@or3/cloud 0.1.112 → 0.1.116

package/dist/cli.mjs

@@ -133,7 +133,7 @@ import { basename as basename8, resolve as resolve17 } from "node:path";
 
 // src/commands/adopt.ts
 import { chmod as chmod5, mkdir as mkdir5 } from "node:fs/promises";
-import { basename as basename3, join as join16, resolve as resolve7 } from "node:path";
+import { basename as basename3, join as join17, resolve as resolve7 } from "node:path";
 
 // src/backup/archive.ts
 import { createReadStream as createReadStream3 } from "node:fs";
@@ -194,7 +194,7 @@ import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_ROOT = resolve(fileURLToPath(new URL("../", import.meta.url)));
-var PACKAGE_VERSION = "0.1.112";
+var PACKAGE_VERSION = "0.1.116";
 var IMAGE_REPOSITORY = "ghcr.io/saluana/or3-chat";
 var ASSET_ROOT = resolve(fileURLToPath(new URL("../assets/", import.meta.url)));
 var SHA256_DIGEST = /^sha256:[0-9a-f]{64}$/;
@@ -1866,12 +1866,12 @@ END {
 }
 
 // src/backup/manifests.ts
-import { createHash as createHash3, createHmac, randomBytes as randomBytes5, timingSafeEqual } from "node:crypto";
+import { createHmac, randomBytes as randomBytes5, timingSafeEqual } from "node:crypto";
 import { lstat as lstat3, readdir as readdir2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join12, resolve as resolve4 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join14, resolve as resolve4 } from "node:path";
 
 // src/deployment/assets.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash2, randomBytes as randomBytes4 } from "node:crypto";
 import { chmod as chmod3, copyFile as copyFile2, mkdir as mkdir3, readFile as readFile2, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join8 } from "node:path";
 var MANAGED_ASSET_INVENTORY_VERSION = 4;
@@ -1998,11 +1998,12 @@ async function verifiedManagedAssetContents(backupPath, manifest2) {
       throw new Error(`Backup ${manifest2.backupId} has an invalid checksum for managed asset ${name}.`);
     }
     const source = join8(backupPath, "managed-assets", name);
-    const actualSha = await sha256File(source);
+    const contents = await readFile2(source);
+    const actualSha = createHash2("sha256").update(contents).digest("hex");
     if (actualSha !== expectedSha) {
       throw new Error(`Backup managed asset checksum mismatch for ${name}. Expected ${expectedSha}, got ${actualSha}.`);
     }
-    assets.set(name, await readFile2(source));
+    assets.set(name, contents);
   }
   return assets;
 }
@@ -2405,10 +2406,236 @@ async function captureRemoteSnapshot(directory, state, env, backupDir) {
 }
 
