dokku-compose 0.3.5 → 0.4.0

package/dist/index.js

@@ -4,6 +4,7 @@
 import { Command } from "commander";
 import * as fs3 from "fs";
 import * as yaml3 from "js-yaml";
+import { createRequire } from "module";
 
 // src/core/config.ts
 import * as fs from "fs";
@@ -26,6 +27,9 @@ var ChecksSchema = z.union([
     skipped: z.array(z.string()).optional()
   }).catchall(z.union([z.string(), z.number(), z.boolean()]))
 ]);
+var GitSchema = z.object({
+  deploy_branch: z.string().optional()
+});
 var AppSchema = z.object({
   domains: z.union([z.array(z.string()), z.literal(false)]).optional(),
   links: z.array(z.string()).optional(),
@@ -60,12 +64,26 @@ var AppSchema = z.object({
     build: z.array(z.string()).optional(),
     deploy: z.array(z.string()).optional(),
     run: z.array(z.string()).optional()
-  }).optional()
+  }).optional(),
+  git: GitSchema.optional()
+});
+var ServiceBackupAuthSchema = z.object({
+  access_key_id: z.string(),
+  secret_access_key: z.string(),
+  region: z.string(),
+  signature_version: z.string(),
+  endpoint: z.string()
+});
+var ServiceBackupSchema = z.object({
+  schedule: z.string(),
+  bucket: z.string(),
+  auth: ServiceBackupAuthSchema
 });
 var ServiceSchema = z.object({
   plugin: z.string(),
   version: z.string().optional(),
-  image: z.string().optional()
+  image: z.string().optional(),
+  backup: ServiceBackupSchema.optional()
 });
 var PluginSchema = z.object({
   url: z.string().url(),
@@ -82,29 +100,39 @@ var ConfigSchema = z.object({
   domains: z.union([z.array(z.string()), z.literal(false)]).optional(),
   env: EnvMapSchema.optional(),
   nginx: z.record(z.string(), z.union([z.string(), z.number()])).optional(),
-  logs: z.record(z.string(), z.union([z.string(), z.number()])).optional()
+  logs: z.record(z.string(), z.union([z.string(), z.number()])).optional(),
+  git: GitSchema.optional()
 });
 function parseConfig(raw) {
   return ConfigSchema.parse(raw);
 }
 
 // src/core/config.ts
+function interpolateEnvVars(content) {
+  return content.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? "");
+}
 function loadConfig(filePath) {
   if (!fs.existsSync(filePath)) {
     throw new Error(`Config file not found: ${filePath}`);
   }
-  const raw = yaml.load(fs.readFileSync(filePath, "utf8"));
+  const content = fs.readFileSync(filePath, "utf8");
+  const raw = yaml.load(interpolateEnvVars(content));
   return parseConfig(raw);
 }
 
 // src/core/dokku.ts
 import { execa } from "execa";
+import { createHash } from "crypto";
+import * as os from "os";
+import * as path from "path";
 function createRunner(opts = {}) {
   const log = [];
+  const controlPath = opts.host ? path.join(os.tmpdir(), `dc-${createHash("sha1").update(opts.host).digest("hex").slice(0, 16)}.sock`) : null;
+  const sshControlFlags = controlPath ? ["-o", "ControlMaster=auto", "-o", `ControlPath=${controlPath}`, "-o", "ControlPersist=60"] : [];
   async function execDokku(args) {
     if (opts.host) {
       try {
-        const result = await execa("ssh", [`dokku@${opts.host}`, ...args]);
+        const result = await execa("ssh", [...sshControlFlags, `dokku@${opts.host}`, ...args]);
         return { stdout: result.stdout, ok: true };
       } catch (e) {
         return { stdout: e.stdout ?? "", ok: false };
@@ -136,10 +164,80 @@ function createRunner(opts = {}) {
       if (opts.dryRun) return false;
       const { ok } = await execDokku(args);
       return ok;
+    },
+    async close() {
+      if (!opts.host || !controlPath) return;
+      try {
+        await execa("ssh", ["-O", "exit", "-o", `ControlPath=${controlPath}`, `dokku@${opts.host}`]);
+      } catch {
+      }
     }
   };
 }
 
+// src/core/context.ts
+function createContext(runner) {
+  const cache = /* @__PURE__ */ new Map();
+  const commands = [];
+  return {
+    commands,
+    runner,
+    query(...args) {
+      const key = args.join("\0");
+      if (!cache.has(key)) {
+        cache.set(key, runner.query(...args));
+      }
+      return cache.get(key);
+    },
+    check(...args) {
+      return runner.check(...args);
+    },
+    async run(...args) {
+      commands.push(args);
+      await runner.run(...args);
+    },
+    close() {
+      return runner.close();
+    }
+  };
+}
+
+// src/core/change.ts
+function computeChange(before, after) {
+  if (before === null || before === void 0 || after === null || after === void 0) {
+    return { before, after, changed: before !== after };
+  }
+  if (Array.isArray(before) && Array.isArray(after)) {
+    const beforeSet = new Set(before);
+    const afterSet = new Set(after);
+    const added = after.filter((x) => !beforeSet.has(x));
+    const removed = before.filter((x) => !afterSet.has(x));
+    return {
+      before,
+      after,
+      changed: added.length > 0 || removed.length > 0,
+      added,
+      removed
+    };
+  }
+  if (typeof before === "object" && typeof after === "object") {
+    const b = before;
+    const a = after;
+    const allKeys = /* @__PURE__ */ new Set([...Object.keys(b), ...Object.keys(a)]);
+    const added = {};
+    const removed = [];
+    const modified = {};
+    for (const key of allKeys) {
+      if (!(key in b)) added[key] = a[key];
+      else if (!(key in a)) removed.push(key);
+      else if (String(b[key]) !== String(a[key])) modified[key] = a[key];
+    }
+    const changed = Object.keys(added).length > 0 || removed.length > 0 || Object.keys(modified).length > 0;
+    return { before, after, changed, added, removed, modified };
+  }
+  return { before, after, changed: before !== after };
+}
+
 // src/core/logger.ts
 import chalk from "chalk";
 function logAction(context, message) {
@@ -152,68 +250,326 @@ function logSkip() {
   console.log(`... ${chalk.yellow("already configured")}`);
 }
 
-// src/modules/apps.ts
-async function ensureApp(runner, app) {
-  const exists = await runner.check("apps:exists", app);
-  logAction(app, "Creating app");
-  if (exists) {
-    logSkip();
+// src/core/reconcile.ts
+async function reconcile(resource, ctx, target, desired) {
+  if (desired === void 0) return;
+  logAction(target, `${resource.key}`);
+  if (resource.forceApply) {
+    await resource.onChange(ctx, target, { before: void 0, after: desired, changed: true });
+    logDone();
     return;
   }
-  await runner.run("apps:create", app);
-  logDone();
-}
-async function destroyApp(runner, app) {
-  const exists = await runner.check("apps:exists", app);
-  logAction(app, "Destroying app");
-  if (!exists) {
+  const before = await resource.read(ctx, target);
+  const change = computeChange(before, desired);
+  if (!change.changed) {
     logSkip();
     return;
   }
-  await runner.run("apps:destroy", app, "--force");
+  await resource.onChange(ctx, target, change);
   logDone();
 }
-async function exportApps(runner) {
-  const output = await runner.query("apps:list");
-  return output.split("\n").map((s) => s.trim()).filter(
-    (s) => s && !s.startsWith("=====>")
-  );
-}
 
