@rakay-technology/kraft 0.7.9 → 0.7.13

package/dist/{chunk-MOSINQAM.js → chunk-AFUXAAFQ.js}

@@ -5,11 +5,10 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   containerCommand,
   edgeContainerExecutor,
-  isSafeCertPath,
   readDeclaredPair,
   readMaybeInContainer,
   validateCertFor
-} from "./chunk-VFPLICBX.js";
+} from "./chunk-3AZY56JP.js";
 import {
   EdgeConflictError,
   EdgeMigrateRequested,
@@ -24,42 +23,42 @@ import {
   sanitizeEdgeVhosts,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-PCOTSRS4.js";
+} from "./chunk-QLPQ5NFE.js";
 import {
   privilegedExecutor,
   rootChecked,
   rootOrDegrade
-} from "./chunk-DI54Y66N.js";
+} from "./chunk-QPUEAYB3.js";
 import {
   EDGE_CHALLENGE_HOST_DIR,
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_PATHS,
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-XBGSR22I.js";
+} from "./chunk-XAEYWDBX.js";
 import {
   waitForPortListening
-} from "./chunk-2Y62WP2D.js";
+} from "./chunk-QCGVPIYN.js";
 import {
   EDGE_CONTAINER_NAME,
   probeExec,
   probeExecElevated,
   tryExec,
   withReason
-} from "./chunk-3RCXJZJD.js";
+} from "./chunk-E3J47WO3.js";
 import {
   envOps,
   opScript
-} from "./chunk-ZQJU5CTZ.js";
+} from "./chunk-7VMXN646.js";
 import {
   resolveEnvironment
-} from "./chunk-YY5DEAZI.js";
+} from "./chunk-BQMBJ32I.js";
 import {
   formatDuration,
   systemDebug
 } from "./chunk-3CJLKL6E.js";
 import {
   sq
-} from "./chunk-BN23UUSF.js";
+} from "./chunk-YXXWTBXB.js";
 import {
   AppError,
   PROXY_DIRECTIVES,
@@ -73,7 +72,7 @@ import {
   safeErrorMessage,
   sanitizeProxySettings,
   shellQuote
-} from "./chunk-ND23EK7Y.js";
+} from "./chunk-G4VGNFGV.js";
 
 // ../../packages/adapters/src/system/managed-image.ts
 import { posix } from "path";
@@ -1334,237 +1333,6 @@ async function scanApache(executor) {
   return { proxy: "apache", sites: kept, warnings };
 }
 