 // src/backup/vault.ts
-import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
 import { constants } from "node:fs";
-import { lstat as lstat2, open as open2, readFile as readFile4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join as join11 } from "node:path";
+import { lstat as lstat2, open as open2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join13 } from "node:path";
+
+// src/runtime/project.ts
+import { readFileSync as readFileSync5 } from "node:fs";
+import { join as join11 } from "node:path";
+
+// src/runtime/health.ts
+var DEEP_HEALTH_TIMEOUT_MS = 180000;
+var HEALTH_SCRIPT = "const fs=require('node:fs');try{const auth=process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth',storage=process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs',sync=process.env.OR3_SYNC_PROVIDER||'sqlite';if(sync!=='sqlite'||!(auth==='basic-auth'&&storage==='fs'||auth==='clerk'&&storage==='s3')||process.env.AUTH_PROVIDER&&process.env.OR3_AUTH_PROVIDER&&process.env.AUTH_PROVIDER!==process.env.OR3_AUTH_PROVIDER)throw Error('profile');fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);const paths=auth==='basic-auth'?[process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH]:[process.env.OR3_SQLITE_DB_PATH];if(paths.some(p=>!p))throw Error('database path');for(const path of paths){const fd=fs.openSync(path,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));if(!response.ok||body.status!=='ok'||body.providers?.auth?.provider!==(process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth')||body.providers?.sync?.provider!=='sqlite'||body.providers?.storage?.provider!==(process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs'))process.exit(1)}).catch(()=>process.exit(1))";
+var VERIFY_DATABASES_SCRIPT = `
+const fs = require('node:fs');
+const Database = require('/app/.output/server/node_modules/better-sqlite3');
+const results = [];
+const auth = process.env.AUTH_PROVIDER || process.env.OR3_AUTH_PROVIDER || 'basic-auth';
+const storage = process.env.NUXT_PUBLIC_STORAGE_PROVIDER || 'fs', sync = process.env.OR3_SYNC_PROVIDER || 'sqlite';
+if (sync !== 'sqlite' || !(auth === 'basic-auth' && storage === 'fs' || auth === 'clerk' && storage === 's3') || process.env.AUTH_PROVIDER && process.env.OR3_AUTH_PROVIDER && process.env.AUTH_PROVIDER !== process.env.OR3_AUTH_PROVIDER) throw new Error('Unsupported auth profile');
+const paths = auth === 'basic-auth' ? [process.env.OR3_BASIC_AUTH_DB_PATH, process.env.OR3_SQLITE_DB_PATH] : [process.env.OR3_SQLITE_DB_PATH];
+if (paths.some(path => !path)) throw new Error('Missing managed database path');
+for (const path of paths) {
+  const info = fs.statSync(path);
+  if (info.uid !== 65532 || info.gid !== 65532) throw new Error(path + ' must be owned by 65532:65532');
+  const db = new Database(path, { readonly: true, fileMustExist: true });
+  const quickCheck = db.pragma('quick_check', { simple: true });
+  const tables = db.prepare("select count(*) as count from sqlite_master where type = 'table'").get().count;
+  db.close();
+  if (quickCheck !== 'ok') throw new Error(path + ' quick_check failed: ' + quickCheck);
+  results.push({ path, quickCheck, tables });
+}
+if (process.env.OR3_FORCE_HTTPS === 'true' && process.env.NUXT_SECURITY_PROXY_TRUST_PROXY !== 'true') {
+  throw new Error('NUXT_SECURITY_PROXY_TRUST_PROXY must be true for a managed public deployment');
+}
+console.log(JSON.stringify(results));
+`;
+var CONTAINER_NODE = "/nodejs/bin/node";
+var LEGACY_CONTAINER_NODE = "/usr/local/bin/node";
+var CONTAINER_NODE_SHELL = `if [ -x ${CONTAINER_NODE} ]; then exec ${CONTAINER_NODE} -e "$1"; elif [ -x ${LEGACY_CONTAINER_NODE} ]; then exec ${LEGACY_CONTAINER_NODE} -e "$1"; else exit 127; fi`;
+function containerNodeCommand(script) {
+  return ["sh", "-c", CONTAINER_NODE_SHELL, "or3-node", script];
+}
+async function waitForDeepHealthWithArgs(composeCommand, directory, secrets = []) {
+  const startedAt = Date.now();
+  const deadline = startedAt + DEEP_HEALTH_TIMEOUT_MS;
+  let lastError = "health check did not complete";
+  let lastProgressAt = startedAt;
+  while (Date.now() < deadline) {
+    const result = await run("docker", [
+      ...composeCommand,
+      "exec",
+      "-T",
+      "or3",
+      ...containerNodeCommand(HEALTH_SCRIPT)
+    ], directory);
+    if (result.ok)
+      return;
+    lastError = redact(result.stderr, secrets);
+    if (Date.now() - lastProgressAt >= 15000) {
+      console.error(`Waiting for OR3 deep health (${Math.round((Date.now() - startedAt) / 1000)}s elapsed)…`);
+      lastProgressAt = Date.now();
+    }
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 1000));
+  }
+  throw new Error(`OR3 deep health did not pass within ${DEEP_HEALTH_TIMEOUT_MS / 1000} seconds. Last error: ${lastError}`);
+}
+async function waitForDeepHealth(directory, mode, secrets = []) {
+  try {
+    await waitForDeepHealthWithArgs(composeArgs(directory, mode), directory, secrets);
+  } catch (error) {
+    const captured = await captureComposeDiagnostics(directory, mode, secrets).catch((captureError) => redact(`Diagnostics capture failed: ${captureError instanceof Error ? captureError.message : String(captureError)}`, secrets));
+    throw new Error(`${error instanceof Error ? error.message : String(error)}
+Captured Docker diagnostics:
+${captured}
+Diagnostics: ${diagnostics(directory, mode)}`);
+  }
+}
+async function probeDeepHealth(directory, mode) {
+  const result = await run("docker", [...composeArgs(directory, mode, ["exec", "-T", "or3", ...containerNodeCommand(HEALTH_SCRIPT)])], directory);
+  if (result.ok)
+    return "ok";
+  const ps = await run("docker", [...composeArgs(directory, mode, ["ps", "-q", "or3"])], directory);
+  if (ps.ok && ps.stdout.trim())
+    return "degraded";
+  return "unreachable";
+}
+
+// src/runtime/project.ts
+function managedVaultEnabled(directory, env) {
+  const selected = env ?? parseEnv(readFileSync5(join11(directory, ".env"), "utf8"));
+  return selected.SSR_AUTH_ENABLED === "true" && (selected.NUXT_SECRETS_PROVIDER ?? "or3-secrets") === "or3-secrets" && readFileSync5(join11(directory, "compose.yaml"), "utf8").includes(`
+  or3-vault:
+`);
+}
+async function stopProject(directory, mode) {
+  await compose(directory, mode, ["stop", "or3", ...managedVaultEnabled(directory) ? ["or3-vault"] : []]);
+}
+async function projectServiceRunning(directory, mode) {
+  const result = await run("docker", composeArgs(directory, mode, ["ps", "--status", "running", "-q", "or3"]), directory);
+  if (!result.ok)
+    throw new Error(`Could not determine whether OR3 is running. ${result.stderr.trim()}`);
+  return Boolean(result.stdout.trim());
+}
+async function startProject(directory, mode, env) {
+  await assertSafeComposeBinding(directory, mode, env);
+  const services = process.env.OR3_DASHBOARD_UPDATE_JOB_ID ? ["or3"] : [];
+  await compose(directory, mode, ["up", "-d", "--wait", "--wait-timeout", "180", ...services], secretValues(env));
+  await waitForDeepHealth(directory, mode, secretValues(env));
+  await assertRunningAppImage(directory, mode, env.OR3_IMAGE);
+}
+
+// src/backup/config.ts
+import { createHash as createHash3 } from "node:crypto";
+import { readFile as readFile4 } from "node:fs/promises";
+import { join as join12 } from "node:path";
+async function readAuthenticatedBackupConfig(backupPath, manifest2) {
+  const bytes = await readFile4(join12(backupPath, "config.env"));
+  if (!manifest2.configSha256 || createHash3("sha256").update(bytes).digest("hex") !== manifest2.configSha256) {
+    throw new Error(`Backup configuration checksum mismatch for ${manifest2.backupId}.`);
+  }
+  const text = bytes.toString("utf8");
+  if (!Buffer.from(text, "utf8").equals(bytes))
+    throw new Error("Backup configuration has invalid UTF-8.");
+  return text;
+}
+function hasUnambiguousEnvSyntax(text, allowedKeys) {
+  const keys = new Set;
+  for (const source of text.split(/\r?\n/)) {
+    const line = source.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (!match || keys.has(match[1]) || allowedKeys && !allowedKeys.has(match[1]))
+      return false;
+    keys.add(match[1]);
+    const value = match[2];
+    if (!/^'(?:[^'\\\x00\r\n]|\\['\\])*'$/.test(value) && !/^[A-Za-z0-9._:@%+=/-]*$/.test(value))
+      return false;
+  }
+  return true;
+}
+
+// src/backup/vault.ts
+var LEGACY_IMAGE = "ghcr.io/saluana/or3-chat:0.1.90";
+var LEGACY_DIGEST = "sha256:d50b70d6522574798f1a3081894b5bf8fe9eca7aa5f183ad5a562de2e4f41c12";
+var LEGACY_ASSETS = {
+  "compose.yaml": "6f4bdb7901eb997710501ef46c4c837870a830b6b835ea7fcc9a2036f9e51fc8",
+  "compose.public.yaml": "08e7b9a6e64c6d7df526a8a1372815c153765b098cdffe3af9086dd19e00b0d1",
+  Caddyfile: "623bd4a05b89530cff6a88e33cb6bf0b98b0561de6dd734d2d5b187abc1c48dd",
+  "compose.operator.yaml": "36ff63bed54f11b8e46daadd2dab2c5fa4b2fadde1e3d6dbd9bf9f1c37e9de86",
+  "dashboard-operator.mjs": "47dd5d186f4e87edd962d45cdfc274fea4c95533d676e4eddf59bdc59bb51308",
+  "dashboard-lifecycle.mjs": "628b903e290786aca97ef94ef9c0452f396b10edb11f14e620500671981ffbd2"
+};
+var LEGACY_OPERATOR_IMAGE = "ghcr.io/saluana/or3-chat@sha256:7148fc08014a0a35c1bd211243c3cf7cecb4b25cce9ec0dac1ecd7e50a61121a";
+var LEGACY_ENV_KEYS = new Set([
+  "OR3_VERSION",
+  "OR3_IMAGE",
+  "OR3_DEPLOYMENT_ID",
+  "OR3_COMPOSE_PROJECT",
+  "OR3_VOLUME_NAME",
+  "OR3_CADDY_DATA_VOLUME",
+  "OR3_CADDY_CONFIG_VOLUME",
+  "OR3_PORT",
+  "SSR_AUTH_ENABLED",
+  "AUTH_PROVIDER",
+  "OR3_AUTH_PROVIDER",
+  "OR3_AUTH_REGISTRATION_MODE",
+  "OR3_AUTH_AUTO_PROVISION",
+  "OR3_GUEST_ACCESS_ENABLED",
+  "OR3_PLUGIN_ZIP_INSTALL_ENABLED",
+  "OR3_ADMIN_ALLOW_REBUILD",
+  "OR3_BASIC_AUTH_JWT_SECRET",
+  "OR3_BASIC_AUTH_REFRESH_SECRET",
+  "OR3_BASIC_AUTH_ACCESS_TTL_SECONDS",
+  "OR3_BASIC_AUTH_REFRESH_TTL_SECONDS",
+  "OR3_BASIC_AUTH_DB_PATH",
+  "OR3_BASIC_AUTH_BOOTSTRAP_EMAIL",
+  "OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD",
+  "OR3_MANAGED_OWNER_EMAIL",
+  "OR3_AUTH_INVITE_TOKEN_SECRET",
+  "OR3_SYNC_ENABLED",
+  "OR3_CLOUD_SYNC_ENABLED",
+  "OR3_SYNC_PROVIDER",
+  "OR3_SQLITE_DB_PATH",
+  "OR3_SQLITE_PRAGMA_JOURNAL_MODE",
+  "OR3_SQLITE_PRAGMA_SYNCHRONOUS",
+  "OR3_SQLITE_ALLOW_IN_MEMORY",
+  "OR3_SQLITE_STRICT",
+  "OR3_STORAGE_ENABLED",
+  "OR3_CLOUD_STORAGE_ENABLED",
+  "NUXT_PUBLIC_STORAGE_PROVIDER",
+  "OR3_STORAGE_FS_ROOT",
+  "OR3_STORAGE_FS_TOKEN_SECRET",
+  "OR3_STORAGE_FS_URL_TTL_SECONDS",
+  "OR3_ADMIN_USERNAME",
+  "OR3_ADMIN_PASSWORD",
+  "OR3_ADMIN_JWT_SECRET",
+  "OR3_ADMIN_JWT_EXPIRY",
+  "OR3_PUBLIC_DOMAIN",
+  "OR3_ALLOWED_ORIGINS",
+  "OR3_FORCE_HTTPS",
+  "OR3_TRUST_PROXY",
+  "OR3_FORWARDED_FOR_HEADER",
+  "OR3_DASHBOARD_UPDATES_ENABLED",
+  "OR3_OPERATOR_IMAGE",
+  "OR3_DEPLOYMENT_DIR",
+  "OR3_OPERATOR_UID",
+  "OR3_OPERATOR_GID",
+  "OR3_DOCKER_SOCKET",
+  "OR3_DOCKER_GID"
+]);
+var LEGACY_FIXED_PROFILE = {
+  SSR_AUTH_ENABLED: "true",
+  AUTH_PROVIDER: "basic-auth",
+  OR3_AUTH_PROVIDER: "basic-auth",
+  OR3_AUTH_REGISTRATION_MODE: "invite_only",
+  OR3_AUTH_AUTO_PROVISION: "false",
+  OR3_GUEST_ACCESS_ENABLED: "false",
+  OR3_PLUGIN_ZIP_INSTALL_ENABLED: "false",
+  OR3_ADMIN_ALLOW_REBUILD: "false",
+  OR3_BASIC_AUTH_DB_PATH: "/data/auth.sqlite",
+  OR3_SYNC_ENABLED: "true",
+  OR3_CLOUD_SYNC_ENABLED: "true",
+  OR3_SYNC_PROVIDER: "sqlite",
+  OR3_SQLITE_DB_PATH: "/data/sync.sqlite",
+  OR3_STORAGE_ENABLED: "true",
+  OR3_CLOUD_STORAGE_ENABLED: "true",
+  NUXT_PUBLIC_STORAGE_PROVIDER: "fs",
+  OR3_STORAGE_FS_ROOT: "/data/storage"
+};
 async function readAuthenticatedVaultId(path, expectedSha256) {
   if (!/^[a-f0-9]{64}$/.test(expectedSha256))
     throw new Error("Invalid vault backup checksum.");
@@ -2419,7 +2646,7 @@ async function readAuthenticatedVaultId(path, expectedSha256) {
     const pathInfo = await lstat2(path, { bigint: true });
     if (!before.isFile() || !pathInfo.isFile() || pathInfo.isSymbolicLink() || before.nlink !== 1n || before.size < 113n || before.size > BigInt(2 ** 30 + 112) || identity(before) !== identity(pathInfo))
       throw new Error("invalid vault backup");
-    const hash = createHash2("sha256"), buffer = Buffer.alloc(1024 * 1024), header = Buffer.alloc(96);
+    const hash = createHash4("sha256"), buffer = Buffer.alloc(1024 * 1024), header = Buffer.alloc(96);
     let offset = 0;
     while (offset < Number(before.size)) {
       const count = (await file.read(buffer, 0, Math.min(buffer.length, Number(before.size) - offset), offset)).bytesRead;
@@ -2442,22 +2669,31 @@ async function readAuthenticatedVaultId(path, expectedSha256) {
     await file.close();
   }
 }
