355 +6739,228 @@ CommandExecutorMap = ta.NewType('CommandExecutorMap', ta.Mapping[ta.Type[Command
 
 
 ########################################
-# ../deploy/paths/paths.py
-"""
-TODO:
- - run/{.pid,.sock}
- - logs/...
- - current symlink
- - conf/{nginx,supervisor}
- - env/?
- - apps/<app>/shared
-"""
+# ../deploy/tags.py
 
 
 ##
 
 
-class DeployPathError(Exception):
-    pass
-
+DEPLOY_TAG_SIGIL = '@'
 
-class DeployPathRenderable(abc.ABC):
-    @abc.abstractmethod
-    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
-        raise NotImplementedError
+DEPLOY_TAG_SEPARATOR = '--'
 
+DEPLOY_TAG_DELIMITERS: ta.AbstractSet[str] = frozenset([
+    DEPLOY_TAG_SEPARATOR,
+    '.',
+])
 
-##
+DEPLOY_TAG_ILLEGAL_STRS: ta.AbstractSet[str] = frozenset([
+    DEPLOY_TAG_SIGIL,
+    *DEPLOY_TAG_DELIMITERS,
+    '/',
+])
 
 
-class DeployPathNamePart(DeployPathRenderable, abc.ABC):
-    @classmethod
-    def parse(cls, s: str) -> 'DeployPathNamePart':
-        check.non_empty_str(s)
-        if s.startswith(DEPLOY_TAG_SIGIL):
-            return TagDeployPathNamePart(s[1:])
-        elif s in DEPLOY_TAG_DELIMITERS:
-            return DelimiterDeployPathNamePart(s)
-        else:
-            return ConstDeployPathNamePart(s)
+##
 
 
 @dc.dataclass(frozen=True)
-class TagDeployPathNamePart(DeployPathNamePart):
-    name: str
+class DeployTag(abc.ABC):  # noqa
+    s: str
 
     def __post_init__(self) -> None:
-        check.in_(self.name, DEPLOY_TAGS_BY_NAME)
+        check.not_in(abc.ABC, type(self).__bases__)
+        check.non_empty_str(self.s)
+        for ch in DEPLOY_TAG_ILLEGAL_STRS:
+            check.state(ch not in self.s)
 
-    @property
-    def tag(self) -> ta.Type[DeployTag]:
-        return DEPLOY_TAGS_BY_NAME[self.name]
+    #
 
-    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
-        if tags is not None:
-            return tags[self.tag].s
-        else:
-            return DEPLOY_TAG_SIGIL + self.name
+    tag_name: ta.ClassVar[str]
+    tag_kwarg: ta.ClassVar[str]
 
+    def __init_subclass__(cls, **kwargs: ta.Any) -> None:
+        super().__init_subclass__(**kwargs)
 
-@dc.dataclass(frozen=True)
-class DelimiterDeployPathNamePart(DeployPathNamePart):
-    delimiter: str
+        if abc.ABC in cls.__bases__:
+            return
 
-    def __post_init__(self) -> None:
-        check.in_(self.delimiter, DEPLOY_TAG_DELIMITERS)
+        for b in cls.__bases__:
+            if issubclass(b, DeployTag):
+                check.in_(abc.ABC, b.__bases__)
 
-    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
-        return self.delimiter
+        check.non_empty_str(tn := cls.tag_name)
+        check.equal(tn, tn.lower().strip())
+        check.not_in('_', tn)
 
+        check.state(not hasattr(cls, 'tag_kwarg'))
+        cls.tag_kwarg = tn.replace('-', '_')
 
-@dc.dataclass(frozen=True)
-class ConstDeployPathNamePart(DeployPathNamePart):
-    const: str
 
-    def __post_init__(self) -> None:
-        check.non_empty_str(self.const)
-        for c in [*DEPLOY_TAG_DELIMITERS, DEPLOY_TAG_SIGIL, '/']:
-            check.not_in(c, self.const)
+##
 
-    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
-        return self.const
 
+_DEPLOY_TAGS: ta.Set[ta.Type[DeployTag]] = set()
+DEPLOY_TAGS: ta.AbstractSet[ta.Type[DeployTag]] = _DEPLOY_TAGS
 
-@dc.dataclass(frozen=True)
-class DeployPathName(DeployPathRenderable):
-    parts: ta.Sequence[DeployPathNamePart]
+_DEPLOY_TAGS_BY_NAME: ta.Dict[str, ta.Type[DeployTag]] = {}
+DEPLOY_TAGS_BY_NAME: ta.Mapping[str, ta.Type[DeployTag]] = _DEPLOY_TAGS_BY_NAME
 
-    def __post_init__(self) -> None:
-        hash(self)
-        check.not_empty(self.parts)
-        for k, g in itertools.groupby(self.parts, type):
-            if len(gl := list(g)) > 1:
-                raise DeployPathError(f'May not have consecutive path name part types: {k} {gl}')
+_DEPLOY_TAGS_BY_KWARG: ta.Dict[str, ta.Type[DeployTag]] = {}
+DEPLOY_TAGS_BY_KWARG: ta.Mapping[str, ta.Type[DeployTag]] = _DEPLOY_TAGS_BY_KWARG
 
-    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
-        return ''.join(p.render(tags) for p in self.parts)
 
-    @classmethod
-    def parse(cls, s: str) -> 'DeployPathName':
-        check.non_empty_str(s)
-        check.not_in('/', s)
+def _register_deploy_tag(cls):
+    check.not_in(cls.tag_name, _DEPLOY_TAGS_BY_NAME)
+    check.not_in(cls.tag_kwarg, _DEPLOY_TAGS_BY_KWARG)
 
-        i = 0
-        ps = []
-        while i < len(s):
-            ns = [(n, d) for d in DEPLOY_TAG_DELIMITERS if (n := s.find(d, i)) >= 0]
-            if not ns:
-                ps.append(s[i:])
-                break
-            n, d = min(ns)
-            ps.append(check.non_empty_str(s[i:n]))
-            ps.append(s[n:n + len(d)])
-            i = n + len(d)
+    _DEPLOY_TAGS.add(cls)
+    _DEPLOY_TAGS_BY_NAME[cls.tag_name] = cls
+    _DEPLOY_TAGS_BY_KWARG[cls.tag_kwarg] = cls
 
-        return cls(tuple(DeployPathNamePart.parse(p) for p in ps))
+    register_type_obj_marshaler(cls, SingleFieldObjMarshaler(cls, 's'))
+
+    return cls
 
 
 ##
 
 
-@dc.dataclass(frozen=True)
-class DeployPathPart(DeployPathRenderable, abc.ABC):  # noqa
-    name: DeployPathName
+@_register_deploy_tag
+class DeployTime(DeployTag):
+    tag_name: ta.ClassVar[str] = 'time'
 
-    @property
-    @abc.abstractmethod
-    def kind(self) -> DeployPathKind:
-        raise NotImplementedError
 
-    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
-        return self.name.render(tags) + ('/' if self.kind == 'dir' else '')
+##
 
-    @classmethod
-    def parse(cls, s: str) -> 'DeployPathPart':
-        if (is_dir := s.endswith('/')):
-            s = s[:-1]
-        check.non_empty_str(s)
-        check.not_in('/', s)
 
-        n = DeployPathName.parse(s)
-        if is_dir:
-            return DirDeployPathPart(n)
-        else:
-            return FileDeployPathPart(n)
+class NameDeployTag(DeployTag, abc.ABC):  # noqa
+    pass
 
 
-class DirDeployPathPart(DeployPathPart):
-    @property
-    def kind(self) -> DeployPathKind:
-        return 'dir'
+@_register_deploy_tag
+class DeployApp(NameDeployTag):
+    tag_name: ta.ClassVar[str] = 'app'
 
 
-class FileDeployPathPart(DeployPathPart):
-    @property
-    def kind(self) -> DeployPathKind:
-        return 'file'
+@_register_deploy_tag
+class DeployConf(NameDeployTag):
+    tag_name: ta.ClassVar[str] = 'conf'
 
 
 ##
 
 
-@dc.dataclass(frozen=True)
-class DeployPath:
-    parts: ta.Sequence[DeployPathPart]
-
-    @property
-    def name_parts(self) -> ta.Iterator[DeployPathNamePart]:
-        for p in self.parts:
-            yield from p.name.parts
-
-    def __post_init__(self) -> None:
-        hash(self)
-        check.not_empty(self.parts)
-        for p in self.parts[:-1]:
-            check.equal(p.kind, 'dir')
-
-    @cached_nullary
-    def tag_indices(self) -> ta.Mapping[ta.Type[DeployTag], ta.Sequence[int]]:
-        pd: ta.Dict[ta.Type[DeployTag], ta.List[int]] = {}
-        for i, np in enumerate(self.name_parts):
-            if isinstance(np, TagDeployPathNamePart):
-                pd.setdefault(np.tag, []).append(i)
-        return pd
-
-    @property
-    def kind(self) -> DeployPathKind:
-        return self.parts[-1].kind
+class KeyDeployTag(DeployTag, abc.ABC):  # noqa
+    pass
 
-    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
-        return ''.join([p.render(tags) for p in self.parts])
 
-    @classmethod
-    def parse(cls, s: str) -> 'DeployPath':
-        check.non_empty_str(s)
-        ps = split_keep_delimiter(s, '/')
-        return cls(tuple(DeployPathPart.parse(p) for p in ps))
+@_register_deploy_tag
+class DeployKey(KeyDeployTag):
+    tag_name: ta.ClassVar[str] = 'deploy-key'
 
 
-########################################
-# ../deploy/specs.py
+@_register_deploy_tag
+class DeployAppKey(KeyDeployTag):
+    tag_name: ta.ClassVar[str] = 'app-key'
 
 
 ##
 
 
-def check_valid_deploy_spec_path(s: str) -> str:
-    check.non_empty_str(s)
-    for c in ['..', '//']:
-        check.not_in(c, s)
-    check.arg(not s.startswith('/'))
-    return s
-
+class RevDeployTag(DeployTag, abc.ABC):  # noqa
+    pass
 
-class DeploySpecKeyed(ta.Generic[KeyDeployTagT]):
-    @cached_nullary
-    def _key_str(self) -> str:
-        return hashlib.sha256(repr(self).encode('utf-8')).hexdigest()[:8]
 
-    @abc.abstractmethod
-    def key(self) -> KeyDeployTagT:
-        raise NotImplementedError
+@_register_deploy_tag
+class DeployAppRev(RevDeployTag):
+    tag_name: ta.ClassVar[str] = 'app-rev'
 
 
 ##
 
 
-@dc.dataclass(frozen=True)
-class DeployGitRepo:
-    host: ta.Optional[str] = None
-    username: ta.Optional[str] = None
-    path: ta.Optional[str] = None
+class DeployTagMap:
+    def __init__(
+            self,
+            *args: DeployTag,
+            **kwargs: str,
+    ) -> None:
+        super().__init__()
 
-    def __post_init__(self) -> None:
-        check.not_in('..', check.non_empty_str(self.host))
-        check.not_in('.', check.non_empty_str(self.path))
+        dct: ta.Dict[ta.Type[DeployTag], DeployTag] = {}
 
+        for a in args:
+            c = type(check.isinstance(a, DeployTag))
+            check.not_in(c, dct)
+            dct[c] = a
 
