@or3/cloud 0.1.107 → 0.1.113

package/dist/cli.mjs

@@ -15,7 +15,7 @@ var __export = (target, all) => {
 };
 
 // src/cli.ts
-import { basename as basename8, resolve as resolve17 } from "node:path";
+import { basename as basename9, resolve as resolve18 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/cli/args.ts
@@ -67,6 +67,7 @@ var COMMAND_FLAGS = {
   init: ["local", "public", "domain", "admin-email", "admin-password", "admin-password-file", "port"],
   update: ["to", "dry-run", "json"],
   backup: ["keep", "force", "yes", "json"],
+  "vault-key": ["out"],
   restore: ["yes"],
   rollback: ["yes"],
   doctor: [],
@@ -92,7 +93,7 @@ function assertCommandFlags(command, flags) {
   }
 }
 function assertCommandPositionals(command, positionals) {
-  if (command === "backup" || command === "credentials")
+  if (command === "backup" || command === "credentials" || command === "vault-key")
     return;
   if (command === "init" || command === "adopt") {
     if (positionals.length > 1)
@@ -128,11 +129,11 @@ function requireStringFlag(flags, key) {
 }
 
 // src/cli/dispatch.ts
-import { basename as basename7, resolve as resolve16 } from "node:path";
+import { basename as basename8, resolve as resolve17 } from "node:path";
 
 // src/commands/adopt.ts
 import { chmod as chmod5, mkdir as mkdir5 } from "node:fs/promises";
-import { basename as basename3, join as join13, resolve as resolve7 } from "node:path";
+import { basename as basename3, join as join16, resolve as resolve7 } from "node:path";
 
 // src/backup/archive.ts
 import { createReadStream as createReadStream3 } from "node:fs";
@@ -164,9 +165,23 @@ function quote(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
 function redact(text, secrets = []) {
-  let output = text;
-  for (const secret of secrets.filter(Boolean))
-    output = output.replaceAll(secret, "[REDACTED]");
+  const mask = new Uint8Array(text.length);
+  for (const secret of secrets.filter(Boolean)) {
+    for (let index = text.indexOf(secret);index !== -1; index = text.indexOf(secret, index + 1))
+      mask.fill(1, index, index + secret.length);
+  }
+  let output = "", cursor = 0;
+  for (let index = 0;index < mask.length; ) {
+    if (!mask[index]) {
+      index += 1;
+      continue;
+    }
+    output += `${text.slice(cursor, index)}[REDACTED]`;
+    while (index < mask.length && mask[index])
+      index += 1;
+    cursor = index;
+  }
+  output += text.slice(cursor);
   output = output.replace(/((?:PASSWORD|SECRET|TOKEN|JWT)\s*[=:]\s*)(?!\[REDACTED\])([^\r\n]+)/gi, "$1[REDACTED]");
   return output;
 }
@@ -179,7 +194,7 @@ import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_ROOT = resolve(fileURLToPath(new URL("../", import.meta.url)));
-var PACKAGE_VERSION = "0.1.107";
+var PACKAGE_VERSION = "0.1.113";
 var IMAGE_REPOSITORY = "ghcr.io/saluana/or3-chat";
 var ASSET_ROOT = resolve(fileURLToPath(new URL("../assets/", import.meta.url)));
 var SHA256_DIGEST = /^sha256:[0-9a-f]{64}$/;
@@ -293,6 +308,9 @@ function composeProjectNames(directory) {
     caddyConfig: `${base}-caddy-config`
   };
 }
+function managedVaultVolumeNames(dataVolume) {
+  return ["vault-data", "vault-key", "vault-run", "vault-client"].map((suffix) => `${dataVolume}-${suffix}`);
+}
 function assertDeploymentIdentity(state, env) {
   const expected = {
     OR3_COMPOSE_PROJECT: state.composeProject,
@@ -366,10 +384,149 @@ var SECRET_KEYS = [
   "OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD",
   "OR3_AUTH_INVITE_TOKEN_SECRET",
   "OR3_STORAGE_FS_TOKEN_SECRET",
+  "OR3_STORAGE_S3_ACCESS_KEY_ID",
+  "OR3_STORAGE_S3_SECRET_ACCESS_KEY",
+  "OR3_STORAGE_S3_SESSION_TOKEN",
+  "NUXT_CLERK_SECRET_KEY",
+  "NUXT_AUTH_INVITE_TOKEN_SECRET",
+  "NUXT_ADMIN_AUTH_PASSWORD",
+  "NUXT_ADMIN_AUTH_JWT_SECRET",
+  "OR3_LIBRARY_LINK_SECRET",
+  "NUXT_ADMIN_LIBRARY_LINK_SECRET",
+  "OR3_PLUGIN_CONNECTION_SECRET",
+  "NUXT_ADMIN_PLUGIN_CONNECTION_SECRET",
+  "OR3_BACKGROUND_ENCRYPTION_KEY",
+  "NUXT_BACKGROUND_JOBS_ENCRYPTION_KEY",
+  "OR3_WEBHOOKS_ENCRYPTION_KEY",
+  "NUXT_WEBHOOKS_ENCRYPTION_KEY",
+  "OR3_CONNECT_ENCRYPTION_KEY",
+  "NUXT_CONNECT_ENCRYPTION_KEY",
+  "OR3_CONNECT_CLOUDFLARE_API_TOKEN",
+  "NUXT_CONNECT_CLOUDFLARE_API_TOKEN",
+  "OPENROUTER_API_KEY",
+  "NUXT_OPENROUTER_API_KEY",
+  "OR3_OPENAI_API_KEY",
+  "NUXT_OPENAI_API_KEY",
+  "OR3_BILLING_STRIPE_SECRET_KEY",
+  "OR3_BILLING_STRIPE_WEBHOOK_SECRET",
+  "CONVEX_SELF_HOSTED_ADMIN_KEY",
+  "CONVEX_DEPLOY_KEY",
   "OR3_ADMIN_JWT_SECRET",
   "OR3_ADMIN_PASSWORD"
 ];
+function managedProviderProfile(env) {
+  const auth = env.AUTH_PROVIDER ?? env.OR3_AUTH_PROVIDER ?? "basic-auth";
+  const sync = env.OR3_SYNC_PROVIDER ?? "sqlite";
+  const storage = env.NUXT_PUBLIC_STORAGE_PROVIDER ?? "fs";
+  if (env.AUTH_PROVIDER && env.OR3_AUTH_PROVIDER && env.AUTH_PROVIDER !== env.OR3_AUTH_PROVIDER || sync !== "sqlite") {
+    throw new Error("backup-profile-mismatch: unsupported or inconsistent managed provider profile.");
+  }
+  if (auth === "basic-auth" && storage === "fs")
+    return "basic-sqlite-fs";
+  if (auth === "clerk" && storage === "s3")
+    return "clerk-sqlite-s3";
+  throw new Error("backup-profile-mismatch: unsupported managed provider profile.");
+}
+function assertLegacyManagedProfile(env) {
+  const overrides = {
+    SSR_AUTH_ENABLED: "true",
+    OR3_SYNC_ENABLED: "true",
+    OR3_CLOUD_SYNC_ENABLED: "true",
+    OR3_STORAGE_ENABLED: "true",
+    OR3_CLOUD_STORAGE_ENABLED: "true",
+    OR3_SQLITE_DRIVER: "better-sqlite3",
+    OR3_STORAGE_PROVIDER: "fs",
+    NUXT_AUTH_ENABLED: "true",
+    NUXT_AUTH_PROVIDER: "basic-auth",
+    NUXT_PUBLIC_AUTH_PROVIDER: "basic-auth",
+    NUXT_PUBLIC_SSR_AUTH_ENABLED: "true",
+    NUXT_SYNC_ENABLED: "true",
+    NUXT_PUBLIC_SYNC_ENABLED: "true",
+    NUXT_SYNC_PROVIDER: "sqlite",
+    NUXT_PUBLIC_SYNC_PROVIDER: "sqlite",
+    NUXT_STORAGE_ENABLED: "true",
+    NUXT_PUBLIC_STORAGE_ENABLED: "true",
+    NUXT_STORAGE_PROVIDER: "fs"
+  };
+  const ambiguous = /^(?:RUNTIME_CONFIG$|NUXT_(?:AUTH|SYNC|STORAGE|PUBLIC)$|NITRO_ENV_(?:PREFIX|EXPANSION)$|NITRO_(?:AUTH|SYNC|STORAGE|PUBLIC)(?:_|$))/;
+  if (managedProviderProfile(env) !== "basic-sqlite-fs" || Object.entries(overrides).some(([key, expected]) => env[key] !== undefined && env[key] !== expected) || Object.keys(env).some((key) => ambiguous.test(key))) {
+    throw new Error("Legacy managed state supports only the Basic/SQLite/filesystem profile; provider conversion requires a separate qualified deployment.");
+  }
+}
+function restoreStorageConfiguration(backup, current) {
+  const sourceProvider = backup.NUXT_PUBLIC_STORAGE_PROVIDER;
+  const targetProvider = current.NUXT_PUBLIC_STORAGE_PROVIDER;
+  if (sourceProvider !== targetProvider && (sourceProvider === "s3" || targetProvider === "s3" || sourceProvider && targetProvider)) {
+    throw new Error("backup-profile-mismatch: backup and deployment use different storage providers.");
+  }
+  if (sourceProvider !== "s3")
+    return { ...backup };
+  const prefix = (value) => {
+    const trimmed = (value ?? "").trim().replace(/^\/+/, "").replace(/\/+$/, "");
+    return trimmed ? `${trimmed}/` : "";
+  };
+  if (prefix(backup.OR3_STORAGE_S3_KEY_PREFIX) !== prefix(current.OR3_STORAGE_S3_KEY_PREFIX)) {
+    throw new Error("backup-prefix-mismatch: backup and target S3 key prefixes differ.");
+  }
+  const restored = Object.fromEntries(Object.entries(backup).filter(([key]) => !key.startsWith("OR3_STORAGE_S3_")));
+  for (const [key, value] of Object.entries(current))
+    if (key.startsWith("OR3_STORAGE_S3_"))
+      restored[key] = value;
+  return restored;
+}
+var ADOPTION_SECRET_KEYS = [
+  "OR3_BASIC_AUTH_JWT_SECRET",
+  "OR3_BASIC_AUTH_REFRESH_SECRET",
+  "OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD",
+  "OR3_AUTH_INVITE_TOKEN_SECRET",
+  "OR3_STORAGE_FS_TOKEN_SECRET",
+  "OR3_ADMIN_PASSWORD",
+  "OR3_ADMIN_JWT_SECRET",
+  "NUXT_AUTH_INVITE_TOKEN_SECRET",
+  "NUXT_ADMIN_AUTH_JWT_SECRET",
+  "OR3_LIBRARY_LINK_SECRET",
+  "NUXT_ADMIN_LIBRARY_LINK_SECRET",
+  "OR3_PLUGIN_CONNECTION_SECRET",
+  "NUXT_ADMIN_PLUGIN_CONNECTION_SECRET",
+  "OR3_BACKGROUND_ENCRYPTION_KEY",
+  "NUXT_BACKGROUND_JOBS_ENCRYPTION_KEY",
+  "OR3_WEBHOOKS_ENCRYPTION_KEY",
+  "NUXT_WEBHOOKS_ENCRYPTION_KEY",
+  "OR3_CONNECT_ENCRYPTION_KEY",
+  "NUXT_CONNECT_ENCRYPTION_KEY",
+  "OR3_CONNECT_CLOUDFLARE_API_TOKEN",
+  "NUXT_CONNECT_CLOUDFLARE_API_TOKEN",
+  "OPENROUTER_API_KEY",
+  "NUXT_OPENROUTER_API_KEY",
+  "OR3_OPENAI_API_KEY",
+  "NUXT_OPENAI_API_KEY"
+];
+var ADOPTION_RUNTIME_KEYS = [
+  "OR3_MARKETPLACE_REGISTRY_ORIGIN",
+  "OR3_MARKETPLACE_INSTALL_ENABLED",
+  "OR3_MARKETPLACE_RELEASE_KEYS",
+  "OR3_INSTANCE_ID",
+  "OR3_MARKETPLACE_MAX_ARTIFACT_BYTES",
+  "OR3_MARKETPLACE_RESERVE_BYTES",
+  "OR3_BACKGROUND_STREAMING_ENABLED",
+  "OR3_BACKGROUND_STREAMING_PROVIDER",
+  "OR3_BACKGROUND_MAX_JOBS",
+  "OR3_BACKGROUND_MAX_JOBS_PER_USER",
+  "OR3_BACKGROUND_JOB_TIMEOUT",
+  "NUXT_BACKGROUND_JOBS_ENABLED",
+  "NUXT_PUBLIC_BACKGROUND_STREAMING_ENABLED",
+  "NUXT_BACKGROUND_JOBS_STORAGE_PROVIDER",
+  "NUXT_BACKGROUND_JOBS_MAX_CONCURRENT_JOBS",
+  "NUXT_BACKGROUND_JOBS_MAX_CONCURRENT_JOBS_PER_USER",
+  "NUXT_BACKGROUND_JOBS_JOB_TIMEOUT_MS",
+  "OR3_PLUGIN_ALLOWED_MODELS",
+  "OR3_PLUGIN_MODEL_PRICES",
+  "NUXT_ADMIN_PLUGIN_ALLOWED_MODELS",
+  "NUXT_ADMIN_PLUGIN_MODEL_PRICES"
+];
 var ALLOWED_ENV_KEYS = new Set([
+  ...ADOPTION_SECRET_KEYS,
+  ...ADOPTION_RUNTIME_KEYS,
   "SSR_AUTH_ENABLED",
   "NUXT_SECRETS_PROVIDER",
   "NUXT_SECRETS_NAMESPACE",
@@ -386,6 +543,7 @@ var ALLOWED_ENV_KEYS = new Set([
   "OR3_BASIC_AUTH_REFRESH_SECRET",
   "OR3_BASIC_AUTH_ACCESS_TTL_SECONDS",
   "OR3_BASIC_AUTH_REFRESH_TTL_SECONDS",
+  "OR3_SQLITE_DRIVER",
   "OR3_BASIC_AUTH_DB_PATH",
   "OR3_BASIC_AUTH_BOOTSTRAP_EMAIL",
   "OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD",
@@ -550,7 +708,9 @@ function buildEnv(input) {
   return values;
 }
 function secretValues(env) {
-  return SECRET_KEYS.map((key) => env[key]).filter((value) => Boolean(value));
+  const known = new Set(SECRET_KEYS);
+  const secretName = /(?:^|_)(?:PASSWORD|SECRET|TOKEN|PRIVATE_KEY|API_KEY|ACCESS_KEY|AUTH_KEY)(?:_|$)/i;
+  return Object.entries(env).filter(([key, value]) => Boolean(value) && (known.has(key) || secretName.test(key))).map(([, value]) => value);
 }
 
 // src/deployment/state-store.ts
@@ -844,6 +1004,12 @@ import { dirname as dirname2, join as join5 } from "node:path";
 var execFile = promisify(execFileCallback);
 var COMMAND_TIMEOUT_MS = 180000;
 var STREAM_COMMAND_TIMEOUT_MS = 15 * 60000;
+var MAX_STREAM_COMMAND_TIMEOUT_MS = 4 * 60 * 60000;
+function streamDeadline(timeoutMs) {
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_STREAM_COMMAND_TIMEOUT_MS)
+    throw new Error("Invalid archive stream deadline.");
+  return timeoutMs;
+}
 var PROCESS_ENV_PASSTHROUGH = [
   "PATH",
   "HOME",
@@ -940,7 +1106,8 @@ function terminateChildProcess(child) {
   }
   child.kill("SIGKILL");
 }
-async function streamCommandToFile(command, args, destination, cwd, secrets = []) {
+async function streamCommandToFile(command, args, destination, cwd, secrets = [], environment, timeoutMs = STREAM_COMMAND_TIMEOUT_MS) {
+  streamDeadline(timeoutMs);
   if (await fileExists(destination)) {
     throw new Error(`Refusing to overwrite existing archive ${destination}.`);
   }
@@ -948,7 +1115,7 @@ async function streamCommandToFile(command, args, destination, cwd, secrets = []
   const temporary = `${destination}.${randomBytes3(8).toString("hex")}.partial`;
   const child = spawn(command, args, {
     cwd,
-    env: commandEnvironment(command, args, cwd),
+    env: commandEnvironment(command, args, cwd, environment),
     detached: process.platform !== "win32",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -958,7 +1125,7 @@ async function streamCommandToFile(command, args, destination, cwd, secrets = []
   const timeout = setTimeout(() => {
     timedOut = true;
     terminateChildProcess(child);
-  }, STREAM_COMMAND_TIMEOUT_MS);
+  }, timeoutMs);
   child.stderr.setEncoding("utf8");
   child.stderr.on("data", (chunk) => {
     stderr = `${stderr}${chunk}`.slice(-64 * 1024);
@@ -974,7 +1141,7 @@ async function streamCommandToFile(command, args, destination, cwd, secrets = []
       transfer
     ]);
     if (hasTimedOut())
-      throw new Error(`${command} exceeded the ${STREAM_COMMAND_TIMEOUT_MS / 1000}-second archive deadline.`);
+      throw new Error(`${command} exceeded the ${timeoutMs / 1000}-second archive deadline.`);
     if (exitCode !== 0) {
       throw new Error(`${command} ${args.join(" ")} exited with ${exitCode}. ${redact(stderr, secrets)}`.trim());
     }
@@ -998,10 +1165,11 @@ Temporary archive cleanup failed: ${redact(cleanupError instanceof Error ? clean
     clearTimeout(timeout);
   }
 }
-async function streamFileToCommand(command, args, source, cwd, secrets = []) {
+async function streamFileToCommand(command, args, source, cwd, secrets = [], environment, timeoutMs = STREAM_COMMAND_TIMEOUT_MS) {
+  streamDeadline(timeoutMs);
   const child = spawn(command, args, {
     cwd,
-    env: commandEnvironment(command, args, cwd),
+    env: commandEnvironment(command, args, cwd, environment),
     detached: process.platform !== "win32",
     stdio: ["pipe", "ignore", "pipe"]
   });
@@ -1011,7 +1179,7 @@ async function streamFileToCommand(command, args, source, cwd, secrets = []) {
   const timeout = setTimeout(() => {
     timedOut = true;
     terminateChildProcess(child);
-  }, STREAM_COMMAND_TIMEOUT_MS);
+  }, timeoutMs);
   child.stderr.setEncoding("utf8");
   child.stderr.on("data", (chunk) => {
     stderr = `${stderr}${chunk}`.slice(-64 * 1024);
@@ -1026,13 +1194,13 @@ async function streamFileToCommand(command, args, source, cwd, secrets = []) {
       pipeline(createReadStream2(source), child.stdin)
     ]);
     if (hasTimedOut())
-      throw new Error(`${command} exceeded the ${STREAM_COMMAND_TIMEOUT_MS / 1000}-second archive deadline.`);
+      throw new Error(`${command} exceeded the ${timeoutMs / 1000}-second archive deadline.`);
     if (exitCode !== 0) {
       throw new Error(`${command} ${args.join(" ")} exited with ${exitCode}. ${redact(stderr, secrets)}`.trim());
     }
   } catch (error) {
     terminateChildProcess(child);
-    const detail = error instanceof Error ? error.message : String(error);
+    const detail = redact(error instanceof Error ? error.message : String(error), secrets);
     throw new Error(`${detail}${stderr && !detail.includes(stderr) ? `
 ${redact(stderr, secrets)}` : ""}`);
   } finally {
@@ -1121,6 +1289,31 @@ function parseComposeConfig(text) {
     throw new Error(`Docker Compose did not return a readable JSON configuration: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
+function assertCapturedComposeMounts(service) {
+  const mounts = service.volumes ?? [], tmpfs = service.tmpfs;
+  for (const field of [service.configs, service.secrets, service.volumes_from]) {
+    if (field != null && (!Array.isArray(field) || field.length !== 0))
+      throw new Error("Source has additional Compose mounts that cannot be captured safely.");
+  }
+  if (mounts.some((mount) => {
+    const volume = mount.volume;
+    return volume && typeof volume === "object" && volume.subpath;
+  }))
+    throw new Error("Source volume subpaths cannot be captured safely.");
+  if (tmpfs != null && (!Array.isArray(tmpfs) || tmpfs.some((entry) => typeof entry !== "string" || entry.split(":", 1)[0] !== "/tmp")))
+    throw new Error("Source has an unexpected temporary filesystem.");
+}
+function assertCapturedHostMounts(tmpfs, hostMounts) {
+  if (tmpfs != null && (typeof tmpfs !== "object" || Array.isArray(tmpfs) || Object.keys(tmpfs).some((path) => path !== "/tmp")))
+    throw new Error("Source has an unexpected temporary filesystem.");
+  if (hostMounts != null && (!Array.isArray(hostMounts) || hostMounts.some((mount) => {
+    if (!mount || typeof mount !== "object" || Array.isArray(mount))
+      return true;
+    const options = mount.VolumeOptions;
+    return options && typeof options === "object" && options.Subpath;
+  })))
+    throw new Error("Source volume subpaths cannot be captured safely.");
+}
 function composeEnvironmentValue(service, key) {
   const environment = service.environment;
   if (Array.isArray(environment)) {
@@ -1171,6 +1364,41 @@ async function resolvedComposeConfig(directory, mode, deadline = performance.now
 ${result.stderr}`);
   return result.stdout;
 }
+async function assertLegacyComposeProfile(directory, mode, env, deadline) {
+  assertLegacyManagedProfile(env);
+  let resolved;
+  try {
+    resolved = await resolvedComposeConfig(directory, mode, deadline);
+  } catch (error) {
+    throw new Error(redact(error instanceof Error ? error.message : String(error), secretValues(env)));
+  }
+  let service;
+  try {
+    service = parseComposeConfig(resolved).services?.or3;
+  } catch {
+    throw new Error("Resolved Compose provider configuration is unreadable.");
+  }
+  if (!service || !service.environment || typeof service.environment !== "object")
+    throw new Error("Resolved Compose provider environment is missing.");
+  const entries = Array.isArray(service.environment) ? service.environment.map((entry) => {
+    if (typeof entry !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*=/.test(entry))
+      throw new Error("Resolved Compose provider environment is ambiguous.");
+    const index = entry.indexOf("=");
+    return [entry.slice(0, index), entry.slice(index + 1)];
+  }) : Object.entries(service.environment);
+  const effective = {};
+  const seen = new Set;
+  for (const [key, value] of entries) {
+    if (typeof key !== "string" || typeof value !== "string" || seen.has(key))
+      throw new Error("Resolved Compose provider environment is ambiguous.");
+    seen.add(key);
+    effective[key] = value;
+  }
+  assertLegacyManagedProfile(effective);
+  if ((effective.OR3_AUTH_PROVIDER || effective.AUTH_PROVIDER) !== "basic-auth" || effective.SSR_AUTH_ENABLED !== "true" || (effective.OR3_CLOUD_SYNC_ENABLED || effective.OR3_SYNC_ENABLED) !== "true" || effective.OR3_SYNC_PROVIDER !== "sqlite" || (effective.OR3_CLOUD_STORAGE_ENABLED || effective.OR3_STORAGE_ENABLED) !== "true" || (effective.OR3_STORAGE_PROVIDER || effective.NUXT_PUBLIC_STORAGE_PROVIDER) !== "fs") {
+    throw new Error("Resolved Compose provider profile is missing required Basic/SQLite/filesystem settings.");
+  }
+}
 async function assertSafeComposeBinding(directory, mode, env, deadline) {
   const config = await resolvedComposeConfig(directory, mode, deadline);
   const parsed = parseComposeConfig(config);
@@ -1570,8 +1798,14 @@ async function restoreVolumeArchive(directory, mode, env, backupPath) {
   ], join7(backupPath, "data.tgz"), directory, secretValues(env));
 }
 async function validateVolumeArchive(directory, _mode, env, backupPath, archivedStorageRoot) {
+  const auth = env.AUTH_PROVIDER ?? env.OR3_AUTH_PROVIDER ?? "basic-auth";
+  const sync = env.OR3_SYNC_PROVIDER ?? "sqlite";
+  const storage = env.NUXT_PUBLIC_STORAGE_PROVIDER ?? "fs";
+  if (env.AUTH_PROVIDER && env.OR3_AUTH_PROVIDER && env.AUTH_PROVIDER !== env.OR3_AUTH_PROVIDER || sync !== "sqlite" || !(auth === "basic-auth" && storage === "fs" || auth === "clerk" && storage === "s3"))
+    throw new Error("Unsupported backup archive provider profile.");
+  const requireAuth = auth === "basic-auth";
   const storageRoot = posix.relative("/data", archivedStorageRoot ?? env.OR3_STORAGE_FS_ROOT ?? "/data/storage");
-  const storagePrefix = storageRoot === ".." || storageRoot.startsWith("../") || posix.isAbsolute(storageRoot) ? "" : `${storageRoot ? `${storageRoot}/` : ""}workspaces/`;
+  const storagePrefix = storage !== "fs" || storageRoot === ".." || storageRoot.startsWith("../") || posix.isAbsolute(storageRoot) ? "" : `${storageRoot ? `${storageRoot}/` : ""}workspaces/`;
   await streamFileToCommand("docker", [
     "run",
     "--rm",
@@ -1587,7 +1821,7 @@ async function validateVolumeArchive(directory, _mode, env, backupPath, archived
     "sh",
     env.OR3_IMAGE,
     "-c",
-    `{ tar tzf -; printf '\\nOR3_TAR_RESULT:%s\\n' "$?"; } | awk -v prefix="$1" '
+    `{ tar tzf -; printf '\\nOR3_TAR_RESULT:%s\\n' "$?"; } | awk -v prefix="$1" -v require_auth="$2" '
 {
   entry = $0
   sub(/^\\.\\//, "", entry)
@@ -1612,8 +1846,8 @@ async function validateVolumeArchive(directory, _mode, env, backupPath, archived
 }
 END {
   if (!seen_status || tar_status != "0") exit 1
-  if (!auth || !sync) {
-    print "Backup archive is missing required managed database payloads (auth.sqlite and sync.sqlite)." > "/dev/stderr"
+  if (!sync || (require_auth == "1" && !auth)) {
+    print "Backup archive is missing required managed database payloads for its provider profile." > "/dev/stderr"
     exit 1
   }
   for (entry in metadata) {
@@ -1626,14 +1860,15 @@ END {
   }
 }'`,
     "or3-archive-validation",
-    storagePrefix
+    storagePrefix,
+    requireAuth ? "1" : "0"
   ], join7(backupPath, "data.tgz"), directory, secretValues(env));
 }
 
 // src/backup/manifests.ts
-import { createHmac, randomBytes as randomBytes5, timingSafeEqual } from "node:crypto";
-import { lstat, readdir as readdir2 } from "node:fs/promises";
-import { isAbsolute, join as join9, resolve as resolve4 } from "node:path";
+import { createHash as createHash3, createHmac, randomBytes as randomBytes5, timingSafeEqual } from "node:crypto";
+import { lstat as lstat3, readdir as readdir2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute3, join as join12, resolve as resolve4 } from "node:path";
 
 // src/deployment/assets.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
@@ -1793,6 +2028,572 @@ function assertRestorableManagedAssets(manifest2) {
   }
 }
 