-// ../../packages/adapters/src/system/proxy/import/traefik.ts
-function lowerKeys(labels) {
-  const out = {};
-  for (const [k, v] of Object.entries(labels)) out[k.toLowerCase()] = v;
-  return out;
-}
-function extractHosts(rule) {
-  const hosts = [];
-  for (const call of rule.matchAll(/\bHost\(([^)]*)\)/gi)) {
-    for (const m of call[1].matchAll(/[`'"]([^`'"]+)[`'"]/g)) {
-      const h = m[1].trim();
-      if (h) hosts.push(h);
-    }
-  }
-  return [...new Set(hosts)];
-}
-function extraMatchers(rule) {
-  const found = /* @__PURE__ */ new Set();
-  for (const m of rule.matchAll(
-    /\b(PathPrefix|PathRegexp|Path|HeadersRegexp|Headers|Method|Query|ClientIP|HostRegexp)\b/gi
-  )) {
-    found.add(m[1]);
-  }
-  return [...found];
-}
-function collectDefinitions(containers) {
-  const services = /* @__PURE__ */ new Map();
-  const redirectMiddlewares = /* @__PURE__ */ new Set();
-  const streamRouters = [];
-  let fileProvider = false;
-  let exposedByDefault = true;
-  for (const c of containers) {
-    const labels = lowerKeys(c.labels);
-    for (const [k, v] of Object.entries(labels)) {
-      let m = k.match(
-        /^traefik\.http\.services\.([^.]+)\.loadbalancer\.server\.(port|scheme)$/
-      );
-      if (m) {
-        const def = services.get(m[1]) ?? {};
-        if (m[2] === "port") def.port = v;
-        else def.scheme = v;
-        services.set(m[1], def);
-        continue;
-      }
-      m = k.match(/^traefik\.http\.middlewares\.([^.]+)\.redirectscheme\./);
-      if (m) {
-        redirectMiddlewares.add(m[1]);
-        continue;
-      }
-      m = k.match(/^traefik\.(tcp|udp)\.routers\.([^.]+)\.rule$/);
-      if (m) streamRouters.push(`${m[1]} router "${m[2]}"`);
-    }
-    const cmd = c.cmd ?? "";
-    if (/--?providers\.file/i.test(cmd)) fileProvider = true;
-    if (/--?providers\.docker\.exposedbydefault[= ]?false/i.test(cmd))
-      exposedByDefault = false;
-  }
-  return {
-    services,
-    redirectMiddlewares,
-    streamRouters,
-    fileProvider,
-    exposedByDefault
-  };
-}
-function resolveIp(c, labels) {
-  const wanted = labels["traefik.docker.network"];
-  if (wanted && c.networks?.[wanted]) return c.networks[wanted];
-  if (c.ip) return c.ip;
-  const first = Object.values(c.networks ?? {}).find(Boolean);
-  return first || void 0;
-}
-function parseTraefikLabels(containers) {
-  const warnings = [];
-  const defs = collectDefinitions(containers);
-  const candidates = [];
-  for (const c of containers) {
-    const labels = lowerKeys(c.labels);
-    if (labels["traefik.enable"] === "false") continue;
-    if (!defs.exposedByDefault && labels["traefik.enable"] !== "true") continue;
-    const routers = /* @__PURE__ */ new Map();
-    for (const [key, val] of Object.entries(labels)) {
-      const r = key.match(/^traefik\.http\.routers\.([^.]+)\.(.+)$/);
-      if (!r) continue;
-      const bag = routers.get(r[1]) ?? {};
-      bag[r[2]] = val;
-      routers.set(r[1], bag);
-    }
-    for (const [rname, props] of routers) {
-      const rule = props.rule;
-      if (!rule) continue;
-      const hosts = extractHosts(rule);