-@dc.dataclass(frozen=True)
-class DeployGitSpec:
-    repo: DeployGitRepo
-    rev: DeployRev
-
-    subtrees: ta.Optional[ta.Sequence[str]] = None
-
-    def __post_init__(self) -> None:
-        check.non_empty_str(self.rev)
-        if self.subtrees is not None:
-            for st in self.subtrees:
-                check.non_empty_str(st)
-
-
-##
-
-
-@dc.dataclass(frozen=True)
-class DeployVenvSpec:
-    interp: ta.Optional[str] = None
-
-    requirements_files: ta.Optional[ta.Sequence[str]] = None
-    extra_dependencies: ta.Optional[ta.Sequence[str]] = None
-
-    use_uv: bool = False
-
-
-##
-
-
-@dc.dataclass(frozen=True)
-class DeployAppConfFile:
-    path: str
-    body: str
-
-    def __post_init__(self) -> None:
-        check_valid_deploy_spec_path(self.path)
-
-
-#
-
-
-@dc.dataclass(frozen=True)
-class DeployAppConfLink:  # noqa
-    """
-    May be either:
-     - @conf(.ext)* - links a single file in root of app conf dir to conf/@conf/@dst(.ext)*
-     - @conf/file - links a single file in a single subdir to conf/@conf/@dst--file
-     - @conf/ - links a directory in root of app conf dir to conf/@conf/@dst/
-    """
-
-    src: str
-
-    kind: ta.Literal['current_only', 'all_active'] = 'current_only'
-
-    def __post_init__(self) -> None:
-        check_valid_deploy_spec_path(self.src)
-        if '/' in self.src:
-            check.equal(self.src.count('/'), 1)
-
-
-#
-
-
-@dc.dataclass(frozen=True)
-class DeployAppConfSpec:
-    files: ta.Optional[ta.Sequence[DeployAppConfFile]] = None
-
-    links: ta.Optional[ta.Sequence[DeployAppConfLink]] = None
-
-    def __post_init__(self) -> None:
-        if self.files:
-            seen: ta.Set[str] = set()
-            for f in self.files:
-                check.not_in(f.path, seen)
-                seen.add(f.path)
+        for k, v in kwargs.items():
+            c = DEPLOY_TAGS_BY_KWARG[k]
+            check.not_in(c, dct)
+            dct[c] = c(v)
 
+        self._dct = dct
+        self._tup = tuple(sorted((type(t).tag_kwarg, t.s) for t in dct.values()))
 
-##
+    #
 
+    def add(self, *args: ta.Any, **kwargs: ta.Any) -> 'DeployTagMap':
+        return DeployTagMap(
+            *self,
+            *args,
+            **kwargs,
+        )
 
-@dc.dataclass(frozen=True)
-class DeployAppSpec(DeploySpecKeyed[DeployAppKey]):
-    app: DeployApp
+    def remove(self, *tags_or_names: ta.Union[ta.Type[DeployTag], str]) -> 'DeployTagMap':
+        dcs = {
+            check.issubclass(a, DeployTag) if isinstance(a, type) else DEPLOY_TAGS_BY_NAME[a]
+            for a in tags_or_names
+        }
 
-    git: DeployGitSpec
+        return DeployTagMap(*[
+            t
+            for t in self._dct.values()
+            if t not in dcs
+        ])
 
-    venv: ta.Optional[DeployVenvSpec] = None
+    #
 
-    conf: ta.Optional[DeployAppConfSpec] = None
+    def __repr__(self) -> str:
+        return f'{self.__class__.__name__}({", ".join(f"{k}={v!r}" for k, v in self._tup)})'
 
-    # @ta.override
-    def key(self) -> DeployAppKey:
-        return DeployAppKey(self._key_str())
+    def __hash__(self) -> int:
+        return hash(self._tup)
 
+    def __eq__(self, other: object) -> bool:
+        if isinstance(other, DeployTagMap):
+            return self._tup == other._tup
+        else:
+            return NotImplemented
 
-##
+    #
 
+    def __len__(self) -> int:
+        return len(self._dct)
 
-@dc.dataclass(frozen=True)
-class DeploySpec(DeploySpecKeyed[DeployKey]):
-    apps: ta.Sequence[DeployAppSpec]
+    def __iter__(self) -> ta.Iterator[DeployTag]:
+        return iter(self._dct.values())
 
-    def __post_init__(self) -> None:
-        seen: ta.Set[DeployApp] = set()
-        for a in self.apps:
-            if a.app in seen:
-                raise KeyError(a.app)
-            seen.add(a.app)
+    def __getitem__(self, key: ta.Union[ta.Type[DeployTag], str]) -> DeployTag:
+        if isinstance(key, str):
+            return self._dct[DEPLOY_TAGS_BY_NAME[key]]
+        elif isinstance(key, type):
+            return self._dct[key]
+        else:
+            raise TypeError(key)
 
-    # @ta.override
-    def key(self) -> DeployKey:
-        return DeployKey(self._key_str())
+    def __contains__(self, key: ta.Union[ta.Type[DeployTag], str]) -> bool:
+        if isinstance(key, str):
+            return DEPLOY_TAGS_BY_NAME[key] in self._dct
+        elif isinstance(key, type):
+            return key in self._dct
+        else:
+            raise TypeError(key)
 
 
 ########################################
@@ -7863,293 +7548,424 @@ class LocalCommandExecutor(CommandExecutor):
 
 
 ########################################
-# ../deploy/conf.py
+# ../deploy/paths/paths.py
 """
 TODO:
- - @conf DeployPathPlaceholder? :|
- - post-deploy: remove any dir_links not present in new spec
-  - * only if succeeded * - otherwise, remove any dir_links present in new spec but not previously present?
-   - no such thing as 'previously present'.. build a 'deploy state' and pass it back?
- - ** whole thing can be atomic **
-  - 1) new atomic temp dir
-  - 2) for each subdir not needing modification, hardlink into temp dir
-  - 3) for each subdir needing modification, new subdir, hardlink all files not needing modification
-  - 4) write (or if deleting, omit) new files
-  - 5) swap top level
- - ** whole deploy can be atomic(-ish) - do this for everything **
-  - just a '/deploy/current' dir
-  - some things (venvs) cannot be moved, thus the /deploy/venvs dir
-  - ** ensure (enforce) equivalent relpath nesting
+ - run/{.pid,.sock}
+ - logs/...
+ - current symlink
+ - conf/{nginx,supervisor}
+ - env/?
+ - apps/<app>/shared
 """
 
 
-class DeployConfManager:
-    def __init__(
-            self,
-            *,
-            deploy_home: ta.Optional[DeployHome] = None,
-    ) -> None:
-        super().__init__()
-
-        self._deploy_home = deploy_home
+##
 
-    #
 
-    async def _write_app_conf_file(
-            self,
-            acf: DeployAppConfFile,
-            app_conf_dir: str,
-    ) -> None:
-        conf_file = os.path.join(app_conf_dir, acf.path)
-        check.arg(is_path_in_dir(app_conf_dir, conf_file))
+class DeployPathError(Exception):
+    pass
 
-        os.makedirs(os.path.dirname(conf_file), exist_ok=True)
 
-        with open(conf_file, 'w') as f:  # noqa
-            f.write(acf.body)
+class DeployPathRenderable(abc.ABC):
+    @abc.abstractmethod
+    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
+        raise NotImplementedError
 
-    #
 
-    class _ComputedConfLink(ta.NamedTuple):
-        conf: DeployConf
-        is_dir: bool
-        link_src: str
-        link_dst: str
+##
 
-    _UNIQUE_LINK_NAME_STR = '@app--@time--@app-key'
-    _UNIQUE_LINK_NAME = DeployPath.parse(_UNIQUE_LINK_NAME_STR)
 
+class DeployPathNamePart(DeployPathRenderable, abc.ABC):
     @classmethod
-    def _compute_app_conf_link_dst(
-            cls,
-            link: DeployAppConfLink,
-            tags: DeployTagMap,
-            app_conf_dir: str,
-            conf_link_dir: str,
-    ) -> _ComputedConfLink:
-        link_src = os.path.join(app_conf_dir, link.src)
-        check.arg(is_path_in_dir(app_conf_dir, link_src))
+    def parse(cls, s: str) -> 'DeployPathNamePart':
+        check.non_empty_str(s)
+        if s.startswith(DEPLOY_TAG_SIGIL):
+            return TagDeployPathNamePart(s[1:])
+        elif s in DEPLOY_TAG_DELIMITERS:
+            return DelimiterDeployPathNamePart(s)
+        else:
+            return ConstDeployPathNamePart(s)
 
-        #
 
-        if (is_dir := link.src.endswith('/')):
-            # @conf/ - links a directory in root of app conf dir to conf/@conf/@dst/
-            check.arg(link.src.count('/') == 1)
-            conf = DeployConf(link.src.split('/')[0])
-            link_dst_pfx = link.src
-            link_dst_sfx = ''
+@dc.dataclass(frozen=True)
+class TagDeployPathNamePart(DeployPathNamePart):
+    name: str
 
-        elif '/' in link.src:
-            # @conf/file - links a single file in a single subdir to conf/@conf/@dst--file
-            d, f = os.path.split(link.src)
-            # TODO: check filename :|
-            conf = DeployConf(d)
-            link_dst_pfx = d + '/'
-            link_dst_sfx = DEPLOY_TAG_SEPARATOR + f
+    def __post_init__(self) -> None:
+        check.in_(self.name, DEPLOY_TAGS_BY_NAME)
 
-        else:  # noqa
-            # @conf(.ext)* - links a single file in root of app conf dir to conf/@conf/@dst(.ext)*
-            if '.' in link.src:
-                l, _, r = link.src.partition('.')
-                conf = DeployConf(l)
-                link_dst_pfx = l + '/'
-                link_dst_sfx = '.' + r
-            else:
-                conf = DeployConf(link.src)
-                link_dst_pfx = link.src + '/'
-                link_dst_sfx = ''
+    @property
+    def tag(self) -> ta.Type[DeployTag]:
+        return DEPLOY_TAGS_BY_NAME[self.name]
 
-        #
+    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
+        if tags is not None:
+            return tags[self.tag].s
+        else:
+            return DEPLOY_TAG_SIGIL + self.name
 
-        if link.kind == 'current_only':
-            link_dst_mid = str(tags[DeployApp].s)
-        elif link.kind == 'all_active':
-            link_dst_mid = cls._UNIQUE_LINK_NAME.render(tags)
-        else:
-            raise TypeError(link)
 
-        #
+@dc.dataclass(frozen=True)
+class DelimiterDeployPathNamePart(DeployPathNamePart):
+    delimiter: str
 
-        link_dst_name = ''.join([
-            link_dst_pfx,
-            link_dst_mid,
-            link_dst_sfx,
-        ])
-        link_dst = os.path.join(conf_link_dir, link_dst_name)
+    def __post_init__(self) -> None:
+        check.in_(self.delimiter, DEPLOY_TAG_DELIMITERS)
 
-        return DeployConfManager._ComputedConfLink(
-            conf=conf,
-            is_dir=is_dir,
-            link_src=link_src,
-            link_dst=link_dst,
-        )
+    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
+        return self.delimiter
 
-    async def _make_app_conf_link(
-            self,
-            link: DeployAppConfLink,
-            tags: DeployTagMap,
-            app_conf_dir: str,
-            conf_link_dir: str,
-    ) -> None:
-        comp = self._compute_app_conf_link_dst(
-            link,
-            tags,
-            app_conf_dir,
-            conf_link_dir,
-        )
 
-        #
+@dc.dataclass(frozen=True)
+class ConstDeployPathNamePart(DeployPathNamePart):
+    const: str
 
-        check.arg(is_path_in_dir(app_conf_dir, comp.link_src))
-        check.arg(is_path_in_dir(conf_link_dir, comp.link_dst))
+    def __post_init__(self) -> None:
+        check.non_empty_str(self.const)
+        for c in [*DEPLOY_TAG_DELIMITERS, DEPLOY_TAG_SIGIL, '/']:
+            check.not_in(c, self.const)
 
-        if comp.is_dir:
-            check.arg(os.path.isdir(comp.link_src))
-        else:
-            check.arg(os.path.isfile(comp.link_src))
+    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
+        return self.const
 
-        #
 
-        relative_symlink(  # noqa
-            comp.link_src,
-            comp.link_dst,
-            target_is_directory=comp.is_dir,
-            make_dirs=True,
-        )
+@dc.dataclass(frozen=True)
+class DeployPathName(DeployPathRenderable):
+    parts: ta.Sequence[DeployPathNamePart]
 