-function backupHasVaultCoverage(manifest2, env, archivedConfig) {
+async function backupHasVaultCoverage(manifest2, archivedConfig, backupPath) {
+  if (!manifest2.configSha256 || createHash4("sha256").update(archivedConfig).digest("hex") !== manifest2.configSha256)
+    return false;
+  const env = parseEnv(archivedConfig);
   if (Object.keys(env).some((key) => /^(?:RUNTIME_CONFIG|NUXT_SECRETS|NITRO_ENV_(?:PREFIX|EXPANSION)|NITRO_SECRETS(?:_.*)?)$/.test(key)))
     return false;
   const provider = env.NUXT_SECRETS_PROVIDER;
-  if (provider === undefined && manifest2.appVersion === "0.1.90" && manifest2.image === "ghcr.io/saluana/or3-chat:0.1.90" && manifest2.imageDigest === "sha256:d50b70d6522574798f1a3081894b5bf8fe9eca7aa5f183ad5a562de2e4f41c12" && archivedConfig !== undefined && createHash2("sha256").update(archivedConfig).digest("hex") === manifest2.configSha256) {
-    const keys = new Set;
-    for (const line of archivedConfig.split(/\r?\n/)) {
-      const text = line.trim();
-      if (!text || text.startsWith("#"))
-        continue;
-      const match = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(text);
-      if (!match || keys.has(match[1]) || !/^(?:'[^'\r\n]*'|"[^"$\\\r\n]*"|[^'"$\\\s]*)$/.test(match[2]))
+  if (!manifest2.vaultSha256 && (!hasUnambiguousEnvSyntax(archivedConfig) || Object.keys(env).some((key) => /^(?:NUXT_SECRETS_(?!PROVIDER$)|OR3_MANAGED_VAULT(?:_|$)|NODE_|BUN_|LD_|DYLD_|PATH$)/.test(key))))
+    return false;
+  if (provider === undefined && manifest2.appVersion === "0.1.90" && manifest2.image === LEGACY_IMAGE && manifest2.imageDigest === LEGACY_DIGEST && !manifest2.vaultSha256) {
+    if (!["local", "public"].includes(manifest2.mode) || env.OR3_VERSION !== manifest2.appVersion || env.OR3_IMAGE !== manifest2.image || !hasUnambiguousEnvSyntax(archivedConfig, LEGACY_ENV_KEYS) || Object.entries(LEGACY_FIXED_PROFILE).some(([key, value]) => env[key] !== value) || env.OR3_FORCE_HTTPS !== (manifest2.mode === "public" ? "true" : "false") || env.OR3_TRUST_PROXY !== (manifest2.mode === "public" ? "true" : "false") || env.OR3_DASHBOARD_UPDATES_ENABLED !== undefined && !["true", "false"].includes(env.OR3_DASHBOARD_UPDATES_ENABLED))
+      return false;
+    const names = ["compose.yaml", ...manifest2.mode === "public" ? ["compose.public.yaml", "Caddyfile"] : []];
+    if (env.OR3_DASHBOARD_UPDATES_ENABLED === "true") {
+      if (env.OR3_OPERATOR_IMAGE !== LEGACY_OPERATOR_IMAGE)
         return false;
-      keys.add(match[1]);
+      names.push("compose.operator.yaml", "dashboard-operator.mjs", "dashboard-lifecycle.mjs");
     }
-    return !keys.has("NUXT_SECRETS_PROVIDER");
+    if (names.some((name) => manifest2.managedAssetSha256?.[name] !== LEGACY_ASSETS[name]))
+      return false;
+    const assets = await verifiedManagedAssetContents(backupPath, manifest2);
+    return names.every((name) => {
+      const bytes = assets?.get(name);
+      return bytes !== undefined && createHash4("sha256").update(bytes).digest("hex") === LEGACY_ASSETS[name];
+    });
   }
   return provider === "" || (provider === undefined || provider === "or3-secrets") && Boolean(manifest2.vaultSha256);
 }
@@ -2470,13 +2706,15 @@ async function assertVaultVolumesExist(directory, state) {
       throw new Error("Vault custody is missing or cannot be inspected. The operation is refused; preserve the encrypted backup and recover the vault key and volumes first.");
   }
 }
-async function assertExistingVaultCustody(directory, state, manifest2, backupPath, backupEnv) {
-  const archivedConfig = await readFile4(join11(backupPath, "config.env"), "utf8");
-  if (!backupHasVaultCoverage(manifest2, backupEnv, archivedConfig))
+async function assertExistingVaultCustody(directory, state, manifest2, backupPath, archivedConfig) {
+  if (!await backupHasVaultCoverage(manifest2, archivedConfig, backupPath))
     throw new Error("Backup lacks the vault archive required by its saved configuration. Preserve it and use a separately reviewed recovery procedure.");
-  if (!manifest2.vaultSha256)
+  if (!manifest2.vaultSha256) {
+    if (managedVaultEnabled(directory))
+      await assertVaultVolumesExist(directory, state);
     return;
-  const expectedVaultId = await readAuthenticatedVaultId(join11(backupPath, "vault.backup"), manifest2.vaultSha256);
+  }
+  const expectedVaultId = await readAuthenticatedVaultId(join13(backupPath, "vault.backup"), manifest2.vaultSha256);
   const dataVolume = `${state.volumeName}-vault-data`;
   const keyVolume = `${state.volumeName}-vault-key`;
   await assertVaultVolumesExist(directory, state);
@@ -2621,14 +2859,14 @@ function backupAuthenticationTag(key, manifestContents) {
 }
 async function writeBackupAuthentication(directory, backupPath, manifestContents) {
   const key = await backupAuthenticationKey(directory, true);
-  await writeSecure(join12(backupPath, "manifest.auth"), `${backupAuthenticationTag(key, manifestContents)}
+  await writeSecure(join14(backupPath, "manifest.auth"), `${backupAuthenticationTag(key, manifestContents)}
 `);
 }
 async function assertBackupAuthentication(directory, backupPath, manifestContents) {
   const key = await backupAuthenticationKey(directory);
   let provided;
   try {
-    const value = (await readText(join12(backupPath, "manifest.auth"))).trim();
+    const value = (await readText(join14(backupPath, "manifest.auth"))).trim();
     if (!/^[0-9a-f]{64}$/i.test(value))
       throw new Error("invalid authentication tag");
     provided = Buffer.from(value, "hex");
@@ -2657,7 +2895,7 @@ function classifyBackupError(error) {
   return { code: "backup-entry-invalid", message };
 }
 async function inspectBackupEntry(backupsRoot, entry, directory) {
-  const path = join12(backupsRoot, entry);
+  const path = join14(backupsRoot, entry);
   let info;
   try {
     info = await lstat3(path);
@@ -2689,7 +2927,7 @@ async function inspectBackupEntry(backupsRoot, entry, directory) {
     };
   }
   try {
-    await lstat3(join12(path, "manifest.auth"));
+    await lstat3(join14(path, "manifest.auth"));
   } catch (error) {
     if (error.code === "ENOENT") {
       return {
@@ -2702,7 +2940,7 @@ async function inspectBackupEntry(backupsRoot, entry, directory) {
     return { kind: "unreadable", entryName: entry, ...classifyBackupError(error) };
   }
   try {
-    const raw = JSON.parse(await readText(join12(path, "manifest.json")));
+    const raw = JSON.parse(await readText(join14(path, "manifest.json")));
     if (typeof raw.schemaVersion === "number" && raw.schemaVersion > 2) {
       return {
         kind: "unsupported",
@@ -2734,12 +2972,10 @@ async function inspectBackupEntry(backupsRoot, entry, directory) {
     }
     let bytes = 0;
     for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth", ...manifest2.vaultSha256 ? ["vault.backup"] : [], ...manifest2.schemaVersion === 2 ? [manifest2.remote.file] : []]) {
-      bytes += (await lstat3(join12(path, file))).size;
+      bytes += (await lstat3(join14(path, file))).size;
     }
-    const savedConfig = await readText(join12(path, "config.env"));
-    if (createHash3("sha256").update(savedConfig).digest("hex") !== manifest2.configSha256)
-      throw new Error(`Backup configuration changed during inventory for ${manifest2.backupId}.`);
-    const recoveryArtifactsComplete = Boolean(manifest2.managedAssetSha256) && backupHasVaultCoverage(manifest2, parseEnv(savedConfig), savedConfig);
+    const savedConfig = await readAuthenticatedBackupConfig(path, manifest2);
+    const recoveryArtifactsComplete = Boolean(manifest2.managedAssetSha256) && await backupHasVaultCoverage(manifest2, savedConfig, path);
     return {
       kind: "verified",
       backup: {
@@ -2849,7 +3085,7 @@ function assertBackupMatchesDeployment(manifest2, backupEnv, state, env) {
 }
 async function readManifest(backupPath, authenticatedForDirectory) {
   await lifecycleFaults.beforeArchiveRead?.();
-  const manifestContents = await readText(join12(backupPath, "manifest.json"));
+  const manifestContents = await readText(join14(backupPath, "manifest.json"));
   if (authenticatedForDirectory)
     await assertBackupAuthentication(authenticatedForDirectory, backupPath, manifestContents);
   const manifest2 = JSON.parse(manifestContents);
@@ -2857,15 +3093,10 @@ async function readManifest(backupPath, authenticatedForDirectory) {
   if (unvalidated.schemaVersion !== 1 && unvalidated.schemaVersion !== 2 || !BACKUP_ID_PATTERN.test(manifest2.backupId) || unvalidated.snapshotKind !== undefined && unvalidated.snapshotKind !== "full" && unvalidated.snapshotKind !== "safety" || !Number.isFinite(Date.parse(manifest2.createdAt)) || !isVersion(manifest2.appVersion) || !manifest2.image || !/^sha256:[0-9a-f]{64}$/i.test(manifest2.imageDigest) || !/^[0-9a-f]{64}$/i.test(manifest2.dataSha256) || !/^[0-9a-f]{64}$/i.test(manifest2.configSha256 ?? "") || manifest2.vaultSha256 !== undefined && !/^[0-9a-f]{64}$/i.test(manifest2.vaultSha256) || manifest2.dataBytes !== undefined && (!Number.isSafeInteger(manifest2.dataBytes) || manifest2.dataBytes < 0)) {
     throw new Error(`Invalid backup manifest at ${backupPath}.`);
   }
-  const actual = await sha256File(join12(backupPath, "data.tgz"));
+  const actual = await sha256File(join14(backupPath, "data.tgz"));
   if (actual !== manifest2.dataSha256)
     throw new Error(`Backup checksum mismatch for ${manifest2.backupId}. Expected ${manifest2.dataSha256}, got ${actual}.`);
-  if (manifest2.configSha256) {
-    const configActual = await sha256File(join12(backupPath, "config.env"));
-    if (configActual !== manifest2.configSha256)
-      throw new Error(`Backup configuration checksum mismatch for ${manifest2.backupId}.`);
-  }
-  const config = parseEnv(await readText(join12(backupPath, "config.env")));
+  const config = parseEnv(await readAuthenticatedBackupConfig(backupPath, manifest2));
   const storage = (config.NUXT_PUBLIC_STORAGE_PROVIDER ?? "").trim().toLowerCase();
   if (manifest2.schemaVersion === 1 && storage === "s3") {
     throw new Error(`Invalid backup manifest for ${manifest2.backupId}: schema-1 S3 snapshots do not contain recoverable remote objects.`);
@@ -2879,13 +3110,13 @@ async function readManifest(backupPath, authenticatedForDirectory) {
     if (!remote.source || remote.source.endpointOrigin !== source.endpointOrigin || remote.source.bucket !== source.bucket || remote.source.keyPrefix !== source.keyPrefix) {
       throw new Error(`Invalid backup manifest for ${manifest2.backupId}: S3 source differs from the authenticated configuration.`);
     }
-    const file = join12(backupPath, remote.file);
+    const file = join14(backupPath, remote.file);
     const info = await lstat3(file);
     if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size !== remote.bytes || await sha256File(file) !== remote.sha256) {
       throw new Error(`Backup remote checksum mismatch or size mismatch for ${manifest2.backupId}.`);
     }
   }
-  if (manifest2.vaultSha256 && await sha256File(join12(backupPath, "vault.backup")) !== manifest2.vaultSha256)
+  if (manifest2.vaultSha256 && await sha256File(join14(backupPath, "vault.backup")) !== manifest2.vaultSha256)
     throw new Error(`Vault backup checksum mismatch for ${manifest2.backupId}.`);
   await verifiedManagedAssetContents(backupPath, manifest2);
   return manifest2;
@@ -2895,7 +3126,7 @@ async function resolveBackup(directory, value) {
     throw new Error(`Backup ID "${value}" is invalid. Use an OR3-generated backup ID or an absolute external backup path.`);
   }
   const candidate = isAbsolute3(value) ? value : backupDirectory(directory, value);
-  if (!await fileExists(join12(candidate, "manifest.json")))
+  if (!await fileExists(join14(candidate, "manifest.json")))
     throw new Error(`Backup ${value} was not found in ${deploymentPaths(directory).backups}.`);
   return resolve4(candidate);
 }
@@ -2904,7 +3135,7 @@ async function recordedBackupPath(directory, pending) {
   const path = previous ? pending.previousBackupPath : pending.backupPath;
   const backupId = previous ? pending.previousBackupId : pending.backupId;
   const resolved = path ? resolve4(path) : backupId ? await resolveBackup(directory, backupId) : undefined;
-  if (!resolved || !await fileExists(join12(resolved, "manifest.json"))) {
+  if (!resolved || !await fileExists(join14(resolved, "manifest.json"))) {
     throw new Error(`The incomplete ${pending.operation} has no readable ${previous ? "pre-mutation" : "target"} backup source.`);
   }
   const manifest2 = await readManifest(resolved, directory);
@@ -3046,87 +3277,7 @@ async function maskedQuestion(question) {
 