-      if (hosts.length === 0) {
-        warnings.push(
-          /HostRegexp/i.test(rule) ? `traefik: router "${rname}" uses HostRegexp (${rule}) \u2014 regex hosts aren't migratable` : `traefik: router "${rname}" has no Host() rule (${rule}) \u2014 skipped`
-        );
-        continue;
-      }
-      const ip = resolveIp(c, labels);
-      if (!ip) {
-        warnings.push(
-          `traefik: ${hosts.join(", ")} \u2014 couldn't resolve container ${c.name}'s IP; re-add the upstream manually`
-        );
-        continue;
-      }
-      const svc = props.service?.replace(/@.*$/, "");
-      const def = (svc ? defs.services.get(svc) : void 0) ?? (defs.services.size === 1 ? [...defs.services.values()][0] : void 0);
-      const onlyExposed = c.exposedPorts?.length === 1 ? c.exposedPorts[0].split("/")[0] : void 0;
-      const rawPort = def?.port ?? onlyExposed;
-      const port = /^\d{1,5}$/.test(String(rawPort)) ? String(rawPort) : "80";
-      const scheme = def?.scheme?.toLowerCase() === "https" ? "https" : "http";
-      const middlewares = (props.middlewares ?? "").split(",").map((m) => m.trim().replace(/@.*$/, "")).filter(Boolean);
-      candidates.push({
-        hosts,
-        ssl: Object.keys(props).some(
-          (p) => p === "tls" || p.startsWith("tls.")
-        ),
-        url: `${scheme}://${ip}:${port}`,
-        container: c.name,
-        router: rname,
-        rule,
-        middlewares,
-        redirectOnly: middlewares.length > 0 && middlewares.every((m) => defs.redirectMiddlewares.has(m)),
-        portGuessed: rawPort === void 0
-      });
-    }
-  }
-  const { kept: sites, dropped } = collapseByHost(
-    candidates,
-    (c) => c.hosts,
-    (c) => c.redirectOnly ? 0 : c.ssl ? 2 : 1
-  );
-  for (const cand of sites) {
-    const extras = extraMatchers(cand.rule);
-    if (extras.length > 0) {
-      warnings.push(
-        `traefik: ${cand.hosts.join(", ")} also matches ${extras.join(", ")} \u2014 only the Host() part is migrated; re-add path/header rules manually`
-      );
-    }
-    const carried = cand.middlewares.filter(
-      (m) => !defs.redirectMiddlewares.has(m)
-    );
-    if (carried.length > 0) {
-      warnings.push(
-        `traefik: ${cand.hosts.join(", ")} uses middleware(s) "${carried.join(", ")}" \u2014 not migrated`
-      );
-    }
-    if (cand.portGuessed) {
-      warnings.push(
-        `traefik: ${cand.hosts.join(", ")} \u2014 no service port label and no single exposed port on ${cand.container}; assumed :80, check the upstream`
-      );
-    }
-  }
-  for (const d of dropped) {
-    warnings.push(
-      `traefik: ${d.hosts.join(", ")} router "${d.router}" is an http\u2192https redirect \u2014 Kraft's edge does that itself (nothing to migrate)`
-    );
-  }
-  for (const s of defs.streamRouters) {
-    warnings.push(
-      `traefik: ${s} can't migrate \u2014 Kraft's edge routes HTTP(S), not raw TCP/UDP`
-    );
-  }
-  if (defs.fileProvider) {
-    warnings.push(
-      "traefik: a file provider is configured \u2014 routes defined in its YAML/TOML files are NOT read here, only container labels. Re-add those domains manually."