-    #
+    def __post_init__(self) -> None:
+        hash(self)
+        check.not_empty(self.parts)
+        for k, g in itertools.groupby(self.parts, type):
+            if len(gl := list(g)) > 1:
+                raise DeployPathError(f'May not have consecutive path name part types: {k} {gl}')
 
-    async def write_app_conf(
-            self,
-            spec: DeployAppConfSpec,
-            tags: DeployTagMap,
-            app_conf_dir: str,
-            conf_link_dir: str,
-    ) -> None:
-        for acf in spec.files or []:
-            await self._write_app_conf_file(
-                acf,
-                app_conf_dir,
-            )
+    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
+        return ''.join(p.render(tags) for p in self.parts)
 
-        #
+    @classmethod
+    def parse(cls, s: str) -> 'DeployPathName':
+        check.non_empty_str(s)
+        check.not_in('/', s)
 
-        for link in spec.links or []:
-            await self._make_app_conf_link(
-                link,
-                tags,
-                app_conf_dir,
-                conf_link_dir,
-            )
+        i = 0
+        ps = []
+        while i < len(s):
+            ns = [(n, d) for d in DEPLOY_TAG_DELIMITERS if (n := s.find(d, i)) >= 0]
+            if not ns:
+                ps.append(s[i:])
+                break
+            n, d = min(ns)
+            ps.append(check.non_empty_str(s[i:n]))
+            ps.append(s[n:n + len(d)])
+            i = n + len(d)
 
+        return cls(tuple(DeployPathNamePart.parse(p) for p in ps))
 
-########################################
-# ../deploy/paths/owners.py
 
+##
 
-class DeployPathOwner(abc.ABC):
+
+@dc.dataclass(frozen=True)
+class DeployPathPart(DeployPathRenderable, abc.ABC):  # noqa
+    name: DeployPathName
+
+    @property
     @abc.abstractmethod
-    def get_owned_deploy_paths(self) -> ta.AbstractSet[DeployPath]:
+    def kind(self) -> DeployPathKind:
         raise NotImplementedError
 
+    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
+        return self.name.render(tags) + ('/' if self.kind == 'dir' else '')
 
-DeployPathOwners = ta.NewType('DeployPathOwners', ta.Sequence[DeployPathOwner])
+    @classmethod
+    def parse(cls, s: str) -> 'DeployPathPart':
+        if (is_dir := s.endswith('/')):
+            s = s[:-1]
+        check.non_empty_str(s)
+        check.not_in('/', s)
 
+        n = DeployPathName.parse(s)
+        if is_dir:
+            return DirDeployPathPart(n)
+        else:
+            return FileDeployPathPart(n)
 
-class SingleDirDeployPathOwner(DeployPathOwner, abc.ABC):
-    def __init__(
-            self,
-            *args: ta.Any,
-            owned_dir: str,
-            deploy_home: ta.Optional[DeployHome],
-            **kwargs: ta.Any,
-    ) -> None:
-        super().__init__(*args, **kwargs)
 
-        check.not_in('/', owned_dir)
-        self._owned_dir: str = check.non_empty_str(owned_dir)
+class DirDeployPathPart(DeployPathPart):
+    @property
+    def kind(self) -> DeployPathKind:
+        return 'dir'
 
-        self._deploy_home = deploy_home
 
-        self._owned_deploy_paths = frozenset([DeployPath.parse(self._owned_dir + '/')])
+class FileDeployPathPart(DeployPathPart):
+    @property
+    def kind(self) -> DeployPathKind:
+        return 'file'
 
-    @cached_nullary
-    def _dir(self) -> str:
-        return os.path.join(check.non_empty_str(self._deploy_home), self._owned_dir)
 
-    @cached_nullary
-    def _make_dir(self) -> str:
-        if not os.path.isdir(d := self._dir()):
-            os.makedirs(d, exist_ok=True)
-        return d
+##
 
-    def get_owned_deploy_paths(self) -> ta.AbstractSet[DeployPath]:
-        return self._owned_deploy_paths
 
+@dc.dataclass(frozen=True)
+class DeployPath:
+    parts: ta.Sequence[DeployPathPart]
 
-########################################
-# ../remote/execution.py
-"""
-TODO:
- - sequence all messages
-"""
+    @property
+    def name_parts(self) -> ta.Iterator[DeployPathNamePart]:
+        for p in self.parts:
+            yield from p.name.parts
 
+    def __post_init__(self) -> None:
+        hash(self)
+        check.not_empty(self.parts)
+        for p in self.parts[:-1]:
+            check.equal(p.kind, 'dir')
 
-##
+    @cached_nullary
+    def tag_indices(self) -> ta.Mapping[ta.Type[DeployTag], ta.Sequence[int]]:
+        pd: ta.Dict[ta.Type[DeployTag], ta.List[int]] = {}
+        for i, np in enumerate(self.name_parts):
+            if isinstance(np, TagDeployPathNamePart):
+                pd.setdefault(np.tag, []).append(i)
+        return pd
 
+    @property
+    def kind(self) -> DeployPathKind:
+        return self.parts[-1].kind
 
-class _RemoteProtocol:
-    class Message(abc.ABC):  # noqa
-        async def send(self, chan: RemoteChannel) -> None:
-            await chan.send_obj(self, _RemoteProtocol.Message)
+    def render(self, tags: ta.Optional[DeployTagMap] = None) -> str:
+        return ''.join([p.render(tags) for p in self.parts])
 
-        @classmethod
-        async def recv(cls: ta.Type[T], chan: RemoteChannel) -> ta.Optional[T]:
-            return await chan.recv_obj(cls)
+    @classmethod
+    def parse(cls, s: str) -> 'DeployPath':
+        check.non_empty_str(s)
+        ps = split_keep_delimiter(s, '/')
+        return cls(tuple(DeployPathPart.parse(p) for p in ps))
 
-    #
 
-    class Request(Message, abc.ABC):  # noqa
-        pass
+########################################
+# ../deploy/specs.py
 
-    @dc.dataclass(frozen=True)
-    class CommandRequest(Request):
-        seq: int
-        cmd: Command
 
-    @dc.dataclass(frozen=True)
-    class PingRequest(Request):
-        time: float
+##
 
-    #
 
-    class Response(Message, abc.ABC):  # noqa
-        pass
+def check_valid_deploy_spec_path(s: str) -> str:
+    check.non_empty_str(s)
+    for c in ['..', '//']:
+        check.not_in(c, s)
+    check.arg(not s.startswith('/'))
+    return s
 
-    @dc.dataclass(frozen=True)
-    class LogResponse(Response):
-        s: str
 
-    @dc.dataclass(frozen=True)
-    class CommandResponse(Response):
-        seq: int
-        res: CommandOutputOrExceptionData
+class DeploySpecKeyed(ta.Generic[KeyDeployTagT]):
+    @cached_nullary
+    def _key_str(self) -> str:
+        return hashlib.sha256(repr(self).encode('utf-8')).hexdigest()[:8]
 
-    @dc.dataclass(frozen=True)
-    class PingResponse(Response):
-        time: float
+    @abc.abstractmethod
+    def key(self) -> KeyDeployTagT:
+        raise NotImplementedError
 
 
 ##
 
 
-class _RemoteLogHandler(logging.Handler):
-    def __init__(
-            self,
-            chan: RemoteChannel,
-            loop: ta.Any = None,
-    ) -> None:
-        super().__init__()
+@dc.dataclass(frozen=True)
+class DeployGitRepo:
+    host: ta.Optional[str] = None
+    username: ta.Optional[str] = None
+    path: ta.Optional[str] = None
+
+    def __post_init__(self) -> None:
+        check.not_in('..', check.non_empty_str(self.host))
+        check.not_in('.', check.non_empty_str(self.path))
+
+
+@dc.dataclass(frozen=True)
+class DeployGitSpec:
+    repo: DeployGitRepo
+    rev: DeployRev
+
+    subtrees: ta.Optional[ta.Sequence[str]] = None
+
+    def __post_init__(self) -> None:
+        check.non_empty_str(self.rev)
+        if self.subtrees is not None:
+            for st in self.subtrees:
+                check.non_empty_str(st)
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class DeployVenvSpec:
+    interp: ta.Optional[str] = None
+
+    requirements_files: ta.Optional[ta.Sequence[str]] = None
+    extra_dependencies: ta.Optional[ta.Sequence[str]] = None
+
+    use_uv: bool = False
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class DeployAppConfFile:
+    path: str
+    body: str
+
+    def __post_init__(self) -> None:
+        check_valid_deploy_spec_path(self.path)
+
+
+#
+
+
+@dc.dataclass(frozen=True)
+class DeployAppConfLink:  # noqa
+    """
+    May be either:
+     - @conf(.ext)* - links a single file in root of app conf dir to conf/@conf/@dst(.ext)*
+     - @conf/file - links a single file in a single subdir to conf/@conf/@dst--file
+     - @conf/ - links a directory in root of app conf dir to conf/@conf/@dst/
+    """
+
+    src: str
+
+    kind: ta.Literal['current_only', 'all_active'] = 'current_only'
+
+    def __post_init__(self) -> None:
+        check_valid_deploy_spec_path(self.src)
+        if '/' in self.src:
+            check.equal(self.src.count('/'), 1)
+
+
+#
+
+
+@dc.dataclass(frozen=True)
+class DeployAppConfSpec:
+    files: ta.Optional[ta.Sequence[DeployAppConfFile]] = None
+
+    links: ta.Optional[ta.Sequence[DeployAppConfLink]] = None
+
+    def __post_init__(self) -> None:
+        if self.files:
+            seen: ta.Set[str] = set()
+            for f in self.files:
+                check.not_in(f.path, seen)
+                seen.add(f.path)
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class DeployAppSpec(DeploySpecKeyed[DeployAppKey]):
+    app: DeployApp
+
+    git: DeployGitSpec
+
+    venv: ta.Optional[DeployVenvSpec] = None
+
+    conf: ta.Optional[DeployAppConfSpec] = None
+
+    # @ta.override
+    def key(self) -> DeployAppKey:
+        return DeployAppKey(self._key_str())
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class DeploySpec(DeploySpecKeyed[DeployKey]):
+    home: DeployHome
+
+    apps: ta.Sequence[DeployAppSpec]
+
+    def __post_init__(self) -> None:
+        check.non_empty_str(self.home)
+
+        seen: ta.Set[DeployApp] = set()
+        for a in self.apps:
+            if a.app in seen:
+                raise KeyError(a.app)
+            seen.add(a.app)
+
+    # @ta.override
+    def key(self) -> DeployKey:
+        return DeployKey(self._key_str())
+
+
+########################################
+# ../remote/execution.py
+"""
+TODO:
+ - sequence all messages
+"""
+
+
+##
+
+
+class _RemoteProtocol:
+    class Message(abc.ABC):  # noqa
+        async def send(self, chan: RemoteChannel) -> None:
+            await chan.send_obj(self, _RemoteProtocol.Message)
+
+        @classmethod
+        async def recv(cls: ta.Type[T], chan: RemoteChannel) -> ta.Optional[T]:
+            return await chan.recv_obj(cls)
+
+    #
+
+    class Request(Message, abc.ABC):  # noqa
+        pass
+
+    @dc.dataclass(frozen=True)
+    class CommandRequest(Request):
+        seq: int
+        cmd: Command
+
+    @dc.dataclass(frozen=True)
+    class PingRequest(Request):
+        time: float
+
+    #
+
+    class Response(Message, abc.ABC):  # noqa
+        pass
+
+    @dc.dataclass(frozen=True)
+    class LogResponse(Response):
+        s: str
+
+    @dc.dataclass(frozen=True)
+    class CommandResponse(Response):
+        seq: int
+        res: CommandOutputOrExceptionData
+
+    @dc.dataclass(frozen=True)
+    class PingResponse(Response):
+        time: float
+
+
+##
+
+
+class _RemoteLogHandler(logging.Handler):
+    def __init__(
+            self,
+            chan: RemoteChannel,
+            loop: ta.Any = None,
+    ) -> None:
+        super().__init__()
 
         self._chan = chan
         self._loop = loop
@@ -8874,236 +8690,212 @@ class SubprocessCommandExecutor(CommandExecutor[SubprocessCommand, SubprocessCom
 