-// src/modules/domains.ts
-async function ensureAppDomains(runner, app, domains) {
-  if (domains === void 0) return;
-  logAction(app, "Configuring domains");
-  if (domains === false) {
-    await runner.run("domains:disable", app);
-    await runner.run("domains:clear", app);
-  } else {
-    await runner.run("domains:enable", app);
-    await runner.run("domains:set", app, ...domains);
+// src/resources/lifecycle.ts
+var Apps = {
+  key: "_app",
+  read: async (ctx, target) => {
+    return ctx.check("apps:exists", target);
+  },
+  onChange: async (ctx, target, { after }) => {
+    if (after) {
+      await ctx.run("apps:create", target);
+    } else {
+      await ctx.run("apps:destroy", target, "--force");
+    }
   }
-  logDone();
+};
+
+// src/resources/lists.ts
+function splitWords(raw) {
+  return raw.split(/\s+/).map((s) => s.trim()).filter(Boolean);
 }
-async function ensureGlobalDomains(runner, domains) {
-  logAction("global", "Configuring domains");
-  if (domains === false) {
-    await runner.run("domains:clear-global");
-  } else {
-    await runner.run("domains:set-global", ...domains);
+function splitLines(raw) {
+  return raw.split("\n").map((s) => s.trim()).filter(Boolean);
+}
+var Ports = {
+  key: "ports",
+  read: async (ctx, target) => {
+    const raw = await ctx.query("ports:report", target, "--ports-map");
+    return splitWords(raw);
+  },
+  onChange: async (ctx, target, change) => {
+    await ctx.run("ports:set", target, ...change.after);
+  }
+};
+var Domains = {
+  key: "domains",
+  read: async (ctx, target) => {
+    const raw = await ctx.query("domains:report", target, "--domains-app-vhosts");
+    return splitLines(raw);
+  },
+  onChange: async (ctx, target, { added, removed }) => {
+    for (const d of removed) await ctx.run("domains:remove", target, d);
+    for (const d of added) await ctx.run("domains:add", target, d);
+  }
+};
+var Storage = {
+  key: "storage",
+  read: async (ctx, target) => {
+    const raw = await ctx.query("storage:report", target, "--storage-mounts");
+    return splitLines(raw);
+  },
+  onChange: async (ctx, target, { added, removed }) => {
+    for (const m of removed) await ctx.run("storage:unmount", target, m);
+    for (const m of added) await ctx.run("storage:mount", target, m);
+  }
+};
+
+// src/resources/parsers.ts
+function parseReport(raw, namespace) {
+  const result = {};
+  const prefix = new RegExp(`^${namespace}\\s+`, "i");
+  for (const line of raw.split("\n")) {
+    if (line.trimStart().startsWith("=====>")) continue;
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1) continue;
+    const rawKey = line.slice(0, colonIdx).trim();
+    if (!rawKey) continue;
+    const value = line.slice(colonIdx + 1).trim();
+    const stripped = rawKey.replace(prefix, "");
+    const key = stripped.toLowerCase().replace(/\s+/g, "-");
+    if (key.startsWith("computed-") || key.startsWith("global-") || key === "last-visited-at") continue;
+    if (!value) continue;
+    result[key] = value;
   }
-  logDone();
+  return result;
 }
-async function exportAppDomains(runner, app) {
-  const enabledRaw = await runner.query("domains:report", app, "--domains-app-enabled");
-  if (enabledRaw.trim() === "false") return false;
-  const raw = await runner.query("domains:report", app, "--domains-app-vhosts");
-  const vhosts = raw.split("\n").map((s) => s.trim()).filter(Boolean);
-  if (vhosts.length === 0) return void 0;
-  return vhosts;
+
+// src/resources/properties.ts
+function propertyResource(opts) {
+  return {
+    key: opts.key,
+    async read(ctx, target) {
+      const raw = await ctx.query(`${opts.namespace}:report`, target);
+      return parseReport(raw, opts.namespace);
+    },
+    async onChange(ctx, target, change) {
+      for (const [key, value] of Object.entries({ ...change.added, ...change.modified })) {
+        await ctx.run(opts.setCmd, target, key, String(value));
+      }
+      if (opts.afterChange) {
+        for (const cmd of opts.afterChange) {
+          await ctx.run(cmd, target);
+        }
+      }
+    }
+  };
 }
+var Nginx = propertyResource({
+  key: "nginx",
+  namespace: "nginx",
+  setCmd: "nginx:set",
+  afterChange: ["proxy:build-config"]
+});
+var Logs = propertyResource({
+  key: "logs",
+  namespace: "logs",
+  setCmd: "logs:set"
+});
+var Registry = propertyResource({
+  key: "registry",
+  namespace: "registry",
+  setCmd: "registry:set"
+});
+var Scheduler = {
+  key: "scheduler",
+  async read(ctx, target) {
+    const raw = await ctx.query("scheduler:report", target);
+    const report = parseReport(raw, "scheduler");
+    return report["selected"] ?? "";
+  },
+  async onChange(ctx, target, change) {
+    await ctx.run("scheduler:set", target, "selected", change.after);
+  }
+};
+
+// src/resources/toggle.ts
+var Proxy = {
+  key: "proxy",
+  read: async (ctx, target) => {
+    const raw = await ctx.query("proxy:report", target, "--proxy-enabled");
+    return raw.trim() === "true";
+  },
+  onChange: async (ctx, target, { after }) => {
+    await ctx.run(after ? "proxy:enable" : "proxy:disable", target);
+  }
+};
+
+// src/resources/config.ts
+var MANAGED_KEYS_VAR = "DOKKU_COMPOSE_MANAGED_KEYS";
+var Config = {
+  key: "env",
+  read: async (ctx, target) => {
+    const managedRaw = await ctx.query("config:get", target, MANAGED_KEYS_VAR);
+    const managedKeys = managedRaw.trim() ? managedRaw.trim().split(",").filter(Boolean) : [];
+    const result = {};
+    if (managedKeys.length > 0) {
+      const raw = await ctx.query("config:export", target, "--format", "shell");
+      for (const line of raw.split("\n")) {
+        const match = line.match(/^export\s+(\w+)=['"]?(.*?)['"]?$/);
+        if (match && managedKeys.includes(match[1])) {
+          result[match[1]] = match[2];
+        }
+      }
+    }
+    return result;
+  },
+  onChange: async (ctx, target, change) => {
+    const { added, removed, modified } = change;
+    if (removed.length > 0) {
+      await ctx.run("config:unset", "--no-restart", target, ...removed);
+    }
+    const toSet = { ...added, ...modified };
+    const allDesiredKeys = Object.keys(change.after);
+    const managedValue = allDesiredKeys.join(",");
+    if (Object.keys(toSet).length > 0 || removed.length > 0) {
+      const pairs = Object.entries(change.after).map(([k, v]) => `${k}=${v}`);
+      await ctx.run(
+        "config:set",
+        "--no-restart",
+        target,
+        ...pairs,
+        `${MANAGED_KEYS_VAR}=${managedValue}`
+      );
+    }
+  }
+};
+
+// src/resources/certs.ts
+var Certs = {
+  key: "ssl",
+  read: async (ctx, target) => {
+    const raw = await ctx.query("certs:report", target, "--ssl-enabled");
+    return raw.trim() === "true";
+  },
+  onChange: async (ctx, target, { before, after }) => {
+    if (after === false && before) {
+      await ctx.run("certs:remove", target);
+    }
+    if (after && typeof after === "object") {
+      await ctx.run("certs:add", target, after.certfile, after.keyfile);
+    }
+  }
+};
+
+// src/resources/builder.ts
+var Builder = {
+  key: "build",
+  forceApply: true,
+  read: async () => ({}),
+  onChange: async (ctx, target, { after }) => {
+    if (after.dockerfile)
+      await ctx.run("builder-dockerfile:set", target, "dockerfile-path", after.dockerfile);
+    if (after.app_json)
+      await ctx.run("app-json:set", target, "appjson-path", after.app_json);
+    if (after.context)
+      await ctx.run("builder:set", target, "build-dir", after.context);
+    if (after.args) {
+      for (const [key, value] of Object.entries(after.args)) {
+        await ctx.run("docker-options:add", target, "build", `--build-arg ${key}=${value}`);
+      }
+    }
+  }
+};
+
+// src/resources/docker-options.ts
+var DockerOptions = {
+  key: "docker_options",
+  forceApply: true,
+  read: async () => ({}),
+  onChange: async (ctx, target, { after }) => {
+    for (const phase of ["build", "deploy", "run"]) {
+      const opts = after[phase];
+      if (!opts || opts.length === 0) continue;
+      await ctx.run("docker-options:clear", target, phase);
+      for (const opt of opts) {
+        await ctx.run("docker-options:add", target, phase, opt);
+      }
+    }
+  }
+};
+
+// src/resources/git.ts
+var Git = {
+  key: "git",
+  read: async (ctx, target) => {
+    const report = await ctx.query("git:report", target, "--git-deploy-branch");
+    return { deploy_branch: report.trim() || void 0 };
+  },
+  onChange: async (ctx, target, { after }) => {
+    if (after.deploy_branch) {
+      await ctx.run("git:set", target, "deploy-branch", after.deploy_branch);
+    }
+  }
+};
+
+// src/resources/checks.ts
+var Checks = {
+  key: "checks",
+  forceApply: true,
+  read: async () => ({}),
+  onChange: async (ctx, target, { after }) => {
+    if (after === false) {
+      await ctx.run("checks:disable", target);
+      return;
+    }
+    if (after.disabled && after.disabled.length > 0) {
+      await ctx.run("checks:disable", target, ...after.disabled);
+    }
+    if (after.skipped && after.skipped.length > 0) {
+      await ctx.run("checks:skip", target, ...after.skipped);
+    }
+    for (const [key, value] of Object.entries(after)) {
+      if (key === "disabled" || key === "skipped") continue;
+      await ctx.run("checks:set", target, key, String(value));
+    }
+  }
+};
+
+// src/resources/network.ts
+var Networks = {
+  key: "networks",
+  read: async (ctx, target) => {
+    const raw = await ctx.query("network:report", target, "--network-attach-post-deploy");
+    return raw.trim() ? raw.trim().split(/\s+/) : [];
+  },
+  onChange: async (ctx, target, { after }) => {
+    await ctx.run("network:set", target, "attach-post-deploy", ...after);
+  }
+};
+var NetworkProps = {
+  key: "network",
+  forceApply: true,
+  read: async () => ({}),
+  onChange: async (ctx, target, { after }) => {
+    if (after.attach_post_create !== void 0 && after.attach_post_create !== false) {
+      const nets = Array.isArray(after.attach_post_create) ? after.attach_post_create : [after.attach_post_create];
+      await ctx.run("network:set", target, "attach-post-create", ...nets);
+    }
+    if (after.initial_network !== void 0 && after.initial_network !== false) {
+      await ctx.run("network:set", target, "initial-network", after.initial_network);
+    }
+    if (after.bind_all_interfaces !== void 0) {
+      await ctx.run("network:set", target, "bind-all-interfaces", String(after.bind_all_interfaces));
+    }
+    if (after.tld !== void 0 && after.tld !== false) {
+      await ctx.run("network:set", target, "tld", after.tld);
+    }
+  }
+};
 