+// src/backup/remote.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { readFile as readFile3, rm as rm4, stat as stat2 } from "node:fs/promises";
+import { join as join10 } from "node:path";
+
+// src/backup/helper.ts
+import { randomUUID } from "node:crypto";
+import { lstat, realpath } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+var INSPECTOR = "/app/scripts/docker/backup-inspect.mjs";
+var NODE = 'if [ -x /nodejs/bin/node ]; then exec /nodejs/bin/node "$@"; else exec node "$@"; fi';
+var S3_ENV = new Set([
+  "OR3_STORAGE_S3_ENDPOINT",
+  "OR3_STORAGE_S3_REGION",
+  "OR3_STORAGE_S3_BUCKET",
+  "OR3_STORAGE_S3_ACCESS_KEY_ID",
+  "OR3_STORAGE_S3_SECRET_ACCESS_KEY",
+  "OR3_STORAGE_S3_SESSION_TOKEN",
+  "OR3_STORAGE_S3_FORCE_PATH_STYLE",
+  "OR3_STORAGE_S3_KEY_PREFIX",
+  "OR3_STORAGE_S3_ALLOW_INSECURE_HTTP",
+  "OR3_BACKUP_S3_ENDPOINT_ORIGIN",
+  "OR3_BACKUP_S3_BUCKET",
+  "OR3_BACKUP_S3_KEY_PREFIX",
+  "OR3_BACKUP_ARCHIVE_SHA256"
+]);
+var S3_SECRETS = new Set(["OR3_STORAGE_S3_ACCESS_KEY_ID", "OR3_STORAGE_S3_SECRET_ACCESS_KEY", "OR3_STORAGE_S3_SESSION_TOKEN"]);
+async function withBackupHelper(directory, image, env, options, body) {
+  const name = `or3-backup-inspection-${randomUUID()}`;
+  const names = options.passEnv ?? [];
+  if (names.some((key) => !S3_ENV.has(key) || options.network === "none" && S3_SECRETS.has(key)))
+    throw new Error("Invalid backup helper environment selection.");
+  const lifetime = options.lifetimeSeconds ?? (options.network === "none" ? 240 : 14400);
+  if (!Number.isSafeInteger(lifetime) || lifetime < 1 || lifetime > 14400)
+    throw new Error("Invalid backup helper lifetime.");
+  const streamTimeout = options.network === "egress" || options.lifetimeSeconds !== undefined ? lifetime * 1000 : undefined;
+  let archiveMount = [];
+  let helperUid = 65532, helperGid = 65532;
+  if (options.archiveFile !== undefined) {
+    if (!isAbsolute(options.archiveFile) || /[,\r\n]/.test(options.archiveFile))
+      throw new Error("Invalid recovery archive path.");
+    const info = await lstat(options.archiveFile);
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || (info.mode & 63) !== 0 || typeof process.getuid === "function" && info.uid !== process.getuid())
+      throw new Error("Recovery archive must be a private regular file owned by the operator.");
+    const canonical = await realpath(options.archiveFile);
+    if (/[,\r\n]/.test(canonical))
+      throw new Error("Invalid recovery archive path.");
+    archiveMount = ["--mount", `type=bind,src=${canonical},dst=/or3-backup.tar,readonly`];
+    helperUid = info.uid;
+    helperGid = info.gid;
+  }
+  const environment = { ...process.env };
+  for (const key of S3_ENV)
+    delete environment[key];
+  for (const key of names) {
+    if (env[key] !== undefined)
+      environment[key] = env[key];
+  }
+  const secrets = secretValues(env);
+  const checked = async (args) => {
+    const result = await run("docker", args, directory, environment);
+    if (!result.ok)
+      throw new Error(`Offline backup reference inspection failed or is unsupported. ${redact(result.stderr, secrets)}`);
+    return result.stdout.trim();
+  };
+  let primary;
+  let value;
+  try {
+    await checked([
+      "run",
+      "--pull",
+      "never",
+      "--rm",
+      "--detach",
+      "--name",
+      name,
+      "--network",
+      options.network === "none" ? "none" : "bridge",
+      "--read-only",
+      "--security-opt",
+      "no-new-privileges:true",
+      "--cap-drop",
+      "ALL",
+      "--memory",
+      "256m",
+      "--cpus",
+      "0.5",
+      "--pids-limit",
+      "32",
+      ...options.archiveFile ? ["--user", `${helperUid}:${helperGid}`] : [],
+      "--tmpfs",
+      `/scratch:rw,noexec,nosuid,nodev,size=512m,mode=700,uid=${helperUid},gid=${helperGid}`,
+      ...archiveMount,
+      ...names.filter((key) => env[key] !== undefined).flatMap((key) => ["--env", key]),
+      "--entrypoint",
+      "sh",
+      image,
+      "-c",
+      `sleep ${lifetime}`
+    ]);
+    const helper = {
+      exec: (args) => checked(["exec", name, ...args]),
+      execFromFile: async (args, file) => streamFileToCommand("docker", ["exec", "-i", name, ...args], file, directory, secrets, environment, streamTimeout),
+      execToFile: async (args, file) => streamCommandToFile("docker", ["exec", name, ...args], file, directory, secrets, environment, streamTimeout),
+      async loadSqlite(dataTgz) {
+        await this.execFromFile(["sh", "-c", "ulimit -f 16384; tar tvzf - > /scratch/inventory"], dataTgz);
+        const inventory = JSON.parse(await this.exec(["sh", "-c", NODE, "or3-backup-inspection", INSPECTOR, "inventory"]));
+        if (!Array.isArray(inventory.selected) || !inventory.selected.includes("./sync.sqlite") && !inventory.selected.includes("sync.sqlite") || inventory.selected.some((item) => !/^(?:\.\/)?sync[.]sqlite(?:-wal)?$/.test(item)) || inventory.selected.length > 2 || !Number.isSafeInteger(inventory.bytes) || inventory.bytes < 0)
+          throw new Error("Invalid offline backup inspection inventory response.");
+        const freeKiB = Number(await this.exec(["sh", "-c", "df -Pk /scratch | awk 'NR == 2 { print $4 }'"]));
+        if (!Number.isFinite(freeKiB) || freeKiB < 0)
+          throw new Error("Could not verify offline backup scratch capacity.");
+        assertEnoughFreeSpace(freeKiB * 1024, inventory.bytes, "Offline backup inspection scratch");
+        await this.execFromFile(["tar", "-xz", "-f", "-", "-C", "/scratch", ...inventory.selected], dataTgz);
+      }
+    };
+    value = await body(helper);
+  } catch (error) {
+    primary = error;
+  }
+  const cleanup = await run("docker", ["rm", "--force", name], directory, environment);
+  if (!cleanup.ok && !/No such container/i.test(cleanup.stderr)) {
+    throw new AggregateError(primary ? [primary] : [], `Offline backup inspection helper cleanup failed. ${redact(cleanup.stderr, secrets)}`);
+  }
+  if (primary)
+    throw primary;
+  return value;
+}
+
+// src/backup/remote.ts
+var INSPECTOR2 = "/app/scripts/docker/backup-inspect.mjs";
+var REMOTE = "/app/scripts/docker/remote-objects.mjs";
+var NODE2 = 'if [ -x /nodejs/bin/node ]; then exec /nodejs/bin/node "$@"; else exec node "$@"; fi';
+var INPUT_NODE = 'if [ -x /nodejs/bin/node ]; then exec /nodejs/bin/node "$@" < /or3-backup.tar; else exec node "$@" < /or3-backup.tar; fi';
+var SOURCE_ENV = ["OR3_STORAGE_S3_ENDPOINT", "OR3_STORAGE_S3_REGION", "OR3_STORAGE_S3_BUCKET", "OR3_STORAGE_S3_KEY_PREFIX", "OR3_STORAGE_S3_ALLOW_INSECURE_HTTP"];
+var TRANSFER_ENV = [...SOURCE_ENV, "OR3_STORAGE_S3_ACCESS_KEY_ID", "OR3_STORAGE_S3_SECRET_ACCESS_KEY", "OR3_STORAGE_S3_SESSION_TOKEN", "OR3_STORAGE_S3_FORCE_PATH_STYLE"];
+function remoteSource(env) {
+  if (env.OR3_SYNC_PROVIDER !== "sqlite" || env.NUXT_PUBLIC_STORAGE_PROVIDER !== "s3" || env.OR3_SQLITE_DRIVER && env.OR3_SQLITE_DRIVER !== "better-sqlite3")
+    throw new Error("Unsupported offline S3 backup provider profile.");
+  let endpoint;
+  try {
+    endpoint = new URL((env.OR3_STORAGE_S3_ENDPOINT ?? "").trim());
+  } catch {
+    throw new Error("Invalid S3 recovery configuration.");
+  }
+  if (!["http:", "https:"].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.pathname !== "/" || endpoint.search || endpoint.hash || endpoint.protocol === "http:" && env.OR3_STORAGE_S3_ALLOW_INSECURE_HTTP !== "true")
+    throw new Error("Invalid S3 recovery configuration.");
+  const bucket = (env.OR3_STORAGE_S3_BUCKET ?? "").trim();
+  const prefix = (env.OR3_STORAGE_S3_KEY_PREFIX ?? "").trim().replace(/^\/+/, "").replace(/\/+$/, "");
+  if (!bucket || bucket.length > 255 || /[\x00-\x20\x7f/\\]/.test(bucket) || prefix.length > 511 || /[\x00-\x1f\\]/.test(prefix) || prefix && prefix.split("/").some((part) => !part || part === "." || part === ".."))
+    throw new Error("Invalid S3 recovery configuration.");
+  return { endpointOrigin: endpoint.origin, bucket, keyPrefix: prefix ? `${prefix}/` : "" };
+}
+function assertRemoteTransferConfiguration(env) {
+  const source = remoteSource(env);
+  if (!env.OR3_STORAGE_S3_REGION?.trim() || !env.OR3_STORAGE_S3_ACCESS_KEY_ID?.trim() || !env.OR3_STORAGE_S3_SECRET_ACCESS_KEY?.trim())
+    throw new Error("Invalid S3 recovery configuration.");
+  return source;
+}
+async function preflightRemoteRestore(directory, manifest2, target, backupDir) {
+  if (manifest2.remote.kind === "s3-copy-v1") {
+    try {
+      return await reconcileRemoteTarget(directory, manifest2, target, backupDir, manifest2.remote);
+    } catch (error) {
+      const detail = redact(error instanceof Error ? error.message : String(error), secretValues(target));
+      throw new Error(`S3 reconciliation did not complete; additive objects may remain in the target. ${detail}`, { cause: error });
+    }
+  }
+  const result = await checkRemoteTarget(directory, manifest2, target, backupDir, manifest2.remote);
+  if (result.missing || result.mismatched)
+    throw new Error("S3 reference target has missing or mismatched objects.");
+  return result;
+}
+function checkedCounts(result, expected) {
+  if (result.checked !== expected || !Array.isArray(result.missing) || !Array.isArray(result.mismatched) || result.missing.length + result.mismatched.length > result.checked || [...result.missing, ...result.mismatched].some((value) => typeof value !== "string" || value.length > 1024))
+    throw new Error("Invalid S3 reference check receipt.");
+  return { checked: result.checked, missing: result.missing.length, mismatched: result.mismatched.length };
+}
+function sourceEnvironment(source) {
+  const env = { OR3_SYNC_PROVIDER: "sqlite", NUXT_PUBLIC_STORAGE_PROVIDER: "s3", OR3_STORAGE_S3_ENDPOINT: source.endpointOrigin, OR3_STORAGE_S3_BUCKET: source.bucket, OR3_STORAGE_S3_KEY_PREFIX: source.keyPrefix, OR3_STORAGE_S3_ALLOW_INSECURE_HTTP: source.endpointOrigin.startsWith("http:") ? "true" : "false" };
+  const normalized = remoteSource(env);
+  if (normalized.endpointOrigin !== source.endpointOrigin || normalized.bucket !== source.bucket || normalized.keyPrefix !== source.keyPrefix)
+    throw new Error("Invalid S3 backup source.");
+  return env;
+}
+async function assertArchive(backupDir, remote) {
+  const unvalidated = remote;
+  if (unvalidated.kind !== "s3-copy-v1" || unvalidated.file !== "remote-objects.tar" || !/^[a-f0-9]{64}$/.test(remote.sha256) || !Number.isSafeInteger(remote.bytes) || remote.bytes < 1)
+    throw new Error("Invalid S3 backup archive metadata.");
+  const archive = join10(backupDir, remote.file);
+  if ((await stat2(archive)).size !== remote.bytes || await sha256File(archive) !== remote.sha256)
+    throw new Error("S3 backup archive checksum or size mismatch.");
+  return archive;
+}
+async function verifyRemoteSnapshot(directory, image, backupDir, remote) {
+  const env = sourceEnvironment(remote.source);
+  const archive = await assertArchive(backupDir, remote);
+  const receipt = join10(deploymentPaths(directory).operations, `.s3-verify-${randomUUID2()}.json`);
+  let verified;
+  try {
+    verified = await withBackupHelper(directory, imageAtDigest(image.image, image.imageDigest), env, { network: "none", passEnv: SOURCE_ENV, archiveFile: archive, lifetimeSeconds: 14400 }, async (helper) => {
+      await helper.loadSqlite(join10(backupDir, "data.tgz"));
+      await helper.execToFile(["sh", "-c", INPUT_NODE, "or3-s3-verify", REMOTE, "verify", "/scratch/sync.sqlite"], receipt);
+      if ((await stat2(receipt)).size > 64 * 1024)
+        throw new Error("Invalid S3 backup verification receipt.");
+      return JSON.parse(await readFile3(receipt, "utf8"));
+    });
+  } finally {
+    await rm4(receipt, { force: true });
+  }
+  if (verified.contract !== 2 || verified.kind !== "s3-copy-v1" || verified.objectCount !== remote.objectCount || verified.payloadBytes !== remote.payloadBytes || verified.inventorySha256 !== remote.inventorySha256)
+    throw new Error("S3 backup verification did not match the authenticated manifest.");
+  await assertArchive(backupDir, remote);
+}
+async function reconcileRemoteTarget(directory, image, target, backupDir, remote) {
+  const destination = assertRemoteTransferConfiguration(target);
+  if (destination.keyPrefix !== remote.source.keyPrefix)
+    throw new Error("S3 backup and target key prefix mismatch.");
+  await verifyRemoteSnapshot(directory, image, backupDir, remote);
+  const archive = await assertArchive(backupDir, remote);
+  const env = { ...target, OR3_BACKUP_S3_ENDPOINT_ORIGIN: remote.source.endpointOrigin, OR3_BACKUP_S3_BUCKET: remote.source.bucket, OR3_BACKUP_S3_KEY_PREFIX: remote.source.keyPrefix, OR3_BACKUP_ARCHIVE_SHA256: remote.sha256 };
+  const receipt = join10(deploymentPaths(directory).operations, `.s3-reconcile-${randomUUID2()}.json`);
+  let result;
+  try {
+    result = await withBackupHelper(directory, imageAtDigest(image.image, image.imageDigest), env, { network: "egress", passEnv: [...TRANSFER_ENV, "OR3_BACKUP_S3_ENDPOINT_ORIGIN", "OR3_BACKUP_S3_BUCKET", "OR3_BACKUP_S3_KEY_PREFIX", "OR3_BACKUP_ARCHIVE_SHA256"], archiveFile: archive, lifetimeSeconds: 14400 }, async (helper) => {
+      await helper.loadSqlite(join10(backupDir, "data.tgz"));
+      await helper.execToFile(["sh", "-c", NODE2, "or3-s3-reconcile", REMOTE, "reconcile", "/scratch/sync.sqlite", "/or3-backup.tar"], receipt);
+      if ((await stat2(receipt)).size > 64 * 1024)
+        throw new Error("Invalid S3 reconciliation receipt.");
+      return JSON.parse(await readFile3(receipt, "utf8"));
+    });
+  } finally {
+    await rm4(receipt, { force: true });
+  }
+  if (!Number.isSafeInteger(result.uploaded) || result.uploaded < 0 || result.uploaded > remote.objectCount || !Number.isSafeInteger(result.markersCreated) || result.markersCreated < 0 || result.markersCreated > remote.objectCount)
+    throw new Error("Invalid S3 reconciliation receipt.");
+  return { uploaded: result.uploaded, markersCreated: result.markersCreated };
+}
+async function checkRemoteCopyTarget(directory, image, target, backupDir, remote) {
+  const destination = assertRemoteTransferConfiguration(target);
+  if (destination.keyPrefix !== remote.source.keyPrefix)
+    throw new Error("S3 backup and target key prefix mismatch.");
+  await verifyRemoteSnapshot(directory, image, backupDir, remote);
+  const archive = await assertArchive(backupDir, remote);
+  const env = { ...target, OR3_BACKUP_S3_ENDPOINT_ORIGIN: remote.source.endpointOrigin, OR3_BACKUP_S3_BUCKET: remote.source.bucket, OR3_BACKUP_S3_KEY_PREFIX: remote.source.keyPrefix, OR3_BACKUP_ARCHIVE_SHA256: remote.sha256 };
+  const receipt = join10(deploymentPaths(directory).operations, `.s3-check-copy-${randomUUID2()}.json`);
+  try {
+    const result = await withBackupHelper(directory, imageAtDigest(image.image, image.imageDigest), env, { network: "egress", passEnv: [...TRANSFER_ENV, "OR3_BACKUP_S3_ENDPOINT_ORIGIN", "OR3_BACKUP_S3_BUCKET", "OR3_BACKUP_S3_KEY_PREFIX", "OR3_BACKUP_ARCHIVE_SHA256"], archiveFile: archive, lifetimeSeconds: 14400 }, async (helper) => {
+      await helper.loadSqlite(join10(backupDir, "data.tgz"));
+      await helper.execToFile(["sh", "-c", NODE2, "or3-s3-check-copy", REMOTE, "check-copy", "/scratch/sync.sqlite", "/or3-backup.tar"], receipt);
+      if ((await stat2(receipt)).size > 64 * 1024 * 1024)
+        throw new Error("Invalid S3 reference check receipt.");
+      return JSON.parse(await readFile3(receipt, "utf8"));
+    });
+    return checkedCounts(result, remote.objectCount);
+  } finally {
+    await rm4(receipt, { force: true });
+  }
+}
+async function checkRemoteTarget(directory, image, target, backupDir, remote) {
+  const source = assertRemoteTransferConfiguration(target);
+  if (source.endpointOrigin !== remote.source.endpointOrigin || source.bucket !== remote.source.bucket || source.keyPrefix !== remote.source.keyPrefix)
+    throw new Error("S3 reference snapshot can only use its original source target.");
+  const unvalidated = remote;
+  if (unvalidated.kind !== "s3-reference-v1" || unvalidated.file !== "remote-inventory.json" || !/^[a-f0-9]{64}$/.test(remote.sha256) || remote.inventorySha256 !== remote.sha256 || !Number.isSafeInteger(remote.bytes) || remote.bytes < 1 || remote.bytes > 64 * 1024 * 1024)
+    throw new Error("Invalid S3 backup reference inventory.");
+  const inventory = join10(backupDir, remote.file);
+  const assertInventory = async () => {
+    if ((await stat2(inventory)).size !== remote.bytes || await sha256File(inventory) !== remote.sha256)
+      throw new Error("S3 backup inventory checksum or size mismatch.");
+  };
+  await assertInventory();
+  const offlineEnv = sourceEnvironment(remote.source);
+  const receipt = join10(deploymentPaths(directory).operations, `.s3-check-${randomUUID2()}.json`);
+  try {
+    const verified = await withBackupHelper(directory, imageAtDigest(image.image, image.imageDigest), offlineEnv, { network: "none", passEnv: SOURCE_ENV, archiveFile: inventory, lifetimeSeconds: 14400 }, async (helper) => {
+      await helper.loadSqlite(join10(backupDir, "data.tgz"));
+      await helper.execToFile(["sh", "-c", INPUT_NODE, "or3-s3-verify-inventory", REMOTE, "verify-inventory", "/scratch/sync.sqlite"], receipt);
+      if ((await stat2(receipt)).size > 64 * 1024)
+        throw new Error("Invalid S3 backup verification receipt.");
+      return JSON.parse(await readFile3(receipt, "utf8"));
+    });
+    if (verified.contract !== 2 || verified.kind !== "s3-reference-v1" || verified.objectCount !== remote.objectCount || verified.payloadBytes !== remote.payloadBytes || verified.inventorySha256 !== remote.inventorySha256)
+      throw new Error("S3 inventory verification did not match the authenticated manifest.");
+    await rm4(receipt, { force: true });
+    await assertInventory();
+    const result = await withBackupHelper(directory, imageAtDigest(image.image, image.imageDigest), target, { network: "egress", passEnv: TRANSFER_ENV, archiveFile: inventory, lifetimeSeconds: 14400 }, async (helper) => {
+      await helper.loadSqlite(join10(backupDir, "data.tgz"));
+      await helper.execToFile(["sh", "-c", INPUT_NODE, "or3-s3-check", REMOTE, "check", "/scratch/sync.sqlite"], receipt);
+      if ((await stat2(receipt)).size > 64 * 1024 * 1024)
+        throw new Error("Invalid S3 reference check receipt.");
+      return JSON.parse(await readFile3(receipt, "utf8"));
+    });
+    return checkedCounts(result, remote.objectCount);
+  } finally {
+    await rm4(receipt, { force: true });
+  }
+}
+function assertSummary(summary) {
+  if (summary.contract !== 2 || !Number.isSafeInteger(summary.references) || summary.references < 0 || summary.references > 1e5 || !Number.isSafeInteger(summary.payloadBytes) || summary.payloadBytes < 0 || summary.payloadBytes > summary.references * 2 ** 30)
+    throw new Error("Invalid S3 backup reference summary.");
+}
+async function captureRemoteInventory(directory, state, env, backupDir) {
+  const source = remoteSource(env);
+  const image = imageAtDigest(state.image, state.imageDigest);
+  const data = join10(backupDir, "data.tgz");
+  const inventory = join10(backupDir, "remote-inventory.json");
+  const summary = await withBackupHelper(directory, image, env, { network: "none", passEnv: SOURCE_ENV, lifetimeSeconds: 14400 }, async (helper) => {
+    await helper.loadSqlite(data);
+    const result = JSON.parse(await helper.exec(["sh", "-c", NODE2, "or3-s3-summary", INSPECTOR2, "s3-summary", source.keyPrefix]));
+    assertSummary(result);
+    await helper.execToFile(["sh", "-c", NODE2, "or3-s3-inventory", REMOTE, "inventory", "/scratch/sync.sqlite"], inventory);
+    return result;
+  });
+  const bytes = (await stat2(inventory)).size;
+  if (!Number.isSafeInteger(bytes) || bytes < 1 || bytes > 64 * 1024 * 1024)
+    throw new Error("Invalid S3 backup reference inventory.");
+  const before = await sha256File(inventory);
+  const receipt = join10(backupDir, `.s3-inventory-verification-${randomUUID2()}.json`);
+  let verified;
+  try {
+    verified = await withBackupHelper(directory, image, env, { network: "none", passEnv: SOURCE_ENV, archiveFile: inventory, lifetimeSeconds: 14400 }, async (helper) => {
+      await helper.loadSqlite(data);
+      await helper.execToFile(["sh", "-c", INPUT_NODE, "or3-s3-verify-inventory", REMOTE, "verify-inventory", "/scratch/sync.sqlite"], receipt);
+      if ((await stat2(receipt)).size > 64 * 1024)
+        throw new Error("Invalid S3 backup verification receipt.");
+      return JSON.parse(await readFile3(receipt, "utf8"));
+    });
+  } finally {
+    await rm4(receipt, { force: true });
+  }
+  if (verified.contract !== 2 || verified.kind !== "s3-reference-v1" || verified.objectCount !== summary.references || verified.payloadBytes !== summary.payloadBytes || verified.inventorySha256 !== before)
+    throw new Error("S3 backup verification did not match the canonical reference summary.");
+  if (await sha256File(inventory) !== before || (await stat2(inventory)).size !== bytes)
+    throw new Error("S3 backup inventory changed during verification.");
+  return { kind: "s3-reference-v1", file: "remote-inventory.json", sha256: before, bytes, inventorySha256: verified.inventorySha256, objectCount: verified.objectCount, payloadBytes: verified.payloadBytes, source, providerVersion: "0.0.15" };
+}
+async function captureRemoteSnapshot(directory, state, env, backupDir) {
+  const source = assertRemoteTransferConfiguration(env);
+  const image = imageAtDigest(state.image, state.imageDigest);
+  const data = join10(backupDir, "data.tgz");
+  const archive = join10(backupDir, "remote-objects.tar");
+  const summary = await withBackupHelper(directory, image, env, { network: "none", passEnv: SOURCE_ENV }, async (helper) => {
+    await helper.loadSqlite(data);
+    return JSON.parse(await helper.exec(["sh", "-c", NODE2, "or3-s3-summary", INSPECTOR2, "s3-summary", source.keyPrefix]));
+  });
+  assertSummary(summary);
+  const required = summary.payloadBytes + summary.references * (64 * 1024 + 4096) + 64 * 1024 * 1024;
+  await assertFreeSpaceForArchive(archive, required, "S3 backup");
+  await withBackupHelper(directory, image, env, { network: "egress", passEnv: TRANSFER_ENV }, async (helper) => {
+    await helper.loadSqlite(data);
+    await helper.execToFile(["sh", "-c", NODE2, "or3-s3-capture", REMOTE, "capture", "/scratch/sync.sqlite"], archive);
+  });
+  const before = await sha256File(archive);
+  const receipt = join10(backupDir, `.s3-verification-${randomUUID2()}.json`);
+  let verified;
+  try {
+    verified = await withBackupHelper(directory, image, env, { network: "none", passEnv: SOURCE_ENV, archiveFile: archive, lifetimeSeconds: 14400 }, async (helper) => {
+      await helper.loadSqlite(data);
