@or3/cloud 0.1.90 → 0.1.91

package/README.md

@@ -5,7 +5,7 @@ application repository or installing its dependencies on the host.
 
 ## Quick start: local machine
 
-You need Docker Engine with Docker Compose v2 and Node.js 20 or later.
+You need Docker Engine with Docker Compose v2 and Node.js 24.22.1 or later in the 24.x line.
 
 ```sh
 npx @or3/cloud init --local
@@ -26,6 +26,28 @@ Basic Auth + SQLite + filesystem storage. The CLI checks the image manifest,
 source/version labels, and then writes a digest-qualified image reference; it
 also verifies the image of the running container before committing state.
 
+## Default credential vault
+
+Authenticated managed deployments provision a separate `or3-vault` container
+from the same image, using private persistent data/master-key volumes and a
+shared local socket. The application receives only an expiring scoped token;
+it never mounts vault data, master keys or operator credentials. Setup refuses
+partial or lost custody instead of reinitializing. This supports one persistent
+Docker host; it does not provide serverless storage or multi-host replication.
+
+`NUXT_SECRETS_PROVIDER=` explicitly disables the vault for instance-billed-only
+operation; stop before changing this setting, then start to apply it. A restart
+alone retains the container environment. Cloud never falls back to browser credentials. Keep master-key
+recovery copies separate from application backups. Managed snapshots/exports
+include a checksummed encrypted `vault.backup`; application rollback preserves
+the live vault. Disaster recovery requires an explicit fresh-key vault restore
+and fresh service tokens. Preserve custody volumes during cleanup.
+
+See [Cloud credentials and recovery](../../public/_documentation/cloud/secret-store.md)
+for configuration, migration, plugin compatibility and outstanding production
+qualification requirements. Run `bun scripts/test/run-cloud-vault-e2e.ts` from
+the repository root for the disposable container custody/recovery drill.
+
 ## Run it publicly on a VPS
 
 Before starting, point a domain at the VPS and allow inbound TCP ports `80`
@@ -85,9 +107,9 @@ Until the one-time handoff file is deleted, `verify` may read its initial owner
 credential from that protected file; it is never restored to `.env` or Docker
 container metadata.
 Verification rejects cross-origin filesystem grants and unexpected methods or
-headers, validates the storage ID before uploading, tombstones its probe before
-requesting physical deletion, and revokes its temporary session even when a later
-check fails. When the provider explicitly requires deletion coordination,
+headers, validates the storage ID before uploading, commits the presigned upload
+intent, tombstones its probe before requesting physical deletion, and revokes
+its temporary session even when a later check fails. When the provider explicitly requires deletion coordination,
 verification reports physical cleanup as deferred; retained probe bytes remain
 subject to the provider retention policy. Other deletion failures still fail verification.
 

package/assets/compose.yaml

@@ -19,10 +19,21 @@ services:
       OR3_STORAGE_FS_ROOT: /data/storage
       OR3_EXTENSIONS_ROOT: /data/extensions
       OR3_ADMIN_DATA_DIR: /data/admin
+      NUXT_SECRETS_PROVIDER: "${NUXT_SECRETS_PROVIDER-or3-secrets}"
+      NUXT_SECRETS_SOCKET_PATH: /run/or3-secrets/api.sock
+      NUXT_SECRETS_TOKEN_FILE: /run/or3-secrets-client/service.token
+      NUXT_SECRETS_SERVICE_UID: "1000"
+      OR3_MANAGED_VAULT_CONFIG: /run/or3-secrets-client/config.json
     ports:
       - "127.0.0.1:${OR3_PORT}:3000"
     volumes:
       - or3-data:/data
+      - or3-vault-run:/run/or3-secrets:ro
+      - or3-vault-client:/run/or3-secrets-client:ro
+    depends_on:
+      or3-vault:
+        condition: service_healthy
+        required: false
     restart: unless-stopped
     # Leave enough time for Nuxt to close SSE responses and upstream provider
     # connections before Docker sends SIGKILL.
@@ -69,8 +80,51 @@ services:
       retries: 12
       start_period: 30s
 
+  or3-vault:
+    image: ${OR3_IMAGE}
+    profiles: [or3-vault]
+    labels:
+      io.or3.cloud.deployment-id: ${OR3_DEPLOYMENT_ID}
+    user: "0:0"
+    entrypoint: [/nodejs/bin/node, /app/vault/entrypoint.mjs]
+    environment:
+      OR3_VAULT_NAMESPACE: "${NUXT_SECRETS_NAMESPACE:-or3}"
+    network_mode: none
+    read_only: true
+    security_opt: [no-new-privileges:true]
+    cap_drop: [ALL]
+    # The confined supervisor provisions identities and atomically renews the
+    # app-owned token. Actual vault CLI/service processes run as UID 1000.
+    cap_add: [CHOWN, FOWNER, DAC_OVERRIDE, SETUID, SETGID]
+    tmpfs: [/tmp:size=16m]
+    volumes:
+      - or3-vault-data:/vault-data
+      - or3-vault-key:/vault-key
+      - or3-vault-run:/run/or3-secrets
+      - or3-vault-client:/run/or3-secrets-client
+    restart: unless-stopped
+    stop_grace_period: 25s
+    logging:
+      driver: json-file
+      options: { max-size: "10m", max-file: "3" }
+    healthcheck:
+      test: [CMD, /nodejs/bin/node, /app/vault/entrypoint.mjs, health]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      start_period: 20s
+
 volumes:
   or3-data:
     name: ${OR3_VOLUME_NAME}
     labels:
       io.or3.cloud.deployment-id: ${OR3_DEPLOYMENT_ID}
+
+  or3-vault-data:
+    name: ${OR3_VOLUME_NAME}-vault-data
+  or3-vault-key:
+    name: ${OR3_VOLUME_NAME}-vault-key
+  or3-vault-run:
+    name: ${OR3_VOLUME_NAME}-vault-run
+  or3-vault-client:
+    name: ${OR3_VOLUME_NAME}-vault-client

package/assets/dashboard-lifecycle.mjs

@@ -45,97 +45,21 @@ var __export = (target, all) => {
 };
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// ../../node_modules/dotenv/package.json
-var require_package = __commonJS((exports, module) => {
-  module.exports = {
-    name: "dotenv",
-    version: "17.2.3",
-    description: "Loads environment variables from .env file",
-    main: "lib/main.js",
-    types: "lib/main.d.ts",
-    exports: {
-      ".": {
-        types: "./lib/main.d.ts",
-        require: "./lib/main.js",
-        default: "./lib/main.js"
-      },
-      "./config": "./config.js",
-      "./config.js": "./config.js",
-      "./lib/env-options": "./lib/env-options.js",
-      "./lib/env-options.js": "./lib/env-options.js",
-      "./lib/cli-options": "./lib/cli-options.js",
-      "./lib/cli-options.js": "./lib/cli-options.js",
-      "./package.json": "./package.json"
-    },
-    scripts: {
-      "dts-check": "tsc --project tests/types/tsconfig.json",
-      lint: "standard",
-      pretest: "npm run lint && npm run dts-check",
-      test: "tap run tests/**/*.js --allow-empty-coverage --disable-coverage --timeout=60000",
-      "test:coverage": "tap run tests/**/*.js --show-full-coverage --timeout=60000 --coverage-report=text --coverage-report=lcov",
-      prerelease: "npm test",
-      release: "standard-version"
-    },
-    repository: {
-      type: "git",
-      url: "git://github.com/motdotla/dotenv.git"
-    },
-    homepage: "https://github.com/motdotla/dotenv#readme",
-    funding: "https://dotenvx.com",
-    keywords: [
-      "dotenv",
-      "env",
-      ".env",
-      "environment",
-      "variables",
-      "config",
-      "settings"
-    ],
-    readmeFilename: "README.md",
-    license: "BSD-2-Clause",
-    devDependencies: {
-      "@types/node": "^18.11.3",
-      decache: "^4.6.2",
-      sinon: "^14.0.1",
-      standard: "^17.0.0",
-      "standard-version": "^9.5.0",
-      tap: "^19.2.0",
-      typescript: "^4.8.4"
