sealkeep 0.9.0 → 0.11.0

package/dist/src/storage-targets.js

@@ -1,59 +1,651 @@
-import { fail } from "./errors.js";
-import { readConfig, listArchives } from "./vault.js";
+import { createHash } from "node:crypto";
+import { fail, isSealkeepError } from "./errors.js";
+import { readConfig, listArchives, updateConfigFields, updateConfigFieldsIf } from "./vault.js";
 import { isV2 } from "./types.js";
-import { envVar } from "./env.js";
+import { envFlag, envVar } from "./env.js";
+import { loadProviderCredentialRecord, storeProviderCredentials, } from "./secrets.js";
+import { archiveCopies } from "./archive-copies.js";
+import { STORAGE_PREFIX_DEFAULT } from "./branding.js";
+import { assertSafeStorageEndpoint, parseStorageEndpoint } from "./storage-endpoint.js";
+export { assertSafeStorageEndpoint, parseStorageEndpoint } from "./storage-endpoint.js";
+async function targetPushGenerationMatches(dataDir, options) {
+    if (!Object.hasOwn(options, "expectedAuthGeneration"))
+        return true;
+    try {
+        const { cloudAuthGeneration } = await import("./cloud.js");
+        return await cloudAuthGeneration(dataDir) === options.expectedAuthGeneration;
+    }
+    catch {
+        return false;
+    }
+}
+function routingFingerprint(config) {
+    // Usage reporting must never revive a destination, cap, pin or priority
+    // which the person changed while its network request was in flight. The
+    // complete account-owned routing shapes are small and already serialisable;
+    // hashing them also avoids persisting another mutable revision counter.
+    return createHash("sha256").update(JSON.stringify({
+        storageTargets: config.storageTargets ?? null,
+        storageTargetsScope: config.storageTargetsScope ?? null,
+        remoteStorage: config.remoteStorage ?? null,
+    })).digest("hex");
+}
+function normalizedStorageTargetsScope(config) {
+    const scope = config.storageTargetsScope;
+    if (scope?.kind === "local")
+        return { kind: "local" };
+    if (scope?.kind === "account"
+        && (scope.accountScope === null || typeof scope.accountScope === "string")) {
+        return { kind: "account", accountScope: scope.accountScope };
+    }
+    return null;
+}
+const accountStorageTargetsScope = (accountScope) => ({
+    kind: "account",
+    accountScope,
+});
+function sameStorageTargetsScope(left, right) {
+    return left?.kind === right.kind
+        && (left.kind !== "account" || right.kind !== "account" || left.accountScope === right.accountScope);
+}
+/** Read-only local auth state. `signedIn: null` is an unreadable/transitioning
+ * credential store and therefore cannot authorise a legacy unscoped cache. */
+async function localCloudAuthState(dataDir) {
+    const { cloudAuthGeneration, cloudToken } = await import("./cloud.js");
+    let accountScope;
+    try {
+        accountScope = await cloudAuthGeneration(dataDir);
+    }
+    catch {
+        return { accountScope: null, signedIn: null };
+    }
+    try {
+        await cloudToken(dataDir, undefined, { renew: false });
+        return { accountScope, signedIn: true };
+    }
+    catch (error) {
+        return {
+            accountScope,
+            signedIn: isSealkeepError(error) && error.code === "unauthorized" ? false : null,
+        };
+    }
+}
+async function localStorageTargetsAreUsable(dataDir, config, authenticatedAccountScope) {
+    const scope = normalizedStorageTargetsScope(config);
+    if (scope?.kind === "local")
+        return true;
+    if (authenticatedAccountScope !== undefined) {
+        return scope?.kind === "account" && scope.accountScope === authenticatedAccountScope;
+    }
+    const auth = await localCloudAuthState(dataDir);
+    if (scope?.kind === "account") {
+        return auth.signedIn === true && auth.accountScope === scope.accountScope;
+    }
+    // Before this field existed, storageTargets could be either a local setting
+    // or a Cloud cache. Preserve signed-out/local vaults, but never guess while a
+    // Cloud account (or an unreadable auth transition) may own the old rows.
+    return auth.signedIn === false;
+}
+export async function storageTargetAccountBaselineIsCurrent(dataDir, baseline) {
+    return targetPushGenerationMatches(dataDir, { expectedAuthGeneration: baseline.accountScope });
+}
+async function targetPushRoutingMatches(dataDir, options) {
+    if (!options.expectedRoutingFingerprint)
+        return true;
+    try {
+        return routingFingerprint(await readConfig(dataDir)) === options.expectedRoutingFingerprint;
+    }
+    catch {
+        return false;
+    }
+}
+function normalPrefix(prefix) {
+    return (prefix ?? STORAGE_PREFIX_DEFAULT).trim().replace(/^\/+|\/+$/g, "");
+}
+function gdriveCredentialAccountId(credentials) {
+    if (!credentials || !("kind" in credentials) || credentials.kind !== "gdrive")
+        return null;
+    const accountId = typeof credentials.accountId === "string" ? credentials.accountId.trim() : "";
+    return accountId && accountId.length <= 512 && !/[\u0000-\u001f\u007f]/.test(accountId) ? accountId : null;
+}
+/** Stable, serialisable identity used by both credential and copy bindings. */
+export function storageDestinationIdentity(target, effectiveEndpoint = target.endpoint, gdriveAccountId) {
+    if (target.provider === "vaultline")
+        fail("invalid_argument", "Managed storage does not use a local bucket destination identity.");
+    const bucket = (target.bucket ?? "").trim();
+    if (!bucket && target.provider !== "gdrive")
+        fail("invalid_argument", `Storage target "${target.id}" needs a bucket.`);
+    const endpoint = effectiveEndpoint ? parseStorageEndpoint(effectiveEndpoint).origin : null;
+    const hostname = endpoint ? new URL(endpoint).hostname.toLowerCase().replace(/^\[|\]$/g, "") : "";
+    const r2Suffix = ".r2.cloudflarestorage.com";
+    const account = target.provider === "gdrive"
+        ? (gdriveAccountId?.trim() || null)
+        : target.provider === "r2" && hostname.endsWith(r2Suffix)
+            ? hostname.slice(0, -r2Suffix.length) || null
+            : null;
+    return {
+        version: 1,
+        provider: target.provider,
+        bucket,
+        prefix: normalPrefix(target.prefix),
+        region: target.provider === "gcs" || target.provider === "gdrive"
+            ? null
+            : (target.region ?? "auto").trim().toLowerCase(),
+        endpoint,
+        account,
+    };
+}
+/** Hash of a fixed-order tuple, never of user-controlled object key syntax. */
+export function storageDestinationFingerprint(destination) {
+    const canonical = JSON.stringify([
+        destination.version,
+        destination.provider,
+        destination.bucket,
+        destination.prefix,
+        destination.region,
+        destination.endpoint,
+        destination.account,
+    ]);
+    return `dest_${createHash("sha256").update(canonical).digest("hex")}`;
+}
+export async function destinationIdentityForTarget(dataDir, target, credentials) {