-    );
-  }
-  return {
-    proxy: "traefik",
-    sites: sites.map((cand) => ({
-      serverNames: cand.hosts,
-      ssl: cand.ssl,
-      target: { kind: "proxy", url: cand.url },
-      source: `traefik container ${cand.container}`
-    })),
-    warnings
-  };
-}
-async function scanTraefik(executor) {
-  const out = await tryExec(
-    executor,
-    `docker ps -q 2>/dev/null | xargs -r docker inspect --format '{{.Name}}	{{json .Config.Labels}}	{{range $n, $v := .NetworkSettings.Networks}}{{$n}}={{$v.IPAddress}} {{end}}	{{range $p, $v := .Config.ExposedPorts}}{{$p}} {{end}}	{{if .Config.Cmd}}{{join .Config.Cmd " "}}{{end}}' 2>/dev/null`
-  );
-  if (!out) {
-    return {
-      proxy: "traefik",
-      sites: [],
-      warnings: ["traefik: couldn't read container labels via docker inspect"]
-    };
-  }
-  const containers = [];
-  for (const line of out.split("\n")) {
-    const [rawName, rawLabels, rawNets, rawPorts, rawCmd] = line.split("	");
-    if (!rawName || !rawLabels) continue;
-    let labels;
-    try {
-      labels = JSON.parse(rawLabels) ?? {};
-    } catch {
-      continue;
-    }
-    const networks = {};
-    let bareIp;
-    for (const pair of (rawNets ?? "").trim().split(/\s+/)) {
-      if (!pair) continue;
-      const eq = pair.indexOf("=");
-      if (eq > 0) {
-        const ip = pair.slice(eq + 1);
-        if (ip) networks[pair.slice(0, eq)] = ip;
-      } else if (!bareIp) {
-        bareIp = pair;
-      }
-    }
-    const exposedPorts = (rawPorts ?? "").trim().split(/\s+/).filter(Boolean);
-    const hasTraefikLabels = Object.keys(labels).some(
-      (k) => k.toLowerCase().startsWith("traefik.")
-    );
-    const looksLikeTraefik = /traefik/i.test(rawCmd ?? "") || /--?providers\./i.test(rawCmd ?? "");
-    if (!hasTraefikLabels && !looksLikeTraefik) continue;
-    containers.push({
-      name: rawName.replace(/^\//, ""),
-      labels,
-      ip: Object.values(networks)[0] ?? bareIp,
-      networks,
-      exposedPorts,
-      cmd: rawCmd ?? void 0
-    });
-  }
-  return parseTraefikLabels(containers);
-}
-
 // ../../packages/adapters/src/system/proxy/import/index.ts
 var INSTALLED_MARKERS = [
   { proxy: "nginx", paths: ["/etc/nginx/nginx.conf"] },
@@ -1607,8 +1375,6 @@ async function scanImportableSites(executor, proxy) {
       return scanCaddy(executor);
     case "apache":
       return scanApache(executor);
-    case "traefik":
-      return scanTraefik(executor);
     case "openresty":
       return scanForeignOpenResty(executor);
     default:
@@ -1620,7 +1386,7 @@ async function scanImportableSites(executor, proxy) {
   }
 }
 function canImportProxy(proxy) {
-  return proxy === "nginx" || proxy === "caddy" || proxy === "apache" || proxy === "traefik" || proxy === "openresty";
+  return proxy === "nginx" || proxy === "caddy" || proxy === "apache" || proxy === "openresty";
 }
 function unreachableStaticRoots(sites, opts) {
   if (!opts.containerEdge) return [];
@@ -1693,125 +1459,6 @@ async function caddyStoreCert(exec, host, container) {
   return null;
 }
 