-    },
-    engines: {
-      node: ">=12"
-    },
-    browser: {
-      fs: false
-    }
-  };
-});
-
 // ../../node_modules/dotenv/lib/main.js
 var require_main = __commonJS((exports, module) => {
   var fs = __require("fs");
   var path = __require("path");
   var os = __require("os");
   var crypto = __require("crypto");
-  var packageJson = require_package();
-  var version = packageJson.version;
   var TIPS = [
-    "\uD83D\uDD10 encrypt with Dotenvx: https://dotenvx.com",
-    "\uD83D\uDD10 prevent committing .env to code: https://dotenvx.com/precommit",
-    "\uD83D\uDD10 prevent building .env in docker: https://dotenvx.com/prebuild",
-    "\uD83D\uDCE1 add observability to secrets: https://dotenvx.com/ops",
-    "\uD83D\uDC65 sync secrets across teammates & machines: https://dotenvx.com/ops",
-    "\uD83D\uDDC2️ backup and recover secrets: https://dotenvx.com/ops",
-    "✅ audit secrets and track compliance: https://dotenvx.com/ops",
-    "\uD83D\uDD04 add secrets lifecycle management: https://dotenvx.com/ops",
-    "\uD83D\uDD11 add access controls to secrets: https://dotenvx.com/ops",
-    "\uD83D\uDEE0️  run anywhere with `dotenvx run -- yourcommand`",
-    "⚙️  specify custom .env file path with { path: '/custom/path/.env' }",
-    "⚙️  enable debug logging with { debug: true }",
-    "⚙️  override existing env vars with { override: true }",
-    "⚙️  suppress all logs with { quiet: true }",
-    "⚙️  write to custom object with { processEnv: myObject }",
-    "⚙️  load multiple .env files with { path: ['.env.local', '.env'] }"
+    "◈ encrypted .env [www.dotenvx.com]",
+    "◈ secrets for agents [www.dotenvx.com]",
+    "⌁ auth for agents [www.vestauth.com]",
+    "⌘ custom filepath { path: '/custom/path/.env' }",
+    "⌘ enable debugging { debug: true }",
+    "⌘ override existing { override: true }",
+    "⌘ suppress logs { quiet: true }",
+    "⌘ multiple files { path: ['.env.local', '.env'] }"
   ];
   function _getRandomTip() {
     return TIPS[Math.floor(Math.random() * TIPS.length)];
@@ -202,13 +126,13 @@ var require_main = __commonJS((exports, module) => {
     return DotenvModule.parse(decrypted);
   }
   function _warn(message) {
-    console.error(`[dotenv@${version}][WARN] ${message}`);
+    console.error(`⚠ ${message}`);
   }
   function _debug(message) {
-    console.log(`[dotenv@${version}][DEBUG] ${message}`);
+    console.log(`┆ ${message}`);
   }
   function _log(message) {
-    console.log(`[dotenv@${version}] ${message}`);
+    console.log(`◇ ${message}`);
   }
   function _dotenvKey(options) {
     if (options && options.DOTENV_KEY && options.DOTENV_KEY.length > 0) {
@@ -279,7 +203,7 @@ var require_main = __commonJS((exports, module) => {
     const debug = parseBoolean(process.env.DOTENV_CONFIG_DEBUG || options && options.debug);
     const quiet = parseBoolean(process.env.DOTENV_CONFIG_QUIET || options && options.quiet);
     if (debug || !quiet) {
-      _log("Loading env from encrypted .env.vault");
+      _log("loading env from encrypted .env.vault");
     }
     const parsed = DotenvModule._parseVault(options);
     let processEnv = process.env;
@@ -302,7 +226,7 @@ var require_main = __commonJS((exports, module) => {
       encoding = options.encoding;
     } else {
       if (debug) {
-        _debug("No encoding is specified. UTF-8 is used by default");
+        _debug("no encoding is specified (UTF-8 is used by default)");
       }
     }
     let optionPaths = [dotenvPath];
@@ -324,7 +248,7 @@ var require_main = __commonJS((exports, module) => {
         DotenvModule.populate(parsedAll, parsed, options);
       } catch (e) {
         if (debug) {
-          _debug(`Failed to load ${path2} ${e.message}`);
+          _debug(`failed to load ${path2} ${e.message}`);
         }
         lastError = e;
       }
@@ -341,12 +265,12 @@ var require_main = __commonJS((exports, module) => {
           shortPaths.push(relative);
         } catch (e) {
           if (debug) {
-            _debug(`Failed to load ${filePath} ${e.message}`);
+            _debug(`failed to load ${filePath} ${e.message}`);
           }
           lastError = e;
         }
       }
-      _log(`injecting env (${keysCount}) from ${shortPaths.join(",")} ${dim(`-- tip: ${_getRandomTip()}`)}`);
+      _log(`injected env (${keysCount}) from ${shortPaths.join(",")} ${dim(`// tip: ${_getRandomTip()}`)}`);
     }
     if (lastError) {
       return { parsed: parsedAll, error: lastError };
@@ -360,7 +284,7 @@ var require_main = __commonJS((exports, module) => {
     }
     const vaultPath = _vaultPath(options);
     if (!vaultPath) {
-      _warn(`You set DOTENV_KEY but you are missing a .env.vault file at ${vaultPath}. Did you forget to build it?`);
+      _warn(`you set DOTENV_KEY but you are missing a .env.vault file at ${vaultPath}`);
       return DotenvModule.configDotenv(options);
     }
     return DotenvModule._configVault(options);
@@ -1035,6 +959,7 @@ __export(exports_util, {
   toZod: () => toZod,
   stringifyPrimitive: () => stringifyPrimitive,
   slugify: () => slugify,
+  sizeCaps: () => sizeCaps,
   shallowClone: () => shallowClone,
   safeExtend: () => safeExtend,
   required: () => required,
@@ -1609,6 +1534,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a;
   for (let i = start;i < issues.length; i++) {
@@ -3028,7 +2965,7 @@ ${content.join(`
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // ../../node_modules/zod/v4/core/schemas.js
@@ -3777,6 +3714,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse2 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse2(payload, ctx);
+  };
+}
+var arraySize = (input) => Array.isArray(input) ? input.length : -1;
+var mapSize = (input) => input instanceof Map ? input.size : -1;
+var setSize = (input) => input instanceof Set ? input.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -3820,6 +3782,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
   const isPresent = key in input;
@@ -4774,6 +4737,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
   if (keyResult.issues.length) {
@@ -4840,6 +4804,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -14289,9 +14254,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -14691,6 +14662,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -14707,6 +14679,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -20053,7 +20026,7 @@ class RestartController {
       const timer = setTimeout(() => {
         this.cancel(request.requestId).catch(() => {});
       }, 330000);
-      timer.unref?.();
+      timer.unref();
       this.preparationTimers.set(request.requestId, timer);
       return publicOperation(o);
     });
@@ -20380,6 +20353,30 @@ async function writeEnvFileDetailed(updates, options = {}) {
 }
 
 // ../../shared/admin/configuration.ts
+var siteSettingPaths = {
+  OR3_SITE_NAME: ["or3", "site", "name"],
+  OR3_SITE_DESCRIPTION: ["or3", "site", "description"],
+  OR3_LOGO_URL: ["or3", "site", "logoUrl"],
+  OR3_FAVICON_URL: ["or3", "site", "faviconUrl"],
+  OR3_DEFAULT_THEME: ["or3", "site", "defaultTheme"],
+  OR3_DISABLED_THEMES: ["or3", "site", "disabledThemes"],
+  OR3_DEFAULT_PANE_COUNT: ["or3", "ui", "defaultPaneCount"],
+  OR3_MAX_PANES: ["or3", "ui", "maxPanes"],
+  OR3_SIDEBAR_COLLAPSED: ["or3", "ui", "sidebarCollapsedByDefault"],
+  OR3_TERMS_URL: ["or3", "legal", "termsUrl"],
+  OR3_PRIVACY_URL: ["or3", "legal", "privacyUrl"],
+  OR3_WORKFLOWS_ENABLED: ["features", "workflows", "enabled"],
+  OR3_WORKFLOWS_EDITOR: ["features", "workflows", "editor"],
+  OR3_WORKFLOWS_SLASH_COMMANDS: ["features", "workflows", "slashCommands"],