+    let accountId = target.provider === "gdrive" ? gdriveCredentialAccountId(credentials) : null;
+    if (target.provider === "gdrive" && !credentials) {
+        const config = await readConfig(dataDir);
+        const ids = [...new Set([target.id, ...(target.id === "primary" ? [config.vaultId] : [])].filter(Boolean))];
+        for (const id of ids) {
+            const record = await loadProviderCredentialRecord(dataDir, id).catch(() => null);
+            accountId = gdriveCredentialAccountId(record?.credentials);
+            if (accountId)
+                break;
+        }
+    }
+    return storageDestinationIdentity(target, await endpointForTarget(dataDir, target), accountId);
+}
+export async function destinationBindingForTarget(dataDir, target, verifiedAt = new Date().toISOString(), credentials) {
+    const destination = await destinationIdentityForTarget(dataDir, target, credentials);
+    return { destination, destinationFingerprint: storageDestinationFingerprint(destination), verifiedAt };
+}
+export async function storeProviderCredentialsForTarget(dataDir, target, credentials, preferred, verifiedAt = new Date().toISOString()) {
+    if (target.provider === "gdrive" && !gdriveCredentialAccountId(credentials)) {
+        fail("invalid_argument", `Google Drive target "${target.id}" has no stable account identity. Disconnect and reconnect it before use.`);
+    }
+    return storeProviderCredentials(dataDir, target.id, credentials, preferred, await destinationBindingForTarget(dataDir, target, verifiedAt, credentials));
+}
+function validDestinationBinding(binding) {
+    return binding.destinationFingerprint === storageDestinationFingerprint(binding.destination);
+}
+/** Provider host information is routing configuration, not a credential, so it
+ * travels with the account target and every machine signs against the same
+ * intended service. This also prevents a stale setup-wide endpoint from being
+ * accidentally reused for a different bucket target. */
+export function endpointOverridesForTarget(target) {
+    if (!target.endpoint)
+        return {};
+    const parsed = parseStorageEndpoint(target.endpoint, `Storage target "${target.id}" endpoint`);
+    return {
+        host: parsed.hostname,
+        ...(parsed.port ? { port: Number(parsed.port) } : {}),
+        protocol: parsed.protocol === "http:" ? "http" : "https",
+        pathStyle: true,
+    };
+}
+/**
+ * The setup wizard predates account-wide targets and kept its endpoint in
+ * setup.json. That value belongs to the one legacy `remoteStorage` target only:
+ * letting it bleed into a named target can sign an R2/S3 request for the right
+ * bucket against the wrong provider host. New targets carry their endpoint in
+ * routing metadata; only the synthesized `primary` target may use this fallback.
+ */
+export async function endpointForTarget(dataDir, target) {
+    if (target.endpoint)
+        return target.endpoint;
+    if (target.id !== "primary")
+        return undefined;
+    try {
+        const { readFile } = await import("node:fs/promises");
+        const { join } = await import("node:path");
+        const setup = JSON.parse(await readFile(join(dataDir, "setup.json"), "utf8"));
+        return typeof setup.storageEndpoint === "string" && setup.storageEndpoint.trim()
+            ? setup.storageEndpoint.trim()
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Effective provider overrides, including the narrowly-scoped legacy fallback. */
+export async function endpointOverridesForResolvedTarget(dataDir, target) {
+    const endpoint = await endpointForTarget(dataDir, target);
+    if (!endpoint)
+        return {};
+    await assertSafeStorageEndpoint(endpoint, target.provider);
+    return endpointOverridesForTarget({ ...target, endpoint });
+}
 const defaultPriority = (target) => target.priority ?? (target.provider === "vaultline" ? 0 : 10);
+function credentialMatches(target, credential) {
+    if (target.provider === "gdrive")
+        return "kind" in credential && credential.kind === "gdrive";
+    if (target.provider === "gcs")
+        return "clientEmail" in credential;
+    return target.provider !== "vaultline" && "accessKeyId" in credential;
+}
 /**
- * The effective target list. Explicit `storageTargets` in config wins;
- * otherwise the single `remoteStorage` entry is the one target; otherwise a
- * vault signed into the cloud account is managed-only — the same ladder the
- * rest of the product climbs.
+ * Provider credentials belong to a machine, while routing rules belong to the
+ * account. New installs address a credential by target id so two BYO targets
+ * cannot overwrite one another; the vault id remains a read fallback only for
+ * the synthesized primary target created by older releases.
  */
-export async function resolveTargets(dataDir) {
+export async function credentialConfigIdForTarget(dataDir, target) {
+    if (target.provider === "vaultline")
+        return null;
     const config = await readConfig(dataDir);
+    // A named account target is an isolation boundary. Two S3-style providers
+    // have the same credential shape, so probing the vault-wide legacy secret
+    // for every target would make a newly-added bucket appear connected with a
+    // different bucket's key. Only the synthesized legacy primary may fall back.
+    const ids = [...new Set([target.id, ...(target.id === "primary" ? [config.vaultId] : [])].filter(Boolean))];
+    const destination = target.provider === "gdrive" ? null : await destinationIdentityForTarget(dataDir, target);
+    const fingerprint = destination ? storageDestinationFingerprint(destination) : null;
+    const actualLegacyPrimary = config.remoteStorage
+        ? { id: "primary", ...config.remoteStorage }
+        : null;
+    const actualLegacyFingerprint = actualLegacyPrimary && actualLegacyPrimary.provider !== "vaultline" && actualLegacyPrimary.provider !== "gdrive"
+        ? storageDestinationFingerprint(await destinationIdentityForTarget(dataDir, actualLegacyPrimary))
+        : null;
+    const synthesizedPrimary = target.id === "primary"
+        && !(config.storageTargets && config.storageTargets.length > 0)
+        && Boolean(config.remoteStorage)
+        && fingerprint === actualLegacyFingerprint;
+    for (const id of ids) {
+        const record = await loadProviderCredentialRecord(dataDir, id).catch(() => null);
+        if (!record || !credentialMatches(target, record.credentials))
+            continue;
+        const candidateDestination = target.provider === "gdrive"
+            ? await destinationIdentityForTarget(dataDir, target, record.credentials)
+            : destination;
+        const candidateFingerprint = candidateDestination
+            ? storageDestinationFingerprint(candidateDestination)
+            : null;
+        // Pre-account-binding Drive grants are readable only so the person can
+        // disconnect them.  Treating one as connected would let a reconnect under
+        // account B read/delete a copy that was actually written under account A.