 
 ########################################
-# ../deploy/git.py
+# ../deploy/conf.py
 """
 TODO:
- - 'repos'?
-
-git/github.com/wrmsr/omlish <- bootstrap repo
- - shallow clone off bootstrap into /apps
-
-github.com/wrmsr/omlish@rev
+ - @conf DeployPathPlaceholder? :|
+ - post-deploy: remove any dir_links not present in new spec
+  - * only if succeeded * - otherwise, remove any dir_links present in new spec but not previously present?
+   - no such thing as 'previously present'.. build a 'deploy state' and pass it back?
+ - ** whole thing can be atomic **
+  - 1) new atomic temp dir
+  - 2) for each subdir not needing modification, hardlink into temp dir
+  - 3) for each subdir needing modification, new subdir, hardlink all files not needing modification
+  - 4) write (or if deleting, omit) new files
+  - 5) swap top level
+ - ** whole deploy can be atomic(-ish) - do this for everything **
+  - just a '/deploy/current' dir
+  - some things (venvs) cannot be moved, thus the /deploy/venvs dir
+  - ** ensure (enforce) equivalent relpath nesting
 """
 
 
-##
-
-
-class DeployGitManager(SingleDirDeployPathOwner):
-    def __init__(
+class DeployConfManager:
+    async def _write_app_conf_file(
             self,
-            *,
-            deploy_home: ta.Optional[DeployHome] = None,
-            atomics: AtomicPathSwapping,
+            acf: DeployAppConfFile,
+            app_conf_dir: str,
     ) -> None:
-        super().__init__(
-            owned_dir='git',
-            deploy_home=deploy_home,
-        )
+        conf_file = os.path.join(app_conf_dir, acf.path)
+        check.arg(is_path_in_dir(app_conf_dir, conf_file))
 
-        self._atomics = atomics
+        os.makedirs(os.path.dirname(conf_file), exist_ok=True)
 
-        self._repo_dirs: ta.Dict[DeployGitRepo, DeployGitManager.RepoDir] = {}
+        with open(conf_file, 'w') as f:  # noqa
+            f.write(acf.body)
 
-    class RepoDir:
-        def __init__(
-                self,
-                git: 'DeployGitManager',
-                repo: DeployGitRepo,
-        ) -> None:
-            super().__init__()
+    #
 
-            self._git = git
-            self._repo = repo
-            self._dir = os.path.join(
-                self._git._make_dir(),  # noqa
-                check.non_empty_str(repo.host),
-                check.non_empty_str(repo.path),
-            )
+    class _ComputedConfLink(ta.NamedTuple):
+        conf: DeployConf
+        is_dir: bool
+        link_src: str
+        link_dst: str
 
-        @property
-        def repo(self) -> DeployGitRepo:
-            return self._repo
+    _UNIQUE_LINK_NAME_STR = '@app--@time--@app-key'
+    _UNIQUE_LINK_NAME = DeployPath.parse(_UNIQUE_LINK_NAME_STR)
 
-        @property
-        def url(self) -> str:
-            if self._repo.username is not None:
-                return f'{self._repo.username}@{self._repo.host}:{self._repo.path}'
-            else:
-                return f'https://{self._repo.host}/{self._repo.path}'
-
-        #
-
-        async def _call(self, *cmd: str) -> None:
-            await asyncio_subprocesses.check_call(
-                *cmd,
-                cwd=self._dir,
-            )
+    @classmethod
+    def _compute_app_conf_link_dst(
+            cls,
+            link: DeployAppConfLink,
+            tags: DeployTagMap,
+            app_conf_dir: str,
+            conf_link_dir: str,
+    ) -> _ComputedConfLink:
+        link_src = os.path.join(app_conf_dir, link.src)
+        check.arg(is_path_in_dir(app_conf_dir, link_src))
 
         #
 
-        @async_cached_nullary
-        async def init(self) -> None:
-            os.makedirs(self._dir, exist_ok=True)
-            if os.path.exists(os.path.join(self._dir, '.git')):
-                return
+        if (is_dir := link.src.endswith('/')):
+            # @conf/ - links a directory in root of app conf dir to conf/@conf/@dst/
+            check.arg(link.src.count('/') == 1)
+            conf = DeployConf(link.src.split('/')[0])
+            link_dst_pfx = link.src
+            link_dst_sfx = ''
 
-            await self._call('git', 'init')
-            await self._call('git', 'remote', 'add', 'origin', self.url)
+        elif '/' in link.src:
+            # @conf/file - links a single file in a single subdir to conf/@conf/@dst--file
+            d, f = os.path.split(link.src)
+            # TODO: check filename :|
+            conf = DeployConf(d)
+            link_dst_pfx = d + '/'
+            link_dst_sfx = DEPLOY_TAG_SEPARATOR + f
 
-        async def fetch(self, rev: DeployRev) -> None:
-            await self.init()
-            await self._call('git', 'fetch', '--depth=1', 'origin', rev)
+        else:  # noqa
+            # @conf(.ext)* - links a single file in root of app conf dir to conf/@conf/@dst(.ext)*
+            if '.' in link.src:
+                l, _, r = link.src.partition('.')
+                conf = DeployConf(l)
+                link_dst_pfx = l + '/'
+                link_dst_sfx = '.' + r
+            else:
+                conf = DeployConf(link.src)
+                link_dst_pfx = link.src + '/'
+                link_dst_sfx = ''
 
         #
 
-        async def checkout(self, spec: DeployGitSpec, dst_dir: str) -> None:
-            check.state(not os.path.exists(dst_dir))
-            with self._git._atomics.begin_atomic_path_swap(  # noqa
-                    'dir',
-                    dst_dir,
-                    auto_commit=True,
-                    make_dirs=True,
-            ) as dst_swap:
-                await self.fetch(spec.rev)
-
-                dst_call = functools.partial(asyncio_subprocesses.check_call, cwd=dst_swap.tmp_path)
-                await dst_call('git', 'init')
-
-                await dst_call('git', 'remote', 'add', 'local', self._dir)
-                await dst_call('git', 'fetch', '--depth=1', 'local', spec.rev)
-                await dst_call('git', 'checkout', spec.rev, *(spec.subtrees or []))
-
-    def get_repo_dir(self, repo: DeployGitRepo) -> RepoDir:
-        try:
-            return self._repo_dirs[repo]
-        except KeyError:
-            repo_dir = self._repo_dirs[repo] = DeployGitManager.RepoDir(self, repo)
-            return repo_dir
-
-    async def checkout(
-            self,
-            spec: DeployGitSpec,
-            dst_dir: str,
-    ) -> None:
-        await self.get_repo_dir(spec.repo).checkout(spec, dst_dir)
+        if link.kind == 'current_only':
+            link_dst_mid = str(tags[DeployApp].s)
+        elif link.kind == 'all_active':
+            link_dst_mid = cls._UNIQUE_LINK_NAME.render(tags)
+        else:
+            raise TypeError(link)
 
+        #
 
-########################################
-# ../deploy/paths/manager.py
+        link_dst_name = ''.join([
+            link_dst_pfx,
+            link_dst_mid,
+            link_dst_sfx,
+        ])
+        link_dst = os.path.join(conf_link_dir, link_dst_name)
 
+        return DeployConfManager._ComputedConfLink(
+            conf=conf,
+            is_dir=is_dir,
+            link_src=link_src,
+            link_dst=link_dst,
+        )
 
-class DeployPathsManager:
-    def __init__(
+    async def _make_app_conf_link(
             self,
-            *,
-            deploy_home: ta.Optional[DeployHome],
-            deploy_path_owners: DeployPathOwners,
+            link: DeployAppConfLink,
+            tags: DeployTagMap,
+            app_conf_dir: str,
+            conf_link_dir: str,
     ) -> None:
-        super().__init__()
+        comp = self._compute_app_conf_link_dst(
+            link,
+            tags,
+            app_conf_dir,
+            conf_link_dir,
+        )
 
-        self._deploy_home = deploy_home
-        self._deploy_path_owners = deploy_path_owners
+        #
 
-    @cached_nullary
-    def owners_by_path(self) -> ta.Mapping[DeployPath, DeployPathOwner]:
-        dct: ta.Dict[DeployPath, DeployPathOwner] = {}
-        for o in self._deploy_path_owners:
-            for p in o.get_owned_deploy_paths():
-                if p in dct:
-                    raise DeployPathError(f'Duplicate deploy path owner: {p}')
-                dct[p] = o
-        return dct
+        check.arg(is_path_in_dir(app_conf_dir, comp.link_src))
+        check.arg(is_path_in_dir(conf_link_dir, comp.link_dst))
 
-    def validate_deploy_paths(self) -> None:
-        self.owners_by_path()
+        if comp.is_dir:
+            check.arg(os.path.isdir(comp.link_src))
+        else:
+            check.arg(os.path.isfile(comp.link_src))
 
+        #
 
-########################################
-# ../deploy/tmp.py
+        relative_symlink(  # noqa
+            comp.link_src,
+            comp.link_dst,
+            target_is_directory=comp.is_dir,
+            make_dirs=True,
+        )
 
+    #
 
-class DeployTmpManager(
-    SingleDirDeployPathOwner,
-    AtomicPathSwapping,
-):
-    def __init__(
+    async def write_app_conf(
             self,
-            *,
-            deploy_home: ta.Optional[DeployHome] = None,
+            spec: DeployAppConfSpec,
+            tags: DeployTagMap,
+            app_conf_dir: str,
+            conf_link_dir: str,
     ) -> None:
-        super().__init__(
-            owned_dir='tmp',
-            deploy_home=deploy_home,
-        )
+        for acf in spec.files or []:
+            await self._write_app_conf_file(
+                acf,
+                app_conf_dir,
+            )
 
-    @cached_nullary
-    def _swapping(self) -> AtomicPathSwapping:
-        return TempDirAtomicPathSwapping(
-            temp_dir=self._make_dir(),
-            root_dir=check.non_empty_str(self._deploy_home),
-        )
+        #
 
-    def begin_atomic_path_swap(
-            self,
-            kind: AtomicPathSwapKind,
-            dst_path: str,
-            **kwargs: ta.Any,
-    ) -> AtomicPathSwap:
-        return self._swapping().begin_atomic_path_swap(
-            kind,
-            dst_path,
-            **kwargs,
-        )
+        for link in spec.links or []:
+            await self._make_app_conf_link(
+                link,
+                tags,
+                app_conf_dir,
+                conf_link_dir,
+            )
 
 
 ########################################
-# ../deploy/venvs.py
-"""
-TODO:
- - interp
- - share more code with pyproject?
-"""
+# ../deploy/paths/owners.py
 
 
-class DeployVenvManager:
-    def __init__(
-            self,
-            *,
-            atomics: AtomicPathSwapping,
-    ) -> None:
-        super().__init__()
+class DeployPathOwner(abc.ABC):
+    @abc.abstractmethod
+    def get_owned_deploy_paths(self) -> ta.AbstractSet[DeployPath]:
+        raise NotImplementedError
 
-        self._atomics = atomics
 
-    async def setup_venv(
-            self,
-            spec: DeployVenvSpec,
-            git_dir: str,
-            venv_dir: str,
-    ) -> None:
-        sys_exe = 'python3'
+DeployPathOwners = ta.NewType('DeployPathOwners', ta.Sequence[DeployPathOwner])
 