+  OR3_WORKFLOWS_EXECUTION: ["features", "workflows", "execution"],
+  OR3_DOCUMENTS_ENABLED: ["features", "documents", "enabled"],
+  OR3_BACKUP_ENABLED: ["features", "backup", "enabled"],
+  OR3_MENTIONS_ENABLED: ["features", "mentions", "enabled"],
+  OR3_MENTIONS_DOCUMENTS: ["features", "mentions", "documents"],
+  OR3_MENTIONS_CONVERSATIONS: ["features", "mentions", "conversations"],
+  OR3_DASHBOARD_ENABLED: ["features", "dashboard", "enabled"]
+};
+var siteSettingKeys = new Set(Object.keys(siteSettingPaths));
 var restartSettingKeys = new Set(["OR3_AUTH_REGISTRATION_MODE", "OR3_ADMIN_ALLOW_RESTART"]);
 
 // ../../shared/server/restarts/configuration.ts
@@ -20823,6 +20820,12 @@ var SECRET_KEYS = [
 ];
 var ALLOWED_ENV_KEYS = new Set([
   "SSR_AUTH_ENABLED",
+  "NUXT_SECRETS_PROVIDER",
+  "NUXT_SECRETS_NAMESPACE",
+  "NUXT_SECRETS_SOCKET_PATH",
+  "NUXT_SECRETS_TOKEN_FILE",
+  "NUXT_SECRETS_VAULT_ID",
+  "NUXT_SECRETS_SERVICE_UID",
   "AUTH_PROVIDER",
   "OR3_AUTH_PROVIDER",
   "OR3_AUTH_REGISTRATION_MODE",
@@ -21054,6 +21057,7 @@ function composeArgs(directory, mode, command = []) {
   }
   return [
     "compose",
+    ...env.SSR_AUTH_ENABLED === "true" && (env.NUXT_SECRETS_PROVIDER ?? "or3-secrets") === "or3-secrets" ? ["--profile", "or3-vault"] : [],
     "--project-name",
     project,
     "--project-directory",
@@ -21329,7 +21333,7 @@ async function createManagedLifecycle(directory) {
       Config: exports_external.object({ Labels: exports_external.record(exports_external.string(), exports_external.string()).nullish() }).passthrough(),
       Mounts: exports_external.array(exports_external.object({ Destination: exports_external.string(), Name: exports_external.string().optional(), Type: exports_external.string() }).passthrough())
     }).passthrough()).nonempty().parse(JSON.parse(result.stdout))[0];
-    if (info.Config?.Labels?.["io.or3.cloud.deployment-id"] !== initial.state.deploymentId || !info.Mounts.some((mount) => mount.Destination === "/data" && mount.Type === "volume" && mount.Name === initial.state.volumeName))
+    if (info.Config.Labels?.["io.or3.cloud.deployment-id"] !== initial.state.deploymentId || !info.Mounts.some((mount) => mount.Destination === "/data" && mount.Type === "volume" && mount.Name === initial.state.volumeName))
       throw new RestartError("deployment_identity_changed");
     return { loaded, imageId: String(info.Image) };
   }

package/dist/cli.mjs

@@ -132,7 +132,7 @@ import { basename as basename7, resolve as resolve16 } from "node:path";
 
 // src/commands/adopt.ts
 import { chmod as chmod5, mkdir as mkdir5 } from "node:fs/promises";
-import { basename as basename3, join as join12, resolve as resolve7 } from "node:path";
+import { basename as basename3, join as join13, resolve as resolve7 } from "node:path";
 
 // src/backup/archive.ts
 import { createReadStream as createReadStream3 } from "node:fs";
@@ -179,7 +179,7 @@ import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_ROOT = resolve(fileURLToPath(new URL("../", import.meta.url)));
-var PACKAGE_VERSION = "0.1.90";
+var PACKAGE_VERSION = "0.1.91";
 var IMAGE_REPOSITORY = "ghcr.io/saluana/or3-chat";
 var ASSET_ROOT = resolve(fileURLToPath(new URL("../assets/", import.meta.url)));
 var SHA256_DIGEST = /^sha256:[0-9a-f]{64}$/;
@@ -371,6 +371,12 @@ var SECRET_KEYS = [
 ];
 var ALLOWED_ENV_KEYS = new Set([
   "SSR_AUTH_ENABLED",
+  "NUXT_SECRETS_PROVIDER",
+  "NUXT_SECRETS_NAMESPACE",
+  "NUXT_SECRETS_SOCKET_PATH",
+  "NUXT_SECRETS_TOKEN_FILE",
+  "NUXT_SECRETS_VAULT_ID",
+  "NUXT_SECRETS_SERVICE_UID",
   "AUTH_PROVIDER",
   "OR3_AUTH_PROVIDER",
   "OR3_AUTH_REGISTRATION_MODE",
@@ -1052,6 +1058,7 @@ function composeArgs(directory, mode, command = []) {
   }
   return [
     "compose",
+    ...env.SSR_AUTH_ENABLED === "true" && (env.NUXT_SECRETS_PROVIDER ?? "or3-secrets") === "or3-secrets" ? ["--profile", "or3-vault"] : [],
     "--project-name",
     project,
     "--project-directory",
@@ -1923,7 +1930,7 @@ async function inspectBackupEntry(backupsRoot, entry, directory) {
       };
     }
     let bytes = 0;
-    for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth"]) {
+    for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth", ...manifest2.vaultSha256 ? ["vault.backup"] : []]) {
       bytes += (await lstat(join9(path, file))).size;
     }
     return {
@@ -2035,7 +2042,7 @@ async function readManifest(backupPath, authenticatedForDirectory) {
   if (authenticatedForDirectory)
     await assertBackupAuthentication(authenticatedForDirectory, backupPath, manifestContents);
   const manifest2 = JSON.parse(manifestContents);
-  if (manifest2.schemaVersion !== 1 || !BACKUP_ID_PATTERN.test(manifest2.backupId) || !Number.isFinite(Date.parse(manifest2.createdAt)) || !isVersion(manifest2.appVersion) || !manifest2.image || !/^sha256:[0-9a-f]{64}$/i.test(manifest2.imageDigest) || !/^[0-9a-f]{64}$/i.test(manifest2.dataSha256) || !/^[0-9a-f]{64}$/i.test(manifest2.configSha256 ?? "") || manifest2.dataBytes !== undefined && (!Number.isSafeInteger(manifest2.dataBytes) || manifest2.dataBytes < 0)) {
+  if (manifest2.schemaVersion !== 1 || !BACKUP_ID_PATTERN.test(manifest2.backupId) || !Number.isFinite(Date.parse(manifest2.createdAt)) || !isVersion(manifest2.appVersion) || !manifest2.image || !/^sha256:[0-9a-f]{64}$/i.test(manifest2.imageDigest) || !/^[0-9a-f]{64}$/i.test(manifest2.dataSha256) || !/^[0-9a-f]{64}$/i.test(manifest2.configSha256 ?? "") || manifest2.vaultSha256 !== undefined && !/^[0-9a-f]{64}$/i.test(manifest2.vaultSha256) || manifest2.dataBytes !== undefined && (!Number.isSafeInteger(manifest2.dataBytes) || manifest2.dataBytes < 0)) {
     throw new Error(`Invalid backup manifest at ${backupPath}.`);
   }
   const actual = await sha256File(join9(backupPath, "data.tgz"));
@@ -2046,6 +2053,8 @@ async function readManifest(backupPath, authenticatedForDirectory) {
     if (configActual !== manifest2.configSha256)
       throw new Error(`Backup configuration checksum mismatch for ${manifest2.backupId}.`);
   }
+  if (manifest2.vaultSha256 && await sha256File(join9(backupPath, "vault.backup")) !== manifest2.vaultSha256)
+    throw new Error(`Vault backup checksum mismatch for ${manifest2.backupId}.`);
   await verifiedManagedAssetContents(backupPath, manifest2);
   return manifest2;
 }
@@ -2748,8 +2757,16 @@ async function checkPublicPrerequisites(domain) {
 }
 
 // src/runtime/project.ts
+import { readFileSync as readFileSync5 } from "node:fs";
+import { join as join12 } from "node:path";
+function managedVaultEnabled(directory, env) {
+  const selected = env ?? parseEnv(readFileSync5(join12(directory, ".env"), "utf8"));
+  return selected.SSR_AUTH_ENABLED === "true" && (selected.NUXT_SECRETS_PROVIDER ?? "or3-secrets") === "or3-secrets" && readFileSync5(join12(directory, "compose.yaml"), "utf8").includes(`
+  or3-vault:
+`);
+}
 async function stopProject(directory, mode) {
-  await compose(directory, mode, ["stop", "or3"]);
+  await compose(directory, mode, ["stop", "or3", ...managedVaultEnabled(directory) ? ["or3-vault"] : []]);
 }
 async function projectServiceRunning(directory, mode) {
   const result = await run("docker", composeArgs(directory, mode, ["ps", "--status", "running", "-q", "or3"]), directory);
@@ -2898,6 +2915,7 @@ async function verifyPublicApplication(baseUrl, credentials) {
           workspace_id: workspaceId,
           hash,
           storage_id: storageId,
+          intent_id: presign.intentId,
           storage_provider_id: "fs",
           mime_type: "image/png",
           size_bytes: probeBytes.length,