+        if (target.provider === "gdrive" && !gdriveCredentialAccountId(record.credentials))
+            continue;
+        if (record.binding) {
+            if (validDestinationBinding(record.binding) && record.binding.destinationFingerprint === candidateFingerprint)
+                return id;
+            continue;
+        }
+        // A Drive credential carrying its Google-issued account id can be migrated
+        // without probing or guessing: the credential itself identifies the grant.
+        // Historical credentials without that field take the fail-closed branch
+        // above and require fresh consent.
+        if (target.provider === "gdrive" && candidateDestination && candidateFingerprint) {
+            await storeProviderCredentials(dataDir, id, record.credentials, undefined, {
+                destination: candidateDestination,
+                destinationFingerprint: candidateFingerprint,
+                verifiedAt: null,
+            });
+            return id;
+        }
+        // A raw named credential has no evidence of which account endpoint it was
+        // tested against. Silently blessing today's route would recreate the
+        // target-id repoint vulnerability. The one safe migration is the old
+        // machine-owned `remoteStorage` target: its routing and secret predate the
+        // account-wide mutable target list and were stored together locally.
+        if (synthesizedPrimary && destination) {
+            const binding = {
+                destination,
+                destinationFingerprint: fingerprint,
+                // Unknown is represented honestly; this migration does not pretend a
+                // historical probe happened now.
+                verifiedAt: null,
+            };
+            await storeProviderCredentials(dataDir, id, record.credentials, undefined, binding);
+            return id;
+        }
+    }
+    return null;
+}
+/**
+ * Exact-copy routing guard. New records must match the immutable fingerprint.
+ * Legacy records are accepted only for globally addressed providers without a
+ * custom endpoint; R2/custom S3/Drive account identity is ambiguous and fails
+ * closed until a verified migration can stamp the copy.
+ */
+export async function remoteCopyMatchesTarget(dataDir, target, copy) {
+    if (target.provider === "vaultline")
+        return copy.provider === "vaultline";
+    if (copy.provider !== target.provider || (target.bucket ?? "") !== copy.bucket)
+        return false;
+    const destination = await destinationIdentityForTarget(dataDir, target);
+    const fingerprint = storageDestinationFingerprint(destination);
+    if (copy.destination || copy.destinationFingerprint) {
+        return Boolean(copy.destination && copy.destinationFingerprint
+            && copy.destinationFingerprint === storageDestinationFingerprint(copy.destination)
+            && copy.destinationFingerprint === fingerprint);
+    }
+    const endpoint = await endpointForTarget(dataDir, target);
+    return !endpoint && target.provider !== "r2" && target.provider !== "gdrive";
+}
+/** Whether this particular machine can use an account-wide destination now. */
+export async function targetConnectedOnThisMachine(dataDir, target, options = {}) {
+    options.signal?.throwIfAborted();
+    if (target.provider === "vaultline") {
+        try {
+            const { cloudToken } = await import("./cloud.js");
+            await cloudToken(dataDir, undefined, {
+                renew: options.renewCloudToken !== false,
+                signal: options.signal,
+            });
+            return true;
+        }
+        catch (error) {
+            if (options.signal?.aborted)
+                throw options.signal.reason ?? error;
+            return false;
+        }
+    }
+    const endpoint = await endpointForTarget(dataDir, target);
+    if (target.provider === "r2" && !endpoint)
+        return false;
+    try {
+        if (endpoint)
+            await assertSafeStorageEndpoint(endpoint, target.provider);
+    }
+    catch {
+        return false;
+    }
+    return (await credentialConfigIdForTarget(dataDir, target)) !== null;
+}
+export async function targetConnectionEvidence(dataDir, target, options = {}) {
+    if (target.provider === "vaultline") {
+        const connected = await targetConnectedOnThisMachine(dataDir, target, options);
+        return { connected, status: connected ? "account_session" : "credentials_missing", verifiedAt: null };
+    }
+    const credentialId = await credentialConfigIdForTarget(dataDir, target);
+    if (!credentialId || !(await targetConnectedOnThisMachine(dataDir, target, options))) {
+        return { connected: false, status: "credentials_missing", verifiedAt: null };
+    }
+    const record = await loadProviderCredentialRecord(dataDir, credentialId).catch(() => null);
+    const verifiedAt = record?.binding?.verifiedAt ?? null;
+    return {
+        connected: true,
+        status: verifiedAt ? "credentials_verified" : "credentials_saved",
+        verifiedAt,
+    };
+}
+async function resolveTargetsState(dataDir, options = {}) {
+    let config = await readConfig(dataDir);
+    const expectedLocalRoutingFingerprint = routingFingerprint(config);
     // The account is the source of truth: every machine of the vault syncs the
     // SAME rules down, so a cap set on the laptop holds on the desktop too.
     // The local config is the offline cache; an explicit local list still wins
     // when the account cannot be reached.
-    const fromCloud = await pullTargetsFromCloud(dataDir).catch(() => null);
-    if (fromCloud && fromCloud.length > 0) {
-        if (JSON.stringify(fromCloud) !== JSON.stringify(config.storageTargets ?? null)) {
-            await setStorageTargets(dataDir, fromCloud, { push: false }).catch(() => undefined);
+    const pulled = options.pullFromCloud === false
+        ? null
+        // This boundary is an account-routing read backed by an authenticated
+        // local cache. A timeout makes the remote read unavailable; it does not
+        // invalidate that cache. `pullTargetsFromCloud` itself still propagates
+        // aborts, so write paths which call it directly retain cancellation.
+        : await pullTargetsFromCloud(dataDir, options).catch(() => null);
+    // The Cloud read may be slow. If a person saved a newer route while it was
+    // in flight, neither use nor cache the older reply. Re-resolve strictly from
+    // the latest local config so the action which awaited this read also sees
+    // the newer choice.
+    if (options.pullFromCloud !== false) {
+        const localStillCurrent = await targetPushRoutingMatches(dataDir, {
+            expectedRoutingFingerprint: expectedLocalRoutingFingerprint,
+        });
+        if (!localStillCurrent)
+            return resolveTargetsState(dataDir, { ...options, pullFromCloud: false });
+    }
+    // A target reply is account-owned configuration. If login/logout raced the
+    // request, it must not overwrite this machine's cached routes or be used by
+    // the action which happened to await it.
