@envsync-cloud/deploy 0.21.0 → 0.21.2

package/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
+import { createHash as createHash3, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
 import { spawnSync } from "child_process";
-import fs4 from "fs";
+import fs5 from "fs";
 import path4 from "path";
 import readline2 from "readline";
 import chalk from "chalk";
@@ -284,6 +284,16 @@ function formatDeploymentPlan(plan, format = "yaml") {
 }
 
 // src/render.ts
+import { createHash } from "crypto";
+import fs2 from "fs";
+function swarmConfigObjectName(stackName, logical, filePath, fallbackVersion) {
+  let token = fallbackVersion.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_|_$/g, "") || "v";
+  try {
+    token = createHash("sha256").update(fs2.readFileSync(filePath)).digest("hex").slice(0, 12);
+  } catch {
+  }
+  return `${stackName}_${logical}_${token}`;
+}
 function domainMap(rootDomain) {
   return {
     landing: rootDomain,
@@ -537,7 +547,7 @@ function renderTraefikDynamicConfig(config, generated) {
   const landingEnabled = false;
   const managementEnabled = !isOssConfig(config);
   const otelAllowedOrigins = [
-    ...landingEnabled ? publicHttpsOriginVariants(config, hosts.landing) : [],
+    ...publicHttpsOriginVariants(config, hosts.landing),
     ...publicHttpsOriginVariants(config, hosts.app)
   ];
   return [
@@ -925,6 +935,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const apiLicenseVolume = managementEnabled ? "\n    volumes:\n      - /etc/envsync/license:/etc/envsync/license:ro" : "";
   const deployment = createSteadyApiDeploymentState(config, generated);
   const stackName = config.services.stack_name;
+  const configName = (logical, filePath) => swarmConfigObjectName(stackName, logical, filePath, config.release.version);
   const s3RouterName = `${stackName}-s3-router`;
   const s3ServiceName = `${stackName}-s3-service`;
   const s3ConsoleRouterName = `${stackName}-s3-console-router`;
@@ -1216,56 +1227,62 @@ volumes:
 
 configs:
   keycloak_realm:
+    name: ${configName("keycloak_realm", paths.keycloakRealmFile)}
     file: ${paths.keycloakRealmFile}
   clickstack_clickhouse_conf:
+    name: ${configName("clickstack_clickhouse_conf", paths.clickstackClickhouseConf)}
     file: ${paths.clickstackClickhouseConf}
   otel_agent_conf:
+    name: ${configName("otel_agent_conf", paths.otelAgentConf)}
     file: ${paths.otelAgentConf}
 ${landingEnabled ? `  nginx_landing_conf:
+    name: ${configName("nginx_landing_conf", paths.nginxLandingConf)}
     file: ${paths.nginxLandingConf}
 ` : ""}
   nginx_web_conf:
+    name: ${configName("nginx_web_conf", paths.nginxWebConf)}
     file: ${paths.nginxWebConf}
   nginx_api_maintenance_conf:
+    name: ${configName("nginx_api_maintenance_conf", paths.nginxApiMaintenanceConf)}
     file: ${paths.nginxApiMaintenanceConf}
 `.trimStart();
 }
 
 // src/static-bundle.ts
-import fs2 from "fs";
+import fs3 from "fs";
 import path2 from "path";
 function exists(target) {
-  return fs2.existsSync(target);
+  return fs3.existsSync(target);
 }
 function normalizeExtractedStaticBundle(kind, targetDir) {
   const directIndex = path2.join(targetDir, "index.html");
   if (exists(directIndex)) {
     return;
   }
-  const childDirs = fs2.readdirSync(targetDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path2.join(targetDir, entry.name));
+  const childDirs = fs3.readdirSync(targetDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path2.join(targetDir, entry.name));
   const candidateRoots = childDirs.filter((dir) => exists(path2.join(dir, "index.html")));
   if (candidateRoots.length !== 1) {
     return;
   }
   const nestedRoot = candidateRoots[0];
-  for (const entry of fs2.readdirSync(nestedRoot)) {
-    fs2.cpSync(path2.join(nestedRoot, entry), path2.join(targetDir, entry), { recursive: true });
+  for (const entry of fs3.readdirSync(nestedRoot)) {
+    fs3.cpSync(path2.join(nestedRoot, entry), path2.join(targetDir, entry), { recursive: true });
   }
-  fs2.rmSync(nestedRoot, { recursive: true, force: true });
+  fs3.rmSync(nestedRoot, { recursive: true, force: true });
 }
 function validateStaticBundle(kind, targetDir) {
   if (exists(path2.join(targetDir, "index.html"))) {
     return;
   }
-  const entries = exists(targetDir) ? fs2.readdirSync(targetDir).slice(0, 20).join(", ") : "";
+  const entries = exists(targetDir) ? fs3.readdirSync(targetDir).slice(0, 20).join(", ") : "";
   throw new Error(
     `Invalid ${kind} static bundle at ${targetDir}: missing index.html${entries ? `. Found: ${entries}` : ""}`
   );
 }
 
 // src/org-setup.ts
-import { createHash, randomBytes } from "crypto";
-import fs3 from "fs";
+import { createHash as createHash2, randomBytes } from "crypto";
+import fs4 from "fs";
 import path3 from "path";
 import readline from "readline";
 var SETUP_TOKEN_HEADER = "X-EnvSync-Setup-Token";
@@ -1275,33 +1292,33 @@ function generateSetupToken() {
 function ensureSetupTokenFile(tokenFile, existingToken) {
   if (existingToken?.trim()) {
     const dir2 = path3.dirname(tokenFile);
-    fs3.mkdirSync(dir2, { recursive: true, mode: 448 });
-    fs3.writeFileSync(tokenFile, `${existingToken.trim()}
+    fs4.mkdirSync(dir2, { recursive: true, mode: 448 });
+    fs4.writeFileSync(tokenFile, `${existingToken.trim()}
 `, { mode: 384 });
     return existingToken.trim();
   }
-  if (fs3.existsSync(tokenFile)) {
-    const fromFile = fs3.readFileSync(tokenFile, "utf8").trim();
+  if (fs4.existsSync(tokenFile)) {
+    const fromFile = fs4.readFileSync(tokenFile, "utf8").trim();
     if (fromFile.length >= 16) {
       return fromFile;
     }
   }
   const token = generateSetupToken();
   const dir = path3.dirname(tokenFile);
-  fs3.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs3.writeFileSync(tokenFile, `${token}
+  fs4.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs4.writeFileSync(tokenFile, `${token}
 `, { mode: 384 });
   return token;
 }
 function readSetupTokenFile(tokenFile) {
-  if (!fs3.existsSync(tokenFile)) {
+  if (!fs4.existsSync(tokenFile)) {
     return null;
   }
-  const token = fs3.readFileSync(tokenFile, "utf8").trim();
+  const token = fs4.readFileSync(tokenFile, "utf8").trim();
   return token.length >= 16 ? token : null;
 }
 function setupTokenFingerprint(token) {
-  return createHash("sha256").update(token).digest("hex").slice(0, 12);
+  return createHash2("sha256").update(token).digest("hex").slice(0, 12);
 }
 async function fetchSetupStatus(apiBaseUrl, setupToken) {
   const base = apiBaseUrl.replace(/\/$/, "");
@@ -1788,12 +1805,12 @@ ${typeof result.stderr === "string" ? result.stderr : ""}`.toLowerCase();
 ${stderr}` : ""}`);
 }
 function ensureDir(dir) {
-  fs4.mkdirSync(dir, { recursive: true });
+  fs5.mkdirSync(dir, { recursive: true });
 }
 function writeFile(target, content, mode) {
   ensureDir(path4.dirname(target));
-  fs4.writeFileSync(target, content, "utf8");
-  if (mode != null) fs4.chmodSync(target, mode);
+  fs5.writeFileSync(target, content, "utf8");
+  if (mode != null) fs5.chmodSync(target, mode);
 }
 function writeFileMaybe(target, content, mode) {
   if (currentOptions.dryRun) {
@@ -1805,7 +1822,7 @@ function writeFileMaybe(target, content, mode) {
 function ensureEnterpriseLicenseFilesReadable() {
   if (exists2(LICENSE_ROOT)) {
     try {
-      fs4.chmodSync(LICENSE_ROOT, LICENSE_DIR_MODE);
+      fs5.chmodSync(LICENSE_ROOT, LICENSE_DIR_MODE);
     } catch {
       throw new Error(
         `Cannot update directory mode for ${LICENSE_ROOT}. Fix by running: chmod ${LICENSE_DIR_MODE.toString(8)} ${LICENSE_ROOT}`
@@ -1815,7 +1832,7 @@ function ensureEnterpriseLicenseFilesReadable() {
   for (const filePath of [LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE]) {
     if (!exists2(filePath)) continue;
     try {
-      fs4.chmodSync(filePath, LICENSE_FILE_MODE);
+      fs5.chmodSync(filePath, LICENSE_FILE_MODE);
     } catch {
       throw new Error(
         `Cannot update file mode for ${filePath}. Fix by running: chmod ${LICENSE_FILE_MODE.toString(8)} ${filePath}`
@@ -1824,7 +1841,7 @@ function ensureEnterpriseLicenseFilesReadable() {
   }
 }
 function exists2(target) {
-  return fs4.existsSync(target);
+  return fs5.existsSync(target);
 }
 function randomSecret(bytes = 24) {
   return randomBytes2(bytes).toString("hex");
@@ -1834,7 +1851,7 @@ function generateMinikmsSessionSigningKey() {
   return privateKey.export({ type: "pkcs8", format: "pem" }).toString();
 }
 function deterministicInstallFingerprint(rootDomain, stackName) {
-  return `envsync-${createHash2("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
+  return `envsync-${createHash3("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
 }
 function randomStrongPassword() {
   return `EnvSync!${randomBytes2(8).toString("hex")}Aa1`;
@@ -1938,7 +1955,7 @@ function normalizeNetutilsForwards(raw, stackName, enabled) {
 }
 function loadWireguardState() {
   if (!exists2(WIREGUARD_STATE_FILE)) return null;
-  const raw = JSON.parse(fs4.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
+  const raw = JSON.parse(fs5.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
   return {
     private_key: raw.private_key,
     public_key: raw.public_key,
@@ -2122,7 +2139,7 @@ function publicHttpsUrl2(config, host, path5 = "") {
 function getDeployCliVersion() {
   try {
     const packageJsonPath = new URL("../package.json", import.meta.url);
-    const raw = fs4.readFileSync(packageJsonPath, "utf8");
+    const raw = fs5.readFileSync(packageJsonPath, "utf8");
     return JSON.parse(raw).version ?? "0.0.0";
   } catch {
     return process.env.npm_package_version ?? "0.0.0";
@@ -2543,7 +2560,7 @@ function normalizeGeneratedState(raw) {
 }
 function readInternalState() {
   if (!exists2(INTERNAL_CONFIG_JSON)) return null;
-  const raw = JSON.parse(fs4.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
+  const raw = JSON.parse(fs5.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
   return {
     config: raw.config ? normalizeConfig(raw.config) : void 0,
     generated: normalizeGeneratedState(raw.generated)
@@ -2553,7 +2570,7 @@ function loadConfig() {
   if (!exists2(DEPLOY_YAML)) {
     throw new Error(`Missing deploy config at ${DEPLOY_YAML}. Run setup first.`);
   }
-  const raw = fs4.readFileSync(DEPLOY_YAML, "utf8");
+  const raw = fs5.readFileSync(DEPLOY_YAML, "utf8");
   if (raw.trimStart().startsWith("{")) {
     return normalizeConfig(JSON.parse(raw));
   }
@@ -2561,7 +2578,7 @@ function loadConfig() {
 }
 function loadGeneratedEnv() {
   if (!exists2(DEPLOY_ENV)) return {};
-  return parseEnvFile(fs4.readFileSync(DEPLOY_ENV, "utf8"));
+  return parseEnvFile(fs5.readFileSync(DEPLOY_ENV, "utf8"));
 }
 function mergeGeneratedState(env, generated) {
   const normalized = normalizeGeneratedState(generated);
@@ -2849,7 +2866,7 @@ function extractStaticBundle(kind, image, targetDir) {
     logDryRun(`Would extract ${kind} bundle from ${image} into ${targetDir}`);
     return;
   }
-  fs4.rmSync(targetDir, { recursive: true, force: true });
+  fs5.rmSync(targetDir, { recursive: true, force: true });
   ensureDir(targetDir);
   const containerId = run("docker", ["create", image], { quiet: true }).trim();
   try {
@@ -2877,23 +2894,23 @@ function writeFrontendRuntimeConfig(targetDir, runtimeConfig) {
 function syncFrontendReleaseContents(sourceDir, targetDir) {
   ensureDir(targetDir);
   const deferredEntries = /* @__PURE__ */ new Set(["index.html", "runtime-config.js"]);
-  const entries = fs4.readdirSync(sourceDir, { withFileTypes: true });
+  const entries = fs5.readdirSync(sourceDir, { withFileTypes: true });
   for (const entry of entries) {
     if (deferredEntries.has(entry.name)) {
       continue;
     }
-    fs4.cpSync(path4.join(sourceDir, entry.name), path4.join(targetDir, entry.name), {
+    fs5.cpSync(path4.join(sourceDir, entry.name), path4.join(targetDir, entry.name), {
       recursive: true,
       force: true
     });
   }
   const stagedRuntimeConfig = path4.join(sourceDir, "runtime-config.js");
   if (exists2(stagedRuntimeConfig)) {
-    fs4.cpSync(stagedRuntimeConfig, path4.join(targetDir, "runtime-config.js"), { force: true });
+    fs5.cpSync(stagedRuntimeConfig, path4.join(targetDir, "runtime-config.js"), { force: true });
   }
   const stagedIndex = path4.join(sourceDir, "index.html");
   if (exists2(stagedIndex)) {
-    fs4.cpSync(stagedIndex, path4.join(targetDir, "index.html"), { force: true });
+    fs5.cpSync(stagedIndex, path4.join(targetDir, "index.html"), { force: true });
   }
 }
 function activateFrontendRelease(kind, version, runtimeConfig) {
@@ -3291,7 +3308,7 @@ ${trimmed}`
 }
 function readRenderedRuntimeConfig(filePath) {
   if (!exists2(filePath)) return null;
-  const raw = fs4.readFileSync(filePath, "utf8").trim();
+  const raw = fs5.readFileSync(filePath, "utf8").trim();
   const prefix = "window.__ENVSYNC_RUNTIME_CONFIG__ = ";
   if (!raw.startsWith(prefix) || !raw.endsWith(";")) return null;
   try {
@@ -3588,7 +3605,7 @@ function removeTarget(target) {
     logDryRun(`Would remove ${target}`);
     return;
   }
-  fs4.rmSync(target, { recursive: true, force: true });
+  fs5.rmSync(target, { recursive: true, force: true });
   logInfo(`Removed ${target}`);
 }
 async function cmdRemove() {
@@ -4335,7 +4352,7 @@ async function cmdDeploy() {
       sleepSeconds(3);
       promoted = true;
       if (snapshotPath && !currentOptions.dryRun) {
-        fs4.rmSync(snapshotPath, { force: true });
+        fs5.rmSync(snapshotPath, { force: true });
       }
     } catch (error) {
       const rollbackTarget = preUpgradeHead ?? "zero";
@@ -4369,7 +4386,7 @@ ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
       deployRenderedStack(config, "rollback recovery");
       waitForApiSlotHealthy(config, recoveredState.deployment.active_slot);
       if (snapshotPath && !config.upgrade.keep_failed_upgrade_db_snapshot && !currentOptions.dryRun) {
-        fs4.rmSync(snapshotPath, { force: true });
+        fs5.rmSync(snapshotPath, { force: true });
       }
       throw new Error(
         usedSnapshotRestore ? `Deploy failed after DB migration. Previous release was restored using DB snapshot recovery. ${error instanceof Error ? error.message : String(error)}` : `Deploy failed after DB migration. Previous release was restored. ${error instanceof Error ? error.message : String(error)}`
@@ -4490,7 +4507,7 @@ async function cmdHealth(asJson) {
   const hosts = domainMap2(config.domain.root_domain);
   const services = listStackServices(config);
   const stackName = config.services.stack_name;
-  const traefikDynamic = exists2(TRAEFIK_DYNAMIC_FILE) ? fs4.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8") : "";
+  const traefikDynamic = exists2(TRAEFIK_DYNAMIC_FILE) ? fs5.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8") : "";
   const webRuntimeConfig = readRenderedRuntimeConfig(path4.join(RELEASES_ROOT, "web", "current", "runtime-config.js"));
   const landingRuntimeConfig = readRenderedRuntimeConfig(path4.join(RELEASES_ROOT, "landing", "current", "runtime-config.js"));
   const clickstackSearchState = getClickstackSearchState(config);
@@ -4682,8 +4699,8 @@ async function cmdUpgradeDeps() {
   await cmdDeploy();
 }
 function sha256File(filePath) {
-  const hash = createHash2("sha256");
-  hash.update(fs4.readFileSync(filePath));
+  const hash = createHash3("sha256");
+  hash.update(fs5.readFileSync(filePath));
   return hash.digest("hex");
 }
 function parseEnterpriseLicenseBundle(raw) {
@@ -4712,7 +4729,7 @@ function parseEnterpriseLicenseBundle(raw) {
   return candidate;
 }
 function readEnterpriseLicenseBundle(bundlePath) {
-  return parseEnterpriseLicenseBundle(JSON.parse(fs4.readFileSync(bundlePath, "utf8")));
+  return parseEnterpriseLicenseBundle(JSON.parse(fs5.readFileSync(bundlePath, "utf8")));
 }
 function normalizeLicenseServerUrl(serverUrl, route) {
   const trimmed = serverUrl.replace(/\/+$/, "");
@@ -4974,19 +4991,19 @@ async function cmdBackup() {
       logWarn("Backup will temporarily stop the EnvSync stack to capture consistent volume data.");
       stopManagedRuntime(config, "Stopping existing EnvSync services for consistent backup");
     }
-    writeFile(path4.join(staged, "deploy.env"), fs4.readFileSync(DEPLOY_ENV, "utf8"));
-    writeFile(path4.join(staged, "deploy.yaml"), fs4.readFileSync(DEPLOY_YAML, "utf8"));
-    writeFile(path4.join(staged, "config.json"), fs4.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
-    writeFile(path4.join(staged, "versions.lock.json"), fs4.readFileSync(VERSIONS_LOCK, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.bootstrap.base.yaml"), fs4.readFileSync(BOOTSTRAP_BASE_STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.bootstrap.yaml"), fs4.readFileSync(BOOTSTRAP_STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.yaml"), fs4.readFileSync(STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "traefik-dynamic.yaml"), fs4.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8"));
-    writeFile(path4.join(staged, "keycloak-realm.envsync.json"), fs4.readFileSync(KEYCLOAK_REALM_FILE, "utf8"));
-    writeFile(path4.join(staged, "otel-agent.yaml"), fs4.readFileSync(OTEL_AGENT_CONF, "utf8"));
-    writeFile(path4.join(staged, "clickhouse-listen.xml"), fs4.readFileSync(CLICKSTACK_CLICKHOUSE_CONF, "utf8"));
+    writeFile(path4.join(staged, "deploy.env"), fs5.readFileSync(DEPLOY_ENV, "utf8"));
+    writeFile(path4.join(staged, "deploy.yaml"), fs5.readFileSync(DEPLOY_YAML, "utf8"));
+    writeFile(path4.join(staged, "config.json"), fs5.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
+    writeFile(path4.join(staged, "versions.lock.json"), fs5.readFileSync(VERSIONS_LOCK, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.bootstrap.base.yaml"), fs5.readFileSync(BOOTSTRAP_BASE_STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.bootstrap.yaml"), fs5.readFileSync(BOOTSTRAP_STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.yaml"), fs5.readFileSync(STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "traefik-dynamic.yaml"), fs5.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8"));
+    writeFile(path4.join(staged, "keycloak-realm.envsync.json"), fs5.readFileSync(KEYCLOAK_REALM_FILE, "utf8"));
+    writeFile(path4.join(staged, "otel-agent.yaml"), fs5.readFileSync(OTEL_AGENT_CONF, "utf8"));
+    writeFile(path4.join(staged, "clickhouse-listen.xml"), fs5.readFileSync(CLICKSTACK_CLICKHOUSE_CONF, "utf8"));
     if (!isOssConfig2(config) && exists2(LICENSE_ROOT)) {
-      fs4.cpSync(LICENSE_ROOT, path4.join(staged, "license"), { recursive: true });
+      fs5.cpSync(LICENSE_ROOT, path4.join(staged, "license"), { recursive: true });
     }
     const volumesDir = path4.join(staged, "volumes");
     for (const volume of STACK_VOLUMES) {
@@ -5053,21 +5070,21 @@ async function cmdRestore(archivePath, autoDeploy = false) {
   }
   ensureDir(restoreRoot);
   run("bash", ["-lc", `tar -xzf ${JSON.stringify(archivePath)} -C ${JSON.stringify(restoreRoot)}`]);
-  writeFile(DEPLOY_ENV, fs4.readFileSync(path4.join(restoreRoot, "deploy.env"), "utf8"), 384);
-  writeFile(DEPLOY_YAML, fs4.readFileSync(path4.join(restoreRoot, "deploy.yaml"), "utf8"));
-  writeFile(INTERNAL_CONFIG_JSON, fs4.readFileSync(path4.join(restoreRoot, "config.json"), "utf8"));
-  writeFile(VERSIONS_LOCK, fs4.readFileSync(path4.join(restoreRoot, "versions.lock.json"), "utf8"));
-  writeFile(BOOTSTRAP_BASE_STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.base.yaml"), "utf8"));
-  writeFile(BOOTSTRAP_STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.yaml"), "utf8"));
-  writeFile(STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.yaml"), "utf8"));
-  writeFile(TRAEFIK_DYNAMIC_FILE, fs4.readFileSync(path4.join(restoreRoot, "traefik-dynamic.yaml"), "utf8"));
-  writeFile(KEYCLOAK_REALM_FILE, fs4.readFileSync(path4.join(restoreRoot, "keycloak-realm.envsync.json"), "utf8"));
-  writeFile(OTEL_AGENT_CONF, fs4.readFileSync(path4.join(restoreRoot, "otel-agent.yaml"), "utf8"));
-  writeFile(CLICKSTACK_CLICKHOUSE_CONF, fs4.readFileSync(path4.join(restoreRoot, "clickhouse-listen.xml"), "utf8"));
+  writeFile(DEPLOY_ENV, fs5.readFileSync(path4.join(restoreRoot, "deploy.env"), "utf8"), 384);
+  writeFile(DEPLOY_YAML, fs5.readFileSync(path4.join(restoreRoot, "deploy.yaml"), "utf8"));
+  writeFile(INTERNAL_CONFIG_JSON, fs5.readFileSync(path4.join(restoreRoot, "config.json"), "utf8"));
+  writeFile(VERSIONS_LOCK, fs5.readFileSync(path4.join(restoreRoot, "versions.lock.json"), "utf8"));
+  writeFile(BOOTSTRAP_BASE_STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.base.yaml"), "utf8"));
+  writeFile(BOOTSTRAP_STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.yaml"), "utf8"));
+  writeFile(STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.yaml"), "utf8"));
+  writeFile(TRAEFIK_DYNAMIC_FILE, fs5.readFileSync(path4.join(restoreRoot, "traefik-dynamic.yaml"), "utf8"));
+  writeFile(KEYCLOAK_REALM_FILE, fs5.readFileSync(path4.join(restoreRoot, "keycloak-realm.envsync.json"), "utf8"));
+  writeFile(OTEL_AGENT_CONF, fs5.readFileSync(path4.join(restoreRoot, "otel-agent.yaml"), "utf8"));
+  writeFile(CLICKSTACK_CLICKHOUSE_CONF, fs5.readFileSync(path4.join(restoreRoot, "clickhouse-listen.xml"), "utf8"));
   const restoredLicenseRoot = path4.join(restoreRoot, "license");
   if (exists2(restoredLicenseRoot)) {
-    fs4.rmSync(LICENSE_ROOT, { recursive: true, force: true });
-    fs4.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
+    fs5.rmSync(LICENSE_ROOT, { recursive: true, force: true });
+    fs5.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
     ensureEnterpriseLicenseFilesReadable();
   }
   const config = loadConfig();

package/dist/index.js

@@ -285,6 +285,16 @@ var init_src = __esm({
 });
 
 // src/render.ts
+import { createHash } from "crypto";
+import fs2 from "fs";
+function swarmConfigObjectName(stackName, logical, filePath, fallbackVersion) {
+  let token = fallbackVersion.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_|_$/g, "") || "v";
+  try {
+    token = createHash("sha256").update(fs2.readFileSync(filePath)).digest("hex").slice(0, 12);
+  } catch {
+  }
+  return `${stackName}_${logical}_${token}`;
+}
 function domainMap(rootDomain) {
   return {
     landing: rootDomain,
@@ -538,7 +548,7 @@ function renderTraefikDynamicConfig(config, generated) {
   const landingEnabled = false;
   const managementEnabled = !isOssConfig(config);
   const otelAllowedOrigins = [
-    ...landingEnabled ? publicHttpsOriginVariants(config, hosts.landing) : [],
+    ...publicHttpsOriginVariants(config, hosts.landing),
     ...publicHttpsOriginVariants(config, hosts.app)
   ];
   return [
@@ -922,6 +932,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const apiLicenseVolume = managementEnabled ? "\n    volumes:\n      - /etc/envsync/license:/etc/envsync/license:ro" : "";
   const deployment = createSteadyApiDeploymentState(config, generated);
   const stackName = config.services.stack_name;
+  const configName = (logical, filePath) => swarmConfigObjectName(stackName, logical, filePath, config.release.version);
   const s3RouterName = `${stackName}-s3-router`;
   const s3ServiceName = `${stackName}-s3-service`;
   const s3ConsoleRouterName = `${stackName}-s3-console-router`;
@@ -1213,17 +1224,23 @@ volumes:
 
 configs:
   keycloak_realm:
+    name: ${configName("keycloak_realm", paths.keycloakRealmFile)}
     file: ${paths.keycloakRealmFile}
   clickstack_clickhouse_conf:
+    name: ${configName("clickstack_clickhouse_conf", paths.clickstackClickhouseConf)}
     file: ${paths.clickstackClickhouseConf}
   otel_agent_conf:
+    name: ${configName("otel_agent_conf", paths.otelAgentConf)}
     file: ${paths.otelAgentConf}
 ${landingEnabled ? `  nginx_landing_conf:
+    name: ${configName("nginx_landing_conf", paths.nginxLandingConf)}
     file: ${paths.nginxLandingConf}
 ` : ""}
   nginx_web_conf:
+    name: ${configName("nginx_web_conf", paths.nginxWebConf)}
     file: ${paths.nginxWebConf}
   nginx_api_maintenance_conf:
+    name: ${configName("nginx_api_maintenance_conf", paths.nginxApiMaintenanceConf)}
     file: ${paths.nginxApiMaintenanceConf}
 `.trimStart();
 }
@@ -1239,32 +1256,32 @@ var init_render = __esm({
 });
 
 // src/static-bundle.ts
-import fs2 from "fs";
+import fs3 from "fs";
 import path2 from "path";
 function exists(target) {
-  return fs2.existsSync(target);
+  return fs3.existsSync(target);
 }
 function normalizeExtractedStaticBundle(kind, targetDir) {
   const directIndex = path2.join(targetDir, "index.html");
   if (exists(directIndex)) {
     return;
   }
-  const childDirs = fs2.readdirSync(targetDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path2.join(targetDir, entry.name));
+  const childDirs = fs3.readdirSync(targetDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path2.join(targetDir, entry.name));
   const candidateRoots = childDirs.filter((dir) => exists(path2.join(dir, "index.html")));
   if (candidateRoots.length !== 1) {
     return;
   }
   const nestedRoot = candidateRoots[0];
-  for (const entry of fs2.readdirSync(nestedRoot)) {
-    fs2.cpSync(path2.join(nestedRoot, entry), path2.join(targetDir, entry), { recursive: true });
+  for (const entry of fs3.readdirSync(nestedRoot)) {
+    fs3.cpSync(path2.join(nestedRoot, entry), path2.join(targetDir, entry), { recursive: true });
   }
-  fs2.rmSync(nestedRoot, { recursive: true, force: true });
+  fs3.rmSync(nestedRoot, { recursive: true, force: true });
 }
 function validateStaticBundle(kind, targetDir) {
   if (exists(path2.join(targetDir, "index.html"))) {
     return;
   }
-  const entries = exists(targetDir) ? fs2.readdirSync(targetDir).slice(0, 20).join(", ") : "";
+  const entries = exists(targetDir) ? fs3.readdirSync(targetDir).slice(0, 20).join(", ") : "";
   throw new Error(
     `Invalid ${kind} static bundle at ${targetDir}: missing index.html${entries ? `. Found: ${entries}` : ""}`
   );
@@ -1276,8 +1293,8 @@ var init_static_bundle = __esm({
 });
 
 // src/org-setup.ts
-import { createHash, randomBytes } from "crypto";
-import fs3 from "fs";
+import { createHash as createHash2, randomBytes } from "crypto";
+import fs4 from "fs";
 import path3 from "path";
 import readline from "readline";
 function generateSetupToken() {
@@ -1286,33 +1303,33 @@ function generateSetupToken() {
 function ensureSetupTokenFile(tokenFile, existingToken) {
   if (existingToken?.trim()) {
     const dir2 = path3.dirname(tokenFile);
-    fs3.mkdirSync(dir2, { recursive: true, mode: 448 });
-    fs3.writeFileSync(tokenFile, `${existingToken.trim()}
+    fs4.mkdirSync(dir2, { recursive: true, mode: 448 });
+    fs4.writeFileSync(tokenFile, `${existingToken.trim()}
 `, { mode: 384 });
     return existingToken.trim();
   }
-  if (fs3.existsSync(tokenFile)) {
-    const fromFile = fs3.readFileSync(tokenFile, "utf8").trim();
+  if (fs4.existsSync(tokenFile)) {
+    const fromFile = fs4.readFileSync(tokenFile, "utf8").trim();
     if (fromFile.length >= 16) {
       return fromFile;
     }
   }
   const token = generateSetupToken();
   const dir = path3.dirname(tokenFile);
-  fs3.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs3.writeFileSync(tokenFile, `${token}
+  fs4.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs4.writeFileSync(tokenFile, `${token}
 `, { mode: 384 });
   return token;
 }
 function readSetupTokenFile(tokenFile) {
-  if (!fs3.existsSync(tokenFile)) {
+  if (!fs4.existsSync(tokenFile)) {
     return null;
   }
-  const token = fs3.readFileSync(tokenFile, "utf8").trim();
+  const token = fs4.readFileSync(tokenFile, "utf8").trim();
   return token.length >= 16 ? token : null;
 }
 function setupTokenFingerprint(token) {
-  return createHash("sha256").update(token).digest("hex").slice(0, 12);
+  return createHash2("sha256").update(token).digest("hex").slice(0, 12);
 }
 async function fetchSetupStatus(apiBaseUrl, setupToken) {
   const base = apiBaseUrl.replace(/\/$/, "");
@@ -1455,9 +1472,9 @@ var init_org_setup = __esm({
 
 // src/cli.ts
 var cli_exports = {};
-import { createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
+import { createHash as createHash3, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
 import { spawnSync } from "child_process";
-import fs4 from "fs";
+import fs5 from "fs";
 import path4 from "path";
 import readline2 from "readline";
 import chalk from "chalk";
@@ -1651,12 +1668,12 @@ ${typeof result.stderr === "string" ? result.stderr : ""}`.toLowerCase();
 ${stderr}` : ""}`);
 }
 function ensureDir(dir) {
-  fs4.mkdirSync(dir, { recursive: true });
+  fs5.mkdirSync(dir, { recursive: true });
 }
 function writeFile(target, content, mode) {
   ensureDir(path4.dirname(target));
-  fs4.writeFileSync(target, content, "utf8");
-  if (mode != null) fs4.chmodSync(target, mode);
+  fs5.writeFileSync(target, content, "utf8");
+  if (mode != null) fs5.chmodSync(target, mode);
 }
 function writeFileMaybe(target, content, mode) {
   if (currentOptions.dryRun) {
@@ -1668,7 +1685,7 @@ function writeFileMaybe(target, content, mode) {
 function ensureEnterpriseLicenseFilesReadable() {
   if (exists2(LICENSE_ROOT)) {
     try {
-      fs4.chmodSync(LICENSE_ROOT, LICENSE_DIR_MODE);
+      fs5.chmodSync(LICENSE_ROOT, LICENSE_DIR_MODE);
     } catch {
       throw new Error(
         `Cannot update directory mode for ${LICENSE_ROOT}. Fix by running: chmod ${LICENSE_DIR_MODE.toString(8)} ${LICENSE_ROOT}`
@@ -1678,7 +1695,7 @@ function ensureEnterpriseLicenseFilesReadable() {
   for (const filePath of [LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE]) {
     if (!exists2(filePath)) continue;
     try {
-      fs4.chmodSync(filePath, LICENSE_FILE_MODE);
+      fs5.chmodSync(filePath, LICENSE_FILE_MODE);
     } catch {
       throw new Error(
         `Cannot update file mode for ${filePath}. Fix by running: chmod ${LICENSE_FILE_MODE.toString(8)} ${filePath}`
@@ -1687,7 +1704,7 @@ function ensureEnterpriseLicenseFilesReadable() {
   }
 }
 function exists2(target) {
-  return fs4.existsSync(target);
+  return fs5.existsSync(target);
 }
 function randomSecret(bytes = 24) {
   return randomBytes2(bytes).toString("hex");
@@ -1697,7 +1714,7 @@ function generateMinikmsSessionSigningKey() {
   return privateKey.export({ type: "pkcs8", format: "pem" }).toString();
 }
 function deterministicInstallFingerprint(rootDomain, stackName) {
-  return `envsync-${createHash2("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
+  return `envsync-${createHash3("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
 }
 function randomStrongPassword() {
   return `EnvSync!${randomBytes2(8).toString("hex")}Aa1`;
@@ -1801,7 +1818,7 @@ function normalizeNetutilsForwards(raw, stackName, enabled) {
 }
 function loadWireguardState() {
   if (!exists2(WIREGUARD_STATE_FILE)) return null;
-  const raw = JSON.parse(fs4.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
+  const raw = JSON.parse(fs5.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
   return {
     private_key: raw.private_key,
     public_key: raw.public_key,
@@ -1985,7 +2002,7 @@ function publicHttpsUrl2(config, host, path5 = "") {
 function getDeployCliVersion() {
   try {
     const packageJsonPath = new URL("../package.json", import.meta.url);
-    const raw = fs4.readFileSync(packageJsonPath, "utf8");
+    const raw = fs5.readFileSync(packageJsonPath, "utf8");
     return JSON.parse(raw).version ?? "0.0.0";
   } catch {
     return process.env.npm_package_version ?? "0.0.0";
@@ -2406,7 +2423,7 @@ function normalizeGeneratedState(raw) {
 }
 function readInternalState() {
   if (!exists2(INTERNAL_CONFIG_JSON)) return null;
-  const raw = JSON.parse(fs4.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
+  const raw = JSON.parse(fs5.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
   return {
     config: raw.config ? normalizeConfig(raw.config) : void 0,
     generated: normalizeGeneratedState(raw.generated)
@@ -2416,7 +2433,7 @@ function loadConfig() {
   if (!exists2(DEPLOY_YAML)) {
     throw new Error(`Missing deploy config at ${DEPLOY_YAML}. Run setup first.`);
   }
-  const raw = fs4.readFileSync(DEPLOY_YAML, "utf8");
+  const raw = fs5.readFileSync(DEPLOY_YAML, "utf8");
   if (raw.trimStart().startsWith("{")) {
     return normalizeConfig(JSON.parse(raw));
   }
@@ -2424,7 +2441,7 @@ function loadConfig() {
 }
 function loadGeneratedEnv() {
   if (!exists2(DEPLOY_ENV)) return {};
-  return parseEnvFile(fs4.readFileSync(DEPLOY_ENV, "utf8"));
+  return parseEnvFile(fs5.readFileSync(DEPLOY_ENV, "utf8"));
 }
 function mergeGeneratedState(env, generated) {
   const normalized = normalizeGeneratedState(generated);
@@ -2712,7 +2729,7 @@ function extractStaticBundle(kind, image, targetDir) {
     logDryRun(`Would extract ${kind} bundle from ${image} into ${targetDir}`);
     return;
   }
-  fs4.rmSync(targetDir, { recursive: true, force: true });
+  fs5.rmSync(targetDir, { recursive: true, force: true });
   ensureDir(targetDir);
   const containerId = run("docker", ["create", image], { quiet: true }).trim();
   try {
@@ -2740,23 +2757,23 @@ function writeFrontendRuntimeConfig(targetDir, runtimeConfig) {
 function syncFrontendReleaseContents(sourceDir, targetDir) {
   ensureDir(targetDir);
   const deferredEntries = /* @__PURE__ */ new Set(["index.html", "runtime-config.js"]);
-  const entries = fs4.readdirSync(sourceDir, { withFileTypes: true });
+  const entries = fs5.readdirSync(sourceDir, { withFileTypes: true });
   for (const entry of entries) {
     if (deferredEntries.has(entry.name)) {
       continue;
     }
-    fs4.cpSync(path4.join(sourceDir, entry.name), path4.join(targetDir, entry.name), {
+    fs5.cpSync(path4.join(sourceDir, entry.name), path4.join(targetDir, entry.name), {
       recursive: true,
       force: true
     });
   }
   const stagedRuntimeConfig = path4.join(sourceDir, "runtime-config.js");
   if (exists2(stagedRuntimeConfig)) {
-    fs4.cpSync(stagedRuntimeConfig, path4.join(targetDir, "runtime-config.js"), { force: true });
+    fs5.cpSync(stagedRuntimeConfig, path4.join(targetDir, "runtime-config.js"), { force: true });
   }
   const stagedIndex = path4.join(sourceDir, "index.html");
   if (exists2(stagedIndex)) {
-    fs4.cpSync(stagedIndex, path4.join(targetDir, "index.html"), { force: true });
+    fs5.cpSync(stagedIndex, path4.join(targetDir, "index.html"), { force: true });
   }
 }
 function activateFrontendRelease(kind, version, runtimeConfig) {
@@ -3149,7 +3166,7 @@ ${trimmed}`
 }
 function readRenderedRuntimeConfig(filePath) {
   if (!exists2(filePath)) return null;
-  const raw = fs4.readFileSync(filePath, "utf8").trim();
+  const raw = fs5.readFileSync(filePath, "utf8").trim();
   const prefix = "window.__ENVSYNC_RUNTIME_CONFIG__ = ";
   if (!raw.startsWith(prefix) || !raw.endsWith(";")) return null;
   try {
@@ -3446,7 +3463,7 @@ function removeTarget(target) {
     logDryRun(`Would remove ${target}`);
     return;
   }
-  fs4.rmSync(target, { recursive: true, force: true });
+  fs5.rmSync(target, { recursive: true, force: true });
   logInfo(`Removed ${target}`);
 }
 async function cmdRemove() {
@@ -4193,7 +4210,7 @@ async function cmdDeploy() {
       sleepSeconds(3);
       promoted = true;
       if (snapshotPath && !currentOptions.dryRun) {
-        fs4.rmSync(snapshotPath, { force: true });
+        fs5.rmSync(snapshotPath, { force: true });
       }
     } catch (error) {
       const rollbackTarget = preUpgradeHead ?? "zero";
@@ -4227,7 +4244,7 @@ ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)
       deployRenderedStack(config, "rollback recovery");
       waitForApiSlotHealthy(config, recoveredState.deployment.active_slot);
       if (snapshotPath && !config.upgrade.keep_failed_upgrade_db_snapshot && !currentOptions.dryRun) {
-        fs4.rmSync(snapshotPath, { force: true });
+        fs5.rmSync(snapshotPath, { force: true });
       }
       throw new Error(
         usedSnapshotRestore ? `Deploy failed after DB migration. Previous release was restored using DB snapshot recovery. ${error instanceof Error ? error.message : String(error)}` : `Deploy failed after DB migration. Previous release was restored. ${error instanceof Error ? error.message : String(error)}`
@@ -4348,7 +4365,7 @@ async function cmdHealth(asJson) {
   const hosts = domainMap2(config.domain.root_domain);
   const services = listStackServices(config);
   const stackName = config.services.stack_name;
-  const traefikDynamic = exists2(TRAEFIK_DYNAMIC_FILE) ? fs4.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8") : "";
+  const traefikDynamic = exists2(TRAEFIK_DYNAMIC_FILE) ? fs5.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8") : "";
   const webRuntimeConfig = readRenderedRuntimeConfig(path4.join(RELEASES_ROOT, "web", "current", "runtime-config.js"));
   const landingRuntimeConfig = readRenderedRuntimeConfig(path4.join(RELEASES_ROOT, "landing", "current", "runtime-config.js"));
   const clickstackSearchState = getClickstackSearchState(config);
@@ -4540,8 +4557,8 @@ async function cmdUpgradeDeps() {
   await cmdDeploy();
 }
 function sha256File(filePath) {
-  const hash = createHash2("sha256");
-  hash.update(fs4.readFileSync(filePath));
+  const hash = createHash3("sha256");
+  hash.update(fs5.readFileSync(filePath));
   return hash.digest("hex");
 }
 function parseEnterpriseLicenseBundle(raw) {
@@ -4570,7 +4587,7 @@ function parseEnterpriseLicenseBundle(raw) {
   return candidate;
 }
 function readEnterpriseLicenseBundle(bundlePath) {
-  return parseEnterpriseLicenseBundle(JSON.parse(fs4.readFileSync(bundlePath, "utf8")));
+  return parseEnterpriseLicenseBundle(JSON.parse(fs5.readFileSync(bundlePath, "utf8")));
 }
 function normalizeLicenseServerUrl(serverUrl, route) {
   const trimmed = serverUrl.replace(/\/+$/, "");
@@ -4832,19 +4849,19 @@ async function cmdBackup() {
       logWarn("Backup will temporarily stop the EnvSync stack to capture consistent volume data.");
       stopManagedRuntime(config, "Stopping existing EnvSync services for consistent backup");
     }
-    writeFile(path4.join(staged, "deploy.env"), fs4.readFileSync(DEPLOY_ENV, "utf8"));
-    writeFile(path4.join(staged, "deploy.yaml"), fs4.readFileSync(DEPLOY_YAML, "utf8"));
-    writeFile(path4.join(staged, "config.json"), fs4.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