-// ../../packages/adapters/src/system/proxy/import/traefik-certs.ts
-var DEFAULT_ACME_PATHS = [
-  "/acme.json",
-  "/etc/traefik/acme.json",
-  "/data/acme.json",
-  "/letsencrypt/acme.json"
-];
-var TRAEFIK_STATIC_CONFIGS = [
-  "/etc/traefik/traefik.yml",
-  "/etc/traefik/traefik.yaml",
-  "/etc/traefik/traefik.toml"
-];
-function prop(obj, name) {
-  const hit = Object.keys(obj).find(
-    (k) => k.toLowerCase() === name.toLowerCase()
-  );
-  return hit === void 0 ? void 0 : obj[hit];
-}
-async function candidateStoragePaths(exec, container) {
-  const found = [];
-  const collect = (text) => {
-    for (const m of (text ?? "").matchAll(
-      /acme\.storage[=:\s]+["']?(\/[^\s"',}]+)/gi
-    )) {
-      if (isSafeCertPath(m[1])) found.push(m[1]);
-    }
-    for (const m of (text ?? "").matchAll(
-      /(?:^|\s)storage:\s*["']?(\/[^\s"',}]+\.json)/gi
-    )) {
-      if (isSafeCertPath(m[1])) found.push(m[1]);
-    }
-  };
-  if (container) {
-    collect(
-      await tryExec(
-        exec,
-        `docker inspect ${sq2(container)} --format '{{json .Config.Cmd}} {{json .Args}} {{json .Config.Env}}' 2>/dev/null`
-      )
-    );
-    for (const cfg of TRAEFIK_STATIC_CONFIGS) {
-      collect(await readMaybeInContainer(exec, cfg, container));
-    }
-  }
-  return [.../* @__PURE__ */ new Set([...found, ...DEFAULT_ACME_PATHS])];
-}
-async function loadAcmeJson(exec, container) {
-  for (const path of await candidateStoragePaths(exec, container)) {
-    const raw = await readMaybeInContainer(exec, path, container);
-    if (raw.trim().startsWith("{")) return { raw, path };
-  }
-  return null;
-}
-function certFromAcmeJson(raw, host) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  const target = host.toLowerCase();
-  const matches = (name) => {
-    const n = (name ?? "").toLowerCase();
-    if (!n) return false;
-    if (n === target) return true;
-    if (!n.startsWith("*.")) return false;
-    const suffix = n.slice(1);
-    return target.endsWith(suffix) && !target.slice(0, -suffix.length).includes(".");
-  };
-  for (const [resolver, value] of Object.entries(parsed)) {
-    if (!value || typeof value !== "object") continue;
-    const certs = prop(value, "certificates");
-    if (!Array.isArray(certs)) continue;
-    for (const entry of certs) {
-      const domain = entry && prop(entry, "domain");
-      const names = [domain?.main, ...domain?.sans ?? []];
-      if (!names.some(matches)) continue;
-      const certB64 = prop(entry, "certificate");
-      const keyB64 = prop(entry, "key");
-      if (typeof certB64 !== "string" || typeof keyB64 !== "string") continue;
-      const certPem = Buffer.from(certB64, "base64").toString("utf-8");
-      const keyPem = Buffer.from(keyB64, "base64").toString("utf-8");
-      if (!certPem.includes("-----BEGIN") || !keyPem.includes("-----BEGIN"))
-        continue;
-      return { certPem, keyPem, resolver };
-    }
-  }
-  return null;
-}
-async function traefikAcmeCert(exec, host, container) {
-  const loaded = await loadAcmeJson(exec, container);
-  if (!loaded) return null;
-  const hit = certFromAcmeJson(loaded.raw, host);
-  if (!hit) return null;
-  return {
-    certPem: hit.certPem,
-    keyPem: hit.keyPem,
-    source: `traefik ${loaded.path} (resolver ${hit.resolver})`
-  };
-}
-async function traefikDeclaredCertPaths(exec, container) {
-  const pairs = [];
-  for (const cfg of TRAEFIK_STATIC_CONFIGS) {
-    const text = await readMaybeInContainer(exec, cfg, container);
-    if (!text.trim()) continue;
-    const certFiles = [
-      ...text.matchAll(/certFile:\s*["']?(\/[^\s"',}]+)/gi)
-    ].map((m) => m[1]);
-    const keyFiles = [...text.matchAll(/keyFile:\s*["']?(\/[^\s"',}]+)/gi)].map(
-      (m) => m[1]
-    );
-    for (let i = 0; i < Math.min(certFiles.length, keyFiles.length); i++) {
-      if (isSafeCertPath(certFiles[i]) && isSafeCertPath(keyFiles[i])) {
-        pairs.push({ certPath: certFiles[i], keyPath: keyFiles[i] });
-      }
-    }
-  }
-  return pairs;
-}
-
 // ../../packages/adapters/src/system/proxy/api.ts
 function buildProxyRouteIndex(sites) {
   const byPort = /* @__PURE__ */ new Map();
@@ -1878,28 +1525,9 @@ var CERT_SOURCES = {
   openresty: [declaredCert],
   apache: [declaredCert],
   caddy: [declaredCert, (c) => caddyStoreCert(c.exec, c.host, c.container)],
-  traefik: [
-    (c) => traefikAcmeCert(c.exec, c.host, c.container),
-    // File provider: paths aren't bound to a hostname (traefik picks by SNI), so
-    // hand every declared pair to the validator and let coverage decide.
-    async (c) => {
-      for (const pair of await traefikDeclaredCertPaths(c.exec, c.container)) {
-        const pems = await readDeclaredPair(
-          c.exec,
-          pair.certPath,
-          pair.keyPath,
-          c.container
-        );
-        if (!pems) continue;
-        if (validateCertFor(c.host, pems, pair.certPath).cert) {
-          return { ...pems, source: pair.certPath };
-        }
-      }
-      return null;
-    }
-  ],
   // Takeover-only: no importable config, so no cert to find either.
-  haproxy: []
+  haproxy: [],
+  traefik: []
 };
 async function edgeProxy(exec, opts = {}) {
   const status = opts.status ?? await probeEdge(exec).catch(() => null);
@@ -2867,7 +2495,7 @@ function edgeHostExecutor(executor) {
   });
 }
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-XLDZIG4E.js");
+  const { NginxProvider: Provider } = await import("./nginx-V6DQWKON.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
@@ -2894,8 +2522,8 @@ async function containerEdgeProvider(executor, container, opts) {
   });
 }
 async function localContainerEdgeProvider(container, opts) {
-  const { DockerEdgeExecutor } = await import("./docker-edge-executor-MPIPQHNF.js");
-  const { NginxProvider: Provider } = await import("./nginx-XLDZIG4E.js");
+  const { DockerEdgeExecutor } = await import("./docker-edge-executor-JID2Q2HZ.js");
+  const { NginxProvider: Provider } = await import("./nginx-V6DQWKON.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,

package/dist/{chunk-2UQFOUSZ.js → chunk-B2CUYCGY.js}

@@ -140,29 +140,29 @@ import {
   resolveExecExitCode,
   startAttachStream,
   startExecStream
-} from "./chunk-ZNVAHQRY.js";
+} from "./chunk-Q7FAE2MB.js";
 import {
   BareRuntime
-} from "./chunk-7UKBMDUF.js";
+} from "./chunk-MK6GYBO4.js";
 import {
   createExecutor
-} from "./chunk-SPKRI7MF.js";
+} from "./chunk-N7AJ2D4I.js";
 import {
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-XBGSR22I.js";
+} from "./chunk-XAEYWDBX.js";
 import {
   MAIL_HOST_STATE_DIR
-} from "./chunk-3RCXJZJD.js";
+} from "./chunk-E3J47WO3.js";
 import {
   envOps
-} from "./chunk-ZQJU5CTZ.js";
+} from "./chunk-7VMXN646.js";
 import {
   ENVIRONMENT_PROBE_SCRIPT,
   ENVIRONMENT_PROBE_TIMEOUT_MS,
   cacheEnvironment,
   parseEnvironmentProbe,
   profileIsFresh
-} from "./chunk-YY5DEAZI.js";
+} from "./chunk-BQMBJ32I.js";
 import {
   FAMILY_BY_DISTRO,
   PRICING,
@@ -175,7 +175,7 @@ import {
   validateBackupPath,
   validateClearPath,
   withTimeout
-} from "./chunk-ND23EK7Y.js";
+} from "./chunk-G4VGNFGV.js";
 
 // ../../packages/adapters/src/types.ts
 var DEFAULT_BUILD_RESOURCE_CONFIG = {
@@ -293,13 +293,16 @@ function registerDestination(kind, factory) {
 }
 