+    const currentAccountScope = pulled
+        ? await import("./cloud.js").then(({ cloudAuthGeneration }) => cloudAuthGeneration(dataDir)).catch(() => null)
+        : null;
+    const validPulled = pulled && currentAccountScope === pulled.accountScope ? pulled : null;
+    const accountBaseline = validPulled ? {
+        targetsJson: validPulled.rawTargetsJson,
+        updatedAt: validPulled.updatedAt,
+        accountScope: validPulled.accountScope,
+    } : null;
+    const fromCloud = validPulled && validPulled.rawTargetsJson !== null
+        ? validPulled.targets
+        : null;
+    if (fromCloud) {
+        const desired = fromCloud.length > 0 ? fromCloud : undefined;
+        const desiredScope = accountStorageTargetsScope(validPulled.accountScope);
+        if (JSON.stringify(desired ?? null) !== JSON.stringify(config.storageTargets ?? null)
+            || !sameStorageTargetsScope(normalizedStorageTargetsScope(config), desiredScope)) {
+            const cached = await updateConfigFieldsIf(dataDir, (current) => routingFingerprint(current) === expectedLocalRoutingFingerprint, { storageTargets: desired, storageTargetsScope: desiredScope }).catch(() => null);
+            if (!cached?.matched)
+                return resolveTargetsState(dataDir, { ...options, pullFromCloud: false });
+            config = cached.config;
         }
-        return fromCloud;
+        if (fromCloud.length > 0)
+            return { targets: fromCloud, accountBaseline };
+    }
+    if (validPulled && validPulled.rawTargetsJson === null) {
+        const existingScope = normalizedStorageTargetsScope(config);
+        // An authenticated "no row" answer must retire a prior account's cache.
+        // Keep only an explicit machine-local route, or this same account's local
+        // first-save draft whose create request previously failed offline.
+        const keepLocalDraft = Boolean(config.storageTargets?.length)
+            && (existingScope?.kind === "local"
+                || (existingScope?.kind === "account" && existingScope.accountScope === validPulled.accountScope));
+        const desiredScope = accountStorageTargetsScope(validPulled.accountScope);
+        if (!keepLocalDraft && (config.storageTargets !== undefined
+            || !sameStorageTargetsScope(existingScope, desiredScope))) {
+            const cached = await updateConfigFieldsIf(dataDir, (current) => routingFingerprint(current) === expectedLocalRoutingFingerprint, { storageTargets: undefined, storageTargetsScope: desiredScope }).catch(() => null);
+            if (!cached?.matched)
+                return resolveTargetsState(dataDir, { ...options, pullFromCloud: false });
+            config = cached.config;
+        }
+    }
+    // `[]` is an authoritative account reset, distinct from an unavailable
+    // account response (`null`). Do not resurrect this machine's stale cached
+    // routes after another machine removes the explicit list; continue through
+    // the ordinary legacy/managed fallback as if the local setting were absent.
+    const declared = fromCloud === null
+        && await localStorageTargetsAreUsable(dataDir, config, validPulled ? validPulled.accountScope : undefined)
+        ? config.storageTargets
+        : undefined;
+    if (declared && declared.length > 0) {
+        const sanitized = sanitizedStorageTargets(declared);
+        if (!sanitized)
+            fail("invalid_argument", "Stored storage targets are malformed. Review and save the account's destination rules again.");
+        return { targets: sanitized, accountBaseline };
     }
-    const declared = config.storageTargets;
-    if (declared && declared.length > 0)
-        return declared;
     if (config.remoteStorage) {
-        return [{ id: "primary", provider: config.remoteStorage.provider, bucket: config.remoteStorage.bucket, prefix: config.remoteStorage.prefix, region: config.remoteStorage.region }];
+        return {
+            targets: [{ id: "primary", provider: config.remoteStorage.provider, bucket: config.remoteStorage.bucket, prefix: config.remoteStorage.prefix, region: config.remoteStorage.region }],
+            accountBaseline,
+        };
     }
+    if (validPulled)
+        return { targets: [{ id: "managed", provider: "vaultline" }], accountBaseline };
     try {
         const { cloudToken } = await import("./cloud.js");
-        await cloudToken(dataDir);
-        return [{ id: "managed", provider: "vaultline" }];
+        await cloudToken(dataDir, undefined, {
+            renew: options.renewCloudToken !== false,
+            signal: options.signal,
+        });
+        return { targets: [{ id: "managed", provider: "vaultline" }], accountBaseline };
     }
-    catch {
-        return [];
+    catch (error) {
+        if (options.signal?.aborted)
+            throw options.signal.reason ?? error;
+        return { targets: [], accountBaseline };
     }
 }
+export async function resolveTargets(dataDir, options = {}) {
+    return (await resolveTargetsState(dataDir, options)).targets;
+}
+/** One coherent edit view: the effective rows and the exact account revision
+ * they came from. Callers must carry `accountBaseline` unchanged into
+ * `setStorageTargets`; a fresh read at save time would authorise a stale UI. */
+export async function storageTargetsForEditing(dataDir, options = {}) {
+    // A first explicit account edit may also be the first operation on this
+    // machine. Enrol before sampling the baseline so enrolment cannot advance
+    // the auth generation between the edit read and its eventual CAS write.
+    const { machineIdentity } = await import("./cloud.js");
+    await machineIdentity(dataDir).catch(() => null);
+    return resolveTargetsState(dataDir, options);
+}
 /** The account's rules, or null when not signed in / none saved. */
-async function pullTargetsFromCloud(dataDir) {
-    const { cloudToken } = await import("./cloud.js");
-    const token = await cloudToken(dataDir).catch(() => null);
+function sanitizedStorageTarget(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const raw = value;
+    const providers = new Set(["vaultline", "s3", "r2", "b2", "gcs", "gdrive"]);
+    if (typeof raw.id !== "string" || !/^[A-Za-z0-9._-]{1,100}$/.test(raw.id))
+        return null;
+    if (typeof raw.provider !== "string" || !providers.has(raw.provider))
+        return null;
+    const provider = raw.provider;
+    if (raw.enabled !== undefined && typeof raw.enabled !== "boolean")
+        return null;
+    const stringField = (name, max) => {
+        const found = raw[name];
+        if (found === undefined || found === null)
+            return undefined;
+        return typeof found === "string" && found.length > 0 && found.length <= max ? found : null;
+    };
+    const bucket = stringField("bucket", 1024);
+    const prefix = stringField("prefix", 2048);
+    const region = stringField("region", 200);
+    const endpoint = stringField("endpoint", 2048);
+    if (bucket === null || prefix === null || region === null || endpoint === null)
+        return null;
+    if (provider !== "vaultline" && provider !== "gdrive" && !bucket)
+        return null;
+    if (provider === "r2" && !endpoint)
+        return null;
+    if (endpoint) {
+        let parsed;
+        try {
+            parsed = parseStorageEndpoint(endpoint, `Storage target "${raw.id}" endpoint`);
+        }
+        catch {
+            return null;
+        }
+        const hostname = parsed.hostname.toLowerCase().replace(/\.$/, "");
+        if (provider === "r2" && !hostname.endsWith(".r2.cloudflarestorage.com") && !envFlag("ALLOW_PRIVATE_STORAGE_ENDPOINT"))
+            return null;
+    }
+    const numberField = (name, minimum) => {
+        const found = raw[name];
+        if (found === undefined || found === null)
+            return undefined;