@@ -3056,31 +3074,31 @@ async function adoptCommand(positionals, flags) {
   if (targetDirectory === sourceDirectory)
     throw new Error("Choose a separate target directory for adoption.");
   await readDirectoryEmpty(targetDirectory);
-  if (!await fileExists(join12(sourceDirectory, "or3-release.json")))
+  if (!await fileExists(join13(sourceDirectory, "or3-release.json")))
     throw new Error(`V1 release metadata is missing at ${sourceDirectory}/or3-release.json.`);
-  const release = JSON.parse(await readText(join12(sourceDirectory, "or3-release.json")));
+  const release = JSON.parse(await readText(join13(sourceDirectory, "or3-release.json")));
   if (!release.or3Version || !isVersion(release.or3Version))
     throw new Error("V1 release metadata does not contain a usable OR3 version.");
   if (release.or3Version !== PACKAGE_VERSION) {
     throw new Error(`V1 is on OR3 ${release.or3Version}, but this CLI ships managed assets for ${PACKAGE_VERSION}. Run the matching @or3/cloud version or perform a qualified host CLI update before adoption.`);
   }
-  const sourceEnv = parseEnv(await readText(join12(sourceDirectory, ".env")));
-  const providers = await readText(join12(sourceDirectory, "or3.providers.generated.ts"));
+  const sourceEnv = parseEnv(await readText(join13(sourceDirectory, ".env")));
+  const providers = await readText(join13(sourceDirectory, "or3.providers.generated.ts"));
   assertSupportedSource(sourceDirectory, sourceEnv, providers);
   const mode = sourceMode(sourceDirectory, sourceEnv);
   const domain = mode === "public" ? sourceEnv.OR3_PUBLIC_DOMAIN : undefined;
   if (domain)
     await checkPublicPrerequisites(domain);
-  const sourceComposeFiles = ["-f", join12(sourceDirectory, "compose.yaml")];
+  const sourceComposeFiles = ["-f", join13(sourceDirectory, "compose.yaml")];
   if (mode === "public")
-    sourceComposeFiles.push("-f", join12(sourceDirectory, "compose.public.yaml"));
+    sourceComposeFiles.push("-f", join13(sourceDirectory, "compose.public.yaml"));
   await ensureDocker();
   const sourceConfig = await run("docker", [
     "compose",
     "--project-directory",
     sourceDirectory,
     "--env-file",
-    join12(sourceDirectory, ".env"),
+    join13(sourceDirectory, ".env"),
     ...sourceComposeFiles,
     "config",
     "--format",
@@ -3167,7 +3185,7 @@ ${existing.stderr}`)) {
     OR3_GUEST_ACCESS_ENABLED: "false"
   });
   await writeSecure(deploymentPaths(targetDirectory).env, serializeEnv(targetEnv));
-  await writeSecure(join12(targetDirectory, ".or3-initial-credentials"), serializeInitialCredentials({
+  await writeSecure(join13(targetDirectory, ".or3-initial-credentials"), serializeInitialCredentials({
     bootstrapEmail: email,
     bootstrapPassword: password,
     adminUsername: targetEnv.OR3_ADMIN_USERNAME,
@@ -3203,7 +3221,7 @@ ${existing.stderr}`)) {
       }
     }
     await mkdir5(sourceBackupDir, { recursive: true, mode: 448 });
-    await copySecure(join12(sourceDirectory, ".env"), join12(sourceBackupDir, "config.env"));
+    await copySecure(join13(sourceDirectory, ".env"), join13(sourceBackupDir, "config.env"));
     await archiveExternalVolume(sourceImage, sourceVolume, sourceBackupDir);
     const sourceManifest = {
       schemaVersion: 1,
@@ -3212,8 +3230,8 @@ ${existing.stderr}`)) {
       appVersion: release.or3Version,
       image,
       imageDigest: digest,
-      dataSha256: await sha256File(join12(sourceBackupDir, "data.tgz")),
-      configSha256: await sha256File(join12(sourceBackupDir, "config.env")),
+      dataSha256: await sha256File(join13(sourceBackupDir, "data.tgz")),
+      configSha256: await sha256File(join13(sourceBackupDir, "config.env")),
       mode,
       domain,
       composeProject: sourceEnv.OR3_COMPOSE_PROJECT ?? sanitizeName(basename3(sourceDirectory)),
@@ -3224,7 +3242,7 @@ ${existing.stderr}`)) {
     };
     const sourceManifestContents = `${JSON.stringify(sourceManifest, null, 2)}
 `;
-    await writeSecure(join12(sourceBackupDir, "manifest.json"), sourceManifestContents);
+    await writeSecure(join13(sourceBackupDir, "manifest.json"), sourceManifestContents);
     await writeBackupAuthentication(targetDirectory, sourceBackupDir, sourceManifestContents);
     await readManifest(sourceBackupDir, targetDirectory);
     await updatePending(targetDirectory, state, { phase: "snapshot-created" });
@@ -3260,11 +3278,11 @@ ${sourceRecoveryError ? "The original V1 deployment needs manual recovery. " : "
 
 // src/backup/create.ts
 import { chmod as chmod6, lstat as lstat2, mkdir as mkdir6 } from "node:fs/promises";
-import { join as join15, resolve as resolve9 } from "node:path";
+import { join as join16, resolve as resolve9 } from "node:path";
 
 // src/backup/references.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 var INSPECTOR = "/app/scripts/docker/backup-inspect.mjs";
 var NODE = 'if [ -x /nodejs/bin/node ]; then exec /nodejs/bin/node "$@"; else exec node "$@"; fi';
 async function validateCanonicalBackupReferences(directory, env, backupPath) {
@@ -3309,7 +3327,7 @@ async function validateCanonicalBackupReferences(directory, env, backupPath) {
       "-c",
       "sleep 240"
     ]);
-    await streamFileToCommand("docker", ["exec", "-i", helper, "sh", "-c", "ulimit -f 16384; tar tvzf - > /scratch/inventory"], join13(backupPath, "data.tgz"), directory, secretValues(env));
+    await streamFileToCommand("docker", ["exec", "-i", helper, "sh", "-c", "ulimit -f 16384; tar tvzf - > /scratch/inventory"], join14(backupPath, "data.tgz"), directory, secretValues(env));
     const inventory = JSON.parse(await checked(["exec", helper, "sh", "-c", NODE, "or3-backup-inspection", INSPECTOR, "inventory"]));
     if (!Array.isArray(inventory.selected) || !inventory.selected.includes("./sync.sqlite") && !inventory.selected.includes("sync.sqlite") || inventory.selected.some((name) => !/^(?:\.\/)?sync[.]sqlite(?:-wal)?$/.test(name)) || inventory.selected.length > 2 || !Number.isSafeInteger(inventory.bytes) || inventory.bytes < 0)
       throw new Error("Invalid offline backup inspection inventory response.");
@@ -3317,7 +3335,7 @@ async function validateCanonicalBackupReferences(directory, env, backupPath) {
     if (!Number.isFinite(freeKiB) || freeKiB < 0)
       throw new Error("Could not verify offline backup scratch capacity.");
     assertEnoughFreeSpace(freeKiB * 1024, inventory.bytes, "Offline backup inspection scratch");
-    await streamFileToCommand("docker", ["exec", "-i", helper, "tar", "-xz", "-f", "-", "-C", "/scratch", ...inventory.selected], join13(backupPath, "data.tgz"), directory, secretValues(env));
+    await streamFileToCommand("docker", ["exec", "-i", helper, "tar", "-xz", "-f", "-", "-C", "/scratch", ...inventory.selected], join14(backupPath, "data.tgz"), directory, secretValues(env));
     const result = JSON.parse(await checked(["exec", helper, "sh", "-c", NODE, "or3-backup-inspection", INSPECTOR, "references", env.OR3_STORAGE_FS_ROOT ?? "/data/storage"]));
     if (result.contract !== 1 || result.complete !== true || !Number.isSafeInteger(result.liveAttachments) || result.liveAttachments < 0)
       throw new Error("Offline canonical backup reference inspection did not complete.");
@@ -3334,7 +3352,7 @@ async function validateCanonicalBackupReferences(directory, env, backupPath) {
 
 // src/backup/retention.ts
 import { rm as rm5 } from "node:fs/promises";
-import { basename as basename4, dirname as dirname4, join as join14, resolve as resolve8 } from "node:path";
+import { basename as basename4, dirname as dirname4, join as join15, resolve as resolve8 } from "node:path";