-        # !! NOTE: (most) venvs cannot be relocated, so an atomic swap can't be used. it's up to the path manager to
-        # garbage collect orphaned dirs.
-        await asyncio_subprocesses.check_call(sys_exe, '-m', 'venv', venv_dir)
 
-        #
+class SingleDirDeployPathOwner(DeployPathOwner, abc.ABC):
+    def __init__(
+            self,
+            *args: ta.Any,
+            owned_dir: str,
+            **kwargs: ta.Any,
+    ) -> None:
+        super().__init__(*args, **kwargs)
 
-        venv_exe = os.path.join(venv_dir, 'bin', 'python3')
+        check.not_in('/', owned_dir)
+        self._owned_dir: str = check.non_empty_str(owned_dir)
 
-        #
+        self._owned_deploy_paths = frozenset([DeployPath.parse(self._owned_dir + '/')])
 
-        reqs_txt = os.path.join(git_dir, 'requirements.txt')
+    def _dir(self, home: DeployHome) -> str:
+        return os.path.join(check.non_empty_str(home), self._owned_dir)
 
-        if os.path.isfile(reqs_txt):
-            if spec.use_uv:
-                await asyncio_subprocesses.check_call(venv_exe, '-m', 'pip', 'install', 'uv')
-                pip_cmd = ['-m', 'uv', 'pip']
-            else:
-                pip_cmd = ['-m', 'pip']
+    def _make_dir(self, home: DeployHome) -> str:
+        if not os.path.isdir(d := self._dir(home)):
+            os.makedirs(d, exist_ok=True)
+        return d
 
-            await asyncio_subprocesses.check_call(venv_exe, *pip_cmd,'install', '-r', reqs_txt)
+    def get_owned_deploy_paths(self) -> ta.AbstractSet[DeployPath]:
+        return self._owned_deploy_paths
 
 
 ########################################
@@ -9639,183 +9431,55 @@ def bind_commands(
 
 
 ########################################
-# ../deploy/apps.py
+# ../deploy/paths/manager.py
 
 
-class DeployAppManager(DeployPathOwner):
+class DeployPathsManager:
     def __init__(
             self,
             *,
-            deploy_home: ta.Optional[DeployHome] = None,
-
-            conf: DeployConfManager,
-            git: DeployGitManager,
-            venvs: DeployVenvManager,
+            deploy_path_owners: DeployPathOwners,
     ) -> None:
         super().__init__()
 
-        self._deploy_home = deploy_home
-
-        self._conf = conf
-        self._git = git
-        self._venvs = venvs
-
-    #
-
-    _APP_DIR_STR = 'apps/@app/@time--@app-rev--@app-key/'
-    _APP_DIR = DeployPath.parse(_APP_DIR_STR)
-
-    _DEPLOY_DIR_STR = 'deploys/@time--@deploy-key/'
-    _DEPLOY_DIR = DeployPath.parse(_DEPLOY_DIR_STR)
-
-    _APP_DEPLOY_LINK = DeployPath.parse(f'{_DEPLOY_DIR_STR}apps/@app')
-    _CONF_DEPLOY_DIR = DeployPath.parse(f'{_DEPLOY_DIR_STR}conf/@conf/')
+        self._deploy_path_owners = deploy_path_owners
 
     @cached_nullary
-    def get_owned_deploy_paths(self) -> ta.AbstractSet[DeployPath]:
-        return {
-            self._APP_DIR,
-
-            self._DEPLOY_DIR,
-
-            self._APP_DEPLOY_LINK,
-            self._CONF_DEPLOY_DIR,
-
-            *[
-                DeployPath.parse(f'{self._APP_DIR_STR}{sfx}/')
-                for sfx in [
-                    'conf',
-                    'git',
-                    'venv',
-                ]
-            ],
-        }
-
-    #
-
-    async def prepare_app(
-            self,
-            spec: DeployAppSpec,
-            tags: DeployTagMap,
-    ) -> None:
-        deploy_home = check.non_empty_str(self._deploy_home)
+    def owners_by_path(self) -> ta.Mapping[DeployPath, DeployPathOwner]:
+        dct: ta.Dict[DeployPath, DeployPathOwner] = {}
+        for o in self._deploy_path_owners:
+            for p in o.get_owned_deploy_paths():
+                if p in dct:
+                    raise DeployPathError(f'Duplicate deploy path owner: {p}')
+                dct[p] = o
+        return dct
 
-        def build_path(pth: DeployPath) -> str:
-            return os.path.join(deploy_home, pth.render(tags))
+    def validate_deploy_paths(self) -> None:
+        self.owners_by_path()
 
-        app_dir = build_path(self._APP_DIR)
-        deploy_dir = build_path(self._DEPLOY_DIR)
-        app_deploy_link = build_path(self._APP_DEPLOY_LINK)
 
-        #
+########################################
+# ../deploy/tmp.py
 
-        os.makedirs(deploy_dir, exist_ok=True)
 
-        deploying_link = os.path.join(deploy_home, 'deploys/deploying')
-        relative_symlink(
-            deploy_dir,
-            deploying_link,
-            target_is_directory=True,
-            make_dirs=True,
-        )
+class DeployHomeAtomics(Func1[DeployHome, AtomicPathSwapping]):
+    pass
 
-        #
 
-        os.makedirs(app_dir)
-        relative_symlink(
-            app_dir,
-            app_deploy_link,
-            target_is_directory=True,
-            make_dirs=True,
+class DeployTmpManager(
+    SingleDirDeployPathOwner,
+):
+    def __init__(self) -> None:
+        super().__init__(
+            owned_dir='tmp',
         )
 
-        #
-
-        deploy_conf_dir = os.path.join(deploy_dir, 'conf')
-        os.makedirs(deploy_conf_dir, exist_ok=True)
-
-        #
-
-        # def mirror_symlinks(src: str, dst: str) -> None:
-        #     def mirror_link(lp: str) -> None:
-        #         check.state(os.path.islink(lp))
-        #         shutil.copy2(
-        #             lp,
-        #             os.path.join(dst, os.path.relpath(lp, src)),
-        #             follow_symlinks=False,
-        #         )
-        #
-        #     for dp, dns, fns in os.walk(src, followlinks=False):
-        #         for fn in fns:
-        #             mirror_link(os.path.join(dp, fn))
-        #
-        #         for dn in dns:
-        #             dp2 = os.path.join(dp, dn)
-        #             if os.path.islink(dp2):
-        #                 mirror_link(dp2)
-        #             else:
-        #                 os.makedirs(os.path.join(dst, os.path.relpath(dp2, src)))
-
-        current_link = os.path.join(deploy_home, 'deploys/current')
-
-        # if os.path.exists(current_link):
-        #     mirror_symlinks(
-        #         os.path.join(current_link, 'conf'),
-        #         conf_tag_dir,
-        #     )
-        #     mirror_symlinks(
-        #         os.path.join(current_link, 'apps'),
-        #         os.path.join(deploy_dir, 'apps'),
-        #     )
-
-        #
-
-        app_git_dir = os.path.join(app_dir, 'git')
-        await self._git.checkout(
-            spec.git,
-            app_git_dir,
+    def get_swapping(self, home: DeployHome) -> AtomicPathSwapping:
+        return TempDirAtomicPathSwapping(
+            temp_dir=self._make_dir(home),
+            root_dir=check.non_empty_str(home),
         )
 
-        #
-
-        if spec.venv is not None:
-            app_venv_dir = os.path.join(app_dir, 'venv')
-            await self._venvs.setup_venv(
-                spec.venv,
-                app_git_dir,
-                app_venv_dir,
-            )
-
-        #
-
-        if spec.conf is not None:
-            app_conf_dir = os.path.join(app_dir, 'conf')
-            await self._conf.write_app_conf(
-                spec.conf,
-                tags,
-                app_conf_dir,
-                deploy_conf_dir,
-            )
-
-        #
-
-        os.replace(deploying_link, current_link)
-
-
-########################################
-# ../deploy/paths/inject.py
-
-
-def bind_deploy_paths() -> InjectorBindings:
-    lst: ta.List[InjectorBindingOrBindings] = [
-        inj.bind_array(DeployPathOwner),
-        inj.bind_array_type(DeployPathOwner, DeployPathOwners),
-
-        inj.bind(DeployPathsManager, singleton=True),
-    ]
-
-    return inj.as_bindings(*lst)
-
 
 ########################################
 # ../remote/connection.py
@@ -10272,11 +9936,11 @@ class PyenvVersionInstaller:
             full_args = [
                 os.path.join(check.not_none(await self._pyenv.root()), 'plugins', 'python-build', 'bin', 'python-build'),  # noqa
                 *conf_args,
-                self.install_dir(),
+                await self.install_dir(),
             ]
         else:
             full_args = [
-                self._pyenv.exe(),
+                await self._pyenv.exe(),
                 'install',
                 *conf_args,
             ]
@@ -10532,90 +10196,489 @@ class SystemInterpProvider(InterpProvider):
 
 
 ########################################
-# ../deploy/deploy.py
+# ../deploy/git.py
+"""
+TODO:
+ - 'repos'?
 
+git/github.com/wrmsr/omlish <- bootstrap repo
+ - shallow clone off bootstrap into /apps
 
-DEPLOY_TAG_DATETIME_FMT = '%Y%m%dT%H%M%SZ'
+github.com/wrmsr/omlish@rev
+"""
 
 
-DeployManagerUtcClock = ta.NewType('DeployManagerUtcClock', Func0[datetime.datetime])
+##
 
 
-class DeployManager:
+class DeployGitManager(SingleDirDeployPathOwner):
     def __init__(
             self,
             *,
-            apps: DeployAppManager,
-            paths: DeployPathsManager,
+            atomics: DeployHomeAtomics,
+    ) -> None:
+        super().__init__(
+            owned_dir='git',
+        )
 
-            utc_clock: ta.Optional[DeployManagerUtcClock] = None,
-    ):
-        super().__init__()
+        self._atomics = atomics
 
-        self._apps = apps
-        self._paths = paths
+        self._repo_dirs: ta.Dict[DeployGitRepo, DeployGitManager.RepoDir] = {}
 
-        self._utc_clock = utc_clock
+    class RepoDir:
+        def __init__(
+                self,
+                git: 'DeployGitManager',
+                repo: DeployGitRepo,
+                home: DeployHome,
+        ) -> None:
+            super().__init__()
 
-    def _utc_now(self) -> datetime.datetime:
-        if self._utc_clock is not None:
-            return self._utc_clock()  # noqa
-        else:
-            return datetime.datetime.now(tz=datetime.timezone.utc)  # noqa
+            self._git = git
+            self._repo = repo
+            self._home = home
+            self._dir = os.path.join(
+                self._git._make_dir(home),  # noqa
+                check.non_empty_str(repo.host),
+                check.non_empty_str(repo.path),
+            )
 
-    def _make_deploy_time(self) -> DeployTime:
-        return DeployTime(self._utc_now().strftime(DEPLOY_TAG_DATETIME_FMT))
+        @property
+        def repo(self) -> DeployGitRepo:
+            return self._repo
 
-    async def run_deploy(
-            self,
-            spec: DeploySpec,
-    ) -> None:
-        self._paths.validate_deploy_paths()
+        @property
+        def url(self) -> str:
+            if self._repo.username is not None:
+                return f'{self._repo.username}@{self._repo.host}:{self._repo.path}'
+            else:
+                return f'https://{self._repo.host}/{self._repo.path}'
 
         #
 
-        deploy_tags = DeployTagMap(
-            self._make_deploy_time(),
-            spec.key(),
-        )
+        async def _call(self, *cmd: str) -> None:
+            await asyncio_subprocesses.check_call(
+                *cmd,
+                cwd=self._dir,
+            )
 
         #
 
-        for app in spec.apps:
-            app_tags = deploy_tags.add(
-                app.app,
-                app.key(),
-                DeployAppRev(app.git.rev),
-            )
-
-            await self._apps.prepare_app(
-                app,
-                app_tags,
-            )
+        @async_cached_nullary
+        async def init(self) -> None:
+            os.makedirs(self._dir, exist_ok=True)
+            if os.path.exists(os.path.join(self._dir, '.git')):
+                return
 