 // src/modules/plugins.ts
-async function ensurePlugins(runner, plugins) {
-  const listOutput = await runner.query("plugin:list");
+async function ensurePlugins(ctx, plugins) {
+  const listOutput = await ctx.query("plugin:list");
   const installedNames = new Set(
     listOutput.split("\n").map((line) => line.trim().split(/\s+/)[0]).filter(Boolean)
   );
@@ -223,511 +579,304 @@ async function ensurePlugins(runner, plugins) {
       logSkip();
       continue;
     }
-    await runner.run("plugin:install", config.url, "--name", name);
+    await ctx.run("plugin:install", config.url, "--name", name);
     logDone();
   }
 }
 
 // src/modules/network.ts
-async function ensureNetworks(runner, networks) {
+async function ensureNetworks(ctx, networks) {
   for (const net of networks) {
     logAction("network", `Creating ${net}`);
-    const exists = await runner.check("network:exists", net);
+    const exists = await ctx.check("network:exists", net);
     if (exists) {
       logSkip();
       continue;
     }
-    await runner.run("network:create", net);
+    await ctx.run("network:create", net);
     logDone();
   }
 }
-async function ensureAppNetworks(runner, app, networks) {
-  if (!networks || networks.length === 0) return;
-  logAction(app, "Setting networks");
-  await runner.run("network:set", app, "attach-post-deploy", ...networks);
-  logDone();
-}
-async function ensureAppNetwork(runner, app, network) {
-  if (!network) return;
-  if (network.attach_post_create !== void 0 && network.attach_post_create !== false) {
-    const nets = Array.isArray(network.attach_post_create) ? network.attach_post_create : [network.attach_post_create];
-    await runner.run("network:set", app, "attach-post-create", ...nets);
-  }
-  if (network.initial_network !== void 0 && network.initial_network !== false) {
-    await runner.run("network:set", app, "initial-network", network.initial_network);
-  }
-  if (network.bind_all_interfaces !== void 0) {
-    await runner.run("network:set", app, "bind-all-interfaces", String(network.bind_all_interfaces));
-  }
-  if (network.tld !== void 0 && network.tld !== false) {
-    await runner.run("network:set", app, "tld", network.tld);
-  }
-}
 var DOCKER_BUILTIN_NETWORKS = /* @__PURE__ */ new Set(["bridge", "host", "none"]);
-async function exportNetworks(runner) {
-  const output = await runner.query("network:list");
+async function exportNetworks(ctx) {
+  const output = await ctx.query("network:list");
   return output.split("\n").map((s) => s.trim()).filter((s) => s && !s.startsWith("=====>") && !DOCKER_BUILTIN_NETWORKS.has(s));
 }
-async function exportAppNetwork(runner, app) {
-  const output = await runner.query("network:report", app);
-  if (!output) return void 0;
-  const result = {};
-  const lines = output.split("\n");
-  for (const line of lines) {
-    const [key, ...valueParts] = line.split(":").map((s) => s.trim());
-    const value = valueParts.join(":").trim();
-    if (!key || !value) continue;
-    if (key === "Network attach post deploy") {
-      result.networks = value.split(" ").filter(Boolean);
-    }
-  }
-  return Object.keys(result).length > 0 ? result : void 0;
-}
 