 var BACKUP_RETENTION_KEEP = 5;
 function assertRemovableArtifactName(name) {
   if (!BACKUP_ID_PATTERN.test(name)) {
@@ -3350,7 +3368,7 @@ async function removeNamedBackupArtifact(directory, backupId) {
     throw new Error(`Refusing to remove a path outside the backups directory: ${target}.`);
   }
   await rm5(target, { recursive: true, force: true });
-  await rm5(join14(deploymentPaths(directory).exports, `${backupId}.json`), { force: true });
+  await rm5(join15(deploymentPaths(directory).exports, `${backupId}.json`), { force: true });
 }
 async function removeEnumeratedBackupArtifact(directory, backup) {
   await lifecycleFaults.beforeArtifactDelete?.();
@@ -3360,7 +3378,7 @@ async function removeEnumeratedBackupArtifact(directory, backup) {
     throw new Error(`Refusing to prune an untrusted backup path ${backup.path}.`);
   }
   await rm5(target, { recursive: true, force: true });
-  await rm5(join14(deploymentPaths(directory).exports, `${backup.backupId}.json`), { force: true });
+  await rm5(join15(deploymentPaths(directory).exports, `${backup.backupId}.json`), { force: true });
 }
 function planRetention(entries, keep, protectedIds, options = {}) {
   if (!Number.isInteger(keep) || keep < 1)
@@ -3467,7 +3485,7 @@ async function cleanupPartialBackup(directory, backupId) {
   }
   const statuses = await Promise.all([
     artifactStatus(backupDirectory(directory, backupId)),
-    artifactStatus(join15(deploymentPaths(directory).exports, `${backupId}.json`))
+    artifactStatus(join16(deploymentPaths(directory).exports, `${backupId}.json`))
   ]);
   const removed = statuses.every((status) => status.absent);
   const detail = statuses.map((status) => status.detail).join(" ");
@@ -3515,7 +3533,20 @@ async function createBackup(directory, state, env, options = {}) {
     capturedAt = now();
     await report("capturing", `Backup capture: OR3 is stopped; writing ${backupDir}.`);
     await volumeArchive(directory, state.mode, env, backupDir);
-    await copySecure(deploymentPaths(directory).env, join15(backupDir, "config.env"));
+    if (managedVaultEnabled(directory, env)) {
+      await streamCommandToFile("docker", composeArgs(directory, state.mode, [
+        "run",
+        "--rm",
+        "-T",
+        "--no-deps",
+        "--entrypoint",
+        "/nodejs/bin/node",
+        "or3-vault",
+        "/app/vault/entrypoint.mjs",
+        "backup"
+      ]), join16(backupDir, "vault.backup"), directory, secretValues(env));
+    }
+    await copySecure(deploymentPaths(directory).env, join16(backupDir, "config.env"));
     managedAssetSha256 = await snapshotManagedAssets(directory, state.mode, backupDir);
     artifact = "captured";
   } catch (error) {
@@ -3548,9 +3579,10 @@ async function createBackup(directory, state, env, options = {}) {
         appVersion: state.appVersion,
         image: state.image,
         imageDigest: state.imageDigest,
-        dataSha256: await sha256File(join15(backupDir, "data.tgz")),
+        dataSha256: await sha256File(join16(backupDir, "data.tgz")),
+        ...managedVaultEnabled(directory, env) ? { vaultSha256: await sha256File(join16(backupDir, "vault.backup")) } : {},
         dataBytes: volumeSize,
-        configSha256: await sha256File(join15(backupDir, "config.env")),
+        configSha256: await sha256File(join16(backupDir, "config.env")),
         managedAssetSha256,
         managedAssetInventoryVersion: managedAssetSha256?.["dashboard-lifecycle.mjs"] ? MANAGED_ASSET_INVENTORY_VERSION : managedAssetSha256?.["compose.operator.yaml"] ? 3 : managedAssetSha256?.["dashboard-operator.mjs"] ? 2 : undefined,
         mode: state.mode,
@@ -3564,7 +3596,7 @@ async function createBackup(directory, state, env, options = {}) {
       };
       const manifestContents = `${JSON.stringify(manifest2, null, 2)}
 `;
-      await writeSecure(join15(backupDir, "manifest.json"), manifestContents);
+      await writeSecure(join16(backupDir, "manifest.json"), manifestContents);
       await writeBackupAuthentication(directory, backupDir, manifestContents);
       if (!options.safetySnapshot)
         await validateCanonicalBackupReferences(directory, { ...env, OR3_IMAGE: imageAtDigest(state.image, state.imageDigest) }, backupDir);
@@ -3621,7 +3653,7 @@ async function inspectUnclaimedBackupArtifacts(directory, backupId, backupPath)
     return;
   const statuses = await Promise.all([
     artifactStatus(expectedPath),
-    artifactStatus(join15(deploymentPaths(directory).exports, `${backupId}.json`))
+    artifactStatus(join16(deploymentPaths(directory).exports, `${backupId}.json`))
   ]);
   const detail = statuses.map((status) => status.detail).join(" ");
   return statuses.every((status) => status.absent) ? detail : `Maintenance warning: backup artifact ownership was not recorded. ${detail} This recovery did not verify or remove these paths. Inspect them with "npx @or3/cloud backup list".`;
@@ -3648,7 +3680,7 @@ async function createPreMutationSnapshot(directory, state, env, backupId) {
 
 // src/backup/export.ts
 import { chmod as chmod7, mkdir as mkdir7, realpath, rm as rm6, stat as stat3 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname5, isAbsolute as isAbsolute3, join as join16, resolve as resolve10, sep } from "node:path";
+import { basename as basename5, dirname as dirname5, isAbsolute as isAbsolute3, join as join17, resolve as resolve10, sep } from "node:path";
 var PURGE_REQUIRES_BACKUP_WITHIN_MS = 24 * 60 * 60 * 1000;
 async function exportBackup(directory, backupId, destination) {
   const backupPath = await resolveBackup(directory, backupId);
@@ -3662,7 +3694,7 @@ async function exportBackup(directory, backupId, destination) {
   if (await fileExists(dest))
     throw new Error(`Destination ${dest} already exists. Choose a new empty destination so an export can never merge with unrelated files.`);
   await mkdir7(dirname5(dest), { recursive: true, mode: 448 });
-  const canonicalDestination = join16(await realpath(dirname5(dest)), basename5(dest));
+  const canonicalDestination = join17(await realpath(dirname5(dest)), basename5(dest));
   if (canonicalDestination === deploymentRoot || canonicalDestination.startsWith(`${deploymentRoot}${sep}`)) {
     throw new Error("Backup exports must live outside the managed deployment directory so `remove --purge-data` can never delete the remaining copy.");
   }
@@ -3672,20 +3704,20 @@ async function exportBackup(directory, backupId, destination) {
       throw new Error("Backup export destination changed while it was being created. Refusing to write an export through an unexpected path.");
     }
     await chmod7(dest, 448);
-    for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth"]) {
-      await copySecure(join16(backupPath, file), join16(dest, file));
+    for (const file of ["data.tgz", "config.env", "manifest.json", "manifest.auth", ...manifest2.vaultSha256 ? ["vault.backup"] : []]) {
+      await copySecure(join17(backupPath, file), join17(dest, file));
     }
     if (manifest2.managedAssetSha256) {
       for (const name of managedAssetNamesForInventory(manifest2.mode, manifest2.managedAssetInventoryVersion)) {
-        await copySecure(join16(backupPath, "managed-assets", name), join16(dest, "managed-assets", name));
+        await copySecure(join17(backupPath, "managed-assets", name), join17(dest, "managed-assets", name));
       }
     }
-    const dataSha = await sha256File(join16(dest, "data.tgz"));
+    const dataSha = await sha256File(join17(dest, "data.tgz"));
     if (dataSha !== manifest2.dataSha256) {