+      await helper.execToFile(["sh", "-c", INPUT_NODE, "or3-s3-verify", REMOTE, "verify", "/scratch/sync.sqlite"], receipt);
+      const size = (await stat2(receipt)).size;
+      if (size > 64 * 1024)
+        throw new Error("Invalid S3 backup verification receipt.");
+      return JSON.parse(await readFile3(receipt, "utf8"));
+    });
+  } finally {
+    await rm4(receipt, { force: true });
+  }
+  if (verified.contract !== 2 || verified.kind !== "s3-copy-v1" || verified.objectCount !== summary.references || verified.payloadBytes !== summary.payloadBytes || !/^[a-f0-9]{64}$/.test(verified.inventorySha256))
+    throw new Error("S3 backup verification did not match the canonical reference summary.");
+  const bytes = (await stat2(archive)).size;
+  if (!Number.isSafeInteger(bytes) || bytes < 0 || await sha256File(archive) !== before)
+    throw new Error("S3 backup archive changed during verification.");
+  return { kind: "s3-copy-v1", file: "remote-objects.tar", sha256: before, bytes, inventorySha256: verified.inventorySha256, objectCount: verified.objectCount, payloadBytes: verified.payloadBytes, source, providerVersion: "0.0.15" };
+}
+
+// src/backup/vault.ts
+import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat as lstat2, open as open2, readFile as readFile4 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join11 } from "node:path";
+async function readAuthenticatedVaultId(path, expectedSha256) {
+  if (!/^[a-f0-9]{64}$/.test(expectedSha256))
+    throw new Error("Invalid vault backup checksum.");
+  const file = await open2(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const before = await file.stat({ bigint: true });
+    const identity = (info) => [info.dev, info.ino, info.size, info.mtimeNs, info.ctimeNs].join(":");
+    const pathInfo = await lstat2(path, { bigint: true });
+    if (!before.isFile() || !pathInfo.isFile() || pathInfo.isSymbolicLink() || before.nlink !== 1n || before.size < 113n || before.size > BigInt(2 ** 30 + 112) || identity(before) !== identity(pathInfo))
+      throw new Error("invalid vault backup");
+    const hash = createHash2("sha256"), buffer = Buffer.alloc(1024 * 1024), header = Buffer.alloc(96);
+    let offset = 0;
+    while (offset < Number(before.size)) {
+      const count = (await file.read(buffer, 0, Math.min(buffer.length, Number(before.size) - offset), offset)).bytesRead;
+      if (count === 0)
+        throw new Error("truncated vault backup");
+      if (offset < header.length)
+        buffer.copy(header, offset, 0, Math.min(count, header.length - offset));
+      hash.update(buffer.subarray(0, count));
+      offset += count;
+    }
+    if (hash.digest("hex") !== expectedSha256 || identity(before) !== identity(await file.stat({ bigint: true })) || identity(before) !== identity(await lstat2(path, { bigint: true })))
+      throw new Error("vault backup changed");
+    const vaultId = header.subarray(8, 40).toString("latin1");
+    if (!header.subarray(0, 8).equals(Buffer.from("OR3BAK01")) || !/^[a-f0-9]{32}$/.test(vaultId) || header.readBigUInt64BE(84) + 112n !== before.size || header.subarray(92, 96).some((byte) => byte !== 0))
+      throw new Error("invalid vault header");
+    return vaultId;
+  } catch {
+    throw new Error("Vault backup checksum, header, or file identity is invalid.");
+  } finally {
+    await file.close();
+  }
+}
+function backupHasVaultCoverage(manifest2, env, archivedConfig) {
+  if (Object.keys(env).some((key) => /^(?:RUNTIME_CONFIG|NUXT_SECRETS|NITRO_ENV_(?:PREFIX|EXPANSION)|NITRO_SECRETS(?:_.*)?)$/.test(key)))
+    return false;
+  const provider = env.NUXT_SECRETS_PROVIDER;
+  if (provider === undefined && manifest2.appVersion === "0.1.90" && manifest2.image === "ghcr.io/saluana/or3-chat:0.1.90" && manifest2.imageDigest === "sha256:d50b70d6522574798f1a3081894b5bf8fe9eca7aa5f183ad5a562de2e4f41c12" && archivedConfig !== undefined && createHash2("sha256").update(archivedConfig).digest("hex") === manifest2.configSha256) {
+    const keys = new Set;
+    for (const line of archivedConfig.split(/\r?\n/)) {
+      const text = line.trim();
+      if (!text || text.startsWith("#"))
+        continue;
+      const match = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(text);
+      if (!match || keys.has(match[1]) || !/^(?:'[^'\r\n]*'|"[^"$\\\r\n]*"|[^'"$\\\s]*)$/.test(match[2]))
+        return false;
+      keys.add(match[1]);
+    }
+    return !keys.has("NUXT_SECRETS_PROVIDER");
+  }
+  return provider === "" || (provider === undefined || provider === "or3-secrets") && Boolean(manifest2.vaultSha256);
+}
+async function assertVaultVolumesExist(directory, state) {
+  const dataVolume = `${state.volumeName}-vault-data`;
+  const keyVolume = `${state.volumeName}-vault-key`;
+  for (const volume of [dataVolume, keyVolume]) {
+    const result = await run("docker", ["volume", "inspect", volume], directory);
+    if (!result.ok)
+      throw new Error("Vault custody is missing or cannot be inspected. The operation is refused; preserve the encrypted backup and recover the vault key and volumes first.");
+  }
+}
+async function assertExistingVaultCustody(directory, state, manifest2, backupPath, backupEnv) {
+  const archivedConfig = await readFile4(join11(backupPath, "config.env"), "utf8");
+  if (!backupHasVaultCoverage(manifest2, backupEnv, archivedConfig))
+    throw new Error("Backup lacks the vault archive required by its saved configuration. Preserve it and use a separately reviewed recovery procedure.");
+  if (!manifest2.vaultSha256)
+    return;
+  const expectedVaultId = await readAuthenticatedVaultId(join11(backupPath, "vault.backup"), manifest2.vaultSha256);
+  const dataVolume = `${state.volumeName}-vault-data`;
+  const keyVolume = `${state.volumeName}-vault-key`;
+  await assertVaultVolumesExist(directory, state);
+  const script = `
+const fs = require('node:fs');
+const { spawnSync } = require('node:child_process');
+for (const path of ['/vault-data/live/complete','/vault-key/master.key','/vault-key/operator.token']) {
+  const st = fs.lstatSync(path);
+  if (!st.isFile() || st.isSymbolicLink() || st.uid !== 1000 || (st.mode & 0o777) !== 0o600 || st.nlink !== 1 || st.size < 1) process.exit(1);
+}
+if (!/^[a-f0-9]{32}$/.test(fs.readFileSync('/vault-data/live/complete', 'utf8').trim())) process.exit(1);
+// Never open the running vault database for maintenance. Copy a stable view to
+// private tmpfs and verify that copy with the existing vault's master key.
+const db = '/vault-data/live/vault.sqlite';
+const journal = db + '-journal';
+const identity = (s) => [s.dev, s.ino, s.size, s.mtimeNs, s.ctimeNs].join(':');
+const journalIdentity = () => {
+  let input;
+  try { input = fs.openSync(journal, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW); }
+  catch (e) { if (e.code === 'ENOENT') return 'absent'; throw e; }
+  try {
+    const before = fs.fstatSync(input, { bigint: true });
+    if (!before.isFile() || before.uid !== 1000n || (before.mode & 0o777n) !== 0o600n || before.nlink !== 1n) process.exit(1);
+    if (before.size !== 0n) {
+      if (before.size < 8n) process.exit(1);
+      const header = Buffer.alloc(8);
+      if (fs.readSync(input, header, 0, 8, 0) !== 8 || !header.every(byte => byte === 0)) process.exit(1);
+    }
+    if (identity(before) !== identity(fs.fstatSync(input, { bigint: true })) || identity(before) !== identity(fs.lstatSync(journal, { bigint: true }))) process.exit(1);
+    return identity(before);
+  } finally { fs.closeSync(input); }
+};
+const copy = (source, destination, maxSize) => {
+  const input = fs.openSync(source, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+  try {
+    const before = fs.fstatSync(input, { bigint: true });
+    if (!before.isFile() || before.uid !== 1000n || (before.mode & 0o777n) !== 0o600n || before.nlink !== 1n || before.size < 1n || before.size > BigInt(maxSize)) process.exit(1);
+    const output = fs.openSync(destination, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o600);
+    try {
+      const buffer = Buffer.alloc(1024 * 1024);
+      let remaining = Number(before.size);
+      while (remaining > 0) {
+        const n = fs.readSync(input, buffer, 0, Math.min(buffer.length, remaining), null);
+        if (n === 0) process.exit(1);
+        let offset = 0;
+        while (offset < n) offset += fs.writeSync(output, buffer, offset, n - offset);
+        remaining -= n;
+      }
+    } finally { fs.closeSync(output); }
+    if (identity(before) !== identity(fs.fstatSync(input, { bigint: true })) || identity(before) !== identity(fs.lstatSync(source, { bigint: true }))) process.exit(1);
+    return identity(before);
+  } finally { fs.closeSync(input); }
+};
+const journalBefore = journalIdentity();
+fs.mkdirSync('/scratch/vault', { mode: 0o700 });
+const dbIdentity = copy(db, '/scratch/vault/vault.sqlite', 128 * 1024 * 1024);
+const markerIdentity = copy('/vault-data/live/complete', '/scratch/vault/complete', 128);
+const keyIdentity = copy('/vault-key/master.key', '/scratch/master.key', 4096);
+if (fs.readFileSync('/scratch/vault/complete', 'utf8').trim() !== process.env.OR3_EXPECTED_VAULT_ID) process.exit(1);
+if (journalIdentity() !== journalBefore) process.exit(1);
+const audit = '/app/vault/cli.js audit verify'.split(' ');
+const checked = spawnSync('/usr/local/bin/bun', ['--no-env-file', ...audit, '--vault-dir', '/scratch/vault', '--key-file', '/scratch/master.key'], { stdio: 'ignore', timeout: 120000 });
+if (checked.status !== 0 || checked.error) process.exit(1);
+if (journalIdentity() !== journalBefore) process.exit(1);
+if (dbIdentity !== identity(fs.lstatSync(db, { bigint: true })) || markerIdentity !== identity(fs.lstatSync('/vault-data/live/complete', { bigint: true })) || keyIdentity !== identity(fs.lstatSync('/vault-key/master.key', { bigint: true }))) process.exit(1);
+`;
+  const name = `or3-vault-inspection-${randomUUID3()}`;
+  let failure;
+  try {
+    const result = await run("docker", [
+      "run",
+      "--rm",
+      "--name",
+      name,
+      "--pull",
+      "never",
+      "--log-driver",
+      "none",
+      "--network",
+      "none",
+      "--read-only",
+      "--user",
+      "1000:65532",
+      "--security-opt",
+      "no-new-privileges:true",
+      "--cap-drop",
+      "ALL",
+      "--memory",
+      "256m",
+      "--pids-limit",
+      "32",
+      "--tmpfs",
+      "/scratch:rw,noexec,nosuid,nodev,size=192m,mode=700,uid=1000,gid=65532",
+      "--env",
+      `OR3_EXPECTED_VAULT_ID=${expectedVaultId}`,
+      "--mount",
+      `type=volume,src=${dataVolume},dst=/vault-data,readonly`,
+      "--mount",
+      `type=volume,src=${keyVolume},dst=/vault-key,readonly`,
+      "--entrypoint",
+      "/nodejs/bin/node",
+      imageAtDigest(manifest2.image, manifest2.imageDigest),
+      "-e",
+      script
+    ], directory);
+    if (!result.ok)
+      throw new Error("Vault custody is empty, incomplete, or unreadable. Restore is refused; preserve the encrypted backup and recover the vault key and volumes first.");
+  } catch (error) {
+    failure = error;
+  }
+  const cleanup = await run("docker", ["rm", "--force", name], directory);
+  if (!cleanup.ok && !/No such container/i.test(cleanup.stderr))
+    throw new AggregateError(failure ? [failure] : [], "Vault custody inspection cleanup failed. Inspect the named helper before retrying.");
+  if (failure)
+    throw failure;
+}
+
 // src/backup/manifests.ts
 var BACKUP_ID_PATTERN = /^backup-[0-9A-Za-z-]+$/;
 async function backupAuthenticationKey(directory, create = false) {
@@ -1820,14 +2621,14 @@ function backupAuthenticationTag(key, manifestContents) {
 }
 async function writeBackupAuthentication(directory, backupPath, manifestContents) {
   const key = await backupAuthenticationKey(directory, true);
-  await writeSecure(join9(backupPath, "manifest.auth"), `${backupAuthenticationTag(key, manifestContents)}
+  await writeSecure(join12(backupPath, "manifest.auth"), `${backupAuthenticationTag(key, manifestContents)}
 `);
 }
 async function assertBackupAuthentication(directory, backupPath, manifestContents) {
   const key = await backupAuthenticationKey(directory);
   let provided;
   try {
-    const value = (await readText(join9(backupPath, "manifest.auth"))).trim();
+    const value = (await readText(join12(backupPath, "manifest.auth"))).trim();
     if (!/^[0-9a-f]{64}$/i.test(value))
       throw new Error("invalid authentication tag");
     provided = Buffer.from(value, "hex");
@@ -1856,10 +2657,10 @@ function classifyBackupError(error) {
   return { code: "backup-entry-invalid", message };
 }
 async function inspectBackupEntry(backupsRoot, entry, directory) {
-  const path = join9(backupsRoot, entry);
+  const path = join12(backupsRoot, entry);
   let info;
   try {
-    info = await lstat(path);
+    info = await lstat3(path);
   } catch (error) {
     return { kind: "unreadable", entryName: entry, ...classifyBackupError(error) };
   }
@@ -1888,7 +2689,7 @@ async function inspectBackupEntry(backupsRoot, entry, directory) {
     };
   }
   try {
-    await lstat(join9(path, "manifest.auth"));
+    await lstat3(join12(path, "manifest.auth"));
   } catch (error) {
     if (error.code === "ENOENT") {
       return {
@@ -1901,8 +2702,8 @@ async function inspectBackupEntry(backupsRoot, entry, directory) {
     return { kind: "unreadable", entryName: entry, ...classifyBackupError(error) };
   }
   try {
-    const raw = JSON.parse(await readText(join9(path, "manifest.json")));
-    if (typeof raw.schemaVersion === "number" && raw.schemaVersion > 1) {
+    const raw = JSON.parse(await readText(join12(path, "manifest.json")));
+    if (typeof raw.schemaVersion === "number" && raw.schemaVersion > 2) {
       return {
         kind: "unsupported",
         entryName: entry,
@@ -1932,9 +2733,13 @@ async function inspectBackupEntry(backupsRoot, entry, directory) {
       };
     }
     let bytes = 0;
-    for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth", ...manifest2.vaultSha256 ? ["vault.backup"] : []]) {
-      bytes += (await lstat(join9(path, file))).size;
+    for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth", ...manifest2.vaultSha256 ? ["vault.backup"] : [], ...manifest2.schemaVersion === 2 ? [manifest2.remote.file] : []]) {
+      bytes += (await lstat3(join12(path, file))).size;
     }
+    const savedConfig = await readText(join12(path, "config.env"));
+    if (createHash3("sha256").update(savedConfig).digest("hex") !== manifest2.configSha256)
+      throw new Error(`Backup configuration changed during inventory for ${manifest2.backupId}.`);
+    const recoveryArtifactsComplete = Boolean(manifest2.managedAssetSha256) && backupHasVaultCoverage(manifest2, parseEnv(savedConfig), savedConfig);
     return {
       kind: "verified",
       backup: {
@@ -1943,7 +2748,11 @@ async function inspectBackupEntry(backupsRoot, entry, directory) {
         appVersion: manifest2.appVersion,
         path,
         bytes,
-        dataSha256: manifest2.dataSha256
+        dataSha256: manifest2.dataSha256,
+        schemaVersion: manifest2.schemaVersion,
+        recoveryArtifactsComplete,
+        ...manifest2.snapshotKind ? { snapshotKind: manifest2.snapshotKind } : {},
+        ...manifest2.schemaVersion === 2 ? { remoteKind: manifest2.remote.kind } : {}
       }
     };
   } catch (error) {
@@ -1989,15 +2798,15 @@ async function inventoryBackups(directory) {
   });
   return { entries, storeErrors: [] };
 }
-async function enumerateBackups(directory) {
-  const inventory = await inventoryBackups(directory);
-  return inventory.entries.filter((entry) => entry.kind === "verified").map((entry) => entry.backup).sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0);
-}
 function assertBackupMatchesDeployment(manifest2, backupEnv, state, env) {
   if (manifest2.mode !== state.mode || manifest2.appVersion === undefined || manifest2.image === undefined) {
     throw new Error(`Backup ${manifest2.backupId} does not match the managed deployment mode.`);
   }
   assertDeploymentIdentity(state, env);
+  if (managedProviderProfile(backupEnv) !== managedProviderProfile(env)) {
+    throw new Error("backup-profile-mismatch: backup and deployment use different managed provider profiles.");
+  }
+  restoreStorageConfiguration(backupEnv, env);
   const expected = {
     OR3_COMPOSE_PROJECT: state.composeProject,
     OR3_VOLUME_NAME: state.volumeName,
@@ -2040,32 +2849,53 @@ function assertBackupMatchesDeployment(manifest2, backupEnv, state, env) {
 }
 async function readManifest(backupPath, authenticatedForDirectory) {
   await lifecycleFaults.beforeArchiveRead?.();
-  const manifestContents = await readText(join9(backupPath, "manifest.json"));
+  const manifestContents = await readText(join12(backupPath, "manifest.json"));
   if (authenticatedForDirectory)
     await assertBackupAuthentication(authenticatedForDirectory, backupPath, manifestContents);
   const manifest2 = JSON.parse(manifestContents);
-  if (manifest2.schemaVersion !== 1 || !BACKUP_ID_PATTERN.test(manifest2.backupId) || !Number.isFinite(Date.parse(manifest2.createdAt)) || !isVersion(manifest2.appVersion) || !manifest2.image || !/^sha256:[0-9a-f]{64}$/i.test(manifest2.imageDigest) || !/^[0-9a-f]{64}$/i.test(manifest2.dataSha256) || !/^[0-9a-f]{64}$/i.test(manifest2.configSha256 ?? "") || manifest2.vaultSha256 !== undefined && !/^[0-9a-f]{64}$/i.test(manifest2.vaultSha256) || manifest2.dataBytes !== undefined && (!Number.isSafeInteger(manifest2.dataBytes) || manifest2.dataBytes < 0)) {
+  const unvalidated = manifest2;
+  if (unvalidated.schemaVersion !== 1 && unvalidated.schemaVersion !== 2 || !BACKUP_ID_PATTERN.test(manifest2.backupId) || unvalidated.snapshotKind !== undefined && unvalidated.snapshotKind !== "full" && unvalidated.snapshotKind !== "safety" || !Number.isFinite(Date.parse(manifest2.createdAt)) || !isVersion(manifest2.appVersion) || !manifest2.image || !/^sha256:[0-9a-f]{64}$/i.test(manifest2.imageDigest) || !/^[0-9a-f]{64}$/i.test(manifest2.dataSha256) || !/^[0-9a-f]{64}$/i.test(manifest2.configSha256 ?? "") || manifest2.vaultSha256 !== undefined && !/^[0-9a-f]{64}$/i.test(manifest2.vaultSha256) || manifest2.dataBytes !== undefined && (!Number.isSafeInteger(manifest2.dataBytes) || manifest2.dataBytes < 0)) {
     throw new Error(`Invalid backup manifest at ${backupPath}.`);
   }
-  const actual = await sha256File(join9(backupPath, "data.tgz"));
+  const actual = await sha256File(join12(backupPath, "data.tgz"));
   if (actual !== manifest2.dataSha256)
     throw new Error(`Backup checksum mismatch for ${manifest2.backupId}. Expected ${manifest2.dataSha256}, got ${actual}.`);
   if (manifest2.configSha256) {
-    const configActual = await sha256File(join9(backupPath, "config.env"));
+    const configActual = await sha256File(join12(backupPath, "config.env"));
     if (configActual !== manifest2.configSha256)
       throw new Error(`Backup configuration checksum mismatch for ${manifest2.backupId}.`);
   }
-  if (manifest2.vaultSha256 && await sha256File(join9(backupPath, "vault.backup")) !== manifest2.vaultSha256)
+  const config = parseEnv(await readText(join12(backupPath, "config.env")));
+  const storage = (config.NUXT_PUBLIC_STORAGE_PROVIDER ?? "").trim().toLowerCase();
+  if (manifest2.schemaVersion === 1 && storage === "s3") {
+    throw new Error(`Invalid backup manifest for ${manifest2.backupId}: schema-1 S3 snapshots do not contain recoverable remote objects.`);
+  }
+  if (manifest2.schemaVersion === 2) {
+    const remote = manifest2.remote;
+    if (unvalidated.storage !== "s3" || storage !== "s3" || !remote || !(remote.kind === "s3-copy-v1" && remote.file === "remote-objects.tar" || remote.kind === "s3-reference-v1" && remote.file === "remote-inventory.json") || !/^[a-f0-9]{64}$/.test(remote.sha256) || !/^[a-f0-9]{64}$/.test(remote.inventorySha256) || !Number.isSafeInteger(remote.bytes) || remote.bytes < 1 || !Number.isSafeInteger(remote.objectCount) || remote.objectCount < 0 || remote.objectCount > 1e5 || !Number.isSafeInteger(remote.payloadBytes) || remote.payloadBytes < 0 || remote.payloadBytes > remote.objectCount * 2 ** 30 || remote.providerVersion !== "0.0.15" || remote.kind === "s3-reference-v1" && (remote.bytes > 64 * 1024 * 1024 || remote.inventorySha256 !== remote.sha256)) {
+      throw new Error(`Invalid backup manifest for ${manifest2.backupId}: invalid S3 remote snapshot.`);
+    }
+    const source = remoteSource(config);
+    if (!remote.source || remote.source.endpointOrigin !== source.endpointOrigin || remote.source.bucket !== source.bucket || remote.source.keyPrefix !== source.keyPrefix) {
+      throw new Error(`Invalid backup manifest for ${manifest2.backupId}: S3 source differs from the authenticated configuration.`);
+    }
+    const file = join12(backupPath, remote.file);
+    const info = await lstat3(file);
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size !== remote.bytes || await sha256File(file) !== remote.sha256) {
+      throw new Error(`Backup remote checksum mismatch or size mismatch for ${manifest2.backupId}.`);
+    }
+  }
+  if (manifest2.vaultSha256 && await sha256File(join12(backupPath, "vault.backup")) !== manifest2.vaultSha256)
     throw new Error(`Vault backup checksum mismatch for ${manifest2.backupId}.`);
   await verifiedManagedAssetContents(backupPath, manifest2);
   return manifest2;
 }
 async function resolveBackup(directory, value) {
-  if (!isAbsolute(value) && !BACKUP_ID_PATTERN.test(value)) {
+  if (!isAbsolute3(value) && !BACKUP_ID_PATTERN.test(value)) {
     throw new Error(`Backup ID "${value}" is invalid. Use an OR3-generated backup ID or an absolute external backup path.`);
   }
-  const candidate = isAbsolute(value) ? value : backupDirectory(directory, value);
-  if (!await fileExists(join9(candidate, "manifest.json")))
+  const candidate = isAbsolute3(value) ? value : backupDirectory(directory, value);
+  if (!await fileExists(join12(candidate, "manifest.json")))
     throw new Error(`Backup ${value} was not found in ${deploymentPaths(directory).backups}.`);
   return resolve4(candidate);
 }
@@ -2074,7 +2904,7 @@ async function recordedBackupPath(directory, pending) {
   const path = previous ? pending.previousBackupPath : pending.backupPath;
   const backupId = previous ? pending.previousBackupId : pending.backupId;
   const resolved = path ? resolve4(path) : backupId ? await resolveBackup(directory, backupId) : undefined;
-  if (!resolved || !await fileExists(join9(resolved, "manifest.json"))) {
+  if (!resolved || !await fileExists(join12(resolved, "manifest.json"))) {
     throw new Error(`The incomplete ${pending.operation} has no readable ${previous ? "pre-mutation" : "target"} backup source.`);
   }
   const manifest2 = await readManifest(resolved, directory);
@@ -2216,16 +3046,21 @@ async function maskedQuestion(question) {
 
 // src/deployment/adoption-source.ts
 import { existsSync as existsSync2 } from "node:fs";
-import { basename as basename2, join as join10 } from "node:path";
+import { basename as basename2, join as join13 } from "node:path";
 
 // src/runtime/health.ts
 var DEEP_HEALTH_TIMEOUT_MS = 180000;
-var HEALTH_SCRIPT = "const fs=require('node:fs');try{fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);for(const path of [process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH].filter(Boolean)){const fd=fs.openSync(path,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));if(!response.ok||body.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
+var HEALTH_SCRIPT = "const fs=require('node:fs');try{const auth=process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth',storage=process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs',sync=process.env.OR3_SYNC_PROVIDER||'sqlite';if(sync!=='sqlite'||!(auth==='basic-auth'&&storage==='fs'||auth==='clerk'&&storage==='s3')||process.env.AUTH_PROVIDER&&process.env.OR3_AUTH_PROVIDER&&process.env.AUTH_PROVIDER!==process.env.OR3_AUTH_PROVIDER)throw Error('profile');fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);const paths=auth==='basic-auth'?[process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH]:[process.env.OR3_SQLITE_DB_PATH];if(paths.some(p=>!p))throw Error('database path');for(const path of paths){const fd=fs.openSync(path,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));if(!response.ok||body.status!=='ok'||body.providers?.auth?.provider!==(process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth')||body.providers?.sync?.provider!=='sqlite'||body.providers?.storage?.provider!==(process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs'))process.exit(1)}).catch(()=>process.exit(1))";
 var VERIFY_DATABASES_SCRIPT = `
 const fs = require('node:fs');
 const Database = require('/app/.output/server/node_modules/better-sqlite3');
 const results = [];
-for (const path of [process.env.OR3_BASIC_AUTH_DB_PATH, process.env.OR3_SQLITE_DB_PATH].filter(Boolean)) {
+const auth = process.env.AUTH_PROVIDER || process.env.OR3_AUTH_PROVIDER || 'basic-auth';
+const storage = process.env.NUXT_PUBLIC_STORAGE_PROVIDER || 'fs', sync = process.env.OR3_SYNC_PROVIDER || 'sqlite';
+if (sync !== 'sqlite' || !(auth === 'basic-auth' && storage === 'fs' || auth === 'clerk' && storage === 's3') || process.env.AUTH_PROVIDER && process.env.OR3_AUTH_PROVIDER && process.env.AUTH_PROVIDER !== process.env.OR3_AUTH_PROVIDER) throw new Error('Unsupported auth profile');
+const paths = auth === 'basic-auth' ? [process.env.OR3_BASIC_AUTH_DB_PATH, process.env.OR3_SQLITE_DB_PATH] : [process.env.OR3_SQLITE_DB_PATH];
+if (paths.some(path => !path)) throw new Error('Missing managed database path');
+for (const path of paths) {
   const info = fs.statSync(path);
   if (info.uid !== 65532 || info.gid !== 65532) throw new Error(path + ' must be owned by 65532:65532');
   const db = new Database(path, { readonly: true, fileMustExist: true });
@@ -2298,15 +3133,112 @@ async function sourceServiceRunning(directory, composeFiles) {
     throw new Error(`Could not determine whether the V1 OR3 service is running. ${result.stderr.trim()}`);
   return Boolean(result.stdout.trim());
 }
+async function assertSourceContainer(directory, composeFiles, expectedImage, configText, sourceVolume, expectedPort, sourceEnv) {
+  const listed = await run("docker", [...sourceComposeArgs(directory, composeFiles), "ps", "-aq", "or3"], directory);
+  const ids = listed.stdout.trim().split(/\s+/).filter(Boolean);
+  if (!listed.ok || ids.length !== 1)
+    throw new Error("Could not identify exactly one existing source container.");
+  const inspect = await run("docker", ["inspect", "--format", `{{json .Image}}
+{{json .Config.Env}}
+{{json .Mounts}}
+{{json .Config.Labels}}
+{{json .Config.Entrypoint}}
+{{json .Config.Cmd}}
+{{json .Config.WorkingDir}}
+{{json .HostConfig.ReadonlyRootfs}}
+{{json .HostConfig.Tmpfs}}
+{{json .HostConfig.Mounts}}`, ids[0]], directory);
+  const expected = await run("docker", ["image", "inspect", "--format", `{{.Id}}
+{{json .Config.Entrypoint}}
+{{json .Config.Cmd}}
+{{json .Config.WorkingDir}}
+{{json .Config.Env}}`, expectedImage], directory);
+  if (!inspect.ok || !expected.ok || !expected.stdout.trim())
+    throw new Error("Could not inspect the existing source container or its authenticated image.");
+  let image, env, mounts, labels, entrypoint, command, cwd, readonly, tmpfs, hostMounts, imageId, defaultEntrypoint, defaultCommand, defaultCwd, defaultEnv;
+  try {
+    const lines = inspect.stdout.trimEnd().split(`
+`);
+    const expectedLines = expected.stdout.trimEnd().split(`
+`);
+    if (lines.length !== 10 || expectedLines.length !== 5)
+      throw new Error("invalid inspection");
+    [image, env, mounts, labels, entrypoint, command, cwd, readonly, tmpfs, hostMounts] = lines.map((line) => JSON.parse(line));
+    imageId = expectedLines[0];
+    defaultEntrypoint = JSON.parse(expectedLines[1]);
+    defaultCommand = JSON.parse(expectedLines[2]);
+    defaultCwd = JSON.parse(expectedLines[3]);
+    defaultEnv = JSON.parse(expectedLines[4]);
+  } catch {
+    throw new Error("The source container inspection is incomplete or malformed.");
+  }
+  if (image !== imageId)
+    throw new Error("The source container image does not match the authenticated release image.");
+  if (readonly !== true)
+    throw new Error("The source container root filesystem is not read-only; its code cannot be qualified for adoption.");
+  assertCapturedHostMounts(tmpfs, hostMounts);
+  const diff = await run("docker", ["diff", ids[0]], directory);
+  if (!diff.ok || diff.stdout.trim())
+    throw new Error("The source container writable layer is changed or cannot be inspected; adoption is refused.");
+  const validCommand = (value) => value === null || Array.isArray(value) && value.every((part) => typeof part === "string");
+  if (![entrypoint, command, defaultEntrypoint, defaultCommand].every(validCommand) || JSON.stringify(entrypoint) !== JSON.stringify(defaultEntrypoint) || JSON.stringify(command) !== JSON.stringify(defaultCommand)) {
+    throw new Error("The source container changes the authenticated image entrypoint or command.");
+  }
+  if (typeof cwd !== "string" || cwd !== defaultCwd)
+    throw new Error("The source container changes the authenticated image working directory.");
+  const config = parseComposeConfig(configText);
+  if (!config.name || !labels || typeof labels !== "object" || Array.isArray(labels) || labels["com.docker.compose.project"] !== config.name || labels["com.docker.compose.service"] !== "or3") {
+    throw new Error("The source container Compose labels do not match the selected project and service.");
+  }
+  const parseInspectionEnv = (value) => {
+    if (value === null)
+      return {};
+    if (!Array.isArray(value) || !value.every((line) => typeof line === "string" && /^[A-Za-z_][A-Za-z0-9_]*=/.test(line)))
+      throw new Error("The inspected environment is incomplete or malformed.");
+    const result = {};
+    for (const line of value) {
+      const split = line.indexOf("=");
+      const key = line.slice(0, split);
+      if (Object.hasOwn(result, key))
+        throw new Error(`The inspected environment contains a duplicate ${key} entry.`);
+      result[key] = line.slice(split + 1);
+    }
+    return result;
+  };
+  const actualEnv = parseInspectionEnv(env), imageEnv = parseInspectionEnv(defaultEnv);
+  const executionKey = /^(?:PATH|NODE_.+|BUN_.+|LD_.+|DYLD_.+)$/;
+  for (const key of new Set([...Object.keys(actualEnv), ...Object.keys(imageEnv)])) {
+    if (executionKey.test(key) && actualEnv[key] !== imageEnv[key])
+      throw new Error(`The source container changes execution environment ${key}.`);
+  }
+  if (!Array.isArray(mounts) || !mounts.every((mount) => mount && typeof mount === "object" && typeof mount.Type === "string" && typeof mount.Destination === "string")) {
+    throw new Error("The source container mounts are incomplete or malformed.");
+  }
+  const actualMounts = mounts;
+  if (new Set(actualMounts.map((mount) => mount.Destination)).size !== actualMounts.length)
+    throw new Error("The source container has ambiguous duplicate mount destinations.");
+  if (actualMounts.length !== 1)
+    throw new Error("The source container has additional mounts that adoption cannot safely migrate.");
+  const actualDataMount = actualMounts.find((mount) => mount.Destination === "/data");
+  if (!actualDataMount || actualDataMount.Type !== "volume" || actualDataMount.Name !== sourceVolume) {
+    throw new Error("The source container data mount does not match the selected Docker volume.");
+  }
+  const actualService = config.services?.or3;
+  if (!actualService)
+    throw new Error("V1 Compose configuration does not define an or3 service.");
+  actualService.environment = actualEnv;
+  actualService.volumes = actualMounts.map((mount) => ({ type: mount.Type, source: mount.Name, target: mount.Destination }));
+  assertSupportedSourceCompose(JSON.stringify(config), sourceVolume, expectedPort, sourceEnv, [actualService.image ?? ""]);
+}
 async function readSourceVolume(sourceDirectory) {
   const composeResult = await run("docker", [
     "compose",
     "--project-directory",
     sourceDirectory,
     "--env-file",
-    join10(sourceDirectory, ".env"),
+    join13(sourceDirectory, ".env"),
     "-f",
-    join10(sourceDirectory, "compose.yaml"),
+    join13(sourceDirectory, "compose.yaml"),
     "ps",
     "-aq",
     "or3"
@@ -2327,7 +3259,7 @@ async function readSourceVolume(sourceDirectory) {
 }
 function sourceMode(sourceDirectory, sourceEnv) {
   const publicDeployment = sourceEnv.OR3_PUBLIC_DOMAIN && sourceEnv.OR3_PUBLIC_DOMAIN !== "localhost" && sourceEnv.OR3_FORCE_HTTPS !== "false";
-  return publicDeployment && existsSync2(join10(sourceDirectory, "compose.public.yaml")) ? "public" : "local";
+  return publicDeployment && existsSync2(join13(sourceDirectory, "compose.public.yaml")) ? "public" : "local";
 }
 function sourceComposeArgs(sourceDirectory, sourceComposeFiles) {
   return [
@@ -2335,7 +3267,7 @@ function sourceComposeArgs(sourceDirectory, sourceComposeFiles) {
     "--project-directory",
     sourceDirectory,
     "--env-file",
-    join10(sourceDirectory, ".env"),
+    join13(sourceDirectory, ".env"),
     ...sourceComposeFiles
   ];
 }
@@ -2348,8 +3280,8 @@ async function restartSource(sourceDirectory, sourceComposeFiles, secrets) {
 }
 function assertSupportedSource(sourceDirectory, sourceEnv, providers) {
   const values = [sourceEnv.AUTH_PROVIDER, sourceEnv.OR3_AUTH_PROVIDER].filter(Boolean);
-  if (!values.includes("basic-auth"))
-    throw new Error(`V1 project uses ${values.join(", ") || "an unknown auth provider"}, not Basic Auth.`);
+  if (values.length === 0 || values.some((value) => value !== "basic-auth"))
+    throw new Error(`V1 project uses ${values.join(", ") || "an unknown auth provider"}, not the supported Basic Auth profile.`);
   if (sourceEnv.SSR_AUTH_ENABLED === "false" || sourceEnv.OR3_GUEST_ACCESS_ENABLED === "true") {
     throw new Error("V1 project does not require authenticated access; adoption expects the supported authenticated profile.");
   }
@@ -2374,21 +3306,94 @@ function assertSupportedSource(sourceDirectory, sourceEnv, providers) {
     throw new Error("V1 project is missing OR3 version metadata.");
   }
 }
-function assertSupportedSourceCompose(configText, sourceVolume, expectedPort) {
+function assertSupportedSourceCompose(configText, sourceVolume, expectedPort, sourceEnv, allowedImages) {
   const config = parseComposeConfig(configText);
   const service = config.services?.or3;
   if (!service)
     throw new Error("V1 Compose configuration does not define an or3 service.");
+  assertCapturedComposeMounts(service);
+  if (!service.image || !allowedImages.includes(service.image))
+    throw new Error("V1 Compose image does not match the authenticated release image.");
+  const vault = composeEnvironmentValue(service, "NUXT_SECRETS_PROVIDER");
+  const vaultMount = (service.volumes ?? []).some((mount) => typeof mount.target === "string" && /^\/(?:run\/or3-secrets(?:-client)?|vault-data|vault-key)(?:\/|$)/.test(mount.target));
+  if (sourceEnv.NUXT_SECRETS_PROVIDER || vault !== "" || vaultMount || Object.keys(config.services ?? {}).some((name) => /vault/i.test(name))) {
+    throw new Error("V1 source may use a secret vault; adoption cannot migrate vault custody. Preserve the source and use a separately reviewed migration.");
+  }
+  if (Object.keys(config.services ?? {}).some((name) => name !== "or3")) {
+    throw new Error("V1 Compose has additional services that adoption cannot safely migrate.");
+  }
+  const selected = (key) => composeEnvironmentValue(service, key);
+  const regenerated = new Set(["OR3_BASIC_AUTH_DB_PATH", "OR3_SQLITE_DB_PATH", "OR3_STORAGE_FS_ROOT", "OR3_PUBLIC_DOMAIN", "OR3_ALLOWED_ORIGINS", "OR3_FORCE_HTTPS", "OR3_TRUST_PROXY"]);
+  for (const key of ALLOWED_ENV_KEYS) {
+    if (regenerated.has(key))
+      continue;
+    if (selected(key) !== sourceEnv[key])
+      throw new Error(`V1 Compose ${key} differs from its source environment; adoption refuses configuration drift.`);
+  }
+  if (!sourceEnv.OR3_INSTANCE_ID?.trim())
+    throw new Error("V1 source needs an explicitly configured stable acquisition identity (OR3_INSTANCE_ID) before adoption.");
+  for (const key of ["NUXT_ADMIN_AUTH_USERNAME", "NUXT_ADMIN_AUTH_PASSWORD"]) {
+    if (selected(key) !== undefined || sourceEnv[key] !== undefined)
+      throw new Error(`V1 Compose ${key} cannot be safely provisioned during adoption.`);
+  }
+  const effectiveKeys = Array.isArray(service.environment) ? service.environment.map((entry) => entry.split("=", 1)[0]) : Object.keys(service.environment ?? {});
+  const ambiguous = /^(?:RUNTIME_CONFIG$|NUXT_(?:ADMIN|ADMIN_AUTH|AUTH|AUTH_INVITE|SYNC|STORAGE|SECRETS|PUBLIC|BACKGROUND_JOBS|CONNECT|CONNECT_CLOUDFLARE|WEBHOOKS)$|NITRO_ENV_(?:PREFIX|EXPANSION)$|NITRO_(?:ADMIN|AUTH|SYNC|STORAGE|SECRETS|PUBLIC|BACKGROUND_JOBS|CONNECT|WEBHOOKS)(?:_|$))/;
+  if (effectiveKeys.some((key) => ambiguous.test(key)))
+    throw new Error("V1 Compose contains an unsupported aggregate or Nitro runtime profile override.");
+  const allowedOverrides = {
+    OR3_STORAGE_PROVIDER: "fs",
+    NUXT_AUTH_ENABLED: "true",
+    NUXT_AUTH_PROVIDER: "basic-auth",
+    NUXT_PUBLIC_SSR_AUTH_ENABLED: "true",
+    NUXT_PUBLIC_AUTH_PROVIDER: "basic-auth",
+    NUXT_PUBLIC_GUEST_ACCESS_ENABLED: "false",
+    NUXT_AUTH_REGISTRATION_MODE: "invite_only",
+    NUXT_AUTH_AUTO_PROVISION: "false",
+    NUXT_SYNC_ENABLED: "true",
+    NUXT_PUBLIC_SYNC_ENABLED: "true",
+    NUXT_SYNC_PROVIDER: "sqlite",
+    NUXT_PUBLIC_SYNC_PROVIDER: "sqlite",
+    NUXT_STORAGE_ENABLED: "true",
+    NUXT_PUBLIC_STORAGE_ENABLED: "true",
+    NUXT_STORAGE_PROVIDER: "fs"
+  };
+  for (const [key, expected] of Object.entries(allowedOverrides)) {
+    const value = selected(key);
+    if (value !== undefined && value !== expected)
+      throw new Error(`V1 Compose ${key} selects an unsupported runtime profile.`);
+  }
+  if (selected("OR3_SQLITE_DRIVER") && selected("OR3_SQLITE_DRIVER") !== "better-sqlite3") {
+    throw new Error("V1 Compose selects an unsupported SQLite driver. Adoption requires better-sqlite3.");
+  }
+  const managedOnly = new Set(["OR3_VERSION", "OR3_IMAGE", "OR3_PORT", "OR3_COMPOSE_PROJECT", "OR3_VOLUME_NAME", "OR3_CADDY_DATA_VOLUME", "OR3_CADDY_CONFIG_VOLUME", "OR3_DEPLOYMENT_ID", "OR3_ADMIN_DATA_DIR", "OR3_EXTENSIONS_ROOT"]);
+  for (const key of effectiveKeys) {
+    if (/^(?:OR3|NUXT|NITRO)_/.test(key) && !ALLOWED_ENV_KEYS.has(key) && !managedOnly.has(key) && !(key in allowedOverrides)) {
+      throw new Error(`V1 Compose has unsupported application setting ${key}; adoption refuses to drop it.`);
+    }
+  }
+  const auth = [selected("AUTH_PROVIDER"), selected("OR3_AUTH_PROVIDER")].filter((value) => Boolean(value));
+  const guest = selected("OR3_GUEST_ACCESS_ENABLED");
+  if (!auth.length || auth.some((value) => value !== "basic-auth") || selected("OR3_SYNC_PROVIDER") !== "sqlite" || selected("NUXT_PUBLIC_STORAGE_PROVIDER") !== "fs" || selected("OR3_AUTH_REGISTRATION_MODE") !== "invite_only" || selected("OR3_AUTH_AUTO_PROVISION") !== "false" || selected("SSR_AUTH_ENABLED") !== "true" || guest && guest !== "false" || (selected("OR3_CLOUD_SYNC_ENABLED") || selected("OR3_SYNC_ENABLED")) !== "true" || (selected("OR3_CLOUD_STORAGE_ENABLED") || selected("OR3_STORAGE_ENABLED")) !== "true") {
+    throw new Error("V1 Compose resolves to an unsupported authentication, sync, storage or registration profile.");
+  }
+  for (const key of ["AUTH_PROVIDER", "OR3_AUTH_PROVIDER", "OR3_SYNC_PROVIDER", "NUXT_PUBLIC_STORAGE_PROVIDER", "OR3_AUTH_REGISTRATION_MODE", "OR3_AUTH_AUTO_PROVISION", "SSR_AUTH_ENABLED", "OR3_GUEST_ACCESS_ENABLED", "OR3_SYNC_ENABLED", "OR3_CLOUD_SYNC_ENABLED", "OR3_STORAGE_ENABLED", "OR3_CLOUD_STORAGE_ENABLED"]) {
+    if (sourceEnv[key] !== undefined && selected(key) !== sourceEnv[key])
+      throw new Error(`V1 Compose resolves ${key} differently from its source environment; adoption refuses profile drift.`);
+  }
   for (const [key, expected] of [
     ["OR3_BASIC_AUTH_DB_PATH", "/data/auth.sqlite"],
     ["OR3_SQLITE_DB_PATH", "/data/sync.sqlite"],
-    ["OR3_STORAGE_FS_ROOT", "/data/storage"]
+    ["OR3_STORAGE_FS_ROOT", "/data/storage"],
+    ["OR3_ADMIN_DATA_DIR", "/data/admin"],
+    ["OR3_EXTENSIONS_ROOT", "/data/extensions"]
   ]) {
     if (composeEnvironmentValue(service, key) !== expected) {
       throw new Error(`V1 Compose configuration does not resolve ${key} to ${expected}. Adoption refuses custom data layouts.`);
     }
   }
   const mounts = service.volumes ?? [];
+  if (mounts.length !== 1)
+    throw new Error("V1 Compose has additional mounts that adoption cannot safely migrate.");
   const dataMount = mounts.find((mount) => mount.target === "/data");
   if (!dataMount || dataMount.type !== "volume") {
     throw new Error("V1 Compose configuration must mount one named volume at /data.");
@@ -2408,8 +3413,8 @@ function assertSupportedSourceCompose(configText, sourceVolume, expectedPort) {
 
 // src/runtime/dashboard-operator.ts
 import { randomBytes as randomBytes6 } from "node:crypto";
-import { chmod as chmod4, mkdir as mkdir4, rm as rm4, stat as stat2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join as join11, resolve as resolve6 } from "node:path";
+import { chmod as chmod4, mkdir as mkdir4, rm as rm5, stat as stat3 } from "node:fs/promises";
+import { isAbsolute as isAbsolute4, join as join14, resolve as resolve6 } from "node:path";
 
 // src/runtime/images.ts
 async function pullImage(image, expectedDigest2) {
@@ -2551,13 +3556,13 @@ async function dashboardOperatorEnv(directory, version) {
   if (configured && !configured.startsWith("unix://"))
     return;
   const socket = configured ? configured.slice("unix://".length) : "/var/run/docker.sock";
-  if (!isAbsolute2(socket))
+  if (!isAbsolute4(socket))
     return;
   let socketStat;
   let uid;
   let gid;
   try {
-    socketStat = await stat2(socket);
+    socketStat = await stat3(socket);
     if (!socketStat.isSocket())
       return;
     uid = process.getuid();
@@ -2635,7 +3640,7 @@ async function prepareVerifiedDashboardOperator(directory, version) {
     if (await verifyDashboardOperatorBridge(directory, candidate))
       return candidate;
   } catch {}
-  await rm4(deploymentPaths(directory).operatorIpc, { recursive: true, force: true }).catch(() => {
+  await rm5(deploymentPaths(directory).operatorIpc, { recursive: true, force: true }).catch(() => {
     return;
   });
   console.warn("Dashboard updates are unavailable on this Docker setup; the deployment will remain host-CLI managed.");
@@ -2643,7 +3648,7 @@ async function prepareVerifiedDashboardOperator(directory, version) {
 }
 function dashboardOperatorHandoffArgs(directory, env, jobId) {
   const project = env.OR3_COMPOSE_PROJECT;
-  if (!isAbsolute2(directory) || !DASHBOARD_JOB_ID_PATTERN.test(jobId) || !COMPOSE_PROJECT_PATTERN.test(project ?? "") || !/^\d+$/.test(env.OR3_OPERATOR_UID ?? "") || !/^\d+$/.test(env.OR3_OPERATOR_GID ?? "") || !/^\d+$/.test(env.OR3_DOCKER_GID ?? "") || !isAbsolute2(env.OR3_DOCKER_SOCKET ?? "") || !/@sha256:[0-9a-f]{64}$/i.test(env.OR3_OPERATOR_IMAGE ?? "")) {
+  if (!isAbsolute4(directory) || !DASHBOARD_JOB_ID_PATTERN.test(jobId) || !COMPOSE_PROJECT_PATTERN.test(project ?? "") || !/^\d+$/.test(env.OR3_OPERATOR_UID ?? "") || !/^\d+$/.test(env.OR3_OPERATOR_GID ?? "") || !/^\d+$/.test(env.OR3_DOCKER_GID ?? "") || !isAbsolute4(env.OR3_DOCKER_SOCKET ?? "") || !/@sha256:[0-9a-f]{64}$/i.test(env.OR3_OPERATOR_IMAGE ?? "")) {
     throw new Error("Refusing to schedule an invalid dashboard operator handoff.");
   }
   return [
@@ -2674,7 +3679,7 @@ function dashboardOperatorHandoffArgs(directory, env, jobId) {
     "--entrypoint",
     "/usr/local/bin/node",
     env.OR3_OPERATOR_IMAGE,
-    join11(directory, "dashboard-operator.mjs"),
+    join14(directory, "dashboard-operator.mjs"),
     "--complete-handoff",
     jobId,
     project
@@ -2760,10 +3765,10 @@ async function checkPublicPrerequisites(domain) {
 
 // src/runtime/project.ts
 import { readFileSync as readFileSync5 } from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join15 } from "node:path";
 function managedVaultEnabled(directory, env) {
-  const selected = env ?? parseEnv(readFileSync5(join12(directory, ".env"), "utf8"));
-  return selected.SSR_AUTH_ENABLED === "true" && (selected.NUXT_SECRETS_PROVIDER ?? "or3-secrets") === "or3-secrets" && readFileSync5(join12(directory, "compose.yaml"), "utf8").includes(`
+  const selected = env ?? parseEnv(readFileSync5(join15(directory, ".env"), "utf8"));
+  return selected.SSR_AUTH_ENABLED === "true" && (selected.NUXT_SECRETS_PROVIDER ?? "or3-secrets") === "or3-secrets" && readFileSync5(join15(directory, "compose.yaml"), "utf8").includes(`
   or3-vault:
 `);
 }
@@ -2785,11 +3790,11 @@ async function startProject(directory, mode, env) {
 }
 
 // src/runtime/verification.ts
-import { createHash as createHash2, randomBytes as randomBytes7, randomUUID } from "node:crypto";
-function validateVerificationHealth(value) {
+import { createHash as createHash4, randomBytes as randomBytes7, randomUUID as randomUUID4 } from "node:crypto";
+function validateVerificationHealth(value, profile = "basic-sqlite-fs") {
   const health = value;
-  if (!health || health.status !== "ok" || health.providers?.auth?.provider !== "basic-auth" || health.providers.sync?.provider !== "sqlite" || health.providers.storage?.provider !== "fs") {
-    throw new Error("Public deep health does not report the managed Basic Auth + SQLite + filesystem profile.");
+  if (!health || health.status !== "ok" || health.providers?.auth?.provider !== (profile === "basic-sqlite-fs" ? "basic-auth" : "clerk") || health.providers.sync?.provider !== "sqlite" || health.providers.storage?.provider !== (profile === "basic-sqlite-fs" ? "fs" : "s3")) {
+    throw new Error(`Public deep health does not report the managed ${profile === "basic-sqlite-fs" ? "Basic Auth + SQLite + filesystem" : "Clerk + SQLite + S3"} profile.`);
   }
   return health;
 }
@@ -2884,7 +3889,7 @@ async function verifyPublicApplication(baseUrl, credentials) {
       Buffer.from("89504e470d0a1a0a0000000d49484452000000010000000108060000001f15c489", "hex"),
       randomBytes7(8)
     ]);
-    const hash = `sha256:${createHash2("sha256").update(probeBytes).digest("hex")}`;
+    const hash = `sha256:${createHash4("sha256").update(probeBytes).digest("hex")}`;
     let storageId;
     let metadataAttempted = false;
     let physicalCleanupDeferred = false;
@@ -2926,7 +3931,7 @@ async function verifyPublicApplication(baseUrl, credentials) {
         }
       });
       const metadataCreatedAt = Date.now();
-      const metadataOpId = randomUUID();
+      const metadataOpId = randomUUID4();
       const pushed = await verificationJson(baseUrl, "/api/sync/push", {
         cookie,
         body: {
@@ -2976,7 +3981,7 @@ async function verifyPublicApplication(baseUrl, credentials) {
       if (storageId) {
         if (metadataAttempted) {
           const metadataDeleteAt = Date.now();
-          const metadataDeleteOpId = randomUUID();
+          const metadataDeleteOpId = randomUUID4();
           const deleted = await verificationJson(baseUrl, "/api/sync/push", {
             cookie,
             body: {
@@ -3076,31 +4081,31 @@ async function adoptCommand(positionals, flags) {
   if (targetDirectory === sourceDirectory)
     throw new Error("Choose a separate target directory for adoption.");
   await readDirectoryEmpty(targetDirectory);
-  if (!await fileExists(join13(sourceDirectory, "or3-release.json")))
+  if (!await fileExists(join16(sourceDirectory, "or3-release.json")))
     throw new Error(`V1 release metadata is missing at ${sourceDirectory}/or3-release.json.`);
-  const release = JSON.parse(await readText(join13(sourceDirectory, "or3-release.json")));
+  const release = JSON.parse(await readText(join16(sourceDirectory, "or3-release.json")));
   if (!release.or3Version || !isVersion(release.or3Version))
     throw new Error("V1 release metadata does not contain a usable OR3 version.");
   if (release.or3Version !== PACKAGE_VERSION) {
     throw new Error(`V1 is on OR3 ${release.or3Version}, but this CLI ships managed assets for ${PACKAGE_VERSION}. Run the matching @or3/cloud version or perform a qualified host CLI update before adoption.`);
   }
-  const sourceEnv = parseEnv(await readText(join13(sourceDirectory, ".env")));
-  const providers = await readText(join13(sourceDirectory, "or3.providers.generated.ts"));
+  const sourceEnv = parseEnv(await readText(join16(sourceDirectory, ".env")));
+  const providers = await readText(join16(sourceDirectory, "or3.providers.generated.ts"));
   assertSupportedSource(sourceDirectory, sourceEnv, providers);
   const mode = sourceMode(sourceDirectory, sourceEnv);
   const domain = mode === "public" ? sourceEnv.OR3_PUBLIC_DOMAIN : undefined;
   if (domain)
     await checkPublicPrerequisites(domain);
-  const sourceComposeFiles = ["-f", join13(sourceDirectory, "compose.yaml")];
+  const sourceComposeFiles = ["-f", join16(sourceDirectory, "compose.yaml")];
   if (mode === "public")
-    sourceComposeFiles.push("-f", join13(sourceDirectory, "compose.public.yaml"));
+    sourceComposeFiles.push("-f", join16(sourceDirectory, "compose.public.yaml"));
   await ensureDocker();
   const sourceConfig = await run("docker", [
     "compose",
     "--project-directory",
     sourceDirectory,
     "--env-file",
-    join13(sourceDirectory, ".env"),
+    join16(sourceDirectory, ".env"),
     ...sourceComposeFiles,
     "config",
     "--format",
@@ -3129,11 +4134,12 @@ async function adoptCommand(positionals, flags) {
     throw new Error("V1 project has an invalid OR3 port.");
   if (mode === "public" && [80, 443].includes(sourcePort))
     throw new Error("V1 public deployment uses a Caddy port for OR3; adoption requires a separate OR3 port.");
-  assertSupportedSourceCompose(sourceConfig.stdout, sourceVolume, sourcePort);
+  assertSupportedSourceCompose(sourceConfig.stdout, sourceVolume, sourcePort, sourceEnv, [sourceImage, image]);
   const sourceInitiallyRunning = await sourceServiceRunning(sourceDirectory, sourceComposeFiles);
+  await assertSourceContainer(sourceDirectory, sourceComposeFiles, image, sourceConfig.stdout, sourceVolume, sourcePort, sourceEnv);
   const targetNames = composeProjectNames(targetDirectory);
   await assertDockerProjectAbsent(targetNames.project);
-  for (const volume of [targetNames.volume, ...mode === "public" ? [targetNames.caddyData, targetNames.caddyConfig] : []]) {
+  for (const volume of [targetNames.volume, ...managedVaultVolumeNames(targetNames.volume), ...mode === "public" ? [targetNames.caddyData, targetNames.caddyConfig] : []]) {
     const existing = await run("docker", ["volume", "inspect", volume]);
     if (existing.ok)
       throw new Error(`Docker volume ${volume} already exists. Choose a new adoption target directory.`);
@@ -3187,7 +4193,7 @@ ${existing.stderr}`)) {
     OR3_GUEST_ACCESS_ENABLED: "false"
   });
   await writeSecure(deploymentPaths(targetDirectory).env, serializeEnv(targetEnv));
-  await writeSecure(join13(targetDirectory, ".or3-initial-credentials"), serializeInitialCredentials({
+  await writeSecure(join16(targetDirectory, ".or3-initial-credentials"), serializeInitialCredentials({
     bootstrapEmail: email,
     bootstrapPassword: password,
     adminUsername: targetEnv.OR3_ADMIN_USERNAME,
@@ -3208,6 +4214,7 @@ ${existing.stderr}`)) {
     phase: "prepared"
   });
   let sourceStopAttempted = false;
+  let targetMayHaveStarted = false;
   try {
     sourceStopAttempted = true;
     const sourceStop = await run("docker", [...sourceComposeArgs(sourceDirectory, sourceComposeFiles), "stop"], sourceDirectory);
@@ -3223,7 +4230,7 @@ ${existing.stderr}`)) {
       }
     }
     await mkdir5(sourceBackupDir, { recursive: true, mode: 448 });
-    await copySecure(join13(sourceDirectory, ".env"), join13(sourceBackupDir, "config.env"));
+    await copySecure(join16(sourceDirectory, ".env"), join16(sourceBackupDir, "config.env"));
     await archiveExternalVolume(sourceImage, sourceVolume, sourceBackupDir);
     const sourceManifest = {
       schemaVersion: 1,
@@ -3232,8 +4239,8 @@ ${existing.stderr}`)) {
       appVersion: release.or3Version,
       image,
       imageDigest: digest,
-      dataSha256: await sha256File(join13(sourceBackupDir, "data.tgz")),
-      configSha256: await sha256File(join13(sourceBackupDir, "config.env")),
+      dataSha256: await sha256File(join16(sourceBackupDir, "data.tgz")),
+      configSha256: await sha256File(join16(sourceBackupDir, "config.env")),
       mode,
       domain,
       composeProject: sourceEnv.OR3_COMPOSE_PROJECT ?? sanitizeName(basename3(sourceDirectory)),
@@ -3244,11 +4251,13 @@ ${existing.stderr}`)) {
     };
     const sourceManifestContents = `${JSON.stringify(sourceManifest, null, 2)}
 `;
-    await writeSecure(join13(sourceBackupDir, "manifest.json"), sourceManifestContents);
+    await writeSecure(join16(sourceBackupDir, "manifest.json"), sourceManifestContents);
     await writeBackupAuthentication(targetDirectory, sourceBackupDir, sourceManifestContents);
     await readManifest(sourceBackupDir, targetDirectory);
     await updatePending(targetDirectory, state, { phase: "snapshot-created" });
+    await updatePending(targetDirectory, state, { phase: "target-mutating" });
     await restoreVolumeArchive(targetDirectory, mode, targetEnv, sourceBackupDir);
+    targetMayHaveStarted = true;
     await startProject(targetDirectory, mode, targetEnv);
     await provisionManagedCredentials(mode === "public" ? new URL(`https://${domain}`) : new URL(`http://127.0.0.1:${sourcePort}`), email, password, targetEnv.OR3_ADMIN_USERNAME, targetEnv.OR3_ADMIN_PASSWORD);
     const runtimeEnv = withoutProvisioningCredentials(targetEnv);
@@ -3260,11 +4269,12 @@ ${existing.stderr}`)) {
     console.log(`Source backup: ${sourceBackupDir}`);
     console.log(`The original deployment is preserved and stopped. Verify sign-in, chat, and file access before removing anything.`);
   } catch (error) {
-    await compose(targetDirectory, mode, ["down"]).catch(() => {
-      return;
-    });
+    if (!targetMayHaveStarted)
+      await compose(targetDirectory, mode, ["down"]).catch(() => {
+        return;
+      });
     let sourceRecoveryError = "";
-    if (sourceStopAttempted && sourceInitiallyRunning) {
+    if (!targetMayHaveStarted && sourceStopAttempted && sourceInitiallyRunning) {
       try {
         await restartSource(sourceDirectory, sourceComposeFiles, secretValues(sourceEnv));
       } catch (recovery) {
@@ -3273,88 +4283,297 @@ ${existing.stderr}`)) {
     }
     state.lastError = redact(`${error instanceof Error ? error.message : String(error)}${sourceRecoveryError}`, secretValues(targetEnv));
     await writeState(targetDirectory, state);
+    const recoveryDetail = targetMayHaveStarted ? "The target may contain new writes. Both deployments were left as found; inspect the operation before deciding which data to retain. " : sourceRecoveryError ? "The original V1 deployment needs manual recovery. " : sourceInitiallyRunning ? "The original V1 deployment was restarted and deeply healthy. " : "The original V1 deployment remains stopped. ";
     throw new Error(`${state.lastError}
-${sourceRecoveryError ? "The original V1 deployment needs manual recovery. " : "The original V1 deployment was restarted and deeply healthy. "}Managed files remain at ${targetDirectory}.${sourceBackupDir ? ` Source backup: ${sourceBackupDir}.` : ""}`);
+${recoveryDetail}Managed files remain at ${targetDirectory}.${sourceBackupDir ? ` Source backup: ${sourceBackupDir}.` : ""}`);
   }
 }
 
 // src/backup/create.ts
-import { chmod as chmod6, lstat as lstat2, mkdir as mkdir6 } from "node:fs/promises";
-import { join as join16, resolve as resolve9 } from "node:path";
+import { chmod as chmod6, lstat as lstat4, mkdir as mkdir6 } from "node:fs/promises";
+import { join as join19, resolve as resolve10 } from "node:path";
 