+        return typeof found === "number" && Number.isFinite(found) && found >= minimum ? found : null;
+    };
+    const maxGb = numberField("maxGb", 0);
+    const priority = numberField("priority", Number.NEGATIVE_INFINITY);
+    const usedBytes = numberField("usedBytes", 0);
+    if (maxGb === null || priority === null || usedBytes === null)
+        return null;
+    const projects = raw.projects === undefined ? undefined : Array.isArray(raw.projects)
+        ? raw.projects.filter((item) => typeof item === "string" && item.length > 0 && item.length < 200).slice(0, 64)
+        : null;
+    if (projects === null)
+        return null;
+    const target = {
+        id: raw.id,
+        provider,
+        ...(raw.enabled === false ? { enabled: false } : {}),
+        ...(bucket ? { bucket } : {}),
+        ...(prefix ? { prefix } : {}),
+        ...(region ? { region } : {}),
+        ...(endpoint ? { endpoint: parseStorageEndpoint(endpoint).origin } : {}),
+        ...(maxGb !== undefined ? { maxGb } : {}),
+        ...(projects && projects.length > 0 ? { projects } : {}),
+        ...(priority !== undefined ? { priority } : {}),
+        ...(usedBytes !== undefined ? { usedBytes } : {}),
+        ...(typeof raw.usedAt === "string" ? { usedAt: raw.usedAt } : {}),
+    };
+    if (typeof raw.connectionHealth === "object" && raw.connectionHealth !== null && !Array.isArray(raw.connectionHealth)) {
+        const reports = {};
+        for (const [device, report] of Object.entries(raw.connectionHealth).slice(0, 128)) {
+            if (!/^[A-Za-z0-9._:-]{1,200}$/.test(device) || typeof report !== "object" || report === null || Array.isArray(report))
+                continue;
+            const entry = report;
+            if (typeof entry.connected !== "boolean" || typeof entry.checkedAt !== "string")
+                continue;
+            const status = entry.status === "credentials_verified" || entry.status === "credentials_saved"
+                || entry.status === "credentials_missing" || entry.status === "account_session"
+                ? entry.status : undefined;
+            reports[device] = {
+                connected: entry.connected,
+                checkedAt: entry.checkedAt,
+                ...(status ? { status } : {}),
+                ...(entry.verifiedAt === null || typeof entry.verifiedAt === "string" ? { verifiedAt: entry.verifiedAt } : {}),
+                ...(typeof entry.label === "string" ? { label: entry.label.slice(0, 200) } : {}),
+            };
+        }
+        if (Object.keys(reports).length > 0)
+            target.connectionHealth = reports;
+    }
+    return target;
+}
+function sanitizedStorageTargets(values) {
+    if (!Array.isArray(values) || values.length > 100)
+        return null;
+    const targets = values.map(sanitizedStorageTarget);
+    if (targets.some((target) => target === null))
+        return null;
+    const result = targets;
+    if (new Set(result.map((target) => target.id)).size !== result.length)
+        return null;
+    return result;
+}
+async function pullTargetsFromCloud(dataDir, options = {}) {
+    const { cloudAuthGeneration, cloudToken } = await import("./cloud.js");
+    const token = await cloudToken(dataDir, undefined, {
+        renew: options.renewCloudToken !== false,
+        signal: options.signal,
+    }).catch((error) => {
+        if (options.signal?.aborted)
+            throw options.signal.reason ?? error;
+        return null;
+    });
     if (!token)
         return null;
+    // Sample after cloudToken: an action read may renew a near-expiry token, and
+    // renewal legitimately advances the generation before this request begins.
+    const accountScope = await cloudAuthGeneration(dataDir).catch(() => null);
     const { DEFAULT_CLOUD_URL } = await import("./cloud.js");
     const base = (envVar("CLOUD_URL") ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
-    const response = await fetch(`${base}/v1/cloud/storage-targets`, { headers: { authorization: `Bearer ${token}` } });
+    const response = await fetch(`${base}/v1/cloud/storage-targets`, {
+        headers: { authorization: `Bearer ${token}` },
+        signal: options.signal,
+    });
     if (!response.ok)
         return null;
     const body = await response.json();
-    if (!body.targets_json)
+    if (body.targets_json === null || body.targets_json === undefined)
+        return {
+            targets: [],
+            accountScope,
+            rawTargetsJson: null,
+            updatedAt: typeof body.updated_at === "string" ? body.updated_at : null,
+        };
+    if (typeof body.targets_json !== "string")
         return null;
     try {
-        const parsed = JSON.parse(body.targets_json);
-        return Array.isArray(parsed) ? parsed : null;
+        const targets = sanitizedStorageTargets(JSON.parse(body.targets_json));
+        return targets ? {
+            targets,
+            accountScope,
+            // CAS compares the exact value which the server returned. Re-encoding
+            // the parsed array would make harmless whitespace/key-order differences
+            // look like a concurrent update and could never safely authorise PATCH.
+            rawTargetsJson: body.targets_json,
+            updatedAt: typeof body.updated_at === "string" ? body.updated_at : null,
+        } : null;
     }
     catch {
         return null;
@@ -62,51 +654,269 @@ async function pullTargetsFromCloud(dataDir) {
 /** Pushes the rules to the account so every other machine syncs them. Advisory: offline edits still apply locally. */
 /** Re-pushes the current rules with fresh usage stamps — machines are the only
  * ones who can see Drive and BYO bytes, so the account learns them from here. */
-export async function pushTargetUsage(dataDir) {
+export async function pushTargetUsage(dataDir, options = {}) {
     try {
-        const targets = await resolveTargets(dataDir);
-        if (!targets.length)
+        const { cloudAuthGeneration } = await import("./cloud.js");
+        const expectedAuthGeneration = await cloudAuthGeneration(dataDir);
+        const expectedRoutingFingerprint = routingFingerprint(await readConfig(dataDir));
+        // Telemetry is never the operation which renews a session or claims a
+        // machine. Besides being advisory, doing either here advances auth state
+        // and can invalidate a destructive archive action on another lane. The
+        // local fingerprint is only a cancellation guard; routing itself comes
+        // from the account row inside pushTargetsToCloud.
+        if (await cloudAuthGeneration(dataDir) !== expectedAuthGeneration)
+            return;
+        if (routingFingerprint(await readConfig(dataDir)) !== expectedRoutingFingerprint)
             return;
-        await pushTargetsToCloud(dataDir, targets);
+        await pushTargetsToCloud(dataDir, [], {
+            signal: options.signal,
+            renewCloudToken: false,
+            claimMachineIdentity: false,
+            advisoryUsageOnly: true,
+            expectedAuthGeneration,
+            expectedRoutingFingerprint,
+        });
     }
     catch { /* advisory */ }
 }
-export async function pushTargetsToCloud(dataDir, targets) {
+async function pushTargetsToCloudOutcome(dataDir, targets, options = {}) {
     try {
+        if (!await targetPushGenerationMatches(dataDir, options))
+            return "unavailable";
+        if (!await targetPushRoutingMatches(dataDir, options))
+            return "unavailable";
+        // Explicit saves may enrol the machine so its connection evidence has an
+        // account device key. Do that before reading the routing row: enrolment
+        // legitimately advances the local auth generation, and the subsequent
+        // GET must sample the post-enrolment account scope. Advisory telemetry
+        // uses the read-only peek and therefore never mutates auth state.