 // src/deployment/adoption-source.ts
 import { existsSync as existsSync2 } from "node:fs";
-import { basename as basename2, join as join13 } from "node:path";
-
-// src/runtime/health.ts
-var DEEP_HEALTH_TIMEOUT_MS = 180000;
-var HEALTH_SCRIPT = "const fs=require('node:fs');try{const auth=process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth',storage=process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs',sync=process.env.OR3_SYNC_PROVIDER||'sqlite';if(sync!=='sqlite'||!(auth==='basic-auth'&&storage==='fs'||auth==='clerk'&&storage==='s3')||process.env.AUTH_PROVIDER&&process.env.OR3_AUTH_PROVIDER&&process.env.AUTH_PROVIDER!==process.env.OR3_AUTH_PROVIDER)throw Error('profile');fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);const paths=auth==='basic-auth'?[process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH]:[process.env.OR3_SQLITE_DB_PATH];if(paths.some(p=>!p))throw Error('database path');for(const path of paths){const fd=fs.openSync(path,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));if(!response.ok||body.status!=='ok'||body.providers?.auth?.provider!==(process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth')||body.providers?.sync?.provider!=='sqlite'||body.providers?.storage?.provider!==(process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs'))process.exit(1)}).catch(()=>process.exit(1))";
-var VERIFY_DATABASES_SCRIPT = `
-const fs = require('node:fs');
-const Database = require('/app/.output/server/node_modules/better-sqlite3');
-const results = [];
-const auth = process.env.AUTH_PROVIDER || process.env.OR3_AUTH_PROVIDER || 'basic-auth';
-const storage = process.env.NUXT_PUBLIC_STORAGE_PROVIDER || 'fs', sync = process.env.OR3_SYNC_PROVIDER || 'sqlite';
-if (sync !== 'sqlite' || !(auth === 'basic-auth' && storage === 'fs' || auth === 'clerk' && storage === 's3') || process.env.AUTH_PROVIDER && process.env.OR3_AUTH_PROVIDER && process.env.AUTH_PROVIDER !== process.env.OR3_AUTH_PROVIDER) throw new Error('Unsupported auth profile');
-const paths = auth === 'basic-auth' ? [process.env.OR3_BASIC_AUTH_DB_PATH, process.env.OR3_SQLITE_DB_PATH] : [process.env.OR3_SQLITE_DB_PATH];
-if (paths.some(path => !path)) throw new Error('Missing managed database path');
-for (const path of paths) {
-  const info = fs.statSync(path);
-  if (info.uid !== 65532 || info.gid !== 65532) throw new Error(path + ' must be owned by 65532:65532');
-  const db = new Database(path, { readonly: true, fileMustExist: true });
-  const quickCheck = db.pragma('quick_check', { simple: true });
-  const tables = db.prepare("select count(*) as count from sqlite_master where type = 'table'").get().count;
-  db.close();
-  if (quickCheck !== 'ok') throw new Error(path + ' quick_check failed: ' + quickCheck);
-  results.push({ path, quickCheck, tables });
-}
-if (process.env.OR3_FORCE_HTTPS === 'true' && process.env.NUXT_SECURITY_PROXY_TRUST_PROXY !== 'true') {
-  throw new Error('NUXT_SECURITY_PROXY_TRUST_PROXY must be true for a managed public deployment');
-}
-console.log(JSON.stringify(results));
-`;
-var CONTAINER_NODE = "/nodejs/bin/node";
-var LEGACY_CONTAINER_NODE = "/usr/local/bin/node";
-var CONTAINER_NODE_SHELL = `if [ -x ${CONTAINER_NODE} ]; then exec ${CONTAINER_NODE} -e "$1"; elif [ -x ${LEGACY_CONTAINER_NODE} ]; then exec ${LEGACY_CONTAINER_NODE} -e "$1"; else exit 127; fi`;
-function containerNodeCommand(script) {
-  return ["sh", "-c", CONTAINER_NODE_SHELL, "or3-node", script];
-}
-async function waitForDeepHealthWithArgs(composeCommand, directory, secrets = []) {
-  const startedAt = Date.now();
-  const deadline = startedAt + DEEP_HEALTH_TIMEOUT_MS;
-  let lastError = "health check did not complete";
-  let lastProgressAt = startedAt;
-  while (Date.now() < deadline) {
-    const result = await run("docker", [
-      ...composeCommand,
-      "exec",
-      "-T",
-      "or3",
-      ...containerNodeCommand(HEALTH_SCRIPT)
-    ], directory);
-    if (result.ok)
-      return;
-    lastError = redact(result.stderr, secrets);
-    if (Date.now() - lastProgressAt >= 15000) {
-      console.error(`Waiting for OR3 deep health (${Math.round((Date.now() - startedAt) / 1000)}s elapsed)…`);
-      lastProgressAt = Date.now();
-    }
-    await new Promise((resolvePromise) => setTimeout(resolvePromise, 1000));
-  }
-  throw new Error(`OR3 deep health did not pass within ${DEEP_HEALTH_TIMEOUT_MS / 1000} seconds. Last error: ${lastError}`);
-}
-async function waitForDeepHealth(directory, mode, secrets = []) {
-  try {
-    await waitForDeepHealthWithArgs(composeArgs(directory, mode), directory, secrets);
-  } catch (error) {
-    const captured = await captureComposeDiagnostics(directory, mode, secrets).catch((captureError) => redact(`Diagnostics capture failed: ${captureError instanceof Error ? captureError.message : String(captureError)}`, secrets));
-    throw new Error(`${error instanceof Error ? error.message : String(error)}
-Captured Docker diagnostics:
-${captured}
-Diagnostics: ${diagnostics(directory, mode)}`);
-  }
-}
-async function probeDeepHealth(directory, mode) {
-  const result = await run("docker", [...composeArgs(directory, mode, ["exec", "-T", "or3", ...containerNodeCommand(HEALTH_SCRIPT)])], directory);
-  if (result.ok)
-    return "ok";
-  const ps = await run("docker", [...composeArgs(directory, mode, ["ps", "-q", "or3"])], directory);
-  if (ps.ok && ps.stdout.trim())
-    return "degraded";
-  return "unreachable";
-}
-
-// src/deployment/adoption-source.ts
+import { basename as basename2, join as join15 } from "node:path";
 async function sourceServiceRunning(directory, composeFiles) {
   const result = await run("docker", [...sourceComposeArgs(directory, composeFiles), "ps", "--status", "running", "-q", "or3"], directory);
   if (!result.ok)
@@ -3236,9 +3387,9 @@ async function readSourceVolume(sourceDirectory) {
     "--project-directory",
     sourceDirectory,
     "--env-file",
-    join13(sourceDirectory, ".env"),
+    join15(sourceDirectory, ".env"),
     "-f",
-    join13(sourceDirectory, "compose.yaml"),
+    join15(sourceDirectory, "compose.yaml"),
     "ps",
     "-aq",
     "or3"
@@ -3259,7 +3410,7 @@ async function readSourceVolume(sourceDirectory) {
 }
 function sourceMode(sourceDirectory, sourceEnv) {
   const publicDeployment = sourceEnv.OR3_PUBLIC_DOMAIN && sourceEnv.OR3_PUBLIC_DOMAIN !== "localhost" && sourceEnv.OR3_FORCE_HTTPS !== "false";
-  return publicDeployment && existsSync2(join13(sourceDirectory, "compose.public.yaml")) ? "public" : "local";
+  return publicDeployment && existsSync2(join15(sourceDirectory, "compose.public.yaml")) ? "public" : "local";
 }
 function sourceComposeArgs(sourceDirectory, sourceComposeFiles) {
   return [
@@ -3267,7 +3418,7 @@ function sourceComposeArgs(sourceDirectory, sourceComposeFiles) {
     "--project-directory",
     sourceDirectory,
     "--env-file",
-    join13(sourceDirectory, ".env"),
+    join15(sourceDirectory, ".env"),
     ...sourceComposeFiles
   ];
 }
@@ -3414,7 +3565,7 @@ function assertSupportedSourceCompose(configText, sourceVolume, expectedPort, so
 // src/runtime/dashboard-operator.ts
 import { randomBytes as randomBytes6 } from "node:crypto";
 import { chmod as chmod4, mkdir as mkdir4, rm as rm5, stat as stat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute4, join as join14, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join16, resolve as resolve6 } from "node:path";
 
