dokku-compose 0.13.0 → 0.14.0

package/dist/index.js

@@ -1,8 +1,18 @@
 #!/usr/bin/env node
+import {
+  assertDokkuSupported,
+  compareToFile,
+  enforceFileVersion,
+  logAction,
+  logDone,
+  logError,
+  logSkip,
+  logWarn
+} from "./chunk-WM244P42.js";
 
 // src/index.ts
 import { Command } from "commander";
-import * as fs3 from "fs";
+import * as fs4 from "fs";
 import * as yaml3 from "js-yaml";
 import { createRequire } from "module";
 
@@ -12,6 +22,241 @@ import * as yaml from "js-yaml";
 
 // src/core/schema.ts
 import { z } from "zod";
+
+// src/resources/parsers.ts
+function parseReport(raw, namespace) {
+  const result = {};
+  const prefixPattern = namespace.replace(/-/g, "[\\s-]");
+  const prefix = new RegExp(`^${prefixPattern}\\s+`, "i");
+  for (const line of raw.split("\n")) {
+    if (line.trimStart().startsWith("=====>")) continue;
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) continue;
+    const rawKey = line.slice(0, colonIdx).trim();
+    if (!rawKey) continue;
+    const value = line.slice(colonIdx + 1).trim();
+    const stripped = rawKey.replace(prefix, "");
+    const key = stripped.toLowerCase().replace(/\s+/g, "-");
+    if (key.startsWith("computed-") || key.startsWith("global-") || key === "last-visited-at") continue;
+    if (!value) continue;
+    result[key] = value;
+  }
+  return result;
+}
+function parseBulkReport(raw, namespace, headerNamespace) {
+  const result = /* @__PURE__ */ new Map();
+  const sections = raw.split(/(?=^=====> )/m).filter((s) => s.trim());
+  const nsPattern = (headerNamespace ?? namespace).replace(/-/g, "[\\s-]");
+  const headerRe = new RegExp(`^=====> (.+?)\\s+${nsPattern}\\s+information`, "i");
+  for (const section of sections) {
+    const headerEnd = section.indexOf("\n");
+    if (headerEnd === -1) continue;
+    const header = section.slice(0, headerEnd);
+    const match = header.match(headerRe);
+    if (!match) continue;
+    const app = match[1];
+    result.set(app, parseReport(section, namespace));
+  }
+  return result;
+}
+function parseJsonReport(raw, scope) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`report --format json did not return JSON: ${raw.slice(0, 200)}`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`report --format json did not return a JSON object: ${raw.slice(0, 200)}`);
+  }
+  const result = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (value === null || value === void 0 || String(value) === "") continue;
+    if (scope === "global") {
+      if (key.startsWith("global-")) result[key.slice("global-".length)] = String(value);
+    } else if (scope.includes(key)) {
+      result[key] = String(value);
+    }
+  }
+  return result;
+}
+
+// src/resources/properties.ts
+async function isAppDeployed(ctx, target) {
+  const raw = await ctx.query("ps:report", target, "--deployed");
+  return raw.trim() === "true";
+}
+var NGINX_KEYS = [
+  "access-log-format",
+  "access-log-path",
+  "bind-address-ipv4",
+  "bind-address-ipv6",
+  "client-body-timeout",
+  "client-header-timeout",
+  "client-max-body-size",
+  "disable-custom-config",
+  "error-log-path",
+  "hsts",
+  "hsts-include-subdomains",
+  "hsts-max-age",
+  "hsts-preload",
+  "keepalive-timeout",
+  "lingering-timeout",
+  "nginx-conf-sigil-path",
+  "nginx-service-command",
+  "proxy-buffer-size",
+  "proxy-buffering",
+  "proxy-buffers",
+  "proxy-busy-buffers-size",
+  "proxy-connect-timeout",
+  "proxy-keepalive",
+  "proxy-read-timeout",
+  "proxy-send-timeout",
+  "send-timeout",
+  "underscore-in-headers",
+  "x-forwarded-for-value",
+  "x-forwarded-port-value",
+  "x-forwarded-proto-value",
+  "x-forwarded-ssl"
+];
+var LOGS_KEYS = ["app-label-alias", "max-size", "vector-cron-sink", "vector-sink"];
+var LOGS_GLOBAL_KEYS = [...LOGS_KEYS, "vector-image", "vector-networks"];
+var REGISTRY_KEYS = [
+  "image-repo",
+  "image-repo-template",
+  "push-extra-tags",
+  "push-on-release",
+  "server"
+];
+function propertyRemovals(allowed) {
+  return (current, desired) => Object.keys(current ?? {}).filter((k) => allowed.includes(k) && !(desired && k in desired));
+}
+function propertyPrune(setCmd, afterPrune = []) {
+  return async (ctx, target, removed) => {
+    for (const key of removed) await ctx.run(setCmd, target, key);
+    for (const cmd of afterPrune) {
+      try {
+        await ctx.run(cmd, target);
+      } catch (err) {
+        if (await isAppDeployed(ctx, target)) throw err;
+        logWarn(target, `${cmd} failed on an undeployed app \u2014 its proxy config will be built on first deploy`);
+      }
+    }
+  };
+}
+function propertyResource(opts) {
+  return {
+    key: opts.key,
+    // Keys only on the server never make the block "changed"; diff shows them as removals.
+    additive: true,
+    removals: propertyRemovals(opts.settable),
+    prune: propertyPrune(opts.setCmd, opts.afterChange),
+    async read(ctx, target) {
+      if (opts.json) return parseJsonReport(await ctx.queryStrict(`${opts.namespace}:report`, target, "--format", "json"), opts.settable);
+      const raw = await ctx.query(`${opts.namespace}:report`, target);
+      return parseReport(raw, opts.namespace);
+    },
+    ...opts.json ? {} : {
+      async readAll(ctx) {
+        const raw = await ctx.query(`${opts.namespace}:report`);
+        return parseBulkReport(raw, opts.namespace);
+      }
+    },
+    async onChange(ctx, target, change, deferFollowUp = false) {
+      for (const [key, value] of Object.entries({ ...change.added, ...change.modified })) {
+        await ctx.run(opts.setCmd, target, key, String(value));
+      }
+      if (opts.afterChange && !deferFollowUp) {
+        for (const cmd of opts.afterChange) {
+          try {
+            await ctx.run(cmd, target);
+          } catch (err) {
+            if (await isAppDeployed(ctx, target)) throw err;
+            logWarn(target, `${cmd} failed on an undeployed app \u2014 its proxy config will be built on first deploy`);
+          }
+        }
+      }
+    }
+  };
+}
+var Nginx = propertyResource({
+  key: "nginx",
+  namespace: "nginx",
+  setCmd: "nginx:set",
+  settable: NGINX_KEYS,
+  afterChange: ["proxy:build-config"]
+});
+var Logs = propertyResource({
+  key: "logs",
+  namespace: "logs",
+  setCmd: "logs:set",
+  settable: LOGS_KEYS,
+  json: true
+});
+var Registry = propertyResource({
+  key: "registry",
+  namespace: "registry",
+  setCmd: "registry:set",
+  settable: REGISTRY_KEYS
+});
+function schedulerParts(cfg) {
+  if (typeof cfg === "string") return { selected: cfg, shell: "" };
+  return { selected: cfg?.selected ?? "", shell: cfg?.shell ?? "" };
+}
+function schedulerFromReport(report) {
+  const selected = report["selected"] ?? "";
+  const shell = report["shell"];
+  return shell ? { ...selected ? { selected } : {}, shell } : selected;
+}
+var Scheduler = {
+  key: "scheduler",
+  // A scheduler setting on the app that the file does not declare.
+  removals: (current, desired) => {
+    const have = schedulerParts(current);
+    const want = schedulerParts(desired);
+    const removed = [];
+    if (have.selected && !want.selected) removed.push("scheduler");
+    if (have.shell && !want.shell) removed.push("shell");
+    return removed;
+  },
+  prune: async (ctx, target, removed) => {
+    for (const label of removed) await ctx.run("scheduler:set", target, label === "shell" ? "shell" : "selected");
+  },
+  inSync: (current, desired) => {
+    const have = schedulerParts(current);
+    const want = schedulerParts(desired);
+    return (!want.selected || want.selected === have.selected) && (!want.shell || want.shell === have.shell);
+  },
+  async read(ctx, target) {
+    const raw = await ctx.query("scheduler:report", target);
+    return schedulerFromReport(parseReport(raw, "scheduler"));
+  },
+  async readAll(ctx) {
+    const raw = await ctx.query("scheduler:report");
+    const bulk = parseBulkReport(raw, "scheduler");
+    const result = /* @__PURE__ */ new Map();
+    for (const [app, report] of bulk) result.set(app, schedulerFromReport(report));
+    return result;
+  },
+  async onChange(ctx, target, change) {
+    const have = schedulerParts(change.before);
+    const want = schedulerParts(change.after);
+    if (want.selected && want.selected !== have.selected) await ctx.run("scheduler:set", target, "selected", want.selected);
+    if (want.shell && want.shell !== have.shell) await ctx.run("scheduler:set", target, "shell", want.shell);
+  }
+};
+
+// src/core/schema.ts
+function propertyMap(namespace, keys, value) {
+  return z.record(z.string(), value).superRefine((map, ctx) => {
+    for (const key of Object.keys(map)) {
+      if (!keys.includes(key)) {
+        ctx.addIssue({ code: "custom", path: [key], message: `'${key}' is not a ${namespace}:set property (valid: ${keys.join(", ")})` });
+      }
+    }
+  });
+}
+var StringOrNumber = z.union([z.string(), z.number()]);
 var PortSchema = z.string().regex(
   /^(http|https|tcp|udp):\d+:\d+$/,
   "Port must be scheme:host:container (e.g. http:80:3000)"
@@ -24,46 +269,79 @@ var ChecksSchema = z.union([
   z.literal(false),
   z.object({
     disabled: z.array(z.string()).optional(),
-    skipped: z.array(z.string()).optional()
-  }).catchall(z.union([z.string(), z.number(), z.boolean()]))
+    skipped: z.array(z.string()).optional(),
+    // The only `checks:set` key (Dokku 0.38.31); anything else is refused.
+    "wait-to-retire": z.union([z.string(), z.number(), z.boolean()]).optional()
+  }).strict()
 ]);
 var GitSchema = z.object({
-  deploy_branch: z.string().optional()
-});
+  deploy_branch: z.string().optional(),
+  keep_git_dir: z.union([z.string(), z.boolean()]).optional(),
+  rev_env_var: z.string().optional(),
+  source_image: z.string().optional(),
+  // Dokku reads `archive-max-files` and `archive-max-size` only from the global setting
+  // (`git:set --global`), which dokku-compose does not manage yet; a per-app value never applies.
+  archive_max_files: z.any().refine((v) => v === void 0, { message: "archive_max_files is read only from the global git setting, which dokku-compose does not manage; run `dokku git:set --global archive-max-files <n>`" }),
+  archive_max_size: z.any().refine((v) => v === void 0, { message: "archive_max_size is read only from the global git setting, which dokku-compose does not manage; run `dokku git:set --global archive-max-size <n>`" })
+}).strict();
+var LinkSchema = z.union([
+  z.string(),
+  z.object({
+    service: z.string(),
+    alias: z.string().min(1).optional(),
+    env_var: z.string().min(1).optional(),
+    querystring: z.string().min(1).optional()
+  }).strict().refine((l) => !(l.alias && l.env_var), { message: "`alias` and `env_var` cannot be combined" })
+]);
 var AppSchema = z.object({
   domains: z.union([z.array(z.string()), z.literal(false)]).optional(),
-  links: z.array(z.string()).optional(),
+  links: z.array(LinkSchema).optional(),
   ports: z.array(PortSchema).optional(),
   env: EnvMapSchema.optional(),
+  /** App env keys something else sets: names only; `diff` stops noting them. */
+  env_external: z.array(z.string().min(1)).optional(),
   ssl: z.union([
     z.literal(false),
     z.literal(true),
     z.object({ certfile: z.string(), keyfile: z.string() })
   ]).optional(),
   storage: z.array(z.string()).optional(),
-  proxy: z.object({ enabled: z.boolean() }).optional(),
+  proxy: z.object({
+    enabled: z.boolean().optional(),
+    type: z.string().optional(),
+    proxy_port: StringOrNumber.optional(),
+    proxy_ssl_port: StringOrNumber.optional()
+  }).strict().optional(),
   networks: z.array(z.string()).optional(),
   network: z.object({
     attach_post_create: z.union([z.array(z.string()), z.literal(false)]).optional(),
     initial_network: z.union([z.string(), z.literal(false)]).optional(),
     bind_all_interfaces: z.boolean().optional(),
+    static_web_listener: z.union([z.string(), z.literal(false)]).optional(),
     tld: z.union([z.string(), z.literal(false)]).optional()
   }).optional(),
-  nginx: z.record(z.string(), z.union([z.string(), z.number()])).optional(),
-  logs: z.record(z.string(), z.union([z.string(), z.number()])).optional(),
-  registry: z.record(z.string(), z.union([z.string(), z.boolean()])).optional(),
-  scheduler: z.string().optional(),
+  nginx: propertyMap("nginx", NGINX_KEYS, StringOrNumber).optional(),
+  logs: propertyMap("logs", LOGS_KEYS, StringOrNumber).optional(),
+  // `auth-servers` is report-only: it is a registry login, not a `registry:set` key.
+  registry: propertyMap("registry", REGISTRY_KEYS, z.union([z.string(), z.boolean()])).optional(),
+  scheduler: z.union([z.string(), z.object({ selected: z.string().optional(), shell: z.string().optional() }).strict()]).optional(),
   scale: z.record(z.string(), z.preprocess((v) => typeof v === "string" && /^\s*-?\d+\s*$/.test(v) ? Number(v) : v, z.number().int().min(0))).optional(),
   ps: z.object({
     "procfile-path": z.union([z.string(), z.number()]).optional(),
     "restart-policy": z.union([z.string(), z.number()]).optional(),
-    "stop-timeout-seconds": z.union([z.string(), z.number()]).optional()
+    "stop-timeout-seconds": z.union([z.string(), z.number()]).optional(),
+    "dockerfile-start-cmd": z.union([z.string(), z.number()]).optional(),
+    restore: z.union([z.string(), z.boolean()]).optional(),
+    "skip-deploy": z.union([z.string(), z.boolean()]).optional(),
+    "start-cmd": z.union([z.string(), z.number()]).optional()
   }).strict().optional(),
   checks: ChecksSchema.optional(),
   build: z.object({
     dockerfile: z.string().optional(),
     app_json: z.string().optional(),
     context: z.string().optional(),
+    selected: z.string().optional(),
+    skip_cleanup: z.union([z.string(), z.boolean()]).optional(),
     args: z.record(z.string(), z.string()).optional()
   }).optional(),
   docker_options: z.object({
@@ -88,7 +366,8 @@ var ServiceBackupSchema = z.object({
 var PostgresSchema = z.object({
   version: z.string().optional(),
   image: z.string().optional(),
-  backup: ServiceBackupSchema.optional()
+  // false removes the service's backup schedule and credentials; absent leaves them alone
+  backup: z.union([ServiceBackupSchema, z.literal(false)]).optional()
 });
 var RedisSchema = z.object({
   version: z.string().optional(),
@@ -114,8 +393,9 @@ var ConfigSchema = z.object({
   apps: z.record(z.string(), AppSchema),
   domains: z.union([z.array(z.string()), z.literal(false)]).optional(),
   env: EnvMapSchema.optional(),
-  nginx: z.record(z.string(), z.union([z.string(), z.number()])).optional(),
-  logs: z.record(z.string(), z.union([z.string(), z.number()])).optional(),
+  nginx: propertyMap("nginx", NGINX_KEYS, StringOrNumber).optional(),
+  // The top-level block is also applied with `--global`, which takes two more keys.
+  logs: propertyMap("logs", LOGS_GLOBAL_KEYS, StringOrNumber).optional(),
   git: GitSchema.optional()
 });
 function parseConfig(raw) {
@@ -180,7 +460,7 @@ function maskSensitiveArgs(cmd) {
     return `${key}=${maskValue(value)}`;
   });
   masked = masked.replace(
-    /^(registry:login\s+(?:--global\s+)?\S+\s+\S+\s+)(\S+)/,
+    /^(?!.*--password-stdin)(registry:login\s+(?:--global\s+)?\S+\s+\S+\s+)(\S+)/,
     (_, prefix, password) => `${prefix}${maskValue(password)}`
   );
   masked = masked.replace(
@@ -205,7 +485,7 @@ function maskSensitiveArgsList(args) {
       masked[i] = `${m[1]}=${maskValue(m[2])}`;
     }
   }
-  if (masked[0] === "registry:login") {
+  if (masked[0] === "registry:login" && !masked.includes("--password-stdin")) {
     mark(masked.length - 1);
   }
   if (/^\S+:backup-auth$/.test(masked[0] ?? "")) {
@@ -229,7 +509,7 @@ function maskSensitiveData(data) {
   if (typeof data === "object") {
     const result = {};
     for (const [key, value] of Object.entries(data)) {
-      if (typeof value === "string" && SENSITIVE_RE.test(key)) {
+      if (typeof value === "string" && (SENSITIVE_RE.test(key) || /sink/i.test(key))) {
         result[key] = maskValue(value);
       } else if (typeof value === "object" && value !== null) {
         result[key] = maskSensitiveData(value);
@@ -241,6 +521,13 @@ function maskSensitiveData(data) {
   }
   return data;
 }
+function maskQuerystring(qs) {
+  return qs.split("&").map((pair) => {
+    const i = pair.indexOf("=");
+    if (i === -1 || !SENSITIVE_RE.test(pair.slice(0, i))) return pair;
+    return `${pair.slice(0, i)}=${maskValue(pair.slice(i + 1))}`;
+  }).join("&");
+}
 
 // src/core/dokku.ts
 var DokkuCommandError = class extends Error {
@@ -265,17 +552,18 @@ function createRunner(opts = {}) {
     if (/^[A-Za-z0-9_\-:.,/=@]+$/.test(arg)) return arg;
     return `'${arg.replace(/'/g, "'\\''")}'`;
   }
-  async function execDokku(args) {
+  async function execDokku(args, input) {
+    const stdio = input === void 0 ? { stdin: "ignore" } : { input };
     if (opts.host) {
       try {
-        const result = await execa("ssh", [...sshControlFlags, `dokku@${opts.host}`, "--", ...args.map(shellQuote)], { stdin: "ignore" });
+        const result = await execa("ssh", [...sshControlFlags, `dokku@${opts.host}`, "--", ...args.map(shellQuote)], stdio);
         return { stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? ""), exitCode: result.exitCode ?? 0, ok: true };
       } catch (e) {
         return { stdout: String(e.stdout ?? ""), stderr: String(e.stderr ?? ""), exitCode: e.exitCode ?? 1, ok: false };
       }
     } else {
       try {
-        const result = await execa("dokku", args, { stdin: "ignore" });
+        const result = await execa("dokku", args, stdio);
         return { stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? ""), exitCode: result.exitCode ?? 0, ok: true };
       } catch (e) {
         return { stdout: String(e.stdout ?? ""), stderr: String(e.stderr ?? ""), exitCode: e.exitCode ?? 1, ok: false };
@@ -307,6 +595,18 @@ function createRunner(opts = {}) {
       const { ok } = await execDokku(args);
       return ok;
     },
+    async status(args, input) {
+      const { exitCode, ok } = await execDokku(args, input);
+      return ok ? 0 : exitCode;
+    },
+    async runWithInput(input, ...args) {
+      if (opts.dryRun) {
+        log.push(args.map((a) => a.includes(" ") ? shellQuote(a) : a).join(" "));
+        return;
+      }
+      const { ok, exitCode, stderr } = await execDokku(args, input);
+      if (!ok) throw new DokkuCommandError(args, exitCode, input ? stderr.split(input).join("****") : stderr);
+    },
     async close() {
       if (!opts.host || !controlPath) return;
       try {
@@ -321,9 +621,23 @@ function createRunner(opts = {}) {
 function createContext(runner) {
   const cache = /* @__PURE__ */ new Map();
   const commands = [];
+  const restarts = /* @__PURE__ */ new Map();
+  const rebuilds = /* @__PURE__ */ new Map();
   return {
     commands,
     runner,
+    restarts,
+    rebuilds,
+    needsRebuild(app, reason) {
+      const reasons = rebuilds.get(app) ?? [];
+      if (!reasons.includes(reason)) reasons.push(reason);
+      rebuilds.set(app, reasons);
+    },
+    needsRestart(app, reason) {
+      const reasons = restarts.get(app) ?? [];
+      if (!reasons.includes(reason)) reasons.push(reason);
+      restarts.set(app, reasons);
+    },
     query(...args) {
       const key = args.join("\0");
       if (!cache.has(key)) {
@@ -337,6 +651,13 @@ function createContext(runner) {
     check(...args) {
       return runner.check(...args);
     },
+    status(args, input) {
+      return runner.status(args, input);
+    },
+    async runWithInput(input, ...args) {
+      commands.push(args);
+      await runner.runWithInput(input, ...args);
+    },
     async run(...args) {
       commands.push(args);
       await runner.run(...args);
@@ -348,6 +669,17 @@ function createContext(runner) {
 }
 
 // src/core/change.ts
+function sameValue(x, y, subset = false) {
+  if (x !== null && y !== null && typeof x === "object" && typeof y === "object") {
+    if (Array.isArray(x) || Array.isArray(y)) {
+      if (!Array.isArray(x) || !Array.isArray(y)) return false;
+      return x.length === y.length && x.every((v) => y.some((w) => sameValue(v, w))) && y.every((w) => x.some((v) => sameValue(v, w)));
+    }
+    const kx = Object.keys(x), ky = Object.keys(y);
+    return (subset ? ky : kx).every((k) => k in x && k in y && sameValue(x[k], y[k], subset)) && (subset || kx.length === ky.length);
+  }
+  return String(x) === String(y);
+}
 function computeChange(before, after) {
   if (before === null || before === void 0 || after === null || after === void 0) {
     return { before, after, changed: before !== after };
@@ -375,7 +707,7 @@ function computeChange(before, after) {
     for (const key of allKeys) {
       if (!(key in b)) added[key] = a[key];
       else if (!(key in a)) removed.push(key);
-      else if (String(b[key]) !== String(a[key])) modified[key] = a[key];
+      else if (!sameValue(b[key], a[key])) modified[key] = a[key];
     }
     const changed = Object.keys(added).length > 0 || removed.length > 0 || Object.keys(modified).length > 0;
     return { before, after, changed, added, removed, modified };
@@ -384,28 +716,13 @@ function computeChange(before, after) {
 }
 function computeAdditiveChange(before, after) {
   const change = computeChange(before ?? {}, after);
+  const b = before ?? {};
+  const a = after;
+  for (const k of Object.keys(change.modified)) if (sameValue(b[k], a[k], true)) delete change.modified[k];
   change.changed = Object.keys(change.added).length > 0 || Object.keys(change.modified).length > 0;
   return change;
 }
 
-// src/core/logger.ts
-import chalk from "chalk";
-function logAction(context, message) {
-  process.stdout.write(chalk.blue(`[${context.padEnd(12)}]`) + ` ${message}`);
-}
-function logDone() {
-  console.log(`... ${chalk.green("done")}`);
-}
-function logSkip() {
-  console.log(`... ${chalk.yellow("already configured")}`);
-}
-function logError(context, message) {
-  console.error(chalk.red(`[${context.padEnd(12)}] ERROR: ${message}`));
-}
-function logWarn(context, message) {
-  console.warn(chalk.yellow(`[${context.padEnd(12)}] WARN: ${message}`));
-}
-
 // src/core/reconcile.ts
 async function reconcile(resource, ctx, target, desired, onRemovals, prune = false) {
   const canPrune = prune && !!resource.prune && !!resource.removals;
@@ -428,6 +745,17 @@ async function reconcile(resource, ctx, target, desired, onRemovals, prune = fal
     return;
   }
   const before = await resource.read(ctx, target);
+  if (resource.inSync) {
+    if (before !== void 0 && resource.inSync(before, desired)) {
+      logSkip();
+    } else {
+      await resource.onChange(ctx, target, { before, after: desired, changed: true });
+      logDone();
+    }
+    if (onRemovals && resource.removals) onRemovals(resource.removals(before, desired));
+    if (canPrune) await pruneFrom(before);
+    return;
+  }
   if (onRemovals && resource.removals) onRemovals(resource.removals(before, desired));
   if (canPrune) {
     const change2 = resource.additive ? computeAdditiveChange(before, desired) : computeChange(before, desired);
@@ -465,50 +793,10 @@ var Apps = {
   }
 };
 
-// src/resources/parsers.ts
-function parseReport(raw, namespace) {
-  const result = {};
-  const prefixPattern = namespace.replace(/-/g, "[\\s-]");
-  const prefix = new RegExp(`^${prefixPattern}\\s+`, "i");
-  for (const line of raw.split("\n")) {
-    if (line.trimStart().startsWith("=====>")) continue;
-    const colonIdx = line.indexOf(":");
-    if (colonIdx === -1) continue;
-    const rawKey = line.slice(0, colonIdx).trim();
-    if (!rawKey) continue;
-    const value = line.slice(colonIdx + 1).trim();
-    const stripped = rawKey.replace(prefix, "");
-    const key = stripped.toLowerCase().replace(/\s+/g, "-");
-    if (key.startsWith("computed-") || key.startsWith("global-") || key === "last-visited-at") continue;
-    if (!value) continue;
-    result[key] = value;
-  }
-  return result;
-}
-function parseBulkReport(raw, namespace, headerNamespace) {
-  const result = /* @__PURE__ */ new Map();
-  const sections = raw.split(/(?=^=====> )/m).filter((s) => s.trim());
-  const nsPattern = (headerNamespace ?? namespace).replace(/-/g, "[\\s-]");
-  const headerRe = new RegExp(`^=====> (.+?)\\s+${nsPattern}\\s+information`, "i");
-  for (const section of sections) {
-    const headerEnd = section.indexOf("\n");
-    if (headerEnd === -1) continue;
-    const header = section.slice(0, headerEnd);
-    const match = header.match(headerRe);
-    if (!match) continue;
-    const app = match[1];
-    result.set(app, parseReport(section, namespace));
-  }
-  return result;
-}
-
 // src/resources/lists.ts
 function splitWords(raw) {
   return raw.split(/\s+/).map((s) => s.trim()).filter(Boolean);
 }
-function splitLines(raw) {
-  return raw.split("\n").map((s) => s.trim()).filter(Boolean);
-}
 var Ports = {
   key: "ports",
   read: async (ctx, target) => {
@@ -528,24 +816,53 @@ var Ports = {
     await ctx.run("ports:set", target, ...change.after);
   }
 };
+function parseEnabled(raw) {
+  const v = raw.trim();
+  if (v === "true") return true;
+  if (v === "false") return false;
+  throw new Error(`unexpected domains:report --domains-app-enabled output: '${v}'`);
+}
 var Domains = {
   key: "domains",
   read: async (ctx, target) => {
+    let enabledRaw;
+    try {
+      enabledRaw = await ctx.queryStrict("domains:report", target, "--domains-app-enabled");
+    } catch (err) {
+      if (!await ctx.check("apps:exists", target)) return [];
+      throw err;
+    }
+    const enabled = parseEnabled(enabledRaw);
+    if (!enabled) return false;
     const raw = await ctx.query("domains:report", target, "--domains-app-vhosts");
-    return splitLines(raw);
+    return splitWords(raw);
   },
   readAll: async (ctx) => {
     const raw = await ctx.query("domains:report");
     const bulk = parseBulkReport(raw, "domains");
     const result = /* @__PURE__ */ new Map();
     for (const [app, report] of bulk) {
-      result.set(app, report["app-vhosts"] ? splitWords(report["app-vhosts"]) : []);
+      if (report["app-enabled"] === void 0) {
+        result.set(app, splitWords(report["app-vhosts"] ?? ""));
+        continue;
+      }
+      result.set(app, parseEnabled(report["app-enabled"]) ? splitWords(report["app-vhosts"] ?? "") : false);
     }
     return result;
   },
-  onChange: async (ctx, target, { added, removed }) => {
-    for (const d of removed) await ctx.run("domains:remove", target, d);
-    for (const d of added) await ctx.run("domains:add", target, d);
+  onChange: async (ctx, target, { before, after }) => {
+    if (after === false) {
+      await ctx.run("domains:disable", target);
+      return;
+    }
+    if (Array.isArray(before)) {
+      const { added, removed } = computeChange(before, after);
+      for (const d of removed) await ctx.run("domains:remove", target, d);
+      for (const d of added) await ctx.run("domains:add", target, d);
+      return;
+    }
+    await ctx.run("domains:enable", target);
+    await ctx.run("domains:set", target, ...after);
   }
 };
 function parseDeployMounts(raw) {
@@ -567,146 +884,14 @@ var Storage = {
     return result;
   },
   onChange: async (ctx, target, { added, removed }) => {
-    for (const m of removed) await ctx.run("storage:unmount", target, m);
-    for (const m of added) await ctx.run("storage:mount", target, m);
-  }
-};
-
-// src/resources/properties.ts
-async function isAppDeployed(ctx, target) {
-  const raw = await ctx.query("ps:report", target, "--deployed");
-  return raw.trim() === "true";
-}
-var NGINX_KEYS = [
-  "access-log-format",
-  "access-log-path",
-  "bind-address-ipv4",
-  "bind-address-ipv6",
-  "client-body-timeout",
-  "client-header-timeout",
-  "client-max-body-size",
-  "disable-custom-config",
-  "error-log-path",
-  "hsts",
-  "hsts-include-subdomains",
-  "hsts-max-age",
-  "hsts-preload",
-  "keepalive-timeout",
-  "lingering-timeout",
-  "proxy-buffer-size",
-  "proxy-buffering",
-  "proxy-buffers",
-  "proxy-busy-buffers-size",
-  "proxy-connect-timeout",
-  "proxy-keepalive",
-  "proxy-read-timeout",
-  "proxy-send-timeout",
-  "send-timeout",
-  "underscore-in-headers",
-  "x-forwarded-for-value",
-  "x-forwarded-port-value",
-  "x-forwarded-proto-value",
-  "x-forwarded-ssl"
-];
-var LOGS_KEYS = ["app-label-alias", "max-size", "vector-cron-sink", "vector-sink"];
-var REGISTRY_KEYS = [
-  "auth-servers",
-  "image-repo",
-  "image-repo-template",
-  "push-extra-tags",
-  "push-on-release",
-  "server"
-];
-function propertyRemovals(allowed) {
-  return (current, desired) => Object.keys(current ?? {}).filter((k) => allowed.includes(k) && !(desired && k in desired));
-}
-function propertyPrune(setCmd, afterPrune = []) {
-  return async (ctx, target, removed) => {
-    for (const key of removed) await ctx.run(setCmd, target, key);
-    for (const cmd of afterPrune) {
-      try {
-        await ctx.run(cmd, target);
-      } catch (err) {
-        if (await isAppDeployed(ctx, target)) throw err;
-        logWarn(target, `${cmd} failed on an undeployed app \u2014 its proxy config will be built on first deploy`);
-      }
+    for (const m of removed) {
+      await ctx.run("storage:unmount", target, m);
+      ctx.needsRestart(target, "storage");
     }
-  };
-}
-function propertyResource(opts) {
-  return {
-    key: opts.key,
-    // Keys only on the server never make the block "changed"; diff shows them as removals.
-    additive: true,
-    removals: propertyRemovals(opts.settable),
-    prune: propertyPrune(opts.setCmd, opts.afterChange),
-    async read(ctx, target) {
-      const raw = await ctx.query(`${opts.namespace}:report`, target);
-      return parseReport(raw, opts.namespace);
-    },
-    async readAll(ctx) {
-      const raw = await ctx.query(`${opts.namespace}:report`);
-      return parseBulkReport(raw, opts.namespace);
-    },
-    async onChange(ctx, target, change, deferFollowUp = false) {
-      for (const [key, value] of Object.entries({ ...change.added, ...change.modified })) {
-        await ctx.run(opts.setCmd, target, key, String(value));
-      }
-      if (opts.afterChange && !deferFollowUp) {
-        for (const cmd of opts.afterChange) {
-          try {
-            await ctx.run(cmd, target);
-          } catch (err) {
-            if (await isAppDeployed(ctx, target)) throw err;
-            logWarn(target, `${cmd} failed on an undeployed app \u2014 its proxy config will be built on first deploy`);
-          }
-        }
-      }
+    for (const m of added) {
+      await ctx.run("storage:mount", target, m);
+      ctx.needsRestart(target, "storage");
     }
-  };
-}
-var Nginx = propertyResource({
-  key: "nginx",
-  namespace: "nginx",
-  setCmd: "nginx:set",
-  settable: NGINX_KEYS,
-  afterChange: ["proxy:build-config"]
-});
-var Logs = propertyResource({
-  key: "logs",
-  namespace: "logs",
-  setCmd: "logs:set",
-  settable: LOGS_KEYS
-});
-var Registry = propertyResource({
-  key: "registry",
-  namespace: "registry",
-  setCmd: "registry:set",
-  settable: REGISTRY_KEYS
-});
-var Scheduler = {
-  key: "scheduler",
-  // A scheduler selected on the app but not declared in the file.
-  removals: (current, desired) => desired === void 0 && current ? ["scheduler"] : [],
-  prune: async (ctx, target) => {
-    await ctx.run("scheduler:set", target, "selected");
-  },
-  async read(ctx, target) {
-    const raw = await ctx.query("scheduler:report", target);
-    const report = parseReport(raw, "scheduler");
-    return report["selected"] ?? "";
-  },
-  async readAll(ctx) {
-    const raw = await ctx.query("scheduler:report");
-    const bulk = parseBulkReport(raw, "scheduler");
-    const result = /* @__PURE__ */ new Map();
-    for (const [app, report] of bulk) {
-      result.set(app, report["selected"] ?? "");
-    }
-    return result;
-  },
-  async onChange(ctx, target, change) {
-    await ctx.run("scheduler:set", target, "selected", change.after);
   }
 };
 
@@ -730,6 +915,40 @@ var Proxy = {
     await ctx.run(after ? "proxy:enable" : "proxy:disable", target);
   }
 };
+var PROXY_PROP_KEYS = ["type", "proxy_port", "proxy_ssl_port"];
+function proxyPropsFromReport(report) {
+  const config = {};
+  if (report["type"]) config.type = report["type"];
+  if (report["proxy-port"]) config.proxy_port = report["proxy-port"];
+  if (report["proxy-ssl-port"]) config.proxy_ssl_port = report["proxy-ssl-port"];
+  return config;
+}
+var ProxyProps = {
+  key: "proxy_props",
+  additive: true,
+  // Dokku writes `proxy-port` and `proxy-ssl-port` itself on every nginx build, so they are
+  // compared only when declared and are never removals; only `type` is the user's to remove.
+  removals: (current, desired) => ["type"].filter((k) => current?.[k] !== void 0 && !(desired && k in desired)),
+  prune: async (ctx, target, removed) => {
+    for (const key of removed) await ctx.run("proxy:set", target, key.replaceAll("_", "-"));
+  },
+  read: async (ctx, target) => proxyPropsFromReport(parseReport(await ctx.query("proxy:report", target), "proxy")),
+  readAll: async (ctx) => {
+    const bulk = parseBulkReport(await ctx.query("proxy:report"), "proxy");
+    return new Map([...bulk].map(([app, report]) => [app, proxyPropsFromReport(report)]));
+  },
+  onChange: async (ctx, target, change) => {
+    for (const [key, value] of Object.entries({ ...change.added, ...change.modified })) {
+      await ctx.run("proxy:set", target, key.replaceAll("_", "-"), String(value));
+    }
+  }
+};
+function proxyProps(proxy) {
+  if (!proxy) return void 0;
+  const props = {};
+  for (const k of PROXY_PROP_KEYS) if (proxy[k] !== void 0) props[k] = proxy[k];
+  return Object.keys(props).length > 0 ? props : void 0;
+}
 
 // src/core/config-json.ts
 function parseConfigJson(raw, what) {
@@ -771,6 +990,7 @@ var Config = {
     const { added, removed, modified } = change;
     if (removed.length > 0) {
       await ctx.run("config:unset", "--no-restart", target, ...removed);
+      ctx.needsRestart(target, "env");
     }
     const allDesiredKeys = Object.keys(change.after);
     if (allDesiredKeys.length === 0) {
@@ -787,53 +1007,127 @@ var Config = {
         ...pairs,
         `${MANAGED_KEYS_VAR}=${allDesiredKeys.join(",")}`
       );
+      ctx.needsRestart(target, "env");
     }
   }
 };
 
 // src/resources/certs.ts
+import * as fs2 from "fs";
+var NO_ENDPOINT = "doesn't have an SSL endpoint";
+function readCertFile(path2) {
+  try {
+    return fs2.readFileSync(path2, "utf8");
+  } catch (err) {
+    throw new Error(`ssl: cannot read certfile '${path2}': ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
 var Certs = {
   key: "ssl",
   read: async (ctx, target) => {
-    const raw = (await ctx.query("certs:report", target, "--ssl-enabled")).trim();
-    if (raw === "") return void 0;
-    return raw === "true";
-  },
-  readAll: async (ctx) => {
-    const raw = await ctx.query("certs:report");
-    const bulk = parseBulkReport(raw, "ssl");
-    const result = /* @__PURE__ */ new Map();
-    for (const [app, report] of bulk) {
-      const enabled = report["enabled"];
-      result.set(app, enabled === void 0 ? void 0 : enabled === "true");
+    const enabled = (await ctx.query("certs:report", target, "--ssl-enabled")).trim();
+    if (enabled === "false") return false;
+    if (enabled !== "true") return void 0;
+    try {
+      return { crt: await ctx.queryStrict("certs:show", target, "crt") };
+    } catch (err) {
+      if (err instanceof DokkuCommandError && err.message.includes(NO_ENDPOINT)) return false;
+      return void 0;
     }
-    return result;
+  },
+  inSync: (current, desired) => {
+    const installed = current;
+    if (installed === void 0) return false;
+    if (desired === false) return installed === false;
+    if (desired === true) return installed !== false;
+    if (installed === false || typeof desired !== "object" || !("certfile" in desired)) return false;
+    return installed.crt.trimEnd() === readCertFile(desired.certfile).trimEnd();
   },
   onChange: async (ctx, target, { before, after }) => {
+    if (before === void 0) {
+      throw new Error("ssl: could not read the installed certificate; left as is");
+    }
     if (after === false && before) {
       await ctx.run("certs:remove", target);
     }
-    if (after && typeof after === "object") {
-      await ctx.run("certs:add", target, after.certfile, after.keyfile);
+    if (after && typeof after === "object" && "certfile" in after) {
+      await ctx.run(before ? "certs:update" : "certs:add", target, after.certfile, after.keyfile);
     }
   }
 };
 
+// src/core/shellwords.ts
+function shellSplit(input) {
+  const words = [];
+  let cur = "";
+  let inWord = false;
+  let quote = null;
+  for (let i = 0; i < input.length; i++) {
+    const c = input[i];
+    if (quote === "'") {
+      if (c === "'") quote = null;
+      else cur += c;
+    } else if (c === "\\") {
+      if (i + 1 >= input.length) return void 0;
+      cur += input[++i];
+      inWord = true;
+    } else if (quote === '"') {
+      if (c === '"') quote = null;
+      else cur += c;
+    } else if (c === '"' || c === "'") {
+      quote = c;
+      inWord = true;
+    } else if (/\s/.test(c)) {
+      if (inWord) {
+        words.push(cur);
+        cur = "";
+        inWord = false;
+      }
+    } else {
+      cur += c;
+      inWord = true;
+    }
+  }
+  if (quote) return void 0;
+  if (inWord) words.push(cur);
+  return words;
+}
+function quoteShellArg(s) {
+  if (s === "") return "''";
+  if (!/[ \t\n"'$`\\*?\[\]<>|&;(){}!#~]/.test(s)) return s;
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+
 // src/resources/builder.ts
-function parseBuildOptions(dockerOptsBuild) {
+function parseBuildOptions(buildList) {
   const out = [];
-  for (const raw of dockerOptsBuild.trim().split(/\s+(?=--\S)/)) {
-    const m = raw.match(/^--build-arg\s+([^=\s]+)=?(.*)$/s);
+  for (const raw of buildList) {
+    const words = shellSplit(raw) ?? raw.trim().split(/\s+/);
+    if (words[0] !== "--build-arg" || words.length < 2) continue;
+    const m = words.slice(1).join(" ").match(/^([^=\s]+)=?(.*)$/s);
     if (m) out.push({ key: m[1], value: m[2], raw });
   }
   return out;
 }
-function parseBuildArgs(dockerOptsBuild) {
+function parseBuildArgs(buildList) {
   const args = {};
-  for (const o of parseBuildOptions(dockerOptsBuild)) args[o.key] = o.value;
+  for (const o of parseBuildOptions(buildList)) args[o.key] = o.value;
   return args;
 }
-function buildConfigFromReports(builderReport, dockerfileReport, appJsonReport, dockerOptsBuild) {
+async function readBuildList(ctx, target) {
+  const raw = await ctx.query("docker-options:report", target, "--format", "json");
+  if (!raw.trim()) return [];
+  let report;
+  try {
+    report = JSON.parse(raw);
+  } catch {
+    report = void 0;
+  }
+  const list = report?.["build-list"];
+  if (!Array.isArray(list)) throw new Error(`docker-options:report ${target} --format json did not return a build-list (needs Dokku >= 0.38.22)`);
+  return list.map(String);
+}
+function buildConfigFromReports(builderReport, dockerfileReport, appJsonReport, buildList) {
   const config = {};
   if (dockerfileReport["dockerfile-path"])
     config.dockerfile = dockerfileReport["dockerfile-path"];
@@ -841,71 +1135,93 @@ function buildConfigFromReports(builderReport, dockerfileReport, appJsonReport,
     config.app_json = appJsonReport["selected"];
   if (builderReport["build-dir"])
     config.context = builderReport["build-dir"];
-  const args = parseBuildArgs(dockerOptsBuild);
+  if (builderReport["selected"])
+    config.selected = builderReport["selected"];
+  if (builderReport["skip-cleanup"])
+    config.skip_cleanup = builderReport["skip-cleanup"];
+  const args = parseBuildArgs(buildList);
   if (Object.keys(args).length > 0) config.args = args;
+  const seen = /* @__PURE__ */ new Set();
+  const duplicated = /* @__PURE__ */ new Set();
+  for (const o of parseBuildOptions(buildList)) (seen.has(o.key) ? duplicated : seen).add(o.key);
+  Object.defineProperty(config, "duplicateArgs", { value: duplicated, enumerable: false });
   return config;
 }
 var Builder = {
   key: "build",
   additive: true,
-  // Build args (`--build-arg KEY=...` build docker options) whose KEY is not in `build.args`.
-  removals: (current, desired) => Object.keys(current?.args ?? {}).filter((k) => !(desired?.args && k in desired.args)).map((k) => `args.${k}`),
-  // Remove exactly the stale `--build-arg` options; other build options stay.
+  // Additive compare, plus: a declared arg stored more than once is drift until one option is left.
+  inSync: (current, desired) => !computeAdditiveChange(current, desired).changed && !Object.keys(desired.args ?? {}).some((k) => current?.duplicateArgs?.has(k)),
+  // `builder:set` keys and build args (`--build-arg KEY=...` build docker options) not in the file.
+  removals: (current, desired) => [
+    ...["selected", "skip_cleanup"].filter((k) => current?.[k] !== void 0 && desired?.[k] === void 0),
+    ...Object.keys(current?.args ?? {}).filter((k) => !(desired?.args && k in desired.args)).map((k) => `args.${k}`)
+  ],
+  // Reset the stale `builder:set` keys; remove exactly the stale `--build-arg` options, other build options stay.
   prune: async (ctx, target, removed) => {
-    const stale = new Set(removed.map((l) => l.slice("args.".length)));
-    const report = parseReport(await ctx.query("docker-options:report", target), "docker-options");
-    const options = parseBuildOptions(report["build"] ?? "").filter((o) => stale.has(o.key));
-    for (const o of options) await ctx.run("docker-options:remove", target, "build", o.raw);
+    for (const key of removed.filter((l) => !l.startsWith("args."))) {
+      await ctx.run("builder:set", target, key.replaceAll("_", "-"));
+      ctx.needsRebuild(target, "build");
+    }
+    const stale = new Set(removed.filter((l) => l.startsWith("args.")).map((l) => l.slice("args.".length)));
+    if (stale.size === 0) return;
+    const options = parseBuildOptions(await readBuildList(ctx, target)).filter((o) => stale.has(o.key));
+    for (const o of options) {
+      await ctx.run("docker-options:remove", target, "build", o.raw);
+      ctx.needsRebuild(target, "build args");
+    }
     for (const k of stale) {
       if (!options.some((o) => o.key === k)) logWarn(target, `build arg '${k}' not found as an exact docker option; left as is`);
     }
   },
   async read(ctx, target) {
-    const [builderRaw, dockerfileRaw, appJsonRaw, dockerOptsRaw] = await Promise.all([
+    const [builderRaw, dockerfileRaw, appJsonRaw, buildList] = await Promise.all([
       ctx.query("builder:report", target),
       ctx.query("builder-dockerfile:report", target),
       ctx.query("app-json:report", target),
-      ctx.query("docker-options:report", target)
+      readBuildList(ctx, target)
     ]);
     return buildConfigFromReports(
       parseReport(builderRaw, "builder"),
       parseReport(dockerfileRaw, "builder-dockerfile"),
       parseReport(appJsonRaw, "app-json"),
-      parseReport(dockerOptsRaw, "docker-options")["build"] ?? ""
+      buildList
     );
   },
-  async readAll(ctx) {
-    const [builderRaw, dockerfileRaw, appJsonRaw, dockerOptsRaw] = await Promise.all([
-      ctx.query("builder:report"),
-      ctx.query("builder-dockerfile:report"),
-      ctx.query("app-json:report"),
-      ctx.query("docker-options:report")
-    ]);
-    const builderBulk = parseBulkReport(builderRaw, "builder");
-    const dockerfileBulk = parseBulkReport(dockerfileRaw, "builder-dockerfile");
-    const appJsonBulk = parseBulkReport(appJsonRaw, "app-json");
-    const dockerOptsBulk = parseBulkReport(dockerOptsRaw, "docker-options");
-    const result = /* @__PURE__ */ new Map();
-    for (const app of builderBulk.keys()) {
-      result.set(app, buildConfigFromReports(
-        builderBulk.get(app) ?? {},
-        dockerfileBulk.get(app) ?? {},
-        appJsonBulk.get(app) ?? {},
-        dockerOptsBulk.get(app)?.["build"] ?? ""
-      ));
-    }
-    return result;
-  },
-  async onChange(ctx, target, { after }) {
-    if (after.dockerfile)
+  async onChange(ctx, target, { before, after }) {
+    if (after.dockerfile && after.dockerfile !== before?.dockerfile) {
       await ctx.run("builder-dockerfile:set", target, "dockerfile-path", after.dockerfile);
-    if (after.app_json)
+      ctx.needsRebuild(target, "build");
+    }
+    if (after.app_json && after.app_json !== before?.app_json) {
       await ctx.run("app-json:set", target, "appjson-path", after.app_json);
-    if (after.context)
+      ctx.needsRebuild(target, "build");
+    }
+    if (after.context && after.context !== before?.context) {
       await ctx.run("builder:set", target, "build-dir", after.context);
+      ctx.needsRebuild(target, "build");
+    }
+    if (after.selected && after.selected !== before?.selected) {
+      await ctx.run("builder:set", target, "selected", after.selected);
+      ctx.needsRebuild(target, "build");
+    }
+    if (after.skip_cleanup !== void 0 && String(after.skip_cleanup) !== String(before?.skip_cleanup))
+      await ctx.run("builder:set", target, "skip-cleanup", String(after.skip_cleanup));
     if (after.args) {
+      const stored = parseBuildOptions(await readBuildList(ctx, target));
+      const current = parseBuildArgs(stored.map((o) => o.raw));
+      const dup = before?.duplicateArgs;
+      const changedKeys = new Set(Object.keys(after.args).filter((k) => k in current && (current[k] !== after.args[k] || dup?.has(k))));
+      if (changedKeys.size > 0) {
+        for (const o of stored.filter((o2) => changedKeys.has(o2.key))) {
+          await ctx.run("docker-options:remove", target, "build", o.raw);
+          ctx.needsRebuild(target, "build args");
+        }
+      }
       for (const [key, value] of Object.entries(after.args)) {
-        await ctx.run("docker-options:add", target, "build", `--build-arg ${key}=${value}`);
+        if (key in current && !changedKeys.has(key)) continue;
+        await ctx.run("docker-options:add", target, "build", `--build-arg ${quoteShellArg(`${key}=${value}`)}`);
+        ctx.needsRebuild(target, "build args");
       }
     }
   }
@@ -949,22 +1265,43 @@ var DockerOptions = {
     }
     return result;
   },
+  // Dokku: options "only apply to containers created after the options have been
+  // modified" (docs/advanced-usage/docker-options.md, v0.38.31), so deploy and
+  // run options need a restart. Build options are read only by a build, which
+  // a restart does not run, so they need `ps:rebuild`.
   async onChange(ctx, target, { before, after }) {
     for (const phase of PHASES) {
       const prev = new Set(before[phase] ?? []);
       const desired = new Set(after[phase] ?? []);
       for (const opt of desired) {
-        if (!prev.has(opt)) await ctx.run("docker-options:add", target, phase, opt);
+        if (!prev.has(opt)) {
+          await ctx.run("docker-options:add", target, phase, opt);
+          if (phase === "build") ctx.needsRebuild(target, "build options");
+          else ctx.needsRestart(target, "docker_options");
+        }
       }
       for (const opt of prev) {
-        if (!desired.has(opt)) await ctx.run("docker-options:remove", target, phase, opt);
+        if (!desired.has(opt)) {
+          await ctx.run("docker-options:remove", target, phase, opt);
+          if (phase === "build") ctx.needsRebuild(target, "build options");
+          else ctx.needsRestart(target, "docker_options");
+        }
       }
     }
   }
 };
 
 // src/resources/ps.ts
-var PS_KEYS = ["procfile-path", "restart-policy", "stop-timeout-seconds"];
+var PS_KEYS = [
+  "dockerfile-start-cmd",
+  "procfile-path",
+  "restart-policy",
+  "restore",
+  "skip-deploy",
+  "start-cmd",
+  "stop-timeout-seconds"
+];
+var DOKKU_MANAGED = /* @__PURE__ */ new Set(["restore"]);
 function parseScale(raw) {
   const result = {};
   let parsed;
@@ -1011,7 +1348,7 @@ var Scale = {
 var Ps = {
   key: "ps",
   additive: true,
-  removals: (current, desired) => PS_KEYS.filter((k) => current?.[k] !== void 0 && !(desired && k in desired)),
+  removals: (current, desired) => PS_KEYS.filter((k) => current?.[k] !== void 0 && !DOKKU_MANAGED.has(k) && !(desired && k in desired)),
   prune: async (ctx, target, removed) => {
     for (const key of removed) await ctx.run("ps:set", target, key);
   },
@@ -1026,24 +1363,35 @@ var Ps = {
 };
 
 // src/resources/git.ts
+var toDokku = (key) => key.replaceAll("_", "-");
+var NOT_REMOVABLE = /* @__PURE__ */ new Set(["deploy_branch", "source_image", "rev_env_var"]);
+function fromReport(report) {
+  const config = {};
+  if (report["deploy-branch"]) config.deploy_branch = report["deploy-branch"];
+  if (report["keep-git-dir"]) config.keep_git_dir = report["keep-git-dir"];
+  if (report["rev-env-var"]) config.rev_env_var = report["rev-env-var"];
+  if (report["source-image"]) config.source_image = report["source-image"];
+  return config;
+}
 var Git = {
   key: "git",
-  read: async (ctx, target) => {
-    const report = await ctx.query("git:report", target, "--git-deploy-branch");
-    return { deploy_branch: report.trim() || void 0 };
+  additive: true,
+  removals: (current, desired) => Object.keys(current ?? {}).filter((k) => !NOT_REMOVABLE.has(k) && !(desired && k in desired)),
+  prune: async (ctx, target, removed) => {
+    for (const key of removed) await ctx.run("git:set", target, toDokku(key));
   },
+  read: async (ctx, target) => fromReport(parseReport(await ctx.query("git:report", target), "git")),
   readAll: async (ctx) => {
-    const raw = await ctx.query("git:report");
-    const bulk = parseBulkReport(raw, "git");
     const result = /* @__PURE__ */ new Map();
-    for (const [app, report] of bulk) {
-      result.set(app, { deploy_branch: report["deploy-branch"] || void 0 });
+    for (const section of (await ctx.query("git:report")).split(/(?=^=====> )/m)) {
+      const app = section.match(/^=====> (.+?)\s+git\s+information/i)?.[1];
+      if (app) result.set(app, fromReport(parseReport(section, "git")));
     }
     return result;
   },
-  onChange: async (ctx, target, { after }) => {
-    if (after.deploy_branch) {
-      await ctx.run("git:set", target, "deploy-branch", after.deploy_branch);
+  onChange: async (ctx, target, change) => {
+    for (const [key, value] of Object.entries({ ...change.added, ...change.modified })) {
+      await ctx.run("git:set", target, toDokku(key), String(value));
     }
   }
 };
@@ -1051,11 +1399,12 @@ var Git = {
 // src/resources/checks.ts
 var Checks = {
   key: "checks",
-  forceApply: true,
-  // Applying never reads (forceApply); the read only finds settings to report as removed.
-  // Settable state: the per-process lists and `wait-to-retire`. A list of "none" is empty.
+  // Settable state: the per-process lists and `wait-to-retire`. A list of "none" is empty;
+  // a disabled list of `_all_` (`checks:disable <app>` with no types) reads as `false`.
   read: async (ctx, target) => {
     const report = parseReport(await ctx.query("checks:report", target), "checks");
+    if (report["disabled-list"] === void 0) return void 0;
+    if (report["disabled-list"] === "_all_") return false;
     const current = {};
     for (const [reportKey, key] of [["disabled-list", "disabled"], ["skipped-list", "skipped"]]) {
       const v = report[reportKey];
@@ -1068,7 +1417,7 @@ var Checks = {
   prune: async (ctx, target, removed, current, desired) => {
     const cur = current;
     const split = (v) => (v ?? "").split(",").map((t) => t.trim()).filter(Boolean);
-    const declared = new Set(desired && desired !== false ? [...desired.disabled ?? [], ...desired.skipped ?? []] : []);
+    const declared = new Set(desired ? [...desired.disabled ?? [], ...desired.skipped ?? []] : []);
     const stale = new Set(removed.filter((k) => k === "disabled" || k === "skipped").flatMap((k) => split(cur[k])));
     const enable = [...stale].filter((t) => !declared.has(t));
     for (const t of stale) {
@@ -1076,26 +1425,32 @@ var Checks = {
         logWarn(target, `checks: '${t}' is declared in the file but also set in a list the file does not declare; left as is. Run 'dokku checks:enable ${target} ${t}' and then 'up' to clear it`);
       }
     }
-    if (enable.length > 0) await ctx.run("checks:enable", target, ...enable);
+    if (enable.length > 0) await ctx.run("checks:enable", target, enable.join(","));
     if (removed.includes("wait-to-retire")) await ctx.run("checks:set", target, "wait-to-retire");
   },
-  onChange: async (ctx, target, { after }) => {
-    if (after === false) {
-      await ctx.run("checks:disable", target);
-      return;
-    }
-    if (after.disabled && after.disabled.length > 0) {
-      await ctx.run("checks:disable", target, ...after.disabled);
-    }
-    if (after.skipped && after.skipped.length > 0) {
-      await ctx.run("checks:skip", target, ...after.skipped);
-    }
-    for (const [key, value] of Object.entries(after)) {
-      if (key === "disabled" || key === "skipped") continue;
-      await ctx.run("checks:set", target, key, String(value));
-    }
+  inSync: (current, desired) => checksCalls(current, desired).length === 0,
+  onChange: async (ctx, target, { before, after }) => {
+    if (before === void 0) throw new Error("checks: could not read checks:report; left as is");
+    for (const call of checksCalls(before, after)) await ctx.run(call[0], target, ...call.slice(1));
   }
 };
+function checksCalls(current, desired) {
+  if (desired === false) return current === false ? [] : [["checks:disable"]];
+  const calls = [];
+  const cur = current || {};
+  if (current === false) calls.push(["checks:enable"]);
+  const split = (v) => (v ?? "").split(",").map((t) => t.trim()).filter(Boolean);
+  for (const [key, cmd] of [["disabled", "checks:disable"], ["skipped", "checks:skip"]]) {
+    const have = new Set(split(cur[key]));
+    const missing = (desired[key] ?? []).filter((t) => !have.has(t));
+    if (missing.length > 0) calls.push([cmd, missing.join(",")]);
+  }
+  for (const [key, value] of Object.entries(desired)) {
+    if (key === "disabled" || key === "skipped") continue;
+    if (cur[key] !== String(value)) calls.push(["checks:set", key, String(value)]);
+  }
+  return calls;
+}
 
 // src/resources/network.ts
 var Networks = {
@@ -1115,6 +1470,7 @@ var Networks = {
   },
   onChange: async (ctx, target, { after }) => {
     await ctx.run("network:set", target, "attach-post-deploy", ...after);
+    ctx.needsRebuild(target, "networks");
   }
 };
 var NetworkProps = {
@@ -1123,7 +1479,11 @@ var NetworkProps = {
   removals: (current, desired) => Object.keys(current ?? {}).filter((k) => !(desired && k in desired)),
   // Dokku's property names are hyphenated; the schema's are underscored.
   prune: async (ctx, target, removed) => {
-    for (const key of removed) await ctx.run("network:set", target, key.replaceAll("_", "-"));
+    for (const key of removed) {
+      await ctx.run("network:set", target, key.replaceAll("_", "-"));
+      if (key === "attach_post_create" || key === "initial_network") ctx.needsRebuild(target, "network");
+      else ctx.needsRestart(target, "network");
+    }
   },
   read: async (ctx, target) => {
     const raw = await ctx.query("network:report", target);
@@ -1134,6 +1494,7 @@ var NetworkProps = {
     }
     if (report["initial-network"]) config.initial_network = report["initial-network"];
     if (report["bind-all-interfaces"] === "true") config.bind_all_interfaces = true;
+    if (report["static-web-listener"]) config.static_web_listener = report["static-web-listener"];
     if (report["tld"]) config.tld = report["tld"];
     return config;
   },
@@ -1148,6 +1509,7 @@ var NetworkProps = {
       }
       if (report["initial-network"]) config.initial_network = report["initial-network"];
       if (report["bind-all-interfaces"] === "true") config.bind_all_interfaces = true;
+      if (report["static-web-listener"]) config.static_web_listener = report["static-web-listener"];
       if (report["tld"]) config.tld = report["tld"];
       result.set(app, config);
     }
@@ -1157,15 +1519,22 @@ var NetworkProps = {
     if (after.attach_post_create !== void 0 && after.attach_post_create !== false) {
       const nets = Array.isArray(after.attach_post_create) ? after.attach_post_create : [after.attach_post_create];
       await ctx.run("network:set", target, "attach-post-create", ...nets);
+      ctx.needsRebuild(target, "network");
     }
     if (after.initial_network !== void 0 && after.initial_network !== false) {
       await ctx.run("network:set", target, "initial-network", after.initial_network);
+      ctx.needsRebuild(target, "network");
     }
     if (after.bind_all_interfaces !== void 0) {
       await ctx.run("network:set", target, "bind-all-interfaces", String(after.bind_all_interfaces));
+      ctx.needsRestart(target, "network");
+    }
+    if (after.static_web_listener !== void 0 && after.static_web_listener !== false) {
+      await ctx.run("network:set", target, "static-web-listener", after.static_web_listener);
     }
     if (after.tld !== void 0 && after.tld !== false) {
       await ctx.run("network:set", target, "tld", after.tld);
+      ctx.needsRestart(target, "network");
     }
   }
 };
@@ -1259,13 +1628,61 @@ async function ensurePlugins(ctx, plugins) {
 }
 
 // src/modules/docker-auth.ts
+var AUTH_MATCH = 0;
+var AUTH_MISSING = 1;
+var AUTH_DIFFERS = 2;
+var AUTH_INVALID_ARGUMENTS = 3;
+var AUTH_UNKNOWN = 4;
+function registryHostname(server) {
+  const normalized = server === "hub.docker.com" || server === "docker.com" ? "docker.io" : server;
+  const host = normalized.replace(/^https?:\/\//, "").split("/")[0];
+  return ["", "docker.io", "index.docker.io"].includes(host) ? "docker.io" : host;
+}
+async function loginMatches(ctx, server, creds) {
+  const code = await ctx.status(
+    ["registry:auth-status", "--global", "--password-stdin", server, creds.username],
+    creds.password
+  );
+  if (code === AUTH_MATCH) return true;
+  if (code === AUTH_MISSING || code === AUTH_DIFFERS || code === AUTH_UNKNOWN) return false;
+  if (code === AUTH_INVALID_ARGUMENTS) {
+    throw new Error(`registry:auth-status rejected the arguments for ${server} (exit 3)`);
+  }
+  throw new Error(`registry:auth-status failed for ${server} (exit ${code})`);
+}
+async function globalAuthServers(ctx) {
+  const raw = await ctx.query("registry:report", "--global", "--registry-global-auth-servers");
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
 async function ensureDockerAuth(ctx, config) {
   for (const [server, creds] of Object.entries(config)) {
     logAction("docker-auth", `Logging in to ${server} as ${creds.username}`);
-    await ctx.run("registry:login", "--global", server, creds.username, creds.password);
+    if (await loginMatches(ctx, server, creds)) {
+      logSkip();
+      continue;
+    }
+    await ctx.runWithInput(creds.password, "registry:login", "--global", "--password-stdin", server, creds.username);
+    logDone();
+  }
+}
+async function pruneDockerAuth(ctx, config) {
+  const declared = new Set(Object.keys(config).map(registryHostname));
+  for (const server of await globalAuthServers(ctx)) {
+    if (declared.has(server)) continue;
+    logAction("docker-auth", `Logging out of ${server}`);
+    await ctx.run("registry:logout", "--global", server);
     logDone();
   }
 }
+async function readDockerAuthDrift(ctx, config) {
+  const stale = [];
+  for (const [server, creds] of Object.entries(config)) {
+    if (!await loginMatches(ctx, server, creds)) stale.push(server);
+  }
+  const declared = new Set(Object.keys(config).map(registryHostname));
+  const extra = (await globalAuthServers(ctx)).filter((s) => !declared.has(s));
+  return { stale, extra };
+}
 
 // src/modules/network.ts
 async function ensureNetworks(ctx, networks) {
@@ -1286,61 +1703,255 @@ async function exportNetworks(ctx) {
   return output.split("\n").map((s) => s.trim()).filter((s) => s && !s.startsWith("=====>") && !DOCKER_BUILTIN_NETWORKS.has(s));
 }
 
-// src/modules/postgres.ts
+// src/modules/service-drift.ts
 import { createHash as createHash2 } from "crypto";
-function backupHashKey(serviceName) {
-  return "DOKKU_COMPOSE_BACKUP_HASH_" + serviceName.toUpperCase().replace(/-/g, "_");
+var infoReads = /* @__PURE__ */ new WeakMap();
+function readServiceInfo(ctx, plugin, name) {
+  let reads = infoReads.get(ctx);
+  if (!reads) {
+    reads = /* @__PURE__ */ new Map();
+    infoReads.set(ctx, reads);
+  }
+  const key = `${plugin}\0${name}`;
+  let read = reads.get(key);
+  if (!read) {
+    read = fetchServiceInfo(ctx, plugin, name);
+    read.catch(() => reads.delete(key));
+    reads.set(key, read);
+  }
+  return read;
+}
+async function fetchServiceInfo(ctx, plugin, name) {
+  const raw = await ctx.queryStrict(`${plugin}:info`, name, "--format", "json");
+  try {
+    const info = JSON.parse(raw);
+    if (info && typeof info === "object" && !Array.isArray(info)) return info;
+  } catch {
+  }
+  throw new Error(`${plugin}:info ${name} --format json did not return JSON`);
+}
+var field = (info, key) => String(info[key] ?? "");
+function versionMismatches(info, declared) {
+  const out = [];
+  if (declared.version !== void 0 && declared.version !== field(info, "image-version")) {
+    out.push({ field: "version", desired: declared.version, current: field(info, "image-version") });
+  }
+  if (declared.image !== void 0 && declared.image !== field(info, "image")) {
+    out.push({ field: "image", desired: declared.image, current: field(info, "image") });
+  }
+  return out;
+}
+async function readServiceMismatches(ctx, plugin, name, declared) {
+  if (declared.version === void 0 && declared.image === void 0) return [];
+  return versionMismatches(await readServiceInfo(ctx, plugin, name), declared);
+}
+function backupAuthFingerprint(accessKeyId, secretAccessKey) {
+  const firstLine = (v) => v.trim().split("\n")[0].trim();
+  return createHash2("sha256").update(`${firstLine(accessKeyId)}
+${firstLine(secretAccessKey)}`).digest("hex");
+}
+function hasBackup(info) {
+  return field(info, "backup-schedule") !== "" || field(info, "backup-authenticated") === "true";
+}
+function backupMismatches(info, backup) {
+  for (const key of ["backup-authenticated", "backup-auth-fingerprint", "backup-schedule"]) {
+    if (!(key in info)) throw new Error("dokku-postgres too old to report backup state (needs 2.3.1+)");
+  }
+  if (backup === false) {
+    return hasBackup(info) ? [{ field: "backup", desired: "none", current: describeServerBackup(info) }] : [];
+  }
+  const out = [];
+  const { auth } = backup;
+  const authDiffers = [];
+  if (field(info, "backup-auth-fingerprint") !== backupAuthFingerprint(auth.access_key_id, auth.secret_access_key)) {
+    authDiffers.push("credentials");
+  }
+  if (field(info, "backup-default-region") !== auth.region) authDiffers.push("region");
+  if (field(info, "backup-signature-version") !== auth.signature_version) authDiffers.push("signature version");
+  if (field(info, "backup-endpoint-url") !== auth.endpoint) authDiffers.push("endpoint");
+  if (authDiffers.length > 0) {
+    out.push({
+      field: "backup.auth",
+      desired: `${authDiffers.join(", ")} from the file`,
+      current: field(info, "backup-authenticated") === "true" ? "other values" : "not authenticated"
+    });
+  }
+  if (field(info, "backup-schedule") !== backup.schedule) {
+    out.push({ field: "backup.schedule", desired: backup.schedule, current: field(info, "backup-schedule") });
+  }
+  if (field(info, "backup-bucket") !== backup.bucket) {
+    out.push({ field: "backup.bucket", desired: backup.bucket, current: field(info, "backup-bucket") });
+  }
+  return out;
 }
-function computeBackupHash(backup) {
-  return createHash2("sha256").update(JSON.stringify(backup)).digest("hex");
+function describeServerBackup(info) {
+  const schedule = field(info, "backup-schedule");
+  const parts = [];
+  if (schedule) parts.push(`scheduled ${schedule} to ${field(info, "backup-bucket")}`);
+  if (field(info, "backup-authenticated") === "true") parts.push("credentials stored");
+  return parts.join(", ") || "none";
 }
+
+// src/modules/config.ts
+var MANAGED_KEYS_VAR2 = "DOKKU_COMPOSE_MANAGED_KEYS";
+var GLOBAL_MANAGED_KEYS_VAR = "DOKKU_COMPOSE_GLOBAL_MANAGED_KEYS";
+function isReserved(key) {
+  return key === GLOBAL_MANAGED_KEYS_VAR || key === MANAGED_KEYS_VAR2 || key.startsWith(BACKUP_HASH_PREFIX);
+}
+var globalEnvReads = /* @__PURE__ */ new WeakMap();
+function readGlobalEnv(ctx) {
+  let read = globalEnvReads.get(ctx);
+  if (!read) {
+    read = ctx.queryStrict("config:export", "--global", "--format", "json").then((raw) => parseConfigJson(raw, "--global"));
+    read.catch(() => globalEnvReads.delete(ctx));
+    globalEnvReads.set(ctx, read);
+  }
+  return read;
+}
+var BACKUP_HASH_PREFIX = "DOKKU_COMPOSE_BACKUP_HASH_";
+async function planGlobalEnv(ctx, env, read) {
+  const current = read ?? await readGlobalEnv(ctx);
+  const desired = Object.fromEntries(Object.entries(env).map(([k, v]) => [k, String(v)]));
+  const managed = (current[GLOBAL_MANAGED_KEYS_VAR] ?? "").split(",").filter(Boolean);
+  const removed = managed.filter((k) => !(k in desired) && !isReserved(k) && k in current);
+  const toSet = Object.fromEntries(Object.entries(desired).filter(([k, v]) => current[k] !== v));
+  const marker = Object.keys(desired).join(",");
+  const markerOutdated = [...managed].sort().join(",") !== Object.keys(desired).sort().join(",");
+  return { toSet, removed, marker, markerOutdated };
+}
+async function ensureGlobalConfig(ctx, env) {
+  if (env === false) return false;
+  const { toSet, removed, marker, markerOutdated } = await planGlobalEnv(ctx, env ?? {});
+  const unset = [...removed];
+  if (markerOutdated && marker === "") unset.push(GLOBAL_MANAGED_KEYS_VAR);
+  if (unset.length > 0) await ctx.run("config:unset", "--global", ...unset);
+  const pairs = Object.entries(toSet).map(([k, v]) => `${k}=${v}`);
+  if (markerOutdated && marker !== "") pairs.push(`${GLOBAL_MANAGED_KEYS_VAR}=${marker}`);
+  if (pairs.length > 0) await ctx.run("config:set", "--global", ...pairs);
+  return Object.keys(toSet).length > 0 || removed.length > 0;
+}
+async function readGlobalEnvDrift(ctx, env, current) {
+  const { toSet, removed, markerOutdated } = await planGlobalEnv(ctx, env ?? {}, current);
+  return { changed: Object.keys(toSet), removed, markerOutdated };
+}
+
+// src/modules/postgres.ts
 async function ensurePostgres(ctx, services) {
+  const created = /* @__PURE__ */ new Set();
   for (const [name, config] of Object.entries(services)) {
     logAction("services", `Ensuring ${name}`);
     const exists = await ctx.check("postgres:exists", name);
     if (exists) {
       logSkip();
+      try {
+        const mismatches = await readServiceMismatches(ctx, "postgres", name, config);
+        if (mismatches.length > 0) {
+          const parts = mismatches.map((m) => `${m.field} is ${m.current || "(unknown)"} on the server but ${m.desired} in the file`);
+          logWarn("services", `${name}: ${parts.join("; ")}; up does not change it`);
+        }
+      } catch (err) {
+        logWarn("services", `${name}: could not compare version and image: ${err instanceof Error ? err.message : String(err)}`);
+      }
       continue;
     }
     const args = ["postgres:create", name];
     if (config.image) args.push("--image", config.image);
     if (config.version) args.push("--image-version", config.version);
     await ctx.run(...args);
+    created.add(name);
     logDone();
   }
+  return created;
 }
-async function ensurePostgresBackups(ctx, services) {
+async function ensurePostgresBackups(ctx, services, opts = {}) {
   for (const [name, config] of Object.entries(services)) {
-    if (!config.backup) continue;
+    const backup = config.backup;
+    if (backup === void 0 && !opts.prune) continue;
+    if (backup === void 0) {
+      let info2;
+      try {
+        info2 = await readServiceInfo(ctx, "postgres", name);
+      } catch (err) {
+        logWarn("services", `could not read backup state for ${name}: ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+      }
+      if (hasBackup(info2)) {
+        logWarn("services", `${name}: has a backup the file does not declare (${describeServerBackup(info2)}); --prune leaves it, set backup: false to remove it`);
+      }
+      continue;
+    }
+    if (opts.dryRunCreated?.has(name)) {
+      logAction("services", `Configuring backup for ${name}`);
+      if (backup !== false) {
+        const { schedule: schedule2, bucket: bucket2, auth: auth2 } = backup;
+        await ctx.run(
+          "postgres:backup-auth",
+          name,
+          auth2.access_key_id,
+          auth2.secret_access_key,
+          auth2.region,
+          auth2.signature_version,
+          auth2.endpoint
+        );
+        await ctx.run("postgres:backup-schedule", name, schedule2, bucket2);
+      }
+      logDone();
+      continue;
+    }
+    const info = await readServiceInfo(ctx, "postgres", name);
     logAction("services", `Configuring backup for ${name}`);
-    const hashKey = backupHashKey(name);
-    const desiredHash = computeBackupHash(config.backup);
-    const storedHash = await ctx.query("config:get", "--global", hashKey);
-    if (storedHash === desiredHash) {
+    const fields = new Set(backupMismatches(info, backup).map((m) => m.field));
+    if (fields.size === 0) {
       logSkip();
       continue;
     }
-    const { schedule, bucket, auth } = config.backup;
-    await ctx.run(
-      "postgres:backup-auth",
-      name,
-      auth.access_key_id,
-      auth.secret_access_key,
-      auth.region,
-      auth.signature_version,
-      auth.endpoint
-    );
-    await ctx.run("postgres:backup-schedule", name, schedule, bucket);
-    const cronOutput = await ctx.query("postgres:backup-schedule-cat", name);
-    if (!parseBackupSchedule(cronOutput)) {
-      throw new Error(
-        `Backup schedule for ${name} was not installed after backup-schedule ran`
+    if (backup === false) {
+      if (String(info["backup-schedule"] ?? "") !== "") await ctx.run("postgres:backup-unschedule", name);
+      await ctx.run("postgres:backup-deauth", name);
+      logDone();
+      continue;
+    }
+    const { schedule, bucket, auth } = backup;
+    if (fields.has("backup.auth")) {
+      await ctx.run(
+        "postgres:backup-auth",
+        name,
+        auth.access_key_id,
+        auth.secret_access_key,
+        auth.region,
+        auth.signature_version,
+        auth.endpoint
       );
     }
-    await ctx.run("config:set", "--global", `${hashKey}=${desiredHash}`);
+    if (fields.has("backup.schedule")) {
+      await ctx.run("postgres:backup-schedule", name, schedule, bucket);
+      const cronOutput = await ctx.query("postgres:backup-schedule-cat", name);
+      if (!parseBackupSchedule(cronOutput)) {
+        throw new Error(`Backup schedule for ${name} was not installed after backup-schedule ran`);
+      }
+    } else if (fields.has("backup.bucket")) {
+      await ctx.run("postgres:set", name, "backup-bucket", bucket);
+    }
     logDone();
   }
 }
+async function removeBackupHashKeys(ctx) {
+  let env;
+  try {
+    env = await readGlobalEnv(ctx);
+  } catch (err) {
+    logWarn("global", `could not read global env to remove old backup hash keys: ${err instanceof Error ? err.message : String(err)}`);
+    return;
+  }
+  const stale = staleBackupHashKeys(env);
+  if (stale.length === 0) return;
+  logAction("global", `Removing ${stale.length} old backup hash key(s)`);
+  await ctx.run("config:unset", "--global", "--no-restart", ...stale);
+  logDone();
+}
+function staleBackupHashKeys(env) {
+  return Object.keys(env).filter((k) => k.startsWith(BACKUP_HASH_PREFIX)).sort();
+}
 async function destroyPostgres(ctx, services) {
   for (const [name] of Object.entries(services)) {
     logAction("services", `Destroying ${name}`);
@@ -1413,6 +2024,15 @@ async function ensureRedis(ctx, services) {
     const exists = await ctx.check("redis:exists", name);
     if (exists) {
       logSkip();
+      try {
+        const mismatches = await readServiceMismatches(ctx, "redis", name, config);
+        if (mismatches.length > 0) {
+          const parts = mismatches.map((m) => `${m.field} is ${m.current || "(unknown)"} on the server but ${m.desired} in the file`);
+          logWarn("services", `${name}: ${parts.join("; ")}; up does not change it`);
+        }
+      } catch (err) {
+        logWarn("services", `${name}: could not compare version and image: ${err instanceof Error ? err.message : String(err)}`);
+      }
       continue;
     }
     const args = ["redis:create", name];
@@ -1460,41 +2080,10 @@ async function exportRedis(ctx) {
   return services;
 }
 
-// src/modules/version.ts
-var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)/;
-function parseSemver(input) {
-  const m = input.match(SEMVER_RE);
-  if (!m) throw new Error(`Cannot parse version: ${input}`);
-  return [Number(m[1]), Number(m[2]), Number(m[3])];
-}
-function extractServerVersion(output) {
-  const match = output.match(/(\d+\.\d+\.\d+)/);
-  return match ? match[1] : null;
-}
-function compareSemver(a, b) {
-  const [aMaj, aMin, aPatch] = parseSemver(a);
-  const [bMaj, bMin, bPatch] = parseSemver(b);
-  if (aMaj !== bMaj) return aMaj < bMaj ? -1 : 1;
-  if (aMin !== bMin) return aMin < bMin ? -1 : 1;
-  if (aPatch !== bPatch) return aPatch < bPatch ? -1 : 1;
-  return 0;
-}
-async function ensureDokkuVersion(ctx, pinned) {
-  if (!pinned) return;
-  const output = await ctx.query("version");
-  const server = extractServerVersion(output);
-  if (!server) {
-    throw new Error(`Cannot parse Dokku server version from output: ${output}`);
-  }
-  if (compareSemver(server, pinned) === -1) {
-    logWarn(
-      "dokku",
-      `server is v${server} but dokku-compose.yml pins >= v${pinned}. Some features may be unavailable.`
-    );
-  }
-}
-
 // src/modules/links.ts
+function normalizeLink(entry) {
+  return typeof entry === "string" ? { service: entry } : entry;
+}
 function resolveServicePlugin(name, config) {
   if (config.postgres?.[name]) return { plugin: "postgres", config: config.postgres[name] };
   if (config.redis?.[name]) return { plugin: "redis", config: config.redis[name] };
@@ -1506,24 +2095,112 @@ function allServices(config) {
   for (const name of Object.keys(config.redis ?? {})) entries.push([name, "redis"]);
   return entries;
 }
+var DEFAULT_ENV_VAR = { postgres: "DATABASE_URL", redis: "REDIS_URL" };
+function linkEnvVar(plugin, link) {
+  if (link.env_var) return link.env_var;
+  if (link.alias) return `${link.alias}_URL`;
+  return DEFAULT_ENV_VAR[plugin] ?? `${plugin.toUpperCase()}_URL`;
+}
+function linkFlags(link) {
+  const flags = [];
+  if (link.alias) flags.push("--alias", link.alias);
+  if (link.env_var) flags.push("--env-var", link.env_var);
+  if (link.querystring) flags.push("--querystring", link.querystring);
+  return flags;
+}
+function readEnv(ctx, app, cache) {
+  let read = cache?.get(app);
+  if (!read) {
+    read = ctx.queryStrict("config:export", "--format", "json", app).then((out) => JSON.parse(out));
+    cache?.set(app, read);
+  }
+  return read;
+}
+function findLinkVariables(env, plugin, service) {
+  const host = `dokku-${plugin}-${service}`;
+  const found = [];
+  for (const [name, value] of Object.entries(env)) {
+    if (typeof value !== "string") continue;
+    const m = value.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/?]*@)?([^:/?]+)/i);
+    if (m && m[1] === host) found.push({ name, value });
+  }
+  return found;
+}
+function isFallbackName(plugin, name) {
+  return new RegExp(`^DOKKU_${plugin.toUpperCase()}_[A-Z]+_URL$`).test(name);
+}
+function querystringOf(url) {
+  const q = url.indexOf("?");
+  return q === -1 ? "" : url.slice(q + 1);
+}
+function show(name, qs) {
+  return qs ? `${name}?${maskQuerystring(qs)}` : name;
+}
+async function readLinkOptions(ctx, app, plugin, link, cache) {
+  let env;
+  try {
+    env = await readEnv(ctx, app, cache);
+  } catch (err) {
+    return { state: "unreadable", reason: err instanceof Error ? err.message : String(err) };
+  }
+  const found = findLinkVariables(env, plugin, link.service);
+  if (found.length === 0) {
+    return { state: "unreadable", reason: `no variable of '${app}' points at ${link.service}` };
+  }
+  const name = linkEnvVar(plugin, link);
+  const desired = link.querystring ?? "";
+  const plain = !link.alias && !link.env_var;
+  const hit = found.find((v) => v.name === name) ?? (plain ? found.find((v) => isFallbackName(plugin, v.name)) : void 0);
+  if (!hit) return { state: "differs", current: show(found[0].name, querystringOf(found[0].value)), desired: show(name, desired) };
+  const current = querystringOf(hit.value);
+  if (current === desired) return { state: "same" };
+  return { state: "differs", current: show(name, current), desired: show(name, desired) };
+}
+async function readServiceLinks(ctx, app, desiredLinks, config) {
+  const desired = new Map(desiredLinks.map(normalizeLink).map((l) => [l.service, l]));
+  const states = [];
+  for (const [service, plugin] of allServices(config)) {
+    states.push({ service, plugin, link: desired.get(service), isLinked: await ctx.check(`${plugin}:linked`, service, app) });
+  }
+  return states;
+}
+function servicesToUnlink(states) {
+  return states.filter((s) => !s.link && s.isLinked);
+}
 async function ensureAppLinks(ctx, app, desiredLinks, config) {
-  const desiredSet = new Set(desiredLinks);
-  for (const [serviceName, plugin] of allServices(config)) {
-    const isLinked = await ctx.check(`${plugin}:linked`, serviceName, app);
-    const isDesired = desiredSet.has(serviceName);
-    if (isDesired && !isLinked) {
+  const states = await readServiceLinks(ctx, app, desiredLinks, config);
+  const unlink = new Set(servicesToUnlink(states));
+  for (const state of states) {
+    const { service: serviceName, plugin, link, isLinked } = state;
+    if (link && !isLinked) {
       logAction(app, `Linking ${serviceName}`);
-      await ctx.run(`${plugin}:link`, serviceName, app, "--no-restart");
+      await ctx.run(`${plugin}:link`, serviceName, app, "--no-restart", ...linkFlags(link));
+      ctx.needsRestart(app, "links");
       logDone();
-    } else if (!isDesired && isLinked) {
+    } else if (link && isLinked) {
+      const opts = await readLinkOptions(ctx, app, plugin, link);
+      if (opts.state === "differs") {
+        logAction(app, `Relinking ${serviceName}`);
+        await ctx.run(`${plugin}:unlink`, serviceName, app, "--no-restart");
+        try {
+          await ctx.run(`${plugin}:link`, serviceName, app, "--no-restart", ...linkFlags(link));
+        } catch (err) {
+          logWarn(app, `${app} is now unlinked from ${serviceName}`);
+          throw err;
+        }
+        ctx.needsRestart(app, "links");
+        logDone();
+      }
+    } else if (unlink.has(state)) {
       logAction(app, `Unlinking ${serviceName}`);
       await ctx.run(`${plugin}:unlink`, serviceName, app, "--no-restart");
+      ctx.needsRestart(app, "links");
       logDone();
     }
   }
 }
 async function destroyAppLinks(ctx, app, links, config) {
-  for (const serviceName of links) {
+  for (const serviceName of links.map((l) => normalizeLink(l).service)) {
     const resolved = resolveServicePlugin(serviceName, config);
     if (!resolved) continue;
     const isLinked = await ctx.check(`${resolved.plugin}:linked`, serviceName, app);
@@ -1535,45 +2212,103 @@ async function destroyAppLinks(ctx, app, links, config) {
 async function exportAppLinks(ctx, app, config) {
   const linked = [];
   for (const [serviceName, plugin] of allServices(config)) {
-    const isLinked = await ctx.check(`${plugin}:linked`, serviceName, app);
-    if (isLinked) linked.push(serviceName);
+    if (!await ctx.check(`${plugin}:linked`, serviceName, app)) continue;
+    let found = [];
+    try {
+      found = findLinkVariables(await readEnv(ctx, app), plugin, serviceName);
+    } catch {
+    }
+    const fallback = linkEnvVar(plugin, { service: serviceName });
+    const v = found.find((f) => f.name === fallback) ?? found.find((f) => isFallbackName(plugin, f.name)) ?? found[0];
+    if (!v) {
+      linked.push(serviceName);
+      continue;
+    }
+    const querystring = querystringOf(v.value);
+    if ((v.name === fallback || isFallbackName(plugin, v.name)) && !querystring) {
+      linked.push(serviceName);
+      continue;
+    }
+    const entry = { service: serviceName };
+    if (v.name !== fallback && !isFallbackName(plugin, v.name)) {
+      if (v.name.endsWith("_URL") && v.name.length > 4) entry.alias = v.name.slice(0, -4);
+      else entry.env_var = v.name;
+    }
+    if (querystring) entry.querystring = querystring;
+    linked.push(entry);
   }
   return linked;
 }
 
 // src/modules/domains.ts
+async function readGlobalDomains(ctx) {
+  const raw = await ctx.queryStrict("domains:report", "--global", "--domains-global-vhosts");
+  return raw.split(/\s+/).filter(Boolean);
+}
+function globalDomainsInSync(current, desired) {
+  if (desired === false) return current.length === 0;
+  const sa = new Set(current);
+  const sb = new Set(desired);
+  return sa.size === sb.size && [...sa].every((x) => sb.has(x));
+}
 async function ensureGlobalDomains(ctx, domains) {
   logAction("global", "Configuring domains");
-  if (domains === false) {
-    await ctx.run("domains:clear-global");
-  } else {
-    await ctx.run("domains:set-global", ...domains);
+  const current = await readGlobalDomains(ctx);
+  if (globalDomainsInSync(current, domains)) {
+    logSkip();
+    return;
   }
+  if (domains === false) await ctx.run("domains:clear-global");
+  else await ctx.run("domains:set-global", ...domains);
   logDone();
 }
 
-// src/modules/config.ts
-async function ensureGlobalConfig(ctx, env) {
-  if (env === false) return;
-  const pairs = Object.entries(env).map(([k, v]) => `${k}=${v}`);
-  await ctx.run("config:set", "--global", ...pairs);
-}
-
 // src/modules/logs.ts
+async function readGlobalLogs(ctx) {
+  return parseJsonReport(await ctx.queryStrict("logs:report", "--global", "--format", "json"), "global");
+}
 async function ensureGlobalLogs(ctx, logs) {
+  logAction("global", "Configuring logs");
+  const current = await readGlobalLogs(ctx);
+  let changed = false;
   for (const [key, value] of Object.entries(logs)) {
+    if (current[key] === String(value)) continue;
     await ctx.run("logs:set", "--global", key, String(value));
+    changed = true;
   }
+  if (changed) logDone();
+  else logSkip();
 }
 
 // src/modules/nginx.ts
+async function readGlobalNginx(ctx) {
+  return parseJsonReport(await ctx.queryStrict("nginx:report", "--global", "--format", "json"), "global");
+}
 async function ensureGlobalNginx(ctx, nginx) {
+  logAction("global", "Configuring nginx");
+  const current = await readGlobalNginx(ctx);
+  let changed = false;
   for (const [key, value] of Object.entries(nginx)) {
+    if (current[key] === String(value)) continue;
     await ctx.run("nginx:set", "--global", key, String(value));
+    changed = true;
   }
+  if (changed) logDone();
+  else logSkip();
 }
 
 // src/commands/up.ts
+function markGlobalEnvRestart(ctx, apps, reason = "global env") {
+  for (const app of apps) ctx.needsRestart(app, reason);
+}
+function printRestartSummary(ctx, dryRun = false) {
+  const restarts = [...ctx.restarts].filter(([app]) => !ctx.rebuilds.has(app));
+  if (restarts.length === 0 && ctx.rebuilds.size === 0) return;
+  console.log(`
+# Apps that ${dryRun ? "would need" : "need"} a restart or rebuild:`);
+  for (const [app, reasons] of restarts) console.log(`dokku ps:restart ${app}  # ${reasons.join(", ")}`);
+  for (const [app, reasons] of ctx.rebuilds) console.log(`dokku ps:rebuild ${app}  # ${reasons.join(", ")}`);
+}
 var UpFailedError = class extends Error {
   constructor(failures) {
     super(
@@ -1609,6 +2344,7 @@ async function processApp(ctx, config, app, appConfig, failFast = false, prune =
   await step(() => reconcile(Networks, ctx, app, appConfig.networks));
   await step(() => reconcile(NetworkProps, ctx, app, appConfig.network, count, prune));
   await step(() => reconcile(Proxy, ctx, app, appConfig.proxy?.enabled));
+  await step(() => reconcile(ProxyProps, ctx, app, proxyProps(appConfig.proxy), count, prune));
   await step(() => reconcile(Ports, ctx, app, appConfig.ports));
   if (config.postgres || config.redis) {
     await step(() => ensureAppLinks(ctx, app, appConfig.links ?? [], config));
@@ -1632,18 +2368,36 @@ async function processApp(ctx, config, app, appConfig, failFast = false, prune =
   if (errors.length > 0) throw new AppStepsError(errors);
 }
 async function runUp(ctx, config, appFilter, opts = {}) {
+  try {
+    await runUpPhases(ctx, config, appFilter, opts);
+  } finally {
+    printRestartSummary(ctx, opts.dryRun);
+  }
+}
+async function runUpPhases(ctx, config, appFilter, opts) {
   const apps = appFilter.length > 0 ? appFilter : Object.keys(config.apps);
-  await ensureDokkuVersion(ctx, config.dokku?.version);
+  enforceFileVersion(await assertDokkuSupported(ctx), config.dokku?.version);
   if (config.plugins) await ensurePlugins(ctx, config.plugins);
-  if (config.docker_auth) await ensureDockerAuth(ctx, config.docker_auth);
+  if (config.docker_auth) {
+    await ensureDockerAuth(ctx, config.docker_auth);
+    if (opts.prune) await pruneDockerAuth(ctx, config.docker_auth);
+  }
   if (config.domains !== void 0) await ensureGlobalDomains(ctx, config.domains);
-  if (config.env !== void 0) await ensureGlobalConfig(ctx, config.env);
+  if (await ensureGlobalConfig(ctx, config.env)) {
+    markGlobalEnvRestart(ctx, apps.filter((app) => config.apps[app]));
+  }
   if (config.logs !== void 0) await ensureGlobalLogs(ctx, config.logs);
   if (config.nginx !== void 0) await ensureGlobalNginx(ctx, config.nginx);
   if (config.networks) await ensureNetworks(ctx, config.networks);
-  if (config.postgres) await ensurePostgres(ctx, config.postgres);
+  const createdPostgres = config.postgres ? await ensurePostgres(ctx, config.postgres) : /* @__PURE__ */ new Set();
   if (config.redis) await ensureRedis(ctx, config.redis);
-  if (config.postgres) await ensurePostgresBackups(ctx, config.postgres);
+  if (config.postgres) {
+    await ensurePostgresBackups(ctx, config.postgres, {
+      prune: opts.prune,
+      dryRunCreated: opts.dryRun ? createdPostgres : void 0
+    });
+  }
+  await removeBackupHashKeys(ctx);
   const failures = [];
   for (const app of apps) {
     const appConfig = config.apps[app];
@@ -1693,6 +2447,7 @@ var DownFailedError = class extends Error {
 };
 async function runDown(ctx, config, appFilter, opts) {
   const apps = appFilter.length > 0 ? appFilter : Object.keys(config.apps);
+  await assertDokkuSupported(ctx);
   const failures = [];
   for (const app of apps) {
     const appConfig = config.apps[app];
@@ -1734,6 +2489,7 @@ var NETWORKING_RESOURCES = [
   Networks,
   NetworkProps,
   Proxy,
+  ProxyProps,
   Ports
 ];
 var CONFIG_RESOURCES = [
@@ -1762,8 +2518,7 @@ var ALL_APP_RESOURCES = [
 // src/commands/export.ts
 async function runExport(ctx, opts) {
   const config = { apps: {} };
-  const version2 = extractServerVersion(await ctx.query("version"));
-  if (version2) config.dokku = { version: version2 };
+  config.dokku = { version: await assertDokkuSupported(ctx) };
   const apps = opts.appFilter?.length ? opts.appFilter : await exportApps(ctx);
   const networks = await exportNetworks(ctx);
   if (networks.length > 0) config.networks = networks;
@@ -1774,7 +2529,10 @@ async function runExport(ctx, opts) {
   const prefetched = /* @__PURE__ */ new Map();
   await Promise.all(
     ALL_APP_RESOURCES.filter((r) => !r.forceApply && !r.key.startsWith("_") && r.readAll).map(async (r) => {
-      prefetched.set(r.key, await r.readAll(ctx));
+      try {
+        prefetched.set(r.key, await r.readAll(ctx));
+      } catch {
+      }
     })
   );
   for (const app of apps) {
@@ -1782,13 +2540,24 @@ async function runExport(ctx, opts) {
     for (const resource of ALL_APP_RESOURCES) {
       if (resource.key.startsWith("_")) continue;
       if (resource.forceApply) continue;
+      if (resource.key === "checks") continue;
       const bulk = prefetched.get(resource.key);
-      const value = bulk ? bulk.get(app) : await resource.read(ctx, app);
+      let value;
+      try {
+        value = bulk ? bulk.get(app) : await resource.read(ctx, app);
+      } catch (err) {
+        logWarn(app, `could not read '${resource.key}', left out of the export: ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+      }
       if (value === void 0 || value === null || value === "") continue;
       if (Array.isArray(value) && value.length === 0) continue;
       if (typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0) continue;
-      if (resource.key === "proxy") {
-        appConfig.proxy = { enabled: value };
+      if (resource.key === "ssl") {
+        appConfig.ssl = value !== false;
+      } else if (resource.key === "proxy") {
+        appConfig.proxy = { ...appConfig.proxy, enabled: value };
+      } else if (resource.key === "proxy_props") {
+        appConfig.proxy = { ...appConfig.proxy, ...value };
       } else {
         appConfig[resource.key] = value;
       }
@@ -1802,14 +2571,41 @@ async function runExport(ctx, opts) {
   return config;
 }
 
+// src/modules/env-notes.ts
+var MANAGED_KEYS_VAR3 = "DOKKU_COMPOSE_MANAGED_KEYS";
+var DOKKU_WRITTEN = /* @__PURE__ */ new Set(["GIT_REV", "NO_VHOST"]);
+var SERVICE_URL_HOST = /^[a-z][a-z0-9+.-]*:\/\/(?:[^@/?]*@)?dokku-[a-z]+-[^:/?]+/i;
+function undeclaredEnvKeys(input) {
+  const { env } = input;
+  const skip = /* @__PURE__ */ new Set([MANAGED_KEYS_VAR3, ...input.declared, ...input.external]);
+  for (const k of String(env[MANAGED_KEYS_VAR3] ?? "").split(",")) if (k) skip.add(k);
+  for (const link of input.links) {
+    for (const v of findLinkVariables(env, link.plugin, link.service)) skip.add(v.name);
+  }
+  const notes = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (skip.has(key) || DOKKU_WRITTEN.has(key)) continue;
+    if (key.startsWith("DOKKU_") && key !== "DOKKU_START_CMD") continue;
+    if (typeof value === "string" && SERVICE_URL_HOST.test(value)) continue;
+    const duplicate = key in input.globalFile && key in input.globalServer && input.globalServer[key] === String(value);
+    notes.push(duplicate ? { key, label: "duplicate of global" } : { key });
+  }
+  return notes;
+}
+
 // src/commands/diff.ts
-import chalk2 from "chalk";
-function diffSslStatus(desired, current) {
-  if (typeof desired !== "object" || desired === null) return void 0;
-  if (current === void 0) return void 0;
-  if (current === true) return "in-sync";
-  if (current === false || current === null) return "missing";
-  return void 0;
+import chalk from "chalk";
+function displayCurrent(resourceKey, current) {
+  if (resourceKey === "ssl" && current && typeof current === "object") return "(certificate installed)";
+  return current;
+}
+function safeInSync(resource, current, desired, app, warnings) {
+  try {
+    return resource.inSync(current, desired);
+  } catch (err) {
+    warnings.push(`could not compare '${resource.key}' for app '${app}': ${err instanceof Error ? err.message : String(err)}`);
+    return void 0;
+  }
 }
 function hasAdditionsOrChanges(change) {
   const c = change;
@@ -1821,9 +2617,14 @@ function isEmptyValue(value) {
   return value === null || value === void 0 || Array.isArray(value) && value.length === 0 || typeof value === "object" && Object.keys(value).length === 0;
 }
 async function computeDiff(ctx, config) {
-  const result = { apps: {}, services: {}, plugins: {}, inSync: true, readWarnings: [] };
+  const result = { apps: {}, services: {}, plugins: {}, global: {}, networks: {}, inSync: true, envNotes: {}, readWarnings: [] };
   const appNames = Object.keys(config.apps);
-  await ensureDokkuVersion(ctx, config.dokku?.version);
+  const serverVersion = await assertDokkuSupported(ctx);
+  const fileVersion = config.dokku?.version;
+  if (fileVersion && compareToFile(serverVersion, fileVersion) !== "equal") {
+    result.dokku = { file: fileVersion, server: serverVersion };
+    result.inSync = false;
+  }
   const appExists = /* @__PURE__ */ new Map();
   await Promise.all(
     appNames.map(async (app) => {
@@ -1843,13 +2644,29 @@ async function computeDiff(ctx, config) {
       }
     })
   );
+  let globalEnv;
+  let globalEnvValues = {};
+  let globalEnvError;
+  if (config.env !== false) {
+    try {
+      globalEnvValues = await readGlobalEnv(ctx);
+      globalEnv = await readGlobalEnvDrift(ctx, config.env, globalEnvValues);
+    } catch (err) {
+      globalEnvError = err;
+    }
+  }
   for (const [app, appConfig] of Object.entries(config.apps)) {
     const appDiff = {};
+    const envCache = /* @__PURE__ */ new Map();
     for (const resource of ALL_APP_RESOURCES) {
       if (resource.key.startsWith("_")) continue;
       let desired;
       if (resource.key === "proxy") {
         desired = appConfig.proxy?.enabled;
+      } else if (resource.key === "git") {
+        desired = appConfig.git ?? config.git;
+      } else if (resource.key === "proxy_props") {
+        desired = proxyProps(appConfig.proxy);
       } else {
         desired = appConfig[resource.key];
       }
@@ -1884,17 +2701,28 @@ async function computeDiff(ctx, config) {
         current = await resource.read(ctx, app);
       } else if (bulk) {
         current = bulk.get(app);
-        if (resource.key === "ssl" && current === void 0) {
-          current = await resource.read(ctx, app);
-          if (current === void 0) bulkUnreadable = true;
-        }
       } else {
         current = await resource.read(ctx, app);
       }
-      const sslStatus = resource.key === "ssl" ? diffSslStatus(desired, current) : void 0;
-      if (sslStatus) {
-        appDiff[resource.key] = { status: sslStatus, desired, current };
-        if (sslStatus !== "in-sync") result.inSync = false;
+      if (resource.inSync) {
+        const removedHere = resource.removals ? resource.removals(current, desired) : [];
+        let status;
+        if (current === void 0) {
+          status = "unknown";
+          result.readWarnings.push(`could not read '${resource.key}' for app '${app}'`);
+        } else {
+          const same = safeInSync(resource, current, desired, app, result.readWarnings);
+          if (same === void 0) status = "unknown";
+          else if (same) status = removedHere.length > 0 ? "extra" : "in-sync";
+          else status = current === false || isEmptyValue(current) ? "missing" : "changed";
+        }
+        appDiff[resource.key] = {
+          status,
+          desired,
+          current: displayCurrent(resource.key, current),
+          ...removedHere.length > 0 ? { removed: removedHere } : {}
+        };
+        if (status !== "in-sync") result.inSync = false;
         continue;
       }
       let removed = resource.removals ? resource.removals(current, desired) : [];
@@ -1930,16 +2758,57 @@ async function computeDiff(ctx, config) {
         appDiff[resource.key].removed = removed;
       }
     }
-    if (appConfig.links === void 0 && appExists.get(app)) {
-      const linked = [];
-      for (const [plugin, services] of [["postgres", config.postgres], ["redis", config.redis]]) {
-        for (const svc of Object.keys(services ?? {})) {
-          if (await ctx.check(`${plugin}:linked`, svc, app)) linked.push(svc);
+    if (appExists.get(app) && (config.postgres || config.redis)) {
+      const unlink = servicesToUnlink(await readServiceLinks(ctx, app, appConfig.links ?? [], config)).map((s) => s.service);
+      if (appConfig.links === void 0) {
+        if (unlink.length > 0) {
+          appDiff["links"] = { status: "extra", current: unlink, removed: unlink, note: "no links: in the file; up will unlink these" };
+          result.inSync = false;
+        }
+      } else {
+        for (const service of unlink) {
+          appDiff[`links:${service}`] = { status: "extra", current: service, removed: [service], note: "up unlinks" };
+          result.inSync = false;
+        }
+      }
+    }
+    if (appConfig.links && appExists.get(app)) {
+      for (const entry of appConfig.links) {
+        const link = normalizeLink(entry);
+        const resolved = resolveServicePlugin(link.service, config);
+        if (!resolved) continue;
+        if (!await ctx.check(`${resolved.plugin}:linked`, link.service, app)) {
+          appDiff[`links:${link.service}`] = { status: "missing", desired: linkEnvVar(resolved.plugin, link), current: void 0 };
+          result.inSync = false;
+          continue;
+        }
+        const opts = await readLinkOptions(ctx, app, resolved.plugin, link, envCache);
+        if (opts.state === "differs") {
+          appDiff[`links:${link.service}`] = { status: "changed", desired: opts.desired, current: opts.current, note: "up unlinks and relinks it" };
+          result.inSync = false;
+        } else if (opts.state === "unreadable") {
+          result.readWarnings.push(`could not read the link options of '${link.service}' for app '${app}' (not counted as drift): ${opts.reason}`);
         }
       }
-      if (linked.length > 0) {
-        appDiff["links"] = { status: "extra", current: linked, removed: linked, note: "no links: in the file; up will unlink these" };
-        result.inSync = false;
+    }
+    if (appExists.get(app)) {
+      try {
+        const links = (appConfig.links ?? []).flatMap((entry) => {
+          const link = normalizeLink(entry);
+          const resolved = resolveServicePlugin(link.service, config);
+          return resolved ? [{ plugin: resolved.plugin, service: link.service }] : [];
+        });
+        const notes = undeclaredEnvKeys({
+          env: await readEnv(ctx, app, envCache),
+          declared: appConfig.env ? Object.keys(appConfig.env) : [],
+          links,
+          external: appConfig.env_external ?? [],
+          globalFile: config.env || {},
+          globalServer: globalEnvValues
+        });
+        if (notes.length > 0) result.envNotes[app] = notes;
+      } catch (err) {
+        result.readWarnings.push(`could not read the env of app '${app}' to note keys the file does not declare: ${err instanceof Error ? err.message : String(err)}`);
       }
     }
     result.apps[app] = appDiff;
@@ -1954,20 +2823,137 @@ async function computeDiff(ctx, config) {
       if (plan.action !== "unknown") result.inSync = false;
     }
   }
-  for (const svc of Object.keys(config.postgres ?? {})) {
-    const exists = await ctx.check("postgres:exists", svc);
-    result.services[svc] = { status: exists ? "in-sync" : "missing" };
-    if (!exists) result.inSync = false;
+  if (config.domains !== void 0) {
+    try {
+      const current = await readGlobalDomains(ctx);
+      if (!globalDomainsInSync(current, config.domains)) {
+        result.global.domains = { status: current.length === 0 ? "missing" : "changed", desired: config.domains, current };
+        result.inSync = false;
+      }
+    } catch (err) {
+      result.global.domains = { status: "unknown", desired: config.domains };
+      result.readWarnings.push(`could not read global 'domains': ${err instanceof Error ? err.message : String(err)}`);
+      result.inSync = false;
+    }
+  }
+  if (globalEnv) {
+    const { changed, removed, markerOutdated } = globalEnv;
+    if (changed.length > 0 || removed.length > 0 || markerOutdated) {
+      result.global.env = {
+        status: changed.length === 0 && removed.length > 0 ? "extra" : "changed",
+        desired: Object.fromEntries(changed.map((k) => [k, "****"])),
+        removed,
+        note: changed.length === 0 && removed.length === 0 ? `${GLOBAL_MANAGED_KEYS_VAR} not written yet` : void 0
+      };
+      result.inSync = false;
+    }
+  } else if (config.env !== false) {
+    const err = globalEnvError;
+    result.global.env = { status: "unknown", desired: Object.keys(config.env ?? {}) };
+    result.readWarnings.push(`could not read global 'env': ${err instanceof Error ? err.message : String(err)}`);
+    result.inSync = false;
+  }
+  try {
+    const stale = staleBackupHashKeys(await readGlobalEnv(ctx));
+    if (stale.length > 0) {
+      result.global.backup_hash = { status: "extra", removed: stale, note: "old backup hash keys; up unsets them" };
+      result.inSync = false;
+    }
+  } catch (err) {
+    if (config.env === false) result.readWarnings.push(`could not read global env: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (config.docker_auth) {
+    try {
+      const { stale, extra } = await readDockerAuthDrift(ctx, config.docker_auth);
+      if (stale.length > 0 || extra.length > 0) {
+        result.global.docker_auth = {
+          status: stale.length > 0 ? "changed" : "extra",
+          desired: Object.fromEntries(stale.map((server) => [server, "login missing or differs"])),
+          removed: extra,
+          note: extra.length > 0 ? "up --prune logs out of these" : void 0
+        };
+        result.inSync = false;
+      }
+    } catch (err) {
+      result.global.docker_auth = { status: "unknown", desired: Object.keys(config.docker_auth) };
+      result.readWarnings.push(`could not read global 'docker_auth': ${err instanceof Error ? err.message : String(err)}`);
+      result.inSync = false;
+    }
+  }
+  for (const [name, declared, read] of [
+    ["logs", config.logs, readGlobalLogs],
+    ["nginx", config.nginx, readGlobalNginx]
+  ]) {
+    if (declared === void 0) continue;
+    let current;
+    try {
+      current = await read(ctx);
+    } catch (err) {
+      result.global[name] = { status: "unknown", desired: declared };
+      result.readWarnings.push(`could not read global '${name}': ${err instanceof Error ? err.message : String(err)}`);
+      result.inSync = false;
+      continue;
+    }
+    const differs = Object.entries(declared).filter(([k, v]) => current[k] !== String(v));
+    if (differs.length === 0) continue;
+    const shown = Object.fromEntries(Object.keys(declared).filter((k) => k in current).map((k) => [k, current[k]]));
+    result.global[name] = { status: differs.every(([k]) => !(k in current)) ? "missing" : "changed", desired: declared, current: shown };
+    result.inSync = false;
+  }
+  for (const net of config.networks ?? []) {
+    if (await ctx.check("network:exists", net)) continue;
+    result.networks[net] = { status: "missing" };
+    result.inSync = false;
   }
-  for (const svc of Object.keys(config.redis ?? {})) {
-    const exists = await ctx.check("redis:exists", svc);
-    result.services[svc] = { status: exists ? "in-sync" : "missing" };
-    if (!exists) result.inSync = false;
+  for (const [plugin, services] of [["postgres", config.postgres], ["redis", config.redis]]) {
+    for (const [svc, declared] of Object.entries(services ?? {})) {
+      const exists = await ctx.check(`${plugin}:exists`, svc);
+      if (!exists) {
+        result.services[svc] = { status: "missing" };
+        result.inSync = false;
+        continue;
+      }
+      const backup = plugin === "postgres" ? declared.backup : void 0;
+      const compares = declared?.version !== void 0 || declared?.image !== void 0 || backup !== void 0;
+      if (!compares && plugin === "redis") {
+        result.services[svc] = { status: "in-sync", mismatches: [] };
+        continue;
+      }
+      try {
+        const info = await readServiceInfo(ctx, plugin, svc);
+        const mismatches = [...versionMismatches(info, declared), ...backup !== void 0 ? backupMismatches(info, backup) : []];
+        const note = plugin === "postgres" && backup === void 0 && hasBackup(info) ? `backup on the server is not in the file (${describeServerBackup(info)}); up leaves it, backup: false removes it` : void 0;
+        result.services[svc] = { status: mismatches.length ? "changed" : "in-sync", mismatches, note };
+        if (mismatches.length) result.inSync = false;
+      } catch (err) {
+        result.readWarnings.push(`could not read ${plugin} service '${svc}': ${err instanceof Error ? err.message : String(err)}`);
+        if (!compares) {
+          result.services[svc] = { status: "in-sync", mismatches: [] };
+          continue;
+        }
+        result.services[svc] = { status: "unknown" };
+        result.inSync = false;
+      }
+    }
   }
   return result;
 }
 function maskDiffResult(diff) {
-  const masked = { apps: {}, services: diff.services, plugins: diff.plugins, inSync: diff.inSync, readWarnings: diff.readWarnings };
+  const masked = {
+    apps: {},
+    services: diff.services,
+    plugins: diff.plugins,
+    dokku: diff.dokku,
+    global: Object.fromEntries(Object.entries(diff.global).map(([k, d]) => [k, {
+      ...d,
+      desired: maskSensitiveData(d.desired),
+      current: maskSensitiveData(d.current)
+    }])),
+    networks: diff.networks,
+    inSync: diff.inSync,
+    envNotes: diff.envNotes,
+    readWarnings: diff.readWarnings
+  };
   for (const [app, appDiff] of Object.entries(diff.apps)) {
     const maskedAppDiff = {};
     for (const [feature, d] of Object.entries(appDiff)) {
@@ -1983,6 +2969,9 @@ function maskDiffResult(diff) {
   }
   return masked;
 }
+function driftCount(diff) {
+  return Object.values(diff.apps).flatMap((a) => Object.values(a)).filter((d) => d.status !== "in-sync").length + Object.values(diff.services).filter((d) => d.status !== "in-sync").length + Object.values(diff.plugins).filter((d) => d.status !== "unknown").length + Object.keys(diff.global).length + Object.keys(diff.networks).length + (diff.dokku ? 1 : 0);
+}
 function formatSummary(diff) {
   const lines = [""];
   for (const [app, appDiff] of Object.entries(diff.apps)) {
@@ -1991,15 +2980,30 @@ function formatSummary(diff) {
       lines.push(`  app: ${app}`);
       lines.push(`    (in sync)`);
     } else {
-      lines.push(`  app: ${chalk2.bold(app)}`);
+      lines.push(`  app: ${chalk.bold(app)}`);
       for (const [feature, d] of changes) {
-        const sym = d.status === "missing" ? chalk2.green("+") : d.status === "unknown" ? chalk2.red("?") : d.status === "extra" ? chalk2.red("-") : chalk2.yellow("~");
+        const sym = d.status === "missing" ? chalk.green("+") : d.status === "unknown" ? chalk.red("?") : d.status === "extra" ? chalk.red("-") : chalk.yellow("~");
         lines.push(`    ${sym} ${feature}: ${formatFeatureSummary(d)}`);
       }
     }
+    const notes = diff.envNotes[app];
+    if (notes) lines.push(`    note: env not in the file (up leaves these): ${notes.map(showNote).join(", ")}`);
+  }
+  if (diff.dokku) {
+    lines.push(`  dokku`);
+    lines.push(`    ${chalk.yellow("~")} version: ${diff.dokku.file} (file) \u2192 ${diff.dokku.server} (server)`);
+  }
+  for (const [name, d] of Object.entries(diff.global)) {
+    const sym = d.status === "missing" ? chalk.green("+") : d.status === "unknown" ? chalk.red("?") : chalk.yellow("~");
+    lines.push(`  global`);
+    lines.push(`    ${sym} ${name}: ${formatFeatureSummary(d)}`);
+  }
+  for (const net of Object.keys(diff.networks)) {
+    lines.push(`  networks:`);
+    lines.push(`    ${chalk.green("+")} ${net}: not created`);
   }
   for (const [name, d] of Object.entries(diff.plugins)) {
-    const sym = d.status === "missing" ? chalk2.green("+") : d.status === "unknown" ? chalk2.red("?") : chalk2.yellow("~");
+    const sym = d.status === "missing" ? chalk.green("+") : d.status === "unknown" ? chalk.red("?") : chalk.yellow("~");
     const detail = d.status === "missing" ? `not installed (want ${d.desired ?? "any"})` : `${d.current} \u2192 ${d.desired}`;
     lines.push(`  plugin: ${name}`);
     lines.push(`    ${sym} version: ${detail}${d.note ? ` (${d.note})` : ""}`);
@@ -2007,24 +3011,32 @@ function formatSummary(diff) {
   for (const [svc, d] of Object.entries(diff.services)) {
     if (d.status === "missing") {
       lines.push(`  services:`);
-      lines.push(`    ${chalk2.green("+")} ${svc}: not provisioned`);
+      lines.push(`    ${chalk.green("+")} ${svc}: not provisioned`);
+    }
+    if (d.mismatches?.length || d.note) lines.push(`  services: ${svc}`);
+    for (const m of d.mismatches ?? []) {
+      lines.push(`    ${chalk.yellow("~")} ${m.field}: ${m.current || "(unknown)"} \u2192 ${m.desired}`);
     }
+    if (d.note) lines.push(`    note: ${d.note}`);
   }
-  const total = Object.values(diff.apps).flatMap((a) => Object.values(a)).filter((d) => d.status !== "in-sync").length + Object.values(diff.services).filter((d) => d.status !== "in-sync").length + Object.values(diff.plugins).filter((d) => d.status !== "unknown").length;
+  const total = driftCount(diff);
   if (diff.readWarnings.length > 0) {
     lines.push("");
-    lines.push(chalk2.red("  Could not read some server state \u2014 treated as unknown, not missing:"));
-    for (const w of diff.readWarnings) lines.push(chalk2.red(`    - ${w}`));
+    lines.push(chalk.red("  Could not read some server state \u2014 treated as unknown, not missing:"));
+    for (const w of diff.readWarnings) lines.push(chalk.red(`    - ${w}`));
   }
   lines.push("");
   if (total === 0) {
-    lines.push(chalk2.green("  Everything in sync."));
+    lines.push(chalk.green("  Everything in sync."));
   } else {
-    lines.push(chalk2.yellow(`  ${total} resource(s) out of sync.`));
+    lines.push(chalk.yellow(`  ${total} resource(s) out of sync.`));
   }
   lines.push("");
   return lines.join("\n");
 }
+function showNote(n) {
+  return n.label ? `${n.key} (${n.label})` : n.key;
+}
 function formatFeatureSummary(d) {
   const gone = d.removed?.length ? `not in the file: ${d.removed.join(", ")}` : "";
   if (d.status === "extra") return `${gone}${d.note ? ` (${d.note})` : ""}`;
@@ -2037,7 +3049,8 @@ function formatChange(d) {
   if (Array.isArray(d.desired) && Array.isArray(d.current)) {
     return `${d.current.length} \u2192 ${d.desired.length} items`;
   }
-  return `${JSON.stringify(d.current, showUnset)} \u2192 ${JSON.stringify(d.desired, showUnset)}`;
+  const desired = JSON.stringify(d.desired, showUnset);
+  return d.current === void 0 ? desired : `${JSON.stringify(d.current, showUnset)} \u2192 ${desired}`;
 }
 function showUnset(_key, value) {
   return value === "\0missing" ? "(unset)" : value;
@@ -2050,53 +3063,87 @@ function formatVerbose(diff) {
     for (const [feature, d] of changes) {
       lines.push(`@@ app: ${app} / ${feature} @@`);
       if (d.status === "unknown") {
-        lines.push(chalk2.red(`  ? could not read server state \u2014 not reported as missing`));
+        lines.push(chalk.red(`  ? could not read server state \u2014 not reported as missing`));
         continue;
       }
       if (d.status === "extra") {
-        for (const r of d.removed ?? []) lines.push(chalk2.red(`- ${r}`));
+        for (const r of d.removed ?? []) lines.push(chalk.red(`- ${r}`));
         if (d.note) lines.push(`  (${d.note})`);
         continue;
       }
       const currentLines = d.current !== void 0 ? JSON.stringify(d.current, showUnset, 2).split("\n") : [];
       const desiredLines = JSON.stringify(d.desired, showUnset, 2).split("\n");
-      for (const line of currentLines) lines.push(chalk2.red(`- ${line}`));
-      for (const line of desiredLines) lines.push(chalk2.green(`+ ${line}`));
-      for (const r of d.removed ?? []) lines.push(chalk2.red(`- ${r} (not in the file)`));
+      for (const line of currentLines) lines.push(chalk.red(`- ${line}`));
+      for (const line of desiredLines) lines.push(chalk.green(`+ ${line}`));
+      for (const r of d.removed ?? []) lines.push(chalk.red(`- ${r} (not in the file)`));
+    }
+  }
+  for (const [app, notes] of Object.entries(diff.envNotes)) {
+    lines.push(`@@ app: ${app} / env not in the file (note; up leaves these) @@`);
+    for (const n of notes) lines.push(`  note: ${showNote(n)}`);
+  }
+  if (diff.dokku) {
+    lines.push(`@@ dokku version @@`);
+    lines.push(chalk.red(`- ${diff.dokku.server} (server)`));
+    lines.push(chalk.green(`+ ${diff.dokku.file} (file)`));
+  }
+  for (const [name, d] of Object.entries(diff.global)) {
+    lines.push(`@@ global / ${name} @@`);
+    if (d.status === "unknown") {
+      lines.push(chalk.red(`  ? could not read server state \u2014 not reported as missing`));
+      continue;
     }
+    if (d.current !== void 0) for (const line of JSON.stringify(d.current, null, 2).split("\n")) lines.push(chalk.red(`- ${line}`));
+    if (d.status !== "extra") for (const line of JSON.stringify(d.desired, null, 2).split("\n")) lines.push(chalk.green(`+ ${line}`));
+    for (const r of d.removed ?? []) lines.push(chalk.red(`- ${r} (not in the file)`));
+    if (d.note) lines.push(`  (${d.note})`);
+  }
+  for (const net of Object.keys(diff.networks)) {
+    lines.push(`@@ networks @@`);
+    lines.push(chalk.green(`+ ${net}`));
   }
   for (const [name, d] of Object.entries(diff.plugins)) {
     lines.push(`@@ plugin: ${name} @@`);
-    if (d.current !== void 0) lines.push(chalk2.red(`- ${d.current}`));
-    lines.push(chalk2.green(`+ ${d.desired ?? "(any version)"}`) + (d.note ? ` (${d.note})` : ""));
+    if (d.current !== void 0) lines.push(chalk.red(`- ${d.current}`));
+    lines.push(chalk.green(`+ ${d.desired ?? "(any version)"}`) + (d.note ? ` (${d.note})` : ""));
   }
   for (const [svc, d] of Object.entries(diff.services)) {
     if (d.status === "missing") {
       lines.push(`@@ services @@`);
-      lines.push(chalk2.green(`+ ${svc}`));
+      lines.push(chalk.green(`+ ${svc}`));
+    }
+    for (const m of d.mismatches ?? []) {
+      lines.push(`@@ services: ${svc} ${m.field} @@`);
+      lines.push(chalk.red(`- ${m.current}`));
+      lines.push(chalk.green(`+ ${m.desired}`));
     }
+    if (d.note) lines.push(`@@ services: ${svc} @@
+  (${d.note})`);
   }
   if (diff.readWarnings.length > 0) {
     lines.push("");
-    lines.push(chalk2.red("Could not read some server state \u2014 treated as unknown, not missing:"));
-    for (const w of diff.readWarnings) lines.push(chalk2.red(`  - ${w}`));
+    lines.push(chalk.red("Could not read some server state \u2014 treated as unknown, not missing:"));
+    for (const w of diff.readWarnings) lines.push(chalk.red(`  - ${w}`));
+  }
+  if (driftCount(diff) === 0) {
+    lines.push(chalk.green("Everything in sync."));
   }
   lines.push("");
   return lines.join("\n");
 }
 
 // src/commands/validate.ts
-import * as fs2 from "fs";
+import * as fs3 from "fs";
 import * as yaml2 from "js-yaml";
 function validate(filePath) {
   const errors = [];
   const warnings = [];
-  if (!fs2.existsSync(filePath)) {
+  if (!fs3.existsSync(filePath)) {
     return { errors: [`File not found: ${filePath}`], warnings };
   }
   let raw;
   try {
-    raw = yaml2.load(fs2.readFileSync(filePath, "utf8"));
+    raw = yaml2.load(fs3.readFileSync(filePath, "utf8"));
   } catch (e) {
     return { errors: [`YAML parse error: ${e.message}`], warnings };
   }
@@ -2104,7 +3151,13 @@ function validate(filePath) {
   if (!result.success) {
     for (const issue of result.error.issues) {
       const issuePath = issue.path.join(".");
-      errors.push(`${issuePath}: ${issue.message}`);
+      const branches = issue.code === "invalid_union" ? issue.errors : void 0;
+      const reasons = branches?.filter((b) => !b.every((i) => i.code === "invalid_type" && i.path.length === 0)).flat();
+      if (reasons && reasons.length > 0) {
+        for (const r of reasons) errors.push(`${[issuePath, ...r.path].filter((x) => x !== "").join(".")}: ${r.message}`);
+      } else {
+        errors.push(`${issuePath}: ${issue.message}`);
+      }
     }
   }
   const data = raw;
@@ -2117,9 +3170,11 @@ function validate(filePath) {
       for (const name of Object.keys(data.redis)) serviceNames.add(name);
     }
     for (const [appName, appCfg] of Object.entries(data.apps)) {
+      errors.push(...envExternalErrors(appName, appCfg));
       if (!appCfg?.links) continue;
-      for (const link of appCfg.links) {
-        if (!serviceNames.has(link)) {
+      for (const entry of appCfg.links) {
+        const link = typeof entry === "string" ? entry : entry?.service;
+        if (typeof link === "string" && !serviceNames.has(link)) {
           errors.push(`apps.${appName}.links: service "${link}" not defined in postgres or redis`);
         }
       }
@@ -2134,9 +3189,25 @@ function validate(filePath) {
   }
   return { errors, warnings };
 }
+function envExternalErrors(appName, appCfg) {
+  const list = appCfg?.env_external;
+  if (!Array.isArray(list)) return [];
+  const declared = appCfg.env && typeof appCfg.env === "object" ? appCfg.env : {};
+  const errors = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const key of list) {
+    if (typeof key !== "string") continue;
+    const where = `apps.${appName}.env_external`;
+    if (key === "DOKKU_COMPOSE_MANAGED_KEYS") errors.push(`${where}: "${key}" is dokku-compose's own marker`);
+    else if (seen.has(key)) errors.push(`${where}: "${key}" is listed twice`);
+    else if (key in declared) errors.push(`${where}: "${key}" is also in env:`);
+    seen.add(key);
+  }
+  return errors;
+}
 
 // src/index.ts
-import chalk3 from "chalk";
+import chalk2 from "chalk";
 var require2 = createRequire(import.meta.url);
 var { version } = require2("../package.json");
 var program = new Command().name("dokku-compose").version(version);
@@ -2151,7 +3222,7 @@ program.command("up [apps...]").description("Create/update apps and services to
   const runner = makeRunner(opts);
   const ctx = createContext(runner);
   try {
-    await runUp(ctx, config, apps, { failFast: opts.failFast ?? false, prune: opts.prune ?? false });
+    await runUp(ctx, config, apps, { failFast: opts.failFast ?? false, prune: opts.prune ?? false, dryRun: opts.dryRun ?? false });
     if (opts.dryRun) {
       console.log("\n# Commands that would run:");
       for (const cmd of runner.dryRunLog) {
@@ -2160,7 +3231,7 @@ program.command("up [apps...]").description("Create/update apps and services to
       }
     }
   } catch (error) {
-    console.error(chalk3.red(`
+    console.error(chalk2.red(`
 ${error.message}`));
     process.exitCode = 1;
   } finally {
@@ -2178,7 +3249,7 @@ program.command("down [apps...]").description("Destroy apps and services (requir
   try {
     await runDown(ctx, config, apps, { force: true, failFast: opts.failFast ?? false });
   } catch (error) {
-    console.error(chalk3.red(`
+    console.error(chalk2.red(`
 ${error.message}`));
     process.exitCode = 1;
   } finally {
@@ -2211,11 +3282,15 @@ program.command("export").description("Export server state to dokku-compose.yml
     const result = opts.sensitive ? rawResult : maskSensitiveData(rawResult);
     const out = yaml3.dump(result, { lineWidth: 120 });
     if (opts.output) {
-      fs3.writeFileSync(opts.output, out);
+      fs4.writeFileSync(opts.output, out);
       console.error(`Written to ${opts.output}`);
     } else {
       process.stdout.write(out);
     }
+  } catch (error) {
+    console.error(chalk2.red(`
+${error.message}`));
+    process.exitCode = 1;
   } finally {
     await ctx.close();
   }
@@ -2230,6 +3305,10 @@ program.command("diff").description("Show what is out of sync between config and
     const output = opts.verbose ? formatVerbose(diff) : formatSummary(diff);
     process.stdout.write(output);
     process.exitCode = rawDiff.inSync ? 0 : 1;
+  } catch (error) {
+    console.error(chalk2.red(`
+${error.message}`));
+    process.exitCode = 1;
   } finally {
     await ctx.close();
   }
@@ -2238,8 +3317,12 @@ program.command("ps [apps...]").description("Show status of configured apps").op
   const config = loadConfig(opts.file);
   const runner = makeRunner({});
   try {
-    const { runPs } = await import("./ps-33II4UU3.js");
+    const { runPs } = await import("./ps-QQAVQTEV.js");
     await runPs(runner, config, apps);
+  } catch (error) {
+    console.error(chalk2.red(`
+${error.message}`));
+    process.exitCode = 1;
   } finally {
     await runner.close();
   }