 // src/modules/services.ts
-async function ensureServices(runner, services) {
+import { createHash as createHash2 } from "crypto";
+function backupHashKey(serviceName) {
+  return "DOKKU_COMPOSE_BACKUP_HASH_" + serviceName.toUpperCase().replace(/-/g, "_");
+}
+function computeBackupHash(backup) {
+  return createHash2("sha256").update(JSON.stringify(backup)).digest("hex");
+}
+async function ensureServices(ctx, services) {
   for (const [name, config] of Object.entries(services)) {
     logAction("services", `Ensuring ${name}`);
-    const exists = await runner.check(`${config.plugin}:exists`, name);
+    const exists = await ctx.check(`${config.plugin}:exists`, name);
     if (exists) {
       logSkip();
       continue;
     }
-    await runner.run(`${config.plugin}:create`, name);
+    const args = [`${config.plugin}:create`, name];
+    if (config.image) args.push("--image", config.image);
+    if (config.version) args.push("--image-version", config.version);
+    await ctx.run(...args);
+    logDone();
+  }
+}
+async function ensureServiceBackups(ctx, services) {
+  for (const [name, config] of Object.entries(services)) {
+    if (!config.backup) continue;
+    logAction("services", `Configuring backup for ${name}`);
+    const hashKey = backupHashKey(name);
+    const desiredHash = computeBackupHash(config.backup);
+    const storedHash = await ctx.query("config:get", "--global", hashKey);
+    if (storedHash === desiredHash) {
+      logSkip();
+      continue;
+    }
+    const { schedule, bucket, auth } = config.backup;
+    await ctx.run(`${config.plugin}:backup-deauth`, name);
+    await ctx.run(
+      `${config.plugin}:backup-auth`,
+      name,
+      auth.access_key_id,
+      auth.secret_access_key,
+      auth.region,
+      auth.signature_version,
+      auth.endpoint
+    );
+    await ctx.run(`${config.plugin}:backup-schedule`, name, schedule, bucket);
+    await ctx.run("config:set", "--global", `${hashKey}=${desiredHash}`);
     logDone();
   }
 }
-async function ensureAppLinks(runner, app, desiredLinks, allServices) {
+async function ensureAppLinks(ctx, app, desiredLinks, allServices) {
   const desiredSet = new Set(desiredLinks);
   for (const [serviceName, serviceConfig] of Object.entries(allServices)) {
-    const isLinked = await runner.check(`${serviceConfig.plugin}:linked`, serviceName, app);
+    const isLinked = await ctx.check(`${serviceConfig.plugin}:linked`, serviceName, app);
     const isDesired = desiredSet.has(serviceName);
     if (isDesired && !isLinked) {
       logAction(app, `Linking ${serviceName}`);
-      await runner.run(`${serviceConfig.plugin}:link`, serviceName, app, "--no-restart");
+      await ctx.run(`${serviceConfig.plugin}:link`, serviceName, app, "--no-restart");
       logDone();
     } else if (!isDesired && isLinked) {
       logAction(app, `Unlinking ${serviceName}`);
-      await runner.run(`${serviceConfig.plugin}:unlink`, serviceName, app, "--no-restart");
+      await ctx.run(`${serviceConfig.plugin}:unlink`, serviceName, app, "--no-restart");
       logDone();
     }
   }
 }
-async function destroyAppLinks(runner, app, links, allServices) {
+async function destroyAppLinks(ctx, app, links, allServices) {
   for (const serviceName of links) {
     const config = allServices[serviceName];
     if (!config) continue;
-    const isLinked = await runner.check(`${config.plugin}:linked`, serviceName, app);
+    const isLinked = await ctx.check(`${config.plugin}:linked`, serviceName, app);
     if (isLinked) {
-      await runner.run(`${config.plugin}:unlink`, serviceName, app, "--no-restart");
+      await ctx.run(`${config.plugin}:unlink`, serviceName, app, "--no-restart");
     }
   }
 }
-async function destroyServices(runner, services) {
+async function destroyServices(ctx, services) {
   for (const [name, config] of Object.entries(services)) {
     logAction("services", `Destroying ${name}`);
-    const exists = await runner.check(`${config.plugin}:exists`, name);
+    const exists = await ctx.check(`${config.plugin}:exists`, name);
     if (!exists) {
       logSkip();
       continue;
     }
-    await runner.run(`${config.plugin}:destroy`, name, "--force");
+    await ctx.run(`${config.plugin}:destroy`, name, "--force");
     logDone();
   }
 }
-async function exportServices(_runner) {
+async function exportServices(_ctx) {
   return {};
 }
-async function exportAppLinks(runner, app, services) {
+async function exportAppLinks(ctx, app, services) {
   const linked = [];
   for (const [serviceName, config] of Object.entries(services)) {
-    const isLinked = await runner.check(`${config.plugin}:linked`, serviceName, app);
+    const isLinked = await ctx.check(`${config.plugin}:linked`, serviceName, app);
     if (isLinked) linked.push(serviceName);
   }
   return linked;
 }
 
-// src/modules/proxy.ts
-async function ensureAppProxy(runner, app, enabled) {
-  logAction(app, `Setting proxy enabled=${enabled}`);
-  const currentRaw = await runner.query("proxy:report", app, "--proxy-enabled");
-  const current = currentRaw.trim() === "true";
-  if (current === enabled) {
-    logSkip();
-    return;
-  }
-  if (enabled) {
-    await runner.run("proxy:enable", app);
+// src/modules/domains.ts
+async function ensureGlobalDomains(ctx, domains) {
+  logAction("global", "Configuring domains");
+  if (domains === false) {
+    await ctx.run("domains:clear-global");
   } else {
-    await runner.run("proxy:disable", app);
+    await ctx.run("domains:set-global", ...domains);
   }
   logDone();
 }
-async function exportAppProxy(runner, app) {
-  const raw = await runner.query("proxy:report", app, "--proxy-enabled");
-  const enabled = raw.trim() === "true";
-  if (enabled) return void 0;
-  return { enabled };
-}
 