+            await self._call('git', 'init')
+            await self._call('git', 'remote', 'add', 'origin', self.url)
 
-########################################
-# ../remote/inject.py
+        async def fetch(self, rev: DeployRev) -> None:
+            await self.init()
+            await self._call('git', 'fetch', '--depth=1', 'origin', rev)
 
+        #
 
-def bind_remote(
-        *,
-        remote_config: RemoteConfig,
-) -> InjectorBindings:
+        async def checkout(self, spec: DeployGitSpec, dst_dir: str) -> None:
+            check.state(not os.path.exists(dst_dir))
+            with self._git._atomics(self._home).begin_atomic_path_swap(  # noqa
+                    'dir',
+                    dst_dir,
+                    auto_commit=True,
+                    make_dirs=True,
+            ) as dst_swap:
+                await self.fetch(spec.rev)
+
+                dst_call = functools.partial(asyncio_subprocesses.check_call, cwd=dst_swap.tmp_path)
+                await dst_call('git', 'init')
+
+                await dst_call('git', 'remote', 'add', 'local', self._dir)
+                await dst_call('git', 'fetch', '--depth=1', 'local', spec.rev)
+                await dst_call('git', 'checkout', spec.rev, *(spec.subtrees or []))
+
+    def get_repo_dir(
+            self,
+            repo: DeployGitRepo,
+            home: DeployHome,
+    ) -> RepoDir:
+        try:
+            return self._repo_dirs[repo]
+        except KeyError:
+            repo_dir = self._repo_dirs[repo] = DeployGitManager.RepoDir(
+                self,
+                repo,
+                home,
+            )
+            return repo_dir
+
+    async def checkout(
+            self,
+            spec: DeployGitSpec,
+            home: DeployHome,
+            dst_dir: str,
+    ) -> None:
+        await self.get_repo_dir(
+            spec.repo,
+            home,
+        ).checkout(
+            spec,
+            dst_dir,
+        )
+
+
+########################################
+# ../deploy/paths/inject.py
+
+
+def bind_deploy_paths() -> InjectorBindings:
+    lst: ta.List[InjectorBindingOrBindings] = [
+        inj.bind_array(DeployPathOwner),
+        inj.bind_array_type(DeployPathOwner, DeployPathOwners),
+
+        inj.bind(DeployPathsManager, singleton=True),
+    ]
+
+    return inj.as_bindings(*lst)
+
+
+########################################
+# ../remote/inject.py
+
+
+def bind_remote(
+        *,
+        remote_config: RemoteConfig,
+) -> InjectorBindings:
     lst: ta.List[InjectorBindingOrBindings] = [
         inj.bind(remote_config),
 
         inj.bind(SubprocessRemoteSpawning, singleton=True),
         inj.bind(RemoteSpawning, to_key=SubprocessRemoteSpawning),
 
-        inj.bind(PyremoteRemoteExecutionConnector, singleton=True),
-        inj.bind(InProcessRemoteExecutionConnector, singleton=True),
+        inj.bind(PyremoteRemoteExecutionConnector, singleton=True),
+        inj.bind(InProcessRemoteExecutionConnector, singleton=True),
+    ]
+
+    #
+
+    if (pf := remote_config.payload_file) is not None:
+        lst.append(inj.bind(pf, key=RemoteExecutionPayloadFile))
+
+    #
+
+    return inj.as_bindings(*lst)
+
+
+########################################
+# ../system/inject.py
+
+
+def bind_system(
+        *,
+        system_config: SystemConfig,
+) -> InjectorBindings:
+    lst: ta.List[InjectorBindingOrBindings] = [
+        inj.bind(system_config),
+    ]
+
+    #
+
+    platform = system_config.platform or detect_system_platform()
+    lst.append(inj.bind(platform, key=Platform))
+
+    #
+
+    if isinstance(platform, AmazonLinuxPlatform):
+        lst.extend([
+            inj.bind(YumSystemPackageManager, singleton=True),
+            inj.bind(SystemPackageManager, to_key=YumSystemPackageManager),
+        ])
+
+    elif isinstance(platform, LinuxPlatform):
+        lst.extend([
+            inj.bind(AptSystemPackageManager, singleton=True),
+            inj.bind(SystemPackageManager, to_key=AptSystemPackageManager),
+        ])
+
+    elif isinstance(platform, DarwinPlatform):
+        lst.extend([
+            inj.bind(BrewSystemPackageManager, singleton=True),
+            inj.bind(SystemPackageManager, to_key=BrewSystemPackageManager),
+        ])
+
+    #
+
+    lst.extend([
+        bind_command(CheckSystemPackageCommand, CheckSystemPackageCommandExecutor),
+    ])
+
+    #
+
+    return inj.as_bindings(*lst)
+
+
+########################################
+# ../targets/connection.py
+
+
+##
+
+
+class ManageTargetConnector(abc.ABC):
+    @abc.abstractmethod
+    def connect(self, tgt: ManageTarget) -> ta.AsyncContextManager[CommandExecutor]:
+        raise NotImplementedError
+
+    def _default_python(self, python: ta.Optional[ta.Sequence[str]]) -> ta.Sequence[str]:
+        check.not_isinstance(python, str)
+        if python is not None:
+            return python
+        else:
+            return ['sh', '-c', get_best_python_sh(), '--']
+
+
+##
+
+
+ManageTargetConnectorMap = ta.NewType('ManageTargetConnectorMap', ta.Mapping[ta.Type[ManageTarget], ManageTargetConnector])  # noqa
+
+
+@dc.dataclass(frozen=True)
+class TypeSwitchedManageTargetConnector(ManageTargetConnector):
+    connectors: ManageTargetConnectorMap
+
+    def get_connector(self, ty: ta.Type[ManageTarget]) -> ManageTargetConnector:
+        for k, v in self.connectors.items():
+            if issubclass(ty, k):
+                return v
+        raise KeyError(ty)
+
+    def connect(self, tgt: ManageTarget) -> ta.AsyncContextManager[CommandExecutor]:
+        return self.get_connector(type(tgt)).connect(tgt)
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class LocalManageTargetConnector(ManageTargetConnector):
+    _local_executor: LocalCommandExecutor
+    _in_process_connector: InProcessRemoteExecutionConnector
+    _pyremote_connector: PyremoteRemoteExecutionConnector
+    _bootstrap: MainBootstrap
+
+    @contextlib.asynccontextmanager
+    async def connect(self, tgt: ManageTarget) -> ta.AsyncGenerator[CommandExecutor, None]:
+        lmt = check.isinstance(tgt, LocalManageTarget)
+
+        if isinstance(lmt, InProcessManageTarget):
+            imt = check.isinstance(lmt, InProcessManageTarget)
+
+            if imt.mode == InProcessManageTarget.Mode.DIRECT:
+                yield self._local_executor
+
+            elif imt.mode == InProcessManageTarget.Mode.FAKE_REMOTE:
+                async with self._in_process_connector.connect() as rce:
+                    yield rce
+
+            else:
+                raise TypeError(imt.mode)
+
+        elif isinstance(lmt, SubprocessManageTarget):
+            async with self._pyremote_connector.connect(
+                    RemoteSpawning.Target(
+                        python=self._default_python(lmt.python),
+                    ),
+                    self._bootstrap,
+            ) as rce:
+                yield rce
+
+        else:
+            raise TypeError(lmt)
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class DockerManageTargetConnector(ManageTargetConnector):
+    _pyremote_connector: PyremoteRemoteExecutionConnector
+    _bootstrap: MainBootstrap
+
+    @contextlib.asynccontextmanager
+    async def connect(self, tgt: ManageTarget) -> ta.AsyncGenerator[CommandExecutor, None]:
+        dmt = check.isinstance(tgt, DockerManageTarget)
+
+        sh_parts: ta.List[str] = ['docker']
+        if dmt.image is not None:
+            sh_parts.extend(['run', '-i', dmt.image])
+        elif dmt.container_id is not None:
+            sh_parts.extend(['exec', '-i', dmt.container_id])
+        else:
+            raise ValueError(dmt)
+
+        async with self._pyremote_connector.connect(
+                RemoteSpawning.Target(
+                    shell=' '.join(sh_parts),
+                    python=self._default_python(dmt.python),
+                ),
+                self._bootstrap,
+        ) as rce:
+            yield rce
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class SshManageTargetConnector(ManageTargetConnector):
+    _pyremote_connector: PyremoteRemoteExecutionConnector
+    _bootstrap: MainBootstrap
+
+    @contextlib.asynccontextmanager
+    async def connect(self, tgt: ManageTarget) -> ta.AsyncGenerator[CommandExecutor, None]:
+        smt = check.isinstance(tgt, SshManageTarget)
+
+        sh_parts: ta.List[str] = ['ssh']
+        if smt.key_file is not None:
+            sh_parts.extend(['-i', smt.key_file])
+        addr = check.not_none(smt.host)
+        if smt.username is not None:
+            addr = f'{smt.username}@{addr}'
+        sh_parts.append(addr)
+
+        async with self._pyremote_connector.connect(
+                RemoteSpawning.Target(
+                    shell=' '.join(sh_parts),
+                    shell_quote=True,
+                    python=self._default_python(smt.python),
+                ),
+                self._bootstrap,
+        ) as rce:
+            yield rce
+
+
+########################################
+# ../../../omdev/interp/resolvers.py
+
+
+INTERP_PROVIDER_TYPES_BY_NAME: ta.Mapping[str, ta.Type[InterpProvider]] = {
+    cls.name: cls for cls in deep_subclasses(InterpProvider) if abc.ABC not in cls.__bases__  # type: ignore
+}
+
+
+class InterpResolver:
+    def __init__(
+            self,
+            providers: ta.Sequence[ta.Tuple[str, InterpProvider]],
+    ) -> None:
+        super().__init__()
+
+        self._providers: ta.Mapping[str, InterpProvider] = collections.OrderedDict(providers)
+
+    async def _resolve_installed(self, spec: InterpSpecifier) -> ta.Optional[ta.Tuple[InterpProvider, InterpVersion]]:
+        lst = [
+            (i, si)
+            for i, p in enumerate(self._providers.values())
+            for si in await p.get_installed_versions(spec)
+            if spec.contains(si)
+        ]
+
+        slst = sorted(lst, key=lambda t: (-t[0], t[1].version))
+        if not slst:
+            return None
+
+        bi, bv = slst[-1]
+        bp = list(self._providers.values())[bi]
+        return (bp, bv)
+
+    async def resolve(
+            self,
+            spec: InterpSpecifier,
+            *,
+            install: bool = False,
+    ) -> ta.Optional[Interp]:
+        tup = await self._resolve_installed(spec)
+        if tup is not None:
+            bp, bv = tup
+            return await bp.get_installed_version(bv)
+
+        if not install:
+            return None
+
+        tp = list(self._providers.values())[0]  # noqa
+
+        sv = sorted(
+            [s for s in await tp.get_installable_versions(spec) if s in spec],
+            key=lambda s: s.version,
+        )
+        if not sv:
+            return None
+
+        bv = sv[-1]
+        return await tp.install_version(bv)
+
+    async def list(self, spec: InterpSpecifier) -> None:
+        print('installed:')
+        for n, p in self._providers.items():
+            lst = [
+                si
+                for si in await p.get_installed_versions(spec)
+                if spec.contains(si)
+            ]
+            if lst:
+                print(f'  {n}')
+                for si in lst:
+                    print(f'    {si}')
+
+        print()
+
+        print('installable:')
+        for n, p in self._providers.items():
+            lst = [
+                si
+                for si in await p.get_installable_versions(spec)
+                if spec.contains(si)
+            ]
+            if lst:
+                print(f'  {n}')
+                for si in lst:
+                    print(f'    {si}')
+
+
+DEFAULT_INTERP_RESOLVER = InterpResolver([(p.name, p) for p in [
+    # pyenv is preferred to system interpreters as it tends to have more support for things like tkinter
+    PyenvInterpProvider(try_update=True),
+
+    RunningInterpProvider(),
+
+    SystemInterpProvider(),
+]])
+
+
+########################################
+# ../targets/inject.py
+
+
+def bind_targets() -> InjectorBindings:
+    lst: ta.List[InjectorBindingOrBindings] = [
+        inj.bind(LocalManageTargetConnector, singleton=True),
+        inj.bind(DockerManageTargetConnector, singleton=True),
+        inj.bind(SshManageTargetConnector, singleton=True),
+
+        inj.bind(TypeSwitchedManageTargetConnector, singleton=True),
+        inj.bind(ManageTargetConnector, to_key=TypeSwitchedManageTargetConnector),
     ]
 