       throw new Error(`Exported data.tgz checksum mismatch for ${manifest2.backupId}. Expected ${manifest2.dataSha256}, got ${dataSha}.`);
     }
     if (manifest2.configSha256) {
-      const configSha = await sha256File(join16(dest, "config.env"));
+      const configSha = await sha256File(join17(dest, "config.env"));
       if (configSha !== manifest2.configSha256) {
         throw new Error(`Exported config.env checksum mismatch for ${manifest2.backupId}.`);
       }
@@ -3702,12 +3734,12 @@ async function exportBackup(directory, backupId, destination) {
       dataSha256: manifest2.dataSha256,
       configSha256: manifest2.configSha256
     };
-    await writeSecure(join16(deploymentPaths(directory).exports, `${manifest2.backupId}.json`), `${JSON.stringify(receipt, null, 2)}
+    await writeSecure(join17(deploymentPaths(directory).exports, `${manifest2.backupId}.json`), `${JSON.stringify(receipt, null, 2)}
 `);
-    let bytes = (await stat3(join16(dest, "data.tgz"))).size + (await stat3(join16(dest, "config.env"))).size + (await stat3(join16(dest, "manifest.json"))).size + (await stat3(join16(dest, "manifest.auth"))).size;
+    let bytes = (manifest2.vaultSha256 ? (await stat3(join17(dest, "vault.backup"))).size : 0) + (await stat3(join17(dest, "data.tgz"))).size + (await stat3(join17(dest, "config.env"))).size + (await stat3(join17(dest, "manifest.json"))).size + (await stat3(join17(dest, "manifest.auth"))).size;
     if (manifest2.managedAssetSha256) {
       for (const name of managedAssetNamesForInventory(manifest2.mode, manifest2.managedAssetInventoryVersion)) {
-        bytes += (await stat3(join16(dest, "managed-assets", name))).size;
+        bytes += (await stat3(join17(dest, "managed-assets", name))).size;
       }
     }
     console.log(`Exported backup ${manifest2.backupId} (${bytes} bytes) to ${dest}`);
@@ -3730,7 +3762,7 @@ function assertPurgeBackupFreshness(backups, nowMs) {
 }
 async function readBackupExportReceipt(directory, backupId) {
   try {
-    const receipt = JSON.parse(await readText(join16(deploymentPaths(directory).exports, `${backupId}.json`)));
+    const receipt = JSON.parse(await readText(join17(deploymentPaths(directory).exports, `${backupId}.json`)));
     if (receipt.schemaVersion !== 1 || receipt.backupId !== backupId || typeof receipt.destination !== "string" || !isAbsolute3(receipt.destination) || typeof receipt.destinationDevice !== "number" || !receipt.dataSha256)
       return;
     return receipt;
@@ -3934,7 +3966,7 @@ async function backupCommand(directory, positionals, flags) {
 
 // src/credentials/reset.ts
 import { rm as rm7 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 
 // src/credentials/reset-script.ts
 function buildCredentialsResetScript(input2) {
@@ -4127,7 +4159,7 @@ async function applyCredentialReset(directory, state, nextEnv) {
   await runCredentialsResetScript(directory, state.mode, values);
   const runtimeEnv = withoutProvisioningCredentials(nextEnv);
   await writeSecure(deploymentPaths(directory).env, serializeEnv(runtimeEnv));
-  const initialCredentials = join17(directory, ".or3-initial-credentials");
+  const initialCredentials = join18(directory, ".or3-initial-credentials");
   await rm7(initialCredentials, { force: true });
   await stopProject(directory, state.mode);
   await startProject(directory, state.mode, runtimeEnv);
@@ -4189,7 +4221,7 @@ async function credentialsCommand(directory, positionals, flags) {
 // src/commands/doctor.ts
 import { existsSync as existsSync3 } from "node:fs";
 import { stat as stat4 } from "node:fs/promises";
-import { basename as basename6, join as join18, resolve as resolve11 } from "node:path";
+import { basename as basename6, join as join19, resolve as resolve11 } from "node:path";
 async function doctorCommand(directory) {
   const resolved = resolve11(directory);
   const paths = deploymentPaths(resolved);
@@ -4214,7 +4246,7 @@ async function doctorCommand(directory) {
     failures.push(error instanceof Error ? error.message : String(error));
     console.log("✗ Managed state or .env is missing/invalid");
   }
-  for (const file of [paths.env, paths.state, join18(resolved, ".or3-initial-credentials")]) {
+  for (const file of [paths.env, paths.state, join19(resolved, ".or3-initial-credentials")]) {
     if (!existsSync3(file))
       continue;
     const mode = (await stat4(file)).mode & 511;
@@ -4286,7 +4318,7 @@ async function doctorCommand(directory) {
           }
           assertDashboardOperatorMounts(container.Mounts ?? [], resolved);
           const ipcDirectory = await stat4(paths.operatorIpc);
-          const operatorSocket = await stat4(join18(paths.operatorIpc, "operator.sock"));
+          const operatorSocket = await stat4(join19(paths.operatorIpc, "operator.sock"));
           const operatorUid = Number(env.OR3_OPERATOR_UID);
           const operatorGid = Number(env.OR3_OPERATOR_GID);
           if ((ipcDirectory.mode & 511) !== 456 || ipcDirectory.uid !== operatorUid || ipcDirectory.gid !== operatorGid || !operatorSocket.isSocket() || (operatorSocket.mode & 511) !== 432 || operatorSocket.uid !== operatorUid || operatorSocket.gid !== operatorGid) {
@@ -4345,7 +4377,7 @@ async function doctorCommand(directory) {
 
 // src/commands/init.ts
 import { chmod as chmod8, mkdir as mkdir8 } from "node:fs/promises";
-import { join as join19, relative, resolve as resolve12 } from "node:path";
+import { join as join20, relative, resolve as resolve12 } from "node:path";
 async function initCommand(positionals, flags) {
   const hasLocal = boolFlag(flags, "local");
   const hasPublic = boolFlag(flags, "public");
@@ -4353,7 +4385,7 @@ async function initCommand(positionals, flags) {
     throw new Error("Choose exactly one of --local or --public.");
   const mode = hasPublic ? "public" : "local";
   const directory = resolve12(process.cwd(), positionals[0] ?? "or3-cloud");
-  if (await fileExists(join19(directory, ".or3-cloud", "state.json"))) {
+  if (await fileExists(join20(directory, ".or3-cloud", "state.json"))) {
     throw new Error(`${directory} is already a managed deployment. Use update, doctor, or adopt.`);
   }
   await readDirectoryEmpty(directory);
@@ -4404,7 +4436,7 @@ ${existing.stderr}`)) {
   await copyAssets(directory, mode);
   const env = buildEnv({ mode, version, directory, image, email, password, domain, port, dashboardOperator: operator });
   await writeSecure(deploymentPaths(directory).env, serializeEnv(env));
-  await writeSecure(join19(directory, ".or3-initial-credentials"), serializeInitialCredentials({
+  await writeSecure(join20(directory, ".or3-initial-credentials"), serializeInitialCredentials({
     bootstrapEmail: email,
     bootstrapPassword: password,
     adminUsername: email,
@@ -4429,7 +4461,7 @@ ${existing.stderr}`)) {
     const folder = relative(process.cwd(), directory) || ".";
     console.log(`
 OR3 Cloud ${version} is running at ${url}`);
-    console.log(`Sign in as ${email} with the password in ${join19(folder, ".or3-initial-credentials")}; the same login opens ${url}/admin.`);
+    console.log(`Sign in as ${email} with the password in ${join20(folder, ".or3-initial-credentials")}; the same login opens ${url}/admin.`);
     console.log("Save it in a password manager, then delete that file.");
     console.log(`
 Run later commands from the deployment folder: cd ${quote(folder)} && npx @or3/cloud doctor`);
@@ -4482,10 +4514,10 @@ async function restartCommand(directory, lifecycle) {
 }
 
 // src/commands/recover.ts
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 
 // src/backup/restore.ts