-// src/modules/ports.ts
-async function ensureAppPorts(runner, app, ports) {
-  logAction(app, "Configuring ports");
-  const currentRaw = await runner.query("ports:report", app, "--ports-map");
-  const current = currentRaw.split(/\s+/).map((s) => s.trim()).filter(Boolean).sort();
-  const desired = [...ports].sort();
-  if (JSON.stringify(current) === JSON.stringify(desired)) {
-    logSkip();
-    return;
-  }
-  await runner.run("ports:set", app, ...ports);
-  logDone();
-}
-async function exportAppPorts(runner, app) {
-  const raw = await runner.query("ports:report", app, "--ports-map");
-  const ports = raw.split(/\s+/).map((s) => s.trim()).filter(Boolean);
-  if (ports.length === 0) return void 0;
-  return ports;
+// src/modules/config.ts
+async function ensureGlobalConfig(ctx, env) {
+  if (env === false) return;
+  const pairs = Object.entries(env).map(([k, v]) => `${k}=${v}`);
+  await ctx.run("config:set", "--global", ...pairs);
 }
 
-// src/modules/certs.ts
-async function ensureAppCerts(runner, app, ssl) {
-  logAction(app, "Configuring SSL");
-  const enabledRaw = await runner.query("certs:report", app, "--ssl-enabled");
-  const enabled = enabledRaw.trim() === "true";
-  if (ssl === false) {
-    if (!enabled) {
-      logSkip();
-      return;
-    }
-    await runner.run("certs:remove", app);
-    logDone();
-    return;
-  }
-  if (ssl === true) {
-    if (enabled) {
-      logSkip();
-      return;
-    }
-    logSkip();
-    return;
-  }
-  if (enabled) {
-    logSkip();
-    return;
-  }
-  await runner.run("certs:add", app, ssl.certfile, ssl.keyfile);
-  logDone();
-}
-async function exportAppCerts(runner, app) {
-  const raw = await runner.query("certs:report", app, "--ssl-enabled");
-  const enabled = raw.trim() === "true";
-  if (!enabled) return void 0;
-  return true;
-}
-
-// src/modules/storage.ts
-async function ensureAppStorage(runner, app, storage) {
-  logAction(app, "Configuring storage");
-  const currentRaw = await runner.query("storage:report", app, "--storage-mounts");
-  const current = currentRaw.split("\n").map((s) => s.trim()).filter(Boolean);
-  const desired = new Set(storage);
-  const currentSet = new Set(current);
-  const toUnmount = current.filter((m) => !desired.has(m));
-  const toMount = storage.filter((m) => !currentSet.has(m));
-  if (toUnmount.length === 0 && toMount.length === 0) {
-    logSkip();
-    return;
-  }
-  for (const mount of toUnmount) {
-    await runner.run("storage:unmount", app, mount);
-  }
-  for (const mount of toMount) {
-    await runner.run("storage:mount", app, mount);
+// src/modules/logs.ts
+async function ensureGlobalLogs(ctx, logs) {
+  for (const [key, value] of Object.entries(logs)) {
+    await ctx.run("logs:set", "--global", key, String(value));
   }
-  logDone();
-}
-async function exportAppStorage(runner, app) {
-  const raw = await runner.query("storage:report", app, "--storage-mounts");
-  const mounts = raw.split("\n").map((s) => s.trim()).filter(Boolean);
-  if (mounts.length === 0) return void 0;
-  return mounts;
 }
 
 // src/modules/nginx.ts
-async function ensureAppNginx(runner, app, nginx) {
-  for (const [key, value] of Object.entries(nginx)) {
-    await runner.run("nginx:set", app, key, String(value));
-  }
-}
-async function ensureGlobalNginx(runner, nginx) {
+async function ensureGlobalNginx(ctx, nginx) {
   for (const [key, value] of Object.entries(nginx)) {
-    await runner.run("nginx:set", "--global", key, String(value));
+    await ctx.run("nginx:set", "--global", key, String(value));
   }
 }
-async function exportAppNginx(runner, app) {
-  const raw = await runner.query("nginx:report", app);
-  if (!raw) return void 0;
-  const result = {};
-  for (const line of raw.split("\n")) {
-    const match = line.match(/^\s*Nginx\s+(.+?):\s*(.+?)\s*$/);
-    if (match) {
-      const key = match[1].toLowerCase().replace(/\s+/g, "-");
-      if (key.startsWith("computed-") || key.startsWith("global-") || key === "last-visited-at") continue;
-      const value = match[2].trim();
-      if (!value) continue;
-      result[key] = value;
-    }
-  }
-  return Object.keys(result).length > 0 ? result : void 0;
-}
-
-// src/modules/checks.ts
-async function ensureAppChecks(runner, app, checks) {
-  logAction(app, "Configuring checks");
-  if (checks === false) {
-    await runner.run("checks:disable", app);
-    logDone();
-    return;
-  }
-  if (checks.disabled && checks.disabled.length > 0) {
-    await runner.run("checks:disable", app, ...checks.disabled);
-  }
-  if (checks.skipped && checks.skipped.length > 0) {
-    await runner.run("checks:skip", app, ...checks.skipped);
-  }
-  for (const [key, value] of Object.entries(checks)) {
-    if (key === "disabled" || key === "skipped") continue;
-    await runner.run("checks:set", app, key, String(value));
-  }
-  logDone();
-}
-async function exportAppChecks(runner, app) {
-  const raw = await runner.query("checks:report", app);
-  if (!raw) return void 0;
-  return void 0;
-}
-
-// src/modules/logs.ts
-async function ensureAppLogs(runner, app, logs) {
-  for (const [key, value] of Object.entries(logs)) {
-    await runner.run("logs:set", app, key, String(value));
-  }
-}
-async function ensureGlobalLogs(runner, logs) {
-  for (const [key, value] of Object.entries(logs)) {
-    await runner.run("logs:set", "--global", key, String(value));
-  }
-}
-async function exportAppLogs(runner, app) {
-  const raw = await runner.query("logs:report", app);
-  if (!raw) return void 0;
-  return void 0;
-}
 
-// src/modules/registry.ts
-async function ensureAppRegistry(runner, app, registry) {
-  for (const [key, value] of Object.entries(registry)) {
-    await runner.run("registry:set", app, key, String(value));
+// src/commands/up.ts
+async function runUp(ctx, config, appFilter) {
+  const apps = appFilter.length > 0 ? appFilter : Object.keys(config.apps);
+  if (config.plugins) await ensurePlugins(ctx, config.plugins);
+  if (config.domains !== void 0) await ensureGlobalDomains(ctx, config.domains);
+  if (config.env !== void 0) await ensureGlobalConfig(ctx, config.env);
+  if (config.logs !== void 0) await ensureGlobalLogs(ctx, config.logs);
+  if (config.nginx !== void 0) await ensureGlobalNginx(ctx, config.nginx);
+  if (config.networks) await ensureNetworks(ctx, config.networks);
+  if (config.services) await ensureServices(ctx, config.services);
+  if (config.services) await ensureServiceBackups(ctx, config.services);
+  for (const app of apps) {
+    const appConfig = config.apps[app];
+    if (!appConfig) continue;
+    await reconcile(Apps, ctx, app, true);
+    await reconcile(Domains, ctx, app, appConfig.domains);
+    await reconcile(Networks, ctx, app, appConfig.networks);
+    await reconcile(NetworkProps, ctx, app, appConfig.network);
+    await reconcile(Proxy, ctx, app, appConfig.proxy?.enabled);
+    await reconcile(Ports, ctx, app, appConfig.ports);
+    if (config.services) {
+      await ensureAppLinks(ctx, app, appConfig.links ?? [], config.services);
+    }
+    await reconcile(Certs, ctx, app, appConfig.ssl);
+    await reconcile(Storage, ctx, app, appConfig.storage);
+    await reconcile(Nginx, ctx, app, appConfig.nginx);
+    await reconcile(Checks, ctx, app, appConfig.checks);
+    await reconcile(Logs, ctx, app, appConfig.logs);
+    await reconcile(Registry, ctx, app, appConfig.registry);
+    await reconcile(Scheduler, ctx, app, appConfig.scheduler);
+    await reconcile(Config, ctx, app, appConfig.env);
+    await reconcile(Builder, ctx, app, appConfig.build);
+    await reconcile(Git, ctx, app, appConfig.git ?? config.git);
+    await reconcile(DockerOptions, ctx, app, appConfig.docker_options);
   }
 }
-async function exportAppRegistry(runner, app) {
-  const raw = await runner.query("registry:report", app);
-  if (!raw) return void 0;
-  return void 0;
-}
 
-// src/modules/scheduler.ts
-async function ensureAppScheduler(runner, app, scheduler) {
-  logAction(app, `Setting scheduler to ${scheduler}`);
-  const current = await runner.query("scheduler:report", app, "--scheduler-selected");
-  if (current.trim() === scheduler) {
+// src/modules/apps.ts
+async function destroyApp(ctx, app) {
+  const exists = await ctx.check("apps:exists", app);
+  logAction(app, "Destroying app");
+  if (!exists) {
     logSkip();
     return;
   }
-  await runner.run("scheduler:set", app, "selected", scheduler);
+  await ctx.run("apps:destroy", app, "--force");
   logDone();
 }
-async function exportAppScheduler(runner, app) {
-  const raw = await runner.query("scheduler:report", app, "--scheduler-selected");
-  const scheduler = raw.trim();
-  if (!scheduler || scheduler === "docker-local") return void 0;
-  return scheduler;
-}
-
-// src/modules/config.ts
-var MANAGED_KEYS_VAR = "DOKKU_COMPOSE_MANAGED_KEYS";
-async function ensureAppConfig(runner, app, env) {
-  logAction(app, "Configuring env vars");
-  if (env === false) {
-    logSkip();
-    return;
-  }
-  const prevManagedRaw = await runner.query("config:get", app, MANAGED_KEYS_VAR);
-  const prevManaged = prevManagedRaw.trim() ? prevManagedRaw.trim().split(",").filter(Boolean) : [];
-  const desiredKeys = Object.keys(env);
-  const toUnset = prevManaged.filter((k) => !desiredKeys.includes(k));
-  if (toUnset.length > 0) {
-    await runner.run("config:unset", "--no-restart", app, ...toUnset);
-  }
-  const pairs = Object.entries(env).map(([k, v]) => `${k}=${v}`);
-  const newManagedKeys = desiredKeys.join(",");
-  await runner.run(
-    "config:set",
-    "--no-restart",
-    app,
-    ...pairs,
-    `${MANAGED_KEYS_VAR}=${newManagedKeys}`
+async function exportApps(ctx) {
+  const output = await ctx.query("apps:list");
+  return output.split("\n").map((s) => s.trim()).filter(
+    (s) => s && !s.startsWith("=====>")
   );
-  logDone();
-}
-async function ensureGlobalConfig(runner, env) {
-  if (env === false) return;
-  const pairs = Object.entries(env).map(([k, v]) => `${k}=${v}`);
-  await runner.run("config:set", "--global", ...pairs);
-}
-async function exportAppConfig(runner, app) {
-  const raw = await runner.query("config:export", app, "--format", "shell");
-  if (!raw) return void 0;
-  const result = {};
-  for (const line of raw.split("\n")) {
-    const match = line.match(/^export\s+(\w+)=['"]?(.*?)['"]?$/);
-    if (match && match[1] !== MANAGED_KEYS_VAR) {
-      result[match[1]] = match[2];
-    }
-  }
-  return Object.keys(result).length > 0 ? result : void 0;
-}
-
-// src/modules/builder.ts
-async function ensureAppBuilder(runner, app, build) {
-  if (build.dockerfile) {
-    await runner.run("builder-dockerfile:set", app, "dockerfile-path", build.dockerfile);
-  }
-  if (build.app_json) {
-    await runner.run("app-json:set", app, "appjson-path", build.app_json);
-  }
-  if (build.context) {
-    await runner.run("builder:set", app, "build-dir", build.context);
-  }
-  if (build.args && Object.keys(build.args).length > 0) {
-    for (const [key, value] of Object.entries(build.args)) {
-      await runner.run("docker-options:add", app, "build", `--build-arg ${key}=${value}`);
-    }
-  }
-}
-
-// src/modules/docker-options.ts
-async function ensureAppDockerOptions(runner, app, options) {
-  const phases = ["build", "deploy", "run"];
-  for (const phase of phases) {
-    const opts = options[phase];
-    if (!opts || opts.length === 0) continue;
-    await runner.run("docker-options:clear", app, phase);
-    for (const opt of opts) {
-      await runner.run("docker-options:add", app, phase, opt);
-    }
-  }
-}
-
-// src/commands/up.ts
-async function runUp(runner, config, appFilter) {
-  const apps = appFilter.length > 0 ? appFilter : Object.keys(config.apps);
-  if (config.plugins) await ensurePlugins(runner, config.plugins);
-  if (config.domains !== void 0) await ensureGlobalDomains(runner, config.domains);
-  if (config.env !== void 0) await ensureGlobalConfig(runner, config.env);
-  if (config.logs !== void 0) await ensureGlobalLogs(runner, config.logs);
-  if (config.nginx !== void 0) await ensureGlobalNginx(runner, config.nginx);
-  if (config.networks) await ensureNetworks(runner, config.networks);
-  if (config.services) await ensureServices(runner, config.services);
-  for (const app of apps) {
-    const appConfig = config.apps[app];
-    if (!appConfig) continue;
-    await ensureApp(runner, app);
-    await ensureAppDomains(runner, app, appConfig.domains);
-    if (config.services) await ensureAppLinks(runner, app, appConfig.links ?? [], config.services);
-    await ensureAppNetworks(runner, app, appConfig.networks);
-    await ensureAppNetwork(runner, app, appConfig.network);
-    if (appConfig.proxy) await ensureAppProxy(runner, app, appConfig.proxy.enabled);
-    if (appConfig.ports) await ensureAppPorts(runner, app, appConfig.ports);
-    if (appConfig.ssl !== void 0) await ensureAppCerts(runner, app, appConfig.ssl);
-    if (appConfig.storage) await ensureAppStorage(runner, app, appConfig.storage);
-    if (appConfig.nginx) await ensureAppNginx(runner, app, appConfig.nginx);
-    if (appConfig.checks !== void 0) await ensureAppChecks(runner, app, appConfig.checks);
-    if (appConfig.logs) await ensureAppLogs(runner, app, appConfig.logs);
-    if (appConfig.registry) await ensureAppRegistry(runner, app, appConfig.registry);
-    if (appConfig.scheduler) await ensureAppScheduler(runner, app, appConfig.scheduler);
-    if (appConfig.env !== void 0) await ensureAppConfig(runner, app, appConfig.env);
-    if (appConfig.build) await ensureAppBuilder(runner, app, appConfig.build);
-    if (appConfig.docker_options) await ensureAppDockerOptions(runner, app, appConfig.docker_options);
-  }
 }
 
 // src/commands/down.ts
-async function runDown(runner, config, appFilter, opts) {
+async function runDown(ctx, config, appFilter, opts) {
   const apps = appFilter.length > 0 ? appFilter : Object.keys(config.apps);
   for (const app of apps) {
     const appConfig = config.apps[app];
     if (!appConfig) continue;
     if (config.services && appConfig.links) {
-      await destroyAppLinks(runner, app, appConfig.links, config.services);
+      await destroyAppLinks(ctx, app, appConfig.links, config.services);
     }
-    await destroyApp(runner, app);
+    await destroyApp(ctx, app);
   }
   if (config.services) {
-    await destroyServices(runner, config.services);
+    await destroyServices(ctx, config.services);
   }
   if (config.networks) {
     for (const net of config.networks) {
       logAction("network", `Destroying ${net}`);
-      const exists = await runner.check("network:exists", net);
+      const exists = await ctx.check("network:exists", net);
       if (!exists) {
         logSkip();
         continue;
       }
-      await runner.run("network:destroy", net, "--force");
+      await ctx.run("network:destroy", net, "--force");
       logDone();
     }
   }
 }
 
+// src/resources/index.ts
+var NETWORKING_RESOURCES = [
+  Domains,
+  Networks,
+  NetworkProps,
+  Proxy,
+  Ports
+];
+var CONFIG_RESOURCES = [
+  Certs,
+  Storage,
+  Nginx,
+  Checks,
+  Logs,
+  Registry,
+  Scheduler,
+  Config
+];
+var BUILD_RESOURCES = [
+  Builder,
+  Git,
+  DockerOptions
+];
+var ALL_APP_RESOURCES = [
+  ...NETWORKING_RESOURCES,
+  ...CONFIG_RESOURCES,
+  ...BUILD_RESOURCES
+];
+
 // src/commands/export.ts
-async function runExport(runner, opts) {
+async function runExport(ctx, opts) {
   const config = { apps: {} };
-  const apps = opts.appFilter?.length ? opts.appFilter : await exportApps(runner);
-  const networks = await exportNetworks(runner);
+  const versionOutput = await ctx.query("version");
+  const versionMatch = versionOutput.match(/(\d+\.\d+\.\d+)/);
+  if (versionMatch) config.dokku = { version: versionMatch[1] };
+  const apps = opts.appFilter?.length ? opts.appFilter : await exportApps(ctx);
+  const networks = await exportNetworks(ctx);
   if (networks.length > 0) config.networks = networks;
-  const services = await exportServices(runner);
+  const services = await exportServices(ctx);
   if (Object.keys(services).length > 0) config.services = services;
   for (const app of apps) {
     const appConfig = {};
-    const domains = await exportAppDomains(runner, app);
-    if (domains !== void 0) appConfig.domains = domains;
-    const links = await exportAppLinks(runner, app, services);
-    if (links.length > 0) appConfig.links = links;
-    const ports = await exportAppPorts(runner, app);
-    if (ports?.length) appConfig.ports = ports;
-    const proxy = await exportAppProxy(runner, app);
-    if (proxy !== void 0) appConfig.proxy = proxy;
-    const ssl = await exportAppCerts(runner, app);
-    if (ssl !== void 0) appConfig.ssl = ssl;
-    const storage = await exportAppStorage(runner, app);
-    if (storage?.length) appConfig.storage = storage;
-    const nginx = await exportAppNginx(runner, app);
-    if (nginx && Object.keys(nginx).length) appConfig.nginx = nginx;
-    const checks = await exportAppChecks(runner, app);
-    if (checks !== void 0) appConfig.checks = checks;
-    const logs = await exportAppLogs(runner, app);
-    if (logs && Object.keys(logs).length) appConfig.logs = logs;
-    const registry = await exportAppRegistry(runner, app);
-    if (registry && Object.keys(registry).length) appConfig.registry = registry;
-    const scheduler = await exportAppScheduler(runner, app);
-    if (scheduler) appConfig.scheduler = scheduler;
-    const networkCfg = await exportAppNetwork(runner, app);
-    if (networkCfg?.networks?.length) appConfig.networks = networkCfg.networks;
-    if (networkCfg?.network) appConfig.network = networkCfg.network;
-    const env = await exportAppConfig(runner, app);
-    if (env && Object.keys(env).length) appConfig.env = env;
+    for (const resource of ALL_APP_RESOURCES) {
+      if (resource.key.startsWith("_")) continue;
+      if (resource.forceApply) continue;
+      const value = await resource.read(ctx, app);
+      if (value === void 0 || value === null || value === "") continue;
+      if (Array.isArray(value) && value.length === 0) continue;
+      if (typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0) continue;
+      if (resource.key === "proxy") {
+        appConfig.proxy = { enabled: value };
+      } else {
+        appConfig[resource.key] = value;
+      }
+    }
+    if (Object.keys(services).length > 0) {
+      const links = await exportAppLinks(ctx, app, services);
+      if (links.length > 0) appConfig.links = links;
+    }
     config.apps[app] = appConfig;
   }
   return config;
@@ -735,52 +884,38 @@ async function runExport(runner, opts) {
 