     #
 
-    if (pf := remote_config.payload_file) is not None:
-        lst.append(inj.bind(pf, key=RemoteExecutionPayloadFile))
+    def provide_manage_target_connector_map(injector: Injector) -> ManageTargetConnectorMap:
+        return ManageTargetConnectorMap({
+            LocalManageTarget: injector[LocalManageTargetConnector],
+            DockerManageTarget: injector[DockerManageTargetConnector],
+            SshManageTarget: injector[SshManageTargetConnector],
+        })
+    lst.append(inj.bind(provide_manage_target_connector_map, singleton=True))
 
     #
 
@@ -10623,290 +10686,319 @@ def bind_remote(
 
 
 ########################################
-# ../system/inject.py
+# ../deploy/interp.py
 
 
-def bind_system(
-        *,
-        system_config: SystemConfig,
-) -> InjectorBindings:
-    lst: ta.List[InjectorBindingOrBindings] = [
-        inj.bind(system_config),
-    ]
+##
 
-    #
 
-    platform = system_config.platform or detect_system_platform()
-    lst.append(inj.bind(platform, key=Platform))
+@dc.dataclass(frozen=True)
+class InterpCommand(Command['InterpCommand.Output']):
+    spec: str
+    install: bool = False
 
-    #
+    @dc.dataclass(frozen=True)
+    class Output(Command.Output):
+        exe: str
+        version: str
+        opts: InterpOpts
 
-    if isinstance(platform, AmazonLinuxPlatform):
-        lst.extend([
-            inj.bind(YumSystemPackageManager, singleton=True),
-            inj.bind(SystemPackageManager, to_key=YumSystemPackageManager),
-        ])
 
-    elif isinstance(platform, LinuxPlatform):
-        lst.extend([
-            inj.bind(AptSystemPackageManager, singleton=True),
-            inj.bind(SystemPackageManager, to_key=AptSystemPackageManager),
-        ])
+class InterpCommandExecutor(CommandExecutor[InterpCommand, InterpCommand.Output]):
+    async def execute(self, cmd: InterpCommand) -> InterpCommand.Output:
+        i = InterpSpecifier.parse(check.not_none(cmd.spec))
+        o = check.not_none(await DEFAULT_INTERP_RESOLVER.resolve(i, install=cmd.install))
+        return InterpCommand.Output(
+            exe=o.exe,
+            version=str(o.version.version),
+            opts=o.version.opts,
+        )
 
-    elif isinstance(platform, DarwinPlatform):
-        lst.extend([
-            inj.bind(BrewSystemPackageManager, singleton=True),
-            inj.bind(SystemPackageManager, to_key=BrewSystemPackageManager),
-        ])
 
-    #
+########################################
+# ../deploy/venvs.py
+"""
+TODO:
+ - interp
+ - share more code with pyproject?
+"""
 
-    lst.extend([
-        bind_command(CheckSystemPackageCommand, CheckSystemPackageCommandExecutor),
-    ])
 
-    #
+class DeployVenvManager:
+    async def setup_venv(
+            self,
+            spec: DeployVenvSpec,
+            home: DeployHome,
+            git_dir: str,
+            venv_dir: str,
+    ) -> None:
+        if spec.interp is not None:
+            i = InterpSpecifier.parse(check.not_none(spec.interp))
+            o = check.not_none(await DEFAULT_INTERP_RESOLVER.resolve(i))
+            sys_exe = o.exe
+        else:
+            sys_exe = 'python3'
 
-    return inj.as_bindings(*lst)
+        #
+
+        # !! NOTE: (most) venvs cannot be relocated, so an atomic swap can't be used. it's up to the path manager to
+        # garbage collect orphaned dirs.
+        await asyncio_subprocesses.check_call(sys_exe, '-m', 'venv', venv_dir)
 
+        #
 
-########################################
-# ../targets/connection.py
+        venv_exe = os.path.join(venv_dir, 'bin', 'python3')
 
+        #
 
-##
+        reqs_txt = os.path.join(git_dir, 'requirements.txt')
 
+        if os.path.isfile(reqs_txt):
+            if spec.use_uv:
+                await asyncio_subprocesses.check_call(venv_exe, '-m', 'pip', 'install', 'uv')
+                pip_cmd = ['-m', 'uv', 'pip']
+            else:
+                pip_cmd = ['-m', 'pip']
 
-class ManageTargetConnector(abc.ABC):
-    @abc.abstractmethod
-    def connect(self, tgt: ManageTarget) -> ta.AsyncContextManager[CommandExecutor]:
-        raise NotImplementedError
+            await asyncio_subprocesses.check_call(venv_exe, *pip_cmd,'install', '-r', reqs_txt)
 
-    def _default_python(self, python: ta.Optional[ta.Sequence[str]]) -> ta.Sequence[str]:
-        check.not_isinstance(python, str)
-        if python is not None:
-            return python
-        else:
-            return ['sh', '-c', get_best_python_sh(), '--']
 
+########################################
+# ../deploy/apps.py
 
-##
 
+class DeployAppManager(DeployPathOwner):
+    def __init__(
+            self,
+            *,
+            conf: DeployConfManager,
+            git: DeployGitManager,
+            venvs: DeployVenvManager,
+    ) -> None:
+        super().__init__()
 
-ManageTargetConnectorMap = ta.NewType('ManageTargetConnectorMap', ta.Mapping[ta.Type[ManageTarget], ManageTargetConnector])  # noqa
+        self._conf = conf
+        self._git = git
+        self._venvs = venvs
 
+    #
 
-@dc.dataclass(frozen=True)
-class TypeSwitchedManageTargetConnector(ManageTargetConnector):
-    connectors: ManageTargetConnectorMap
+    _APP_DIR_STR = 'apps/@app/@time--@app-rev--@app-key/'
+    _APP_DIR = DeployPath.parse(_APP_DIR_STR)
 
-    def get_connector(self, ty: ta.Type[ManageTarget]) -> ManageTargetConnector:
-        for k, v in self.connectors.items():
-            if issubclass(ty, k):
-                return v
-        raise KeyError(ty)
+    _DEPLOY_DIR_STR = 'deploys/@time--@deploy-key/'
+    _DEPLOY_DIR = DeployPath.parse(_DEPLOY_DIR_STR)
 
-    def connect(self, tgt: ManageTarget) -> ta.AsyncContextManager[CommandExecutor]:
-        return self.get_connector(type(tgt)).connect(tgt)
+    _APP_DEPLOY_LINK = DeployPath.parse(f'{_DEPLOY_DIR_STR}apps/@app')
+    _CONF_DEPLOY_DIR = DeployPath.parse(f'{_DEPLOY_DIR_STR}conf/@conf/')
 
+    @cached_nullary
+    def get_owned_deploy_paths(self) -> ta.AbstractSet[DeployPath]:
+        return {
+            self._APP_DIR,
 
-##
+            self._DEPLOY_DIR,
 
+            self._APP_DEPLOY_LINK,
+            self._CONF_DEPLOY_DIR,
 
-@dc.dataclass(frozen=True)
-class LocalManageTargetConnector(ManageTargetConnector):
-    _local_executor: LocalCommandExecutor
-    _in_process_connector: InProcessRemoteExecutionConnector
-    _pyremote_connector: PyremoteRemoteExecutionConnector
-    _bootstrap: MainBootstrap
+            *[
+                DeployPath.parse(f'{self._APP_DIR_STR}{sfx}/')
+                for sfx in [
+                    'conf',
+                    'git',
+                    'venv',
+                ]
+            ],
+        }
 
-    @contextlib.asynccontextmanager
-    async def connect(self, tgt: ManageTarget) -> ta.AsyncGenerator[CommandExecutor, None]:
-        lmt = check.isinstance(tgt, LocalManageTarget)
+    #
 
-        if isinstance(lmt, InProcessManageTarget):
-            imt = check.isinstance(lmt, InProcessManageTarget)
+    async def prepare_app(
+            self,
+            spec: DeployAppSpec,
+            home: DeployHome,
+            tags: DeployTagMap,
+    ) -> None:
+        check.non_empty_str(home)
 
-            if imt.mode == InProcessManageTarget.Mode.DIRECT:
-                yield self._local_executor
+        def build_path(pth: DeployPath) -> str:
+            return os.path.join(home, pth.render(tags))
 
-            elif imt.mode == InProcessManageTarget.Mode.FAKE_REMOTE:
-                async with self._in_process_connector.connect() as rce:
-                    yield rce
+        app_dir = build_path(self._APP_DIR)
+        deploy_dir = build_path(self._DEPLOY_DIR)
+        app_deploy_link = build_path(self._APP_DEPLOY_LINK)
 
-            else:
-                raise TypeError(imt.mode)
+        #
 
-        elif isinstance(lmt, SubprocessManageTarget):
-            async with self._pyremote_connector.connect(
-                    RemoteSpawning.Target(
-                        python=self._default_python(lmt.python),
-                    ),
-                    self._bootstrap,
-            ) as rce:
-                yield rce
+        os.makedirs(deploy_dir, exist_ok=True)
 
-        else:
-            raise TypeError(lmt)
+        deploying_link = os.path.join(home, 'deploys/deploying')
+        if os.path.exists(deploying_link):
+            os.unlink(deploying_link)
+        relative_symlink(
+            deploy_dir,
+            deploying_link,
+            target_is_directory=True,
+            make_dirs=True,
+        )
 
+        #
 
-##
+        os.makedirs(app_dir)
+        relative_symlink(
+            app_dir,
+            app_deploy_link,
+            target_is_directory=True,
+            make_dirs=True,
+        )
 
+        #
 
-@dc.dataclass(frozen=True)
-class DockerManageTargetConnector(ManageTargetConnector):
-    _pyremote_connector: PyremoteRemoteExecutionConnector
-    _bootstrap: MainBootstrap
+        deploy_conf_dir = os.path.join(deploy_dir, 'conf')
+        os.makedirs(deploy_conf_dir, exist_ok=True)
+
+        #
+
+        # def mirror_symlinks(src: str, dst: str) -> None:
+        #     def mirror_link(lp: str) -> None:
+        #         check.state(os.path.islink(lp))
+        #         shutil.copy2(
+        #             lp,
+        #             os.path.join(dst, os.path.relpath(lp, src)),
+        #             follow_symlinks=False,
+        #         )
+        #
+        #     for dp, dns, fns in os.walk(src, followlinks=False):
+        #         for fn in fns:
+        #             mirror_link(os.path.join(dp, fn))
+        #
+        #         for dn in dns:
+        #             dp2 = os.path.join(dp, dn)
+        #             if os.path.islink(dp2):
+        #                 mirror_link(dp2)
+        #             else:
+        #                 os.makedirs(os.path.join(dst, os.path.relpath(dp2, src)))
+
+        current_link = os.path.join(home, 'deploys/current')
+
+        # if os.path.exists(current_link):
+        #     mirror_symlinks(
+        #         os.path.join(current_link, 'conf'),
+        #         conf_tag_dir,
+        #     )
+        #     mirror_symlinks(
+        #         os.path.join(current_link, 'apps'),
+        #         os.path.join(deploy_dir, 'apps'),
+        #     )
 