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 function assertFilesystemPayloadHash(key, readChunk, createHash3) {
   const match = /^(sha256|md5)_([a-fA-F0-9]+)$/.exec(key);
   const algorithm = match?.[1];
@@ -4547,7 +4579,7 @@ if ((storageRoot === '/data' || storageRoot.startsWith('/data/')) && fs.existsSy
 }
 `;
 async function assertRestoreFreeSpace(directory, state, env, manifest2, backupPath) {
-  const archiveBytes = await gzipUncompressedBytes(join20(backupPath, "data.tgz"));
+  const archiveBytes = await gzipUncompressedBytes(join21(backupPath, "data.tgz"));
   const requiredBytes = Math.max(manifest2.dataBytes ?? 0, archiveBytes);
   const freeBytes = await dataVolumeFreeBytes(directory, state.mode, env);
   const reclaimableBytes = await dataVolumeSize(directory, state.mode, env, "allocated");
@@ -4556,7 +4588,7 @@ async function assertRestoreFreeSpace(directory, state, env, manifest2, backupPa
 async function restoreBackupData(directory, state, env, backupPath, options = {}) {
   const manifest2 = await readManifest(backupPath, directory);
   assertRestorableManagedAssets(manifest2);
-  const backupEnv = parseEnv(await readText(join20(backupPath, "config.env")));
+  const backupEnv = parseEnv(await readText(join21(backupPath, "config.env")));
   if (backupEnv.OR3_VERSION !== manifest2.appVersion || backupEnv.OR3_IMAGE !== manifest2.image) {
     throw new Error(`Backup ${manifest2.backupId} configuration does not match its manifest.`);
   }
@@ -4644,12 +4676,12 @@ import { resolve as resolve13 } from "node:path";
 // src/deployment/lease.ts
 import { randomBytes as randomBytes8 } from "node:crypto";
 import { mkdir as mkdir10, rename as rename3, rm as rm9 } from "node:fs/promises";
-import { dirname as dirname7, join as join22 } from "node:path";
+import { dirname as dirname7, join as join23 } from "node:path";
 
 // ../../shared/server/restarts/controller.ts
 import { randomUUID as randomUUID3, createHash as createHash3 } from "node:crypto";
 import { mkdir as mkdir9, open as open3, readFile as readFile3, rename as rename2, rm as rm8 } from "node:fs/promises";
-import { dirname as dirname6, join as join21 } from "node:path";
+import { dirname as dirname6, join as join22 } from "node:path";
 
 // ../../node_modules/zod/v4/classic/external.js
 var exports_external = {};
@@ -5241,6 +5273,7 @@ __export(exports_util, {
   toZod: () => toZod,
   stringifyPrimitive: () => stringifyPrimitive,
   slugify: () => slugify,
+  sizeCaps: () => sizeCaps,
   shallowClone: () => shallowClone,
   safeExtend: () => safeExtend,
   required: () => required,
@@ -5815,6 +5848,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a;
   for (let i = start;i < issues.length; i++) {
@@ -7234,7 +7279,7 @@ ${content.join(`
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // ../../node_modules/zod/v4/core/schemas.js
@@ -7983,6 +8028,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse2 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse2(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -8026,6 +8096,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -8980,6 +9051,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -9046,6 +9118,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -18495,9 +18568,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -18897,6 +18976,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -18913,6 +18993,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -24113,7 +24194,7 @@ class RestartController {
   constructor(directory, driver) {
     this.directory = directory;
     this.driver = driver;
-    this.path = join21(directory, "restarts.json");
+    this.path = join22(directory, "restarts.json");
   }
   lock(action) {
     const next = this.serial.then(action, action);
@@ -24256,7 +24337,7 @@ class RestartController {
       const timer = setTimeout(() => {
         this.cancel(request.requestId).catch(() => {});
       }, 330000);
-      timer.unref?.();
+      timer.unref();
       this.preparationTimers.set(request.requestId, timer);
       return publicOperation(o);
     });
@@ -24411,7 +24492,7 @@ class RestartController {
 var DASHBOARD_LEASE_STALE_MS = 30000;
 async function readLeaseOwner(leasePath) {
   try {
-    const owner = JSON.parse(await readText(join22(leasePath, "owner.json")));
+    const owner = JSON.parse(await readText(join23(leasePath, "owner.json")));
     if (owner.schemaVersion !== 1 || typeof owner.nonce !== "string" || typeof owner.command !== "string" || owner.origin !== "cli" && owner.origin !== "dashboard" || !Number.isSafeInteger(owner.pid) || typeof owner.acquiredAt !== "string" || typeof owner.heartbeatAt !== "string")
       return;
     return owner;
@@ -24470,7 +24551,7 @@ async function acquireDeploymentLease(directory, command, dashboardJobId) {
     }
   }
   try {
-    await writeSecure(join22(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
+    await writeSecure(join23(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
 `);
   } catch (error62) {
     await rm9(leasePath, { recursive: true, force: true }).catch(() => {
@@ -24480,7 +24561,7 @@ async function acquireDeploymentLease(directory, command, dashboardJobId) {
   }
   const heartbeat = setInterval(() => {
     owner.heartbeatAt = now();
-    writeSecure(join22(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
+    writeSecure(join23(leasePath, "owner.json"), `${JSON.stringify(owner, null, 2)}
 `).catch(() => {
       return;
     });
@@ -24505,7 +24586,7 @@ async function withDeploymentLease(directory, command, action) {
 }
 async function assertRestartJournalSettled(directory) {
   try {
-    const journal = await readRestartJournal(join22(directory, ".or3-cloud", "restarts", "restarts.json"));
+    const journal = await readRestartJournal(join23(directory, ".or3-cloud", "restarts", "restarts.json"));
     if (journal.operations.some((operation) => !["succeeded", "cancelled", "failed"].includes(operation.phase))) {
       throw new Error("A dashboard restart is unresolved. Run the compatible CLI recover --dry-run to inspect and recover --finish to reconcile it before another mutation.");
     }
@@ -25144,11 +25225,11 @@ async function runRecovery(directory, context) {
         await compose(loaded.directory, loaded.state.mode, ["down"]).catch(() => {
           return;
         });
-        const sourceEnv = parseEnv(await readText(join23(pending.sourceDirectory, ".env")));
-        const sourceFiles = ["-f", join23(pending.sourceDirectory, "compose.yaml")];
+        const sourceEnv = parseEnv(await readText(join24(pending.sourceDirectory, ".env")));
+        const sourceFiles = ["-f", join24(pending.sourceDirectory, "compose.yaml")];
         const sourceModeValue = sourceMode(pending.sourceDirectory, sourceEnv);
         if (sourceModeValue === "public")
-          sourceFiles.push("-f", join23(pending.sourceDirectory, "compose.public.yaml"));
+          sourceFiles.push("-f", join24(pending.sourceDirectory, "compose.public.yaml"));
         if (pending.sourceInitiallyRunning !== false) {
           await restartSource(pending.sourceDirectory, sourceFiles, secretValues(sourceEnv));
         }
@@ -25163,7 +25244,7 @@ async function runRecovery(directory, context) {
 
 // src/commands/remove.ts
 import { rm as rm10 } from "node:fs/promises";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 function purgeVolumesFromState(state) {
   const volumes = [state.volumeName];
   if (state.mode === "public") {
@@ -25200,7 +25281,7 @@ async function removeCommand(directory, flags) {
   for (const volume of volumes)