+        const { machineIdentity, peekMachineCredential } = await import("./cloud.js");
+        const machine = options.claimMachineIdentity === false
+            ? await peekMachineCredential(dataDir).catch(() => null)
+            : await machineIdentity(dataDir).catch(() => null);
+        if (!await targetPushGenerationMatches(dataDir, options))
+            return "unavailable";
+        if (!await targetPushRoutingMatches(dataDir, options))
+            return "unavailable";
+        // A routing write can originate on any signed-in machine. Preserve the
+        // account's newest non-secret telemetry before adding this machine's
+        // observation: a fresh laptop with no local sidecars must never replace a
+        // known positive provider total with zero or erase another device's
+        // connection report. Usage is intentionally monotonic here. Lowering it
+        // requires a provider/account-authoritative reconciliation; one machine's
+        // partial catalog is not enough evidence that shared remote bytes vanished.
+        const pulled = options.advisoryUsageOnly
+            ? await pullTargetsFromCloud(dataDir, options).catch(() => null)
+            : options.accountBaseline
+                ? (() => {
+                    const rawTargetsJson = options.accountBaseline.targetsJson;
+                    if (rawTargetsJson === null)
+                        return {
+                            targets: [], rawTargetsJson: null,
+                            updatedAt: options.accountBaseline.updatedAt,
+                            accountScope: options.accountBaseline.accountScope,
+                        };
+                    try {
+                        const parsed = sanitizedStorageTargets(JSON.parse(rawTargetsJson));
+                        return parsed ? {
+                            targets: parsed, rawTargetsJson,
+                            updatedAt: options.accountBaseline.updatedAt,
+                            accountScope: options.accountBaseline.accountScope,
+                        } : null;
+                    }
+                    catch {
+                        return null;
+                    }
+                })()
+                : null;
+        if (!await targetPushGenerationMatches(dataDir, options))
+            return "unavailable";
+        if (!await targetPushRoutingMatches(dataDir, options))
+            return "unavailable";
+        // PUT is permitted only after a successful authenticated GET proved that
+        // this account has no routing row. A timeout, 5xx, malformed reply, or
+        // missing token is not evidence of absence and must produce no write.
+        if (!pulled)
+            return "unavailable";
+        if (Object.hasOwn(options, "expectedAuthGeneration") && pulled.accountScope !== options.expectedAuthGeneration)
+            return "unavailable";
+        const currentAccountScope = await import("./cloud.js")
+            .then(({ cloudAuthGeneration }) => cloudAuthGeneration(dataDir)).catch(() => null);
+        if (currentAccountScope !== pulled.accountScope)
+            return "unavailable";
+        if (options.advisoryUsageOnly) {
+            // Telemetry is not configuration. It may enrich the exact routing row
+            // it read, but a stale machine must never publish its cached providers,
+            // priority, caps, or project pins. Nor may telemetry create the first
+            // row: that is reserved for an explicit setStorageTargets action.
+            if (pulled.rawTargetsJson === null)
+                return "unavailable";
+            targets = pulled.targets;
+        }
+        else if (pulled.rawTargetsJson !== null) {
+            const remoteById = new Map(pulled.targets.map((target) => [target.id, target]));
+            targets = targets.map((target) => {
+                const remote = remoteById.get(target.id);
+                if (!remote || !sameUsageDestination(target, remote))
+                    return target;
+                const remoteUsed = Number.isFinite(remote.usedBytes) && remote.usedBytes >= 0 ? remote.usedBytes : undefined;
+                const localUsed = Number.isFinite(target.usedBytes) && target.usedBytes >= 0 ? target.usedBytes : undefined;
+                const usedBytes = remoteUsed === undefined ? localUsed : localUsed === undefined ? remoteUsed : Math.max(remoteUsed, localUsed);
+                const usedAt = usedBytes === remoteUsed && remoteUsed !== undefined ? remote.usedAt : target.usedAt;
+                return {
+                    ...target,
+                    ...(usedBytes !== undefined ? { usedBytes } : {}),
+                    ...(usedAt ? { usedAt } : {}),
+                    connectionHealth: {
+                        ...(remote.connectionHealth ?? {}),
+                        ...(target.connectionHealth ?? {}),
+                    },
+                };
+            });
+        }
         const usage = await targetUsage(dataDir, targets).catch(() => null);
+        if (!await targetPushGenerationMatches(dataDir, options))
+            return "unavailable";
+        if (!await targetPushRoutingMatches(dataDir, options))
+            return "unavailable";
         if (usage) {
             const now = new Date().toISOString();
             targets = targets.map((t) => {
                 const used = usage.get(t.id);
-                return used && used > 0 ? { ...t, usedBytes: used, usedAt: now } : t;
+                // A local zero is not proof that a shared/provider destination is
+                // empty. `targetUsage` already preserves the larger account stamp, so
+                // this write can raise the conservative lower bound but never make a
+                // fresh or sparse machine lower it.
+                return used !== undefined ? { ...t, usedBytes: used, usedAt: now } : t;
             });
         }
         const { cloudToken, DEFAULT_CLOUD_URL } = await import("./cloud.js");
-        const token = await cloudToken(dataDir);
+        const token = await cloudToken(dataDir, undefined, { renew: options.renewCloudToken !== false });
+        if (!await targetPushGenerationMatches(dataDir, options))
+            return "unavailable";
+        if (!await targetPushRoutingMatches(dataDir, options))
+            return "unavailable";
+        // Routing is account-wide, but credentials are deliberately machine-local.
+        // Publish only non-secret credential/probe evidence keyed by the enrolled
+        // device. It never becomes a live-reachability claim and never contains a
+        // refresh token, access key, recovery phrase, or local API token.
