sealkeep 0.5.0

package/dist/src/cli.js

@@ -0,0 +1,2035 @@
+#!/usr/bin/env node
+import { writeFile } from "node:fs/promises";
+import { archiveFile, configureRemoteStorage, defaultDataDir, initialize, listArchives, readConfig, vaultStatus, addRecipient, removeRecipient } from "./vault.js";
+import { restoreArchive } from "./restore.js";
+import { detectAgents, findTranscripts, hookConfig, hookEventFromStdin } from "./adapters.js";
+import { setupVault } from "./onboarding.js";
+import { providers } from "./control-plane.js";
+import { ArchiveQueue } from "./queue.js";
+import { drainQueue } from "./worker.js";
+import { runDoctor } from "./doctor.js";
+import { localApiTokenPath } from "./local-api.js";
+import { startUi, readUiRecord, DEFAULT_UI_PORT, DISPLAY_HOST } from "./ui-server.js";
+import { enroll } from "./enroll.js";
+import { freePort } from "./net.js";
+import { errorPayload, fail, isVaultlineError } from "./errors.js";
+import { DRIVE_FOLDER_DEFAULT, PRODUCT_MARK, PRODUCT_NAME } from "./branding.js";
+import { migrateVault, rewrapVault } from "./migrate.js";
+import { uploadArchive, uploadPending } from "./upload.js";
+import { applyRetention, approveReclamation, evaluateRetention, pruneRedundantArchives, retentionSettings, setRetentionPolicy } from "./retention.js";
+import { startDaemon } from "./daemon.js";
+import { applySyncRules, describeSyncRules, resolveSyncRules } from "./sync-rules.js";
+import { buildContentIndex, dropContentIndex, search } from "./search.js";
+import { readAudit, toCsv } from "./audit.js";
+import { deleteProviderCredentials, loadProviderCredentials, storeProviderCredentials } from "./secrets.js";
+import { keyRecipientId, rawPublicKey } from "../packages/vaultline-crypto/src/index.js";
+import { generateKeyPairSync } from "node:crypto";
+import { hostname } from "node:os";
+import { readFile } from "node:fs/promises";
+import { runTui } from "./tui.js";
+import { assertNotDowngrade, verifyArtifact, verifyManifest } from "./update.js";
+import { autopilotStatus, disableAutopilot, enableAutopilot } from "./autopilot.js";
+import { liveness, readHeartbeat } from "./heartbeat.js";
+import { hasPasswordLock, unwrapPhrase, wrapPhrase } from "./password-lock.js";
+import { isMnemonic, PHRASE_WORDS, promptForPhrase, recoveryKit, verifyAgainstVault } from "./recovery.js";
+import { setupPlan } from "./storage-setup.js";
+import { connectGdrive } from "./providers/gdrive.js";
+import { resolveRecoveryPhrase } from "./secrets.js";
+import { amber, bold, blue, bytes, callout, command as cmd, dim, green, heading, hint, keyValue, mark, relativeTime, shortPath, steps, table, vaultline } from "./ui.js";
+const VALUE_FLAGS = new Set(["--data-dir", "--recovery-phrase", "--agent", "--home", "--limit", "--executable", "--provider", "--bucket", "--prefix", "--region", "--older-than-days", "--status", "--max", "--port", "--overwrite", "--label", "--public-key", "--config-id", "--backend", "--endpoint", "--policy", "--grace-days", "--interval", "--manifest", "--artifact", "--key", "--current", "--api", "--token", "--group", "--cli-path", "--account-id", "--project", "--out", "--password"]);
+function take(args, flag, fallback) { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : fallback; }
+function positionals(args) { return args.filter((value, index) => !value.startsWith("-") && !VALUE_FLAGS.has(args[index - 1] ?? "")); }
+function required(value, message) { if (!value)
+    fail("invalid_argument", message); return value; }
+function agentId(value) { const agent = required(value, "Agent must be codex or claude"); if (agent !== "codex" && agent !== "claude")
+    fail("invalid_argument", "Agent must be codex or claude"); return agent; }
+/** Flag, then environment, then this machine's keystore — then, at a terminal, the vault password if one was set. */
+async function unlock(dataDir, explicit) {
+    const config = await readConfig(dataDir).catch(() => null);
+    if (!config)
+        return explicit ?? process.env.VAULTLINE_RECOVERY_PHRASE;
+    const resolved = await resolveRecoveryPhrase(dataDir, config.vaultId, explicit);
+    if (resolved)
+        return resolved;
+    // A person at a terminal can trade the vault password for the phrase; a
+    // script cannot type one, so non-interactive callers keep the failure and
+    // the instructions they have always had.
+    if (process.stdin.isTTY && (await hasPasswordLock(dataDir))) {
+        const phrase = await unwrapPhrase(dataDir, await promptForPhrase("Vault password: "));
+        if (phrase !== null)
+            return phrase;
+        fail("recovery_phrase_mismatch", "That password does not open this vault. Nothing has changed.");
+    }
+    return undefined;
+}
+function readStdin() { return new Promise((done) => { let input = ""; process.stdin.setEncoding("utf8"); process.stdin.on("data", (chunk) => { input += chunk; }); process.stdin.on("end", () => done(input)); }); }
+const BRAND = `${blue(PRODUCT_MARK)} ${bold(PRODUCT_NAME)}`;
+const print = (...lines) => console.log(lines.join("\n"));
+/**
+ * The one screen the whole product depends on.
+ *
+ * The phrase is the only secret that cannot be reissued, reset, or recovered
+ * from anywhere — and until now it went past as a single line of prose in the
+ * middle of a successful command's output, which is how people lose it. Three
+ * things are being fixed here, all of them about transcription rather than
+ * decoration:
+ *
+ * - The words are numbered and laid out in the same three columns as the
+ *   printed sheet `sealkeep recovery kit` produces, so copying from screen to
+ *   paper is position-for-position rather than a re-reading of a long sentence.
+ * - What happens if it is lost is stated as a consequence, not a caveat.
+ *   "Shown once, never stored" describes our behaviour; "nobody can open your
+ *   archives, ever, including us" describes theirs.
+ * - The two commands that make the copy real — verify it, print a sheet for it
+ *   — are named right underneath, because the moment someone will act on that
+ *   advice is this one.
+ *
+ * A phrase supplied with --recovery-phrase may not be 24 words at all, so the
+ * grid is used only for a real mnemonic and anything else prints as one line.
+ */
+function recoveryPhraseScreen(phrase) {
+    const words = phrase.trim().split(/\s+/);
+    const rows = Math.ceil(PHRASE_WORDS / 3);
+    const width = Math.max(...words.map((word) => word.length));
+    const cell = (index) => (words[index] ? `${String(index + 1).padStart(2, " ")}. ${bold(words[index].padEnd(width))}` : "");
+    const grid = isMnemonic(phrase)
+        ? Array.from({ length: rows }, (_, row) => [cell(row), cell(row + rows), cell(row + rows * 2)].filter(Boolean).join("   ").trimEnd())
+        : [bold(phrase)];
+    return [
+        callout(`Recovery phrase — write ${isMnemonic(phrase) ? `these ${words.length} words` : "this"} down now`, [
+            ...grid,
+            "",
+            dim("Shown once. It is not stored anywhere, so this is the only time"),
+            dim("it can be displayed — not by another command, not by support."),
+            "",
+            dim("Lose it and every archive stays sealed forever. Nobody can open"),
+            dim("them: not you, not us, not whoever holds the storage bucket.")
+        ]),
+        "",
+        keyValue([
+            ["Check your copy", cmd("sealkeep recovery verify")],
+            ["Print a sheet", cmd("sealkeep recovery kit --out recovery-kit.txt")]
+        ])
+    ].join("\n");
+}
+/**
+ * Holds the phrase on screen until a person says they have written it down.
+ *
+ * Only when a person is actually watching: without a TTY there is nobody to
+ * press a key, so a script, a hook, or CI would hang forever waiting for one.
+ */
+async function pauseUntilWrittenDown() {
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        return;
+    const { createInterface } = await import("node:readline/promises");
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        await rl.question(`\n  ${dim("press enter once you have written it down")} `);
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * What a browser-opening command says for itself.
+ *
+ * The URL carries the bearer token in its fragment (see uiUrl in
+ * ui-server.ts), so it is deliberately *not* printed on the path where a
+ * browser did open: scrollback outlives the session, gets pasted into issues,
+ * and is captured whole by `script` and CI logs. The origin alone is enough to
+ * tell someone where their window is.
+ *
+ * When no browser could be opened, the same reasoning inverts: a server nobody
+ * can reach is worse than a token in scrollback, so the full URL is printed
+ * with what it is plainly labelled.
+ */
+function printUi(handle, dataDir, options = {}) {
+    const where = bold(handle.origin.replace("http://", ""));
+    // Branded when it is the whole command; a plain line when it is the last
+    // step of one that has already introduced itself.
+    print(options.brand === false
+        ? `\n  ${handle.reused ? "Already open at" : "Settings window on"} ${where}`
+        : `\n${BRAND}  ${handle.reused ? "already running on" : "settings on"} ${where}`);
+    if (handle.browser.opened) {
+        print(`  ${mark.ok()} Opened in your browser.`);
+        print(`  ${dim(`Nothing opened? Visit ${handle.origin} and paste the token from ${shortPath(localApiTokenPath(dataDir), 46)}`)}`);
+    }
+    else {
+        // `--no-browser` is a choice; warning that a browser "could not be opened"
+        // would report a failure that never happened.
+        if (!handle.browser.declined)
+            print(`  ${mark.warn()} ${(handle.browser.problem ?? "No browser could be opened").replace(/\.$/, "")}.`);
+        print(`  ${dim("Open this link yourself. It carries the key to this window, so keep it off shared screens:")}`);
+        print(`  ${handle.url}`);
+    }
+    if (handle.reused) {
+        print(`  ${dim(`Started ${handle.running?.startedAt ? relativeTime(handle.running.startedAt) : "earlier"} by process ${handle.running?.pid ?? "?"}. Stop it there, not here.`)}`);
+        return;
+    }
+    print(`  ${dim("Ctrl-C to stop. The window stops working when you do.")}\n`);
+}
+/** Closes the UI on the way out, so the next run does not find a record pointing at nothing. */
+function holdUntilStopped(handle) {
+    for (const signal of ["SIGINT", "SIGTERM"]) {
+        process.on(signal, () => { void handle.close().then(() => process.exit(0)); });
+    }
+}
+const statusMark = (status) => (status === "pass" || status === "done" ? mark.ok() : status === "fail" || status === "failed" ? mark.fail() : status === "warn" ? mark.warn() : dim(status));
+/** Leading glyph for a quota line — silent at "ok", since a plain number is not a warning. */
+const quotaMarker = (level) => (level === "over" ? `${mark.fail()} ` : level === "ok" ? "" : `${mark.warn()} `);
+function usage() {
+    return [
+        `\n${BRAND}  ${dim("keep your agent history, not the disk usage")}`,
+        heading("Start here"),
+        keyValue([
+            ["start", "first run: choose free or paid, get your recovery phrase"],
+            ["enroll <code>", "set this machine up from the code in your account panel"],
+            ["ui", "open the settings window in your browser"],
+            ["autopilot", "set it up once and let it run itself"],
+            ["quickstart", "set up and queue existing sessions, without a background service"],
+            ["setup", "create a vault and a recovery kit"],
+            ["status", "what is archived, queued, and pending"],
+            ["doctor", "check this machine end to end"]
+        ]),
+        heading("Everyday"),
+        keyValue([
+            ["queue run", "encrypt everything waiting (needs the recovery phrase)"],
+            ["daemon", "watch, archive, upload, and reclaim continuously"],
+            ["archive <file>", "seal one file into the vault by hand"],
+            ["archive <file> --stream", "seal straight into your bucket, no local ciphertext"],
+            ["archive <file> --stream --fresh", "abandon an interrupted streamed upload and start over"],
+            ["scan <path>", "find pasted secrets in transcripts before they are sealed in"],
+            ["list", "browse archives"],
+            ["search <query>", "search metadata, or contents with --content"],
+            ["index build", "build the local content index that --content searches"],
+            ["index status", "what is searchable and what is not yet indexed"],
+            ["storage targets", "several storages at once, with limits, pins, and priority"],
+            ["mcp install", "let your agents search this history themselves"],
+            ["recover <id> <dest>", "restore original bytes; --native puts it back where it came from"],
+            ["recover <session-file>", "agent says a session file is missing? name it and it goes back where resume expects it"],
+            ["tui", "the same view in the terminal"]
+        ]),
+        heading("Storage and retention"),
+        keyValue([
+            ["cloud login/status", "sign in to managed storage (--code for a Google account), or check usage"],
+            ["cloud push <id>", "send one archive to managed storage"],
+            ["cloud archives", "list what managed storage is holding"],
+            ["cloud pull <ref> <dest>", "fetch one archive back out of managed storage"],
+            ["open <ref> <dest>", "fetch and decrypt one archive, on any machine"],
+            ["plans", "what the storage packages cost"],
+            ["verify", "prove every stored archive can still be read back"],
+            ["storage setup", "guided setup for S3, R2, GCS, or Google Drive"],
+            ["storage configure", "choose a bucket and prefix"],
+            ["storage connect gdrive", "sign in to Google Drive (drive.file: it sees only what it created)"],
+            ["storage credentials", "store provider keys in the OS keychain"],
+            ["upload --all", "upload and verify pending archives"],
+            ["retention policy", "decide when sources may be reclaimed"],
+            ["retention apply", "dry run; add --confirm to move sources to the trash"],
+            ["retention prune", "drop snapshots a newer archive already contains"],
+            ["retention offload", "remove local archives your bucket already holds"]
+        ]),
+        heading("Keys and trust"),
+        keyValue([
+            ["recovery seal", "store a sealed copy of your key with your account"],
+            ["recovery open", "read that sealed copy back, with your phrase"],
+            ["device keygen", "mint a device key"],
+            ["recipients", "list, add, or remove who can open new archives"],
+            ["rewrap", "apply the current recipient set to existing archives"],
+            ["recovery kit", "printable sheet for your recovery words"],
+            ["phrase rotate", "new recovery phrase; every archive re-keyed, nothing re-encrypted"],
+            ["password change", "new vault password; the phrase never appears"],
+            ["share <id>", "one archive as a bundle a passcode opens — no vault needed"],
+            ["recovery verify", "check the copy you wrote down still works"],
+            ["audit", "what Sealkeep did to your files"],
+            ["autopilot status/off", "check on, or stop, the background service"],
+            ["agents hook-config", "print a reviewable hook snippet"]
+        ]),
+        `\n${dim("Add --json to any command for machine-readable output.")}`,
+        `${dim("Docs:")} README.md ${dim("·")} ${dim("Security:")} THREAT_MODEL.md\n`
+    ].join("\n");
+}
+async function main() {
+    const [command, ...args] = process.argv.slice(2);
+    const dataDir = take(args, "--data-dir", defaultDataDir());
+    const json = args.includes("--json");
+    // --version is the first thing anyone types at an unfamiliar CLI, and it was
+    // answering "Unknown command". Read it from the manifest rather than hardcoding
+    // a second copy that can drift from what npm actually published.
+    if (command === "--version" || command === "-v" || command === "version") {
+        // The manifest sits one level up from dist/src but two from src/, so a fixed
+        // relative path is right in exactly one of dev and the published package.
+        // Walk up until we find our own manifest instead.
+        const { readFile } = await import("node:fs/promises");
+        const { dirname, join } = await import("node:path");
+        const { fileURLToPath } = await import("node:url");
+        let dir = dirname(fileURLToPath(import.meta.url));
+        let manifest = null;
+        for (let up = 0; up < 5 && !manifest; up += 1) {
+            try {
+                const found = JSON.parse(await readFile(join(dir, "package.json"), "utf8"));
+                if (found?.name === "sealkeep" || found?.name === "vaultline")
+                    manifest = found;
+            }
+            catch { /* keep walking */ }
+            dir = dirname(dir);
+        }
+        if (!manifest)
+            fail("internal", "Could not read the Sealkeep package manifest");
+        print(json ? JSON.stringify({ name: manifest.name, version: manifest.version }, null, 2) : `${manifest.name} ${manifest.version}`);
+        return;
+    }
+    if (command === "help" || command === "--help" || command === "-h") {
+        print(usage());
+        return;
+    }
+    /**
+     * A bare `vaultline` on a machine with no vault is somebody who has just run
+     * `npm i -g vaultline`. Setting this product up belongs in a window, not in a
+     * wall of commands, so that case opens one.
+     *
+     * Three deliberate limits. An existing vault still prints help, because
+     * anyone who has got that far is using the CLI on purpose and having it
+     * launch a browser would be obnoxious. No TTY means a script, a hook, CI or
+     * an SSH session, and none of those can be left holding a foreground server
+     * waiting for a browser that will never open. And `--help` above still wins,
+     * so there is always a way to see the commands.
+     */
+    if (!command) {
+        const configured = await readConfig(dataDir).then(() => true).catch(() => false);
+        if (configured || !process.stdout.isTTY) {
+            print(usage());
+            return;
+        }
+        const handle = await startUi(dataDir, { port: 0 });
+        printUi(handle, dataDir);
+        if (handle.reused)
+            return;
+        holdUntilStopped(handle);
+        return;
+    }
+    if (command === "autopilot") {
+        const [action] = positionals(args);
+        if (action === "status") {
+            const status = await autopilotStatus(dataDir);
+            if (json) {
+                print(JSON.stringify(status, null, 2));
+                return;
+            }
+            const liveMark = status.live.state === "running" ? green("running") : status.live.state === "late" ? amber("late") : dim(status.live.state.replace("-", " "));
+            // The generic "never started" advice is wrong once the service exists: it is
+            // installed and simply has not reached its first check yet.
+            const liveDetail = status.running && status.live.state === "never-started"
+                ? "Installed. Waiting for its first check, which happens at login or within a minute."
+                : status.live.detail;
+            print(`\n${BRAND}  ${status.running ? green("autopilot on") : dim("autopilot off")}\n`);
+            print(keyValue([
+                ["Right now", `${status.running && status.live.state === "never-started" ? dim("waiting") : liveMark}  ${dim(liveDetail)}`],
+                ["Done so far", status.live.totals ? `${status.live.totals.archived} sealed ${dim("·")} ${status.live.totals.uploaded} uploaded ${dim("·")} ${status.live.totals.reclaimed} reclaimed${status.live.totals.failed ? ` ${dim("·")} ${mark.warn()} ${status.live.totals.failed} failed` : ""}` : dim("nothing yet")],
+                ["Service", status.running ? `${status.service.kind} ${dim(`· ${shortPath(status.service.path, 52)}`)}` : dim("not installed")],
+                ["Unlocks itself", status.phraseAvailable ? `${mark.ok()} yes` : `${mark.warn()} no — sessions will queue but stay unsealed`],
+                ["Policy", `${status.retention.policy} ${dim(`· older than ${status.retention.olderThanDays}d · ${status.retention.graceDays}d grace`)}`],
+                ["Bucket", status.hasRemoteTarget ? "configured" : dim("none — nothing will be reclaimed")],
+                ["Queue", `${status.queue.ready} waiting ${dim("·")} ${status.queue.done} sealed`]
+            ]));
+            print("");
+            return;
+        }
+        if (action === "off") {
+            const result = await disableAutopilot(dataDir);
+            if (json) {
+                print(JSON.stringify(result, null, 2));
+                return;
+            }
+            print(`\n  ${mark.ok()} Autopilot off. The service is removed${result.forgotPhrase ? " and this machine has forgotten your phrase" : ""}.`);
+            print(`  ${dim("Every archive is still here. Nothing was deleted.")}\n`);
+            return;
+        }
+        const dryRun = args.includes("--dry-run");
+        const result = await enableAutopilot(dataDir, {
+            phrase: take(args, "--recovery-phrase"),
+            remember: !args.includes("--no-remember"),
+            reclaim: !args.includes("--no-reclaim"),
+            olderThanDays: take(args, "--older-than-days") ? Number(take(args, "--older-than-days")) : undefined,
+            graceDays: take(args, "--grace-days") ? Number(take(args, "--grace-days")) : undefined,
+            home: take(args, "--home"),
+            dryRun
+        });
+        if (json) {
+            print(JSON.stringify(result, null, 2));
+            return;
+        }
+        print(`\n${BRAND}\n`);
+        if (result.recoveryPhrase) {
+            print(recoveryPhraseScreen(result.recoveryPhrase));
+            await pauseUntilWrittenDown();
+        }
+        print(heading(dryRun ? "What would happen" : "Autopilot is on"));
+        print(keyValue([
+            ["Watches", result.agents.length ? result.agents.join(" and ") : dim("no agents found yet")],
+            ["Found", result.found.sessions ? `${result.found.sessions} sessions ${dim(`· ${bytes(result.found.bytes)}`)}` : dim("nothing yet")],
+            ["Seals", result.remembered
+                    ? `automatically ${dim(`· phrase kept in ${result.remembered.backend}`)}`
+                    : dryRun && !args.includes("--no-remember")
+                        ? `automatically ${dim("· the phrase would be kept in this machine's keystore")}`
+                        : `${mark.warn()} needs VAULTLINE_RECOVERY_PHRASE`],
+            ["Reclaims", result.reclaimEnabled ? `after ${result.retention.olderThanDays}d ${dim(`+ ${result.retention.graceDays}d grace, once a remote copy is verified`)}` : dim("never — sync only")],
+            ["Starts", result.service.installed ? `at login ${dim(`· ${result.service.kind}`)}` : dryRun ? dim(`${result.service.kind} service at ${shortPath(result.service.path, 44)}`) : `${mark.warn()} not installed`]
+        ]));
+        for (const note of result.notes)
+            print(`\n  ${mark.warn()} ${note}`);
+        if (!dryRun) {
+            print(`\n${vaultline()}`);
+            print(`${dim("  From here it runs on its own. Check on it with")} ${cmd("sealkeep autopilot status")}${dim(", or stop it with")} ${cmd("sealkeep autopilot off")}${dim(".")}\n`);
+        }
+        else {
+            print(`\n  ${hint(`re-run without ${cmd("--dry-run")} to apply this`)}\n`);
+        }
+        return;
+    }
+    if (command === "quickstart") {
+        const result = await setupVault(dataDir, take(args, "--recovery-phrase"));
+        const installs = await detectAgents(take(args, "--home"));
+        const detected = installs.filter((install) => install.detected);
+        const found = (await Promise.all(detected.map((install) => findTranscripts(install.agent, take(args, "--home"), 500)))).flat();
+        const totalBytes = found.reduce((total, candidate) => total + candidate.bytes, 0);
+        // What leaves this machine is decided here, before anything is queued — see sync-rules.ts.
+        const { rules, source } = await resolveSyncRules(dataDir);
+        const { included, heldBack } = applySyncRules(found, rules);
+        const queue = new ArchiveQueue(dataDir);
+        let queued = 0;
+        for (const candidate of included) {
+            const { deduped } = await queue.enqueue({ sourcePath: candidate.path, agent: candidate.agent, event: "quickstart" });
+            if (!deduped)
+                queued += 1;
+        }
+        if (json) {
+            print(JSON.stringify({ ...result, detected: detected.map((i) => i.agent), found: found.length, heldBack: heldBack.length, totalBytes, queued }, null, 2));
+            return;
+        }
+        print(`\n${BRAND}\n`);
+        if (result.recoveryPhrase) {
+            print(recoveryPhraseScreen(result.recoveryPhrase));
+            await pauseUntilWrittenDown();
+        }
+        else {
+            print(`  ${mark.ok()} Vault ${dim(result.vaultId.slice(0, 8))} already set up.\n`);
+        }
+        print(heading("What you have right now"));
+        print(found.length === 0
+            ? `  ${dim("No agent sessions found yet. Sealkeep will pick them up as you work.")}`
+            : `  ${bold(String(found.length))} sessions across ${detected.map((i) => i.agent).join(" and ")}, ${bold(bytes(totalBytes))} of history.\n  ${queued} queued for encryption.`);
+        if (heldBack.length)
+            print(`  ${dim(`Sync rules: uploading ${describeSyncRules(rules)}. ${heldBack.length} session${heldBack.length === 1 ? "" : "s"} stay local.`)}`);
+        if (source === "cache")
+            print(`  ${dim("Could not reach your account, so the last known sync rules are in force.")}`);
+        print(heading("Next"));
+        print(steps([
+            `Encrypt what is queued:  ${cmd(`VAULTLINE_RECOVERY_PHRASE="…" sealkeep queue run`)}`,
+            `Archive automatically:   ${cmd("vaultline agents hook-config codex")} ${dim("(review, then merge)")}`,
+            `See it:                  ${cmd("sealkeep desktop")}`
+        ]));
+        print(`\n${vaultline()}\n${dim("  Everything below that line is ciphertext. Nothing above it leaves this machine.")}\n`);
+        return;
+    }
+    if (command === "start") {
+        const { modeOptions, start } = await import("./start.js");
+        const mode = take(args, "--mode");
+        const { interactive, onboard } = await import("./start-tui.js");
+        // No flags and a real terminal: walk it interactively instead of making
+        // someone read options and retype them as flags.
+        if (!mode && interactive()) {
+            print(`\n${BRAND}\n`);
+            const choice = await onboard();
+            const filled = choice.mode === "paid"
+                ? { ...choice, password: process.env.VAULTLINE_CLOUD_PASSWORD ?? await promptForPhrase("Choose a password (12+ characters): ") }
+                : choice;
+            const result = await start(dataDir, filled);
+            print(`\n${recoveryPhraseScreen(result.phrase)}`);
+            await pauseUntilWrittenDown();
+            print("");
+            for (const step of result.nextSteps)
+                print(`  · ${step}`);
+            print("");
+            return;
+        }
+        if (!mode) {
+            print(`\n${BRAND}\n`);
+            for (const option of modeOptions()) {
+                print(bold(option.title), dim(option.summary), "");
+                print("  you provide");
+                for (const line of option.youProvide)
+                    print(`    · ${line}`);
+                print("  we provide");
+                for (const line of option.weProvide)
+                    print(`    · ${line}`);
+                print("");
+            }
+            print(dim("Choose one:"), "  sealkeep start --mode free --provider gcs --bucket <name> --prefix sealkeep --project <gcp-project>", "  sealkeep start --mode paid --email you@example.com --label \"my laptop\"", "");
+            return;
+        }
+        const result = mode === "paid"
+            ? await start(dataDir, {
+                mode: "paid",
+                email: take(args, "--email") ?? fail("invalid_argument", "--email is required for a paid account"),
+                password: process.env.VAULTLINE_CLOUD_PASSWORD ?? await promptForPhrase("Choose a password (12+ characters): "),
+                label: take(args, "--label", "this machine")
+            })
+            : await start(dataDir, {
+                mode: "free",
+                provider: take(args, "--provider", "s3"),
+                bucket: take(args, "--bucket") ?? fail("invalid_argument", "--bucket is required for the free tier"),
+                prefix: take(args, "--prefix", "vaultline"),
+                region: take(args, "--region"), accountId: take(args, "--account-id"), project: take(args, "--project")
+            });
+        if (json) {
+            print(JSON.stringify({ ...result, escrow: result.escrow ? "<sealed>" : undefined }, null, 2));
+            return;
+        }
+        print(`\n${BRAND}\n`);
+        print(recoveryPhraseScreen(result.phrase));
+        await pauseUntilWrittenDown();
+        print("");
+        for (const step of result.nextSteps)
+            print(`  · ${step}`);
+        if (result.storageSetup)
+            print("", dim("Storage setup: run `sealkeep storage setup` for the full commands."));
+        print("");
+        return;
+    }
+    if (command === "enroll") {
+        const [code] = positionals(args);
+        const result = await enroll(dataDir, {
+            code: required(code, `Usage: sealkeep enroll <code> [--label "work laptop"]`),
+            // The panel shows this in the device list, so a machine that never says
+            // what it is called still arrives as something a human recognises.
+            label: take(args, "--label", hostname())
+        });
+        if (json) {
+            print(JSON.stringify(result, null, 2));
+            return;
+        }
+        const { quotaState, quotaMessage } = await import("./packages.js");
+        const quota = quotaState(result.account.usedBytes, result.account.quotaBytes);
+        const reclaims = result.settings.retention.policy === "archive-and-reclaim" || result.settings.retention.policy === "manual-approval";
+        print(`\n${BRAND}\n`);
+        print(`  ${mark.ok()} Enrolled on the ${bold(result.account.plan)} plan ${dim(`· device ${result.deviceId}`)}`);
+        print(keyValue([
+            ["Storage", result.account.quotaBytes > 0 ? `${quotaMarker(quota.level)}${quotaMessage(quota)}${quota.level === "ok" ? "" : dim(" · sealkeep plans")}` : dim("no managed quota on this account")],
+            ["Uploads", describeSyncRules(result.settings.sync)],
+            ["Reclaims", reclaims ? `after ${result.settings.retention.olderThanDays}d ${dim(`+ ${result.settings.retention.graceDays}d grace, once a remote copy is verified`)}` : dim("never — sync only")]
+        ]));
+        // Those rules are now on disk, which is the point of fetching them during
+        // enrollment: what leaves this machine stays decidable with the network down.
+        if (result.settingsCached)
+            print(`\n  ${dim("Cached on this machine, so they still hold when it is offline.")}`);
+        else
+            print(`\n  ${mark.warn()} ${result.cacheWarning ?? "The account's settings could not be saved locally."}`);
+        // §5: enrollment ends in a window rather than a list of commands to type.
+        // --no-ui is the escape hatch for scripts and CI, matching --no-remember,
+        // --no-reclaim and --no-watch elsewhere; --json needs no flag because it
+        // has already returned above — a machine reading this output has no
+        // browser to open and must not be left holding a foreground server.
+        if (args.includes("--no-ui")) {
+            print(`\n  ${hint(`${cmd("sealkeep ui")} opens the settings window when you want it`)}\n`);
+            return;
+        }
+        // The enrollment itself is already done and its code already spent, so a
+        // window that will not open must not be reported as a failed enrollment —
+        // the same reasoning enroll.ts applies to settings it could not cache.
+        let handle;
+        try {
+            handle = await startUi(dataDir);
+        }
+        catch (error) {
+            print(`  ${mark.warn()} This machine is enrolled, but the settings window could not start: ${errorPayload(error).error.message}`);
+            print(`  ${hint(`try ${cmd("sealkeep ui")}`)}\n`);
+            return;
+        }
+        printUi(handle, dataDir, { brand: false });
+        if (handle.reused)
+            return;
+        holdUntilStopped(handle);
+        return;
+    }
+    if (command === "cloud") {
+        const cloud = await import("./cloud.js");
+        const [action] = positionals(args);
+        if (action === "login") {
+            const email = take(args, "--email") ?? fail("invalid_argument", "--email is required");
+            // A one-time code from the panel is the only way in for an account that
+            // signed up with Google, and it works for password accounts too.
+            const code = take(args, "--code") ?? process.env.VAULTLINE_CLOUD_CODE;
+            const account = code
+                ? await cloud.loginWithCode(dataDir, { email: email, token: code })
+                : await cloud.login(dataDir, {
+                    email: email,
+                    password: process.env.VAULTLINE_CLOUD_PASSWORD ?? await promptForPhrase("Password: ")
+                });
+            if (json) {
+                print(JSON.stringify(account, null, 2));
+                return;
+            }
+            print(`\nSigned in as ${bold(account.email)} — ${account.plan} plan\n`);
+            return;
+        }
+        if (action === "logout") {
+            await cloud.logout(dataDir);
+            print("\nSigned out of Sealkeep Cloud.\n");
+            return;
+        }
+        if (action === "status" || !action) {
+            const account = await cloud.accountStatus(dataDir);
+            if (json) {
+                print(JSON.stringify(account, null, 2));
+                return;
+            }
+            const { quotaState, quotaMessage } = await import("./packages.js");
+            print(`\n${bold(account.email)}  ${account.plan} plan  ${account.state}\n`);
+            const state = quotaState(account.used_bytes, account.quota_bytes);
+            print(keyValue([
+                ["Storage", account.quota_bytes > 0 ? `${quotaMarker(state.level)}${quotaMessage(state)}${state.level === "ok" ? "" : dim(" · sealkeep plans")}` : dim("no managed quota on this account")]
+            ]));
+            print("");
+            return;
+        }
+        if (action === "push") {
+            const [, archiveId] = positionals(args);
+            if (!archiveId)
+                fail("invalid_argument", "Usage: sealkeep cloud push <archive-id>");
+            const result = await cloud.pushArchive(dataDir, archiveId).catch(async (error) => {
+                // cloud.ts's call() maps a 402 to a VaultlineError coded "forbidden"
+                // whose message is just whatever the control plane said — today a bare
+                // "Quota exceeded", no numbers, no next step. The message is the only
+                // signal available to tell that apart from an unrelated 403 without
+                // editing cloud.ts, so it is what we sniff.
+                if (isVaultlineError(error) && error.code === "forbidden" && /quota/i.test(error.message)) {
+                    const account = await cloud.accountStatus(dataDir).catch(() => null);
+                    if (account) {
+                        const { quotaExceededMessage } = await import("./packages.js");
+                        // The shared message is written for a screen. This is a terminal, so
+                        // it names the command that shows the packages.
+                        fail("forbidden", `${quotaExceededMessage(account)} Run \`sealkeep plans\` to see them.`);
+                    }
+                }
+                throw error;
+            });
+            if (json) {
+                print(JSON.stringify(result, null, 2));
+                return;
+            }
+            print(`\n${result.durable ? "Stored" : "Uploaded"} ${result.objectKey} (${result.bytes} bytes)`);
+            if (result.note)
+                print(dim(`  ${result.note}`));
+            print("");
+            return;
+        }
+        if (action === "archives") {
+            // Chunk families fold into one line per archive — the account stores
+            // objects, but a person asks about archives.
+            const { collapseCloudRows } = await import("./managed-chunks.js");
+            const rows = collapseCloudRows(await cloud.listCloudArchives(dataDir));
+            if (json) {
+                print(JSON.stringify(rows, null, 2));
+                return;
+            }
+            const durable = rows.filter((row) => row.state === "durable");
+            print(`\n${heading(`Managed storage (${durable.length} of ${rows.length} durable)`)}`);
+            print(table(rows, [
+                { header: "", get: (row) => (row.state === "durable" ? mark.ok() : dim("·")) },
+                { header: "ref", get: (row) => row.vault_ref },
+                { header: "archived", get: (row) => (row.durable_at ? relativeTime(row.durable_at) : dim(row.state)) },
+                { header: "size", get: (row) => bytes(Number(row.bytes) || 0), align: "right" }
+            ], "nothing stored yet"));
+            print(dim("\n  Read one back with: sealkeep open <ref> <destination> --recovery-phrase …\n"));
+            return;
+        }
+        if (action === "pull") {
+            const [, vaultRef, destination] = positionals(args);
+            if (!vaultRef)
+                fail("invalid_argument", "Usage: sealkeep cloud pull <vault-ref> <destination>");
+            const out = required(destination, "Destination is required");
+            const { ciphertext, bytes: size } = await cloud.pullCiphertext(dataDir, vaultRef);
+            await writeFile(out, ciphertext, { mode: 0o600 });
+            if (json) {
+                print(JSON.stringify({ vaultRef, output: out, bytes: size }, null, 2));
+                return;
+            }
+            print(`\n  ${mark.ok()} Pulled ${bold(bytes(size))} to ${out}`);
+            print(dim("  Decrypt it with: sealkeep recover <id> <destination> --recovery-phrase …\n"));
+            return;
+        }
+        fail("invalid_argument", `Unknown cloud action: ${action}. Try login, logout, status, archives, push, or pull.`);
+    }
+    if (command === "setup") {
+        // Refused before anything is created: a vault half-made over a typo'd flag
+        // would leave the phrase screen unshown, which is the one unrecoverable
+        // outcome this command has.
+        const password = take(args, "--password");
+        if (password !== undefined && (password.length < 8 || password.length > 1024)) {
+            fail("invalid_argument", "The vault password must be between 8 and 1024 characters.");
+        }
+        const result = await setupVault(dataDir, take(args, "--recovery-phrase"));
+        // Keep the phrase in this machine's keystore, the way the wizard does by
+        // default. Without it a vault made from the terminal looked finished and
+        // was not: the window's Archive button answered "this machine has no
+        // stored recovery phrase", and the background service could not seal a
+        // thing. Two setup paths that produce two different kinds of vault is a
+        // trap, so they now produce the same one. --no-remember opts out.
+        let remembered = null;
+        if (result.recoveryPhrase && !args.includes("--no-remember")) {
+            const { rememberRecoveryPhrase } = await import("./secrets.js");
+            try {
+                remembered = await rememberRecoveryPhrase(dataDir, result.vaultId, result.recoveryPhrase);
+            }
+            catch {
+                remembered = null;
+            }
+        }
+        // --password wraps the phrase (fresh, or this machine's kept copy for a
+        // vault that already exists) so `unlock` can trade a password for it later.
+        // A failed wrap must not fail setup: the phrase screen below still has to
+        // happen, because it is shown exactly once.
+        let passwordLock = false;
+        if (password) {
+            const phrase = result.recoveryPhrase ?? (await resolveRecoveryPhrase(dataDir, result.vaultId).catch(() => null));
+            if (phrase) {
+                try {
+                    await wrapPhrase(dataDir, phrase, password);
+                    passwordLock = true;
+                }
+                catch {
+                    passwordLock = false;
+                }
+            }
+        }
+        if (json) {
+            print(JSON.stringify({ ...result, remembered, ...(password ? { passwordLock } : {}) }, null, 2));
+            return;
+        }
+        print(`\n${BRAND}\n`);
+        if (result.recoveryPhrase) {
+            print(recoveryPhraseScreen(result.recoveryPhrase));
+            await pauseUntilWrittenDown();
+            print(remembered
+                ? `  ${mark.ok()} This machine will unlock the vault on its own ${dim(`· phrase kept in ${remembered.backend}`)}`
+                : `  ${mark.warn()} This machine did not keep the phrase, so it can only archive when you type it. ${dim("Run `sealkeep autopilot` to store it.")}`);
+        }
+        else
+            print(`  ${mark.ok()} Vault ${dim(result.vaultId.slice(0, 8))} was already set up.\n`);
+        if (password) {
+            print(passwordLock
+                ? `  ${mark.ok()} Your password unlocks this vault on this machine ${dim("· the recovery phrase still opens everything, everywhere")}`
+                : `  ${mark.warn()} No password was set${result.recoveryPhrase ? "" : " — this machine holds no phrase to wrap"}. The recovery phrase alone unlocks this vault.`);
+        }
+        const installs = await detectAgents();
+        print(heading("Detected agents"));
+        print(table(installs, [
+            { header: "", get: (install) => (install.detected ? mark.ok() : dim("·")) },
+            { header: "agent", get: (install) => install.agent },
+            { header: "location", get: (install) => (install.detected ? dim(shortPath(install.root)) : dim("not installed")) }
+        ], "none"));
+        print(heading("Next"));
+        print(steps([
+            `Find and queue existing sessions:  ${cmd("sealkeep quickstart")}`,
+            `Or archive one file now:           ${cmd("sealkeep archive <file> --recovery-phrase …")}`,
+            `Reviewable hook snippets written:  ${dim(shortPath(result.files[0]))}`
+        ]));
+        print("");
+        return;
+    }
+    if (command === "init") {
+        const { config, phrase } = await initialize(dataDir, take(args, "--recovery-phrase"));
+        if (json) {
+            print(JSON.stringify({ vaultId: config.vaultId, recoveryPhrase: phrase }, null, 2));
+            return;
+        }
+        // No pause here: `init` is the machine-facing half of setup and is not in help.
+        print(`\n${BRAND}\n`, recoveryPhraseScreen(phrase), "");
+        return;
+    }
+    if (command === "status") {
+        const status = { ...(await vaultStatus(dataDir)), queue: await new ArchiveQueue(dataDir).stats() };
+        if (json) {
+            print(JSON.stringify(status, null, 2));
+            return;
+        }
+        const retention = await evaluateRetention(dataDir).catch(() => null);
+        const eligible = retention?.candidates.filter((candidate) => candidate.eligible).length ?? 0;
+        const live = liveness(await readHeartbeat(dataDir));
+        let managedAccount = null;
+        if (!status.remoteStorage) {
+            try {
+                const cloud = await import("./cloud.js");
+                managedAccount = await cloud.accountStatus(dataDir);
+            }
+            catch { /* not signed in */ }
+        }
+        print(`\n${BRAND}  ${dim(`vault ${status.vaultId.slice(0, 8)}`)}\n`);
+        const rows = [
+            ["Background", live.state === "running" ? `${green("running")} ${dim(live.detail.replace(/^Running\. /, ""))}` : live.state === "late" ? `${amber("late")} ${dim(live.detail)}` : dim(live.detail)],
+            ["Archives", `${bold(String(status.archiveCount))} ${dim(`· ${bytes(status.archivedBytes)} of history preserved`)}`],
+            ["Queue", `${status.queue.ready} ready ${dim("·")} ${status.queue.leased} in flight ${dim("·")} ${status.queue.done} archived${status.queue.failed ? ` ${dim("·")} ${mark.fail()} ${status.queue.failed} failed` : ""}`],
+            ["Remote", status.remoteStorage
+                    ? `${status.remoteStorage.provider}://${status.remoteStorage.bucket}/${status.remoteStorage.prefix}`
+                    // A managed machine has no bucket of its own. Saying "none configured"
+                    // to someone whose archives are in our storage is the same falsehood
+                    // doctor was telling.
+                    : managedAccount ? `${green("Sealkeep Cloud")} ${dim(`· ${managedAccount.email}`)}` : dim("none configured")],
+            ["Retention", retention ? `${retention.policy} ${dim("·")} ${eligible === 0 ? dim("nothing reclaimable") : `${bytes(retention.reclaimableBytes)} reclaimable`}` : dim("unknown")]
+        ];
+        if (managedAccount && managedAccount.quota_bytes > 0) {
+            const { quotaState, quotaMessage } = await import("./packages.js");
+            const state = quotaState(managedAccount.used_bytes, managedAccount.quota_bytes);
+            rows.splice(4, 0, ["Quota", `${quotaMarker(state.level)}${quotaMessage(state)}${state.level === "ok" ? "" : dim(" · sealkeep plans")}`]);
+        }
+        print(keyValue(rows));
+        print(`\n${hint(`${cmd("sealkeep doctor")} checks this machine end to end`)}\n`);
+        return;
+    }
+    if (command === "doctor") {
+        const report = await runDoctor(dataDir);
+        if (json) {
+            print(JSON.stringify(report, null, 2));
+        }
+        else {
+            print(`\n${BRAND}  ${report.ok ? green("healthy") : mark.fail()}\n`);
+            print(table(report.checks, [
+                { header: "", get: (check) => statusMark(check.status) },
+                { header: "check", get: (check) => check.name },
+                { header: "detail", get: (check) => dim(check.detail) }
+            ], "no checks"));
+            print("");
+        }
+        if (!report.ok)
+            process.exitCode = 1;
+        return;
+    }
+    if (command === "archive") {
+        const source = required(positionals(args)[0], "Usage: sealkeep archive <file> --recovery-phrase <phrase>");
+        // Through unlock(), like every other command that needs the phrase: the
+        // keystore answers for a machine that remembered it, the vault password is
+        // traded for it at a terminal, and only a bare script with neither is told
+        // to pass the flag. Demanding the flag unconditionally — which this line
+        // used to do — made `archive` the one command a normal setup could not run.
+        const phraseForSeal = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required");
+        if (args.includes("--stream")) {
+            // Chunk → encrypt → send: the ciphertext never touches this disk. Needs
+            // a configured own bucket; the seal is verified in the provider's own
+            // checksum language before the record is written.
+            const { sealArchiveToCloud } = await import("./stream-to-cloud.js");
+            const fresh = args.includes("--fresh");
+            if (!fresh) {
+                // Say up front that an interrupted upload is being picked up, so a
+                // second long wait after a crash reads as progress, not a restart.
+                // The seal itself re-verifies the journal and may still decide to
+                // start over; this line reports what was found, never key material.
+                const { findSpoolForSource } = await import("./spool.js");
+                const journal = await findSpoolForSource(dataDir, source).catch(() => null);
+                if (journal && !json) {
+                    const confirmed = journal.chunkHeaders.slice(0, journal.nextChunkIndex).reduce((sum, chunk) => sum + chunk.storedBytes, 0);
+                    const totalChunks = Math.max(1, Math.ceil(journal.source.totalBytes / journal.source.chunkBytes));
+                    print(`  ↻ Resuming at chunk ${journal.nextChunkIndex} of ~${totalChunks} (${bytes(confirmed)} already confirmed in the bucket)`);
+                }
+            }
+            // The chunk-FOLDER layout is the default: one object per sealed chunk
+            // under project/date/session — simpler resume (HEAD, not protocol),
+            // per-chunk fetch, folder delete, and the envelope sidecar makes the
+            // bucket self-recovering. --single-object keeps the old multipart path.
+            if (!args.includes("--single-object")) {
+                const { sealToChunkFolder } = await import("./chunk-store.js");
+                const agentName = take(args, "--agent", "custom") ?? "custom";
+                const explicitTarget = take(args, "--target");
+                const { claudeProjectFromPath, codexProjectFromRollout } = await import("./adapters.js");
+                const project = await (async () => {
+                    try {
+                        if (agentName === "claude")
+                            return claudeProjectFromPath(source).project;
+                        if (agentName === "codex")
+                            return (await codexProjectFromRollout(source, new Date().toISOString())).project;
+                    }
+                    catch { /* no project is a folder called no-project, not an error */ }
+                    return null;
+                })();
+                // Multi-target routing happens up here so a project pinned to Google
+                // Drive takes the single-object road (Drive holds whole objects), and
+                // everything else streams chunk folders to its routed target.