 // src/backup/references.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { join as join14 } from "node:path";
-var INSPECTOR = "/app/scripts/docker/backup-inspect.mjs";
-var NODE = 'if [ -x /nodejs/bin/node ]; then exec /nodejs/bin/node "$@"; else exec node "$@"; fi';
-async function validateCanonicalBackupReferences(directory, env, backupPath) {
-  if (env.OR3_SYNC_PROVIDER !== "sqlite" || env.NUXT_PUBLIC_STORAGE_PROVIDER !== "fs" || env.OR3_SQLITE_DRIVER && env.OR3_SQLITE_DRIVER !== "better-sqlite3") {
+import { join as join17, resolve as resolve8 } from "node:path";
+var INSPECTOR3 = "/app/scripts/docker/backup-inspect.mjs";
+var NODE3 = 'if [ -x /nodejs/bin/node ]; then exec /nodejs/bin/node "$@"; else exec node "$@"; fi';
+function assertBackupOperatorMount(directory, enabled, composeMounts, actualMounts) {
+  const expected = resolve8(directory, ".or3-cloud/operator-ipc");
+  const configured = composeMounts.filter((mount) => mount.target === "/run/or3-operator");
+  const actual = actualMounts.filter((mount) => mount.Destination === "/run/or3-operator");
+  if (!enabled && configured.length === 0 && actual.length === 0)
+    return;
+  if (!enabled || configured.length !== 1 || actual.length !== 1 || configured.at(0)?.type !== "bind" || configured.at(0)?.source !== expected || configured.at(0)?.read_only !== true || actual.at(0)?.Type !== "bind" || actual.at(0)?.Source !== expected || actual.at(0)?.RW !== false) {
+    throw new Error("Backup source operator mount does not match the managed read-only socket.");
+  }
+}
+function assertBackupContainerDiff(diff, mounts) {
+  const allowed = new Set(["/data", "/run/or3-operator", "/run/or3-secrets", "/run/or3-secrets-client", "/vault-data", "/vault-key"]);
+  const targets = new Set(mounts.map((mount) => mount.Destination).filter((value) => typeof value === "string" && allowed.has(value)));
+  const permitted = new Set([...targets].map((target) => `A ${target}`));
+  if ([...targets].some((target) => target.startsWith("/run/")))
+    permitted.add("C /run");
+  if (diff.trim() && diff.trim().split(`
+`).some((line) => !permitted.has(line)))
+    throw new Error("Backup source container writable layer is changed or cannot be inspected.");
+}
+function assertSupportedBackupProfile(env) {
+  let profile;
+  try {
+    profile = managedProviderProfile(env);
+  } catch {}
+  const expectedOverrides = {
+    OR3_STORAGE_PROVIDER: "fs",
+    NUXT_AUTH_ENABLED: "true",
+    NUXT_AUTH_PROVIDER: "basic-auth",
+    NUXT_PUBLIC_AUTH_PROVIDER: "basic-auth",
+    NUXT_PUBLIC_SSR_AUTH_ENABLED: "true",
+    NUXT_SYNC_ENABLED: "true",
+    NUXT_PUBLIC_SYNC_ENABLED: "true",
+    NUXT_SYNC_PROVIDER: "sqlite",
+    NUXT_PUBLIC_SYNC_PROVIDER: "sqlite",
+    NUXT_STORAGE_ENABLED: "true",
+    NUXT_PUBLIC_STORAGE_ENABLED: "true",
+    NUXT_STORAGE_PROVIDER: "fs"
+  };
+  const ambiguous = /^(?:RUNTIME_CONFIG$|NUXT_(?:AUTH|SYNC|STORAGE|SECRETS|PUBLIC)$|NITRO_ENV_(?:PREFIX|EXPANSION)$|NITRO_(?:AUTH|SYNC|STORAGE|SECRETS|PUBLIC)(?:_|$))/;
+  if (profile !== "basic-sqlite-fs" || !(env.AUTH_PROVIDER || env.OR3_AUTH_PROVIDER) || env.OR3_SYNC_PROVIDER !== "sqlite" || env.NUXT_PUBLIC_STORAGE_PROVIDER !== "fs" || env.OR3_SQLITE_DRIVER && env.OR3_SQLITE_DRIVER !== "better-sqlite3" || env.SSR_AUTH_ENABLED !== "true" || (env.OR3_CLOUD_SYNC_ENABLED ?? env.OR3_SYNC_ENABLED) !== "true" || (env.OR3_CLOUD_STORAGE_ENABLED ?? env.OR3_STORAGE_ENABLED) !== "true" || Object.entries(expectedOverrides).some(([key, expected]) => env[key] !== undefined && env[key] !== expected) || Object.keys(env).some((key) => ambiguous.test(key))) {
     throw new Error("Unsupported offline backup inspection provider profile; SQLite/FS is required.");
   }
-  const helper = `or3-backup-inspection-${randomUUID2()}`;
-  const checked = async (args) => {
-    const result = await run("docker", args, directory);
-    if (!result.ok)
-      throw new Error(`Offline backup reference inspection failed or is unsupported. ${redact(result.stderr, secretValues(env))}`);
-    return result.stdout.trim();
-  };
-  let primary;
+}
+async function assertBackupSourceProfile(directory, state, env) {
+  assertSupportedBackupProfile(env);
+  if (state.image !== env.OR3_IMAGE || state.volumeName !== env.OR3_VOLUME_NAME)
+    throw new Error("Backup source identity differs from managed state.");
+  await assertSafeComposeBinding(directory, state.mode, env);
+  const config = parseComposeConfig(await resolvedComposeConfig(directory, state.mode));
+  const service = config.services?.or3;
+  if (!service)
+    throw new Error("Backup source Compose service is missing.");
+  const readEnv = (input2) => {
+    const values = {};
+    const entries = Array.isArray(input2) ? input2.map((line) => {
+      if (typeof line !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*=/.test(line))
+        throw new Error("Backup source environment is malformed.");
+      const index = line.indexOf("=");
+      return [line.slice(0, index), line.slice(index + 1)];
+    }) : input2 && typeof input2 === "object" ? Object.entries(input2) : [];
+    for (const [key, value] of entries) {
+      if (typeof key !== "string" || typeof value !== "string" || Object.hasOwn(values, key))
+        throw new Error("Backup source environment is incomplete or ambiguous.");
+      values[key] = value;
+    }
+    return values;
+  };
+  const resolved = readEnv(service.environment);
+  assertSupportedBackupProfile(resolved);
+  if (service.entrypoint != null || service.command != null || service.working_dir != null || service.read_only !== true)
+    throw new Error("Backup source Compose changes the managed application startup.");
+  const matches = (candidate) => {
+    assertSupportedBackupProfile(candidate);
+    for (const [key, value] of [["OR3_BASIC_AUTH_DB_PATH", "/data/auth.sqlite"], ["OR3_SQLITE_DB_PATH", "/data/sync.sqlite"], ["OR3_STORAGE_FS_ROOT", "/data/storage"]]) {
+      if (env[key] !== value || resolved[key] !== value || candidate[key] !== value)
+        throw new Error(`Backup source ${key} does not use the captured managed path.`);
+    }
+    for (const [key, value] of [["OR3_ADMIN_DATA_DIR", "/data/admin"], ["OR3_EXTENSIONS_ROOT", "/data/extensions"]]) {
+      if (env[key] !== undefined && env[key] !== value || resolved[key] !== value || candidate[key] !== value)
+        throw new Error(`Backup source ${key} does not use the captured managed path.`);
+    }
+    const profileKey = /^(?:AUTH_PROVIDER|SSR_AUTH_ENABLED|OR3_(?:AUTH_PROVIDER|SYNC_(?:ENABLED|PROVIDER)|CLOUD_SYNC_ENABLED|STORAGE_(?:ENABLED|PROVIDER|FS_ROOT)|CLOUD_STORAGE_ENABLED|SQLITE_(?:DB_PATH|DRIVER)|BASIC_AUTH_DB_PATH)|NUXT_(?:AUTH|SYNC|STORAGE|PUBLIC)(?:_.*)?|NITRO_(?:AUTH|SYNC|STORAGE|PUBLIC|ENV)(?:_.*)?|RUNTIME_CONFIG)$/;
+    for (const key of new Set([...Object.keys(env), ...Object.keys(resolved), ...Object.keys(candidate)])) {
+      if (profileKey.test(key) && (resolved[key] !== env[key] || candidate[key] !== resolved[key]))
+        throw new Error(`Backup source profile configuration differs for ${key}.`);
+    }
+  };
+  matches(resolved);
+  if ((service.volumes ?? []).some((mount) => typeof mount.target === "string" && mount.target.startsWith("/data/")))
+    throw new Error("Backup source Compose has an uncaptured mount inside /data.");
+  const listed = await run("docker", composeArgs(directory, state.mode, ["ps", "-aq", "or3"]), directory);
+  const ids = listed.stdout.trim().split(/\s+/).filter(Boolean);
+  if (!listed.ok || ids.length !== 1)
+    throw new Error("Backup requires exactly one existing source container, running or stopped.");
+  const inspect = await run("docker", ["inspect", "--format", `{{json .Config.Env}}
+{{json .Image}}
+{{json .Mounts}}
+{{json .Config.Labels}}`, ids[0]], directory);
+  const image = await run("docker", ["image", "inspect", "--format", "{{.Id}}", env.OR3_IMAGE], directory);
+  if (!inspect.ok || !image.ok || !image.stdout.trim())
+    throw new Error("Backup source container or image cannot be inspected.");
+  let actual, imageId, mounts, labels;
   try {
-    await checked([
-      "run",
-      "--pull",
-      "never",
-      "--rm",
-      "--detach",
-      "--name",
-      helper,
-      "--network",
-      "none",
-      "--read-only",
-      "--security-opt",
-      "no-new-privileges:true",
-      "--cap-drop",
-      "ALL",
-      "--memory",
-      "256m",
-      "--cpus",
-      "0.5",
-      "--pids-limit",
-      "32",
-      "--tmpfs",
-      "/scratch:rw,noexec,nosuid,nodev,size=512m,mode=700,uid=65532,gid=65532",
-      "--entrypoint",
-      "sh",
-      env.OR3_IMAGE,
-      "-c",
-      "sleep 240"
-    ]);
-    await streamFileToCommand("docker", ["exec", "-i", helper, "sh", "-c", "ulimit -f 16384; tar tvzf - > /scratch/inventory"], join14(backupPath, "data.tgz"), directory, secretValues(env));
-    const inventory = JSON.parse(await checked(["exec", helper, "sh", "-c", NODE, "or3-backup-inspection", INSPECTOR, "inventory"]));
-    if (!Array.isArray(inventory.selected) || !inventory.selected.includes("./sync.sqlite") && !inventory.selected.includes("sync.sqlite") || inventory.selected.some((name) => !/^(?:\.\/)?sync[.]sqlite(?:-wal)?$/.test(name)) || inventory.selected.length > 2 || !Number.isSafeInteger(inventory.bytes) || inventory.bytes < 0)
-      throw new Error("Invalid offline backup inspection inventory response.");
-    const freeKiB = Number(await checked(["exec", helper, "sh", "-c", "df -Pk /scratch | awk 'NR == 2 { print $4 }'"]));
-    if (!Number.isFinite(freeKiB) || freeKiB < 0)
-      throw new Error("Could not verify offline backup scratch capacity.");
-    assertEnoughFreeSpace(freeKiB * 1024, inventory.bytes, "Offline backup inspection scratch");
-    await streamFileToCommand("docker", ["exec", "-i", helper, "tar", "-xz", "-f", "-", "-C", "/scratch", ...inventory.selected], join14(backupPath, "data.tgz"), directory, secretValues(env));
-    const result = JSON.parse(await checked(["exec", helper, "sh", "-c", NODE, "or3-backup-inspection", INSPECTOR, "references", env.OR3_STORAGE_FS_ROOT ?? "/data/storage"]));
+    const lines = inspect.stdout.trimEnd().split(`
+`);
+    if (lines.length !== 4)
+      throw new Error("incomplete");
+    [actual, imageId, mounts, labels] = lines.map((line) => JSON.parse(line));
+  } catch {
+    throw new Error("Backup source container inspection is incomplete or malformed.");
+  }
+  if (imageId !== image.stdout.trim() || !labels || typeof labels !== "object" || Array.isArray(labels) || labels["com.docker.compose.project"] !== state.composeProject || labels["com.docker.compose.service"] !== "or3")
+    throw new Error("Backup source container identity does not match the managed deployment.");
+  if (!Array.isArray(mounts))
+    throw new Error("Backup source container mounts are unavailable.");
+  const onlyMounts = (items, property, allowed) => {
+    if (items.some((item) => !item || typeof item !== "object" || Array.isArray(item) || !allowed.includes(item[property])))
+      throw new Error("Backup source has an unexpected mount.");
+  };
+  onlyMounts(service.volumes ?? [], "target", ["/data", "/run/or3-secrets", "/run/or3-secrets-client", "/run/or3-operator"]);
+  assertCapturedComposeMounts(service);
+  onlyMounts(mounts, "Destination", ["/data", "/run/or3-secrets", "/run/or3-secrets-client", "/run/or3-operator"]);
+  assertBackupOperatorMount(directory, dashboardUpdatesEnabled(directory), service.volumes ?? [], mounts);
+  const data = mounts.filter((mount) => mount && typeof mount === "object" && mount.Destination === "/data");
+  if (data.length !== 1 || data[0].Type !== "volume" || data[0].Name !== state.volumeName || mounts.some((mount) => typeof mount?.Destination === "string" && mount.Destination.startsWith("/data/")))
+    throw new Error("Backup source container does not use the captured data volume exclusively.");
+  matches(readEnv(actual));
+  const actualEnv = readEnv(actual);
+  const imageExecution = await run("docker", ["image", "inspect", "--format", `{{json .Config.Entrypoint}}
+{{json .Config.Cmd}}
+{{json .Config.WorkingDir}}
+{{json .Config.Env}}`, env.OR3_IMAGE], directory);
+  if (!imageExecution.ok)
+    throw new Error("Backup source image startup cannot be inspected.");
+  let imageEntry, imageCommand, imageWorkingDir, imageEnvironment;
+  try {
+    const lines = imageExecution.stdout.trimEnd().split(`
+`);
+    if (lines.length !== 4)
+      throw new Error("incomplete");
+    [imageEntry, imageCommand, imageWorkingDir, imageEnvironment] = lines.map((line) => JSON.parse(line));
+  } catch {
+    throw new Error("Backup source image startup inspection is malformed.");
+  }
+  const defaultEnv = readEnv(imageEnvironment);
+  const executionKey = /^(?:PATH|NODE_.+|BUN_.+|LD_.+|DYLD_.+)$/;
+  const checkExecutionEnv = (source, isResolved) => {
+    for (const key of new Set([...Object.keys(source), ...Object.keys(defaultEnv)])) {
+      if (executionKey.test(key) && (isResolved ? source[key] ?? defaultEnv[key] : source[key]) !== defaultEnv[key])
+        throw new Error(`Backup source changes execution environment ${key}.`);
+    }
+  };
+  checkExecutionEnv(actualEnv, false);
+  checkExecutionEnv(resolved, true);
+  const checkExecution = async (container, expectedEntry, expectedCommand, containerMounts) => {
+    const result = await run("docker", ["inspect", "--format", `{{json .Config.Entrypoint}}
+{{json .Config.Cmd}}
+{{json .Config.WorkingDir}}
+{{json .HostConfig.ReadonlyRootfs}}
+{{json .HostConfig.Tmpfs}}
+{{json .HostConfig.Mounts}}`, container], directory);
+    let entry, command, cwd, readonly, tmpfs, hostMounts;
+    try {
+      const lines = result.stdout.trimEnd().split(`
+`);
+      if (!result.ok || lines.length !== 6)
+        throw new Error("incomplete");
+      [entry, command, cwd, readonly, tmpfs, hostMounts] = lines.map((line) => JSON.parse(line));
+    } catch {
+      throw new Error("Backup source startup inspection is incomplete.");
+    }
+    if (JSON.stringify(entry) !== JSON.stringify(expectedEntry) || JSON.stringify(command) !== JSON.stringify(expectedCommand) || cwd !== imageWorkingDir || readonly !== true)
+      throw new Error("Backup source container changes the managed startup or writable root.");
+    assertCapturedHostMounts(tmpfs, hostMounts);
+    const diff = await run("docker", ["diff", container], directory);
+    if (!diff.ok)
+      throw new Error("Backup source container writable layer is changed or cannot be inspected.");
+    assertBackupContainerDiff(diff.stdout, containerMounts);
+  };
+  await checkExecution(ids[0], imageEntry, imageCommand, mounts);
+  const vaultEnabled = managedVaultEnabled(directory, env);
+  const legacyWithoutVault = !vaultEnabled && !config.services?.["or3-vault"] && [env, resolved, actualEnv].every((values) => !Object.keys(values).some((key) => key.startsWith("NUXT_SECRETS_"))) && !(service.volumes ?? []).some((mount) => typeof mount.target === "string" && mount.target.startsWith("/run/or3-secrets")) && !mounts.some((mount) => typeof mount?.Destination === "string" && mount.Destination.startsWith("/run/or3-secrets"));
+  const provider = env.NUXT_SECRETS_PROVIDER ?? "or3-secrets";
+  if (!legacyWithoutVault && (provider !== "" && provider !== "or3-secrets" || resolved.NUXT_SECRETS_PROVIDER !== provider || actualEnv.NUXT_SECRETS_PROVIDER !== provider || provider === "or3-secrets" !== vaultEnabled)) {
+    throw new Error("Backup source secret provider differs from managed vault custody.");
+  }
+  if (vaultEnabled) {
+    for (const [key, value] of [["NUXT_SECRETS_SOCKET_PATH", "/run/or3-secrets/api.sock"], ["NUXT_SECRETS_TOKEN_FILE", "/run/or3-secrets-client/service.token"], ["OR3_MANAGED_VAULT_CONFIG", "/run/or3-secrets-client/config.json"]]) {
+      if (resolved[key] !== value || actualEnv[key] !== value)
+        throw new Error("Backup source vault connection is not the managed connection.");
+    }
+    for (const key of new Set([...Object.keys(resolved), ...Object.keys(actualEnv)])) {
+      if (key.startsWith("NUXT_SECRETS_") && resolved[key] !== actualEnv[key])
+        throw new Error(`Backup source vault configuration differs for ${key}.`);
+    }
+    const expected = [
+      ["/vault-data", `${state.volumeName}-vault-data`],
+      ["/vault-key", `${state.volumeName}-vault-key`],
+      ["/run/or3-secrets", `${state.volumeName}-vault-run`],
+      ["/run/or3-secrets-client", `${state.volumeName}-vault-client`]
+    ];
+    const checkComposeMounts = (mountsToCheck, required) => {
+      for (const [target, volume] of required) {
+        const matches2 = mountsToCheck.filter((mount) => mount.target === target);
+        const source = matches2[0]?.source;
+        if (matches2.length !== 1 || matches2[0]?.type !== "volume" || typeof source !== "string" || (config.volumes?.[source]?.name ?? source) !== volume || mountsToCheck.some((mount) => typeof mount.target === "string" && mount.target.startsWith(`${target}/`)))
+          throw new Error("Backup source Compose vault mounts do not match managed custody.");
+      }
+    };
+    const checkActualMounts = (mountsToCheck, required) => {
+      if (!mountsToCheck.every((mount) => mount && typeof mount === "object" && !Array.isArray(mount)))
+        throw new Error("Backup source container vault mounts are malformed.");
+      const typed = mountsToCheck;
+      for (const [target, volume] of required) {
+        const matches2 = typed.filter((mount) => mount.Destination === target);
+        if (matches2.length !== 1 || matches2.at(0)?.Type !== "volume" || matches2.at(0)?.Name !== volume || typed.some((mount) => typeof mount.Destination === "string" && mount.Destination.startsWith(`${target}/`)))
+          throw new Error("Backup source container vault mounts do not match managed custody.");
+      }
+    };
+    checkComposeMounts(service.volumes ?? [], expected.slice(2));
+    checkActualMounts(mounts, expected.slice(2));
+    const vaultService = config.services?.["or3-vault"];
+    if (!vaultService || vaultService.image !== env.OR3_IMAGE)
+      throw new Error("Backup source vault service does not use the managed image.");
+    const vaultResolved = readEnv(vaultService.environment);
+    checkExecutionEnv(vaultResolved, true);
+    if (JSON.stringify(vaultService.entrypoint) !== JSON.stringify(["/nodejs/bin/node", "/app/vault/entrypoint.mjs"]) || vaultService.command != null || vaultService.working_dir != null || vaultService.read_only !== true)
+      throw new Error("Backup source Compose changes the managed vault startup.");
+    onlyMounts(vaultService.volumes ?? [], "target", expected.map(([target]) => target));
+    assertCapturedComposeMounts(vaultService);
+    checkComposeMounts(vaultService.volumes ?? [], expected);
+    const vaultListed = await run("docker", composeArgs(directory, state.mode, ["ps", "-aq", "or3-vault"]), directory);
+    const vaultIds = vaultListed.stdout.trim().split(/\s+/).filter(Boolean);
+    if (!vaultListed.ok || vaultIds.length !== 1)
+      throw new Error("Backup requires exactly one existing source vault container.");
+    const vaultInspect = await run("docker", ["inspect", "--format", `{{json .Config.Env}}
+{{json .Image}}
+{{json .Mounts}}
+{{json .Config.Labels}}`, vaultIds[0]], directory);
+    if (!vaultInspect.ok)
+      throw new Error("Backup source vault container cannot be inspected.");
+    let vaultEnv, vaultImage, vaultMounts, vaultLabels;
+    try {
+      const lines = vaultInspect.stdout.trimEnd().split(`
+`);
+      if (lines.length !== 4)
+        throw new Error("incomplete");
+      [vaultEnv, vaultImage, vaultMounts, vaultLabels] = lines.map((line) => JSON.parse(line));
+    } catch {
+      throw new Error("Backup source vault inspection is incomplete or malformed.");
+    }
+    if (vaultImage !== image.stdout.trim() || !vaultLabels || typeof vaultLabels !== "object" || Array.isArray(vaultLabels) || vaultLabels["com.docker.compose.project"] !== state.composeProject || vaultLabels["com.docker.compose.service"] !== "or3-vault" || !Array.isArray(vaultMounts)) {
+      throw new Error("Backup source vault container identity does not match the managed deployment.");
+    }
+    checkActualMounts(vaultMounts, expected);
+    const actualVaultEnv = readEnv(vaultEnv);
+    checkExecutionEnv(actualVaultEnv, false);
+    if (vaultResolved.OR3_VAULT_NAMESPACE !== (resolved.NUXT_SECRETS_NAMESPACE || "or3") || actualVaultEnv.OR3_VAULT_NAMESPACE !== vaultResolved.OR3_VAULT_NAMESPACE)
+      throw new Error("Backup source vault namespace differs from the managed connection.");
+    onlyMounts(vaultMounts, "Destination", [...expected.map(([target]) => target), "/data"]);
+    await checkExecution(vaultIds[0], ["/nodejs/bin/node", "/app/vault/entrypoint.mjs"], null, vaultMounts);
+  }
+}
+async function validateCanonicalBackupReferences(directory, env, backupPath) {
+  assertSupportedBackupProfile(env);
+  await withBackupHelper(directory, env.OR3_IMAGE, env, { network: "none" }, async (helper) => {
+    await helper.loadSqlite(join17(backupPath, "data.tgz"));
+    const result = JSON.parse(await helper.exec(["sh", "-c", NODE3, "or3-backup-inspection", INSPECTOR3, "references", env.OR3_STORAGE_FS_ROOT ?? "/data/storage"]));
     if (result.contract !== 1 || result.complete !== true || !Number.isSafeInteger(result.liveAttachments) || result.liveAttachments < 0)
       throw new Error("Offline canonical backup reference inspection did not complete.");
-  } catch (error) {
-    primary = error;
-  }
-  const cleanup = await run("docker", ["rm", "--force", helper], directory);
-  if (!cleanup.ok && !/No such container/i.test(cleanup.stderr)) {
-    throw new AggregateError(primary ? [primary] : [], `Offline backup inspection helper cleanup failed. ${redact(cleanup.stderr, secretValues(env))}`);
-  }
-  if (primary)
-    throw primary;
+  });
 }
 
 // src/backup/retention.ts
-import { rm as rm5 } from "node:fs/promises";
-import { basename as basename4, dirname as dirname4, join as join15, resolve as resolve8 } from "node:path";
+import { rm as rm6 } from "node:fs/promises";
+import { basename as basename4, dirname as dirname4, join as join18, resolve as resolve9 } from "node:path";
 var BACKUP_RETENTION_KEEP = 5;
 function assertRemovableArtifactName(name) {
   if (!BACKUP_ID_PATTERN.test(name)) {
@@ -3369,18 +4588,18 @@ async function removeNamedBackupArtifact(directory, backupId) {
   if (dirname4(target) !== deploymentPaths(directory).backups) {
     throw new Error(`Refusing to remove a path outside the backups directory: ${target}.`);
   }
-  await rm5(target, { recursive: true, force: true });
-  await rm5(join15(deploymentPaths(directory).exports, `${backupId}.json`), { force: true });
+  await rm6(target, { recursive: true, force: true });
+  await rm6(join18(deploymentPaths(directory).exports, `${backupId}.json`), { force: true });
 }
 async function removeEnumeratedBackupArtifact(directory, backup) {
   await lifecycleFaults.beforeArtifactDelete?.();
-  const backupsRoot = resolve8(deploymentPaths(directory).backups);
-  const target = resolve8(backup.path);
+  const backupsRoot = resolve9(deploymentPaths(directory).backups);
+  const target = resolve9(backup.path);
   if (dirname4(target) !== backupsRoot || basename4(target) !== backup.backupId || !BACKUP_ID_PATTERN.test(backup.backupId)) {
     throw new Error(`Refusing to prune an untrusted backup path ${backup.path}.`);
   }
-  await rm5(target, { recursive: true, force: true });
-  await rm5(join15(deploymentPaths(directory).exports, `${backup.backupId}.json`), { force: true });
+  await rm6(target, { recursive: true, force: true });
+  await rm6(join18(deploymentPaths(directory).exports, `${backup.backupId}.json`), { force: true });
 }
 function planRetention(entries, keep, protectedIds, options = {}) {
   if (!Number.isInteger(keep) || keep < 1)
@@ -3404,9 +4623,13 @@ function planRetention(entries, keep, protectedIds, options = {}) {
     if (automatic)
       canPrune = false;
   }
-  const verified = entries.filter((entry) => entry.kind === "verified").map((entry) => entry.backup).sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0);
-  const removable = verified.filter((backup) => !protectedIds.has(backup.backupId));
-  const remove = removable.slice(keep).map((backup) => backup.backupId);
+  const observedAt = Date.now();
+  const verified = entries.filter((entry) => entry.kind === "verified").map((entry) => entry.backup).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+  const removable = verified.filter((backup) => !protectedIds.has(backup.backupId) && Date.parse(backup.createdAt) <= observedAt);
+  const full = removable.filter((backup) => backup.recoveryArtifactsComplete === true && backup.snapshotKind === "full" && backup.remoteKind !== "s3-reference-v1");
+  const safety = removable.filter((backup) => backup.recoveryArtifactsComplete === true && backup.snapshotKind === "safety" && backup.remoteKind !== "s3-reference-v1");
+  const references = removable.filter((backup) => backup.recoveryArtifactsComplete === true && backup.snapshotKind === "safety" && backup.remoteKind === "s3-reference-v1");
+  const remove = [...full.slice(keep), ...safety.slice(keep), ...references.slice(keep)].map((backup) => backup.backupId);
   const removeSet = new Set(remove);
   return {
     keep: verified.filter((backup) => !removeSet.has(backup.backupId)).map((backup) => backup.backupId),
@@ -3455,7 +4678,7 @@ async function pruneBackups(directory, state, keep, force, options = {}) {
       throw new Error(`Retention selected backup ${backupId}, but its verified path disappeared before deletion.`);
     const revalidated = await inspectBackupEntry(deploymentPaths(directory).backups, backupId, directory);
     const current = revalidated.kind === "verified" ? revalidated.backup : undefined;
-    if (!current || current.path !== backup.path || current.dataSha256 !== backup.dataSha256) {
+    if (!current || current.path !== backup.path || current.dataSha256 !== backup.dataSha256 || current.createdAt !== backup.createdAt || current.schemaVersion !== backup.schemaVersion || current.remoteKind !== backup.remoteKind || current.snapshotKind !== backup.snapshotKind || current.recoveryArtifactsComplete !== backup.recoveryArtifactsComplete) {
       throw new Error(`Backup ${backupId} changed while pruning was in progress. Aborting retention before deletion.`);
     }
     await removeEnumeratedBackupArtifact(directory, current);
@@ -3470,7 +4693,7 @@ var asError = (error) => error instanceof Error ? error : new Error(String(error
 var RECOVERY_STEPS = 'Keep the operation record. Inspect the named paths and their permissions, then run "npx @or3/cloud recover --dry-run" and "npx @or3/cloud recover" from the deployment directory. Do not restore an unverified artifact or remove recovery locks manually.';
 async function artifactStatus(path) {
   try {
-    await lstat2(path);
+    await lstat4(path);
     return { absent: false, detail: `Still present: ${path}.` };
   } catch (error) {
     if (error.code === "ENOENT")
@@ -3487,7 +4710,7 @@ async function cleanupPartialBackup(directory, backupId) {
   }
   const statuses = await Promise.all([
     artifactStatus(backupDirectory(directory, backupId)),
-    artifactStatus(join16(deploymentPaths(directory).exports, `${backupId}.json`))
+    artifactStatus(join19(deploymentPaths(directory).exports, `${backupId}.json`))
   ]);
   const removed = statuses.every((status) => status.absent);
   const detail = statuses.map((status) => status.detail).join(" ");
@@ -3496,7 +4719,17 @@ async function cleanupPartialBackup(directory, backupId) {
   return { error, removed, detail };
 }
 async function createBackup(directory, state, env, options = {}) {
+  const remoteStorage = env.NUXT_PUBLIC_STORAGE_PROVIDER === "s3";
+  if (!remoteStorage) {
+    assertSupportedBackupProfile(env);
+    await assertBackupSourceProfile(directory, state, env);
+  } else if (options.safetySnapshot)
+    remoteSource(env);
+  else
+    assertRemoteTransferConfiguration(env);
   const restartAfter = options.restartAfter ?? true;
+  if (managedVaultEnabled(directory, env))
+    await assertVaultVolumesExist(directory, state);
   await requireImageDigest(state.image, state.imageDigest, "Current deployment");
   const backupId = options.backupId ?? id("backup");
   if (!BACKUP_ID_PATTERN.test(backupId))
@@ -3536,6 +4769,7 @@ async function createBackup(directory, state, env, options = {}) {
     await report("capturing", `Backup capture: OR3 is stopped; writing ${backupDir}.`);
     await volumeArchive(directory, state.mode, env, backupDir);
     if (managedVaultEnabled(directory, env)) {
+      await assertVaultVolumesExist(directory, state);
       await streamCommandToFile("docker", composeArgs(directory, state.mode, [
         "run",
         "--rm",
@@ -3546,9 +4780,9 @@ async function createBackup(directory, state, env, options = {}) {
         "or3-vault",
         "/app/vault/entrypoint.mjs",
         "backup"
-      ]), join16(backupDir, "vault.backup"), directory, secretValues(env));
+      ]), join19(backupDir, "vault.backup"), directory, secretValues(env));
     }
-    await copySecure(deploymentPaths(directory).env, join16(backupDir, "config.env"));
+    await copySecure(deploymentPaths(directory).env, join19(backupDir, "config.env"));
     managedAssetSha256 = await snapshotManagedAssets(directory, state.mode, backupDir);
     artifact = "captured";
   } catch (error) {
@@ -3562,6 +4796,8 @@ async function createBackup(directory, state, env, options = {}) {
         progressFailures.push(asError(error));
       }
       try {
+        if (managedVaultEnabled(directory, env))
+          await assertVaultVolumesExist(directory, state);
         await startProject(directory, state.mode, env);
         service = "healthy";
         downtimeMs = Date.now() - stopStartedAt;
@@ -3571,20 +4807,30 @@ async function createBackup(directory, state, env, options = {}) {
       }
     }
   }
+  if (!primaryFailure && restartFailure && remoteStorage)
+    primaryFailure = new Error("S3 capture requires successful service recovery before remote transfer.");
   if (!primaryFailure) {
     try {
+      let remote;
+      if (remoteStorage) {
+        await report("remote-capture", options.safetySnapshot ? "Remote inventory: recording and verifying S3 references for rollback." : "Remote capture: copying and verifying the referenced S3 objects.");
+        remote = options.safetySnapshot ? await captureRemoteInventory(directory, state, env, backupDir) : await captureRemoteSnapshot(directory, state, env, backupDir);
+      }
       await report("verifying", `Verification: checking the captured backup; ${service === "healthy" ? "OR3 is deeply healthy" : service === "stopped" ? "OR3 remains stopped" : "service recovery is unverified"}.`);
+      if (!options.safetySnapshot && !remoteStorage)
+        await validateCanonicalBackupReferences(directory, { ...env, OR3_IMAGE: imageAtDigest(state.image, state.imageDigest) }, backupDir);
       const manifest2 = {
-        schemaVersion: 1,
+        ...remote ? { schemaVersion: 2, storage: "s3", remote } : { schemaVersion: 1 },
         backupId,
+        snapshotKind: options.safetySnapshot ? "safety" : "full",
         createdAt: capturedAt,
         appVersion: state.appVersion,
         image: state.image,
         imageDigest: state.imageDigest,
-        dataSha256: await sha256File(join16(backupDir, "data.tgz")),
-        ...managedVaultEnabled(directory, env) ? { vaultSha256: await sha256File(join16(backupDir, "vault.backup")) } : {},
+        dataSha256: await sha256File(join19(backupDir, "data.tgz")),
+        ...managedVaultEnabled(directory, env) ? { vaultSha256: await sha256File(join19(backupDir, "vault.backup")) } : {},
         dataBytes: volumeSize,
-        configSha256: await sha256File(join16(backupDir, "config.env")),
+        configSha256: await sha256File(join19(backupDir, "config.env")),
         managedAssetSha256,
         managedAssetInventoryVersion: managedAssetSha256?.["dashboard-lifecycle.mjs"] ? MANAGED_ASSET_INVENTORY_VERSION : managedAssetSha256?.["compose.operator.yaml"] ? 3 : managedAssetSha256?.["dashboard-operator.mjs"] ? 2 : undefined,
         mode: state.mode,
@@ -3598,10 +4844,8 @@ async function createBackup(directory, state, env, options = {}) {
       };
       const manifestContents = `${JSON.stringify(manifest2, null, 2)}
 `;
-      await writeSecure(join16(backupDir, "manifest.json"), manifestContents);
+      await writeSecure(join19(backupDir, "manifest.json"), manifestContents);
       await writeBackupAuthentication(directory, backupDir, manifestContents);
-      if (!options.safetySnapshot)
-        await validateCanonicalBackupReferences(directory, { ...env, OR3_IMAGE: imageAtDigest(state.image, state.imageDigest) }, backupDir);
       verifiedManifest = await readManifest(backupDir, directory);
       artifact = "verified";
     } catch (error) {
@@ -3650,12 +4894,12 @@ async function createBackup(directory, state, env, options = {}) {
 async function inspectUnclaimedBackupArtifacts(directory, backupId, backupPath) {
   if (!backupId || !backupPath || !BACKUP_ID_PATTERN.test(backupId))
     return;
-  const expectedPath = resolve9(backupDirectory(directory, backupId));
-  if (resolve9(backupPath) !== expectedPath)
+  const expectedPath = resolve10(backupDirectory(directory, backupId));
+  if (resolve10(backupPath) !== expectedPath)
     return;
   const statuses = await Promise.all([
     artifactStatus(expectedPath),
-    artifactStatus(join16(deploymentPaths(directory).exports, `${backupId}.json`))
+    artifactStatus(join19(deploymentPaths(directory).exports, `${backupId}.json`))
   ]);
   const detail = statuses.map((status) => status.detail).join(" ");
   return statuses.every((status) => status.absent) ? detail : `Maintenance warning: backup artifact ownership was not recorded. ${detail} This recovery did not verify or remove these paths. Inspect them with "npx @or3/cloud backup list".`;
@@ -3663,8 +4907,8 @@ async function inspectUnclaimedBackupArtifacts(directory, backupId, backupPath)
 async function cleanupJournaledPartialBackup(directory, backupId, backupPath) {
   if (!backupId || !backupPath || !BACKUP_ID_PATTERN.test(backupId))
     return;
-  const expectedPath = resolve9(backupDirectory(directory, backupId));
-  if (resolve9(backupPath) !== expectedPath)
+  const expectedPath = resolve10(backupDirectory(directory, backupId));
+  if (resolve10(backupPath) !== expectedPath)
     return;
   try {
     await readManifest(expectedPath, directory);
@@ -3681,51 +4925,53 @@ async function createPreMutationSnapshot(directory, state, env, backupId) {
 }
 
 // src/backup/export.ts
-import { chmod as chmod7, mkdir as mkdir7, realpath, rm as rm6, stat as stat3 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname5, isAbsolute as isAbsolute3, join as join17, resolve as resolve10, sep } from "node:path";
+import { chmod as chmod7, mkdir as mkdir7, realpath as realpath2, rm as rm7, stat as stat4 } from "node:fs/promises";
+import { basename as basename5, dirname as dirname5, isAbsolute as isAbsolute5, join as join20, resolve as resolve11, sep } from "node:path";
 var PURGE_REQUIRES_BACKUP_WITHIN_MS = 24 * 60 * 60 * 1000;
 async function exportBackup(directory, backupId, destination) {
   const backupPath = await resolveBackup(directory, backupId);
   const manifest2 = await readManifest(backupPath, directory);
-  const dest = resolve10(destination);
-  const source = resolve10(backupPath);
-  const deploymentRoot = await realpath(directory);
+  if (manifest2.schemaVersion === 2 && manifest2.remote.kind === "s3-reference-v1")
+    throw new Error("S3 reference-only snapshots cannot be exported as recovery backups.");
+  const dest = resolve11(destination);
+  const source = resolve11(backupPath);
+  const deploymentRoot = await realpath2(directory);
   if (source === dest || dest.startsWith(`${source}${sep}`)) {
     throw new Error("Choose a destination directory different from the backup itself.");
   }
   if (await fileExists(dest))
     throw new Error(`Destination ${dest} already exists. Choose a new empty destination so an export can never merge with unrelated files.`);
   await mkdir7(dirname5(dest), { recursive: true, mode: 448 });
-  const canonicalDestination = join17(await realpath(dirname5(dest)), basename5(dest));
+  const canonicalDestination = join20(await realpath2(dirname5(dest)), basename5(dest));
   if (canonicalDestination === deploymentRoot || canonicalDestination.startsWith(`${deploymentRoot}${sep}`)) {
     throw new Error("Backup exports must live outside the managed deployment directory so `remove --purge-data` can never delete the remaining copy.");
   }
   await mkdir7(dest, { mode: 448 });
   try {
-    if (await realpath(dest) !== canonicalDestination) {
+    if (await realpath2(dest) !== canonicalDestination) {
       throw new Error("Backup export destination changed while it was being created. Refusing to write an export through an unexpected path.");
     }
     await chmod7(dest, 448);
-    for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth", ...manifest2.vaultSha256 ? ["vault.backup"] : []]) {
-      await copySecure(join17(backupPath, file), join17(dest, file));
+    for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth", ...manifest2.vaultSha256 ? ["vault.backup"] : [], ...manifest2.schemaVersion === 2 ? [manifest2.remote.file] : []]) {
+      await copySecure(join20(backupPath, file), join20(dest, file));
     }
     if (manifest2.managedAssetSha256) {
       for (const name of managedAssetNamesForInventory(manifest2.mode, manifest2.managedAssetInventoryVersion)) {
-        await copySecure(join17(backupPath, "managed-assets", name), join17(dest, "managed-assets", name));
+        await copySecure(join20(backupPath, "managed-assets", name), join20(dest, "managed-assets", name));
       }
     }
-    const dataSha = await sha256File(join17(dest, "data.tgz"));
+    const dataSha = await sha256File(join20(dest, "data.tgz"));
     if (dataSha !== manifest2.dataSha256) {
       throw new Error(`Exported data.tgz checksum mismatch for ${manifest2.backupId}. Expected ${manifest2.dataSha256}, got ${dataSha}.`);
     }
     if (manifest2.configSha256) {
-      const configSha = await sha256File(join17(dest, "config.env"));
+      const configSha = await sha256File(join20(dest, "config.env"));
       if (configSha !== manifest2.configSha256) {
         throw new Error(`Exported config.env checksum mismatch for ${manifest2.backupId}.`);
       }
     }
     await readManifest(dest, directory);
-    const destinationDevice = (await stat3(dest)).dev;
+    const destinationDevice = (await stat4(dest)).dev;
     await mkdir7(deploymentPaths(directory).exports, { recursive: true, mode: 448 });
     const receipt = {
       schemaVersion: 1,
@@ -3736,65 +4982,28 @@ async function exportBackup(directory, backupId, destination) {
       dataSha256: manifest2.dataSha256,
       configSha256: manifest2.configSha256
     };
-    await writeSecure(join17(deploymentPaths(directory).exports, `${manifest2.backupId}.json`), `${JSON.stringify(receipt, null, 2)}
+    await writeSecure(join20(deploymentPaths(directory).exports, `${manifest2.backupId}.json`), `${JSON.stringify(receipt, null, 2)}
 `);
-    let bytes = (manifest2.vaultSha256 ? (await stat3(join17(dest, "vault.backup"))).size : 0) + (await stat3(join17(dest, "data.tgz"))).size + (await stat3(join17(dest, "config.env"))).size + (await stat3(join17(dest, "manifest.json"))).size + (await stat3(join17(dest, "manifest.auth"))).size;
+    let bytes = (manifest2.vaultSha256 ? (await stat4(join20(dest, "vault.backup"))).size : 0) + (await stat4(join20(dest, "data.tgz"))).size + (await stat4(join20(dest, "config.env"))).size + (await stat4(join20(dest, "manifest.json"))).size + (await stat4(join20(dest, "manifest.auth"))).size;
+    if (manifest2.schemaVersion === 2)
+      bytes += (await stat4(join20(dest, manifest2.remote.file))).size;
     if (manifest2.managedAssetSha256) {
       for (const name of managedAssetNamesForInventory(manifest2.mode, manifest2.managedAssetInventoryVersion)) {
-        bytes += (await stat3(join17(dest, "managed-assets", name))).size;
+        bytes += (await stat4(join20(dest, "managed-assets", name))).size;
       }
     }
     console.log(`Exported backup ${manifest2.backupId} (${bytes} bytes) to ${dest}`);
     console.log("The exported copy contains credentials and secrets. It is owner-only (0600); keep it off-host.");
-    if ((await stat3(backupPath)).dev === destinationDevice) {
-      console.log("This export is on the same filesystem as the deployment and cannot authorize `remove --purge-data`. Copy it to a mounted backup disk or another host, then export again there.");
+    if ((await stat4(backupPath)).dev === destinationDevice) {
+      console.log("This export is on the same filesystem as the deployment. Keep a separate off-host copy; data purge remains disabled until reconstruction is supported.");
     } else {
-      console.log("Verified export recorded. It can authorize `remove --purge-data --yes` while this backup remains fresh.");
+      console.log("Verified export recorded. Data purge remains disabled until reconstruction from an export is supported.");
     }
   } catch (error) {
-    await rm6(dest, { recursive: true, force: true });
+    await rm7(dest, { recursive: true, force: true });
     throw error;
   }
 }
-function assertPurgeBackupFreshness(backups, nowMs) {
-  const cutoff = nowMs - PURGE_REQUIRES_BACKUP_WITHIN_MS;
-  if (!backups.some((backup) => new Date(backup.createdAt).getTime() >= cutoff)) {
-    throw new Error('No backup newer than 24 hours exists for this deployment. Run "npx @or3/cloud backup" and "npx @or3/cloud backup export <backup-id> <destination-dir>" before destroying local data.');
-  }
-}
-async function readBackupExportReceipt(directory, backupId) {
-  try {
-    const receipt = JSON.parse(await readText(join17(deploymentPaths(directory).exports, `${backupId}.json`)));
-    if (receipt.schemaVersion !== 1 || receipt.backupId !== backupId || typeof receipt.destination !== "string" || !isAbsolute3(receipt.destination) || typeof receipt.destinationDevice !== "number" || !receipt.dataSha256)
-      return;
-    return receipt;
-  } catch {
-    return;
-  }
-}
-async function assertPurgeHasVerifiedExport(directory, backups, nowMs) {
-  assertPurgeBackupFreshness(backups, nowMs);
-  const cutoff = nowMs - PURGE_REQUIRES_BACKUP_WITHIN_MS;
-  for (const backup of backups) {
-    if (new Date(backup.createdAt).getTime() < cutoff)
-      continue;
-    const receipt = await readBackupExportReceipt(directory, backup.backupId);
-    if (!receipt || !await fileExists(receipt.destination))
-      continue;
-    const deploymentRoot = await realpath(directory);
-    try {
-      const canonicalDestination = await realpath(receipt.destination);
-      if (canonicalDestination === deploymentRoot || canonicalDestination.startsWith(`${deploymentRoot}${sep}`))
-        continue;
-      const exported = await readManifest(receipt.destination, directory);
-      const sourceDevice = (await stat3(backup.path)).dev;
-      const destinationDevice = (await stat3(receipt.destination)).dev;
-      if (sourceDevice !== destinationDevice && receipt.destinationDevice === destinationDevice && exported.backupId === backup.backupId && exported.dataSha256 === receipt.dataSha256 && exported.dataSha256 === backup.dataSha256 && exported.configSha256 === receipt.configSha256)
-        return receipt;
-    } catch {}
-  }
-  throw new Error("No fresh checksum-verified backup export on another filesystem is available. Run `npx @or3/cloud backup export <backup-id> <new-directory-on-a-mounted-backup-disk>` before purging local data.");
-}
 
 // src/commands/backup.ts
 function parseKeep(flags) {
@@ -3808,6 +5017,10 @@ async function backupCreateCommand(directory) {
   await ensureDocker();
   const loaded = await loadManaged(directory);
   assertNoPending(loaded.state);
+  assertSupportedBackupProfile(loaded.env);
+  await assertBackupSourceProfile(loaded.directory, loaded.state, loaded.env);
+  if (managedVaultEnabled(loaded.directory, loaded.env))
+    await assertVaultVolumesExist(loaded.directory, loaded.state);
   const backupId = id("backup");
   const initialAppRunning = await projectServiceRunning(loaded.directory, loaded.state.mode);
   const pending = {
@@ -3882,6 +5095,10 @@ async function backupListCommand(directory, flags = {}) {
         appVersion: backup.appVersion,
         bytes: backup.bytes,
         dataSha256: backup.dataSha256,
+        manifestSchemaVersion: backup.schemaVersion,
+        snapshotKind: backup.snapshotKind ?? null,
+        recoveryArtifactsComplete: backup.recoveryArtifactsComplete === true,
+        ...backup.remoteKind ? { remoteKind: backup.remoteKind } : {},
         trust: "verified"
       })),
       findings: findings.map((entry) => ({ entryName: entry.entryName, kind: entry.kind, code: entry.code, message: entry.message })),
@@ -3897,10 +5114,16 @@ async function backupListCommand(directory, flags = {}) {
     console.log(`No authenticated backups are available for ${loaded.directory}.`);
   } else {
     console.log(`OR3 Cloud backups for ${loaded.directory} (${verified.length} verified):`);
-    console.log("backupId                      createdAt                      version  bytes     trust     checksum");
+    console.log("backupId                      createdAt                      version  bytes     kind                snapshot  coverage    trust     checksum");
     for (const backup of verified) {
-      console.log(`${backup.backupId.padEnd(30)} ${backup.createdAt.padEnd(30)} ${backup.appVersion.padEnd(8)} ${String(backup.bytes).padStart(9)}  ${"verified".padEnd(9)} ${backup.dataSha256.slice(0, 12)}`);
+      const kind = backup.remoteKind === "s3-reference-v1" ? "reference-only" : backup.remoteKind === "s3-copy-v1" ? "s3-copy" : "filesystem";
+      const snapshot = backup.snapshotKind ?? "unmarked";
+      const coverage = backup.recoveryArtifactsComplete ? "complete" : "incomplete";
+      console.log(`${backup.backupId.padEnd(30)} ${backup.createdAt.padEnd(30)} ${backup.appVersion.padEnd(8)} ${String(backup.bytes).padStart(9)}  ${kind.padEnd(19)} ${snapshot.padEnd(9)} ${coverage.padEnd(11)} ${"verified".padEnd(9)} ${backup.dataSha256.slice(0, 12)}`);
     }
+    console.log("Verified checksums and artifact coverage are not proof of a successful recovery.");
+    if (verified.some((backup) => backup.remoteKind === "s3-reference-v1"))
+      console.log("Reference-only snapshots require their original bucket and cannot be exported as recovery copies.");
   }
   if (findings.length > 0) {
     console.log(`
@@ -3967,8 +5190,8 @@ async function backupCommand(directory, positionals, flags) {
 }
 
 // src/credentials/reset.ts
-import { rm as rm7 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { rm as rm8 } from "node:fs/promises";
+import { join as join21 } from "node:path";
 
 // src/credentials/reset-script.ts
 function buildCredentialsResetScript(input2) {
@@ -4152,7 +5375,10 @@ async function verifyCredentialsInsideContainer(directory, mode, values) {
     throw new Error(`Credential verification inside the OR3 container failed. ${redact(result.stderr, [values.ownerPassword, values.adminPassword])}`);
 }
 async function applyCredentialReset(directory, state, nextEnv) {
+  assertLegacyManagedProfile(nextEnv);
   const values = credentialResetValues(nextEnv);
+  if (managedVaultEnabled(directory, nextEnv))
+    await assertVaultVolumesExist(directory, state);
   const running = await run("docker", [...composeArgs(directory, state.mode, ["ps", "-q", "or3"])], directory);
   if (!running.ok || !running.stdout.trim()) {
     await writeSecure(deploymentPaths(directory).env, serializeEnv(nextEnv));
@@ -4161,9 +5387,11 @@ async function applyCredentialReset(directory, state, nextEnv) {
   await runCredentialsResetScript(directory, state.mode, values);
   const runtimeEnv = withoutProvisioningCredentials(nextEnv);
   await writeSecure(deploymentPaths(directory).env, serializeEnv(runtimeEnv));
-  const initialCredentials = join18(directory, ".or3-initial-credentials");
-  await rm7(initialCredentials, { force: true });
+  const initialCredentials = join21(directory, ".or3-initial-credentials");
+  await rm8(initialCredentials, { force: true });
   await stopProject(directory, state.mode);
+  if (managedVaultEnabled(directory, runtimeEnv))
+    await assertVaultVolumesExist(directory, state);
   await startProject(directory, state.mode, runtimeEnv);
   await verifyCredentialsInsideContainer(directory, state.mode, values);
 }
@@ -4176,6 +5404,10 @@ async function credentialsResetCommand(directory, flags) {
   const loaded = await loadManaged(directory);
   assertDeploymentDirectoryIdentity(directory, loaded.state);
   assertNoPending(loaded.state);
+  assertLegacyManagedProfile(loaded.env);
+  await assertLegacyComposeProfile(loaded.directory, loaded.state.mode, loaded.env);
+  if (managedVaultEnabled(loaded.directory, loaded.env))
+    await assertVaultVolumesExist(loaded.directory, loaded.state);
   const ownerEmail = loaded.env.OR3_MANAGED_OWNER_EMAIL || loaded.env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
   const adminUsername = loaded.env.OR3_ADMIN_USERNAME;
   if (!ownerEmail)
@@ -4222,10 +5454,10 @@ async function credentialsCommand(directory, positionals, flags) {
 
 // src/commands/doctor.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { stat as stat4 } from "node:fs/promises";
-import { basename as basename6, join as join19, resolve as resolve11 } from "node:path";
+import { stat as stat5 } from "node:fs/promises";
+import { basename as basename6, join as join22, resolve as resolve12 } from "node:path";
 async function doctorCommand(directory) {
-  const resolved = resolve11(directory);
+  const resolved = resolve12(directory);
   const paths = deploymentPaths(resolved);
   const failures = [];
   let state;
@@ -4248,10 +5480,10 @@ async function doctorCommand(directory) {
     failures.push(error instanceof Error ? error.message : String(error));
     console.log("✗ Managed state or .env is missing/invalid");
   }
-  for (const file of [paths.env, paths.state, join19(resolved, ".or3-initial-credentials")]) {
+  for (const file of [paths.env, paths.state, join22(resolved, ".or3-initial-credentials")]) {
     if (!existsSync3(file))
       continue;
-    const mode = (await stat4(file)).mode & 511;
+    const mode = (await stat5(file)).mode & 511;
     if (mode !== 384) {
       failures.push(`${file} must be mode 0600 (currently ${mode.toString(8)}).`);
       console.log(`✗ Permissions: ${file} is ${mode.toString(8)}`);
@@ -4319,8 +5551,8 @@ async function doctorCommand(directory) {
             throw new Error("Dashboard operator deployment identity does not match managed state.");
           }
           assertDashboardOperatorMounts(container.Mounts ?? [], resolved);
-          const ipcDirectory = await stat4(paths.operatorIpc);
-          const operatorSocket = await stat4(join19(paths.operatorIpc, "operator.sock"));
+          const ipcDirectory = await stat5(paths.operatorIpc);
+          const operatorSocket = await stat5(join22(paths.operatorIpc, "operator.sock"));
           const operatorUid = Number(env.OR3_OPERATOR_UID);
           const operatorGid = Number(env.OR3_OPERATOR_GID);
           if ((ipcDirectory.mode & 511) !== 456 || ipcDirectory.uid !== operatorUid || ipcDirectory.gid !== operatorGid || !operatorSocket.isSocket() || (operatorSocket.mode & 511) !== 432 || operatorSocket.uid !== operatorUid || operatorSocket.gid !== operatorGid) {
@@ -4379,15 +5611,15 @@ async function doctorCommand(directory) {
 
 // src/commands/init.ts
 import { chmod as chmod8, mkdir as mkdir8 } from "node:fs/promises";
-import { join as join20, relative, resolve as resolve12 } from "node:path";
+import { join as join23, relative, resolve as resolve13 } from "node:path";
 async function initCommand(positionals, flags) {
   const hasLocal = boolFlag(flags, "local");
   const hasPublic = boolFlag(flags, "public");
   if (hasLocal === hasPublic)
     throw new Error("Choose exactly one of --local or --public.");
   const mode = hasPublic ? "public" : "local";
-  const directory = resolve12(process.cwd(), positionals[0] ?? "or3-cloud");
-  if (await fileExists(join20(directory, ".or3-cloud", "state.json"))) {
+  const directory = resolve13(process.cwd(), positionals[0] ?? "or3-cloud");
+  if (await fileExists(join23(directory, ".or3-cloud", "state.json"))) {
     throw new Error(`${directory} is already a managed deployment. Use update, doctor, or adopt.`);
   }
   await readDirectoryEmpty(directory);
@@ -4413,7 +5645,7 @@ async function initCommand(positionals, flags) {
   await ensureDocker();
   const names = composeProjectNames(directory);
   await assertDockerProjectAbsent(names.project);
-  for (const volume of [names.volume, ...mode === "public" ? [names.caddyData, names.caddyConfig] : []]) {
+  for (const volume of [names.volume, ...managedVaultVolumeNames(names.volume), ...mode === "public" ? [names.caddyData, names.caddyConfig] : []]) {
     const existing = await run("docker", ["volume", "inspect", volume]);
     if (existing.ok)
       throw new Error(`Docker volume ${volume} already exists. Choose a new directory or inspect it before initializing.`);
@@ -4438,7 +5670,7 @@ ${existing.stderr}`)) {
   await copyAssets(directory, mode);
   const env = buildEnv({ mode, version, directory, image, email, password, domain, port, dashboardOperator: operator });
   await writeSecure(deploymentPaths(directory).env, serializeEnv(env));
-  await writeSecure(join20(directory, ".or3-initial-credentials"), serializeInitialCredentials({
+  await writeSecure(join23(directory, ".or3-initial-credentials"), serializeInitialCredentials({
     bootstrapEmail: email,
     bootstrapPassword: password,
     adminUsername: email,
@@ -4463,7 +5695,7 @@ ${existing.stderr}`)) {
     const folder = relative(process.cwd(), directory) || ".";
     console.log(`
 OR3 Cloud ${version} is running at ${url}`);
-    console.log(`Sign in as ${email} with the password in ${join20(folder, ".or3-initial-credentials")}; the same login opens ${url}/admin.`);
+    console.log(`Sign in as ${email} with the password in ${join23(folder, ".or3-initial-credentials")}; the same login opens ${url}/admin.`);
     console.log("Save it in a password manager, then delete that file.");
     console.log(`
 Run later commands from the deployment folder: cd ${quote(folder)} && npx @or3/cloud doctor`);
@@ -4484,6 +5716,10 @@ async function startCommand(directory) {
   const loaded = await loadManaged(directory);
   assertDeploymentDirectoryIdentity(directory, loaded.state);
   assertPhaseAllowsCommand("start", loaded.state);
+  assertLegacyManagedProfile(loaded.env);
+  await assertLegacyComposeProfile(loaded.directory, loaded.state.mode, loaded.env);
+  if (managedVaultEnabled(loaded.directory, loaded.env))
+    await assertVaultVolumesExist(loaded.directory, loaded.state);
   await startProject(directory, loaded.state.mode, loaded.env);
   const url = loaded.state.mode === "public" ? `https://${loaded.state.domain}` : `http://127.0.0.1:${loaded.state.port}`;
   console.log(`OR3 started and is deeply healthy at ${url}.`);
@@ -4501,6 +5737,8 @@ async function restartCommand(directory, lifecycle) {
   const loaded = await loadManaged(directory);
   assertDeploymentDirectoryIdentity(directory, loaded.state);
   assertPhaseAllowsCommand("restart", loaded.state);
+  assertLegacyManagedProfile(loaded.env);
+  await assertLegacyComposeProfile(loaded.directory, loaded.state.mode, loaded.env, lifecycle?.deadline);
   if (lifecycle) {
     await assertSafeComposeBinding(directory, loaded.state.mode, loaded.env, lifecycle.deadline);
     await assertRunningAppImage(directory, loaded.state.mode, loaded.state.image, lifecycle.deadline);
@@ -4515,11 +5753,8 @@ async function restartCommand(directory, lifecycle) {
   console.log("OR3 restarted and is deeply healthy.");
 }
 
-// src/commands/recover.ts
-import { join as join24 } from "node:path";
-
 // src/backup/restore.ts
-import { join as join21 } from "node:path";
+import { join as join24 } from "node:path";
 
 // src/backup/generation-restore.ts
 function rebindRestoredGenerations(fs, path, crypto, db, root, options = {}) {
@@ -4715,14 +5950,14 @@ if (root !== '/data' && !root.startsWith('/data/')) throw new Error('Generation
   if (!result.ok)
     throw new Error(`Restored generation verification failed. ${redact(result.stderr, secretValues(env))}`);
 }
-function assertFilesystemPayloadHash(key, readChunk, createHash3) {
+function assertFilesystemPayloadHash(key, readChunk, createHash5) {
   const match = /^(sha256|md5)_([a-fA-F0-9]+)$/.exec(key);
   const algorithm = match?.[1];
   const expected = match?.[2];
   if (algorithm !== "sha256" && algorithm !== "md5" || expected?.length !== (algorithm === "sha256" ? 64 : 32)) {
     throw new Error("Invalid canonical filesystem payload key");
   }
-  const hash = createHash3(algorithm);
+  const hash = createHash5(algorithm);
   for (let chunk = readChunk();chunk !== undefined; chunk = readChunk())
     hash.update(chunk);
   if (hash.digest("hex") !== expected.toLowerCase())
@@ -4732,8 +5967,10 @@ var VERIFY_RESTORED_DATA_SCRIPT = `
 const fs = require('node:fs');
 const Database = require('/app/.output/server/node_modules/better-sqlite3');
 const validFilesystemPayload = ${assertFilesystemPayloadHash.toString()};
-const paths = [process.env.OR3_BASIC_AUTH_DB_PATH, process.env.OR3_SQLITE_DB_PATH].filter(Boolean);
-if (paths.length !== 2) throw new Error('Both managed database paths must be configured');
+const auth = process.env.AUTH_PROVIDER || 'basic-auth', storage = process.env.NUXT_PUBLIC_STORAGE_PROVIDER || 'fs';
+if (!(auth === 'basic-auth' && storage === 'fs' || auth === 'clerk' && storage === 's3')) throw new Error('Unsupported restored provider profile');
+const paths = auth === 'basic-auth' ? [process.env.OR3_BASIC_AUTH_DB_PATH, process.env.OR3_SQLITE_DB_PATH] : [process.env.OR3_SQLITE_DB_PATH];
+if (paths.some(path => !path)) throw new Error('Managed database paths must be configured');
 for (const path of paths) {
   const databasePath = fs.realpathSync(path);
   if (!fs.statSync(databasePath).isFile()) throw new Error('Restored database payload must be a regular file');
@@ -4754,7 +5991,7 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 const storageRoot = path.resolve(process.env.OR3_STORAGE_FS_ROOT || '/data/storage');
 const workspacesRoot = path.join(storageRoot, 'workspaces');
-if ((storageRoot === '/data' || storageRoot.startsWith('/data/')) && fs.existsSync(workspacesRoot)) {
+if (storage === 'fs' && (storageRoot === '/data' || storageRoot.startsWith('/data/')) && fs.existsSync(workspacesRoot)) {
   const chunk = Buffer.alloc(65536);
   for (const workspace of fs.readdirSync(workspacesRoot, { withFileTypes: true }).filter(entry => /^[a-zA-Z0-9_-]+$/.test(entry.name))) {
     const directory = path.join(workspacesRoot, workspace.name);
@@ -4776,7 +6013,7 @@ if ((storageRoot === '/data' || storageRoot.startsWith('/data/')) && fs.existsSy
 }
 `;
 async function assertRestoreFreeSpace(directory, state, env, manifest2, backupPath) {
-  const archiveBytes = await gzipUncompressedBytes(join21(backupPath, "data.tgz"));
+  const archiveBytes = await gzipUncompressedBytes(join24(backupPath, "data.tgz"));
   const requiredBytes = Math.max(manifest2.dataBytes ?? 0, archiveBytes);
   const freeBytes = await dataVolumeFreeBytes(directory, state.mode, env);
   const reclaimableBytes = await dataVolumeSize(directory, state.mode, env, "allocated");
@@ -4785,15 +6022,32 @@ async function assertRestoreFreeSpace(directory, state, env, manifest2, backupPa
 async function restoreBackupData(directory, state, env, backupPath, options = {}) {
   const manifest2 = await readManifest(backupPath, directory);
   assertRestorableManagedAssets(manifest2);
-  const backupEnv = parseEnv(await readText(join21(backupPath, "config.env")));
+  const backupEnv = parseEnv(await readText(join24(backupPath, "config.env")));
   if (backupEnv.OR3_VERSION !== manifest2.appVersion || backupEnv.OR3_IMAGE !== manifest2.image) {
     throw new Error(`Backup ${manifest2.backupId} configuration does not match its manifest.`);
   }
   assertBackupMatchesDeployment(manifest2, backupEnv, state, env);
+  if (manifest2.schemaVersion === 1)
+    assertSupportedBackupProfile(backupEnv);
+  else if (!options.beforeStart && options.remoteReferencePolicy !== "warn" || options.remoteReferencePolicy === "warn" && (!options.previousSafetySnapshot || options.beforeStart) || options.previousSafetySnapshot && manifest2.remote.kind !== "s3-reference-v1") {
+    throw new Error("S3 restore requires a journaled startup or a reference-only safety snapshot.");
+  }
   if (manifest2.imageDigest)
     await requireImageDigest(manifest2.image, manifest2.imageDigest, `Backup ${manifest2.backupId}`);
+  await assertExistingVaultCustody(directory, state, manifest2, backupPath, backupEnv);
   await validateVolumeArchive(directory, state.mode, env, backupPath, backupEnv.OR3_STORAGE_FS_ROOT);
-  if (!options.previousSafetySnapshot) {
+  if (manifest2.schemaVersion === 2 && manifest2.remote.kind === "s3-copy-v1") {
+    const result = await checkRemoteCopyTarget(directory, manifest2, env, backupPath, manifest2.remote);
+    if (result.missing || result.mismatched)
+      throw new Error("S3 restore target has missing or mismatched objects.");
+  } else if (manifest2.schemaVersion === 2 && manifest2.remote.kind === "s3-reference-v1") {
+    const result = await checkRemoteTarget(directory, manifest2, env, backupPath, manifest2.remote);
+    if (result.missing || result.mismatched) {
+      if (options.remoteReferencePolicy !== "warn")
+        throw new Error("S3 reference target has missing or mismatched objects.");
+      console.warn(`Restoring the pre-mutation snapshot with ${result.missing} missing and ${result.mismatched} mismatched S3 objects; attachment completeness is not certified.`);
+    }
+  } else if (!options.previousSafetySnapshot) {
     await validateCanonicalBackupReferences(directory, { ...backupEnv, OR3_IMAGE: imageAtDigest(manifest2.image, manifest2.imageDigest) }, backupPath);
   } else {
     console.warn("Restoring the recorded byte-preservation safety snapshot; canonical attachment completeness is not certified. Verify previously uploaded files.");
@@ -4802,10 +6056,10 @@ async function restoreBackupData(directory, state, env, backupPath, options = {}
   await assertRestoreFreeSpace(directory, state, env, manifest2, backupPath);
   const restoresOperatorOverlay = [3, MANAGED_ASSET_INVENTORY_VERSION].includes(manifest2.managedAssetInventoryVersion ?? 1) && Boolean(manifest2.managedAssetSha256?.["compose.operator.yaml"]);
   const restoredEnv = restoresOperatorOverlay ? {
-    ...backupEnv,
+    ...restoreStorageConfiguration(backupEnv, env),
     OR3_IMAGE: imageAtDigest(manifest2.image, manifest2.imageDigest)
   } : withoutDashboardOperator({
-    ...backupEnv,
+    ...restoreStorageConfiguration(backupEnv, env),
     OR3_IMAGE: imageAtDigest(manifest2.image, manifest2.imageDigest)
   });
   if (options.recreateDataVolume)
@@ -4835,6 +6089,10 @@ async function restoreBackupData(directory, state, env, backupPath, options = {}
     "--env",
     `OR3_SQLITE_DB_PATH=${restoredEnv.OR3_SQLITE_DB_PATH ?? ""}`,
     "--env",
+    `AUTH_PROVIDER=${restoredEnv.AUTH_PROVIDER ?? restoredEnv.OR3_AUTH_PROVIDER ?? "basic-auth"}`,
+    "--env",
+    `NUXT_PUBLIC_STORAGE_PROVIDER=${restoredEnv.NUXT_PUBLIC_STORAGE_PROVIDER ?? "fs"}`,
+    "--env",
     `OR3_STORAGE_FS_ROOT=${restoredEnv.OR3_STORAGE_FS_ROOT ?? "/data/storage"}`,
     "--entrypoint",
     "sh",
@@ -4844,9 +6102,19 @@ async function restoreBackupData(directory, state, env, backupPath, options = {}
   if (!snapshotCheck.ok) {
     throw new Error(`Restored snapshot integrity verification failed. ${redact(snapshotCheck.stderr, secretValues(restoredEnv))}`);
   }
-  await restoreGenerationIdentities(directory, state, restoredEnv, backupPath, { previousSafetySnapshot: options.previousSafetySnapshot });
+  if (manifest2.schemaVersion === 1)
+    await restoreGenerationIdentities(directory, state, restoredEnv, backupPath, { previousSafetySnapshot: options.previousSafetySnapshot });
   await options.beforeStart?.();
   await startProject(directory, state.mode, restoredEnv);
+  if (manifest2.schemaVersion === 2 && manifest2.remote.kind === "s3-copy-v1") {
+    const result = await checkRemoteCopyTarget(directory, manifest2, restoredEnv, backupPath, manifest2.remote);
+    if (result.missing || result.mismatched)
+      throw new Error("S3 restore target has missing or mismatched objects after startup.");
+  } else if (manifest2.schemaVersion === 2 && manifest2.remote.kind === "s3-reference-v1" && options.remoteReferencePolicy !== "warn") {
+    const result = await checkRemoteTarget(directory, manifest2, restoredEnv, backupPath, manifest2.remote);
+    if (result.missing || result.mismatched)
+      throw new Error("S3 reference target has missing or mismatched objects after startup.");
+  }
   return manifest2;
 }
 async function restorePreMutationSnapshot(directory, state, env) {
@@ -4856,30 +6124,30 @@ async function restorePreMutationSnapshot(directory, state, env) {
   const previous = await recordedBackupPath(directory, pending);
   await updatePending(directory, state, { phase: "restoring-previous" });
   if (pending.recreateDataVolume) {
-    await restoreBackupData(directory, state, env, previous.path, { recreateDataVolume: true, previousSafetySnapshot: true });
+    await restoreBackupData(directory, state, env, previous.path, { recreateDataVolume: true, previousSafetySnapshot: true, remoteReferencePolicy: "warn" });
     return previous;
   }
   if (pending.previousRootOwnership) {
     await pullAndRequireImage(state.image, state.imageDigest, "Previous deployment");
     await setManagedVolumeRootOwnership(directory, state, env, state.image, pending.previousRootOwnership);
   }
-  await restoreBackupData(directory, state, env, previous.path, { previousSafetySnapshot: true });
+  await restoreBackupData(directory, state, env, previous.path, { previousSafetySnapshot: true, remoteReferencePolicy: "warn" });
   return previous;
 }
 
 // src/deployment/observation.ts
-import { createHash as createHash4 } from "node:crypto";
-import { resolve as resolve13 } from "node:path";
+import { createHash as createHash6 } from "node:crypto";
+import { resolve as resolve14 } from "node:path";
 
 // src/deployment/lease.ts
 import { randomBytes as randomBytes8 } from "node:crypto";
-import { mkdir as mkdir10, rename as rename3, rm as rm9 } from "node:fs/promises";
-import { dirname as dirname7, join as join23 } from "node:path";
+import { mkdir as mkdir10, rename as rename3, rm as rm10 } from "node:fs/promises";
+import { dirname as dirname7, join as join26 } from "node:path";
 
 // ../../shared/server/restarts/controller.ts
-import { randomUUID as randomUUID3, createHash as createHash3 } from "node:crypto";
-import { mkdir as mkdir9, open as open3, readFile as readFile3, rename as rename2, rm as rm8 } from "node:fs/promises";
-import { dirname as dirname6, join as join22 } from "node:path";
+import { randomUUID as randomUUID5, createHash as createHash5 } from "node:crypto";
+import { mkdir as mkdir9, open as open4, readFile as readFile5, rename as rename2, rm as rm9 } from "node:fs/promises";
+import { dirname as dirname6, join as join25 } from "node:path";
 
 // ../../node_modules/zod/v4/classic/external.js
 var exports_external = {};
@@ -9928,7 +11196,7 @@ var recursive = /* @__PURE__ */ new WeakMap;
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve13) {
+function isRecursive(inst, stack, resolve14) {
   const cached2 = recursive.get(inst);
   if (cached2 !== undefined)
     return cached2 ? PROVEN : NONE;
@@ -9938,7 +11206,7 @@ function isRecursive(inst, stack, resolve13) {
   let result = NONE;
   const check = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve13);
+      const answer = isRecursive(child, stack, resolve14);
       if (answer > result)
         result = answer;
     }
@@ -9949,7 +11217,7 @@ function isRecursive(inst, stack, resolve13) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve13) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve14) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -10012,7 +11280,7 @@ function isRecursive(inst, stack, resolve13) {
       check(def.output);
       break;
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve13 ? inst._zod.innerType : undefined);
+      const inner = def._cachedInner ?? (resolve14 ? inst._zod.innerType : undefined);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -10073,7 +11341,7 @@ function bucketFor(state, inst) {
   return bucket;
 }
 var handoff;
-var open2 = [];
+var open3 = [];
 var memo = {
   alloc(_inst, payload, empty) {
     const bucket = handoff;
@@ -10082,7 +11350,7 @@ var memo = {
     handoff = undefined;
     const entry = { value: empty, issues: null };
     bucket.set(payload.value, entry);
-    open2.push(entry);
+    open3.push(entry);
     return empty;
   },
   guard(inst) {
@@ -10153,10 +11421,10 @@ var memo = {
           return payload;
         }
         handoff = bucket;
-        const depth = open2.length;
+        const depth = open3.length;
         const result = base(payload, ctx);
         handoff = undefined;
-        const entry = open2.length > depth ? open2.pop() : undefined;
+        const entry = open3.length > depth ? open3.pop() : undefined;
         if (result instanceof Promise) {
           return result.then((r) => {
             if (entry)
@@ -24328,7 +25596,7 @@ var recordSchema = exports_external.object({
   expected: exports_external.record(exports_external.string(), exports_external.union([exports_external.string().max(128), exports_external.boolean()])),
   executionIntent: exports_external.boolean(),
   runtimeIdentity: exports_external.string().max(512).optional()
-}).strict().refine((record2) => record2.requestId === record2.request.requestId && record2.fingerprint === createHash3("sha256").update(JSON.stringify(record2.request)).digest("hex"), "Receipt identity mismatch");
+}).strict().refine((record2) => record2.requestId === record2.request.requestId && record2.fingerprint === createHash5("sha256").update(JSON.stringify(record2.request)).digest("hex"), "Receipt identity mismatch");
 
 class RestartError extends Error {
   code;
@@ -24342,15 +25610,15 @@ class RestartError extends Error {
 var resolved = new Set(["succeeded", "cancelled", "failed"]);
 var replayWindowMs = 24 * 60 * 60 * 1000;
 async function readRestartJournal(path) {
-  const text = await readFile3(path, "utf8");
+  const text = await readFile5(path, "utf8");
   if (Buffer.byteLength(text) > 512 * 1024)
     throw new RestartError("journal_invalid");
   return exports_external.object({ schemaVersion: exports_external.literal(1), identity: exports_external.string().min(1), operations: exports_external.array(recordSchema).max(256) }).strict().parse(JSON.parse(text));
 }
 async function writePrivateJson(path, value) {
-  const temporary = `${path}.${randomUUID3()}.tmp`;
+  const temporary = `${path}.${randomUUID5()}.tmp`;
   try {
-    const file2 = await open3(temporary, "wx", 384);
+    const file2 = await open4(temporary, "wx", 384);
     try {
       await file2.writeFile(JSON.stringify(value));
       await file2.sync();
@@ -24358,14 +25626,14 @@ async function writePrivateJson(path, value) {
       await file2.close();
     }
     await rename2(temporary, path);
-    const directory = await open3(dirname6(path), "r");
+    const directory = await open4(dirname6(path), "r");
     try {
       await directory.sync();
     } finally {
       await directory.close();
     }
   } finally {
-    await rm8(temporary, { force: true });
+    await rm9(temporary, { force: true });
   }
 }
 function publicOperation(o) {
@@ -24392,7 +25660,7 @@ class RestartController {
   constructor(directory, driver) {
     this.directory = directory;
     this.driver = driver;
-    this.path = join22(directory, "restarts.json");
+    this.path = join25(directory, "restarts.json");
   }
   lock(action) {
     const next = this.serial.then(action, action);
@@ -24482,7 +25750,7 @@ class RestartController {
     if (!parsed.success)
       throw new RestartError("invalid_request", 400);
     const request = parsed.data;
-    const fingerprint = createHash3("sha256").update(JSON.stringify(request)).digest("hex");
+    const fingerprint = createHash5("sha256").update(JSON.stringify(request)).digest("hex");
     return this.lock(async () => {
       const old = this.operations.find((o2) => o2.requestId === request.requestId);
       if (old) {
@@ -24608,7 +25876,7 @@ class RestartController {
           });
           return;
         }
-        await new Promise((resolve13) => setTimeout(resolve13, 250));
+        await new Promise((resolve14) => setTimeout(resolve14, 250));
       }
       if (this.disposed)
         return;
@@ -24631,7 +25899,7 @@ class RestartController {
         throw new RestartError("configuration_unsupported", 501);
       if ((await this.driver.configuration()).revision !== expectedRevision)
         throw new RestartError("stale_revision");
-      const release = await this.driver.acquire(randomUUID3());
+      const release = await this.driver.acquire(randomUUID5());
       try {
         await this.driver.save(updates, expectedRevision);
       } finally {
@@ -24690,7 +25958,7 @@ class RestartController {
 var DASHBOARD_LEASE_STALE_MS = 30000;
 async function readLeaseOwner(leasePath) {
   try {
-    const owner = JSON.parse(await readText(join23(leasePath, "owner.json")));
+    const owner = JSON.parse(await readText(join26(leasePath, "owner.json")));
     if (owner.schemaVersion !== 1 || typeof owner.nonce !== "string" || typeof owner.command !== "string" || owner.origin !== "cli" && owner.origin !== "dashboard" || !Number.isSafeInteger(owner.pid) || typeof owner.acquiredAt !== "string" || typeof owner.heartbeatAt !== "string")
       return;
     return owner;
@@ -24738,7 +26006,7 @@ async function acquireDeploymentLease(directory, command, dashboardJobId) {
       const stalePath = `${leasePath}.stale-${randomBytes8(8).toString("hex")}`;
       try {
         await rename3(leasePath, stalePath);
-        await rm9(stalePath, { recursive: true, force: true });
+        await rm10(stalePath, { recursive: true, force: true });
         await mkdir10(leasePath, { recursive: false, mode: 448 });
       } catch (reclaimError) {
         throw new Error(`Another OR3 Cloud operation owns ${directory}. Refusing to race its lifecycle lock. ${reclaimError instanceof Error ? reclaimError.message : String(reclaimError)}`);
@@ -24749,17 +26017,17 @@ async function acquireDeploymentLease(directory, command, dashboardJobId) {
     }
   }
   try {
-    await writeSecure(join23(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
+    await writeSecure(join26(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
 `);
   } catch (error62) {
-    await rm9(leasePath, { recursive: true, force: true }).catch(() => {
+    await rm10(leasePath, { recursive: true, force: true }).catch(() => {
       return;
     });
     throw error62;
   }
   const heartbeat = setInterval(() => {
     owner.heartbeatAt = now();
-    writeSecure(join23(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
+    writeSecure(join26(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
 `).catch(() => {
       return;
     });
@@ -24769,7 +26037,7 @@ async function acquireDeploymentLease(directory, command, dashboardJobId) {
     clearInterval(heartbeat);
     const current = await readLeaseOwner(leasePath);
     if (current?.nonce === nonce)
-      await rm9(leasePath, { recursive: true, force: true });
+      await rm10(leasePath, { recursive: true, force: true });
   };
 }
 async function withDeploymentLease(directory, command, action) {
@@ -24784,7 +26052,7 @@ async function withDeploymentLease(directory, command, action) {
 }
 async function assertRestartJournalSettled(directory) {
   try {
-    const journal = await readRestartJournal(join23(directory, ".or3-cloud", "restarts", "restarts.json"));
+    const journal = await readRestartJournal(join26(directory, ".or3-cloud", "restarts", "restarts.json"));
     if (journal.operations.some((operation) => !["succeeded", "cancelled", "failed"].includes(operation.phase))) {
       throw new Error("A dashboard restart is unresolved. Run the compatible CLI recover --dry-run to inspect and recover --finish to reconcile it before another mutation.");
     }
@@ -24798,8 +26066,19 @@ async function assertRestartJournalSettled(directory) {
 }
 
 // src/deployment/observation.ts
+function latestFullSnapshot(backups, observedAt) {
+  const cutoff = Date.parse(observedAt);
+  const candidates = (backups?.entries ?? []).filter((entry) => entry.kind === "verified").map((entry) => entry.backup).filter((backup2) => backup2.recoveryArtifactsComplete === true && backup2.snapshotKind === "full" && backup2.schemaVersion === 1 && Date.parse(backup2.createdAt) <= cutoff).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt) || a.backupId.localeCompare(b.backupId));
+  const backup = candidates[0];
+  return backup ? {
+    backupId: backup.backupId,
+    createdAt: backup.createdAt,
+    schemaVersion: backup.schemaVersion,
+    remoteKind: backup.remoteKind ?? "none"
+  } : null;
+}
 async function observeDeployment(directory, options = {}) {
-  const resolved2 = resolve13(directory);
+  const resolved2 = resolve14(directory);
   const observedAt = now();
   let state = null;
   let stateError = null;
@@ -24926,6 +26205,7 @@ function publicStateProjection(state) {
       dashboardJobId: pending.dashboardJobId ?? null,
       targetVersion: pending.targetVersion ?? null,
       targetImageDigest: pending.targetImageDigest ?? null,
+      remoteReconcile: pending.remoteReconcile ?? null,
       backupProgress: pending.backupProgress ? {
         stage: pending.backupProgress.stage,
         service: pending.backupProgress.service,
@@ -24955,7 +26235,7 @@ function observationFindings(observation) {
   return findings;
 }
 function stateFingerprint(state) {
-  return createHash4("sha256").update(JSON.stringify({
+  return createHash6("sha256").update(JSON.stringify({
     schema: state.schemaVersion,
     appVersion: state.appVersion,
     image: state.image,
@@ -24987,6 +26267,9 @@ function decideRecoveryAction(state) {
     }
     return { action: "none", detail: "No incomplete operation is recorded." };
   }
+  if (pending.operation === "adopt") {
+    return { action: "require-explicit-restore", detail: "The adoption target may contain newer writes. Replaying the source backup can discard them.", snapshotId: pending.backupId };
+  }
   if (pending.operation === "update" && pending.phase === "target-ready" && pending.evidence) {
     return { action: "finish", detail: "A completed replacement carries durable target-ready evidence and can be committed without restoring data." };
   }
@@ -25028,6 +26311,7 @@ async function reconcileOperatorHandoff(directory, state, report = console.log)
   return detail;
 }
 async function collectTargetReadyChecks(directory, mode, env) {
+  const profile = managedProviderProfile(env);
   const checks3 = [];
   let containerId;
   const container = await run("docker", composeArgs(directory, mode, ["ps", "-q", "or3"]), directory);
@@ -25040,16 +26324,16 @@ async function collectTargetReadyChecks(directory, mode, env) {
   if (databaseCheck.ok) {
     try {
       const databases = JSON.parse(databaseCheck.stdout.trim());
-      databasesOk = databases.length === 2 && databases.every((entry) => entry.quickCheck === "ok" && entry.tables >= 1);
+      databasesOk = databases.length === (profile === "basic-sqlite-fs" ? 2 : 1) && databases.every((entry) => entry.quickCheck === "ok" && entry.tables >= 1);
     } catch {
       databasesOk = false;
     }
   }
-  checks3.push(databasesOk ? { code: "database-integrity", status: "passed", detail: "auth.sqlite and sync.sqlite quick_check passed with managed ownership." } : { code: "database-integrity", status: "failed", detail: `SQLite integrity or ownership verification failed. ${redact(databaseCheck.stderr.trim(), secretValues(env))}` });
+  checks3.push(databasesOk ? { code: "database-integrity", status: "passed", detail: `${profile === "basic-sqlite-fs" ? "auth.sqlite and sync.sqlite" : "sync.sqlite"} quick_check passed with managed ownership.` } : { code: "database-integrity", status: "failed", detail: `SQLite integrity or ownership verification failed. ${redact(databaseCheck.stderr.trim(), secretValues(env))}` });
   if (mode === "public") {
     const baseUrl = new URL(`https://${env.OR3_PUBLIC_DOMAIN}`);
     try {
-      validateVerificationHealth(await verificationJson(baseUrl, "/api/health?deep=true"));
+      validateVerificationHealth(await verificationJson(baseUrl, "/api/health?deep=true"), profile);
       checks3.push({ code: "public-health", status: "passed", detail: `${baseUrl.origin} deep health reports the managed profile.` });
     } catch (error62) {
       checks3.push({ code: "public-health", status: "failed", detail: redact(error62 instanceof Error ? error62.message : String(error62)) });
@@ -25247,6 +26531,8 @@ async function runRecovery(directory, context) {
   const loaded = await loadManaged(directory);
   const pending = loaded.state.incompleteOperation;
   const decision = decideRecoveryAction(loaded.state);
+  if (pending || decision.action === "reconcile-handoff")
+    assertLegacyManagedProfile(loaded.env);
   if (decision.action === "reconcile-handoff") {
     if (explicitRestore)
       throw new Error("This deployment completed its application update; only the dashboard operator handoff needs reconciliation. Run `npx @or3/cloud recover --finish` without --restore.");
@@ -25273,7 +26559,18 @@ async function runRecovery(directory, context) {
     const detail = await finishTargetReadyUpdate(loaded.directory, loaded.state, loaded.env, report);
     return { kind: "recovered", operation: "update", detail };
   }
+  const resumesExistingVault = pending.operation === "credentials-reset" || (pending.operation === "backup" ? pending.initialAppRunning !== false : ["update", "restore", "rollback"].includes(pending.operation) && (pending.phase === "prepared" || pending.phase === "snapshot-created"));
+  if (resumesExistingVault && managedVaultEnabled(loaded.directory, loaded.env))
+    await assertVaultVolumesExist(loaded.directory, loaded.state);
+  if (resumesExistingVault || pending.operation === "init" || pending.operation === "adopt") {
+    await assertLegacyComposeProfile(loaded.directory, loaded.state.mode, loaded.env);
+  }
+  if (pending.operation === "credentials-reset" && pending.credentialReset?.nextEnv)
+    assertLegacyManagedProfile(pending.credentialReset.nextEnv);
   const requiresExplicitRestore = decision.action === "require-explicit-restore";
+  if (pending.operation === "adopt" && requiresExplicitRestore && !explicitRestore) {
+    throw new Error("The adoption target may contain newer writes. Nothing was changed. Review recover --dry-run; recover --restore --yes explicitly discards target writes after the source backup.");
+  }
   try {
     if (pending.operation === "backup") {
       const failures = [];
@@ -25394,6 +26691,7 @@ async function runRecovery(directory, context) {
       if (sourceManifest.mode !== loaded.state.mode || sourceManifest.appVersion !== loaded.state.appVersion || sourceManifest.image !== loaded.state.image || sourceManifest.imageDigest !== loaded.state.imageDigest) {
         throw new Error(`Source backup ${sourceManifest.backupId} does not match the managed adoption target.`);
       }
+      await updatePending(loaded.directory, loaded.state, { phase: "target-mutating" });
       await stopProject(loaded.directory, loaded.state.mode);
       await restoreVolumeArchive(loaded.directory, loaded.state.mode, loaded.env, sourceBackupPath);
     }
@@ -25418,84 +26716,29 @@ async function runRecovery(directory, context) {
   } catch (error62) {
     const recoverySecrets = pending.operation === "credentials-reset" ? secretValues(pending.credentialReset?.nextEnv ?? loaded.env) : secretValues(loaded.env);
     loaded.state.lastError = redact(error62 instanceof Error ? error62.message : String(error62), recoverySecrets);
-    if (pending.operation === "adopt" && pending.sourceDirectory) {
-      try {
-        await compose(loaded.directory, loaded.state.mode, ["down"]).catch(() => {
-          return;
-        });
-        const sourceEnv = parseEnv(await readText(join24(pending.sourceDirectory, ".env")));
-        const sourceFiles = ["-f", join24(pending.sourceDirectory, "compose.yaml")];
-        const sourceModeValue = sourceMode(pending.sourceDirectory, sourceEnv);
-        if (sourceModeValue === "public")
-          sourceFiles.push("-f", join24(pending.sourceDirectory, "compose.public.yaml"));
-        if (pending.sourceInitiallyRunning !== false) {
-          await restartSource(pending.sourceDirectory, sourceFiles, secretValues(sourceEnv));
-        }
-      } catch (recovery) {
-        loaded.state.lastError += ` Original deployment recovery failed: ${recovery instanceof Error ? recovery.message : String(recovery)}`;
-      }
-    }
     await writeState(loaded.directory, loaded.state);
     throw new Error(`Recovery could not safely complete ${pending.operation}. Keep the operation record and run doctor. ${loaded.state.lastError}`);
   }
 }
 
 // src/commands/remove.ts
-import { rm as rm10 } from "node:fs/promises";
-import { join as join25 } from "node:path";
-function purgeVolumesFromState(state) {
-  const volumes = [state.volumeName];
-  if (state.mode === "public") {
-    if (state.caddyDataVolume)
-      volumes.push(state.caddyDataVolume);
-    if (state.caddyConfigVolume)
-      volumes.push(state.caddyConfigVolume);
-  }
-  return volumes;
-}
 async function removeCommand(directory, flags) {
   if (boolFlag(flags, "purge-data") && !boolFlag(flags, "yes")) {
-    throw new Error("--purge-data deletes the data volume, every backup, and the managed files. Re-run with --purge-data --yes after confirming the data-loss boundary.");
+    throw new Error("--purge-data is disabled because reconstruction from an export is not yet supported. Preserve the deployment and backups.");
   }
   await ensureDocker();
   const loaded = await loadManaged(directory);
   assertDeploymentDirectoryIdentity(directory, loaded.state);
   assertNoPending(loaded.state);
-  const { state } = loaded;
-  if (!boolFlag(flags, "purge-data")) {
-    await compose(directory, state.mode, ["down"]);
-    console.log(`Removed runtime containers and network. Data volume, backups, configuration, and managed state are retained at ${directory}. Re-run \`npx @or3/cloud start\` to restore service.`);
-    return;
+  if (boolFlag(flags, "purge-data")) {
+    throw new Error("Purge is disabled because reconstruction from an export is not yet supported. Preserve the deployment and backups.");
   }
-  const exportReceipt = await assertPurgeHasVerifiedExport(directory, await enumerateBackups(directory), Date.now());
-  const volumes = purgeVolumesFromState(state);
-  const managedFiles = [
-    ".env",
-    ".or3-cloud",
-    ...managedAssetNames(state.mode),
-    ".or3-initial-credentials"
-  ];
-  console.log("Removing exactly these targets:");
-  for (const volume of volumes)
-    console.log(`  docker volume ${volume}`);
-  for (const file2 of managedFiles)
-    console.log(`  ${join25(directory, file2)}`);
-  await compose(directory, state.mode, ["down"]);
-  await assertPurgeHasVerifiedExport(directory, await enumerateBackups(directory), Date.now());
-  for (const volume of volumes) {
-    const result = await run("docker", ["volume", "rm", volume], directory);
-    if (!result.ok)
-      throw new Error(`${result.command}
-${result.stderr}`);
-  }
-  for (const file2 of managedFiles) {
-    await rm10(join25(directory, file2), { recursive: true, force: true });
-  }
-  console.log(`Purged: data volumes, backups, .env, managed state, and compose files were deleted. The verified export at ${exportReceipt.destination} is the remaining copy.`);
+  await compose(directory, loaded.state.mode, ["down"]);
+  console.log(`Removed runtime containers and network. Data volume, backups, configuration, and managed state are retained at ${directory}. Re-run \`npx @or3/cloud start\` to restore service.`);
 }
 
 // src/commands/restore.ts
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 async function restoreCommand(directory, flags, positionals) {
   if (!boolFlag(flags, "yes"))
     throw new Error("Restore replaces live data. Re-run with --yes after confirming the backup and data-loss boundary.");
@@ -25508,18 +26751,26 @@ async function restoreCommand(directory, flags, positionals) {
   const backupPath = await resolveBackup(loaded.directory, backupValue);
   const manifest2 = await readManifest(backupPath, loaded.directory);
   assertRestorableManagedAssets(manifest2);
-  const backupEnv = parseEnv(await readText(join26(backupPath, "config.env")));
+  const backupEnv = parseEnv(await readText(join27(backupPath, "config.env")));
   if (backupEnv.OR3_VERSION !== manifest2.appVersion || backupEnv.OR3_IMAGE !== manifest2.image) {
     throw new Error(`Backup ${manifest2.backupId} configuration does not match its manifest.`);
   }
   assertBackupMatchesDeployment(manifest2, backupEnv, loaded.state, loaded.env);
+  assertSupportedBackupProfile(loaded.env);
+  await assertBackupSourceProfile(loaded.directory, loaded.state, loaded.env);
   const recreateDataVolume = restoreRequiresVolumeRecreation(loaded.env, backupEnv);
   if (manifest2.imageDigest)
     await pullAndRequireImage(manifest2.image, manifest2.imageDigest, `Backup ${manifest2.backupId}`);
   await assertSupportedHostArchitecture(manifest2.image);
+  await assertExistingVaultCustody(loaded.directory, loaded.state, manifest2, backupPath, backupEnv);
   await assertRestoreFreeSpace(loaded.directory, loaded.state, loaded.env, manifest2, backupPath);
   await validateVolumeArchive(loaded.directory, loaded.state.mode, loaded.env, backupPath, backupEnv.OR3_STORAGE_FS_ROOT);
-  await validateCanonicalBackupReferences(loaded.directory, { ...backupEnv, OR3_IMAGE: imageAtDigest(manifest2.image, manifest2.imageDigest) }, backupPath);
+  const remotePreflight = manifest2.schemaVersion === 2 ? await preflightRemoteRestore(loaded.directory, manifest2, loaded.env, backupPath) : undefined;
+  if (manifest2.schemaVersion === 1)
+    await validateCanonicalBackupReferences(loaded.directory, { ...backupEnv, OR3_IMAGE: imageAtDigest(manifest2.image, manifest2.imageDigest) }, backupPath);
+  const remoteReconcile = remotePreflight && "uploaded" in remotePreflight ? remotePreflight : undefined;
+  if (remoteReconcile)
+    console.log(`S3 reconciliation added ${remoteReconcile.uploaded} objects and ${remoteReconcile.markersCreated} markers; added objects remain if restore fails.`);
   const pending = {
     id: id("restore"),
     operation: "restore",
@@ -25533,6 +26784,7 @@ async function restoreCommand(directory, flags, positionals) {
     targetImage: manifest2.image,
     targetImageDigest: manifest2.imageDigest,
     recreateDataVolume,
+    remoteReconcile,
     phase: "prepared"
   };
   await markPending(loaded.directory, loaded.state, pending);
@@ -25584,6 +26836,8 @@ async function restoreCommand(directory, flags, positionals) {
       throw new Error(recoveredMessage);
     }
     try {
+      if (managedVaultEnabled(loaded.directory, loaded.env))
+        await assertVaultVolumesExist(loaded.directory, loaded.state);
       await startProject(loaded.directory, loaded.state.mode, loaded.env);
       loaded.state.lastError = `Restore of ${manifest2.backupId} stopped before data replacement: ${original}`;
       await clearPending(loaded.directory, loaded.state);
@@ -25598,7 +26852,7 @@ async function restoreCommand(directory, flags, positionals) {
 }
 
 // src/commands/rollback.ts
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 async function rollbackCommand(directory, flags) {
   if (!boolFlag(flags, "yes"))
     throw new Error("Rollback restores the previous image and data snapshot. Re-run with --yes after confirming post-update data loss.");
@@ -25614,16 +26868,23 @@ async function rollbackCommand(directory, flags) {
   if (manifest2.appVersion !== point.appVersion || manifest2.image !== point.image || manifest2.imageDigest !== point.imageDigest) {
     throw new Error(`Rollback point ${point.backupId} no longer matches its recorded image/version. Refusing to mutate the deployment.`);
   }
-  const backupEnv = parseEnv(await readText(join27(backupPath, "config.env")));
+  const backupEnv = parseEnv(await readText(join28(backupPath, "config.env")));
   if (backupEnv.OR3_VERSION !== manifest2.appVersion || backupEnv.OR3_IMAGE !== manifest2.image) {
     throw new Error(`Backup ${manifest2.backupId} configuration does not match its manifest.`);
   }
   assertBackupMatchesDeployment(manifest2, backupEnv, loaded.state, loaded.env);
+  assertSupportedBackupProfile(loaded.env);
+  await assertBackupSourceProfile(loaded.directory, loaded.state, loaded.env);
   const recreateDataVolume = restoreRequiresVolumeRecreation(loaded.env, backupEnv);
   await pullAndRequireImage(point.image, point.imageDigest, "Rollback");
   await assertSupportedHostArchitecture(point.image);
+  await assertExistingVaultCustody(loaded.directory, loaded.state, manifest2, backupPath, backupEnv);
   await assertRestoreFreeSpace(loaded.directory, loaded.state, loaded.env, manifest2, backupPath);
   await validateVolumeArchive(loaded.directory, loaded.state.mode, loaded.env, backupPath, backupEnv.OR3_STORAGE_FS_ROOT);
+  const remotePreflight = manifest2.schemaVersion === 2 ? await preflightRemoteRestore(loaded.directory, manifest2, loaded.env, backupPath) : undefined;
+  const remoteReconcile = remotePreflight && "uploaded" in remotePreflight ? remotePreflight : undefined;
+  if (remoteReconcile)
+    console.log(`S3 reconciliation added ${remoteReconcile.uploaded} objects and ${remoteReconcile.markersCreated} markers; added objects remain if rollback fails.`);
   const pending = {
     id: id("rollback"),
     operation: "rollback",
@@ -25637,6 +26898,7 @@ async function rollbackCommand(directory, flags) {
     targetImage: point.image,
     targetImageDigest: point.imageDigest,
     recreateDataVolume,
+    remoteReconcile,
     phase: "prepared"
   };
   await markPending(loaded.directory, loaded.state, pending);
@@ -25688,6 +26950,8 @@ async function rollbackCommand(directory, flags) {
       throw new Error(recoveredMessage);
     }
     try {
+      if (managedVaultEnabled(loaded.directory, loaded.env))
+        await assertVaultVolumesExist(loaded.directory, loaded.state);
       await startProject(loaded.directory, loaded.state.mode, loaded.env);
       loaded.state.lastError = `Rollback to ${point.appVersion} stopped before data replacement: ${original}`;
       await clearPending(loaded.directory, loaded.state);
@@ -25725,6 +26989,7 @@ async function statusCommand(directory, flags = {}) {
       identityMatches: observation.identityMatches,
       lastReceipt: state?.lastReceipt ?? null,
       backups: observation.backups,
+      recoveryPoint: latestFullSnapshot(observation.backups, observation.observedAt),
       findings
     }, null, 2));
     return;
@@ -25824,8 +27089,8 @@ ${result.stderr}`);
 }
 
 // src/commands/update.ts
-import { readFile as readFile4, statfs as statfs2 } from "node:fs/promises";
-import { join as join28, resolve as resolve14 } from "node:path";
+import { readFile as readFile6, statfs as statfs2 } from "node:fs/promises";
+import { join as join29, resolve as resolve15 } from "node:path";
 async function assessUpdate(directory, targetVersion, options = {}) {
   const checkDocker = options.checkDocker ?? false;
   const observation = await observeDeployment(directory, { checkDocker, checkImage: false });
@@ -25890,7 +27155,7 @@ async function assessUpdate(directory, targetVersion, options = {}) {
     for (const name of managedAssetNames(state?.mode ?? "local")) {
       let desired;
       try {
-        desired = await readFile4(join28(ASSET_ROOT, name));
+        desired = await readFile6(join29(ASSET_ROOT, name));
       } catch (error62) {
         findings.push({
           code: "managed-asset-unreadable",
@@ -25901,12 +27166,12 @@ async function assessUpdate(directory, targetVersion, options = {}) {
         continue;
       }
       try {
-        const installedPath = join28(directory, name);
+        const installedPath = join29(directory, name);
         if (!await fileExists(installedPath)) {
           changed.push(`${name} (add)`);
           continue;
         }
-        const installed = await readFile4(installedPath);
+        const installed = await readFile6(installedPath);
         if (!installed.equals(desired))
           changed.push(`${name} (update)`);
       } catch (error62) {
@@ -26013,6 +27278,8 @@ async function runUpdateCommand(directory, flags, asJson) {
       progress(`OR3 ${targetVersion} is already installed. Nothing to do.`);
     return;
   }
+  assertSupportedBackupProfile(env);
+  await assertBackupSourceProfile(loaded.directory, state, env);
   const preflight = await assessUpdate(loaded.directory, targetVersion, { underLease: true, checkDocker: true });
   const preflightBlockers = preflight.findings.filter((finding) => finding.severity === "blocker");
   if (preflightBlockers.length > 0) {
@@ -26114,7 +27381,8 @@ async function runUpdateCommand(directory, flags, asJson) {
         }
         await restoreBackupData(loaded.directory, state, oldEnv, backup.backupDir, {
           recreateDataVolume,
-          previousSafetySnapshot: true
+          previousSafetySnapshot: true,
+          remoteReferencePolicy: "warn"
         });
       } catch (restoreError) {
         throw new Error(`Update to ${targetVersion} failed, and automatic backup restoration also failed: ${restoreError instanceof Error ? restoreError.message : String(restoreError)}. Original update error: ${error62 instanceof Error ? error62.message : String(error62)}`);
@@ -26137,7 +27405,7 @@ async function runUpdateCommand(directory, flags, asJson) {
     const targetReadyEvidence = {
       checkedAt: now(),
       deploymentId: targetDeploymentId,
-      deploymentRoot: resolve14(loaded.directory),
+      deploymentRoot: resolve15(loaded.directory),
       containerId: targetChecks.containerId,
       imageDigest: digest,
       configurationSha256: await sha256File(deploymentPaths(loaded.directory).env),
@@ -26211,7 +27479,7 @@ async function runUpdateCommand(directory, flags, asJson) {
     state.image = targetImage;
     state.imageDigest = digest;
     state.deploymentId = targetDeploymentId;
-    state.deploymentRoot = resolve14(loaded.directory);
+    state.deploymentRoot = resolve15(loaded.directory);
     state.lastSuccessfulOperation = "update";
     state.lastError = undefined;
     let commit;
@@ -26257,7 +27525,7 @@ async function runUpdateCommand(directory, flags, asJson) {
 }
 
 // src/commands/verify.ts
-import { join as join29, resolve as resolve15 } from "node:path";
+import { join as join30, resolve as resolve16 } from "node:path";
 async function verificationCredentials(directory, flags, env) {
   const passwordFile = stringFlag(flags, "verification-password-file");
   if (flags["verification-email"] !== undefined && !stringFlag(flags, "verification-email")) {
@@ -26269,7 +27537,7 @@ async function verificationCredentials(directory, flags, env) {
   const configuredEmail = stringFlag(flags, "verification-email")?.trim() || env.OR3_MANAGED_OWNER_EMAIL || env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
   let initialCredentials = {};
   if (!configuredEmail || !passwordFile && !env.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD) {
-    const initialCredentialsPath = join29(directory, ".or3-initial-credentials");
+    const initialCredentialsPath = join30(directory, ".or3-initial-credentials");
     if (await fileExists(initialCredentialsPath)) {
       initialCredentials = parseEnv(await readOwnerOnlyText(initialCredentialsPath, "The initial credentials file"));
     }
@@ -26278,7 +27546,7 @@ async function verificationCredentials(directory, flags, env) {
   if (!email3)
     throw new Error("A current owner email is required for verification.");
   validateEmail(email3);
-  const password = passwordFile ? (await readOwnerOnlyText(resolve15(passwordFile), "The verification password file")).trim() : env.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD || initialCredentials.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD;
+  const password = passwordFile ? (await readOwnerOnlyText(resolve16(passwordFile), "The verification password file")).trim() : env.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD || initialCredentials.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD;
   if (!password) {
     throw new Error("A current owner password is required. Pass --verification-password-file after changing the bootstrap password.");
   }
@@ -26389,11 +27657,134 @@ async function verifyReadOnlyCommand(directory, flags) {
   }
 }
 
+// src/commands/vault-key.ts
+import { spawn as spawn2 } from "node:child_process";
+import { createHash as createHash7, randomUUID as randomUUID6 } from "node:crypto";
+import { constants as constants2 } from "node:fs";
+import { open as open5, realpath as realpath3, stat as stat6 } from "node:fs/promises";
+import { basename as basename7, dirname as dirname8, isAbsolute as isAbsolute6, join as join31, sep as sep2 } from "node:path";
+async function vaultKeyCommand(directory, positionals, flags) {
+  if (positionals.length !== 1 || positionals[0] !== "export")
+    throw new Error("Use vault-key export --out <absolute-path>.");
+  const destination = requireStringFlag(flags, "out");
+  if (!isAbsolute6(destination))
+    throw new Error("Vault key destination must be an absolute path.");
+  const leaf = destination.split(sep2).at(-1);
+  if (!leaf || leaf === "." || leaf === "..")
+    throw new Error("Vault key destination must name a new file.");
+  const parent = await realpath3(dirname8(destination));
+  const parentInfo = await stat6(parent);
+  if (!parentInfo.isDirectory() || (parentInfo.mode & 511) !== 448 || typeof process.getuid === "function" && parentInfo.uid !== process.getuid()) {
+    throw new Error("Vault key destination parent must be an owner-only directory (0700).");
+  }
+  const target = join31(parent, basename7(destination));
+  const deployment = await realpath3(directory);
+  if (target === deployment || target.startsWith(`${deployment}${sep2}`))
+    throw new Error("Vault key destination must be outside the managed deployment directory.");
+  const file2 = await open5(target, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
+  let written = false;
+  const parts = [];
+  try {
+    await ensureDocker();
+    const loaded = await loadManaged(directory);
+    assertNoPending(loaded.state);
+    await requireImageDigest(loaded.state.image, loaded.state.imageDigest, "Current deployment");
+    const volume = `${loaded.state.volumeName}-vault-key`;
+    if (!(await run("docker", ["volume", "inspect", volume], directory)).ok)
+      throw new Error("Vault key custody is missing or cannot be inspected.");
+    const script = `const fs=require('node:fs');const p='/vault-key/master.key';const s=fs.lstatSync(p);if(!s.isFile()||s.isSymbolicLink()||s.uid!==1000||(s.mode&0o777)!==0o600||s.nlink!==1||s.size!==32)process.exit(1);process.stdout.write(fs.readFileSync(p));`;
+    const helperName = `or3-vault-key-export-${randomUUID6()}`;
+    const child = spawn2("docker", [
+      "run",
+      "--rm",
+      "--name",
+      helperName,
+      "--log-driver",
+      "none",
+      "--pull",
+      "never",
+      "--network",
+      "none",
+      "--read-only",
+      "--user",
+      "1000:65532",
+      "--security-opt",
+      "no-new-privileges:true",
+      "--cap-drop",
+      "ALL",
+      "--mount",
+      `type=volume,src=${volume},dst=/vault-key,readonly`,
+      "--entrypoint",
+      "/nodejs/bin/node",
+      imageAtDigest(loaded.state.image, loaded.state.imageDigest),
+      "-e",
+      script
+    ], { cwd: directory, stdio: ["ignore", "pipe", "ignore"] });
+    const timeout = setTimeout(() => child.kill("SIGKILL"), 120000);
+    const exited = new Promise((resolve17, reject) => {
+      child.once("error", reject);
+      child.once("close", resolve17);
+    });
+    let bytes = 0;
+    let helperFailure;
+    try {
+      for await (const chunk of child.stdout) {
+        const buffer = Buffer.from(chunk);
+        parts.push(buffer);
+        bytes += buffer.length;
+        if (bytes > 32) {
+          child.kill("SIGKILL");
+          throw new Error("Vault key export returned an invalid key.");
+        }
+      }
+      if (await exited !== 0 || bytes !== 32)
+        throw new Error("Vault key export could not read valid custody.");
+    } catch (error62) {
+      helperFailure = error62;
+    } finally {
+      clearTimeout(timeout);
+      if (child.exitCode === null && child.signalCode === null)
+        child.kill("SIGKILL");
+      await exited.catch(() => null);
+      const cleanup = await run("docker", ["rm", "--force", helperName], directory);
+      if (!cleanup.ok && !/No such container/i.test(cleanup.stderr)) {
+        throw new AggregateError(helperFailure ? [helperFailure] : [], "Vault key helper cleanup failed; inspect the named helper before retrying.");
+      }
+    }
+    if (helperFailure)
+      throw helperFailure;
+    const key = Buffer.concat(parts, bytes);
+    try {
+      await file2.writeFile(key);
+      await file2.chmod(384);
+      await file2.sync();
+      const parentHandle = await open5(parent, "r");
+      try {
+        await parentHandle.sync();
+      } finally {
+        await parentHandle.close();
+      }
+      written = true;
+      console.log(`Exported vault master key to ${target} (SHA-256 ${createHash7("sha256").update(key).digest("hex")}). Protect it separately from the backup.`);
+    } finally {
+      key.fill(0);
+    }
+  } finally {
+    for (const part of parts)
+      part.fill(0);
+    await file2.close();
+    if (!written) {
+      console.error(`Vault key export did not complete; inspect the owner-only destination ${target} before retrying.`);
+    }
+  }
+}
+
 // src/cli/dispatch.ts
 var MUTATING_COMMANDS = new Set([
   "init",
   "update",
   "backup",
+  "vault-key",
   "verify",
   "restore",
   "rollback",
@@ -26407,10 +27798,10 @@ var MUTATING_COMMANDS = new Set([
 ]);
 function mutationDirectory(command, positionals, flags) {
   if (command === "init")
-    return resolve16(process.cwd(), positionals[0] ?? "or3-cloud");
+    return resolve17(process.cwd(), positionals[0] ?? "or3-cloud");
   if (command === "adopt") {
     const sourceDirectory = requireStringFlag(flags, "from");
-    return resolve16(process.cwd(), positionals[0] ?? `${basename7(sourceDirectory)}-managed`);
+    return resolve17(process.cwd(), positionals[0] ?? `${basename8(sourceDirectory)}-managed`);
   }
   return process.cwd();
 }
@@ -26428,6 +27819,8 @@ async function dispatchCommand(command, parsed) {
   }
   if (command === "backup")
     return await backupCommand(process.cwd(), parsed.positionals, parsed.flags);
+  if (command === "vault-key")
+    return await vaultKeyCommand(process.cwd(), parsed.positionals, parsed.flags);
   if (command === "restore")
     return await restoreCommand(process.cwd(), parsed.flags, parsed.positionals);
   if (command === "rollback")
@@ -26469,6 +27862,7 @@ Usage:
   npx @or3/cloud init [directory] --public --domain <hostname>
   npx @or3/cloud update [--to <exact-version>] [--dry-run] [--json]
   npx @or3/cloud backup [list [--json]|prune [--keep <n>]|export <backup-id> <destination-dir>]
+  npx @or3/cloud vault-key export --out <absolute-path>
   npx @or3/cloud restore <backup-id-or-path> --yes
   npx @or3/cloud rollback --yes
   npx @or3/cloud credentials reset --yes [--owner-password-file <path> --admin-password-file <path>]
@@ -26491,6 +27885,7 @@ Options:
   --verification-password-file <path>  Read the current owner password for this verification
   --port <port>                  Local OR3 port (default: 3000)
   --keep <n>                     Backups to retain when pruning (default: 5)
+  --out <absolute-path>          New owner-only vault-key export destination
   --force                        Bypass suspect-entry deferral; protected recovery backups remain protected
   --tail <n>                     Log lines to show (default: 200)
   --public                       Require verification through the public HTTPS origin
@@ -26499,7 +27894,7 @@ Options:
   --finish                       Commit a proven completed replacement without restoring data
   --restore                      Explicitly restore the recorded snapshot (requires --yes)
   --json                         Emit one machine-readable result object on stdout
-  --purge-data                   Remove data volumes and managed files (with remove)
+  --purge-data                   Currently disabled pending export reconstruction support
   --yes                          Confirm a destructive restore, rollback, credentials reset, or purge
   --help                         Show this help
   --version                      Show the Cloud package version
@@ -26510,11 +27905,11 @@ The installer never changes firewall, DNS, Cloudflare, or Tailscale settings.`);
 
 // src/commands/recover-restart.ts
 import { request } from "node:http";
-import { join as join30 } from "node:path";
+import { join as join32 } from "node:path";
 async function recoverRestart(directory, flags) {
   let journal;
   try {
-    journal = await readRestartJournal(join30(directory, ".or3-cloud", "restarts", "restarts.json"));
+    journal = await readRestartJournal(join32(directory, ".or3-cloud", "restarts", "restarts.json"));
   } catch (error62) {
     if (error62.code === "ENOENT")
       return false;
@@ -26537,9 +27932,9 @@ async function recoverRestart(directory, flags) {
   if (!boolFlag(flags, "finish") || boolFlag(flags, "restore"))
     throw new Error("The restart is unresolved. Inspect recover --dry-run, then use recover --finish to reconcile it. Data restoration is not a restart recovery action.");
   const value = JSON.stringify({ requestId: operation.requestId });
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const req = request({
-      socketPath: join30(deploymentPaths(directory).operatorIpc, "operator.sock"),
+      socketPath: join32(deploymentPaths(directory).operatorIpc, "operator.sock"),
       path: "/lifecycle/v1/reconcile",
       method: "POST",
       headers: { "content-type": "application/json", "content-length": Buffer.byteLength(value) }
@@ -26554,7 +27949,7 @@ async function recoverRestart(directory, flags) {
       response.on("end", () => {
         clearTimeout(timer);
         if (response.statusCode === 200)
-          resolve17();
+          resolve18();
         else
           reject(new Error("Restart recovery is unverified. Keep the receipt and inspect app/operator diagnostics; no additional restart was executed."));
       });
@@ -26605,7 +28000,7 @@ async function assertDeploymentFolder(command, directory = process.cwd()) {
     return;
   throw new Error("No OR3 Cloud deployment here. Run this from the folder that init created (usually ./or3-cloud).");
 }
-var invokedAsCli = process.argv[1] ? ["or3", "cli.mjs"].includes(basename8(process.argv[1])) : false;
-if (invokedAsCli || process.argv[1] && resolve17(process.argv[1]) === resolve17(fileURLToPath2(import.meta.url))) {
+var invokedAsCli = process.argv[1] ? ["or3", "cli.mjs"].includes(basename9(process.argv[1])) : false;
+if (invokedAsCli || process.argv[1] && resolve18(process.argv[1]) === resolve18(fileURLToPath2(import.meta.url))) {
   await main();
 }