restore reproduces the stack as an internal stack with its secrets

src/routes/api/backup/restore/+server.ts

@@ -21,6 +21,10 @@ export const POST: RequestHandler = async (event) => {
 	const postRestore = ['start', 'recreate', 'redeploy', 'none'].includes(body.postRestore) ? body.postRestore : undefined;
 	// New-location clone: per-volume destinations on the target env.
 	const volumeDestinations = Array.isArray(body.volumeDestinations) ? body.volumeDestinations : undefined;
+	// Stack restore: reproduce the stack's secrets carried in the snapshot (default on).
+	// The client sends false to bring the stack up without them. Only a stack redeploy
+	// consumes this; container restores ignore it.
+	const restoreSecrets = body.restoreSecrets !== false;
 
 	// Authorization gates run BEFORE request validation, so an unauthorized caller
 	// never learns anything about the request shape.
@@ -71,6 +75,7 @@ export const POST: RequestHandler = async (event) => {
 				targetName: body.targetName ?? null,
 				postRestore,
 				volumeDestinations,
+				restoreSecrets,
 			},
 			access,
 			// Stream progress to the client (the restore modal's log). Without this the

src/routes/api/backup/snapshots/[id]/metadata/+server.ts

@@ -28,7 +28,15 @@ export const GET: RequestHandler = async ({ params, url, cookies }) => {
 	try {
 		const metadata = await getSnapshotMetadata(destinationId, snapshotId);
 		if (!metadata) return json({ error: 'No metadata available' }, { status: 404 });
-		return json(metadata);
+		// Never expose the stored secret VALUES (ciphertext) to the client — replace the
+		// `secrets` array with `secretKeys` (names only) so the UI can list them.
+		const { secrets, ...safe } = metadata as Record<string, unknown>;
+		if (Array.isArray(secrets)) {
+			(safe as Record<string, unknown>).secretKeys = secrets
+				.map((s: any) => s?.key)
+				.filter((k: unknown): k is string => typeof k === 'string');
+		}
+		return json(safe);
 	} catch (error) {
 		const msg = error instanceof Error ? error.message : String(error);
 		return json({ error: msg }, { status: 500 });