-    @contextlib.asynccontextmanager
-    async def connect(self, tgt: ManageTarget) -> ta.AsyncGenerator[CommandExecutor, None]:
-        dmt = check.isinstance(tgt, DockerManageTarget)
+        #
 
-        sh_parts: ta.List[str] = ['docker']
-        if dmt.image is not None:
-            sh_parts.extend(['run', '-i', dmt.image])
-        elif dmt.container_id is not None:
-            sh_parts.extend(['exec', '-i', dmt.container_id])
-        else:
-            raise ValueError(dmt)
+        app_git_dir = os.path.join(app_dir, 'git')
+        await self._git.checkout(
+            spec.git,
+            home,
+            app_git_dir,
+        )
 
-        async with self._pyremote_connector.connect(
-                RemoteSpawning.Target(
-                    shell=' '.join(sh_parts),
-                    python=self._default_python(dmt.python),
-                ),
-                self._bootstrap,
-        ) as rce:
-            yield rce
+        #
 
+        if spec.venv is not None:
+            app_venv_dir = os.path.join(app_dir, 'venv')
+            await self._venvs.setup_venv(
+                spec.venv,
+                home,
+                app_git_dir,
+                app_venv_dir,
+            )
 
-##
+        #
 
+        if spec.conf is not None:
+            app_conf_dir = os.path.join(app_dir, 'conf')
+            await self._conf.write_app_conf(
+                spec.conf,
+                tags,
+                app_conf_dir,
+                deploy_conf_dir,
+            )
 
-@dc.dataclass(frozen=True)
-class SshManageTargetConnector(ManageTargetConnector):
-    _pyremote_connector: PyremoteRemoteExecutionConnector
-    _bootstrap: MainBootstrap
+        #
 
-    @contextlib.asynccontextmanager
-    async def connect(self, tgt: ManageTarget) -> ta.AsyncGenerator[CommandExecutor, None]:
-        smt = check.isinstance(tgt, SshManageTarget)
+        os.replace(deploying_link, current_link)
 
-        sh_parts: ta.List[str] = ['ssh']
-        if smt.key_file is not None:
-            sh_parts.extend(['-i', smt.key_file])
-        addr = check.not_none(smt.host)
-        if smt.username is not None:
-            addr = f'{smt.username}@{addr}'
-        sh_parts.append(addr)
 
-        async with self._pyremote_connector.connect(
-                RemoteSpawning.Target(
-                    shell=' '.join(sh_parts),
-                    shell_quote=True,
-                    python=self._default_python(smt.python),
-                ),
-                self._bootstrap,
-        ) as rce:
-            yield rce
+########################################
+# ../deploy/deploy.py
 
 
-########################################
-# ../../../omdev/interp/resolvers.py
+DEPLOY_TAG_DATETIME_FMT = '%Y%m%dT%H%M%SZ'
 
 
-INTERP_PROVIDER_TYPES_BY_NAME: ta.Mapping[str, ta.Type[InterpProvider]] = {
-    cls.name: cls for cls in deep_subclasses(InterpProvider) if abc.ABC not in cls.__bases__  # type: ignore
-}
+DeployManagerUtcClock = ta.NewType('DeployManagerUtcClock', Func0[datetime.datetime])
 
 
-class InterpResolver:
+class DeployManager:
     def __init__(
             self,
-            providers: ta.Sequence[ta.Tuple[str, InterpProvider]],
-    ) -> None:
+            *,
+            apps: DeployAppManager,
+            paths: DeployPathsManager,
+
+            utc_clock: ta.Optional[DeployManagerUtcClock] = None,
+    ):
         super().__init__()
 
-        self._providers: ta.Mapping[str, InterpProvider] = collections.OrderedDict(providers)
+        self._apps = apps
+        self._paths = paths
 
-    async def _resolve_installed(self, spec: InterpSpecifier) -> ta.Optional[ta.Tuple[InterpProvider, InterpVersion]]:
-        lst = [
-            (i, si)
-            for i, p in enumerate(self._providers.values())
-            for si in await p.get_installed_versions(spec)
-            if spec.contains(si)
-        ]
+        self._utc_clock = utc_clock
 
-        slst = sorted(lst, key=lambda t: (-t[0], t[1].version))
-        if not slst:
-            return None
+    def _utc_now(self) -> datetime.datetime:
+        if self._utc_clock is not None:
+            return self._utc_clock()  # noqa
+        else:
+            return datetime.datetime.now(tz=datetime.timezone.utc)  # noqa
 
-        bi, bv = slst[-1]
-        bp = list(self._providers.values())[bi]
-        return (bp, bv)
+    def _make_deploy_time(self) -> DeployTime:
+        return DeployTime(self._utc_now().strftime(DEPLOY_TAG_DATETIME_FMT))
 
-    async def resolve(
+    async def run_deploy(
             self,
-            spec: InterpSpecifier,
-            *,
-            install: bool = False,
-    ) -> ta.Optional[Interp]:
-        tup = await self._resolve_installed(spec)
-        if tup is not None:
-            bp, bv = tup
-            return await bp.get_installed_version(bv)
-
-        if not install:
-            return None
-
-        tp = list(self._providers.values())[0]  # noqa
-
-        sv = sorted(
-            [s for s in await tp.get_installable_versions(spec) if s in spec],
-            key=lambda s: s.version,
-        )
-        if not sv:
-            return None
+            spec: DeploySpec,
+    ) -> None:
+        self._paths.validate_deploy_paths()
 
-        bv = sv[-1]
-        return await tp.install_version(bv)
+        #
 
-    async def list(self, spec: InterpSpecifier) -> None:
-        print('installed:')
-        for n, p in self._providers.items():
-            lst = [
-                si
-                for si in await p.get_installed_versions(spec)
-                if spec.contains(si)
-            ]
-            if lst:
-                print(f'  {n}')
-                for si in lst:
-                    print(f'    {si}')
+        hs = check.non_empty_str(spec.home)
+        hs = os.path.expanduser(hs)
+        hs = os.path.realpath(hs)
+        hs = os.path.abspath(hs)
 
-        print()
+        home = DeployHome(hs)
 
-        print('installable:')
-        for n, p in self._providers.items():
-            lst = [
-                si
-                for si in await p.get_installable_versions(spec)
-                if spec.contains(si)
-            ]
-            if lst:
-                print(f'  {n}')
-                for si in lst:
-                    print(f'    {si}')
+        #
 
+        deploy_tags = DeployTagMap(
+            self._make_deploy_time(),
+            spec.key(),
+        )
 
-DEFAULT_INTERP_RESOLVER = InterpResolver([(p.name, p) for p in [
-    # pyenv is preferred to system interpreters as it tends to have more support for things like tkinter
-    PyenvInterpProvider(try_update=True),
+        #
 
-    RunningInterpProvider(),
+        for app in spec.apps:
+            app_tags = deploy_tags.add(
+                app.app,
+                app.key(),
+                DeployAppRev(app.git.rev),
+            )
 
-    SystemInterpProvider(),
-]])
+            await self._apps.prepare_app(
+                app,
+                home,
+                app_tags,
+            )
 
 
 ########################################
@@ -10937,65 +11029,6 @@ class DeployCommandExecutor(CommandExecutor[DeployCommand, DeployCommand.Output]
         return DeployCommand.Output()
 
 
-########################################
-# ../targets/inject.py
-
-
-def bind_targets() -> InjectorBindings:
-    lst: ta.List[InjectorBindingOrBindings] = [
-        inj.bind(LocalManageTargetConnector, singleton=True),
-        inj.bind(DockerManageTargetConnector, singleton=True),
-        inj.bind(SshManageTargetConnector, singleton=True),
-
-        inj.bind(TypeSwitchedManageTargetConnector, singleton=True),
-        inj.bind(ManageTargetConnector, to_key=TypeSwitchedManageTargetConnector),
-    ]
-
-    #
-
-    def provide_manage_target_connector_map(injector: Injector) -> ManageTargetConnectorMap:
-        return ManageTargetConnectorMap({
-            LocalManageTarget: injector[LocalManageTargetConnector],
-            DockerManageTarget: injector[DockerManageTargetConnector],
-            SshManageTarget: injector[SshManageTargetConnector],
-        })
-    lst.append(inj.bind(provide_manage_target_connector_map, singleton=True))
-
-    #
-
-    return inj.as_bindings(*lst)
-
-
-########################################
-# ../deploy/interp.py
-
-
-##
-
-
-@dc.dataclass(frozen=True)
-class InterpCommand(Command['InterpCommand.Output']):
-    spec: str
-    install: bool = False
-
-    @dc.dataclass(frozen=True)
-    class Output(Command.Output):
-        exe: str
-        version: str
-        opts: InterpOpts
-
-
-class InterpCommandExecutor(CommandExecutor[InterpCommand, InterpCommand.Output]):
-    async def execute(self, cmd: InterpCommand) -> InterpCommand.Output:
-        i = InterpSpecifier.parse(check.not_none(cmd.spec))
-        o = check.not_none(await DEFAULT_INTERP_RESOLVER.resolve(i, install=cmd.install))
-        return InterpCommand.Output(
-            exe=o.exe,
-            version=str(o.version.version),
-            opts=o.version.opts,
-        )
-
-
 ########################################
 # ../deploy/inject.py
 
@@ -11031,13 +11064,18 @@ def bind_deploy(
         bind_manager(DeployManager),
 
         bind_manager(DeployTmpManager),
-        inj.bind(AtomicPathSwapping, to_key=DeployTmpManager),
 
         bind_manager(DeployVenvManager),
     ])
 
     #
 
+    def provide_deploy_home_atomics(tmp: DeployTmpManager) -> DeployHomeAtomics:
+        return DeployHomeAtomics(tmp.get_swapping)
+    lst.append(inj.bind(provide_deploy_home_atomics, singleton=True))
+
+    #
+
     lst.extend([
         bind_command(DeployCommand, DeployCommandExecutor),
         bind_command(InterpCommand, InterpCommandExecutor),
@@ -11045,10 +11083,6 @@ def bind_deploy(
 
     #
 
-    if (dh := deploy_config.deploy_home) is not None:
-        dh = os.path.abspath(os.path.expanduser(dh))
-        lst.append(inj.bind(dh, key=DeployHome))
-
     return inj.as_bindings(*lst)
 
 
@@ -11175,10 +11209,9 @@ class MainCli(ArgparseCli):
 
         argparse_arg('--debug', action='store_true'),
 
-        argparse_arg('--deploy-home'),
-
         argparse_arg('target'),
-        argparse_arg('command', nargs='+'),
+        argparse_arg('-f', '--command-file', action='append'),
+        argparse_arg('command', nargs='*'),
     )
     async def run(self) -> None:
         bs = MainBootstrap(
@@ -11188,9 +11221,7 @@ class MainCli(ArgparseCli):
                 debug=bool(self.args.debug),
             ),
 
-            deploy_config=DeployConfig(
-                deploy_home=self.args.deploy_home,
-            ),
+            deploy_config=DeployConfig(),
 
             remote_config=RemoteConfig(
                 payload_file=self.args._payload_file,  # noqa
@@ -11224,13 +11255,19 @@ class MainCli(ArgparseCli):
         #
 
         cmds: ta.List[Command] = []
+
         cmd: Command
-        for c in self.args.command:
+
+        for c in self.args.command or []:
             if not c.startswith('{'):
                 c = json.dumps({c: {}})
             cmd = msh.unmarshal_obj(json.loads(c), Command)
             cmds.append(cmd)
 
+        for cf in self.args.command_file or []:
+            cmd = read_config_file(cf, Command, msh=msh)
+            cmds.append(cmd)
+
         #
 
         async with injector[ManageTargetConnector].connect(tgt) as ce: