dokku-compose 0.14.2 → 0.15.0

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  SEMVER_RE,
   assertDokkuSupported,
   compareToFile,
   enforceFileVersion,
@@ -8,7 +9,7 @@ import {
   logError,
   logSkip,
   logWarn
-} from "./chunk-WM244P42.js";
+} from "./chunk-TP2BXE5O.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -246,17 +247,470 @@ var Scheduler = {
   }
 };
 
+// src/core/volume-rules.ts
+var STORAGE_ROOT = "/var/lib/dokku/data/storage";
+var DEFAULT_SCOPE = "_default_";
+var LEGACY_PREFIX = "legacy-";
+var MAX_ENTRY_NAME = 45;
+var CHOWN_PRESETS = ["herokuish", "heroku", "paketo", "root"];
+var DEFAULT_CHOWN = "herokuish";
+var ENTRY_NAME_RE = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;
+var DOCKER_VOLUME_RE = /^[a-zA-Z0-9][a-zA-Z0-9_.-]+$/;
+var PROCESS_TYPE_RE = /^[A-Za-z0-9_-]+$/;
+var ALL_PHASES = ["deploy", "run"];
+function defaultPath(name) {
+  return `${STORAGE_ROOT}/${name}`;
+}
+function isLegacyName(name) {
+  return name.startsWith(LEGACY_PREFIX);
+}
+function isValidEntryName(name) {
+  return name.length <= MAX_ENTRY_NAME && ENTRY_NAME_RE.test(name);
+}
+function entryNameError(name) {
+  if (!isValidEntryName(name)) {
+    return `'${name}' is not a valid entry name: use lowercase letters, digits and dashes (not at the start or end), at most ${MAX_ENTRY_NAME} characters`;
+  }
+  return void 0;
+}
+function isNormalizedAbsolute(p) {
+  if (!p.startsWith("/")) return false;
+  return p.split("/").slice(1).every((seg) => seg !== "" && seg !== "." && seg !== "..");
+}
+function pathError(p) {
+  if (typeof p !== "string" || p === "") return "path must be a non-empty string";
+  if (p.startsWith("/")) {
+    return isNormalizedAbsolute(p) ? void 0 : `path '${p}' must be normalised: no trailing slash and no empty, '.' or '..' segment`;
+  }
+  return DOCKER_VOLUME_RE.test(p) ? void 0 : `path '${p}' must be an absolute directory or a Docker volume name`;
+}
+function usesDefaultLocation(name, path2) {
+  return path2 === void 0 || path2 === defaultPath(name);
+}
+function chownError(value) {
+  if (value === false) return void 0;
+  if (typeof value === "number") {
+    return Number.isInteger(value) && value >= 0 && value <= 65535 ? void 0 : `chown uid ${value} must be an integer from 0 to 65535`;
+  }
+  if (typeof value === "string") {
+    if (CHOWN_PRESETS.includes(value)) return void 0;
+    if (/^\d+$/.test(value) && Number(value) <= 65535) return void 0;
+  }
+  return `chown must be herokuish, heroku, paketo, root, a uid from 0 to 65535, or false (got ${JSON.stringify(value)})`;
+}
+function chownValue(value) {
+  return String(value);
+}
+function modeError(value) {
+  if (typeof value === "number") {
+    return `mode must be a quoted octal string: write mode: "${String(value).padStart(4, "0")}" (YAML reads an unquoted ${value} as a number)`;
+  }
+  if (typeof value === "string" && /^[0-7]{3,4}$/.test(value)) return void 0;
+  return `mode must be a quoted octal string of 3 or 4 digits, e.g. "0750" (got ${JSON.stringify(value)})`;
+}
+function normalizeMode(mode) {
+  return mode.length === 3 ? `0${mode}` : mode;
+}
+function parseMountString(s) {
+  if (s.startsWith("/")) {
+    return `'${s}' is a host path, which storage no longer takes: declare an entry under volumes: (with path: for an existing directory) and mount it as <entry>:<container-dir>`;
+  }
+  const parts = s.split(":");
+  if (parts.length !== 2 || parts[0] === "" || parts[1] === "") {
+    return `'${s}' must be <entry>:<container-dir>; options need the map form (entry, container_dir, ...)`;
+  }
+  return { entry: parts[0], container_dir: parts[1] };
+}
+function mountIssues(m) {
+  const issues = [];
+  if (!isNormalizedAbsolute(m.container_dir) || m.container_dir.includes(":")) {
+    issues.push(`container_dir '${m.container_dir}' must be a normalised absolute path without ':'`);
+  }
+  if (m.process_type !== void 0) {
+    if (m.process_type === DEFAULT_SCOPE) issues.push(`process_type '${DEFAULT_SCOPE}' is the default: leave process_type out`);
+    else if (!PROCESS_TYPE_RE.test(m.process_type)) issues.push(`process_type '${m.process_type}' must be a Procfile process type (letters, digits, '-' and '_')`);
+  }
+  for (const o of m.options ?? []) {
+    if (o === "") issues.push("options must not hold an empty item");
+    else if (o === "ro" || o === "rw") issues.push(`options must not hold '${o}': use readonly`);
+    else if (/[,=:\s]/.test(o)) issues.push(`option '${o}' must not contain ',', '=', ':' or whitespace (Dokku reads 'key=value' tokens as its own keys)`);
+  }
+  const phases = m.phases ?? [];
+  if (new Set(phases).size !== phases.length) issues.push("phases must not repeat a phase");
+  return issues;
+}
+function normalizeMount(m) {
+  const phases = m.phases && m.phases.length > 0 ? m.phases : ALL_PHASES;
+  return {
+    entry: m.entry,
+    container_dir: m.container_dir,
+    readonly: m.readonly ?? false,
+    phases: ALL_PHASES.filter((p) => phases.includes(p)),
+    process_type: m.process_type ?? DEFAULT_SCOPE,
+    options: m.options ?? []
+  };
+}
+function scopesOverlap(a, b) {
+  return a === DEFAULT_SCOPE || b === DEFAULT_SCOPE || a === b;
+}
+function parseServiceMountString(s) {
+  if (s.startsWith("/")) {
+    return `'${s}' is a host path, which mounts no longer take: declare the directory as an entry under volumes: (with path:) and mount it as <entry>:<container-dir>`;
+  }
+  const parsed = parseMountString(s);
+  return typeof parsed === "string" ? parsed.replace("storage", "a service mount") : { entry: parsed.entry, container_dir: parsed.container_dir };
+}
+function serviceMountIssues(m) {
+  return mountIssues(m);
+}
+function normalizeServiceMount(m) {
+  return { entry: m.entry, container_dir: m.container_dir, readonly: m.readonly ?? false, options: m.options ?? [] };
+}
+function declaredServiceMounts(mounts) {
+  const out = [];
+  for (const item of mounts ?? []) {
+    const parsed = typeof item === "string" ? parseServiceMountString(item) : item;
+    if (typeof parsed !== "string") out.push(normalizeServiceMount(parsed));
+  }
+  return out;
+}
+function declaredMounts(storage) {
+  const mounts = [];
+  for (const item of storage ?? []) {
+    const parsed = typeof item === "string" ? parseMountString(item) : item;
+    if (typeof parsed === "string") continue;
+    mounts.push(normalizeMount(parsed));
+  }
+  return mounts;
+}
+
+// src/modules/global.ts
+var same = (name, cmd, keys, kind = "scalar") => keys.map((key) => ({ yaml: key, cmd, key, report: name, kind }));
+var REGISTRY_GLOBAL_KEYS = ["image-repo-template", "push-extra-tags", "push-on-release", "server"];
+var PS_GLOBAL_KEYS = ["procfile-path", "restart-policy", "skip-deploy", "stop-timeout-seconds"];
+var GLOBAL_SPECS = {
+  nginx: { name: "nginx", keys: same("nginx", "nginx:set", NGINX_KEYS) },
+  logs: { name: "logs", keys: same("logs", "logs:set", LOGS_GLOBAL_KEYS) },
+  scheduler: { name: "scheduler", keys: same("scheduler", "scheduler:set", ["selected", "shell"]) },
+  registry: { name: "registry", keys: same("registry", "registry:set", REGISTRY_GLOBAL_KEYS) },
+  checks: { name: "checks", keys: same("checks", "checks:set", ["wait-to-retire"]) },
+  ps: { name: "ps", keys: same("ps", "ps:set", PS_GLOBAL_KEYS) },
+  build: {
+    name: "build",
+    keys: [
+      { yaml: "selected", cmd: "builder:set", key: "selected", report: "builder", kind: "scalar", effect: "rebuild" },
+      { yaml: "context", cmd: "builder:set", key: "build-dir", report: "builder", kind: "scalar", effect: "rebuild" },
+      { yaml: "skip_cleanup", cmd: "builder:set", key: "skip-cleanup", report: "builder", kind: "scalar" },
+      { yaml: "dockerfile", cmd: "builder-dockerfile:set", key: "dockerfile-path", report: "builder-dockerfile", kind: "scalar", effect: "rebuild" },
+      { yaml: "app_json", cmd: "app-json:set", key: "appjson-path", report: "app-json", kind: "scalar", effect: "rebuild" }
+    ]
+  },
+  network: {
+    name: "network",
+    keys: [
+      { yaml: "attach_post_create", cmd: "network:set", key: "attach-post-create", report: "network", kind: "list", effect: "rebuild" },
+      { yaml: "attach_post_deploy", cmd: "network:set", key: "attach-post-deploy", report: "network", kind: "list", effect: "rebuild", keep: true },
+      { yaml: "initial_network", cmd: "network:set", key: "initial-network", report: "network", kind: "clearable", effect: "rebuild" },
+      { yaml: "bind_all_interfaces", cmd: "network:set", key: "bind-all-interfaces", report: "network", kind: "flag", effect: "restart" },
+      { yaml: "tld", cmd: "network:set", key: "tld", report: "network", kind: "clearable", effect: "restart" }
+    ]
+  },
+  // `enabled` (`proxy:enable`/`proxy:disable`) has no global form.
+  proxy: { name: "proxy", keys: [
+    { yaml: "type", cmd: "proxy:set", key: "type", report: "proxy", kind: "scalar" },
+    { yaml: "proxy_port", cmd: "proxy:set", key: "proxy-port", report: "proxy", kind: "scalar" },
+    { yaml: "proxy_ssl_port", cmd: "proxy:set", key: "proxy-ssl-port", report: "proxy", kind: "scalar" }
+  ] },
+  git: {
+    name: "git",
+    keys: [
+      { yaml: "deploy_branch", cmd: "git:set", key: "deploy-branch", report: "git", kind: "scalar" },
+      { yaml: "keep_git_dir", cmd: "git:set", key: "keep-git-dir", report: "git", kind: "scalar" },
+      { yaml: "archive_max_files", cmd: "git:set", key: "archive-max-files", report: "git", kind: "scalar" },
+      { yaml: "archive_max_size", cmd: "git:set", key: "archive-max-size", report: "git", kind: "scalar" }
+    ]
+  }
+};
+var GLOBAL_NAMES = Object.keys(GLOBAL_SPECS);
+var GLOBAL_UP_ORDER = ["logs", "nginx", "scheduler", "registry", "checks", "ps", "build", "proxy", "git"];
+function declaredMap(name, block) {
+  if (typeof block === "string") return name === "scheduler" ? { selected: block } : {};
+  return block ?? {};
+}
+async function readGlobal(ctx, name) {
+  const spec = GLOBAL_SPECS[name];
+  const byReport = /* @__PURE__ */ new Map();
+  for (const report of new Set(spec.keys.map((k) => k.report))) {
+    byReport.set(report, parseJsonReport(await ctx.queryStrict(`${report}:report`, "--global", "--format", "json"), "global"));
+  }
+  const current = {};
+  for (const gk of spec.keys) {
+    const value = byReport.get(gk.report)[gk.key];
+    if (value !== void 0) current[gk.yaml] = value;
+  }
+  return current;
+}
+var words = (value) => (value ?? "").split(/\s+/).filter(Boolean);
+var sameSet = (a, b) => a.length === b.length && a.every((v) => b.includes(v));
+function wanted(gk, value) {
+  if (gk.kind === "list") {
+    const names = Array.isArray(value) ? value.map(String) : [];
+    return { args: names, inSync: (current) => sameSet(words(current), names) };
+  }
+  if (gk.kind === "clearable" && value === false) {
+    return { args: [], inSync: (current) => current === void 0 };
+  }
+  if (gk.kind === "flag") {
+    const on = value === true || value === "true";
+    return { args: [String(on)], inSync: (current) => on ? current === "true" : current !== "true" };
+  }
+  return { args: [String(value)], inSync: (current) => current === String(value) };
+}
+var BOOLEAN_KEYS = /* @__PURE__ */ new Set(["push-on-release", "skip-deploy", "skip_cleanup", "keep_git_dir"]);
+async function exportGlobal(ctx, name) {
+  const current = await readGlobal(ctx, name);
+  const block = {};
+  for (const gk of GLOBAL_SPECS[name].keys) {
+    const value = current[gk.yaml];
+    if (value === void 0) continue;
+    if (gk.kind === "list") block[gk.yaml] = words(value);
+    else if (gk.kind === "flag" || BOOLEAN_KEYS.has(gk.yaml) && (value === "true" || value === "false")) block[gk.yaml] = value === "true";
+    else block[gk.yaml] = value;
+  }
+  const keys = Object.keys(block);
+  if (keys.length === 0) return void 0;
+  if (name === "scheduler" && keys.length === 1 && keys[0] === "selected") return block.selected;
+  return block;
+}
+function planGlobal(name, block, current) {
+  const declared = declaredMap(name, block);
+  const keys = GLOBAL_SPECS[name].keys;
+  const plan = { changes: [], removals: [] };
+  for (const yaml4 of Object.keys(declared)) {
+    const gk = keys.find((k) => k.yaml === yaml4);
+    if (!gk || declared[yaml4] === void 0) continue;
+    const want = wanted(gk, declared[yaml4]);
+    if (!want.inSync(current[yaml4])) plan.changes.push({ gk, args: want.args });
+  }
+  for (const gk of keys) {
+    if (!gk.keep && declared[gk.yaml] === void 0 && current[gk.yaml] !== void 0) plan.removals.push(gk);
+  }
+  return plan;
+}
+function appSets(name, gk, app) {
+  if (name === "network") {
+    if (gk.yaml === "attach_post_deploy") return app?.networks !== void 0;
+    return app?.network?.[gk.yaml] !== void 0;
+  }
+  if (name === "build") return app?.build?.[gk.yaml] !== void 0;
+  return false;
+}
+function markApps(ctx, name, gk, opts) {
+  if (!gk.effect) return;
+  for (const app of opts.apps ?? []) {
+    if (appSets(name, gk, opts.appConfigs?.[app])) continue;
+    if (gk.effect === "rebuild") ctx.needsRebuild(app, `global ${name}`);
+    else ctx.needsRestart(app, `global ${name}`);
+  }
+}
+async function ensureGlobal(ctx, name, block, opts = {}) {
+  logAction("global", `Configuring ${name}`);
+  const plan = planGlobal(name, block, await readGlobal(ctx, name));
+  for (const { gk, args } of plan.changes) {
+    await ctx.run(gk.cmd, "--global", gk.key, ...args);
+    markApps(ctx, name, gk, opts);
+  }
+  if (opts.prune) {
+    for (const gk of plan.removals) {
+      await ctx.run(gk.cmd, "--global", gk.key);
+      markApps(ctx, name, gk, opts);
+    }
+  }
+  const changed = plan.changes.length > 0 || !!opts.prune && plan.removals.length > 0;
+  if (changed) logDone();
+  else logSkip();
+  if (!opts.prune && plan.removals.length > 0) {
+    logWarn("global", `${plan.removals.length} global ${name} setting(s) no longer in the compose file were left on the server; run 'dokku-compose diff' to see them`);
+  }
+  return changed;
+}
+
+// src/modules/service-property-keys.ts
+import { posix } from "path";
+var MANAGED_PROPERTIES = {
+  "initial-network": { kind: "string", createFlag: "initial-network", restart: true },
+  "post-create-network": { kind: "list", createFlag: "post-create-network", restart: true },
+  "post-start-network": { kind: "list", createFlag: "post-start-network", restart: true },
+  "log-driver": { kind: "string", createFlag: "log-driver", restart: true },
+  "log-opt": { kind: "list", createFlag: "log-opt", restart: true },
+  "restart-policy": { kind: "string", createFlag: "restart", restart: true },
+  "wait-timeout": { kind: "number", createFlag: "wait-timeout", restart: false },
+  "volume-targets": { kind: "targets", createFlag: "volume-target", repeat: true, restart: true },
+  "config-options": { kind: "string", createFlag: "config-options", restart: true },
+  "custom-env": { kind: "map", createFlag: "custom-env", restart: true },
+  memory: { kind: "number", createFlag: "memory", restart: true },
+  "shm-size": { kind: "string", createFlag: "shm-size", restart: true },
+  password: { kind: "secret", createFlag: "password", restart: false }
+};
+var COMMON_SET_KEYS = [
+  "initial-network",
+  "post-create-network",
+  "post-start-network",
+  "backup-keyserver",
+  "backup-storage-class",
+  "backup-object-name",
+  "backup-timestamp",
+  "backup-mailto",
+  "backup-access-key-id",
+  "backup-secret-access-key",
+  "backup-default-region",
+  "backup-signature-version",
+  "backup-endpoint-url",
+  "backup-encryption-passphrase",
+  "backup-public-key-id",
+  "backup-bucket",
+  "backup-use-iam",
+  "log-driver",
+  "log-opt",
+  "restart-policy",
+  "wait-timeout",
+  "port-bind-address",
+  "port-source-range",
+  "expose-host",
+  "expose-mode"
+];
+var TAIL_SET_KEYS = ["volume-targets", "config-options", "custom-env", "memory", "shm-size", "password"];
+var PLUGIN_SET_KEYS = {
+  postgres: [...COMMON_SET_KEYS, "export-args", "import-args", ...TAIL_SET_KEYS],
+  redis: [...COMMON_SET_KEYS, ...TAIL_SET_KEYS]
+};
+var TESTED_PLUGIN_VERSION = "2.4.0";
+function rejectedReason(key) {
+  if (key.startsWith("backup-")) return "backup settings belong to the `backup:` block";
+  if (key.startsWith("expose-") || key === "port-bind-address" || key === "port-source-range") {
+    return "exposing a service is not managed yet";
+  }
+  switch (key) {
+    case "export-args":
+    case "import-args":
+      return "arguments for ad-hoc exports and imports are not managed";
+    case "root-password":
+      return "postgres and redis have no root password";
+    case "service-memory":
+      return "postgres and redis have no service memory";
+    case "image":
+    case "image-version":
+    case "version":
+      return "declare `version` and `image` beside `properties`; `up` never upgrades a service";
+    case "definition":
+      return "the definition a service runs on is changed with upgrade";
+    case "mounts":
+      return "mounts are declared in the `mounts:` key";
+    default:
+      return void 0;
+  }
+}
+var PRUNABLE_PROPERTIES = Object.keys(MANAGED_PROPERTIES).filter((k) => k !== "password");
+function propertyString(key, value) {
+  if (Array.isArray(value)) return value.map(String).join(",");
+  if (typeof value === "object") {
+    if (MANAGED_PROPERTIES[key]?.kind === "targets") return targetPairs(value).map(([k, v]) => `${k}=${v}`).join(" ");
+    return Object.entries(value).map(([k, v]) => `${k}=${v}`).join(";");
+  }
+  if (MANAGED_PROPERTIES[key]?.kind === "targets") return targetPairs(String(value)).map(([k, v]) => `${k}=${v}`).join(" ");
+  return String(value).trim();
+}
+var splitSorted = (value, sep) => value.split(sep).map((s) => s.trim()).filter((s) => s !== "").sort().join(sep);
+function comparableProperty(key, value) {
+  switch (MANAGED_PROPERTIES[key]?.kind) {
+    case "list":
+      return splitSorted(value, ",");
+    case "map":
+      return splitSorted(value, ";");
+    case "targets":
+      return targetPairs(value).map(([k, v]) => `${k}=${v}`).join(" ");
+    case "number":
+      return key === "memory" && value === "" ? "0" : value.trim();
+    default:
+      return value;
+  }
+}
+function isDefaultProperty(key, current) {
+  return key === "memory" ? current === "" || current === "0" : current === "";
+}
+function sameProperty(key, desired, current) {
+  return comparableProperty(key, desired) === comparableProperty(key, current);
+}
+function customEnvPairs(value) {
+  if (typeof value === "string") {
+    return value.split(";").filter((s) => s !== "").map((s) => {
+      const i = s.indexOf("=");
+      return i === -1 ? [s, ""] : [s.slice(0, i), s.slice(i + 1)];
+    });
+  }
+  return Object.entries(value).map(([k, v]) => [k, String(v)]);
+}
+function cleanPath(p) {
+  const n = posix.normalize(p);
+  return n.length > 1 ? n.replace(/\/+$/, "") : n;
+}
+function targetPairs(value) {
+  const pairs = typeof value === "string" ? value.split(/\s+/).filter((s) => s !== "").map((s) => {
+    const i = s.indexOf("=");
+    return i === -1 ? [s, ""] : [s.slice(0, i), s.slice(i + 1)];
+  }) : Object.entries(value).map(([k, v]) => [k, String(v)]);
+  return pairs.map(([k, v]) => [k, v.startsWith("/") ? cleanPath(v) : v]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+}
+function normalizeMount2(spec) {
+  const parts = spec.split(":");
+  const source = parts[0] ?? "";
+  const dir = parts[1] ?? "";
+  const rest = parts.slice(2).join(":");
+  if (rest === "") return `${source}:${dir}`;
+  let ro = false;
+  let subpath;
+  let chown;
+  const others = [];
+  for (const token of rest.split(",")) {
+    if (token === "ro") ro = true;
+    else if (token === "rw") continue;
+    else if (token.startsWith("volume-subpath=")) subpath = token;
+    else if (token.startsWith("volume-chown=")) chown = token;
+    else others.push(token);
+  }
+  const options = [...ro ? ["ro"] : [], ...others, ...subpath ? [subpath] : [], ...chown ? [chown] : []];
+  return options.length ? `${source}:${dir}:${options.join(",")}` : `${source}:${dir}`;
+}
+function mountSet(specs) {
+  return [...new Set(specs.map(normalizeMount2))].sort();
+}
+function parseInfoMounts(raw) {
+  return mountSet(raw.split(/\s+/).filter((s) => s !== ""));
+}
+
 // src/core/schema.ts
-function propertyMap(namespace, keys, value) {
+function propertyMap(namespace, keys, value, scope = "") {
   return z.record(z.string(), value).superRefine((map, ctx) => {
     for (const key of Object.keys(map)) {
       if (!keys.includes(key)) {
-        ctx.addIssue({ code: "custom", path: [key], message: `'${key}' is not a ${namespace}:set property (valid: ${keys.join(", ")})` });
+        ctx.addIssue({ code: "custom", path: [key], message: `'${key}' is not a ${namespace}:set${scope} property (valid: ${keys.join(", ")})` });
       }
     }
   });
 }
 var StringOrNumber = z.union([z.string(), z.number()]);
+function withHints(hints, notAnObject) {
+  return {
+    error: (iss) => {
+      if (iss.code === "unrecognized_keys" && iss.keys.some((k) => k in hints)) {
+        return iss.keys.map((k) => `'${k}' ${hints[k] ?? "is not a recognized key"}`).join("; ");
+      }
+      if (iss.code === "invalid_type" && iss.expected === "object") return notAnObject?.(iss.input);
+      return void 0;
+    }
+  };
+}
+var PER_APP_ONLY = "is a per-app setting (Dokku has no global form); put it under apps.<app>";
 var PortSchema = z.string().regex(
   /^(http|https|tcp|udp):\d+:\d+$/,
   "Port must be scheme:host:container (e.g. http:80:3000)"
@@ -265,13 +719,17 @@ var EnvMapSchema = z.union([
   z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])),
   z.literal(false)
 ]);
+var WaitToRetire = z.preprocess(
+  (v) => typeof v === "string" && /^\s*\d+\s*$/.test(v) ? Number(v) : v,
+  z.number({ error: "wait-to-retire is a number of seconds" }).int().min(0)
+);
 var ChecksSchema = z.union([
   z.literal(false),
   z.object({
     disabled: z.array(z.string()).optional(),
     skipped: z.array(z.string()).optional(),
     // The only `checks:set` key (Dokku 0.38.31); anything else is refused.
-    "wait-to-retire": z.union([z.string(), z.number(), z.boolean()]).optional()
+    "wait-to-retire": WaitToRetire.optional()
   }).strict()
 ]);
 var GitSchema = z.object({
@@ -280,10 +738,88 @@ var GitSchema = z.object({
   rev_env_var: z.string().optional(),
   source_image: z.string().optional(),
   // Dokku reads `archive-max-files` and `archive-max-size` only from the global setting
-  // (`git:set --global`), which dokku-compose does not manage yet; a per-app value never applies.
-  archive_max_files: z.any().optional().refine((v) => v === void 0, { message: "archive_max_files is read only from the global git setting, which dokku-compose does not manage; run `dokku git:set --global archive-max-files <n>`" }),
-  archive_max_size: z.any().optional().refine((v) => v === void 0, { message: "archive_max_size is read only from the global git setting, which dokku-compose does not manage; run `dokku git:set --global archive-max-size <n>`" })
+  // (`git:set --global`), so a per-app value never applies: declare them in the top-level `git:`.
+  archive_max_files: z.any().optional().refine((v) => v === void 0, { message: "archive_max_files is read only from the global git setting; declare it in the top-level git:" }),
+  archive_max_size: z.any().optional().refine((v) => v === void 0, { message: "archive_max_size is read only from the global git setting; declare it in the top-level git:" })
+}).strict();
+var GlobalGitSchema = z.strictObject({
+  deploy_branch: z.string().optional(),
+  keep_git_dir: z.union([z.string(), z.boolean()]).optional(),
+  archive_max_files: StringOrNumber.optional(),
+  archive_max_size: StringOrNumber.optional()
+}, withHints({ rev_env_var: `${PER_APP_ONLY}.git`, source_image: `${PER_APP_ONLY}.git` }));
+var SchedulerSchema = z.union([z.string(), z.object({ selected: z.string().optional(), shell: z.string().optional() }).strict()]);
+var PsSchema = z.object({
+  "procfile-path": z.union([z.string(), z.number()]).optional(),
+  "restart-policy": z.union([z.string(), z.number()]).optional(),
+  "stop-timeout-seconds": z.union([z.string(), z.number()]).optional(),
+  "dockerfile-start-cmd": z.union([z.string(), z.number()]).optional(),
+  restore: z.union([z.string(), z.boolean()]).optional(),
+  "skip-deploy": z.union([z.string(), z.boolean()]).optional(),
+  "start-cmd": z.union([z.string(), z.number()]).optional()
+}).strict();
+var GlobalPsSchema = z.strictObject({
+  "procfile-path": z.union([z.string(), z.number()]).optional(),
+  "restart-policy": z.union([z.string(), z.number()]).optional(),
+  "stop-timeout-seconds": z.union([z.string(), z.number()]).optional(),
+  "skip-deploy": z.union([z.string(), z.boolean()]).optional()
+}, withHints(Object.fromEntries(["restore", "start-cmd", "dockerfile-start-cmd"].map((k) => [k, `${PER_APP_ONLY}.ps`]))));
+var GlobalChecksSchema = z.strictObject({
+  // The only `checks:set` key (Dokku 0.38.31), and the only one with a global form.
+  "wait-to-retire": WaitToRetire.optional()
+}, withHints({
+  disabled: `${PER_APP_ONLY}.checks`,
+  skipped: `${PER_APP_ONLY}.checks`
+}, (input) => input === false ? "false disables the checks of one app; put it under apps.<app>.checks" : void 0));
+var BuildSchema = z.object({
+  dockerfile: z.string().optional(),
+  app_json: z.string().optional(),
+  context: z.string().optional(),
+  selected: z.string().optional(),
+  skip_cleanup: z.union([z.string(), z.boolean()]).optional(),
+  args: z.record(z.string(), z.string()).optional()
 }).strict();
+var GlobalBuildSchema = z.strictObject({
+  dockerfile: z.string().optional(),
+  app_json: z.string().optional(),
+  context: z.string().optional(),
+  selected: z.string().optional(),
+  skip_cleanup: z.union([z.string(), z.boolean()]).optional()
+}, withHints({ args: "has no global form (build args are docker options); put them under apps.<app>.build.args" }));
+var NETWORK_LIST_HINT = "is the list of networks to attach; properties such as tld go under network:";
+var NETWORK_PROPS_HINT = "takes properties (tld, bind_all_interfaces, ...); the list of networks to attach goes under networks:";
+var NetworkSchema = z.strictObject({
+  attach_post_create: z.union([z.array(z.string()), z.literal(false)]).optional(),
+  initial_network: z.union([z.string(), z.literal(false)]).optional(),
+  bind_all_interfaces: z.boolean().optional(),
+  static_web_listener: z.union([z.string(), z.literal(false)]).optional(),
+  tld: z.union([z.string(), z.literal(false)]).optional()
+}, withHints({
+  attach_post_deploy: "is not a network: key; per app, attach-post-deploy is the list under networks:",
+  networks: "is a sibling of network:, not a key inside it"
+}, (input) => Array.isArray(input) ? NETWORK_PROPS_HINT : void 0));
+var GlobalNetworkSchema = z.strictObject({
+  attach_post_create: z.union([z.array(z.string()), z.literal(false)]).optional(),
+  attach_post_deploy: z.array(z.string()).optional(),
+  initial_network: z.union([z.string(), z.literal(false)]).optional(),
+  bind_all_interfaces: z.boolean().optional(),
+  tld: z.union([z.string(), z.literal(false)]).optional()
+}, withHints({
+  static_web_listener: `${PER_APP_ONLY}.network`,
+  networks: "is the list of shared networks to create; it sits beside network:, not inside it"
+}, (input) => Array.isArray(input) ? "takes global properties (tld, attach_post_deploy, ...); the list of shared networks to create goes under networks:" : void 0));
+var GlobalProxySchema = z.strictObject({
+  type: z.string().optional(),
+  proxy_port: StringOrNumber.optional(),
+  proxy_ssl_port: StringOrNumber.optional()
+}, withHints({ enabled: `${PER_APP_ONLY}.proxy` }));
+var isMap = (input) => !!input && typeof input === "object" && !Array.isArray(input);
+var appNetworksList = z.array(z.string(), {
+  error: (iss) => iss.code === "invalid_type" && isMap(iss.input) ? NETWORK_LIST_HINT : void 0
+});
+var sharedNetworksList = z.array(z.string(), {
+  error: (iss) => iss.code === "invalid_type" && isMap(iss.input) ? "is the list of shared networks to create; global network properties go under network:" : void 0
+});
 var LinkSchema = z.union([
   z.string(),
   z.object({
@@ -293,6 +829,59 @@ var LinkSchema = z.union([
     querystring: z.string().min(1).optional()
   }).strict().refine((l) => !(l.alias && l.env_var), { message: "`alias` and `env_var` cannot be combined" })
 ]);
+var VolumeSchema = z.object({
+  // Checked below, so a wrong type gets a message that says how to write it.
+  chown: z.union([z.literal(false), z.string(), z.number()]).optional(),
+  mode: z.union([z.string(), z.number()]).optional(),
+  path: z.string().optional()
+}).strict();
+var VolumesSchema = z.record(z.string(), VolumeSchema).superRefine((volumes, ctx) => {
+  const bad = (name, key, message) => ctx.addIssue({ code: "custom", path: key ? [name, key] : [name], message });
+  for (const [name, v] of Object.entries(volumes)) {
+    if (isLegacyName(name)) {
+      if (Object.keys(v).length > 0) bad(name, void 0, `'${name}' starts with 'legacy-', which Dokku reserves for entries it made from old host-path mounts: declare such an entry as {}, or give a new entry another name`);
+      continue;
+    }
+    const nameError = entryNameError(name);
+    if (nameError) bad(name, void 0, nameError);
+    if (v.mode !== void 0) {
+      const e = modeError(v.mode);
+      if (e) bad(name, "mode", e);
+    }
+    if (v.chown !== void 0) {
+      const e = chownError(v.chown);
+      if (e) bad(name, "chown", e);
+    }
+    if (v.path !== void 0) {
+      const e = pathError(v.path);
+      if (e) bad(name, "path", e);
+      else if (!usesDefaultLocation(name, v.path)) {
+        if (v.mode !== void 0) bad(name, "mode", `mode needs the default location: Dokku refuses it on a custom path. Drop path, or manage '${v.path}' yourself`);
+        if (v.chown !== void 0 && v.chown !== false) bad(name, "chown", `chown needs the default location: Dokku refuses it on a custom path. Drop path, use chown: false, or manage '${v.path}' yourself`);
+      }
+    }
+  }
+});
+var unsupportedMountKey = (key) => z.any().optional().refine((v) => v === void 0, {
+  message: `${key} is not supported: on docker-local Dokku stores it but never applies it`
+});
+var MountObjectSchema = z.object({
+  entry: z.string().min(1),
+  container_dir: z.string().min(1),
+  readonly: z.boolean().optional(),
+  phases: z.array(z.enum(["deploy", "run"])).min(1).optional(),
+  process_type: z.string().optional(),
+  options: z.array(z.string()).optional(),
+  subpath: unsupportedMountKey("subpath"),
+  volume_chown: unsupportedMountKey("volume_chown")
+}).strict().superRefine((m, ctx) => {
+  for (const message of mountIssues(m)) ctx.addIssue({ code: "custom", message });
+});
+var MountStringSchema = z.string().superRefine((s, ctx) => {
+  const parsed = parseMountString(s);
+  if (typeof parsed === "string") ctx.addIssue({ code: "custom", message: parsed });
+  else for (const message of mountIssues(parsed)) ctx.addIssue({ code: "custom", message });
+});
 var AppSchema = z.object({
   domains: z.union([z.array(z.string()), z.literal(false)]).optional(),
   links: z.array(LinkSchema).optional(),
@@ -303,100 +892,270 @@ var AppSchema = z.object({
   ssl: z.union([
     z.literal(false),
     z.literal(true),
-    z.object({ certfile: z.string(), keyfile: z.string() })
+    z.object({ certfile: z.string(), keyfile: z.string() }).strict()
   ]).optional(),
-  storage: z.array(z.string()).optional(),
+  storage: z.array(z.union([MountStringSchema, MountObjectSchema])).optional(),
   proxy: z.object({
     enabled: z.boolean().optional(),
     type: z.string().optional(),
     proxy_port: StringOrNumber.optional(),
     proxy_ssl_port: StringOrNumber.optional()
   }).strict().optional(),
-  networks: z.array(z.string()).optional(),
-  network: z.object({
-    attach_post_create: z.union([z.array(z.string()), z.literal(false)]).optional(),
-    initial_network: z.union([z.string(), z.literal(false)]).optional(),
-    bind_all_interfaces: z.boolean().optional(),
-    static_web_listener: z.union([z.string(), z.literal(false)]).optional(),
-    tld: z.union([z.string(), z.literal(false)]).optional()
-  }).optional(),
+  networks: appNetworksList.optional(),
+  network: NetworkSchema.optional(),
   nginx: propertyMap("nginx", NGINX_KEYS, StringOrNumber).optional(),
   logs: propertyMap("logs", LOGS_KEYS, StringOrNumber).optional(),
   // `auth-servers` is report-only: it is a registry login, not a `registry:set` key.
   registry: propertyMap("registry", REGISTRY_KEYS, z.union([z.string(), z.boolean()])).optional(),
-  scheduler: z.union([z.string(), z.object({ selected: z.string().optional(), shell: z.string().optional() }).strict()]).optional(),
+  scheduler: SchedulerSchema.optional(),
   scale: z.record(z.string(), z.preprocess((v) => typeof v === "string" && /^\s*-?\d+\s*$/.test(v) ? Number(v) : v, z.number().int().min(0))).optional(),
-  ps: z.object({
-    "procfile-path": z.union([z.string(), z.number()]).optional(),
-    "restart-policy": z.union([z.string(), z.number()]).optional(),
-    "stop-timeout-seconds": z.union([z.string(), z.number()]).optional(),
-    "dockerfile-start-cmd": z.union([z.string(), z.number()]).optional(),
-    restore: z.union([z.string(), z.boolean()]).optional(),
-    "skip-deploy": z.union([z.string(), z.boolean()]).optional(),
-    "start-cmd": z.union([z.string(), z.number()]).optional()
-  }).strict().optional(),
+  ps: PsSchema.optional(),
   checks: ChecksSchema.optional(),
-  build: z.object({
-    dockerfile: z.string().optional(),
-    app_json: z.string().optional(),
-    context: z.string().optional(),
-    selected: z.string().optional(),
-    skip_cleanup: z.union([z.string(), z.boolean()]).optional(),
-    args: z.record(z.string(), z.string()).optional()
-  }).optional(),
+  build: BuildSchema.optional(),
   docker_options: z.object({
     build: z.array(z.string()).optional(),
     deploy: z.array(z.string()).optional(),
     run: z.array(z.string()).optional()
-  }).optional(),
+  }).strict().optional(),
   git: GitSchema.optional()
-});
+}).strict();
+var EXPORT_PLACEHOLDER = "REPLACE_ME";
+var notPlaceholder = (v) => v !== EXPORT_PLACEHOLDER;
+var placeholderMessage = `replace the ${EXPORT_PLACEHOLDER} placeholder written by export`;
+var singleLine = (v) => !/[\r\n]/.test(v);
 var ServiceBackupAuthSchema = z.object({
-  access_key_id: z.string().min(1),
-  secret_access_key: z.string().min(1),
+  access_key_id: z.string().min(1).refine(notPlaceholder, placeholderMessage),
+  secret_access_key: z.string().min(1).refine(notPlaceholder, placeholderMessage),
   region: z.string().min(1),
   signature_version: z.string().min(1),
   endpoint: z.string().min(1)
+}).strict();
+var ServiceBackupEncryptionSchema = z.object({
+  passphrase: z.string().min(1).refine(singleLine, "must be a single line").refine(notPlaceholder, placeholderMessage).optional(),
+  public_key_id: z.string().min(1).refine(singleLine, "must be a single line").optional(),
+  keyserver: z.string().min(1).refine(singleLine, "must be a single line").optional()
+}).strict().superRefine((enc, ctx) => {
+  if (enc.passphrase !== void 0 && enc.public_key_id !== void 0) {
+    ctx.addIssue({ code: "custom", message: "name passphrase or public_key_id, not both" });
+  } else if (enc.passphrase === void 0 && enc.public_key_id === void 0) {
+    ctx.addIssue({ code: "custom", message: "name passphrase or public_key_id (use encryption: false to clear it)" });
+  }
+  if (enc.keyserver !== void 0 && enc.public_key_id === void 0) {
+    ctx.addIssue({ code: "custom", path: ["keyserver"], message: "keyserver goes with public_key_id" });
+  }
 });
+var STORAGE_CLASSES = [
+  "STANDARD",
+  "REDUCED_REDUNDANCY",
+  "STANDARD_IA",
+  "ONEZONE_IA",
+  "INTELLIGENT_TIERING",
+  "GLACIER",
+  "DEEP_ARCHIVE",
+  "GLACIER_IR"
+];
+function objectNameProblem(name) {
+  if (name.length > 512) return "must be at most 512 characters";
+  if (!/^[A-Za-z0-9._\-/]+$/.test(name)) return "may hold only letters, numbers, dots, dashes, underscores and slashes";
+  if (name.startsWith("/") || name.endsWith("/")) return "must not start or end with a slash";
+  if (name.split("/").some((seg) => seg === "" || seg === "." || seg === "..")) return "must not have an empty, . or .. segment";
+  return void 0;
+}
 var ServiceBackupSchema = z.object({
   schedule: z.string().min(1),
   bucket: z.string().min(1),
-  auth: ServiceBackupAuthSchema
+  auth: ServiceBackupAuthSchema,
+  // false clears the service's encryption; absent leaves it alone
+  encryption: z.union([ServiceBackupEncryptionSchema, z.literal(false)]).optional(),
+  storage_class: z.enum(STORAGE_CLASSES).optional(),
+  object_name: z.string().superRefine((name, ctx) => {
+    const problem = objectNameProblem(name);
+    if (problem) ctx.addIssue({ code: "custom", message: problem });
+  }).optional(),
+  mailto: z.string().min(1).regex(/^\S+$/, "must not contain spaces").optional(),
+  // the plugin takes false (no timestamp in the object name) or unset
+  timestamp: z.literal(false).optional()
+}).strict();
+var PropertyValueSchema = z.union([
+  z.string(),
+  z.number(),
+  z.array(z.union([z.string(), z.number()])),
+  z.record(z.string(), z.union([z.string(), z.number(), z.boolean()]))
+]);
+var ServicePropertiesSchema = z.record(z.string(), PropertyValueSchema).superRefine((props, ctx) => {
+  const issue = (key, message) => ctx.addIssue({ code: "custom", path: [key], message });
+  for (const [key, value] of Object.entries(props)) {
+    const rejected = rejectedReason(key);
+    if (rejected) {
+      issue(key, `'${key}' cannot be set here: ${rejected}`);
+      continue;
+    }
+    const kind = MANAGED_PROPERTIES[key]?.kind;
+    if (kind === "map") {
+      if (Array.isArray(value)) {
+        issue(key, `'${key}' takes a map of names to values`);
+        continue;
+      }
+      for (const [name, v] of customEnvPairs(value)) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) issue(key, `'${name}' is not an environment variable name`);
+        if (/[;\r\n]/.test(v)) issue(key, `the value of ${name} must not contain ';' or a newline`);
+        if (v === EXPORT_PLACEHOLDER) issue(key, `the value of ${name}: ${placeholderMessage}`);
+      }
+      if (typeof value === "string" && /[\r\n]/.test(value)) issue(key, `'${key}' must be a single line`);
+      continue;
+    }
+    if (kind === "targets") {
+      if (Array.isArray(value)) {
+        issue(key, `'${key}' takes a map of volumes to container paths`);
+        continue;
+      }
+      const seen = /* @__PURE__ */ new Set();
+      for (const [volume, target] of targetPairs(value)) {
+        if (volume === "" || target === "") {
+          issue(key, `'${volume}' needs a container path (<volume>=<container-path>)`);
+          continue;
+        }
+        if (seen.has(volume)) issue(key, `the volume ${volume} is moved more than once`);
+        seen.add(volume);
+        if (!target.startsWith("/")) issue(key, `the container path of ${volume} must be absolute`);
+        else if (/[:,\s]/.test(target)) issue(key, `the container path of ${volume} must not contain a colon, a comma or whitespace`);
+        else if (cleanPath(target) === "/") issue(key, `the volume ${volume} must not be mounted at /`);
+      }
+      continue;
+    }
+    if (kind === "list") {
+      const items = Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : void 0;
+      if (!items) {
+        issue(key, `'${key}' takes a list`);
+        continue;
+      }
+      if (items.some((i) => String(i).trim() === "" || /[,\s]/.test(String(i).trim()))) issue(key, `'${key}' entries must not be empty or contain commas or spaces`);
+      continue;
+    }
+    if (typeof value === "object") {
+      issue(key, `'${key}' takes a string or number`);
+      continue;
+    }
+    const text = String(value);
+    if (text.trim() === "") {
+      issue(key, `'${key}' is empty: leave the key out`);
+      continue;
+    }
+    if (/[\r\n]/.test(text)) {
+      issue(key, `'${key}' must be a single line`);
+      continue;
+    }
+    if (kind === "secret") {
+      if (!/^[A-Za-z0-9._~-]+$/.test(text)) issue(key, `'${key}' may hold only letters, digits, '.', '_', '~' and '-'`);
+      if (text === EXPORT_PLACEHOLDER) issue(key, placeholderMessage);
+    } else if (key === "memory") {
+      if (!/^\d+$/.test(text.trim())) issue(key, "memory is a whole number of megabytes (0 for no limit)");
+    } else if (key === "wait-timeout") {
+      if (!/^\d+$/.test(text.trim()) || Number(text) < 1) issue(key, "wait-timeout is a whole number of seconds greater than 0");
+    }
+  }
 });
+var ServiceMountObjectSchema = z.object({
+  entry: z.string().min(1),
+  container_dir: z.string().min(1),
+  readonly: z.boolean().optional(),
+  options: z.array(z.string()).optional()
+}).strict().superRefine((m, ctx) => {
+  for (const message of serviceMountIssues(m)) ctx.addIssue({ code: "custom", message });
+});
+var ServiceMountStringSchema = z.string().superRefine((s, ctx) => {
+  const parsed = parseServiceMountString(s);
+  if (typeof parsed === "string") ctx.addIssue({ code: "custom", message: parsed });
+  else for (const message of serviceMountIssues(parsed)) ctx.addIssue({ code: "custom", message });
+});
+var ServiceMountsSchema = z.array(z.union([ServiceMountStringSchema, ServiceMountObjectSchema]));
 var PostgresSchema = z.object({
   version: z.string().optional(),
   image: z.string().optional(),
-  // false removes the service's backup schedule and credentials; absent leaves them alone
-  backup: z.union([ServiceBackupSchema, z.literal(false)]).optional()
-});
+  // false removes the service's backup schedule, credentials, encryption and settings; absent leaves them alone
+  backup: z.union([ServiceBackupSchema, z.literal(false)]).optional(),
+  // the plugin's `:set` keys; absent leaves them alone, `--prune` clears the known ones removed from the file
+  properties: ServicePropertiesSchema.optional(),
+  // the whole set of mounts; absent leaves them alone, [] removes them all
+  mounts: ServiceMountsSchema.optional()
+}).strict();
 var RedisSchema = z.object({
   version: z.string().optional(),
-  image: z.string().optional()
-});
+  image: z.string().optional(),
+  // same blocks as postgres
+  backup: z.union([ServiceBackupSchema, z.literal(false)]).optional(),
+  properties: ServicePropertiesSchema.optional(),
+  mounts: ServiceMountsSchema.optional()
+}).strict();
 var PluginSchema = z.object({
   url: z.string().url(),
   version: z.string().optional()
-});
+}).strict();
 var DockerAuthEntrySchema = z.object({
   username: z.string().min(1),
   password: z.string().min(1)
-});
+}).strict();
 var ConfigSchema = z.object({
   dokku: z.object({
-    version: z.string().optional()
-  }).optional(),
+    version: z.string({ error: 'dokku.version must be a quoted string starting with X.Y.Z, e.g. "0.38.31"' }).regex(SEMVER_RE, 'dokku.version must start with X.Y.Z, e.g. "0.38.31"').optional()
+  }).strict().optional(),
   plugins: z.record(z.string(), PluginSchema).optional(),
   docker_auth: z.record(z.string(), DockerAuthEntrySchema).optional(),
-  networks: z.array(z.string()).optional(),
+  networks: sharedNetworksList.optional(),
+  volumes: VolumesSchema.optional(),
   postgres: z.record(z.string(), PostgresSchema).optional(),
   redis: z.record(z.string(), RedisSchema).optional(),
   apps: z.record(z.string(), AppSchema),
   domains: z.union([z.array(z.string()), z.literal(false)]).optional(),
   env: EnvMapSchema.optional(),
-  nginx: propertyMap("nginx", NGINX_KEYS, StringOrNumber).optional(),
-  // The top-level block is also applied with `--global`, which takes two more keys.
-  logs: propertyMap("logs", LOGS_GLOBAL_KEYS, StringOrNumber).optional(),
-  git: GitSchema.optional()
+  // The top-level blocks below are Dokku's own `--global` settings (`<ns>:set --global`); Dokku does the inheritance.
+  nginx: propertyMap("nginx", NGINX_KEYS, StringOrNumber, " --global").optional(),
+  // Also takes the two keys only `logs:set --global` accepts.
+  logs: propertyMap("logs", LOGS_GLOBAL_KEYS, StringOrNumber, " --global").optional(),
+  scheduler: SchedulerSchema.optional(),
+  // `image-repo` names one app's repository: per app only, like the report-only `auth-servers`.
+  registry: propertyMap("registry", REGISTRY_GLOBAL_KEYS, z.union([z.string(), z.boolean()]), " --global").optional(),
+  checks: GlobalChecksSchema.optional(),
+  ps: GlobalPsSchema.optional(),
+  build: GlobalBuildSchema.optional(),
+  network: GlobalNetworkSchema.optional(),
+  proxy: GlobalProxySchema.optional(),
+  git: GlobalGitSchema.optional()
+}).strict().superRefine((config, ctx) => {
+  for (const plugin of ["postgres", "redis"]) {
+    for (const [svc, svcConfig] of Object.entries(config[plugin] ?? {})) {
+      const mounts = (svcConfig.mounts ?? []).flatMap((item, index) => {
+        const [mount] = declaredServiceMounts([item]);
+        return mount ? [{ mount, index }] : [];
+      });
+      mounts.forEach(({ mount: m, index }, i) => {
+        const where = [plugin, svc, "mounts", index];
+        if (!config.volumes || !(m.entry in config.volumes)) {
+          ctx.addIssue({ code: "custom", path: where, message: `entry '${m.entry}' is not declared under volumes: (a host directory is an entry's path:)` });
+        }
+        if (mounts.slice(0, i).some(({ mount: earlier }) => earlier.container_dir === m.container_dir)) {
+          ctx.addIssue({ code: "custom", path: where, message: `container_dir '${m.container_dir}' is mounted twice` });
+        }
+      });
+    }
+  }
+  for (const [app, appConfig] of Object.entries(config.apps)) {
+    const mounts = (appConfig.storage ?? []).flatMap((item, index) => {
+      const [mount] = declaredMounts([item]);
+      return mount ? [{ mount, index }] : [];
+    });
+    mounts.forEach(({ mount: m, index }, i) => {
+      const where = ["apps", app, "storage", index];
+      if (!config.volumes || !(m.entry in config.volumes)) {
+        ctx.addIssue({ code: "custom", path: where, message: `entry '${m.entry}' is not declared under volumes:` });
+      }
+      mounts.slice(0, i).forEach(({ mount: earlier }) => {
+        if (earlier.container_dir !== m.container_dir || !scopesOverlap(earlier.process_type, m.process_type)) return;
+        const how = earlier.process_type === m.process_type ? `twice in ${m.process_type === DEFAULT_SCOPE ? "every process" : `process type ${m.process_type}`}` : "in the default scope and in a named process type, which Dokku forbids";
+        ctx.addIssue({ code: "custom", path: where, message: `container_dir '${m.container_dir}' is mounted ${how}` });
+      });
+    });
+  }
 });
 function parseConfig(raw) {
   return ConfigSchema.parse(raw);
@@ -450,39 +1209,107 @@ import * as os from "os";
 import * as path from "path";
 
 // src/core/mask.ts
-var SENSITIVE_RE = /(?:TOKEN|SECRET|PASSWORD|KEY|AUTH|CREDENTIAL)/i;
-function maskValue(value) {
-  if (value.length <= 4) return "****";
+var SENSITIVE_RE = /(?:TOKEN|SECRET|PASSWORD|PASSPHRASE|KEY|AUTH|CREDENTIAL)/i;
+var NOT_SECRET_KEYS = /* @__PURE__ */ new Set(["public_key_id", "keyserver"]);
+var PLACEHOLDER = "REPLACE_ME";
+var OPAQUE_RE = /PASSPHRASE/i;
+function maskValue(value, opaque = false) {
+  if (opaque || value.length <= 4) return "****";
   return `****${value.slice(-4)}`;
 }
+var WORD = String.raw`(?:'[^']*'|\\.|[^\s\\])+`;
+function unshell(word) {
+  return /^'.*'$/s.test(word) ? word.slice(1, -1).replace(/'\\''/g, "'") : word;
+}
+function maskCustomEnv(value) {
+  return value.split(";").filter((p) => p !== "").map((p) => {
+    const i = p.indexOf("=");
+    return i === -1 ? "****" : `${p.slice(0, i)}=****`;
+  }).join(";");
+}
 function maskSensitiveArgs(cmd) {
-  let masked = cmd.replace(/([^\s=]*(?:TOKEN|SECRET|PASSWORD|KEY|AUTH|CREDENTIAL)[^\s=]*)=(\S+)/gi, (_, key, value) => {
-    return `${key}=${maskValue(value)}`;
+  const original = cmd;
+  cmd = cmd.replace(/^(\S+:set\s+(?:--no-restart\s+)?\S+\s+password\s+(?:--\s+)?).+$/s, (_, prefix) => `${prefix}****`);
+  cmd = cmd.replace(/^(\S+:set\s+(?:--no-restart\s+)?\S+\s+custom-env\s+(?:--\s+)?)(.+)$/s, (_, prefix, rest) => `${prefix}${maskCustomEnv(unshell(rest))}`);
+  cmd = cmd.replace(new RegExp(String.raw`^(\S+:create\s.*?\s--password\s+)(${WORD})`, "s"), (_, prefix) => `${prefix}****`);
+  cmd = cmd.replace(new RegExp(String.raw`^(\S+:create\s.*?\s--custom-env\s+)(${WORD})`, "s"), (_, prefix, word) => `${prefix}${maskCustomEnv(unshell(word))}`);
+  if (cmd !== original) return cmd;
+  let masked = cmd.replace(new RegExp(String.raw`'([^\s='\\]*(?:TOKEN|SECRET|PASSWORD|PASSPHRASE|KEY|AUTH|CREDENTIAL)[^\s='\\]*)=((?:[^']|'\\'')*)'`, "gi"), (_, key, value) => {
+    return `${key}=${maskValue(value.replace(/'\\''/g, "'"), OPAQUE_RE.test(key))}`;
+  });
+  masked = masked.replace(new RegExp(String.raw`([^\s=]*(?:TOKEN|SECRET|PASSWORD|PASSPHRASE|KEY|AUTH|CREDENTIAL)[^\s=]*)=(${WORD})`, "gi"), (_, key, value) => {
+    return `${key}=${maskValue(value, OPAQUE_RE.test(key))}`;
   });
   masked = masked.replace(
-    /^(?!.*--password-stdin)(registry:login\s+(?:--global\s+)?\S+\s+\S+\s+)(\S+)/,
+    /^(\S+:set\s+\S+\s+backup-encryption-passphrase\s+).+$/s,
+    (_, prefix) => `${prefix}****`
+  );
+  masked = masked.replace(
+    /^(\S+:backup-set-encryption\s+\S+\s+).+$/s,
+    (_, prefix) => `${prefix}****`
+  );
+  masked = masked.replace(
+    new RegExp(String.raw`^(?!.*--password-stdin)(registry:login\s+(?:--global\s+)?\S+\s+\S+\s+)(${WORD})`),
     (_, prefix, password) => `${prefix}${maskValue(password)}`
   );
   masked = masked.replace(
-    /^(\S+:backup-auth\s+\S+\s+)(\S+)(\s+)(\S+)/,
+    new RegExp(String.raw`^(\S+:backup-auth\s+\S+\s+)(${WORD})(\s+)(${WORD})`),
     (_, prefix, accessKeyId, sep, secretAccessKey) => `${prefix}${maskValue(accessKeyId)}${sep}${maskValue(secretAccessKey)}`
   );
   return masked;
 }
 function maskSensitiveArgsList(args) {
   const secrets = [];
+  const opaque = [];
   const masked = [...args];
-  const mark = (index) => {
+  const mark = (index, completely = false) => {
     const value = masked[index];
     if (value === void 0 || value === "") return;
     secrets.push(value);
-    masked[index] = maskValue(value);
+    if (completely) opaque.push(value);
+    masked[index] = maskValue(value, completely);
+  };
+  const handled = /* @__PURE__ */ new Set();
+  const markCustomEnv = (index) => {
+    handled.add(index);
+    const value = masked[index];
+    if (value === void 0 || value === "") return;
+    for (const part of value.split(";")) {
+      const v = part.slice(part.indexOf("=") + 1);
+      if (v.length >= 3) {
+        secrets.push(v);
+        opaque.push(v);
+      }
+    }
+    masked[index] = maskCustomEnv(value);
   };
+  if (/^\S+:set$/.test(masked[0] ?? "")) {
+    const name = masked[1] === "--no-restart" ? 2 : 1;
+    const key = masked[name + 1];
+    const valueAt = masked[name + 2] === "--" ? name + 3 : name + 2;
+    if (key === "password") {
+      handled.add(valueAt);
+      mark(valueAt, true);
+    }
+    if (key === "custom-env") markCustomEnv(valueAt);
+  }
+  if (/^\S+:create$/.test(masked[0] ?? "")) {
+    for (let i = 1; i < masked.length - 1; i++) {
+      if (masked[i] === "--password") {
+        handled.add(i + 1);
+        mark(i + 1, true);
+      }
+      if (masked[i] === "--custom-env") markCustomEnv(i + 1);
+    }
+  }
   for (let i = 0; i < masked.length; i++) {
-    const m = masked[i].match(/^([^\s=]*(?:TOKEN|SECRET|PASSWORD|KEY|AUTH|CREDENTIAL)[^\s=]*)=(.+)$/i);
+    if (handled.has(i)) continue;
+    const m = masked[i].match(/^([^\s=]*(?:TOKEN|SECRET|PASSWORD|PASSPHRASE|KEY|AUTH|CREDENTIAL)[^\s=]*)=(.+)$/i);
     if (m) {
       secrets.push(m[2]);
-      masked[i] = `${m[1]}=${maskValue(m[2])}`;
+      const completely = OPAQUE_RE.test(m[1]);
+      if (completely) opaque.push(m[2]);
+      masked[i] = `${m[1]}=${maskValue(m[2], completely)}`;
     }
   }
   if (masked[0] === "registry:login" && !masked.includes("--password-stdin")) {
@@ -492,13 +1319,15 @@ function maskSensitiveArgsList(args) {
     mark(2);
     mark(3);
   }
-  return { masked, secrets };
+  if (/^\S+:set$/.test(masked[0] ?? "") && masked[2] === "backup-encryption-passphrase") mark(3, true);
+  if (/^\S+:backup-set-encryption$/.test(masked[0] ?? "")) mark(2, true);
+  return { masked, secrets, opaque };
 }
-function maskSecretsInText(text, secrets) {
+function maskSecretsInText(text, secrets, opaque = []) {
   let masked = text;
   for (const secret of secrets) {
     if (!secret) continue;
-    masked = masked.split(secret).join(maskValue(secret));
+    masked = masked.split(secret).join(maskValue(secret, opaque.includes(secret)));
   }
   return masked;
 }
@@ -509,8 +1338,16 @@ function maskSensitiveData(data) {
   if (typeof data === "object") {
     const result = {};
     for (const [key, value] of Object.entries(data)) {
-      if (typeof value === "string" && (SENSITIVE_RE.test(key) || /sink/i.test(key))) {
-        result[key] = maskValue(value);
+      if (NOT_SECRET_KEYS.has(key.toLowerCase()) || value === PLACEHOLDER) {
+        result[key] = value;
+      } else if (key === "custom-env" && typeof value === "object" && value !== null && !Array.isArray(value)) {
+        result[key] = Object.fromEntries(Object.entries(value).map(([k, v]) => [k, v === PLACEHOLDER ? v : "****"]));
+      } else if (key === "properties" && typeof value === "object" && value !== null && !Array.isArray(value)) {
+        const props = maskSensitiveData(value);
+        if (typeof props.password === "string" && props.password !== PLACEHOLDER) props.password = "****";
+        result[key] = props;
+      } else if (typeof value === "string" && (SENSITIVE_RE.test(key) || /sink/i.test(key))) {
+        result[key] = maskValue(value, OPAQUE_RE.test(key));
       } else if (typeof value === "object" && value !== null) {
         result[key] = maskSensitiveData(value);
       } else {
@@ -532,9 +1369,9 @@ function maskQuerystring(qs) {
 // src/core/dokku.ts
 var DokkuCommandError = class extends Error {
   constructor(args, exitCode, stderr) {
-    const { masked, secrets } = maskSensitiveArgsList(args);
+    const { masked, secrets, opaque } = maskSensitiveArgsList(args);
     const maskedCmd = masked.join(" ");
-    const stderrTail = maskSecretsInText(stderr.trim(), secrets);
+    const stderrTail = maskSecretsInText(stderr.trim(), secrets, opaque);
     super(
       `dokku ${maskedCmd} failed (exit ${exitCode})` + (stderrTail ? `: ${stderrTail}` : "")
     );
@@ -574,7 +1411,7 @@ function createRunner(opts = {}) {
     dryRunLog: log,
     async run(...args) {
       if (opts.dryRun) {
-        log.push(args.map((a) => a.includes(" ") ? shellQuote(a) : a).join(" "));
+        log.push(args.map(shellQuote).join(" "));
         return;
       }
       const { ok, exitCode, stderr } = await execDokku(args);
@@ -601,7 +1438,7 @@ function createRunner(opts = {}) {
     },
     async runWithInput(input, ...args) {
       if (opts.dryRun) {
-        log.push(args.map((a) => a.includes(" ") ? shellQuote(a) : a).join(" "));
+        log.push(args.map(shellQuote).join(" "));
         return;
       }
       const { ok, exitCode, stderr } = await execDokku(args, input);
@@ -623,11 +1460,19 @@ function createContext(runner) {
   const commands = [];
   const restarts = /* @__PURE__ */ new Map();
   const rebuilds = /* @__PURE__ */ new Map();
+  const serviceRestarts = /* @__PURE__ */ new Map();
   return {
     commands,
     runner,
     restarts,
     rebuilds,
+    serviceRestarts,
+    needsServiceRestart(plugin, service, reason) {
+      const key = `${plugin}:${service}`;
+      const entry = serviceRestarts.get(key) ?? { plugin, service, reasons: [] };
+      if (!entry.reasons.includes(reason)) entry.reasons.push(reason);
+      serviceRestarts.set(key, entry);
+    },
     needsRebuild(app, reason) {
       const reasons = rebuilds.get(app) ?? [];
       if (!reasons.includes(reason)) reasons.push(reason);
@@ -724,10 +1569,10 @@ function computeAdditiveChange(before, after) {
 }
 
 // src/core/reconcile.ts
-async function reconcile(resource, ctx, target, desired, onRemovals, prune = false) {
+async function reconcile(resource, ctx, target, desired, onRemovals, prune = false, inherited) {
   const canPrune = prune && !!resource.prune && !!resource.removals;
   const pruneFrom = async (current) => {
-    const removed = resource.removals(current, desired);
+    const removed = resource.removals(current, desired, inherited);
     if (removed.length === 0) return;
     logAction(target, `${resource.key} (prune)`);
     await resource.prune(ctx, target, removed, current, desired);
@@ -752,14 +1597,14 @@ async function reconcile(resource, ctx, target, desired, onRemovals, prune = fal
       await resource.onChange(ctx, target, { before, after: desired, changed: true });
       logDone();
     }
-    if (onRemovals && resource.removals) onRemovals(resource.removals(before, desired));
+    if (onRemovals && resource.removals) onRemovals(resource.removals(before, desired, inherited));
     if (canPrune) await pruneFrom(before);
     return;
   }
-  if (onRemovals && resource.removals) onRemovals(resource.removals(before, desired));
+  if (onRemovals && resource.removals) onRemovals(resource.removals(before, desired, inherited));
   if (canPrune) {
     const change2 = resource.additive ? computeAdditiveChange(before, desired) : computeChange(before, desired);
-    const pending = resource.removals(before, desired).length > 0;
+    const pending = resource.removals(before, desired, inherited).length > 0;
     if (change2.changed) {
       await resource.onChange(ctx, target, change2, pending);
       logDone();
@@ -865,33 +1710,328 @@ var Domains = {
     await ctx.run("domains:set", target, ...after);
   }
 };
-function parseDeployMounts(raw) {
-  return raw.split(/\s+/).filter((s) => s && s !== "-v");
+
+// src/modules/volumes.ts
+var DOCKER_LOCAL = "docker-local";
+async function readEntries(ctx) {
+  const raw = await ctx.queryStrict("storage:list-entries", "--format", "json");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`storage:list-entries --format json did not return JSON: ${raw.slice(0, 80)}`);
+  }
+  if (!Array.isArray(parsed)) throw new Error("storage:list-entries --format json did not return a list");
+  const entries = /* @__PURE__ */ new Map();
+  for (const e of parsed) entries.set(e.name, e);
+  return entries;
+}
+function desiredEntry(name, cfg) {
+  if (isLegacyName(name)) return { name, legacy: true };
+  const atDefault = usesDefaultLocation(name, cfg.path);
+  return {
+    name,
+    legacy: false,
+    path: atDefault ? void 0 : cfg.path,
+    // Dokku manages owner and mode only at the default location; there an absent chown means herokuish.
+    chown: atDefault ? cfg.chown === void 0 ? DEFAULT_CHOWN : chownValue(cfg.chown) : void 0,
+    mode: cfg.mode === void 0 ? void 0 : normalizeMode(String(cfg.mode))
+  };
+}
+function desiredEntries(volumes) {
+  return Object.entries(volumes ?? {}).map(([name, cfg]) => desiredEntry(name, cfg));
+}
+function hostPathOf(d) {
+  return d.path ?? defaultPath(d.name);
+}
+function entryState(d, server) {
+  if (!server) return { kind: "missing" };
+  if (server.scheduler !== DOCKER_LOCAL) return { kind: "scheduler", scheduler: server.scheduler };
+  if (d.legacy) return { kind: "ok" };
+  const want = hostPathOf(d);
+  if ((server.host_path ?? "") !== want) return { kind: "path", server: server.host_path ?? "", want };
+  const chownMatches = d.chown === "false" ? (server.chown ?? "") === "" || server.chown === "false" : (server.chown ?? "") === d.chown;
+  const chown = d.chown !== void 0 && !chownMatches ? { server: server.chown ?? "", want: d.chown } : void 0;
+  const mode = d.mode !== void 0 && (server.mode ?? "") !== d.mode ? { server: server.mode ?? "", want: d.mode } : void 0;
+  return chown || mode ? { kind: "changed", ...chown ? { chown } : {}, ...mode ? { mode } : {} } : { kind: "ok" };
+}
+function stateError(d, state) {
+  switch (state.kind) {
+    case "scheduler":
+      return `entry '${d.name}' exists on the server with scheduler ${state.scheduler}; dokku-compose manages only docker-local entries`;
+    case "path":
+      return `entry '${d.name}' is at ${state.server || "(no path)"} on the server but the file says ${state.want}; Dokku cannot change an entry's path. Give the entry a new name in the file, or correct path`;
+    case "missing":
+      return d.legacy ? `entry '${d.name}' is not on the server; a legacy- entry is made by Dokku, never created here` : void 0;
+    default:
+      return void 0;
+  }
+}
+function createArgs(d) {
+  const args = ["storage:create", d.name];
+  if (d.path !== void 0) args.push(d.path);
+  if (d.chown !== void 0) args.push("--chown", d.chown);
+  if (d.mode !== void 0) args.push("--mode", d.mode);
+  return args;
+}
+var planned = /* @__PURE__ */ new WeakMap();
+function plannedHostPaths(ctx) {
+  return planned.get(ctx) ?? /* @__PURE__ */ new Map();
+}
+async function ensureVolumes(ctx, volumes, failFast = false) {
+  const failed = /* @__PURE__ */ new Map();
+  const server = await readEntries(ctx);
+  for (const d of desiredEntries(volumes)) {
+    logAction("volumes", `Ensuring ${d.name}`);
+    try {
+      const state = entryState(d, server.get(d.name));
+      const problem = stateError(d, state);
+      if (problem) throw new Error(problem);
+      if (state.kind === "missing") {
+        await ctx.run(...createArgs(d));
+        planned.set(ctx, new Map([...plannedHostPaths(ctx), [d.name, hostPathOf(d)]]));
+        logDone();
+      } else if (state.kind === "changed") {
+        if (state.chown) await ctx.run("storage:set", d.name, "chown", state.chown.want);
+        if (state.mode) await ctx.run("storage:set", d.name, "mode", state.mode.want);
+        logDone();
+      } else {
+        logSkip();
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.log("");
+      logError("volumes", message);
+      if (failFast) throw err;
+      failed.set(d.name, message);
+    }
+  }
+  return failed;
+}
+function sanitizeName(raw) {
+  const trim = (n2) => n2.replace(/^-+|-+$/g, "");
+  let n = trim(raw.toLowerCase().replace(/[^a-z0-9]+/g, "-"));
+  while (n.startsWith(LEGACY_PREFIX)) n = trim(n.slice(LEGACY_PREFIX.length));
+  return n.slice(0, MAX_ENTRY_NAME).replace(/-+$/, "");
+}
+function legacyExportNames(legacy, taken) {
+  const names = /* @__PURE__ */ new Map();
+  for (const e of [...legacy].sort((a, b) => a.name.localeCompare(b.name))) {
+    const parts = (e.host_path ?? "").split("/").filter(Boolean);
+    const last = parts[parts.length - 1] ?? "";
+    const two = parts.length > 1 ? `${parts[parts.length - 2]}-${last}` : "";
+    const candidates = [sanitizeName(last), sanitizeName(two)].filter((n) => n !== "" && isValidEntryName(n));
+    let chosen = candidates.find((n) => !taken.has(n)) ?? null;
+    if (chosen === null && candidates.length > 0) {
+      for (let i = 2; i < 100 && chosen === null; i++) {
+        const suffix = `-${i}`;
+        const base = candidates[0].slice(0, MAX_ENTRY_NAME - suffix.length).replace(/-+$/, "");
+        if (!taken.has(base + suffix)) chosen = base + suffix;
+      }
+    }
+    if (chosen !== null) taken.add(chosen);
+    names.set(e.name, chosen);
+  }
+  return names;
+}
+function exportedChown(stored) {
+  if (stored === void 0 || stored === "" || stored === "false") return false;
+  return /^\d+$/.test(stored) ? Number(stored) : stored;
+}
+function exportVolumes(server, mounted, onlyMounted = false) {
+  const volumes = {};
+  const names = /* @__PURE__ */ new Map();
+  const dockerLocal = [...server.values()].filter((e) => e.scheduler === DOCKER_LOCAL);
+  const describe = (name, e) => {
+    const atDefault = (e.host_path ?? "") === defaultPath(name);
+    if (!atDefault) return { path: e.host_path };
+    return { chown: exportedChown(e.chown), ...e.mode ? { mode: e.mode } : {} };
+  };
+  for (const e of dockerLocal.filter((e2) => !isLegacyName(e2.name)).sort((a, b) => a.name.localeCompare(b.name))) {
+    if (onlyMounted && !mounted.has(e.name)) continue;
+    volumes[e.name] = describe(e.name, e);
+    names.set(e.name, e.name);
+  }
+  const used = dockerLocal.filter((e) => isLegacyName(e.name) && mounted.has(e.name));
+  const given = legacyExportNames(used, new Set(server.keys()));
+  for (const e of used) {
+    const name = given.get(e.name);
+    if (name == null || pathError(e.host_path) !== void 0) {
+      volumes[e.name] = {};
+      names.set(e.name, e.name);
+      continue;
+    }
+    volumes[name] = describe(name, e);
+    names.set(e.name, name);
+  }
+  return { volumes, names };
+}
+
+// src/resources/storage.ts
+function formatSpec(s) {
+  const tokens = [];
+  if (s.readonly) tokens.push("ro");
+  if (s.phases.length !== ALL_PHASES.length) for (const p of s.phases) tokens.push(`phase=${p}`);
+  tokens.push(...s.options);
+  if (s.subpath) tokens.push(`volume-subpath=${s.subpath}`);
+  if (s.volumeChown) tokens.push(`volume-chown=${s.volumeChown}`);
+  const prefix = s.scope === DEFAULT_SCOPE ? "" : `${s.scope}=`;
+  return `${prefix}${s.entry}:${s.dir}${tokens.length ? `:${tokens.join(",")}` : ""}`;
+}
+function parseSpec(spec) {
+  let scope = DEFAULT_SCOPE;
+  let rest = spec;
+  const scoped = spec.match(/^([A-Za-z0-9_-]+)=(.*)$/s);
+  if (scoped) {
+    scope = scoped[1];
+    rest = scoped[2];
+  }
+  const first = rest.indexOf(":");
+  const entry = rest.slice(0, first);
+  const afterEntry = rest.slice(first + 1);
+  const second = afterEntry.indexOf(":");
+  const dir = second === -1 ? afterEntry : afterEntry.slice(0, second);
+  const tokens = second === -1 ? [] : afterEntry.slice(second + 1).split(",").filter(Boolean);
+  const parsed = { scope, entry, dir, readonly: false, phases: [...ALL_PHASES], options: [] };
+  const phases = [];
+  for (const t of tokens) {
+    if (t === "ro") parsed.readonly = true;
+    else if (t.startsWith("phase=")) phases.push(t.slice("phase=".length));
+    else if (t.startsWith("volume-subpath=")) parsed.subpath = t.slice("volume-subpath=".length);
+    else if (t.startsWith("volume-chown=")) parsed.volumeChown = t.slice("volume-chown=".length);
+    else parsed.options.push(t);
+  }
+  if (phases.length > 0) parsed.phases = ALL_PHASES.filter((p) => phases.includes(p));
+  return parsed;
+}
+function mountSpec(m) {
+  return formatSpec({
+    scope: m.process_type,
+    entry: m.entry,
+    dir: m.container_dir,
+    readonly: m.readonly,
+    phases: m.phases,
+    options: m.options
+  });
+}
+function desiredSpecs(storage) {
+  return storage === void 0 ? void 0 : declaredMounts(storage).map(mountSpec);
+}
+function parseAttachments(raw) {
+  let report;
+  try {
+    report = JSON.parse(raw);
+  } catch {
+    throw new Error(`storage:report --format json did not return JSON: ${raw.slice(0, 80)}`);
+  }
+  const byIndex = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(report)) {
+    const m = key.match(/^attachment\.(\d+)\.(.+)$/);
+    if (!m) continue;
+    const index = Number(m[1]);
+    byIndex.set(index, { ...byIndex.get(index), [m[2]]: String(value ?? "") });
+  }
+  return [...byIndex.entries()].sort((a, b) => a[0] - b[0]).map(([, a]) => {
+    const phases = (a["phases"] ?? "").split(",").filter((p) => p === "deploy" || p === "run");
+    return formatSpec({
+      scope: a["process-type"] || DEFAULT_SCOPE,
+      entry: a["entry-name"] ?? "",
+      dir: a["container-path"] ?? "",
+      readonly: a["readonly"] === "true",
+      phases: phases.length > 0 ? ALL_PHASES.filter((p) => phases.includes(p)) : [...ALL_PHASES],
+      options: (a["volume-options"] ?? "").split(",").filter(Boolean),
+      subpath: a["subpath"] || void 0,
+      volumeChown: a["volume-chown"] || void 0
+    });
+  });
+}
+function replaceArg(spec) {
+  const p = parseSpec(spec);
+  return formatSpec({ ...p, scope: DEFAULT_SCOPE, subpath: void 0, volumeChown: void 0 });
+}
+function byScope(specs) {
+  const scopes = /* @__PURE__ */ new Map();
+  for (const spec of specs) {
+    const scope = parseSpec(spec).scope;
+    scopes.set(scope, [...scopes.get(scope) ?? [], spec]);
+  }
+  return scopes;
+}
+var sameSet2 = (a, b) => a.length === b.length && a.every((x) => b.includes(x));
+function orderActions(actions, before) {
+  const held = /* @__PURE__ */ new Map();
+  for (const [scope, specs] of before) held.set(scope, new Set(specs.map((s) => parseSpec(s).dir)));
+  const pending = [...actions];
+  const ordered = [];
+  while (pending.length > 0) {
+    const index = pending.findIndex((a) => a.specs.every((spec) => {
+      const dir = parseSpec(spec).dir;
+      return ![...held].some(([scope, dirs]) => scope !== a.scope && scopesOverlap(scope, a.scope) && dirs.has(dir));
+    }));
+    if (index === -1) {
+      throw new Error(`cannot reorder the storage mounts: scopes ${pending.map((a) => a.scope).join(", ")} each claim a container dir another still holds. Apply the change in two runs`);
+    }
+    const [action] = pending.splice(index, 1);
+    held.set(action.scope, new Set(action.specs.map((s) => parseSpec(s).dir)));
+    ordered.push(action);
+  }
+  return ordered;
+}
+function containerView(specs, hosts) {
+  const view = /* @__PURE__ */ new Set();
+  for (const spec of specs) {
+    const s = parseSpec(spec);
+    const host = hosts?.get(s.entry)?.host_path ?? `?${s.entry}`;
+    for (const phase of s.phases) view.add([phase, s.scope, host, s.dir, s.readonly, s.options.join(",")].join("\0"));
+  }
+  return view;
+}
+async function entriesOrUndefined(ctx) {
+  try {
+    const entries = await readEntries(ctx);
+    for (const [name, host_path] of plannedHostPaths(ctx)) {
+      if (!entries.has(name)) entries.set(name, { name, scheduler: "docker-local", host_path });
+    }
+    return entries;
+  } catch {
+    return void 0;
+  }
 }
 var Storage = {
   key: "storage",
   read: async (ctx, target) => {
-    const raw = await ctx.query("storage:report", target, "--storage-deploy-mounts");
-    return parseDeployMounts(raw);
-  },
-  readAll: async (ctx) => {
-    const raw = await ctx.query("storage:report");
-    const bulk = parseBulkReport(raw, "storage");
-    const result = /* @__PURE__ */ new Map();
-    for (const [app, report] of bulk) {
-      result.set(app, report["deploy-mounts"] ? parseDeployMounts(report["deploy-mounts"]) : []);
+    let raw;
+    try {
+      raw = await ctx.queryStrict("storage:report", target, "--format", "json");
+    } catch (err) {
+      if (!await ctx.check("apps:exists", target)) return [];
+      throw err;
     }
-    return result;
+    return parseAttachments(raw);
   },
-  onChange: async (ctx, target, { added, removed }) => {
-    for (const m of removed) {
-      await ctx.run("storage:unmount", target, m);
-      ctx.needsRestart(target, "storage");
+  onChange: async (ctx, target, change) => {
+    const hostsBefore = await entriesOrUndefined(ctx);
+    const before = byScope(change.before);
+    const after = byScope(change.after);
+    const actions = [];
+    for (const scope of /* @__PURE__ */ new Set([...before.keys(), ...after.keys()])) {
+      const was = before.get(scope) ?? [];
+      const now = after.get(scope) ?? [];
+      if (!sameSet2(was, now)) actions.push({ scope, specs: now });
     }
-    for (const m of added) {
-      await ctx.run("storage:mount", target, m);
-      ctx.needsRestart(target, "storage");
+    if (change.after.length === 0) {
+      await ctx.run("storage:unmount", "--all", target);
+    } else {
+      for (const { scope, specs } of orderActions(actions, before)) {
+        if (specs.length === 0) await ctx.run("storage:unmount", "--all", target, "--process-type", scope);
+        else await ctx.run("storage:mount", "--replace", target, ...specs.map(replaceArg), ...scope === DEFAULT_SCOPE ? [] : ["--process-type", scope]);
+      }
     }
+    const hostsAfter = await entriesOrUndefined(ctx);
+    const seenBefore = containerView(change.before, hostsBefore);
+    const seenAfter = containerView(change.after, hostsAfter);
+    const same2 = seenBefore.size === seenAfter.size && [...seenBefore].every((x) => seenAfter.has(x));
+    if (!same2) ctx.needsRestart(target, "storage");
   }
 };
 
@@ -1058,7 +2198,7 @@ var Certs = {
 
 // src/core/shellwords.ts
 function shellSplit(input) {
-  const words = [];
+  const words2 = [];
   let cur = "";
   let inWord = false;
   let quote = null;
@@ -1079,7 +2219,7 @@ function shellSplit(input) {
       inWord = true;
     } else if (/\s/.test(c)) {
       if (inWord) {
-        words.push(cur);
+        words2.push(cur);
         cur = "";
         inWord = false;
       }
@@ -1089,8 +2229,8 @@ function shellSplit(input) {
     }
   }
   if (quote) return void 0;
-  if (inWord) words.push(cur);
-  return words;
+  if (inWord) words2.push(cur);
+  return words2;
 }
 function quoteShellArg(s) {
   if (s === "") return "''";
@@ -1102,9 +2242,9 @@ function quoteShellArg(s) {
 function parseBuildOptions(buildList) {
   const out = [];
   for (const raw of buildList) {
-    const words = shellSplit(raw) ?? raw.trim().split(/\s+/);
-    if (words[0] !== "--build-arg" || words.length < 2) continue;
-    const m = words.slice(1).join(" ").match(/^([^=\s]+)=?(.*)$/s);
+    const words2 = shellSplit(raw) ?? raw.trim().split(/\s+/);
+    if (words2[0] !== "--build-arg" || words2.length < 2) continue;
+    const m = words2.slice(1).join(" ").match(/^([^=\s]+)=?(.*)$/s);
     if (m) out.push({ key: m[1], value: m[2], raw });
   }
   return out;
@@ -1249,8 +2389,8 @@ var DockerOptions = {
   key: "docker_options",
   // Pruned by `up` within a declared block only, so a missing block is not shown.
   removals: (current, desired) => !desired ? [] : PHASES.flatMap((phase) => {
-    const wanted = new Set(desired?.[phase] ?? []);
-    return (current?.[phase] ?? []).filter((o) => !wanted.has(o)).map((o) => `${phase}: ${o}`);
+    const wanted2 = new Set(desired?.[phase] ?? []);
+    return (current?.[phase] ?? []).filter((o) => !wanted2.has(o)).map((o) => `${phase}: ${o}`);
   }),
   async read(ctx, target) {
     const raw = await ctx.query("docker-options:report", target);
@@ -1365,6 +2505,9 @@ var Ps = {
 // src/resources/git.ts
 var toDokku = (key) => key.replaceAll("_", "-");
 var NOT_REMOVABLE = /* @__PURE__ */ new Set(["deploy_branch", "source_image", "rev_env_var"]);
+function isCopiedDeployBranch(current, inherited) {
+  return inherited?.deploy_branch !== void 0 && current.deploy_branch === String(inherited.deploy_branch);
+}
 function fromReport(report) {
   const config = {};
   if (report["deploy-branch"]) config.deploy_branch = report["deploy-branch"];
@@ -1376,7 +2519,12 @@ function fromReport(report) {
 var Git = {
   key: "git",
   additive: true,
-  removals: (current, desired) => Object.keys(current ?? {}).filter((k) => !NOT_REMOVABLE.has(k) && !(desired && k in desired)),
+  inheritsGlobal: true,
+  removals: (current, desired, inherited) => Object.keys(current ?? {}).filter((k) => {
+    if (desired && k in desired) return false;
+    if (k === "deploy_branch") return isCopiedDeployBranch(current, inherited);
+    return !NOT_REMOVABLE.has(k);
+  }),
   prune: async (ctx, target, removed) => {
     for (const key of removed) await ctx.run("git:set", target, toDokku(key));
   },
@@ -1515,29 +2663,38 @@ var NetworkProps = {
     }
     return result;
   },
-  onChange: async (ctx, target, { after }) => {
-    if (after.attach_post_create !== void 0 && after.attach_post_create !== false) {
-      const nets = Array.isArray(after.attach_post_create) ? after.attach_post_create : [after.attach_post_create];
-      await ctx.run("network:set", target, "attach-post-create", ...nets);
-      ctx.needsRebuild(target, "network");
-    }
-    if (after.initial_network !== void 0 && after.initial_network !== false) {
-      await ctx.run("network:set", target, "initial-network", after.initial_network);
-      ctx.needsRebuild(target, "network");
-    }
-    if (after.bind_all_interfaces !== void 0) {
-      await ctx.run("network:set", target, "bind-all-interfaces", String(after.bind_all_interfaces));
-      ctx.needsRestart(target, "network");
-    }
-    if (after.static_web_listener !== void 0 && after.static_web_listener !== false) {
-      await ctx.run("network:set", target, "static-web-listener", after.static_web_listener);
-    }
-    if (after.tld !== void 0 && after.tld !== false) {
-      await ctx.run("network:set", target, "tld", after.tld);
-      ctx.needsRestart(target, "network");
+  // `false` clears a property, so it is in sync when the server has no value; a
+  // declared value must match what the server reports.
+  inSync: (current, desired) => Object.keys(desired).every((k) => propInSync(current, desired, k)),
+  onChange: async (ctx, target, { before, after }) => {
+    const todo = (k) => after[k] !== void 0 && !propInSync(before, after, k);
+    for (const [key, restart] of [
+      ["attach_post_create", false],
+      ["initial_network", false],
+      ["bind_all_interfaces", true],
+      ["static_web_listener", null],
+      ["tld", true]
+    ]) {
+      if (!todo(key)) continue;
+      const value = after[key];
+      const args = value === false && key !== "bind_all_interfaces" ? [] : Array.isArray(value) ? value : [String(value)];
+      await ctx.run("network:set", target, key.replaceAll("_", "-"), ...args);
+      if (restart === false) ctx.needsRebuild(target, "network");
+      else if (restart) ctx.needsRestart(target, "network");
     }
   }
 };
+function propInSync(current, desired, key) {
+  const want = desired[key];
+  const have = current?.[key];
+  if (want === void 0) return true;
+  if (key === "bind_all_interfaces") return want === true === (have === true);
+  if (want === false) return have === void 0;
+  if (have === void 0 || have === false) return false;
+  const w = Array.isArray(want) ? want : [want];
+  const h = Array.isArray(have) ? have : [have];
+  return w.length === h.length && w.every((v) => h.includes(v));
+}
 
 // src/modules/plugins.ts
 function parsePluginList(raw) {
@@ -1704,7 +2861,6 @@ async function exportNetworks(ctx) {
 }
 
 // src/modules/service-drift.ts
-import { createHash as createHash2 } from "crypto";
 var infoReads = /* @__PURE__ */ new WeakMap();
 function readServiceInfo(ctx, plugin, name) {
   let reads = infoReads.get(ctx);
@@ -1721,6 +2877,9 @@ function readServiceInfo(ctx, plugin, name) {
   }
   return read;
 }
+function forgetServiceInfo(ctx, plugin, name) {
+  infoReads.get(ctx)?.delete(`${plugin}\0${name}`);
+}
 async function fetchServiceInfo(ctx, plugin, name) {
   const raw = await ctx.queryStrict(`${plugin}:info`, name, "--format", "json");
   try {
@@ -1745,18 +2904,514 @@ async function readServiceMismatches(ctx, plugin, name, declared) {
   if (declared.version === void 0 && declared.image === void 0) return [];
   return versionMismatches(await readServiceInfo(ctx, plugin, name), declared);
 }
+
+// src/modules/service-properties.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/modules/service-mounts.ts
+async function entryHostPaths(ctx, volumes, names) {
+  const paths = /* @__PURE__ */ new Map();
+  let server;
+  for (const name of names) {
+    const declared = volumes?.[name];
+    if (declared === void 0) throw new Error(`entry '${name}' is not declared under volumes:`);
+    if (isLegacyName(name)) {
+      server ??= await readEntries(ctx);
+      const hostPath = server.get(name)?.host_path;
+      if (!hostPath) throw new Error(`entry '${name}' is not on the server, so its host path is unknown`);
+      paths.set(name, hostPath);
+    } else {
+      paths.set(name, declared.path ?? defaultPath(name));
+    }
+  }
+  return paths;
+}
+async function resolveServiceMounts(ctx, volumes, mounts, failedEntries) {
+  if (mounts === void 0) return void 0;
+  const declared = declaredServiceMounts(mounts);
+  for (const m of declared) {
+    const reason = failedEntries?.get(m.entry);
+    if (reason !== void 0) throw new Error(`entry '${m.entry}' failed: ${reason}`);
+  }
+  const paths = await entryHostPaths(ctx, volumes, [...new Set(declared.map((m) => m.entry))]);
+  return declared.map((m) => {
+    const tokens = [...m.readonly ? ["ro"] : [], ...m.options];
+    return `${paths.get(m.entry)}:${m.container_dir}${tokens.length ? `:${tokens.join(",")}` : ""}`;
+  });
+}
+
+// src/modules/links.ts
+function normalizeLink(entry) {
+  return typeof entry === "string" ? { service: entry } : entry;
+}
+function resolveServicePlugin(name, config) {
+  if (config.postgres?.[name]) return { plugin: "postgres", config: config.postgres[name] };
+  if (config.redis?.[name]) return { plugin: "redis", config: config.redis[name] };
+  return void 0;
+}
+function allServices(config) {
+  const entries = [];
+  for (const name of Object.keys(config.postgres ?? {})) entries.push([name, "postgres"]);
+  for (const name of Object.keys(config.redis ?? {})) entries.push([name, "redis"]);
+  return entries;
+}
+var DEFAULT_ENV_VAR = { postgres: "DATABASE_URL", redis: "REDIS_URL" };
+function linkEnvVar(plugin, link) {
+  if (link.env_var) return link.env_var;
+  if (link.alias) return `${link.alias}_URL`;
+  return DEFAULT_ENV_VAR[plugin] ?? `${plugin.toUpperCase()}_URL`;
+}
+function linkFlags(link) {
+  const flags = [];
+  if (link.alias) flags.push("--alias", link.alias);
+  if (link.env_var) flags.push("--env-var", link.env_var);
+  if (link.querystring) flags.push("--querystring", link.querystring);
+  return flags;
+}
+function readEnv(ctx, app, cache) {
+  let read = cache?.get(app);
+  if (!read) {
+    read = ctx.queryStrict("config:export", "--format", "json", app).then((out) => JSON.parse(out));
+    cache?.set(app, read);
+  }
+  return read;
+}
+function findLinkVariables(env, plugin, service) {
+  const host = `dokku-${plugin}-${service}`;
+  const found = [];
+  for (const [name, value] of Object.entries(env)) {
+    if (typeof value !== "string") continue;
+    const m = value.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/?]*@)?([^:/?]+)/i);
+    if (m && m[1] === host) found.push({ name, value });
+  }
+  return found;
+}
+function isFallbackName(plugin, name) {
+  return new RegExp(`^DOKKU_${plugin.toUpperCase()}_[A-Z]+_URL$`).test(name);
+}
+function querystringOf(url) {
+  const q = url.indexOf("?");
+  return q === -1 ? "" : url.slice(q + 1);
+}
+function show(name, qs) {
+  return qs ? `${name}?${maskQuerystring(qs)}` : name;
+}
+async function readLinkOptions(ctx, app, plugin, link, cache) {
+  let env;
+  try {
+    env = await readEnv(ctx, app, cache);
+  } catch (err) {
+    return { state: "unreadable", reason: err instanceof Error ? err.message : String(err) };
+  }
+  const found = findLinkVariables(env, plugin, link.service);
+  if (found.length === 0) {
+    return { state: "unreadable", reason: `no variable of '${app}' points at ${link.service}` };
+  }
+  const name = linkEnvVar(plugin, link);
+  const desired = link.querystring ?? "";
+  const plain = !link.alias && !link.env_var;
+  const hit = found.find((v) => v.name === name) ?? (plain ? found.find((v) => isFallbackName(plugin, v.name)) : void 0);
+  if (!hit) return { state: "differs", current: show(found[0].name, querystringOf(found[0].value)), desired: show(name, desired) };
+  const current = querystringOf(hit.value);
+  if (current === desired) return { state: "same" };
+  return { state: "differs", current: show(name, current), desired: show(name, desired) };
+}
+async function readServiceLinks(ctx, app, desiredLinks, config) {
+  const desired = new Map(desiredLinks.map(normalizeLink).map((l) => [l.service, l]));
+  const states = [];
+  for (const [service, plugin] of allServices(config)) {
+    states.push({ service, plugin, link: desired.get(service), isLinked: await ctx.check(`${plugin}:linked`, service, app) });
+  }
+  return states;
+}
+function servicesToUnlink(states) {
+  return states.filter((s) => !s.link && s.isLinked);
+}
+async function ensureAppLinks(ctx, app, desiredLinks, config) {
+  const states = await readServiceLinks(ctx, app, desiredLinks, config);
+  const unlink = new Set(servicesToUnlink(states));
+  for (const state of states) {
+    const { service: serviceName, plugin, link, isLinked } = state;
+    if (link && !isLinked) {
+      logAction(app, `Linking ${serviceName}`);
+      await ctx.run(`${plugin}:link`, serviceName, app, "--no-restart", ...linkFlags(link));
+      ctx.needsRestart(app, "links");
+      logDone();
+    } else if (link && isLinked) {
+      const opts = await readLinkOptions(ctx, app, plugin, link);
+      if (opts.state === "differs") {
+        logAction(app, `Relinking ${serviceName}`);
+        await ctx.run(`${plugin}:unlink`, serviceName, app, "--no-restart");
+        try {
+          await ctx.run(`${plugin}:link`, serviceName, app, "--no-restart", ...linkFlags(link));
+        } catch (err) {
+          logWarn(app, `${app} is now unlinked from ${serviceName}`);
+          throw err;
+        }
+        ctx.needsRestart(app, "links");
+        logDone();
+      }
+    } else if (unlink.has(state)) {
+      logAction(app, `Unlinking ${serviceName}`);
+      await ctx.run(`${plugin}:unlink`, serviceName, app, "--no-restart");
+      ctx.needsRestart(app, "links");
+      logDone();
+    }
+  }
+}
+async function destroyAppLinks(ctx, app, links, config) {
+  for (const serviceName of links.map((l) => normalizeLink(l).service)) {
+    const resolved = resolveServicePlugin(serviceName, config);
+    if (!resolved) continue;
+    const isLinked = await ctx.check(`${resolved.plugin}:linked`, serviceName, app);
+    if (isLinked) {
+      await ctx.run(`${resolved.plugin}:unlink`, serviceName, app, "--no-restart");
+    }
+  }
+}
+async function exportAppLinks(ctx, app, config) {
+  const linked = [];
+  for (const [serviceName, plugin] of allServices(config)) {
+    if (!await ctx.check(`${plugin}:linked`, serviceName, app)) continue;
+    let found = [];
+    try {
+      found = findLinkVariables(await readEnv(ctx, app), plugin, serviceName);
+    } catch {
+    }
+    const fallback = linkEnvVar(plugin, { service: serviceName });
+    const v = found.find((f) => f.name === fallback) ?? found.find((f) => isFallbackName(plugin, f.name)) ?? found[0];
+    if (!v) {
+      linked.push(serviceName);
+      continue;
+    }
+    const querystring = querystringOf(v.value);
+    if ((v.name === fallback || isFallbackName(plugin, v.name)) && !querystring) {
+      linked.push(serviceName);
+      continue;
+    }
+    const entry = { service: serviceName };
+    if (v.name !== fallback && !isFallbackName(plugin, v.name)) {
+      if (v.name.endsWith("_URL") && v.name.length > 4) entry.alias = v.name.slice(0, -4);
+      else entry.env_var = v.name;
+    }
+    if (querystring) entry.querystring = querystring;
+    linked.push(entry);
+  }
+  return linked;
+}
+
+// src/modules/service-properties.ts
+function createArgs2(declared, mounts) {
+  const args = [];
+  for (const [key, value] of declaredEntries(declared.properties)) {
+    const spec = MANAGED_PROPERTIES[key];
+    if (!spec) continue;
+    if (spec.repeat) for (const pair of value.split(" ")) args.push(`--${spec.createFlag}`, pair);
+    else args.push(`--${spec.createFlag}`, value);
+  }
+  for (const mount of mounts ?? []) args.push("--volume", mount);
+  return args;
+}
+var sha256 = (v) => createHash2("sha256").update(v).digest("hex");
+function declaredEntries(properties) {
+  return Object.entries(properties ?? {}).map(([key, value]) => [key, propertyString(key, value)]);
+}
+function propertyChanges(plugin, info, properties, prune) {
+  const changes = [];
+  const declared = /* @__PURE__ */ new Set();
+  for (const [key, desired] of declaredEntries(properties)) {
+    declared.add(key);
+    const spec = MANAGED_PROPERTIES[key];
+    if (spec?.kind === "secret") {
+      if (!(`${key}-fingerprint` in info)) throw new Error(`dokku-${plugin} too old to report the ${key} fingerprint`);
+      if (field(info, `${key}-fingerprint`) !== sha256(desired)) {
+        changes.push({ key, value: desired, noRestart: true, restart: false, password: true });
+      }
+      continue;
+    }
+    if (!sameProperty(key, desired, field(info, key))) {
+      changes.push({ key, value: desired, restart: spec?.restart ?? false, password: false });
+    }
+  }
+  if (prune) {
+    for (const key of PRUNABLE_PROPERTIES) {
+      if (declared.has(key) || isDefaultProperty(key, field(info, key))) continue;
+      changes.push({ key, restart: MANAGED_PROPERTIES[key].restart, password: false });
+    }
+  }
+  return changes;
+}
+function serverMounts(plugin, info) {
+  if (!("mounts" in info)) throw new Error(`dokku-${plugin} too old to report mounts`);
+  return parseInfoMounts(field(info, "mounts"));
+}
+function mountCommand(plugin, name, info, mounts) {
+  if (mounts === void 0) return void 0;
+  const desired = mountSet(mounts);
+  const current = serverMounts(plugin, info);
+  if (desired.join(" ") === current.join(" ")) return void 0;
+  if (desired.length === 0) return [`${plugin}:unmount`, "--all", name];
+  return [`${plugin}:mount`, "--replace", name, ...new Set(mounts)];
+}
+function mountMismatches(plugin, info, mounts) {
+  if (mounts === void 0) return [];
+  const desired = mountSet(mounts);
+  const current = serverMounts(plugin, info);
+  return desired.join(" ") === current.join(" ") ? [] : [{ field: "mounts", desired: desired.join(" ") || "(none)", current: current.join(" ") || "(none)" }];
+}
+function linkedApps(info, name, config, dryRun = false) {
+  const apps = new Set(field(info, "links").split(/[\s,]+/).filter((a) => a !== ""));
+  if (dryRun) {
+    for (const [app, appConfig] of Object.entries(config.apps)) {
+      if ((appConfig.links ?? []).some((l) => normalizeLink(l).service === name)) apps.add(app);
+    }
+  }
+  return [...apps];
+}
+function setArgs(plugin, name, change) {
+  return [
+    `${plugin}:set`,
+    ...change.noRestart ? ["--no-restart"] : [],
+    name,
+    change.key,
+    ...change.value === void 0 ? [] : ["--", change.value]
+  ];
+}
+async function ensureServiceProperties(ctx, plugin, services, config, opts = {}) {
+  const failures = [];
+  for (const [name, declared] of Object.entries(services)) {
+    if (declared.properties === void 0 && declared.mounts === void 0 && !opts.prune) continue;
+    if (opts.dryRunCreated?.has(name)) {
+      for (const [key, value] of declaredEntries(declared.properties)) {
+        if (!MANAGED_PROPERTIES[key]) await ctx.run(`${plugin}:set`, name, key, "--", value);
+      }
+      continue;
+    }
+    try {
+      const info = await readServiceInfo(ctx, plugin, name);
+      const mountSpecs = await resolveServiceMounts(ctx, config.volumes, declared.mounts, opts.failedVolumes);
+      const changes = propertyChanges(plugin, info, declared.properties, opts.prune ?? false);
+      const mount = mountCommand(plugin, name, info, mountSpecs);
+      logAction("services", `Configuring properties for ${name}`);
+      if (changes.length === 0 && !mount) {
+        logSkip();
+        continue;
+      }
+      for (const change of changes) {
+        await ctx.run(...setArgs(plugin, name, change));
+        forgetServiceInfo(ctx, plugin, name);
+        if (change.restart) ctx.needsServiceRestart(plugin, name, change.key);
+        if (change.password) for (const app of linkedApps(info, name, config, opts.dryRun)) ctx.needsRestart(app, `${name} ${change.key} changed`);
+      }
+      if (mount) {
+        await ctx.run(...mount);
+        forgetServiceInfo(ctx, plugin, name);
+        ctx.needsServiceRestart(plugin, name, "mounts");
+      }
+      logDone();
+    } catch (error) {
+      console.log("");
+      logError(name, error instanceof Error ? error.message : String(error));
+      failures.push({ service: name, error });
+    }
+  }
+  return failures;
+}
+function propertyMismatches(plugin, info, properties) {
+  const out = [];
+  const declared = /* @__PURE__ */ new Set();
+  for (const [key, desired] of declaredEntries(properties)) {
+    declared.add(key);
+    const spec = MANAGED_PROPERTIES[key];
+    if (spec?.kind === "secret") {
+      if (!(`${key}-fingerprint` in info)) throw new Error(`dokku-${plugin} too old to report the ${key} fingerprint`);
+      const stored = field(info, `${key}-fingerprint`);
+      if (stored !== sha256(desired)) {
+        out.push({ field: `properties.${key}`, desired: `the ${key} from the file`, current: stored === "" ? `no ${key}` : `another ${key}` });
+      }
+      continue;
+    }
+    const current = field(info, key);
+    if (!sameProperty(key, desired, current)) out.push({ field: `properties.${key}`, desired, current });
+  }
+  for (const key of PRUNABLE_PROPERTIES) {
+    const current = field(info, key);
+    if (declared.has(key) || isDefaultProperty(key, current)) continue;
+    out.push({ field: `properties.${key}`, desired: "(not in the file)", current, removed: true });
+  }
+  return out;
+}
+async function exportServiceProperties(ctx, plugin, name) {
+  let info;
+  try {
+    info = await readServiceInfo(ctx, plugin, name);
+  } catch {
+    return {};
+  }
+  const properties = {};
+  for (const key of PRUNABLE_PROPERTIES) {
+    const current = field(info, key);
+    if (isDefaultProperty(key, current)) continue;
+    switch (MANAGED_PROPERTIES[key].kind) {
+      case "list":
+        properties[key] = current.split(",").filter((v) => v !== "");
+        break;
+      case "map":
+        properties[key] = Object.fromEntries(current.split(";").filter((v) => v !== "").map((p) => [p.split("=")[0], EXPORT_PLACEHOLDER]));
+        break;
+      case "number":
+        properties[key] = Number(current);
+        break;
+      case "targets":
+        properties[key] = Object.fromEntries(targetPairs(current));
+        break;
+      default:
+        properties[key] = current;
+    }
+  }
+  const mounts = "mounts" in info ? parseInfoMounts(field(info, "mounts")) : [];
+  return {
+    ...Object.keys(properties).length > 0 ? { properties } : {},
+    ...mounts.length > 0 ? { mountSpecs: mounts } : {}
+  };
+}
+
+// src/modules/service-backup.ts
+import { createHash as createHash3 } from "crypto";
 function backupAuthFingerprint(accessKeyId, secretAccessKey) {
   const firstLine = (v) => v.trim().split("\n")[0].trim();
-  return createHash2("sha256").update(`${firstLine(accessKeyId)}
+  return createHash3("sha256").update(`${firstLine(accessKeyId)}
 ${firstLine(secretAccessKey)}`).digest("hex");
 }
+var sha2562 = (v) => createHash3("sha256").update(v).digest("hex");
+var SETTINGS = [
+  { key: "storage_class", property: "backup-storage-class" },
+  { key: "object_name", property: "backup-object-name" },
+  { key: "mailto", property: "backup-mailto" }
+];
+function otherScheduleIds(info) {
+  const raw = info["backup-schedules"];
+  const ids = Array.isArray(raw) ? raw.map((r) => String(r?.id ?? "")) : String(raw ?? "").split(";").map((r) => r.split("|")[0]);
+  return ids.filter((id) => id !== "" && id !== "default");
+}
+var passphraseStored = (info) => field(info, "backup-encryption-fingerprint") !== "";
+var publicKeyStored = (info) => field(info, "backup-public-key-id") !== "";
+var encryptionStored = (info) => passphraseStored(info) || publicKeyStored(info) || field(info, "backup-keyserver") !== "";
+function settingsStored(info) {
+  const out = SETTINGS.filter((s) => field(info, s.property) !== "").map((s) => s.key);
+  if (field(info, "backup-timestamp") === "false") out.push("timestamp");
+  return out;
+}
 function hasBackup(info) {
-  return field(info, "backup-schedule") !== "" || field(info, "backup-authenticated") === "true";
+  return field(info, "backup-schedule") !== "" || field(info, "backup-authenticated") === "true" || encryptionStored(info) || settingsStored(info).length > 0;
+}
+function describeServerBackup(info) {
+  const schedule = field(info, "backup-schedule");
+  const parts = [];
+  if (schedule) parts.push(`scheduled ${schedule} to ${field(info, "backup-bucket")}`);
+  if (field(info, "backup-authenticated") === "true") parts.push("credentials stored");
+  if (encryptionStored(info)) parts.push("encrypted");
+  const settings = settingsStored(info);
+  if (settings.length > 0) parts.push(`with ${settings.join(", ")} set`);
+  return parts.join(", ") || "none";
+}
+function declaresNewerKeys(backup) {
+  return backup.encryption !== void 0 || backup.timestamp !== void 0 || SETTINGS.some((s) => backup[s.key] !== void 0);
+}
+function assertReportsBackup(plugin, info, backup) {
+  const needed = ["backup-auth-fingerprint"];
+  if (backup !== false && declaresNewerKeys(backup)) needed.push("backup-timestamp", "backup-mailto");
+  if (needed.some((key) => !(key in info))) throw new Error(`dokku-${plugin} too old to report backup state (needs 2.3.1+)`);
+}
+function encryptionMismatch(info, enc) {
+  const fingerprint = field(info, "backup-encryption-fingerprint");
+  const keyId = field(info, "backup-public-key-id");
+  const keyserver = field(info, "backup-keyserver");
+  const stored = [];
+  if (enc === false) {
+    if (passphraseStored(info)) stored.push("a passphrase");
+    if (keyId !== "") stored.push(`public key ${keyId}`);
+    if (keyserver !== "") stored.push(`keyserver ${keyserver}`);
+    return stored.length ? { field: "backup.encryption", desired: "none", current: stored.join(", ") } : void 0;
+  }
+  if (enc.passphrase !== void 0) {
+    if (fingerprint !== sha2562(enc.passphrase)) stored.push(fingerprint === "" ? "no passphrase" : "a different passphrase");
+    if (keyId !== "") stored.push(`public key ${keyId}`);
+    if (keyserver !== "") stored.push(`keyserver ${keyserver}`);
+    return stored.length ? { field: "backup.encryption", desired: "passphrase", current: stored.join(", ") } : void 0;
+  }
+  if (keyId !== enc.public_key_id) stored.push(keyId === "" ? "no public key" : `public key ${keyId}`);
+  if (keyserver !== (enc.keyserver ?? "")) stored.push(`keyserver ${keyserver || "none"}`);
+  if (passphraseStored(info)) stored.push("a passphrase");
+  return stored.length ? {
+    field: "backup.encryption",
+    desired: `public key ${enc.public_key_id}${enc.keyserver ? ` on ${enc.keyserver}` : ""}`,
+    current: stored.join(", ")
+  } : void 0;
+}
+function encryptionCommands(plugin, name, info, enc) {
+  const set = (property, value) => [`${plugin}:set`, name, property, ...value === void 0 ? [] : [value]];
+  const cmds = [];
+  const clearPassphrase = () => {
+    if (passphraseStored(info)) cmds.push(set("backup-encryption-passphrase"));
+  };
+  const clearKeyId = () => {
+    if (publicKeyStored(info)) cmds.push(set("backup-public-key-id"));
+  };
+  const clearKeyserver = () => {
+    if (field(info, "backup-keyserver") !== "") cmds.push(set("backup-keyserver"));
+  };
+  if (enc === false) {
+    clearPassphrase();
+    clearKeyId();
+    clearKeyserver();
+  } else if (enc.passphrase !== void 0) {
+    if (field(info, "backup-encryption-fingerprint") !== sha2562(enc.passphrase)) cmds.push(set("backup-encryption-passphrase", enc.passphrase));
+    clearKeyId();
+    clearKeyserver();
+  } else {
+    if (field(info, "backup-keyserver") !== (enc.keyserver ?? "")) cmds.push(set("backup-keyserver", enc.keyserver));
+    if (field(info, "backup-public-key-id") !== enc.public_key_id) cmds.push(set("backup-public-key-id", enc.public_key_id));
+    clearPassphrase();
+  }
+  return cmds;
 }
-function backupMismatches(info, backup) {
-  for (const key of ["backup-authenticated", "backup-auth-fingerprint", "backup-schedule"]) {
-    if (!(key in info)) throw new Error("dokku-postgres too old to report backup state (needs 2.3.1+)");
+function settingMismatches(info, backup) {
+  const out = [];
+  for (const { key, property } of SETTINGS) {
+    const desired = backup[key];
+    if (desired !== void 0 && desired !== field(info, property)) out.push({ field: `backup.${key}`, desired, current: field(info, property) });
+  }
+  if (backup.timestamp === false && field(info, "backup-timestamp") !== "false") {
+    out.push({ field: "backup.timestamp", desired: "false", current: field(info, "backup-timestamp") || "true" });
+  }
+  return out;
+}
+function settingCommands(plugin, name, info, backup) {
+  const cmds = [];
+  for (const { key, property } of SETTINGS) {
+    const desired = backup[key];
+    if (desired !== void 0 && desired !== field(info, property)) cmds.push([`${plugin}:set`, name, property, desired]);
+  }
+  if (backup.timestamp === false && field(info, "backup-timestamp") !== "false") cmds.push([`${plugin}:set`, name, "backup-timestamp", "false"]);
+  return cmds;
+}
+function pruneCommands(plugin, name, info, backup) {
+  const cmds = [];
+  for (const { key, property } of SETTINGS) {
+    if (backup[key] === void 0 && field(info, property) !== "") cmds.push([`${plugin}:set`, name, property]);
   }
+  if (backup.timestamp === void 0 && field(info, "backup-timestamp") === "false") cmds.push([`${plugin}:set`, name, "backup-timestamp"]);
+  return cmds;
+}
+function clearAllCommands(plugin, name, info) {
+  const cmds = encryptionCommands(plugin, name, info, false);
+  for (const { property } of SETTINGS) if (field(info, property) !== "") cmds.push([`${plugin}:set`, name, property]);
+  if (field(info, "backup-timestamp") === "false") cmds.push([`${plugin}:set`, name, "backup-timestamp"]);
+  return cmds;
+}
+function backupMismatches(plugin, info, backup) {
+  assertReportsBackup(plugin, info, backup);
   if (backup === false) {
     return hasBackup(info) ? [{ field: "backup", desired: "none", current: describeServerBackup(info) }] : [];
   }
@@ -1782,14 +3437,167 @@ function backupMismatches(info, backup) {
   if (field(info, "backup-bucket") !== backup.bucket) {
     out.push({ field: "backup.bucket", desired: backup.bucket, current: field(info, "backup-bucket") });
   }
+  if (backup.encryption !== void 0) {
+    const m = encryptionMismatch(info, backup.encryption);
+    if (m) out.push(m);
+  }
+  out.push(...settingMismatches(info, backup));
   return out;
 }
-function describeServerBackup(info) {
+function backupNotes(info, backup) {
+  const notes = [];
+  if (backup === void 0) {
+    if (hasBackup(info)) notes.push(`backup on the server is not in the file (${describeServerBackup(info)}); up leaves it, backup: false removes it`);
+  } else if (backup !== false) {
+    if (backup.encryption === void 0 && encryptionStored(info)) {
+      notes.push("backup encryption on the server is not in the file; up leaves it, encryption: false removes it");
+    }
+    const extra = [
+      ...SETTINGS.filter((s) => backup[s.key] === void 0 && field(info, s.property) !== "").map((s) => s.key),
+      ...backup.timestamp === void 0 && field(info, "backup-timestamp") === "false" ? ["timestamp"] : []
+    ];
+    if (extra.length > 0) notes.push(`backup ${extra.join(", ")} on the server ${extra.length === 1 ? "is" : "are"} not in the file; up leaves ${extra.length === 1 ? "it" : "them"}, up --prune clears ${extra.length === 1 ? "it" : "them"}`);
+  }
+  const others = otherScheduleIds(info);
+  if (others.length > 0) notes.push(`other backup schedules (${others.join(", ")}) are not managed; up never touches them`);
+  return notes;
+}
+async function ensureServiceBackups(ctx, plugin, services, opts = {}) {
+  for (const [name, config] of Object.entries(services)) {
+    const backup = config.backup;
+    if (backup === void 0 && !opts.prune) continue;
+    if (backup === void 0) {
+      let info2;
+      try {
+        info2 = await readServiceInfo(ctx, plugin, name);
+      } catch (err) {
+        logWarn("services", `could not read backup state for ${name}: ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+      }
+      if (hasBackup(info2)) {
+        logWarn("services", `${name}: has a backup the file does not declare (${describeServerBackup(info2)}); --prune leaves it, set backup: false to remove it`);
+      }
+      continue;
+    }
+    if (opts.dryRunCreated?.has(name)) {
+      logAction("services", `Configuring backup for ${name}`);
+      if (backup !== false) {
+        const { schedule: schedule2, bucket: bucket2, auth: auth2 } = backup;
+        await ctx.run(
+          `${plugin}:backup-auth`,
+          name,
+          auth2.access_key_id,
+          auth2.secret_access_key,
+          auth2.region,
+          auth2.signature_version,
+          auth2.endpoint
+        );
+        await ctx.run(`${plugin}:backup-schedule`, name, schedule2, bucket2);
+        const nothing = {};
+        const cmds2 = [
+          ...backup.encryption !== void 0 ? encryptionCommands(plugin, name, nothing, backup.encryption) : [],
+          ...settingCommands(plugin, name, nothing, backup)
+        ];
+        for (const cmd of cmds2) await ctx.run(...cmd);
+      }
+      logDone();
+      continue;
+    }
+    const info = await readServiceInfo(ctx, plugin, name);
+    logAction("services", `Configuring backup for ${name}`);
+    const fields = new Set(backupMismatches(plugin, info, backup).map((m) => m.field));
+    const prune = opts.prune && backup !== false ? pruneCommands(plugin, name, info, backup) : [];
+    if (opts.prune && backup !== false && backup.encryption === void 0 && encryptionStored(info)) {
+      logWarn("services", `${name}: has backup encryption the file does not declare; --prune leaves it, set encryption: false to remove it`);
+    }
+    if (fields.size === 0 && prune.length === 0) {
+      logSkip();
+      continue;
+    }
+    if (backup === false) {
+      if (field(info, "backup-schedule") !== "") await ctx.run(`${plugin}:backup-unschedule`, name, "--id", "default");
+      if (field(info, "backup-authenticated") === "true") await ctx.run(`${plugin}:backup-deauth`, name);
+      for (const cmd of clearAllCommands(plugin, name, info)) await ctx.run(...cmd);
+      logDone();
+      continue;
+    }
+    const { schedule, bucket, auth } = backup;
+    if (fields.has("backup.auth")) {
+      await ctx.run(
+        `${plugin}:backup-auth`,
+        name,
+        auth.access_key_id,
+        auth.secret_access_key,
+        auth.region,
+        auth.signature_version,
+        auth.endpoint
+      );
+    }
+    if (fields.has("backup.schedule")) {
+      await ctx.run(`${plugin}:backup-schedule`, name, schedule, bucket);
+      if (!opts.dryRun) {
+        const cronOutput = await ctx.query(`${plugin}:backup-schedule-cat`, name);
+        if (!parseBackupSchedule(cronOutput)) {
+          throw new Error(`Backup schedule for ${name} was not installed after backup-schedule ran`);
+        }
+      }
+    } else if (fields.has("backup.bucket")) {
+      if (otherScheduleIds(info).length > 0) await ctx.run(`${plugin}:backup-schedule`, name, schedule, bucket);
+      else await ctx.run(`${plugin}:set`, name, "backup-bucket", bucket);
+    }
+    const cmds = [
+      ...backup.encryption !== void 0 ? encryptionCommands(plugin, name, info, backup.encryption) : [],
+      ...settingCommands(plugin, name, info, backup),
+      ...prune
+    ];
+    for (const cmd of cmds) await ctx.run(...cmd);
+    logDone();
+  }
+}
+function parseBackupSchedule(cronLine) {
+  const parts = cronLine.trim().split(/\s+/);
+  if (parts.length < 8) return null;
+  const schedule = parts.slice(0, 5).join(" ");
+  const bucket = parts[parts.length - 1];
+  return { schedule, bucket };
+}
+async function exportServiceBackup(ctx, plugin, name) {
+  let info;
+  try {
+    info = await readServiceInfo(ctx, plugin, name);
+  } catch (err) {
+    logWarn(name, `could not read the backup of ${plugin} service '${name}', left out of the export: ${err instanceof Error ? err.message : String(err)}`);
+    return void 0;
+  }
   const schedule = field(info, "backup-schedule");
-  const parts = [];
-  if (schedule) parts.push(`scheduled ${schedule} to ${field(info, "backup-bucket")}`);
-  if (field(info, "backup-authenticated") === "true") parts.push("credentials stored");
-  return parts.join(", ") || "none";
+  if (schedule === "") {
+    if (hasBackup(info)) {
+      logWarn(name, `${plugin} service '${name}' has backup ${describeServerBackup(info)} but no default schedule; its backup is left out of the export`);
+    }
+    return void 0;
+  }
+  const out = {
+    schedule,
+    bucket: field(info, "backup-bucket"),
+    auth: {
+      access_key_id: EXPORT_PLACEHOLDER,
+      secret_access_key: EXPORT_PLACEHOLDER,
+      region: EXPORT_PLACEHOLDER,
+      signature_version: EXPORT_PLACEHOLDER,
+      endpoint: EXPORT_PLACEHOLDER
+    }
+  };
+  if (publicKeyStored(info)) {
+    out.encryption = { public_key_id: field(info, "backup-public-key-id") };
+    if (field(info, "backup-keyserver") !== "") out.encryption.keyserver = field(info, "backup-keyserver");
+  } else if (passphraseStored(info)) {
+    out.encryption = { passphrase: EXPORT_PLACEHOLDER };
+  }
+  for (const { key, property } of SETTINGS) {
+    if (field(info, property) !== "") out[key] = field(info, property);
+  }
+  if (field(info, "backup-timestamp") === "false") out.timestamp = false;
+  return out;
 }
 
 // src/modules/config.ts
@@ -1836,7 +3644,7 @@ async function readGlobalEnvDrift(ctx, env, current) {
 }
 
 // src/modules/postgres.ts
-async function ensurePostgres(ctx, services) {
+async function ensurePostgres(ctx, services, volumes, opts = {}) {
   const created = /* @__PURE__ */ new Set();
   for (const [name, config] of Object.entries(services)) {
     logAction("services", `Ensuring ${name}`);
@@ -1857,85 +3665,20 @@ async function ensurePostgres(ctx, services) {
     const args = ["postgres:create", name];
     if (config.image) args.push("--image", config.image);
     if (config.version) args.push("--image-version", config.version);
-    await ctx.run(...args);
-    created.add(name);
-    logDone();
-  }
-  return created;
-}
-async function ensurePostgresBackups(ctx, services, opts = {}) {
-  for (const [name, config] of Object.entries(services)) {
-    const backup = config.backup;
-    if (backup === void 0 && !opts.prune) continue;
-    if (backup === void 0) {
-      let info2;
-      try {
-        info2 = await readServiceInfo(ctx, "postgres", name);
-      } catch (err) {
-        logWarn("services", `could not read backup state for ${name}: ${err instanceof Error ? err.message : String(err)}`);
-        continue;
-      }
-      if (hasBackup(info2)) {
-        logWarn("services", `${name}: has a backup the file does not declare (${describeServerBackup(info2)}); --prune leaves it, set backup: false to remove it`);
-      }
-      continue;
-    }
-    if (opts.dryRunCreated?.has(name)) {
-      logAction("services", `Configuring backup for ${name}`);
-      if (backup !== false) {
-        const { schedule: schedule2, bucket: bucket2, auth: auth2 } = backup;
-        await ctx.run(
-          "postgres:backup-auth",
-          name,
-          auth2.access_key_id,
-          auth2.secret_access_key,
-          auth2.region,
-          auth2.signature_version,
-          auth2.endpoint
-        );
-        await ctx.run("postgres:backup-schedule", name, schedule2, bucket2);
-      }
-      logDone();
-      continue;
-    }
-    const info = await readServiceInfo(ctx, "postgres", name);
-    logAction("services", `Configuring backup for ${name}`);
-    const fields = new Set(backupMismatches(info, backup).map((m) => m.field));
-    if (fields.size === 0) {
-      logSkip();
-      continue;
-    }
-    if (backup === false) {
-      if (String(info["backup-schedule"] ?? "") !== "") await ctx.run("postgres:backup-unschedule", name);
-      await ctx.run("postgres:backup-deauth", name);
-      logDone();
+    try {
+      args.push(...createArgs2(config, await resolveServiceMounts(ctx, volumes, config.mounts, opts.failedVolumes)));
+      await ctx.run(...args);
+    } catch (error) {
+      if (!opts.failures) throw error;
+      console.log("");
+      logError(name, error instanceof Error ? error.message : String(error));
+      opts.failures.push({ service: name, error });
       continue;
     }
-    const { schedule, bucket, auth } = backup;
-    if (fields.has("backup.auth")) {
-      await ctx.run(
-        "postgres:backup-auth",
-        name,
-        auth.access_key_id,
-        auth.secret_access_key,
-        auth.region,
-        auth.signature_version,
-        auth.endpoint
-      );
-    }
-    if (fields.has("backup.schedule")) {
-      await ctx.run("postgres:backup-schedule", name, schedule, bucket);
-      if (!opts.dryRun) {
-        const cronOutput = await ctx.query("postgres:backup-schedule-cat", name);
-        if (!parseBackupSchedule(cronOutput)) {
-          throw new Error(`Backup schedule for ${name} was not installed after backup-schedule ran`);
-        }
-      }
-    } else if (fields.has("backup.bucket")) {
-      await ctx.run("postgres:set", name, "backup-bucket", bucket);
-    }
+    created.add(name);
     logDone();
   }
+  return created;
 }
 async function removeBackupHashKeys(ctx) {
   let env;
@@ -1966,14 +3709,7 @@ async function destroyPostgres(ctx, services) {
     logDone();
   }
 }
-function parseBackupSchedule(cronLine) {
-  const parts = cronLine.trim().split(/\s+/);
-  if (parts.length < 8) return null;
-  const schedule = parts.slice(0, 5).join(" ");
-  const bucket = parts[parts.length - 1];
-  return { schedule, bucket };
-}
-async function exportPostgres(ctx) {
+async function exportPostgres(ctx, mountSpecs) {
   const services = {};
   const listOutput = await ctx.query("postgres:list");
   const lines = listOutput.split("\n").slice(1);
@@ -1994,33 +3730,19 @@ async function exportPostgres(ctx) {
     } else {
       config.version = versionField;
     }
-    try {
-      const cronOutput = await ctx.query("postgres:backup-schedule-cat", name);
-      if (cronOutput) {
-        const parsed = parseBackupSchedule(cronOutput);
-        if (parsed) {
-          config.backup = {
-            schedule: parsed.schedule,
-            bucket: parsed.bucket,
-            auth: {
-              access_key_id: "REPLACE_ME",
-              secret_access_key: "REPLACE_ME",
-              region: "REPLACE_ME",
-              signature_version: "REPLACE_ME",
-              endpoint: "REPLACE_ME"
-            }
-          };
-        }
-      }
-    } catch {
-    }
+    const backup = await exportServiceBackup(ctx, "postgres", name);
+    if (backup) config.backup = backup;
+    const exported = await exportServiceProperties(ctx, "postgres", name);
+    if (exported.properties) config.properties = exported.properties;
+    if (exported.mountSpecs) mountSpecs?.set(name, exported.mountSpecs);
     services[name] = config;
   }
   return services;
 }
 
 // src/modules/redis.ts
-async function ensureRedis(ctx, services) {
+async function ensureRedis(ctx, services, volumes, opts = {}) {
+  const created = /* @__PURE__ */ new Set();
   for (const [name, config] of Object.entries(services)) {
     logAction("services", `Ensuring ${name}`);
     const exists = await ctx.check("redis:exists", name);
@@ -2037,12 +3759,23 @@ async function ensureRedis(ctx, services) {
       }
       continue;
     }
-    const args = ["redis:create", name];
-    if (config.image) args.push("--image", config.image);
-    if (config.version) args.push("--image-version", config.version);
-    await ctx.run(...args);
+    const args = ["redis:create", name];
+    if (config.image) args.push("--image", config.image);
+    if (config.version) args.push("--image-version", config.version);
+    try {
+      args.push(...createArgs2(config, await resolveServiceMounts(ctx, volumes, config.mounts, opts.failedVolumes)));
+      await ctx.run(...args);
+    } catch (error) {
+      if (!opts.failures) throw error;
+      console.log("");
+      logError(name, error instanceof Error ? error.message : String(error));
+      opts.failures.push({ service: name, error });
+      continue;
+    }
+    created.add(name);
     logDone();
   }
+  return created;
 }
 async function destroyRedis(ctx, services) {
   for (const [name] of Object.entries(services)) {
@@ -2056,7 +3789,7 @@ async function destroyRedis(ctx, services) {
     logDone();
   }
 }
-async function exportRedis(ctx) {
+async function exportRedis(ctx, mountSpecs) {
   const services = {};
   const listOutput = await ctx.query("redis:list");
   const lines = listOutput.split("\n").slice(1);
@@ -2077,171 +3810,16 @@ async function exportRedis(ctx) {
     } else {
       config.version = versionField;
     }
+    const backup = await exportServiceBackup(ctx, "redis", name);
+    if (backup) config.backup = backup;
+    const exported = await exportServiceProperties(ctx, "redis", name);
+    if (exported.properties) config.properties = exported.properties;
+    if (exported.mountSpecs) mountSpecs?.set(name, exported.mountSpecs);
     services[name] = config;
   }
   return services;
 }
 
-// src/modules/links.ts
-function normalizeLink(entry) {
-  return typeof entry === "string" ? { service: entry } : entry;
-}
-function resolveServicePlugin(name, config) {
-  if (config.postgres?.[name]) return { plugin: "postgres", config: config.postgres[name] };
-  if (config.redis?.[name]) return { plugin: "redis", config: config.redis[name] };
-  return void 0;
-}
-function allServices(config) {
-  const entries = [];
-  for (const name of Object.keys(config.postgres ?? {})) entries.push([name, "postgres"]);
-  for (const name of Object.keys(config.redis ?? {})) entries.push([name, "redis"]);
-  return entries;
-}
-var DEFAULT_ENV_VAR = { postgres: "DATABASE_URL", redis: "REDIS_URL" };
-function linkEnvVar(plugin, link) {
-  if (link.env_var) return link.env_var;
-  if (link.alias) return `${link.alias}_URL`;
-  return DEFAULT_ENV_VAR[plugin] ?? `${plugin.toUpperCase()}_URL`;
-}
-function linkFlags(link) {
-  const flags = [];
-  if (link.alias) flags.push("--alias", link.alias);
-  if (link.env_var) flags.push("--env-var", link.env_var);
-  if (link.querystring) flags.push("--querystring", link.querystring);
-  return flags;
-}
-function readEnv(ctx, app, cache) {
-  let read = cache?.get(app);
-  if (!read) {
-    read = ctx.queryStrict("config:export", "--format", "json", app).then((out) => JSON.parse(out));
-    cache?.set(app, read);
-  }
-  return read;
-}
-function findLinkVariables(env, plugin, service) {
-  const host = `dokku-${plugin}-${service}`;
-  const found = [];
-  for (const [name, value] of Object.entries(env)) {
-    if (typeof value !== "string") continue;
-    const m = value.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/?]*@)?([^:/?]+)/i);
-    if (m && m[1] === host) found.push({ name, value });
-  }
-  return found;
-}
-function isFallbackName(plugin, name) {
-  return new RegExp(`^DOKKU_${plugin.toUpperCase()}_[A-Z]+_URL$`).test(name);
-}
-function querystringOf(url) {
-  const q = url.indexOf("?");
-  return q === -1 ? "" : url.slice(q + 1);
-}
-function show(name, qs) {
-  return qs ? `${name}?${maskQuerystring(qs)}` : name;
-}
-async function readLinkOptions(ctx, app, plugin, link, cache) {
-  let env;
-  try {
-    env = await readEnv(ctx, app, cache);
-  } catch (err) {
-    return { state: "unreadable", reason: err instanceof Error ? err.message : String(err) };
-  }
-  const found = findLinkVariables(env, plugin, link.service);
-  if (found.length === 0) {
-    return { state: "unreadable", reason: `no variable of '${app}' points at ${link.service}` };
-  }
-  const name = linkEnvVar(plugin, link);
-  const desired = link.querystring ?? "";
-  const plain = !link.alias && !link.env_var;
-  const hit = found.find((v) => v.name === name) ?? (plain ? found.find((v) => isFallbackName(plugin, v.name)) : void 0);
-  if (!hit) return { state: "differs", current: show(found[0].name, querystringOf(found[0].value)), desired: show(name, desired) };
-  const current = querystringOf(hit.value);
-  if (current === desired) return { state: "same" };
-  return { state: "differs", current: show(name, current), desired: show(name, desired) };
-}
-async function readServiceLinks(ctx, app, desiredLinks, config) {
-  const desired = new Map(desiredLinks.map(normalizeLink).map((l) => [l.service, l]));
-  const states = [];
-  for (const [service, plugin] of allServices(config)) {
-    states.push({ service, plugin, link: desired.get(service), isLinked: await ctx.check(`${plugin}:linked`, service, app) });
-  }
-  return states;
-}
-function servicesToUnlink(states) {
-  return states.filter((s) => !s.link && s.isLinked);
-}
-async function ensureAppLinks(ctx, app, desiredLinks, config) {
-  const states = await readServiceLinks(ctx, app, desiredLinks, config);
-  const unlink = new Set(servicesToUnlink(states));
-  for (const state of states) {
-    const { service: serviceName, plugin, link, isLinked } = state;
-    if (link && !isLinked) {
-      logAction(app, `Linking ${serviceName}`);
-      await ctx.run(`${plugin}:link`, serviceName, app, "--no-restart", ...linkFlags(link));
-      ctx.needsRestart(app, "links");
-      logDone();
-    } else if (link && isLinked) {
-      const opts = await readLinkOptions(ctx, app, plugin, link);
-      if (opts.state === "differs") {
-        logAction(app, `Relinking ${serviceName}`);
-        await ctx.run(`${plugin}:unlink`, serviceName, app, "--no-restart");
-        try {
-          await ctx.run(`${plugin}:link`, serviceName, app, "--no-restart", ...linkFlags(link));
-        } catch (err) {
-          logWarn(app, `${app} is now unlinked from ${serviceName}`);
-          throw err;
-        }
-        ctx.needsRestart(app, "links");
-        logDone();
-      }
-    } else if (unlink.has(state)) {
-      logAction(app, `Unlinking ${serviceName}`);
-      await ctx.run(`${plugin}:unlink`, serviceName, app, "--no-restart");
-      ctx.needsRestart(app, "links");
-      logDone();
-    }
-  }
-}
-async function destroyAppLinks(ctx, app, links, config) {
-  for (const serviceName of links.map((l) => normalizeLink(l).service)) {
-    const resolved = resolveServicePlugin(serviceName, config);
-    if (!resolved) continue;
-    const isLinked = await ctx.check(`${resolved.plugin}:linked`, serviceName, app);
-    if (isLinked) {
-      await ctx.run(`${resolved.plugin}:unlink`, serviceName, app, "--no-restart");
-    }
-  }
-}
-async function exportAppLinks(ctx, app, config) {
-  const linked = [];
-  for (const [serviceName, plugin] of allServices(config)) {
-    if (!await ctx.check(`${plugin}:linked`, serviceName, app)) continue;
-    let found = [];
-    try {
-      found = findLinkVariables(await readEnv(ctx, app), plugin, serviceName);
-    } catch {
-    }
-    const fallback = linkEnvVar(plugin, { service: serviceName });
-    const v = found.find((f) => f.name === fallback) ?? found.find((f) => isFallbackName(plugin, f.name)) ?? found[0];
-    if (!v) {
-      linked.push(serviceName);
-      continue;
-    }
-    const querystring = querystringOf(v.value);
-    if ((v.name === fallback || isFallbackName(plugin, v.name)) && !querystring) {
-      linked.push(serviceName);
-      continue;
-    }
-    const entry = { service: serviceName };
-    if (v.name !== fallback && !isFallbackName(plugin, v.name)) {
-      if (v.name.endsWith("_URL") && v.name.length > 4) entry.alias = v.name.slice(0, -4);
-      else entry.env_var = v.name;
-    }
-    if (querystring) entry.querystring = querystring;
-    linked.push(entry);
-  }
-  return linked;
-}
-
 // src/modules/domains.ts
 async function readGlobalDomains(ctx) {
   const raw = await ctx.queryStrict("domains:report", "--global", "--domains-global-vhosts");
@@ -2265,46 +3843,20 @@ async function ensureGlobalDomains(ctx, domains) {
   logDone();
 }
 
-// src/modules/logs.ts
-async function readGlobalLogs(ctx) {
-  return parseJsonReport(await ctx.queryStrict("logs:report", "--global", "--format", "json"), "global");
-}
-async function ensureGlobalLogs(ctx, logs) {
-  logAction("global", "Configuring logs");
-  const current = await readGlobalLogs(ctx);
-  let changed = false;
-  for (const [key, value] of Object.entries(logs)) {
-    if (current[key] === String(value)) continue;
-    await ctx.run("logs:set", "--global", key, String(value));
-    changed = true;
-  }
-  if (changed) logDone();
-  else logSkip();
-}
-
-// src/modules/nginx.ts
-async function readGlobalNginx(ctx) {
-  return parseJsonReport(await ctx.queryStrict("nginx:report", "--global", "--format", "json"), "global");
-}
-async function ensureGlobalNginx(ctx, nginx) {
-  logAction("global", "Configuring nginx");
-  const current = await readGlobalNginx(ctx);
-  let changed = false;
-  for (const [key, value] of Object.entries(nginx)) {
-    if (current[key] === String(value)) continue;
-    await ctx.run("nginx:set", "--global", key, String(value));
-    changed = true;
-  }
-  if (changed) logDone();
-  else logSkip();
-}
-
 // src/commands/up.ts
 function markGlobalEnvRestart(ctx, apps, reason = "global env") {
   for (const app of apps) ctx.needsRestart(app, reason);
 }
 function printRestartSummary(ctx, dryRun = false) {
   const restarts = [...ctx.restarts].filter(([app]) => !ctx.rebuilds.has(app));
+  const services = [...ctx.serviceRestarts?.values() ?? []];
+  if (services.length > 0) {
+    console.log(`
+# Services that ${dryRun ? "would need" : "need"} a stop and start:`);
+    for (const { plugin, service, reasons } of services) {
+      console.log(`dokku ${plugin}:stop ${service} && dokku ${plugin}:start ${service}  # ${reasons.join(", ")}`);
+    }
+  }
   if (restarts.length === 0 && ctx.rebuilds.size === 0) return;
   console.log(`
 # Apps that ${dryRun ? "would need" : "need"} a restart or rebuild:`);
@@ -2313,8 +3865,9 @@ function printRestartSummary(ctx, dryRun = false) {
 }
 var UpFailedError = class extends Error {
   constructor(failures) {
+    const kinds = failures.every((f) => f.service) ? "service(s)" : failures.some((f) => f.service) ? "app(s) and service(s)" : "app(s)";
     super(
-      `up failed for ${failures.length} app(s): ${failures.map((f) => f.app).join(", ")}`
+      `up failed for ${failures.length} ${kinds}: ${failures.map((f) => f.app).join(", ")}`
     );
     this.failures = failures;
     this.name = "UpFailedError";
@@ -2326,7 +3879,7 @@ var AppStepsError = class extends AggregateError {
     this.name = "AppStepsError";
   }
 };
-async function processApp(ctx, config, app, appConfig, failFast = false, prune = false) {
+async function processApp(ctx, config, app, appConfig, failFast = false, prune = false, failedVolumes = /* @__PURE__ */ new Map()) {
   const errors = [];
   let leftOnServer = 0;
   const count = prune ? void 0 : (removed) => {
@@ -2352,7 +3905,13 @@ async function processApp(ctx, config, app, appConfig, failFast = false, prune =
     await step(() => ensureAppLinks(ctx, app, appConfig.links ?? [], config));
   }
   await step(() => reconcile(Certs, ctx, app, appConfig.ssl));
-  await step(() => reconcile(Storage, ctx, app, appConfig.storage));
+  await step(async () => {
+    const failedEntries = [...new Set(declaredMounts(appConfig.storage).map((m) => m.entry))].filter((e) => failedVolumes.has(e));
+    if (failedEntries.length > 0) {
+      throw new Error(`storage skipped: ${failedEntries.map((e) => `entry '${e}' failed (${failedVolumes.get(e)})`).join("; ")}`);
+    }
+    await reconcile(Storage, ctx, app, desiredSpecs(appConfig.storage));
+  });
   await step(() => reconcile(Nginx, ctx, app, appConfig.nginx, count, prune));
   await step(() => reconcile(Checks, ctx, app, appConfig.checks, void 0, prune));
   await step(() => reconcile(Logs, ctx, app, appConfig.logs, count, prune));
@@ -2362,7 +3921,7 @@ async function processApp(ctx, config, app, appConfig, failFast = false, prune =
   await step(() => reconcile(Scale, ctx, app, appConfig.scale));
   await step(() => reconcile(Config, ctx, app, appConfig.env || {}));
   await step(() => reconcile(Builder, ctx, app, appConfig.build, count, prune));
-  await step(() => reconcile(Git, ctx, app, appConfig.git ?? config.git));
+  await step(() => reconcile(Git, ctx, app, appConfig.git, count, prune, config.git));
   await step(() => reconcile(DockerOptions, ctx, app, appConfig.docker_options));
   if (leftOnServer > 0) {
     logWarn(app, `${leftOnServer} setting(s) no longer in the compose file were left on the server; run 'dokku-compose diff' to see them`);
@@ -2388,25 +3947,57 @@ async function runUpPhases(ctx, config, appFilter, opts) {
   if (await ensureGlobalConfig(ctx, config.env)) {
     markGlobalEnvRestart(ctx, apps.filter((app) => config.apps[app]));
   }
-  if (config.logs !== void 0) await ensureGlobalLogs(ctx, config.logs);
-  if (config.nginx !== void 0) await ensureGlobalNginx(ctx, config.nginx);
+  const globalOpts = { prune: opts.prune, apps: apps.filter((app) => config.apps[app]), appConfigs: config.apps };
+  for (const name of GLOBAL_UP_ORDER) {
+    if (config[name] !== void 0) await ensureGlobal(ctx, name, config[name], globalOpts);
+  }
   if (config.networks) await ensureNetworks(ctx, config.networks);
-  const createdPostgres = config.postgres ? await ensurePostgres(ctx, config.postgres) : /* @__PURE__ */ new Set();
-  if (config.redis) await ensureRedis(ctx, config.redis);
-  if (config.postgres) {
-    await ensurePostgresBackups(ctx, config.postgres, {
+  if (config.network !== void 0) await ensureGlobal(ctx, "network", config.network, globalOpts);
+  const failedVolumes = config.volumes ? await ensureVolumes(ctx, config.volumes, opts.failFast) : /* @__PURE__ */ new Map();
+  const createFailures = [];
+  const redisCreateFailures = [];
+  const createdPostgres = config.postgres ? await ensurePostgres(ctx, config.postgres, config.volumes, { failedVolumes, failures: createFailures }) : /* @__PURE__ */ new Set();
+  const createdRedis = config.redis ? await ensureRedis(ctx, config.redis, config.volumes, { failedVolumes, failures: redisCreateFailures }) : /* @__PURE__ */ new Set();
+  const without = (services, failed) => services && Object.fromEntries(Object.entries(services).filter(([name]) => !failed.some((f) => f.service === name)));
+  const postgres = without(config.postgres, createFailures);
+  const redis = without(config.redis, redisCreateFailures);
+  if (postgres) {
+    await ensureServiceBackups(ctx, "postgres", postgres, {
       prune: opts.prune,
       dryRun: opts.dryRun,
       dryRunCreated: opts.dryRun ? createdPostgres : void 0
     });
   }
+  if (redis) {
+    await ensureServiceBackups(ctx, "redis", redis, {
+      prune: opts.prune,
+      dryRun: opts.dryRun,
+      dryRunCreated: opts.dryRun ? createdRedis : void 0
+    });
+  }
+  const serviceFailures = [
+    ...createFailures.map((f) => ({ app: `postgres:${f.service}`, error: f.error, service: true })),
+    ...redisCreateFailures.map((f) => ({ app: `redis:${f.service}`, error: f.error, service: true }))
+  ];
+  if (opts.failFast && serviceFailures.length > 0) throw new UpFailedError(serviceFailures);
+  for (const [plugin, services, created] of [["postgres", postgres, createdPostgres], ["redis", redis, createdRedis]]) {
+    if (!services) continue;
+    const failed = await ensureServiceProperties(ctx, plugin, services, config, {
+      prune: opts.prune,
+      dryRun: opts.dryRun,
+      dryRunCreated: opts.dryRun ? created : void 0,
+      failedVolumes
+    });
+    serviceFailures.push(...failed.map((f) => ({ app: `${plugin}:${f.service}`, error: f.error, service: true })));
+  }
+  if (opts.failFast && serviceFailures.length > 0) throw new UpFailedError(serviceFailures);
   await removeBackupHashKeys(ctx);
-  const failures = [];
+  const failures = [...serviceFailures];
   for (const app of apps) {
     const appConfig = config.apps[app];
     if (!appConfig) continue;
     try {
-      await processApp(ctx, config, app, appConfig, opts.failFast, opts.prune);
+      await processApp(ctx, config, app, appConfig, opts.failFast, opts.prune, failedVolumes);
     } catch (error) {
       if (opts.failFast) throw error;
       if (!(error instanceof AppStepsError)) {
@@ -2418,6 +4009,9 @@ async function runUpPhases(ctx, config, appFilter, opts) {
   if (failures.length > 0) {
     throw new UpFailedError(failures);
   }
+  if (failedVolumes.size > 0) {
+    throw new Error(`up failed for storage entr${failedVolumes.size === 1 ? "y" : "ies"}: ${[...failedVolumes.keys()].join(", ")}`);
+  }
 }
 
 // src/modules/apps.ts
@@ -2525,9 +4119,22 @@ async function runExport(ctx, opts) {
   const apps = opts.appFilter?.length ? opts.appFilter : await exportApps(ctx);
   const networks = await exportNetworks(ctx);
   if (networks.length > 0) config.networks = networks;
-  const postgres = await exportPostgres(ctx);
+  for (const name of GLOBAL_NAMES) {
+    try {
+      const block = await exportGlobal(ctx, name);
+      if (block !== void 0) config[name] = block;
+    } catch (err) {
+      logWarn("global", `could not read '${name}', left out of the export: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const serviceMounts = /* @__PURE__ */ new Map();
+  const specsOf = /* @__PURE__ */ new Map();
+  const postgres = await exportPostgres(ctx, specsOf);
+  for (const [name, specs] of specsOf) serviceMounts.set(name, { plugin: "postgres", specs });
+  specsOf.clear();
   if (Object.keys(postgres).length > 0) config.postgres = postgres;
-  const redis = await exportRedis(ctx);
+  const redis = await exportRedis(ctx, specsOf);
+  for (const [name, specs] of specsOf) serviceMounts.set(name, { plugin: "redis", specs });
   if (Object.keys(redis).length > 0) config.redis = redis;
   const prefetched = /* @__PURE__ */ new Map();
   await Promise.all(
@@ -2538,12 +4145,21 @@ async function runExport(ctx, opts) {
       }
     })
   );
+  const mounts = /* @__PURE__ */ new Map();
   for (const app of apps) {
     const appConfig = {};
     for (const resource of ALL_APP_RESOURCES) {
       if (resource.key.startsWith("_")) continue;
       if (resource.forceApply) continue;
       if (resource.key === "checks") continue;
+      if (resource.key === "storage") {
+        try {
+          mounts.set(app, await resource.read(ctx, app));
+        } catch (err) {
+          logWarn(app, `could not read 'storage', left out of the export: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        continue;
+      }
       const bulk = prefetched.get(resource.key);
       let value;
       try {
@@ -2571,8 +4187,97 @@ async function runExport(ctx, opts) {
     }
     config.apps[app] = appConfig;
   }
+  await exportStorage(ctx, config, mounts, !!opts.appFilter?.length, serviceMounts);
   return config;
 }
+async function exportStorage(ctx, config, mounts, onlyMounted, serviceMounts) {
+  let server;
+  try {
+    server = await readEntries(ctx);
+  } catch (err) {
+    logWarn("storage", `could not read the storage entries, storage left out of the export: ${err instanceof Error ? err.message : String(err)}`);
+    for (const name of serviceMounts.keys()) logWarn(name, "its mounts are left out of the export: the storage entries could not be read");
+    return;
+  }
+  const parsed = new Map([...mounts].map(([app, specs]) => [app, specs.map(parseSpec)]));
+  const mounted = new Set([...parsed.values()].flat().map((m) => m.entry));
+  const byPath = /* @__PURE__ */ new Map();
+  for (const e of [...server.values()].filter((e2) => e2.scheduler === DOCKER_LOCAL && e2.host_path).sort((a, b) => Number(isLegacyName(a.name)) - Number(isLegacyName(b.name)) || a.name.localeCompare(b.name))) {
+    if (!byPath.has(e.host_path)) byPath.set(e.host_path, e.name);
+  }
+  const serviceSpecs = new Map([...serviceMounts].map(([name, { specs }]) => [name, specs.map(parseServiceSpec)]));
+  for (const list of serviceSpecs.values()) for (const m of list) {
+    const entry = byPath.get(m.source);
+    if (entry) mounted.add(entry);
+  }
+  const { volumes, names } = exportVolumes(server, mounted, onlyMounted);
+  exportServiceMounts(config, serviceMounts, serviceSpecs, byPath, names, volumes, server);
+  if (Object.keys(volumes).length > 0) config.volumes = volumes;
+  for (const [app, list] of parsed) {
+    const items = [];
+    for (const m of list) {
+      const entry = names.get(m.entry);
+      if (entry === void 0) {
+        logWarn(app, `mount of '${m.entry}' at ${m.dir} left out of the export: dokku-compose manages only docker-local entries`);
+        continue;
+      }
+      if (m.subpath || m.volumeChown) {
+        logWarn(app, `${m.dir}: ${[m.subpath && "volume-subpath", m.volumeChown && "volume-chown"].filter(Boolean).join(" and ")} dropped: docker-local stores it but never applies it`);
+      }
+      const plain = !m.readonly && m.phases.length === ALL_PHASES.length && m.options.length === 0 && m.scope === DEFAULT_SCOPE;
+      if (plain) {
+        items.push(`${entry}:${m.dir}`);
+        continue;
+      }
+      items.push({
+        entry,
+        container_dir: m.dir,
+        ...m.readonly ? { readonly: true } : {},
+        ...m.phases.length !== ALL_PHASES.length ? { phases: m.phases } : {},
+        ...m.scope !== DEFAULT_SCOPE ? { process_type: m.scope } : {},
+        ...m.options.length > 0 ? { options: m.options } : {}
+      });
+    }
+    if (items.length > 0) config.apps[app].storage = items;
+  }
+}
+function parseServiceSpec(spec) {
+  const [source = "", dir = "", ...rest] = spec.split(":");
+  const out = { source, dir, readonly: false, options: [], dropped: [] };
+  for (const token of rest.join(":").split(",").filter(Boolean)) {
+    if (token === "ro") out.readonly = true;
+    else if (token.startsWith("volume-subpath=") || token.startsWith("volume-chown=")) out.dropped.push(token.split("=")[0]);
+    else out.options.push(token);
+  }
+  return out;
+}
+function exportServiceMounts(config, serviceMounts, parsed, byPath, names, volumes, server) {
+  const taken = /* @__PURE__ */ new Set([...server.keys(), ...Object.keys(volumes)]);
+  const added = /* @__PURE__ */ new Map();
+  for (const [svc, { plugin }] of serviceMounts) {
+    const items = [];
+    for (const m of parsed.get(svc) ?? []) {
+      let entry = byPath.has(m.source) ? names.get(byPath.get(m.source)) : added.get(m.source);
+      if (entry === void 0 && !byPath.has(m.source)) {
+        const given = pathError(m.source) === void 0 ? legacyExportNames([{ name: m.source, scheduler: DOCKER_LOCAL, host_path: m.source }], taken).get(m.source) ?? null : null;
+        if (given === null) {
+          logWarn(svc, `mount of ${m.source} at ${m.dir} left out of the export: no valid volumes: entry can name it`);
+          continue;
+        }
+        volumes[given] = m.source === defaultPath(given) ? { chown: false } : { path: m.source };
+        added.set(m.source, given);
+        entry = given;
+      }
+      if (entry === void 0) {
+        logWarn(svc, `mount of ${m.source} at ${m.dir} left out of the export: dokku-compose manages only docker-local entries`);
+        continue;
+      }
+      if (m.dropped.length > 0) logWarn(svc, `${m.dir}: ${m.dropped.join(" and ")} dropped: not managed for a service mount`);
+      items.push(!m.readonly && m.options.length === 0 ? `${entry}:${m.dir}` : { entry, container_dir: m.dir, ...m.readonly ? { readonly: true } : {}, ...m.options.length > 0 ? { options: m.options } : {} });
+    }
+    if (items.length > 0) config[plugin][svc].mounts = items;
+  }
+}
 
 // src/modules/env-notes.ts
 var MANAGED_KEYS_VAR3 = "DOKKU_COMPOSE_MANAGED_KEYS";
@@ -2620,7 +4325,7 @@ function isEmptyValue(value) {
   return value === null || value === void 0 || Array.isArray(value) && value.length === 0 || typeof value === "object" && Object.keys(value).length === 0;
 }
 async function computeDiff(ctx, config) {
-  const result = { apps: {}, services: {}, plugins: {}, global: {}, networks: {}, inSync: true, envNotes: {}, readWarnings: [] };
+  const result = { apps: {}, services: {}, plugins: {}, global: {}, networks: {}, volumes: {}, volumeNotes: [], inSync: true, envNotes: {}, readWarnings: [] };
   const appNames = Object.keys(config.apps);
   const serverVersion = await assertDokkuSupported(ctx);
   const fileVersion = config.dokku?.version;
@@ -2666,13 +4371,14 @@ async function computeDiff(ctx, config) {
       let desired;
       if (resource.key === "proxy") {
         desired = appConfig.proxy?.enabled;
-      } else if (resource.key === "git") {
-        desired = appConfig.git ?? config.git;
       } else if (resource.key === "proxy_props") {
         desired = proxyProps(appConfig.proxy);
+      } else if (resource.key === "storage") {
+        desired = desiredSpecs(appConfig.storage);
       } else {
         desired = appConfig[resource.key];
       }
+      const inherited = resource.inheritsGlobal ? config[resource.key] : void 0;
       const checkRemovalsOnly = desired === void 0;
       if (checkRemovalsOnly && (!resource.removals || !appExists.get(app))) continue;
       if (resource.forceApply && !resource.removals) continue;
@@ -2692,7 +4398,7 @@ async function computeDiff(ctx, config) {
           result.readWarnings.push(`could not read '${resource.key}' for app '${app}' to look for removed settings: ${err instanceof Error ? err.message : String(err)}`);
           continue;
         }
-        const removed2 = resource.removals(current, void 0);
+        const removed2 = resource.removals(current, void 0, inherited);
         if (removed2.length > 0) {
           appDiff[resource.key] = { status: "extra", current, removed: removed2 };
           result.inSync = false;
@@ -2708,15 +4414,15 @@ async function computeDiff(ctx, config) {
         current = await resource.read(ctx, app);
       }
       if (resource.inSync) {
-        const removedHere = resource.removals ? resource.removals(current, desired) : [];
+        const removedHere = resource.removals ? resource.removals(current, desired, inherited) : [];
         let status;
         if (current === void 0) {
           status = "unknown";
           result.readWarnings.push(`could not read '${resource.key}' for app '${app}'`);
         } else {
-          const same = safeInSync(resource, current, desired, app, result.readWarnings);
-          if (same === void 0) status = "unknown";
-          else if (same) status = removedHere.length > 0 ? "extra" : "in-sync";
+          const same2 = safeInSync(resource, current, desired, app, result.readWarnings);
+          if (same2 === void 0) status = "unknown";
+          else if (same2) status = removedHere.length > 0 ? "extra" : "in-sync";
           else status = current === false || isEmptyValue(current) ? "missing" : "changed";
         }
         appDiff[resource.key] = {
@@ -2728,7 +4434,7 @@ async function computeDiff(ctx, config) {
         if (status !== "in-sync") result.inSync = false;
         continue;
       }
-      let removed = resource.removals ? resource.removals(current, desired) : [];
+      let removed = resource.removals ? resource.removals(current, desired, inherited) : [];
       if (resource.forceApply) {
         if (removed.length > 0) {
           appDiff[resource.key] = { status: "extra", desired, current, removed };
@@ -2883,24 +4589,30 @@ async function computeDiff(ctx, config) {
       result.inSync = false;
     }
   }
-  for (const [name, declared, read] of [
-    ["logs", config.logs, readGlobalLogs],
-    ["nginx", config.nginx, readGlobalNginx]
-  ]) {
+  for (const name of GLOBAL_NAMES) {
+    const declared = config[name];
     if (declared === void 0) continue;
     let current;
     try {
-      current = await read(ctx);
+      current = await readGlobal(ctx, name);
     } catch (err) {
       result.global[name] = { status: "unknown", desired: declared };
       result.readWarnings.push(`could not read global '${name}': ${err instanceof Error ? err.message : String(err)}`);
       result.inSync = false;
       continue;
     }
-    const differs = Object.entries(declared).filter(([k, v]) => current[k] !== String(v));
-    if (differs.length === 0) continue;
-    const shown = Object.fromEntries(Object.keys(declared).filter((k) => k in current).map((k) => [k, current[k]]));
-    result.global[name] = { status: differs.every(([k]) => !(k in current)) ? "missing" : "changed", desired: declared, current: shown };
+    const plan = planGlobal(name, declared, current);
+    if (plan.changes.length === 0 && plan.removals.length === 0) continue;
+    const declaredKeys = new Set(typeof declared === "string" ? ["selected"] : Object.keys(declared));
+    const shown = Object.fromEntries(Object.entries(current).filter(([k]) => declaredKeys.has(k)));
+    const removed = plan.removals.map((gk) => gk.yaml);
+    const status = plan.changes.length === 0 ? "extra" : plan.changes.every((c) => !(c.gk.yaml in current)) ? "missing" : "changed";
+    result.global[name] = {
+      status,
+      desired: declared,
+      ...Object.keys(shown).length > 0 || status !== "extra" ? { current: shown } : {},
+      ...removed.length > 0 ? { removed } : {}
+    };
     result.inSync = false;
   }
   for (const net of config.networks ?? []) {
@@ -2908,6 +4620,35 @@ async function computeDiff(ctx, config) {
     result.networks[net] = { status: "missing" };
     result.inSync = false;
   }
+  if (config.volumes) {
+    try {
+      const server = await readEntries(ctx);
+      const declared = desiredEntries(config.volumes);
+      for (const d of declared) {
+        const state = entryState(d, server.get(d.name));
+        const problem = stateError(d, state);
+        if (state.kind === "ok") continue;
+        if (state.kind === "missing" && !problem) {
+          result.volumes[d.name] = { status: "missing" };
+        } else if (state.kind === "changed") {
+          result.volumes[d.name] = {
+            status: "changed",
+            desired: Object.fromEntries([...state.chown ? [["chown", state.chown.want]] : [], ...state.mode ? [["mode", state.mode.want]] : []]),
+            current: Object.fromEntries([...state.chown ? [["chown", state.chown.server || "(unset)"]] : [], ...state.mode ? [["mode", state.mode.server || "(unset)"]] : []])
+          };
+        } else {
+          result.volumes[d.name] = { status: "changed", note: `${problem}; up stops on it` };
+        }
+        result.inSync = false;
+      }
+      const names = new Set(declared.map((d) => d.name));
+      result.volumeNotes = [...server.values()].filter((e) => e.scheduler === "docker-local" && !isLegacyName(e.name) && !names.has(e.name)).map((e) => e.name);
+    } catch (err) {
+      result.readWarnings.push(`could not read the storage entries: ${err instanceof Error ? err.message : String(err)}`);
+      for (const name of Object.keys(config.volumes)) result.volumes[name] = { status: "unknown" };
+      result.inSync = false;
+    }
+  }
   for (const [plugin, services] of [["postgres", config.postgres], ["redis", config.redis]]) {
     for (const [svc, declared] of Object.entries(services ?? {})) {
       const exists = await ctx.check(`${plugin}:exists`, svc);
@@ -2916,17 +4657,18 @@ async function computeDiff(ctx, config) {
         result.inSync = false;
         continue;
       }
-      const backup = plugin === "postgres" ? declared.backup : void 0;
-      const compares = declared?.version !== void 0 || declared?.image !== void 0 || backup !== void 0;
-      if (!compares && plugin === "redis") {
-        result.services[svc] = { status: "in-sync", mismatches: [] };
-        continue;
-      }
+      const backup = declared.backup;
+      const compares = declared?.version !== void 0 || declared?.image !== void 0 || backup !== void 0 || declared?.properties !== void 0 || declared?.mounts !== void 0;
       try {
         const info = await readServiceInfo(ctx, plugin, svc);
-        const mismatches = [...versionMismatches(info, declared), ...backup !== void 0 ? backupMismatches(info, backup) : []];
-        const note = plugin === "postgres" && backup === void 0 && hasBackup(info) ? `backup on the server is not in the file (${describeServerBackup(info)}); up leaves it, backup: false removes it` : void 0;
-        result.services[svc] = { status: mismatches.length ? "changed" : "in-sync", mismatches, note };
+        const mismatches = [
+          ...versionMismatches(info, declared),
+          ...backup !== void 0 ? backupMismatches(plugin, info, backup) : [],
+          ...propertyMismatches(plugin, info, declared.properties),
+          ...mountMismatches(plugin, info, await resolveServiceMounts(ctx, config.volumes, declared.mounts))
+        ];
+        const notes = backupNotes(info, backup);
+        result.services[svc] = { status: mismatches.length ? "changed" : "in-sync", mismatches, note: notes.length ? notes.join("; ") : void 0 };
         if (mismatches.length) result.inSync = false;
       } catch (err) {
         result.readWarnings.push(`could not read ${plugin} service '${svc}': ${err instanceof Error ? err.message : String(err)}`);
@@ -2941,10 +4683,18 @@ async function computeDiff(ctx, config) {
   }
   return result;
 }
+function maskServices(services) {
+  return Object.fromEntries(Object.entries(services).map(([svc, d]) => [svc, {
+    ...d,
+    ...d.mismatches ? {
+      mismatches: d.mismatches.map((m) => m.field === "properties.custom-env" ? { ...m, desired: m.removed ? m.desired : maskCustomEnv(m.desired), current: maskCustomEnv(m.current) } : m)
+    } : {}
+  }]));
+}
 function maskDiffResult(diff) {
   const masked = {
     apps: {},
-    services: diff.services,
+    services: maskServices(diff.services),
     plugins: diff.plugins,
     dokku: diff.dokku,
     global: Object.fromEntries(Object.entries(diff.global).map(([k, d]) => [k, {
@@ -2953,6 +4703,8 @@ function maskDiffResult(diff) {
       current: maskSensitiveData(d.current)
     }])),
     networks: diff.networks,
+    volumes: diff.volumes,
+    volumeNotes: diff.volumeNotes,
     inSync: diff.inSync,
     envNotes: diff.envNotes,
     readWarnings: diff.readWarnings
@@ -2973,7 +4725,7 @@ function maskDiffResult(diff) {
   return masked;
 }
 function driftCount(diff) {
-  return Object.values(diff.apps).flatMap((a) => Object.values(a)).filter((d) => d.status !== "in-sync").length + Object.values(diff.services).filter((d) => d.status !== "in-sync").length + Object.values(diff.plugins).filter((d) => d.status !== "unknown").length + Object.keys(diff.global).length + Object.keys(diff.networks).length + (diff.dokku ? 1 : 0);
+  return Object.values(diff.apps).flatMap((a) => Object.values(a)).filter((d) => d.status !== "in-sync").length + Object.values(diff.services).filter((d) => d.status !== "in-sync").length + Object.values(diff.plugins).filter((d) => d.status !== "unknown").length + Object.keys(diff.global).length + Object.keys(diff.networks).length + Object.keys(diff.volumes).length + (diff.dokku ? 1 : 0);
 }
 function formatSummary(diff) {
   const lines = [""];
@@ -2996,15 +4748,23 @@ function formatSummary(diff) {
     lines.push(`  dokku`);
     lines.push(`    ${chalk.yellow("~")} version: ${diff.dokku.file} (file) \u2192 ${diff.dokku.server} (server)`);
   }
+  if (Object.keys(diff.global).length > 0) lines.push(`  global`);
   for (const [name, d] of Object.entries(diff.global)) {
-    const sym = d.status === "missing" ? chalk.green("+") : d.status === "unknown" ? chalk.red("?") : chalk.yellow("~");
-    lines.push(`  global`);
+    const sym = d.status === "missing" ? chalk.green("+") : d.status === "unknown" ? chalk.red("?") : d.status === "extra" ? chalk.red("-") : chalk.yellow("~");
     lines.push(`    ${sym} ${name}: ${formatFeatureSummary(d)}`);
   }
   for (const net of Object.keys(diff.networks)) {
     lines.push(`  networks:`);
     lines.push(`    ${chalk.green("+")} ${net}: not created`);
   }
+  for (const [name, d] of Object.entries(diff.volumes)) {
+    const sym = d.status === "missing" ? chalk.green("+") : d.status === "unknown" ? chalk.red("?") : chalk.yellow("~");
+    lines.push(`  volumes:`);
+    lines.push(`    ${sym} ${name}: ${volumeSummary(d)}`);
+  }
+  if (diff.volumeNotes.length > 0) {
+    lines.push(`  note: storage entries not in the compose file (up leaves them): ${diff.volumeNotes.join(", ")}`);
+  }
   for (const [name, d] of Object.entries(diff.plugins)) {
     const sym = d.status === "missing" ? chalk.green("+") : d.status === "unknown" ? chalk.red("?") : chalk.yellow("~");
     const detail = d.status === "missing" ? `not installed (want ${d.desired ?? "any"})` : `${d.current} \u2192 ${d.desired}`;
@@ -3018,7 +4778,7 @@ function formatSummary(diff) {
     }
     if (d.mismatches?.length || d.note) lines.push(`  services: ${svc}`);
     for (const m of d.mismatches ?? []) {
-      lines.push(`    ${chalk.yellow("~")} ${m.field}: ${m.current || "(unknown)"} \u2192 ${m.desired}`);
+      lines.push(m.removed ? `    ${chalk.red("-")} ${m.field}: ${m.current} (not in the file)` : `    ${chalk.yellow("~")} ${m.field}: ${m.current || "(unknown)"} \u2192 ${m.desired}`);
     }
     if (d.note) lines.push(`    note: ${d.note}`);
   }
@@ -3037,6 +4797,14 @@ function formatSummary(diff) {
   lines.push("");
   return lines.join("\n");
 }
+function volumeSummary(d) {
+  if (d.status === "missing") return "not created";
+  if (d.status === "unknown") return "(could not read server state)";
+  if (d.note) return d.note;
+  const cur = d.current;
+  const want = d.desired;
+  return Object.keys(want).map((k) => `${k} ${cur[k]} \u2192 ${want[k]}`).join(", ");
+}
 function showNote(n) {
   return n.label ? `${n.key} (${n.label})` : n.key;
 }
@@ -3105,6 +4873,27 @@ function formatVerbose(diff) {
     lines.push(`@@ networks @@`);
     lines.push(chalk.green(`+ ${net}`));
   }
+  for (const [name, d] of Object.entries(diff.volumes)) {
+    lines.push(`@@ volumes / ${name} @@`);
+    if (d.status === "missing") {
+      lines.push(chalk.green(`+ ${name}`));
+      continue;
+    }
+    if (d.status === "unknown") {
+      lines.push(chalk.red(`  ? could not read server state`));
+      continue;
+    }
+    if (d.note) {
+      lines.push(`  (${d.note})`);
+      continue;
+    }
+    for (const [k, v] of Object.entries(d.current)) lines.push(chalk.red(`- ${k}: ${v}`));
+    for (const [k, v] of Object.entries(d.desired)) lines.push(chalk.green(`+ ${k}: ${v}`));
+  }
+  for (const name of diff.volumeNotes) {
+    lines.push(`@@ volumes / ${name} (note; up leaves it) @@`);
+    lines.push(`  entry not in the compose file`);
+  }
   for (const [name, d] of Object.entries(diff.plugins)) {
     lines.push(`@@ plugin: ${name} @@`);
     if (d.current !== void 0) lines.push(chalk.red(`- ${d.current}`));
@@ -3118,7 +4907,7 @@ function formatVerbose(diff) {
     for (const m of d.mismatches ?? []) {
       lines.push(`@@ services: ${svc} ${m.field} @@`);
       lines.push(chalk.red(`- ${m.current}`));
-      lines.push(chalk.green(`+ ${m.desired}`));
+      if (!m.removed) lines.push(chalk.green(`+ ${m.desired}`));
     }
     if (d.note) lines.push(`@@ services: ${svc} @@
   (${d.note})`);
@@ -3159,7 +4948,7 @@ function validate(filePath) {
       if (reasons && reasons.length > 0) {
         for (const r of reasons) errors.push(`${[issuePath, ...r.path].filter((x) => x !== "").join(".")}: ${r.message}`);
       } else {
-        errors.push(`${issuePath}: ${issue.message}`);
+        errors.push(issuePath ? `${issuePath}: ${issue.message}` : issue.message);
       }
     }
   }
@@ -3183,6 +4972,16 @@ function validate(filePath) {
       }
     }
   }
+  for (const plugin of ["postgres", "redis"]) {
+    for (const [svc, cfg] of Object.entries(data?.[plugin] && typeof data[plugin] === "object" ? data[plugin] : {})) {
+      const props = cfg?.properties;
+      if (!props || typeof props !== "object" || Array.isArray(props)) continue;
+      for (const key of Object.keys(props)) {
+        if (PLUGIN_SET_KEYS[plugin].includes(key) || rejectedReason(key)) continue;
+        warnings.push(`${plugin}.${svc}.properties.${key}: not a ${plugin}:set key of dokku-${plugin} ${TESTED_PLUGIN_VERSION}; up passes it on and fails the service if the plugin refuses it`);
+      }
+    }
+  }
   const pluginNames = data?.plugins ? new Set(Object.keys(data.plugins)) : /* @__PURE__ */ new Set();
   if (data?.postgres && pluginNames.size > 0 && !pluginNames.has("postgres")) {
     warnings.push(`postgres: "postgres" plugin not declared in plugins (may be pre-installed)`);
@@ -3320,7 +5119,7 @@ program.command("ps [apps...]").description("Show status of configured apps").op
   const config = loadConfig(opts.file);
   const runner = makeRunner({});
   try {
-    const { runPs } = await import("./ps-QQAVQTEV.js");
+    const { runPs } = await import("./ps-4ESSTYJT.js");
     await runPs(runner, config, apps);
   } catch (error) {
     console.error(chalk2.red(`