 // ../../packages/adapters/src/backup/common/credentials.ts
-import { createDecipheriv, createHash as createHash2 } from "crypto";
-var PREFIX = "enc1:";
+import { createDecipheriv, createHash as createHash2, hkdfSync } from "crypto";
+var PREFIX_V1 = "enc1:";
+var PREFIX_V2 = "enc2:";
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 var AUTH_TAG_LENGTH = 16;
+var HKDF_SALT_V2 = "kraft-enc-salt-v2";
+var SSH_CREDENTIAL_PURPOSE = "ssh-credential-v1";
 var injectedSecret;
-function deriveKey() {
+function deriveKeyV1() {
   const secret = injectedSecret ?? process.env.BETTER_AUTH_SECRET;
   if (!secret) {
     throw new Error(
@@ -308,23 +311,53 @@ function deriveKey() {
   }
   return createHash2("sha256").update(secret).digest();
 }
-function decryptCredential(stored) {
-  if (stored == null || stored === "") return void 0;
-  if (!stored.startsWith(PREFIX)) return stored;
-  const packed = Buffer.from(stored.slice(PREFIX.length), "base64");
+function deriveKeyV2() {
+  const secret = injectedSecret ?? process.env.BETTER_AUTH_SECRET;
+  if (!secret) {
+    throw new Error(
+      "BETTER_AUTH_SECRET is not set \u2014 cannot decrypt backup destination credentials."
+    );
+  }
+  return Buffer.from(
+    hkdfSync(
+      "sha256",
+      Buffer.from(secret, "utf8"),
+      HKDF_SALT_V2,
+      SSH_CREDENTIAL_PURPOSE,
+      32
+    )
+  );
+}
+function openEnvelope(packed, key) {
   if (packed.length < IV_LENGTH + AUTH_TAG_LENGTH) {
     throw new Error("Invalid credential ciphertext: too short");
   }
   const iv = packed.subarray(0, IV_LENGTH);
   const authTag = packed.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
   const ciphertext = packed.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
-  const decipher = createDecipheriv(ALGORITHM, deriveKey(), iv);
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
   decipher.setAuthTag(authTag);
   return Buffer.concat([
     decipher.update(ciphertext),
     decipher.final()
   ]).toString("utf8");
 }
+function decryptCredential(stored) {
+  if (stored == null || stored === "") return void 0;
+  if (stored.startsWith(PREFIX_V2)) {
+    return openEnvelope(
+      Buffer.from(stored.slice(PREFIX_V2.length), "base64"),
+      deriveKeyV2()
+    );
+  }
+  if (stored.startsWith(PREFIX_V1)) {
+    return openEnvelope(
+      Buffer.from(stored.slice(PREFIX_V1.length), "base64"),
+      deriveKeyV1()
+    );
+  }
+  return stored;
+}
 
 // ../../packages/adapters/src/backup/common/sha256-stream.ts
 import { createHash as createHash3 } from "crypto";

package/dist/{chunk-7O6MARHJ.js → chunk-B6B42QMZ.js}

@@ -9,14 +9,14 @@ import {
   internalPost,
   mintBareInternalToken,
   waitHealthy
-} from "./chunk-JK7KKBXI.js";
+} from "./chunk-KHAT3OZP.js";
 import {
   completeHostEdge,
   markStoppedProxyImported,
   planAndApplyHostEdge,
   previewHostEdge,
   rollbackHostEdge
-} from "./chunk-IGTODKUA.js";
+} from "./chunk-5RWL7EFH.js";
 import {
   DEFAULT_REPO,
   PORTS_FILE,
@@ -43,11 +43,11 @@ import {
   resolvePorts,
   sourceBuildDir,
   verifyHostChannel
-} from "./chunk-ULEEWX5M.js";
+} from "./chunk-C3LRTROB.js";
 import {
   startUnitHint,
   thisHost
-} from "./chunk-2UQFOUSZ.js";
+} from "./chunk-B2CUYCGY.js";
 import {
   AUTH_SECRET_FILE,
   DATA_DIR,
@@ -59,16 +59,16 @@ import {
 import {
   edgeCrashReason,
   edgeIsBroken
-} from "./chunk-PCOTSRS4.js";
+} from "./chunk-QLPQ5NFE.js";
 import {
   LocalExecutor
-} from "./chunk-HFOE2IXZ.js";
+} from "./chunk-BIOW6K3V.js";
 import {
   EDGE_CONTAINER_NAME
-} from "./chunk-3RCXJZJD.js";
+} from "./chunk-E3J47WO3.js";
 import {
   isValidEmail
-} from "./chunk-ND23EK7Y.js";
+} from "./chunk-G4VGNFGV.js";
 
 // src/commands/up.ts
 import { Command } from "commander";
@@ -1942,7 +1942,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.7.9"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.7.13"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;

package/dist/{chunk-HFOE2IXZ.js → chunk-BIOW6K3V.js}

@@ -8,7 +8,7 @@ import {
   getLocalShellPath,
   logEntry,
   sq
-} from "./chunk-BN23UUSF.js";
+} from "./chunk-YXXWTBXB.js";
 
 // ../../packages/adapters/src/system/local-executor.ts
 import { exec, spawn } from "child_process";