+        if (!await targetPushGenerationMatches(dataDir, options))
+            return "unavailable";
+        if (!await targetPushRoutingMatches(dataDir, options))
+            return "unavailable";
+        if (machine) {
+            const { hostname } = await import("node:os");
+            const checkedAt = new Date().toISOString();
+            const deviceKey = String(machine.device_id);
+            targets = await Promise.all(targets.map(async (target) => {
+                const evidence = await targetConnectionEvidence(dataDir, target, { renewCloudToken: options.renewCloudToken });
+                return {
+                    ...target,
+                    connectionHealth: {
+                        ...(target.connectionHealth ?? {}),
+                        [deviceKey]: { ...evidence, checkedAt, label: hostname() }
+                    }
+                };
+            }));
+        }
+        if (!await targetPushGenerationMatches(dataDir, options))
+            return "unavailable";
+        if (!await targetPushRoutingMatches(dataDir, options))
+            return "unavailable";
+        if (await import("./cloud.js").then(({ cloudAuthGeneration }) => cloudAuthGeneration(dataDir)).catch(() => null) !== pulled.accountScope)
+            return "unavailable";
         const base = (envVar("CLOUD_URL") ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
+        const targetsJson = JSON.stringify(targets);
         const response = await fetch(`${base}/v1/cloud/storage-targets`, {
-            method: "PUT",
+            // An existing row is always compare-and-set. In particular, a detached
+            // usage report may merge an old snapshot, but it can no longer commit
+            // after another machine has changed that account routing row.
+            method: pulled.rawTargetsJson !== null ? "PATCH" : "PUT",
             headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-            body: JSON.stringify({ targets_json: JSON.stringify(targets) })
+            body: JSON.stringify(pulled.rawTargetsJson !== null
+                ? {
+                    targets_json: targetsJson,
+                    expected_targets_json: pulled.rawTargetsJson,
+                    expected_updated_at: pulled.updatedAt,
+                }
+                : { targets_json: targetsJson }),
+            signal: options.signal,
         });
-        return response.ok;
+        // The request may have committed under account A while this machine
+        // switched to account B (or accepted a newer local route) before fetch
+        // delivered the response. The remote CAS remains a valid A-side commit,
+        // but this caller must not report it as B's synced local state. Returning
+        // unavailable lets setStorageTargets apply its generation fence and
+        // restore the stale local draft without masking a real 409 below.
+        if (!await targetPushGenerationMatches(dataDir, options))
+            return "unavailable";
+        if (!await targetPushRoutingMatches(dataDir, options))
+            return "unavailable";
+        if (await import("./cloud.js").then(({ cloudAuthGeneration }) => cloudAuthGeneration(dataDir)).catch(() => null) !== pulled.accountScope) {
+            return "unavailable";
+        }
+        // A CAS conflict is final for this snapshot. Retrying it as a PUT (or
+        // silently re-reading and merging again) would let stale advisory work
+        // overwrite the user's newer routing choice.
+        if (response.status === 409)
+            return "conflict";
+        return response.ok ? "synced" : "unavailable";
     }
     catch {
-        return false;
+        return "unavailable";
     }
 }
-/** Bytes each target currently holds, from the records: targetId when stamped, provider+bucket for older records. */
+export async function pushTargetsToCloud(dataDir, targets, options = {}) {
+    return await pushTargetsToCloudOutcome(dataDir, targets, options) === "synced";
+}
+/** Non-secret physical identity sufficient for retaining conservative usage
+ * across an account routing write. A changed provider/bucket/prefix/endpoint
+ * starts a new destination instead of inheriting an old destination's total. */
+function sameUsageDestination(left, right) {
+    return left.provider === right.provider
+        && (left.bucket ?? "") === (right.bucket ?? "")
+        && normalPrefix(left.prefix) === normalPrefix(right.prefix)
+        && (left.region ?? "") === (right.region ?? "")
+        && (left.endpoint ?? "") === (right.endpoint ?? "");
+}
+/** Bytes each target currently holds. A mutable display id is never enough to
+ * attribute a copy: the record must still name the target's immutable physical
+ * destination (or pass the deliberately narrow legacy compatibility rule). */
 export async function targetUsage(dataDir, targets) {
     const usage = new Map(targets.map((target) => [target.id, 0]));
     const records = await listArchives(dataDir).catch(() => []);
     for (const record of records) {
-        if (!isV2(record) || !record.remote)
+        if (!isV2(record))
             continue;
-        const stamped = record.remote.targetId;
-        const match = (stamped && targets.find((target) => target.id === stamped))
-            ?? targets.find((target) => target.provider === record.remote.provider && (target.provider === "vaultline" || target.bucket === record.remote.bucket));
-        if (match)
-            usage.set(match.id, (usage.get(match.id) ?? 0) + (record.remote.bytes ?? 0));
+        for (const copy of archiveCopies(record)) {
+            let match;
+            // Prefer the recorded label only as a lookup hint. The label can be
+            // repointed account-wide, so immutable destination matching remains the
+            // authority before usage affects limits or account health.
+            const stamped = copy.targetId ? targets.find((target) => target.id === copy.targetId) : undefined;
+            if (stamped && await remoteCopyMatchesTarget(dataDir, stamped, copy))
+                match = stamped;
+            if (!match) {
+                for (const target of targets) {
+                    if (target === stamped)
+                        continue;
+                    if (await remoteCopyMatchesTarget(dataDir, target, copy)) {
+                        match = target;
+                        break;
+                    }
+                }
+            }
+            if (match)
+                usage.set(match.id, (usage.get(match.id) ?? 0) + (copy.bytes ?? 0));
+        }
+    }
+    // Local records are a lower bound on a multi-machine/provider total. Keep a
+    // larger account-reported value rather than allowing a sparse/fresh machine
+    // to route beyond the configured cap.
+    for (const target of targets) {
+        if (Number.isFinite(target.usedBytes) && target.usedBytes >= 0) {
+            usage.set(target.id, Math.max(usage.get(target.id) ?? 0, target.usedBytes));
+        }
     }
     return usage;
 }
@@ -124,44 +934,142 @@ export async function chooseTarget(dataDir, input) {
         const named = targets.find((target) => target.id === input.targetId);
         if (!named)
             fail("invalid_argument", `No storage target named "${input.targetId}". Targets: ${targets.map((target) => target.id).join(", ")}`);
+        if (named.enabled === false) {
+            fail("storage_not_configured", `Storage target "${named.id}" is paused for new archives. Resume it before copying an archive there.`);
+        }
+        if (input.requireManaged && named.provider !== "vaultline") {
+            fail("storage_not_configured", "Shared project memory must be stored in Sealkeep Cloud so every approved member can reach the same encrypted archive.");
+        }
+        if (input.requireChunkCapable && named.provider === "gdrive") {
+            fail("storage_not_configured", `Storage target "${named.id}" cannot accept streamed chunk archives.`);
+        }
+        if (!(await targetConnectedOnThisMachine(dataDir, named))) {
+            fail("storage_not_configured", `Storage target "${named.id}" is not connected on this machine. Reconnect it before copying an archive there.`);
+        }
+        if (named.maxGb !== undefined) {
+            const used = (await targetUsage(dataDir, targets)).get(named.id) ?? 0;
+            if (used + input.bytes > named.maxGb * 1024 ** 3) {
+                fail("storage_not_configured", `Storage target "${named.id}" is at its ${named.maxGb} GB limit. Choose another destination or raise its cap.`);
+            }
+        }
         return named;
     }
     const usage = await targetUsage(dataDir, targets);
+    const connected = new Map(await Promise.all(targets.map(async (target) => [target.id, await targetConnectedOnThisMachine(dataDir, target)])));
     const eligible = targets.filter((target) => {
+        if (target.enabled === false)
+            return false;
+        if (input.requireManaged && target.provider !== "vaultline")
+            return false;
         if (input.requireChunkCapable && target.provider === "gdrive")
             return false;
         if (target.maxGb !== undefined && (usage.get(target.id) ?? 0) + input.bytes > target.maxGb * 1024 ** 3)
             return false;
+        // A Drive/bucket rule can be valid account-wide but unavailable on this
+        // machine. Automatic routing falls through to the next connected target;
+        // otherwise an unattended daemon retries the same impossible first rule
+        // forever while a working managed destination sits underneath it.