 // src/runtime/images.ts
 async function pullImage(image, expectedDigest2) {
@@ -3679,7 +3830,7 @@ function dashboardOperatorHandoffArgs(directory, env, jobId) {
     "--entrypoint",
     "/usr/local/bin/node",
     env.OR3_OPERATOR_IMAGE,
-    join14(directory, "dashboard-operator.mjs"),
+    join16(directory, "dashboard-operator.mjs"),
     "--complete-handoff",
     jobId,
     project
@@ -3763,34 +3914,8 @@ async function checkPublicPrerequisites(domain) {
   return address;
 }
 
-// src/runtime/project.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import { join as join15 } from "node:path";
-function managedVaultEnabled(directory, env) {
-  const selected = env ?? parseEnv(readFileSync5(join15(directory, ".env"), "utf8"));
-  return selected.SSR_AUTH_ENABLED === "true" && (selected.NUXT_SECRETS_PROVIDER ?? "or3-secrets") === "or3-secrets" && readFileSync5(join15(directory, "compose.yaml"), "utf8").includes(`
-  or3-vault:
-`);
-}
-async function stopProject(directory, mode) {
-  await compose(directory, mode, ["stop", "or3", ...managedVaultEnabled(directory) ? ["or3-vault"] : []]);
-}
-async function projectServiceRunning(directory, mode) {
-  const result = await run("docker", composeArgs(directory, mode, ["ps", "--status", "running", "-q", "or3"]), directory);
-  if (!result.ok)
-    throw new Error(`Could not determine whether OR3 is running. ${result.stderr.trim()}`);
-  return Boolean(result.stdout.trim());
-}
-async function startProject(directory, mode, env) {
-  await assertSafeComposeBinding(directory, mode, env);
-  const services = process.env.OR3_DASHBOARD_UPDATE_JOB_ID ? ["or3"] : [];
-  await compose(directory, mode, ["up", "-d", "--wait", "--wait-timeout", "180", ...services], secretValues(env));
-  await waitForDeepHealth(directory, mode, secretValues(env));
-  await assertRunningAppImage(directory, mode, env.OR3_IMAGE);
-}
-
 // src/runtime/verification.ts
-import { createHash as createHash4, randomBytes as randomBytes7, randomUUID as randomUUID4 } from "node:crypto";
+import { createHash as createHash5, randomBytes as randomBytes7, randomUUID as randomUUID4 } from "node:crypto";
 function validateVerificationHealth(value, profile = "basic-sqlite-fs") {
   const health = value;
   if (!health || health.status !== "ok" || health.providers?.auth?.provider !== (profile === "basic-sqlite-fs" ? "basic-auth" : "clerk") || health.providers.sync?.provider !== "sqlite" || health.providers.storage?.provider !== (profile === "basic-sqlite-fs" ? "fs" : "s3")) {
@@ -3889,7 +4014,7 @@ async function verifyPublicApplication(baseUrl, credentials) {
       Buffer.from("89504e470d0a1a0a0000000d49484452000000010000000108060000001f15c489", "hex"),
       randomBytes7(8)
     ]);
-    const hash = `sha256:${createHash4("sha256").update(probeBytes).digest("hex")}`;
+    const hash = `sha256:${createHash5("sha256").update(probeBytes).digest("hex")}`;
     let storageId;
     let metadataAttempted = false;
     let physicalCleanupDeferred = false;
@@ -4081,31 +4206,31 @@ async function adoptCommand(positionals, flags) {
   if (targetDirectory === sourceDirectory)
     throw new Error("Choose a separate target directory for adoption.");
   await readDirectoryEmpty(targetDirectory);
-  if (!await fileExists(join16(sourceDirectory, "or3-release.json")))
+  if (!await fileExists(join17(sourceDirectory, "or3-release.json")))
     throw new Error(`V1 release metadata is missing at ${sourceDirectory}/or3-release.json.`);
-  const release = JSON.parse(await readText(join16(sourceDirectory, "or3-release.json")));
+  const release = JSON.parse(await readText(join17(sourceDirectory, "or3-release.json")));
   if (!release.or3Version || !isVersion(release.or3Version))
     throw new Error("V1 release metadata does not contain a usable OR3 version.");
   if (release.or3Version !== PACKAGE_VERSION) {
     throw new Error(`V1 is on OR3 ${release.or3Version}, but this CLI ships managed assets for ${PACKAGE_VERSION}. Run the matching @or3/cloud version or perform a qualified host CLI update before adoption.`);
   }
-  const sourceEnv = parseEnv(await readText(join16(sourceDirectory, ".env")));
-  const providers = await readText(join16(sourceDirectory, "or3.providers.generated.ts"));
+  const sourceEnv = parseEnv(await readText(join17(sourceDirectory, ".env")));
+  const providers = await readText(join17(sourceDirectory, "or3.providers.generated.ts"));
   assertSupportedSource(sourceDirectory, sourceEnv, providers);
   const mode = sourceMode(sourceDirectory, sourceEnv);
   const domain = mode === "public" ? sourceEnv.OR3_PUBLIC_DOMAIN : undefined;
   if (domain)
     await checkPublicPrerequisites(domain);
-  const sourceComposeFiles = ["-f", join16(sourceDirectory, "compose.yaml")];
+  const sourceComposeFiles = ["-f", join17(sourceDirectory, "compose.yaml")];
   if (mode === "public")
-    sourceComposeFiles.push("-f", join16(sourceDirectory, "compose.public.yaml"));
+    sourceComposeFiles.push("-f", join17(sourceDirectory, "compose.public.yaml"));
   await ensureDocker();
   const sourceConfig = await run("docker", [
     "compose",
     "--project-directory",
     sourceDirectory,
     "--env-file",
-    join16(sourceDirectory, ".env"),
+    join17(sourceDirectory, ".env"),
     ...sourceComposeFiles,
     "config",
     "--format",
@@ -4193,7 +4318,7 @@ ${existing.stderr}`)) {
     OR3_GUEST_ACCESS_ENABLED: "false"
   });
   await writeSecure(deploymentPaths(targetDirectory).env, serializeEnv(targetEnv));
-  await writeSecure(join16(targetDirectory, ".or3-initial-credentials"), serializeInitialCredentials({
+  await writeSecure(join17(targetDirectory, ".or3-initial-credentials"), serializeInitialCredentials({
     bootstrapEmail: email,
     bootstrapPassword: password,
     adminUsername: targetEnv.OR3_ADMIN_USERNAME,
@@ -4230,7 +4355,7 @@ ${existing.stderr}`)) {
       }
     }
     await mkdir5(sourceBackupDir, { recursive: true, mode: 448 });
-    await copySecure(join16(sourceDirectory, ".env"), join16(sourceBackupDir, "config.env"));
+    await copySecure(join17(sourceDirectory, ".env"), join17(sourceBackupDir, "config.env"));
     await archiveExternalVolume(sourceImage, sourceVolume, sourceBackupDir);
     const sourceManifest = {
       schemaVersion: 1,
@@ -4239,8 +4364,8 @@ ${existing.stderr}`)) {
       appVersion: release.or3Version,
       image,
       imageDigest: digest,
-      dataSha256: await sha256File(join16(sourceBackupDir, "data.tgz")),
-      configSha256: await sha256File(join16(sourceBackupDir, "config.env")),
+      dataSha256: await sha256File(join17(sourceBackupDir, "data.tgz")),
+      configSha256: await sha256File(join17(sourceBackupDir, "config.env")),
       mode,
       domain,
       composeProject: sourceEnv.OR3_COMPOSE_PROJECT ?? sanitizeName(basename3(sourceDirectory)),
@@ -4251,7 +4376,7 @@ ${existing.stderr}`)) {
     };
     const sourceManifestContents = `${JSON.stringify(sourceManifest, null, 2)}
 `;
-    await writeSecure(join16(sourceBackupDir, "manifest.json"), sourceManifestContents);
+    await writeSecure(join17(sourceBackupDir, "manifest.json"), sourceManifestContents);
     await writeBackupAuthentication(targetDirectory, sourceBackupDir, sourceManifestContents);
     await readManifest(sourceBackupDir, targetDirectory);
     await updatePending(targetDirectory, state, { phase: "snapshot-created" });
@@ -4291,10 +4416,10 @@ ${recoveryDetail}Managed files remain at ${targetDirectory}.${sourceBackupDir ?
 
 // src/backup/create.ts
 import { chmod as chmod6, lstat as lstat4, mkdir as mkdir6 } from "node:fs/promises";
-import { join as join19, resolve as resolve10 } from "node:path";
+import { join as join20, resolve as resolve10 } from "node:path";
 
 // src/backup/references.ts
-import { join as join17, resolve as resolve8 } from "node:path";
+import { join as join18, resolve as resolve8 } from "node:path";
 var INSPECTOR3 = "/app/scripts/docker/backup-inspect.mjs";
 var NODE3 = 'if [ -x /nodejs/bin/node ]; then exec /nodejs/bin/node "$@"; else exec node "$@"; fi';
 function assertBackupOperatorMount(directory, enabled, composeMounts, actualMounts) {
@@ -4564,7 +4689,7 @@ async function assertBackupSourceProfile(directory, state, env) {
 async function validateCanonicalBackupReferences(directory, env, backupPath) {
   assertSupportedBackupProfile(env);
   await withBackupHelper(directory, env.OR3_IMAGE, env, { network: "none" }, async (helper) => {
-    await helper.loadSqlite(join17(backupPath, "data.tgz"));
+    await helper.loadSqlite(join18(backupPath, "data.tgz"));
     const result = JSON.parse(await helper.exec(["sh", "-c", NODE3, "or3-backup-inspection", INSPECTOR3, "references", env.OR3_STORAGE_FS_ROOT ?? "/data/storage"]));
     if (result.contract !== 1 || result.complete !== true || !Number.isSafeInteger(result.liveAttachments) || result.liveAttachments < 0)
       throw new Error("Offline canonical backup reference inspection did not complete.");
@@ -4573,7 +4698,7 @@ async function validateCanonicalBackupReferences(directory, env, backupPath) {
 