-    writeFile(path4.join(staged, "versions.lock.json"), fs4.readFileSync(VERSIONS_LOCK, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.bootstrap.base.yaml"), fs4.readFileSync(BOOTSTRAP_BASE_STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.bootstrap.yaml"), fs4.readFileSync(BOOTSTRAP_STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "docker-stack.yaml"), fs4.readFileSync(STACK_FILE, "utf8"));
-    writeFile(path4.join(staged, "traefik-dynamic.yaml"), fs4.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8"));
-    writeFile(path4.join(staged, "keycloak-realm.envsync.json"), fs4.readFileSync(KEYCLOAK_REALM_FILE, "utf8"));
-    writeFile(path4.join(staged, "otel-agent.yaml"), fs4.readFileSync(OTEL_AGENT_CONF, "utf8"));
-    writeFile(path4.join(staged, "clickhouse-listen.xml"), fs4.readFileSync(CLICKSTACK_CLICKHOUSE_CONF, "utf8"));
+    writeFile(path4.join(staged, "deploy.env"), fs5.readFileSync(DEPLOY_ENV, "utf8"));
+    writeFile(path4.join(staged, "deploy.yaml"), fs5.readFileSync(DEPLOY_YAML, "utf8"));
+    writeFile(path4.join(staged, "config.json"), fs5.readFileSync(INTERNAL_CONFIG_JSON, "utf8"));
+    writeFile(path4.join(staged, "versions.lock.json"), fs5.readFileSync(VERSIONS_LOCK, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.bootstrap.base.yaml"), fs5.readFileSync(BOOTSTRAP_BASE_STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.bootstrap.yaml"), fs5.readFileSync(BOOTSTRAP_STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "docker-stack.yaml"), fs5.readFileSync(STACK_FILE, "utf8"));
+    writeFile(path4.join(staged, "traefik-dynamic.yaml"), fs5.readFileSync(TRAEFIK_DYNAMIC_FILE, "utf8"));
+    writeFile(path4.join(staged, "keycloak-realm.envsync.json"), fs5.readFileSync(KEYCLOAK_REALM_FILE, "utf8"));
+    writeFile(path4.join(staged, "otel-agent.yaml"), fs5.readFileSync(OTEL_AGENT_CONF, "utf8"));
+    writeFile(path4.join(staged, "clickhouse-listen.xml"), fs5.readFileSync(CLICKSTACK_CLICKHOUSE_CONF, "utf8"));
     if (!isOssConfig2(config) && exists2(LICENSE_ROOT)) {
-      fs4.cpSync(LICENSE_ROOT, path4.join(staged, "license"), { recursive: true });
+      fs5.cpSync(LICENSE_ROOT, path4.join(staged, "license"), { recursive: true });
     }
     const volumesDir = path4.join(staged, "volumes");
     for (const volume of STACK_VOLUMES) {
@@ -4911,21 +4928,21 @@ async function cmdRestore(archivePath, autoDeploy = false) {
   }
   ensureDir(restoreRoot);
   run("bash", ["-lc", `tar -xzf ${JSON.stringify(archivePath)} -C ${JSON.stringify(restoreRoot)}`]);
-  writeFile(DEPLOY_ENV, fs4.readFileSync(path4.join(restoreRoot, "deploy.env"), "utf8"), 384);
-  writeFile(DEPLOY_YAML, fs4.readFileSync(path4.join(restoreRoot, "deploy.yaml"), "utf8"));
-  writeFile(INTERNAL_CONFIG_JSON, fs4.readFileSync(path4.join(restoreRoot, "config.json"), "utf8"));
-  writeFile(VERSIONS_LOCK, fs4.readFileSync(path4.join(restoreRoot, "versions.lock.json"), "utf8"));
-  writeFile(BOOTSTRAP_BASE_STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.base.yaml"), "utf8"));
-  writeFile(BOOTSTRAP_STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.yaml"), "utf8"));
-  writeFile(STACK_FILE, fs4.readFileSync(path4.join(restoreRoot, "docker-stack.yaml"), "utf8"));
-  writeFile(TRAEFIK_DYNAMIC_FILE, fs4.readFileSync(path4.join(restoreRoot, "traefik-dynamic.yaml"), "utf8"));
-  writeFile(KEYCLOAK_REALM_FILE, fs4.readFileSync(path4.join(restoreRoot, "keycloak-realm.envsync.json"), "utf8"));
-  writeFile(OTEL_AGENT_CONF, fs4.readFileSync(path4.join(restoreRoot, "otel-agent.yaml"), "utf8"));
-  writeFile(CLICKSTACK_CLICKHOUSE_CONF, fs4.readFileSync(path4.join(restoreRoot, "clickhouse-listen.xml"), "utf8"));
+  writeFile(DEPLOY_ENV, fs5.readFileSync(path4.join(restoreRoot, "deploy.env"), "utf8"), 384);
+  writeFile(DEPLOY_YAML, fs5.readFileSync(path4.join(restoreRoot, "deploy.yaml"), "utf8"));
+  writeFile(INTERNAL_CONFIG_JSON, fs5.readFileSync(path4.join(restoreRoot, "config.json"), "utf8"));
+  writeFile(VERSIONS_LOCK, fs5.readFileSync(path4.join(restoreRoot, "versions.lock.json"), "utf8"));
+  writeFile(BOOTSTRAP_BASE_STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.base.yaml"), "utf8"));
+  writeFile(BOOTSTRAP_STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.bootstrap.yaml"), "utf8"));
+  writeFile(STACK_FILE, fs5.readFileSync(path4.join(restoreRoot, "docker-stack.yaml"), "utf8"));
+  writeFile(TRAEFIK_DYNAMIC_FILE, fs5.readFileSync(path4.join(restoreRoot, "traefik-dynamic.yaml"), "utf8"));
+  writeFile(KEYCLOAK_REALM_FILE, fs5.readFileSync(path4.join(restoreRoot, "keycloak-realm.envsync.json"), "utf8"));
+  writeFile(OTEL_AGENT_CONF, fs5.readFileSync(path4.join(restoreRoot, "otel-agent.yaml"), "utf8"));
+  writeFile(CLICKSTACK_CLICKHOUSE_CONF, fs5.readFileSync(path4.join(restoreRoot, "clickhouse-listen.xml"), "utf8"));
   const restoredLicenseRoot = path4.join(restoreRoot, "license");
   if (exists2(restoredLicenseRoot)) {
-    fs4.rmSync(LICENSE_ROOT, { recursive: true, force: true });
-    fs4.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
+    fs5.rmSync(LICENSE_ROOT, { recursive: true, force: true });
+    fs5.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
     ensureEnterpriseLicenseFilesReadable();
   }
   const config = loadConfig();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy",
-  "version": "0.21.0",
+  "version": "0.21.2",
   "description": "OSS CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {
@@ -46,7 +46,7 @@
     "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@envsync-cloud/deploy-core": "0.21.0",
+    "@envsync-cloud/deploy-core": "0.21.2",
     "tsup": "^8.5.0",
     "typescript": "^5.9.2"
   },