+        if (!connected.get(target.id))
+            return false;
         return true;
     });
     if (eligible.length === 0) {
-        fail("storage_not_configured", "Every storage target is either full (maxGb reached) or unable to take this seal. Raise a limit or add a target.");
+        if (input.requireManaged) {
+            fail("storage_not_configured", "Shared project memory needs an available Sealkeep Cloud destination. Add it to this account's storage routes or raise its limit.");
+        }
+        fail("storage_not_configured", "No destination on this machine can take this archive: each target is paused, disconnected, full, or incompatible. Resume or reconnect a destination, or change the routing order.");
     }
-    const pinScore = (target) => (input.project && target.projects?.includes(input.project) ? 0 : 1);
+    const pinScore = (target) => ((input.projectKey && target.projects?.includes(input.projectKey))
+        || (input.project && target.projects?.includes(input.project))
+        ? 0
+        : 1);
     eligible.sort((a, b) => pinScore(a) - pinScore(b) || defaultPriority(a) - defaultPriority(b));
     return eligible[0];
 }
 /** Persist an explicit target list. Empty array removes the setting (back to single remoteStorage / managed). */
 export async function setStorageTargets(dataDir, targets, options = {}) {
-    const { readFile, writeFile } = await import("node:fs/promises");
-    const { join } = await import("node:path");
-    const path = join(dataDir, "config.json");
-    const config = JSON.parse(await readFile(path, "utf8"));
-    if (targets.length === 0)
-        delete config.storageTargets;
-    else {
-        const ids = new Set();
-        for (const target of targets) {
-            if (!target.id || ids.has(target.id))
-                fail("invalid_argument", "Every storage target needs a unique id");
-            ids.add(target.id);
-            if (target.provider !== "vaultline" && target.provider !== "gdrive" && !target.bucket) {
-                fail("invalid_argument", `Target "${target.id}" (${target.provider}) needs a bucket`);
-            }
+    let savedTargets;
+    if (targets.length > 0) {
+        const sanitized = sanitizedStorageTargets(targets);
+        if (!sanitized)
+            fail("invalid_argument", "Storage targets must have unique ids and valid provider, bucket, endpoint, routing, and health fields.");
+        targets = sanitized;
+        savedTargets = sanitized;
+    }
+    // A dashboard/CLI draft belongs to the Cloud login which produced its edit
+    // snapshot. Reject an already-stale draft before it can alter even the local
+    // routing cache. A second fence after the write handles a transition which
+    // begins between this read and the config-file transaction.
+    if (options.accountBaseline
+        && !await storageTargetAccountBaselineIsCurrent(dataDir, options.accountBaseline)) {
+        return {
+            localSaved: false,
+            accountSynced: false,
+            accountConflict: true,
+            accountStale: true,
+        };
+    }
+    const before = await readConfig(dataDir);
+    const storageTargetsScope = options.accountBaseline
+        ? accountStorageTargetsScope(options.accountBaseline.accountScope)
+        : options.push === false
+            ? { kind: "local" }
+            : normalizedStorageTargetsScope(before) ?? { kind: "local" };
+    const saved = await updateConfigFields(dataDir, { storageTargets: savedTargets, storageTargetsScope });
+    const expectedRoutingFingerprint = routingFingerprint(saved);
+    const restoreBeforeIfOwned = async () => {
+        await updateConfigFieldsIf(dataDir, (current) => routingFingerprint(current) === expectedRoutingFingerprint, {
+            storageTargets: before.storageTargets,
+            storageTargetsScope: before.storageTargetsScope,
+        }).catch(() => null);
+    };
+    if (options.accountBaseline
+        && !await storageTargetAccountBaselineIsCurrent(dataDir, options.accountBaseline)) {
+        await restoreBeforeIfOwned();
+        return {
+            localSaved: false,
+            accountSynced: false,
+            accountConflict: true,
+            accountStale: true,
+        };
+    }
+    if (options.push === false)
+        return { localSaved: true, accountSynced: null };
+    // No baseline means the account could not be read (or an older caller did
+    // not carry the edit snapshot). Keep the useful offline local save, but do
+    // not turn a fresh GET at save time into permission to overwrite somebody
+    // else's newer account rules.
+    if (!options.accountBaseline)
+        return { localSaved: true, accountSynced: false };
+    const outcome = await pushTargetsToCloudOutcome(dataDir, targets, {
+        expectedRoutingFingerprint,
+        expectedAuthGeneration: options.accountBaseline.accountScope,
+        accountBaseline: options.accountBaseline,
+    });
+    if (outcome === "synced")
+        return { localSaved: true, accountSynced: true };
+    if (outcome === "unavailable") {
+        if (options.accountBaseline
+            && !await storageTargetAccountBaselineIsCurrent(dataDir, options.accountBaseline)) {
+            await restoreBeforeIfOwned();
+            return {
+                localSaved: false,
+                accountSynced: false,
+                accountConflict: true,
+                accountStale: true,
+            };
         }
-        config.storageTargets = targets;
+        return { localSaved: true, accountSynced: false };
     }
-    await writeFile(path, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
-    if (options.push !== false)
-        await pushTargetsToCloud(dataDir, targets);
+    // A stale edit must not leave this machine following C while the account
+    // correctly retained B. First try to load/cache B. If that read happens to
+    // fail, restore the pre-edit local A only if nobody made a newer local edit
+    // after C; either is safer than silently activating the rejected draft.
+    const refreshed = await resolveTargetsState(dataDir).catch(() => null);
+    // Content equality is not a freshness signal: another machine may have
+    // legitimately changed B to the same C this stale editor attempted. A
+    // non-null baseline proves that the recovery GET succeeded even in that case.
+    if (!refreshed?.accountBaseline)
+        await restoreBeforeIfOwned();
+    return { localSaved: false, accountSynced: false, accountConflict: true };
 }