     console.log(`  docker volume ${volume}`);
   for (const file2 of managedFiles)
-    console.log(`  ${join24(directory, file2)}`);
+    console.log(`  ${join25(directory, file2)}`);
   await compose(directory, state.mode, ["down"]);
   await assertPurgeHasVerifiedExport(directory, await enumerateBackups(directory), Date.now());
   for (const volume of volumes) {
@@ -25210,13 +25291,13 @@ async function removeCommand(directory, flags) {
 ${result.stderr}`);
   }
   for (const file2 of managedFiles) {
-    await rm10(join24(directory, file2), { recursive: true, force: true });
+    await rm10(join25(directory, file2), { recursive: true, force: true });
   }
   console.log(`Purged: data volumes, backups, .env, managed state, and compose files were deleted. The verified export at ${exportReceipt.destination} is the remaining copy.`);
 }
 
 // src/commands/restore.ts
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 async function restoreCommand(directory, flags, positionals) {
   if (!boolFlag(flags, "yes"))
     throw new Error("Restore replaces live data. Re-run with --yes after confirming the backup and data-loss boundary.");
@@ -25229,7 +25310,7 @@ async function restoreCommand(directory, flags, positionals) {
   const backupPath = await resolveBackup(loaded.directory, backupValue);
   const manifest2 = await readManifest(backupPath, loaded.directory);
   assertRestorableManagedAssets(manifest2);
-  const backupEnv = parseEnv(await readText(join25(backupPath, "config.env")));
+  const backupEnv = parseEnv(await readText(join26(backupPath, "config.env")));
   if (backupEnv.OR3_VERSION !== manifest2.appVersion || backupEnv.OR3_IMAGE !== manifest2.image) {
     throw new Error(`Backup ${manifest2.backupId} configuration does not match its manifest.`);
   }
@@ -25319,7 +25400,7 @@ async function restoreCommand(directory, flags, positionals) {
 }
 
 // src/commands/rollback.ts
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 async function rollbackCommand(directory, flags) {
   if (!boolFlag(flags, "yes"))
     throw new Error("Rollback restores the previous image and data snapshot. Re-run with --yes after confirming post-update data loss.");
@@ -25335,7 +25416,7 @@ async function rollbackCommand(directory, flags) {
   if (manifest2.appVersion !== point.appVersion || manifest2.image !== point.image || manifest2.imageDigest !== point.imageDigest) {
     throw new Error(`Rollback point ${point.backupId} no longer matches its recorded image/version. Refusing to mutate the deployment.`);
   }
-  const backupEnv = parseEnv(await readText(join26(backupPath, "config.env")));
+  const backupEnv = parseEnv(await readText(join27(backupPath, "config.env")));
   if (backupEnv.OR3_VERSION !== manifest2.appVersion || backupEnv.OR3_IMAGE !== manifest2.image) {
     throw new Error(`Backup ${manifest2.backupId} configuration does not match its manifest.`);
   }
@@ -25546,7 +25627,7 @@ ${result.stderr}`);
 
 // src/commands/update.ts
 import { readFile as readFile4, statfs as statfs2 } from "node:fs/promises";
-import { join as join27, resolve as resolve14 } from "node:path";
+import { join as join28, resolve as resolve14 } from "node:path";
 async function assessUpdate(directory, targetVersion, options = {}) {
   const checkDocker = options.checkDocker ?? false;
   const observation = await observeDeployment(directory, { checkDocker, checkImage: false });
@@ -25611,7 +25692,7 @@ async function assessUpdate(directory, targetVersion, options = {}) {
     for (const name of managedAssetNames(state?.mode ?? "local")) {
       let desired;
       try {
-        desired = await readFile4(join27(ASSET_ROOT, name));
+        desired = await readFile4(join28(ASSET_ROOT, name));
       } catch (error62) {
         findings.push({
           code: "managed-asset-unreadable",
@@ -25622,7 +25703,7 @@ async function assessUpdate(directory, targetVersion, options = {}) {
         continue;
       }
       try {
-        const installedPath = join27(directory, name);
+        const installedPath = join28(directory, name);
         if (!await fileExists(installedPath)) {
           changed.push(`${name} (add)`);
           continue;
@@ -25977,7 +26058,7 @@ async function runUpdateCommand(directory, flags, asJson) {
 }
 
 // src/commands/verify.ts
-import { join as join28, resolve as resolve15 } from "node:path";
+import { join as join29, resolve as resolve15 } from "node:path";
 async function verificationCredentials(directory, flags, env) {
   const passwordFile = stringFlag(flags, "verification-password-file");
   if (flags["verification-email"] !== undefined && !stringFlag(flags, "verification-email")) {
@@ -25989,7 +26070,7 @@ async function verificationCredentials(directory, flags, env) {
   const configuredEmail = stringFlag(flags, "verification-email")?.trim() || env.OR3_MANAGED_OWNER_EMAIL || env.OR3_BASIC_AUTH_BOOTSTRAP_EMAIL;
   let initialCredentials = {};
   if (!configuredEmail || !passwordFile && !env.OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD) {
-    const initialCredentialsPath = join28(directory, ".or3-initial-credentials");
+    const initialCredentialsPath = join29(directory, ".or3-initial-credentials");
     if (await fileExists(initialCredentialsPath)) {
       initialCredentials = parseEnv(await readOwnerOnlyText(initialCredentialsPath, "The initial credentials file"));
     }
@@ -26230,11 +26311,11 @@ The installer never changes firewall, DNS, Cloudflare, or Tailscale settings.`);
 
 // src/commands/recover-restart.ts
 import { request } from "node:http";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 async function recoverRestart(directory, flags) {
   let journal;
   try {
-    journal = await readRestartJournal(join29(directory, ".or3-cloud", "restarts", "restarts.json"));
+    journal = await readRestartJournal(join30(directory, ".or3-cloud", "restarts", "restarts.json"));
   } catch (error62) {
     if (error62.code === "ENOENT")
       return false;
@@ -26259,7 +26340,7 @@ async function recoverRestart(directory, flags) {
   const value = JSON.stringify({ requestId: operation.requestId });
   await new Promise((resolve17, reject) => {
     const req = request({
-      socketPath: join29(deploymentPaths(directory).operatorIpc, "operator.sock"),
+      socketPath: join30(deploymentPaths(directory).operatorIpc, "operator.sock"),
       path: "/lifecycle/v1/reconcile",
       method: "POST",
       headers: { "content-type": "application/json", "content-length": Buffer.byteLength(value) }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@or3/cloud",
-  "version": "0.1.90",
+  "version": "0.1.91",
   "description": "Install and operate the OR3 Cloud container distribution",
   "type": "module",
   "license": "GPL-3.0",
@@ -10,7 +10,7 @@
     "directory": "packages/or3-cloud"
   },
   "engines": {
-    "node": ">=20"
+    "node": "^24.22.1"
   },
   "bin": {
     "or3": "./dist/cli.mjs"
@@ -19,9 +19,9 @@
     "dashboardUpdateProtocol": 1,
     "dashboardUpdateMinimumSourceVersion": "0.1.40",
     "stateSchema": 1,
-    "imageDigest": "sha256:d50b70d6522574798f1a3081894b5bf8fe9eca7aa5f183ad5a562de2e4f41c12",
-    "operatorImageDigest": "sha256:7148fc08014a0a35c1bd211243c3cf7cecb4b25cce9ec0dac1ecd7e50a61121a",
-    "sourceRevision": "8cc6e0d33cacbe304a0d3aec0d57563cdf4d7d9b"
+    "imageDigest": "sha256:c8ddb0c55aa89f7eb768f29f25edfc782ff45ec6d3089972e5b9bc7d01781a27",
+    "operatorImageDigest": "sha256:84593cc55d1c01ce53a49438b5f47624182fe376e7a009511438b8077854c4cf",
+    "sourceRevision": "c299552915aa0f3977673bcfa702f539d225a6c8"
   },
   "files": [
     "dist",