 // src/backup/retention.ts
 import { rm as rm6 } from "node:fs/promises";
-import { basename as basename4, dirname as dirname4, join as join18, resolve as resolve9 } from "node:path";
+import { basename as basename4, dirname as dirname4, join as join19, resolve as resolve9 } from "node:path";
 var BACKUP_RETENTION_KEEP = 5;
 function assertRemovableArtifactName(name) {
   if (!BACKUP_ID_PATTERN.test(name)) {
@@ -4589,7 +4714,7 @@ async function removeNamedBackupArtifact(directory, backupId) {
     throw new Error(`Refusing to remove a path outside the backups directory: ${target}.`);
   }
   await rm6(target, { recursive: true, force: true });
-  await rm6(join18(deploymentPaths(directory).exports, `${backupId}.json`), { force: true });
+  await rm6(join19(deploymentPaths(directory).exports, `${backupId}.json`), { force: true });
 }
 async function removeEnumeratedBackupArtifact(directory, backup) {
   await lifecycleFaults.beforeArtifactDelete?.();
@@ -4599,7 +4724,7 @@ async function removeEnumeratedBackupArtifact(directory, backup) {
     throw new Error(`Refusing to prune an untrusted backup path ${backup.path}.`);
   }
   await rm6(target, { recursive: true, force: true });
-  await rm6(join18(deploymentPaths(directory).exports, `${backup.backupId}.json`), { force: true });
+  await rm6(join19(deploymentPaths(directory).exports, `${backup.backupId}.json`), { force: true });
 }
 function planRetention(entries, keep, protectedIds, options = {}) {
   if (!Number.isInteger(keep) || keep < 1)
@@ -4710,7 +4835,7 @@ async function cleanupPartialBackup(directory, backupId) {
   }
   const statuses = await Promise.all([
     artifactStatus(backupDirectory(directory, backupId)),
-    artifactStatus(join19(deploymentPaths(directory).exports, `${backupId}.json`))
+    artifactStatus(join20(deploymentPaths(directory).exports, `${backupId}.json`))
   ]);
   const removed = statuses.every((status) => status.absent);
   const detail = statuses.map((status) => status.detail).join(" ");
@@ -4780,9 +4905,9 @@ async function createBackup(directory, state, env, options = {}) {
         "or3-vault",
         "/app/vault/entrypoint.mjs",
         "backup"
-      ]), join19(backupDir, "vault.backup"), directory, secretValues(env));
+      ]), join20(backupDir, "vault.backup"), directory, secretValues(env));
     }
-    await copySecure(deploymentPaths(directory).env, join19(backupDir, "config.env"));
+    await copySecure(deploymentPaths(directory).env, join20(backupDir, "config.env"));
     managedAssetSha256 = await snapshotManagedAssets(directory, state.mode, backupDir);
     artifact = "captured";
   } catch (error) {
@@ -4827,10 +4952,10 @@ async function createBackup(directory, state, env, options = {}) {
         appVersion: state.appVersion,
         image: state.image,
         imageDigest: state.imageDigest,
-        dataSha256: await sha256File(join19(backupDir, "data.tgz")),
-        ...managedVaultEnabled(directory, env) ? { vaultSha256: await sha256File(join19(backupDir, "vault.backup")) } : {},
+        dataSha256: await sha256File(join20(backupDir, "data.tgz")),
+        ...managedVaultEnabled(directory, env) ? { vaultSha256: await sha256File(join20(backupDir, "vault.backup")) } : {},
         dataBytes: volumeSize,
-        configSha256: await sha256File(join19(backupDir, "config.env")),
+        configSha256: await sha256File(join20(backupDir, "config.env")),
         managedAssetSha256,
         managedAssetInventoryVersion: managedAssetSha256?.["dashboard-lifecycle.mjs"] ? MANAGED_ASSET_INVENTORY_VERSION : managedAssetSha256?.["compose.operator.yaml"] ? 3 : managedAssetSha256?.["dashboard-operator.mjs"] ? 2 : undefined,
         mode: state.mode,
@@ -4844,7 +4969,7 @@ async function createBackup(directory, state, env, options = {}) {
       };
       const manifestContents = `${JSON.stringify(manifest2, null, 2)}
 `;
-      await writeSecure(join19(backupDir, "manifest.json"), manifestContents);
+      await writeSecure(join20(backupDir, "manifest.json"), manifestContents);
       await writeBackupAuthentication(directory, backupDir, manifestContents);
       verifiedManifest = await readManifest(backupDir, directory);
       artifact = "verified";
@@ -4899,7 +5024,7 @@ async function inspectUnclaimedBackupArtifacts(directory, backupId, backupPath)
     return;
   const statuses = await Promise.all([
     artifactStatus(expectedPath),
-    artifactStatus(join19(deploymentPaths(directory).exports, `${backupId}.json`))
+    artifactStatus(join20(deploymentPaths(directory).exports, `${backupId}.json`))
   ]);
   const detail = statuses.map((status) => status.detail).join(" ");
   return statuses.every((status) => status.absent) ? detail : `Maintenance warning: backup artifact ownership was not recorded. ${detail} This recovery did not verify or remove these paths. Inspect them with "npx @or3/cloud backup list".`;
@@ -4926,7 +5051,7 @@ async function createPreMutationSnapshot(directory, state, env, backupId) {
 
 // src/backup/export.ts
 import { chmod as chmod7, mkdir as mkdir7, realpath as realpath2, rm as rm7, stat as stat4 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname5, isAbsolute as isAbsolute5, join as join20, resolve as resolve11, sep } from "node:path";
+import { basename as basename5, dirname as dirname5, isAbsolute as isAbsolute5, join as join21, resolve as resolve11, sep } from "node:path";
 var PURGE_REQUIRES_BACKUP_WITHIN_MS = 24 * 60 * 60 * 1000;
 async function exportBackup(directory, backupId, destination) {
   const backupPath = await resolveBackup(directory, backupId);
@@ -4942,7 +5067,7 @@ async function exportBackup(directory, backupId, destination) {
   if (await fileExists(dest))
     throw new Error(`Destination ${dest} already exists. Choose a new empty destination so an export can never merge with unrelated files.`);
   await mkdir7(dirname5(dest), { recursive: true, mode: 448 });
-  const canonicalDestination = join20(await realpath2(dirname5(dest)), basename5(dest));
+  const canonicalDestination = join21(await realpath2(dirname5(dest)), basename5(dest));
   if (canonicalDestination === deploymentRoot || canonicalDestination.startsWith(`${deploymentRoot}${sep}`)) {
     throw new Error("Backup exports must live outside the managed deployment directory so `remove --purge-data` can never delete the remaining copy.");
   }
@@ -4953,19 +5078,19 @@ async function exportBackup(directory, backupId, destination) {
     }
     await chmod7(dest, 448);
     for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth", ...manifest2.vaultSha256 ? ["vault.backup"] : [], ...manifest2.schemaVersion === 2 ? [manifest2.remote.file] : []]) {
-      await copySecure(join20(backupPath, file), join20(dest, file));
+      await copySecure(join21(backupPath, file), join21(dest, file));
     }
     if (manifest2.managedAssetSha256) {
       for (const name of managedAssetNamesForInventory(manifest2.mode, manifest2.managedAssetInventoryVersion)) {
-        await copySecure(join20(backupPath, "managed-assets", name), join20(dest, "managed-assets", name));
+        await copySecure(join21(backupPath, "managed-assets", name), join21(dest, "managed-assets", name));
       }
     }
-    const dataSha = await sha256File(join20(dest, "data.tgz"));
+    const dataSha = await sha256File(join21(dest, "data.tgz"));
     if (dataSha !== manifest2.dataSha256) {
       throw new Error(`Exported data.tgz checksum mismatch for ${manifest2.backupId}. Expected ${manifest2.dataSha256}, got ${dataSha}.`);
     }
     if (manifest2.configSha256) {
-      const configSha = await sha256File(join20(dest, "config.env"));
+      const configSha = await sha256File(join21(dest, "config.env"));
       if (configSha !== manifest2.configSha256) {
         throw new Error(`Exported config.env checksum mismatch for ${manifest2.backupId}.`);
       }
@@ -4982,14 +5107,14 @@ async function exportBackup(directory, backupId, destination) {
       dataSha256: manifest2.dataSha256,
       configSha256: manifest2.configSha256
     };
-    await writeSecure(join20(deploymentPaths(directory).exports, `${manifest2.backupId}.json`), `${JSON.stringify(receipt, null, 2)}
+    await writeSecure(join21(deploymentPaths(directory).exports, `${manifest2.backupId}.json`), `${JSON.stringify(receipt, null, 2)}
 `);
-    let bytes = (manifest2.vaultSha256 ? (await stat4(join20(dest, "vault.backup"))).size : 0) + (await stat4(join20(dest, "data.tgz"))).size + (await stat4(join20(dest, "config.env"))).size + (await stat4(join20(dest, "manifest.json"))).size + (await stat4(join20(dest, "manifest.auth"))).size;
+    let bytes = (manifest2.vaultSha256 ? (await stat4(join21(dest, "vault.backup"))).size : 0) + (await stat4(join21(dest, "data.tgz"))).size + (await stat4(join21(dest, "config.env"))).size + (await stat4(join21(dest, "manifest.json"))).size + (await stat4(join21(dest, "manifest.auth"))).size;
     if (manifest2.schemaVersion === 2)
-      bytes += (await stat4(join20(dest, manifest2.remote.file))).size;
+      bytes += (await stat4(join21(dest, manifest2.remote.file))).size;
     if (manifest2.managedAssetSha256) {
       for (const name of managedAssetNamesForInventory(manifest2.mode, manifest2.managedAssetInventoryVersion)) {
-        bytes += (await stat4(join20(dest, "managed-assets", name))).size;
+        bytes += (await stat4(join21(dest, "managed-assets", name))).size;
       }
     }
     console.log(`Exported backup ${manifest2.backupId} (${bytes} bytes) to ${dest}`);
@@ -5191,7 +5316,7 @@ async function backupCommand(directory, positionals, flags) {
 
 // src/credentials/reset.ts
 import { rm as rm8 } from "node:fs/promises";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 
 // src/credentials/reset-script.ts
 function buildCredentialsResetScript(input2) {
@@ -5387,7 +5512,7 @@ async function applyCredentialReset(directory, state, nextEnv) {
   await runCredentialsResetScript(directory, state.mode, values);
   const runtimeEnv = withoutProvisioningCredentials(nextEnv);
   await writeSecure(deploymentPaths(directory).env, serializeEnv(runtimeEnv));
-  const initialCredentials = join21(directory, ".or3-initial-credentials");
+  const initialCredentials = join22(directory, ".or3-initial-credentials");
   await rm8(initialCredentials, { force: true });
   await stopProject(directory, state.mode);
   if (managedVaultEnabled(directory, runtimeEnv))
@@ -5455,7 +5580,7 @@ async function credentialsCommand(directory, positionals, flags) {
 // src/commands/doctor.ts
 import { existsSync as existsSync3 } from "node:fs";
 import { stat as stat5 } from "node:fs/promises";
-import { basename as basename6, join as join22, resolve as resolve12 } from "node:path";
+import { basename as basename6, join as join23, resolve as resolve12 } from "node:path";
 async function doctorCommand(directory) {
   const resolved = resolve12(directory);
   const paths = deploymentPaths(resolved);
@@ -5480,7 +5605,7 @@ async function doctorCommand(directory) {
     failures.push(error instanceof Error ? error.message : String(error));
     console.log("✗ Managed state or .env is missing/invalid");
   }
-  for (const file of [paths.env, paths.state, join22(resolved, ".or3-initial-credentials")]) {
+  for (const file of [paths.env, paths.state, join23(resolved, ".or3-initial-credentials")]) {
     if (!existsSync3(file))
       continue;
     const mode = (await stat5(file)).mode & 511;
@@ -5552,7 +5677,7 @@ async function doctorCommand(directory) {
           }
           assertDashboardOperatorMounts(container.Mounts ?? [], resolved);
           const ipcDirectory = await stat5(paths.operatorIpc);
-          const operatorSocket = await stat5(join22(paths.operatorIpc, "operator.sock"));
+          const operatorSocket = await stat5(join23(paths.operatorIpc, "operator.sock"));
           const operatorUid = Number(env.OR3_OPERATOR_UID);
           const operatorGid = Number(env.OR3_OPERATOR_GID);
           if ((ipcDirectory.mode & 511) !== 456 || ipcDirectory.uid !== operatorUid || ipcDirectory.gid !== operatorGid || !operatorSocket.isSocket() || (operatorSocket.mode & 511) !== 432 || operatorSocket.uid !== operatorUid || operatorSocket.gid !== operatorGid) {
@@ -5611,7 +5736,7 @@ async function doctorCommand(directory) {
 