 // src/commands/diff.ts
 import chalk2 from "chalk";
-function computeDiff(desired, current) {
+async function computeDiff(ctx, config) {
   const result = { apps: {}, services: {}, inSync: true };
-  for (const [app, desiredApp] of Object.entries(desired.apps)) {
-    const currentApp = current.apps[app] ?? {};
+  for (const [app, appConfig] of Object.entries(config.apps)) {
     const appDiff = {};
-    const features = [
-      "domains",
-      "ports",
-      "env",
-      "ssl",
-      "storage",
-      "nginx",
-      "logs",
-      "registry",
-      "scheduler",
-      "checks",
-      "networks",
-      "proxy",
-      "links"
-    ];
-    for (const feature of features) {
-      const d = desiredApp[feature];
-      const c = currentApp[feature];
-      if (d === void 0) continue;
-      const dStr = JSON.stringify(d);
-      const cStr = JSON.stringify(c);
-      if (c === void 0) {
-        appDiff[feature] = { status: "missing", desired: d, current: void 0 };
-        result.inSync = false;
-      } else if (dStr !== cStr) {
-        appDiff[feature] = { status: "changed", desired: d, current: c };
+    for (const resource of ALL_APP_RESOURCES) {
+      if (resource.key.startsWith("_")) continue;
+      if (resource.forceApply) continue;
+      let desired;
+      if (resource.key === "proxy") {
+        desired = appConfig.proxy?.enabled;
+      } else {
+        desired = appConfig[resource.key];
+      }
+      if (desired === void 0) continue;
+      const current = await resource.read(ctx, app);
+      const change = computeChange(current, desired);
+      if (!change.changed) {
+        appDiff[resource.key] = { status: "in-sync", desired, current };
+      } else if (current === null || current === void 0 || Array.isArray(current) && current.length === 0 || typeof current === "object" && Object.keys(current).length === 0) {
+        appDiff[resource.key] = { status: "missing", desired, current };
         result.inSync = false;
       } else {
-        appDiff[feature] = { status: "in-sync", desired: d, current: c };
+        appDiff[resource.key] = { status: "changed", desired, current };
+        result.inSync = false;
       }
     }
     result.apps[app] = appDiff;
   }
-  for (const [svc] of Object.entries(desired.services ?? {})) {
-    const exists = current.services?.[svc];
-    if (!exists) {
-      result.services[svc] = { status: "missing" };
-      result.inSync = false;
-    } else {
-      result.services[svc] = { status: "in-sync" };
-    }
+  for (const [svc, svcConfig] of Object.entries(config.services ?? {})) {
+    const exists = await ctx.check(`${svcConfig.plugin}:exists`, svc);
+    result.services[svc] = { status: exists ? "in-sync" : "missing" };
+    if (!exists) result.inSync = false;
   }
   return result;
 }
@@ -893,7 +1028,9 @@ function validate(filePath) {
 }
 
 // src/index.ts
-var program = new Command().name("dokku-compose").version("0.3.0");
+var require2 = createRequire(import.meta.url);
+var { version } = require2("../package.json");
+var program = new Command().name("dokku-compose").version(version);
 function makeRunner(opts) {
   return createRunner({
     host: process.env.DOKKU_HOST,
@@ -903,10 +1040,15 @@ function makeRunner(opts) {
 program.command("up [apps...]").description("Create/update apps and services to match config").option("-f, --file <path>", "Config file", "dokku-compose.yml").option("--dry-run", "Print commands without executing").option("--fail-fast", "Stop on first error").action(async (apps, opts) => {
   const config = loadConfig(opts.file);
   const runner = makeRunner(opts);
-  await runUp(runner, config, apps);
-  if (opts.dryRun) {
-    console.log("\n# Commands that would run:");
-    for (const cmd of runner.dryRunLog) console.log(`dokku ${cmd}`);
+  const ctx = createContext(runner);
+  try {
+    await runUp(ctx, config, apps);
+    if (opts.dryRun) {
+      console.log("\n# Commands that would run:");
+      for (const cmd of runner.dryRunLog) console.log(`dokku ${cmd}`);
+    }
+  } finally {
+    await ctx.close();
   }
 });
 program.command("down [apps...]").description("Destroy apps and services (requires --force)").option("-f, --file <path>", "Config file", "dokku-compose.yml").option("--force", "Required to destroy apps").action(async (apps, opts) => {
@@ -916,7 +1058,12 @@ program.command("down [apps...]").description("Destroy apps and services (requir
   }
   const config = loadConfig(opts.file);
   const runner = makeRunner({});
-  await runDown(runner, config, apps, { force: true });
+  const ctx = createContext(runner);
+  try {
+    await runDown(ctx, config, apps, { force: true });
+  } finally {
+    await ctx.close();
+  }
 });
 program.command("validate [file]").description("Validate dokku-compose.yml without touching the server").action((file = "dokku-compose.yml") => {
   const result = validate(file);
@@ -936,33 +1083,44 @@ ${result.errors.length} error(s), ${result.warnings.length} warning(s)`);
 });
 program.command("export").description("Export server state to dokku-compose.yml format").option("--app <app>", "Export only a specific app").option("-o, --output <path>", "Write to file instead of stdout").action(async (opts) => {
   const runner = makeRunner({});
-  const result = await runExport(runner, {
-    appFilter: opts.app ? [opts.app] : void 0
-  });
-  const out = yaml3.dump(result, { lineWidth: 120 });
-  if (opts.output) {
-    fs3.writeFileSync(opts.output, out);
-    console.error(`Written to ${opts.output}`);
-  } else {
-    process.stdout.write(out);
+  const ctx = createContext(runner);
+  try {
+    const result = await runExport(ctx, {
+      appFilter: opts.app ? [opts.app] : void 0
+    });
+    const out = yaml3.dump(result, { lineWidth: 120 });
+    if (opts.output) {
+      fs3.writeFileSync(opts.output, out);
+      console.error(`Written to ${opts.output}`);
+    } else {
+      process.stdout.write(out);
+    }
+  } finally {
+    await ctx.close();
   }
 });
 program.command("diff").description("Show what is out of sync between config and server").option("-f, --file <path>", "Config file", "dokku-compose.yml").option("--verbose", "Show git-style +/- diff").action(async (opts) => {
   const desired = loadConfig(opts.file);
   const runner = makeRunner({});
-  const current = await runExport(runner, {
-    appFilter: Object.keys(desired.apps)
-  });
-  const diff = computeDiff(desired, current);
-  const output = opts.verbose ? formatVerbose(diff) : formatSummary(diff);
-  process.stdout.write(output);
-  process.exit(diff.inSync ? 0 : 1);
+  const ctx = createContext(runner);
+  try {
+    const diff = await computeDiff(ctx, desired);
+    const output = opts.verbose ? formatVerbose(diff) : formatSummary(diff);
+    process.stdout.write(output);
+    process.exit(diff.inSync ? 0 : 1);
+  } finally {
+    await ctx.close();
+  }
 });
 program.command("ps [apps...]").description("Show status of configured apps").option("-f, --file <path>", "Config file", "dokku-compose.yml").action(async (apps, opts) => {
   const config = loadConfig(opts.file);
   const runner = makeRunner({});
-  const { runPs } = await import("./ps-33II4UU3.js");
-  await runPs(runner, config, apps);
+  try {
+    const { runPs } = await import("./ps-33II4UU3.js");
+    await runPs(runner, config, apps);
+  } finally {
+    await runner.close();
+  }
 });
 program.command("init [apps...]").description("Create a starter dokku-compose.yml").option("-f, --file <path>", "Config file", "dokku-compose.yml").action(async (apps, opts) => {
   const { runInit } = await import("./init-GIXEVLNW.js");