 // src/commands/init.ts
 import { chmod as chmod8, mkdir as mkdir8 } from "node:fs/promises";
-import { join as join23, relative, resolve as resolve13 } from "node:path";
+import { join as join24, relative, resolve as resolve13 } from "node:path";
 async function initCommand(positionals, flags) {
   const hasLocal = boolFlag(flags, "local");
   const hasPublic = boolFlag(flags, "public");
@@ -5619,7 +5744,7 @@ async function initCommand(positionals, flags) {
     throw new Error("Choose exactly one of --local or --public.");
   const mode = hasPublic ? "public" : "local";
   const directory = resolve13(process.cwd(), positionals[0] ?? "or3-cloud");
-  if (await fileExists(join23(directory, ".or3-cloud", "state.json"))) {
+  if (await fileExists(join24(directory, ".or3-cloud", "state.json"))) {
     throw new Error(`${directory} is already a managed deployment. Use update, doctor, or adopt.`);
   }
   await readDirectoryEmpty(directory);
@@ -5670,7 +5795,7 @@ ${existing.stderr}`)) {
   await copyAssets(directory, mode);
   const env = buildEnv({ mode, version, directory, image, email, password, domain, port, dashboardOperator: operator });
   await writeSecure(deploymentPaths(directory).env, serializeEnv(env));
-  await writeSecure(join23(directory, ".or3-initial-credentials"), serializeInitialCredentials({
+  await writeSecure(join24(directory, ".or3-initial-credentials"), serializeInitialCredentials({
     bootstrapEmail: email,
     bootstrapPassword: password,
     adminUsername: email,
@@ -5695,7 +5820,7 @@ ${existing.stderr}`)) {
     const folder = relative(process.cwd(), directory) || ".";
     console.log(`
 OR3 Cloud ${version} is running at ${url}`);
-    console.log(`Sign in as ${email} with the password in ${join23(folder, ".or3-initial-credentials")}; the same login opens ${url}/admin.`);
+    console.log(`Sign in as ${email} with the password in ${join24(folder, ".or3-initial-credentials")}; the same login opens ${url}/admin.`);
     console.log("Save it in a password manager, then delete that file.");
     console.log(`
 Run later commands from the deployment folder: cd ${quote(folder)} && npx @or3/cloud doctor`);
@@ -5754,7 +5879,7 @@ async function restartCommand(directory, lifecycle) {
 }
 
 // src/backup/restore.ts
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 
 // src/backup/generation-restore.ts
 function rebindRestoredGenerations(fs, path, crypto, db, root, options = {}) {
@@ -5950,14 +6075,14 @@ if (root !== '/data' && !root.startsWith('/data/')) throw new Error('Generation
   if (!result.ok)
     throw new Error(`Restored generation verification failed. ${redact(result.stderr, secretValues(env))}`);
 }
-function assertFilesystemPayloadHash(key, readChunk, createHash5) {
+function assertFilesystemPayloadHash(key, readChunk, createHash6) {
   const match = /^(sha256|md5)_([a-fA-F0-9]+)$/.exec(key);
   const algorithm = match?.[1];
   const expected = match?.[2];
   if (algorithm !== "sha256" && algorithm !== "md5" || expected?.length !== (algorithm === "sha256" ? 64 : 32)) {
     throw new Error("Invalid canonical filesystem payload key");
   }
-  const hash = createHash5(algorithm);
+  const hash = createHash6(algorithm);
   for (let chunk = readChunk();chunk !== undefined; chunk = readChunk())
     hash.update(chunk);
   if (hash.digest("hex") !== expected.toLowerCase())
@@ -6013,7 +6138,7 @@ if (storage === 'fs' && (storageRoot === '/data' || storageRoot.startsWith('/dat
 }
 `;
 async function assertRestoreFreeSpace(directory, state, env, manifest2, backupPath) {
-  const archiveBytes = await gzipUncompressedBytes(join24(backupPath, "data.tgz"));
+  const archiveBytes = await gzipUncompressedBytes(join25(backupPath, "data.tgz"));
   const requiredBytes = Math.max(manifest2.dataBytes ?? 0, archiveBytes);
   const freeBytes = await dataVolumeFreeBytes(directory, state.mode, env);
   const reclaimableBytes = await dataVolumeSize(directory, state.mode, env, "allocated");
@@ -6022,7 +6147,8 @@ async function assertRestoreFreeSpace(directory, state, env, manifest2, backupPa
 async function restoreBackupData(directory, state, env, backupPath, options = {}) {
   const manifest2 = await readManifest(backupPath, directory);
   assertRestorableManagedAssets(manifest2);
-  const backupEnv = parseEnv(await readText(join24(backupPath, "config.env")));
+  const backupConfig = await readAuthenticatedBackupConfig(backupPath, manifest2);
+  const backupEnv = parseEnv(backupConfig);
   if (backupEnv.OR3_VERSION !== manifest2.appVersion || backupEnv.OR3_IMAGE !== manifest2.image) {
     throw new Error(`Backup ${manifest2.backupId} configuration does not match its manifest.`);
   }
@@ -6034,7 +6160,7 @@ async function restoreBackupData(directory, state, env, backupPath, options = {}
   }
   if (manifest2.imageDigest)
     await requireImageDigest(manifest2.image, manifest2.imageDigest, `Backup ${manifest2.backupId}`);
-  await assertExistingVaultCustody(directory, state, manifest2, backupPath, backupEnv);
+  await assertExistingVaultCustody(directory, state, manifest2, backupPath, backupConfig);
   await validateVolumeArchive(directory, state.mode, env, backupPath, backupEnv.OR3_STORAGE_FS_ROOT);
   if (manifest2.schemaVersion === 2 && manifest2.remote.kind === "s3-copy-v1") {
     const result = await checkRemoteCopyTarget(directory, manifest2, env, backupPath, manifest2.remote);
@@ -6136,18 +6262,18 @@ async function restorePreMutationSnapshot(directory, state, env) {
 }
 
 // src/deployment/observation.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { resolve as resolve14 } from "node:path";
 
 // src/deployment/lease.ts
 import { randomBytes as randomBytes8 } from "node:crypto";
 import { mkdir as mkdir10, rename as rename3, rm as rm10 } from "node:fs/promises";
-import { dirname as dirname7, join as join26 } from "node:path";
+import { dirname as dirname7, join as join27 } from "node:path";
 
 // ../../shared/server/restarts/controller.ts
-import { randomUUID as randomUUID5, createHash as createHash5 } from "node:crypto";
+import { randomUUID as randomUUID5, createHash as createHash6 } from "node:crypto";
 import { mkdir as mkdir9, open as open4, readFile as readFile5, rename as rename2, rm as rm9 } from "node:fs/promises";
-import { dirname as dirname6, join as join25 } from "node:path";
+import { dirname as dirname6, join as join26 } from "node:path";
 
 // ../../node_modules/zod/v4/classic/external.js
 var exports_external = {};
@@ -25596,7 +25722,7 @@ var recordSchema = exports_external.object({
   expected: exports_external.record(exports_external.string(), exports_external.union([exports_external.string().max(128), exports_external.boolean()])),
   executionIntent: exports_external.boolean(),
   runtimeIdentity: exports_external.string().max(512).optional()
-}).strict().refine((record2) => record2.requestId === record2.request.requestId && record2.fingerprint === createHash5("sha256").update(JSON.stringify(record2.request)).digest("hex"), "Receipt identity mismatch");
+}).strict().refine((record2) => record2.requestId === record2.request.requestId && record2.fingerprint === createHash6("sha256").update(JSON.stringify(record2.request)).digest("hex"), "Receipt identity mismatch");
 
 class RestartError extends Error {
   code;
@@ -25660,7 +25786,7 @@ class RestartController {
   constructor(directory, driver) {
     this.directory = directory;
     this.driver = driver;
-    this.path = join25(directory, "restarts.json");
+    this.path = join26(directory, "restarts.json");
   }
   lock(action) {
     const next = this.serial.then(action, action);
@@ -25750,7 +25876,7 @@ class RestartController {
     if (!parsed.success)
       throw new RestartError("invalid_request", 400);
     const request = parsed.data;
-    const fingerprint = createHash5("sha256").update(JSON.stringify(request)).digest("hex");
+    const fingerprint = createHash6("sha256").update(JSON.stringify(request)).digest("hex");
     return this.lock(async () => {
       const old = this.operations.find((o2) => o2.requestId === request.requestId);
       if (old) {
@@ -25958,7 +26084,7 @@ class RestartController {
 var DASHBOARD_LEASE_STALE_MS = 30000;
 async function readLeaseOwner(leasePath) {
   try {
-    const owner = JSON.parse(await readText(join26(leasePath, "owner.json")));
+    const owner = JSON.parse(await readText(join27(leasePath, "owner.json")));
     if (owner.schemaVersion !== 1 || typeof owner.nonce !== "string" || typeof owner.command !== "string" || owner.origin !== "cli" && owner.origin !== "dashboard" || !Number.isSafeInteger(owner.pid) || typeof owner.acquiredAt !== "string" || typeof owner.heartbeatAt !== "string")
       return;
     return owner;
@@ -26017,7 +26143,7 @@ async function acquireDeploymentLease(directory, command, dashboardJobId) {
     }
   }
   try {
-    await writeSecure(join26(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
+    await writeSecure(join27(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
 `);
   } catch (error62) {
     await rm10(leasePath, { recursive: true, force: true }).catch(() => {
@@ -26027,7 +26153,7 @@ async function acquireDeploymentLease(directory, command, dashboardJobId) {
   }
   const heartbeat = setInterval(() => {
     owner.heartbeatAt = now();
-    writeSecure(join26(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
+    writeSecure(join27(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
 `).catch(() => {
       return;
     });
@@ -26052,7 +26178,7 @@ async function withDeploymentLease(directory, command, action) {
 }
 async function assertRestartJournalSettled(directory) {
   try {
-    const journal = await readRestartJournal(join26(directory, ".or3-cloud", "restarts", "restarts.json"));
+    const journal = await readRestartJournal(join27(directory, ".or3-cloud", "restarts", "restarts.json"));
     if (journal.operations.some((operation) => !["succeeded", "cancelled", "failed"].includes(operation.phase))) {
       throw new Error("A dashboard restart is unresolved. Run the compatible CLI recover --dry-run to inspect and recover --finish to reconcile it before another mutation.");
     }
@@ -26235,7 +26361,7 @@ function observationFindings(observation) {
   return findings;
 }
 function stateFingerprint(state) {
-  return createHash6("sha256").update(JSON.stringify({
+  return createHash7("sha256").update(JSON.stringify({
     schema: state.schemaVersion,
     appVersion: state.appVersion,
     image: state.image,
@@ -26738,7 +26864,6 @@ async function removeCommand(directory, flags) {
 }
 
 // src/commands/restore.ts
-import { join as join27 } from "node:path";
 async function restoreCommand(directory, flags, positionals) {
   if (!boolFlag(flags, "yes"))
     throw new Error("Restore replaces live data. Re-run with --yes after confirming the backup and data-loss boundary.");
@@ -26751,7 +26876,8 @@ async function restoreCommand(directory, flags, positionals) {
   const backupPath = await resolveBackup(loaded.directory, backupValue);
   const manifest2 = await readManifest(backupPath, loaded.directory);
   assertRestorableManagedAssets(manifest2);
-  const backupEnv = parseEnv(await readText(join27(backupPath, "config.env")));
+  const backupConfig = await readAuthenticatedBackupConfig(backupPath, manifest2);
+  const backupEnv = parseEnv(backupConfig);
   if (backupEnv.OR3_VERSION !== manifest2.appVersion || backupEnv.OR3_IMAGE !== manifest2.image) {
     throw new Error(`Backup ${manifest2.backupId} configuration does not match its manifest.`);
   }
@@ -26762,7 +26888,7 @@ async function restoreCommand(directory, flags, positionals) {
   if (manifest2.imageDigest)
     await pullAndRequireImage(manifest2.image, manifest2.imageDigest, `Backup ${manifest2.backupId}`);
   await assertSupportedHostArchitecture(manifest2.image);
-  await assertExistingVaultCustody(loaded.directory, loaded.state, manifest2, backupPath, backupEnv);
+  await assertExistingVaultCustody(loaded.directory, loaded.state, manifest2, backupPath, backupConfig);
   await assertRestoreFreeSpace(loaded.directory, loaded.state, loaded.env, manifest2, backupPath);
   await validateVolumeArchive(loaded.directory, loaded.state.mode, loaded.env, backupPath, backupEnv.OR3_STORAGE_FS_ROOT);
   const remotePreflight = manifest2.schemaVersion === 2 ? await preflightRemoteRestore(loaded.directory, manifest2, loaded.env, backupPath) : undefined;
@@ -26852,7 +26978,6 @@ async function restoreCommand(directory, flags, positionals) {
 }
 
 // src/commands/rollback.ts
-import { join as join28 } from "node:path";
 async function rollbackCommand(directory, flags) {
   if (!boolFlag(flags, "yes"))
     throw new Error("Rollback restores the previous image and data snapshot. Re-run with --yes after confirming post-update data loss.");
@@ -26868,7 +26993,8 @@ async function rollbackCommand(directory, flags) {
   if (manifest2.appVersion !== point.appVersion || manifest2.image !== point.image || manifest2.imageDigest !== point.imageDigest) {
     throw new Error(`Rollback point ${point.backupId} no longer matches its recorded image/version. Refusing to mutate the deployment.`);
   }
-  const backupEnv = parseEnv(await readText(join28(backupPath, "config.env")));
+  const backupConfig = await readAuthenticatedBackupConfig(backupPath, manifest2);
+  const backupEnv = parseEnv(backupConfig);
   if (backupEnv.OR3_VERSION !== manifest2.appVersion || backupEnv.OR3_IMAGE !== manifest2.image) {
     throw new Error(`Backup ${manifest2.backupId} configuration does not match its manifest.`);
   }
@@ -26878,7 +27004,7 @@ async function rollbackCommand(directory, flags) {
   const recreateDataVolume = restoreRequiresVolumeRecreation(loaded.env, backupEnv);
   await pullAndRequireImage(point.image, point.imageDigest, "Rollback");
   await assertSupportedHostArchitecture(point.image);
-  await assertExistingVaultCustody(loaded.directory, loaded.state, manifest2, backupPath, backupEnv);
+  await assertExistingVaultCustody(loaded.directory, loaded.state, manifest2, backupPath, backupConfig);
   await assertRestoreFreeSpace(loaded.directory, loaded.state, loaded.env, manifest2, backupPath);
   await validateVolumeArchive(loaded.directory, loaded.state.mode, loaded.env, backupPath, backupEnv.OR3_STORAGE_FS_ROOT);
   const remotePreflight = manifest2.schemaVersion === 2 ? await preflightRemoteRestore(loaded.directory, manifest2, loaded.env, backupPath) : undefined;
@@ -27090,7 +27216,7 @@ ${result.stderr}`);
 
 // src/commands/update.ts
 import { readFile as readFile6, statfs as statfs2 } from "node:fs/promises";
-import { join as join29, resolve as resolve15 } from "node:path";
+import { join as join28, resolve as resolve15 } from "node:path";
 async function assessUpdate(directory, targetVersion, options = {}) {
   const checkDocker = options.checkDocker ?? false;
   const observation = await observeDeployment(directory, { checkDocker, checkImage: false });
@@ -27155,7 +27281,7 @@ async function assessUpdate(directory, targetVersion, options = {}) {
     for (const name of managedAssetNames(state?.mode ?? "local")) {
       let desired;
       try {
-        desired = await readFile6(join29(ASSET_ROOT, name));
+        desired = await readFile6(join28(ASSET_ROOT, name));
       } catch (error62) {
         findings.push({
           code: "managed-asset-unreadable",
@@ -27166,7 +27292,7 @@ async function assessUpdate(directory, targetVersion, options = {}) {
         continue;
       }
       try {
-        const installedPath = join29(directory, name);
+        const installedPath = join28(directory, name);
         if (!await fileExists(installedPath)) {
           changed.push(`${name} (add)`);
           continue;
@@ -27525,7 +27651,7 @@ async function runUpdateCommand(directory, flags, asJson) {
 }
 
 // src/commands/verify.ts
-import { join as join30, resolve as resolve16 } from "node:path";
+import { join as join29, resolve as resolve16 } from "node:path";
 async function verificationCredentials(directory, flags, env) {
   const passwordFile = stringFlag(flags, "verification-password-file");
   if (flags["verification-email"] !== undefined && !stringFlag(flags, "verification-email")) {
@@ -27537,7 +27663,7 @@ async function verificationCredentials(directory, flags, env) {
   const configuredEmail = stringFlag(flags, "verification-email")?.trim() || env.OR3_MANAGED_OWNER_EMAIL || env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
   let initialCredentials = {};
   if (!configuredEmail || !passwordFile && !env.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD) {
-    const initialCredentialsPath = join30(directory, ".or3-initial-credentials");
+    const initialCredentialsPath = join29(directory, ".or3-initial-credentials");
     if (await fileExists(initialCredentialsPath)) {
       initialCredentials = parseEnv(await readOwnerOnlyText(initialCredentialsPath, "The initial credentials file"));
     }
@@ -27659,10 +27785,10 @@ async function verifyReadOnlyCommand(directory, flags) {
 
 // src/commands/vault-key.ts
 import { spawn as spawn2 } from "node:child_process";
-import { createHash as createHash7, randomUUID as randomUUID6 } from "node:crypto";
+import { createHash as createHash8, randomUUID as randomUUID6 } from "node:crypto";
 import { constants as constants2 } from "node:fs";
 import { open as open5, realpath as realpath3, stat as stat6 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname8, isAbsolute as isAbsolute6, join as join31, sep as sep2 } from "node:path";
+import { basename as basename7, dirname as dirname8, isAbsolute as isAbsolute6, join as join30, sep as sep2 } from "node:path";
 async function vaultKeyCommand(directory, positionals, flags) {
   if (positionals.length !== 1 || positionals[0] !== "export")
     throw new Error("Use vault-key export --out <absolute-path>.");
@@ -27677,7 +27803,7 @@ async function vaultKeyCommand(directory, positionals, flags) {
   if (!parentInfo.isDirectory() || (parentInfo.mode & 511) !== 448 || typeof process.getuid === "function" && parentInfo.uid !== process.getuid()) {
     throw new Error("Vault key destination parent must be an owner-only directory (0700).");
   }
-  const target = join31(parent, basename7(destination));
+  const target = join30(parent, basename7(destination));
   const deployment = await realpath3(directory);
   if (target === deployment || target.startsWith(`${deployment}${sep2}`))
     throw new Error("Vault key destination must be outside the managed deployment directory.");
@@ -27765,7 +27891,7 @@ async function vaultKeyCommand(directory, positionals, flags) {
         await parentHandle.close();
       }
       written = true;
-      console.log(`Exported vault master key to ${target} (SHA-256 ${createHash7("sha256").update(key).digest("hex")}). Protect it separately from the backup.`);
+      console.log(`Exported vault master key to ${target} (SHA-256 ${createHash8("sha256").update(key).digest("hex")}). Protect it separately from the backup.`);
     } finally {
       key.fill(0);
     }
@@ -27905,11 +28031,11 @@ The installer never changes firewall, DNS, Cloudflare, or Tailscale settings.`);
 
 // src/commands/recover-restart.ts
 import { request } from "node:http";
-import { join as join32 } from "node:path";
+import { join as join31 } from "node:path";
 async function recoverRestart(directory, flags) {
   let journal;
   try {
-    journal = await readRestartJournal(join32(directory, ".or3-cloud", "restarts", "restarts.json"));
+    journal = await readRestartJournal(join31(directory, ".or3-cloud", "restarts", "restarts.json"));
   } catch (error62) {
     if (error62.code === "ENOENT")
       return false;
@@ -27934,7 +28060,7 @@ async function recoverRestart(directory, flags) {
   const value = JSON.stringify({ requestId: operation.requestId });
   await new Promise((resolve18, reject) => {
     const req = request({
-      socketPath: join32(deploymentPaths(directory).operatorIpc, "operator.sock"),
+      socketPath: join31(deploymentPaths(directory).operatorIpc, "operator.sock"),
       path: "/lifecycle/v1/reconcile",
       method: "POST",
       headers: { "content-type": "application/json", "content-length": Buffer.byteLength(value) }