+                const { chooseTarget } = await import("./storage-targets.js");
+                const routedSize = await import("node:fs/promises").then(({ stat: statFile }) => statFile(source)).then((info) => info.size).catch(() => 0);
+                const routed = await chooseTarget(dataDir, { project, bytes: routedSize, targetId: explicitTarget ?? undefined });
+                if (routed.provider === "gdrive") {
+                    const { archiveFile } = await import("./vault.js");
+                    const { uploadArchive } = await import("./upload.js");
+                    const record = await archiveFile(dataDir, source, phraseForSeal, agentName);
+                    const uploaded = await uploadArchive(dataDir, record.id, {
+                        remoteStorage: { provider: "gdrive", bucket: routed.bucket ?? "gdrive", prefix: routed.prefix ?? "vaultline", region: routed.region },
+                        targetId: routed.id
+                    });
+                    if (json) {
+                        print(JSON.stringify({ id: record.id, bytes: record.source.bytes, target: routed.id, provider: "gdrive", objectKey: uploaded.objectKey, streamed: false }, null, 2));
+                        return;
+                    }
+                    print(`  ${mark.ok()} Archived ${bold(bytes(record.source.bytes))} to Google Drive ${dim(`(target "${routed.id}", single object)`)}`);
+                    return;
+                }
+                const outcome = await sealToChunkFolder(dataDir, source, phraseForSeal, agentName, { project, resume: !fresh, targetId: routed.id });
+                if (json) {
+                    print(JSON.stringify({ id: outcome.record.id, bytes: outcome.record.source.bytes, storedBytes: outcome.storedBytes, folder: outcome.folder, chunks: outcome.chunkCount, reusedChunks: outcome.reusedChunks, indexed: outcome.indexed, streamed: true }, null, 2));
+                    return;
+                }
+                print(`  ${mark.ok()} Archived ${bold(bytes(outcome.record.source.bytes))} into ${outcome.record.remote?.provider}://…/${outcome.folder.split("/").slice(-3).join("/")}/ ${dim(`(${outcome.chunkCount} chunks)`)}`);
+                if (outcome.reusedChunks > 0)
+                    print(`    ${dim(`↻ resumed: ${outcome.reusedChunks} chunks were already in the bucket, verified instead of re-sent`)}`);
+                print(`    ${dim(`${bytes(outcome.storedBytes)} sealed and verified; this disk held at most ${bytes(outcome.heldAtMostBytes)} of it at any moment`)}`);
+                return;
+            }
+            const outcome = await sealArchiveToCloud(dataDir, source, phraseForSeal, take(args, "--agent", "custom") ?? "custom", { resume: !fresh });
+            if (json) {
+                print(JSON.stringify({ id: outcome.record.id, bytes: outcome.record.source.bytes, storedBytes: outcome.storedBytes, objectKey: outcome.objectKey, streamed: true }, null, 2));
+                return;
+            }
+            print(`  ${mark.ok()} Archived ${bold(bytes(outcome.record.source.bytes))} straight to ${outcome.record.remote?.provider} ${dim(`→ ${outcome.record.id}`)}`);
+            print(`    ${dim(`${bytes(outcome.storedBytes)} sealed and verified in the bucket; this disk held at most ${bytes(outcome.heldAtMostBytes)} of it at any moment`)}`);
+            return;
+        }
+        const record = await archiveFile(dataDir, source, phraseForSeal, take(args, "--agent", "custom"));
+        if (json) {
+            print(JSON.stringify({ id: record.id, bytes: record.source.bytes, objectPath: record.objectPath, deduplicated: record.deduplicated }, null, 2));
+            return;
+        }
+        print(record.deduplicated
+            ? `  ${mark.ok()} Already archived, unchanged since ${relativeTime(record.createdAt)} ${dim(`(${record.id})`)}`
+            : `  ${mark.ok()} Archived ${bold(bytes(record.source.bytes))} ${dim(`→ ${record.id}`)}`);
+        return;
+    }
+    /**
+     * Pre-seal leak check. Deliberately needs no vault and no phrase: it reads
+     * the same plaintext a seal would, before anything is sealed. High findings
+     * set the exit code so scripts can gate on it; detection never leaves this
+     * machine — see leakscan.ts for why it cannot.
+     */
+    if (command === "scan") {
+        const { scanPath } = await import("./leakscan.js");
+        const target = required(positionals(args)[0], "Usage: sealkeep scan <file-or-directory> [--json]");
+        const report = await scanPath(target);
+        if (json) {
+            print(JSON.stringify(report, null, 2));
+        }
+        else if (report.files === 0) {
+            print(`\n  ${mark.warn()} No .jsonl files at ${shortPath(target)}. Point scan at a transcript, or a directory of them.\n`);
+        }
+        else {
+            print(`\n${heading("Checking for pasted secrets")}`);
+            print(table(report.findings, [
+                { header: "", get: (finding) => (finding.severity === "high" ? mark.fail() : mark.warn()) },
+                { header: "kind", get: (finding) => finding.kind },
+                { header: "where", get: (finding) => dim(`${shortPath(finding.file, 40)}:${finding.line}`) },
+                { header: "preview", get: (finding) => finding.preview }
+            ], "Nothing that looks like a secret."));
+            const files = `${report.files} file${report.files === 1 ? "" : "s"}`;
+            print(report.findings.length
+                ? `\n  ${report.high ? mark.fail() : mark.warn()} ${bold(String(report.findings.length))} finding${report.findings.length === 1 ? "" : "s"} in ${files} ${dim(`· ${report.high} high · ${report.medium} medium`)}\n  ${dim("Previews are masked. Rotate anything real — sealing keeps it forever.")}\n`
+                : `\n  ${mark.ok()} Scanned ${files}. Nothing that looks like a secret.\n`);
+        }
+        if (report.exitCode)
+            process.exitCode = 1;
+        return;
+    }
+    if (command === "list") {
+        const archives = await listArchives(dataDir);
+        if (json) {
+            print(JSON.stringify(archives, null, 2));
+            return;
+        }
+        print(`\n${heading(`Archives (${archives.length})`)}`);
+        print(table(archives, [
+            { header: "archived", get: (record) => relativeTime(record.createdAt) },
+            { header: "agent", get: (record) => record.source.agent },
+            { header: "size", get: (record) => bytes(record.source.bytes), align: "right" },
+            { header: "remote", get: (record) => (record.version === 2 && record.remote ? green("verified") : dim("local only")) },
+            { header: "source", get: (record) => dim(shortPath(record.source.path)) },
+            { header: "id", get: (record) => dim(record.id.slice(0, 8)) }
+        ], "Nothing archived yet. Run `sealkeep quickstart`."));
+        print("");
+        return;
+    }
+    if (command === "verify") {
+        const cloud = await import("./cloud.js");
+        const limit = take(args, "--limit");
+        if (!json)
+            print(`\n${heading("Checking every archive is really there")}`);
+        const checks = await cloud.verifyArchives(dataDir, {
+            limit: limit ? Number(limit) : undefined,
+            onProgress: json ? undefined : (check) => print(`  ${check.ok ? mark.ok() : mark.warn()} ${check.vaultRef}${check.ok ? dim(` ${bytes(check.bytes)}`) : `  ${check.problem}`}`)
+        });
+        const broken = checks.filter((check) => !check.ok);
+        if (json) {
+            print(JSON.stringify({ checked: checks.length, broken: broken.length, checks }, null, 2));
+        }
+        else if (!checks.length)
+            print(dim("  Nothing stored yet.\n"));
+        else if (broken.length)
+            print(`\n  ${mark.warn()} ${bold(String(broken.length))} of ${checks.length} could not be read back. Re-archive them.\n`);
+        else
+            print(`\n  ${mark.ok()} All ${checks.length} archives fetched back and matched their recorded hash.\n`);
+        if (broken.length)
+            process.exitCode = 1;
+        return;
+    }
+    if (command === "plans") {
+        const { PACKAGES, packageForAccount } = await import("./packages.js");
+        let current = null;
+        try {
+            const cloud = await import("./cloud.js");
+            current = packageForAccount(await cloud.accountStatus(dataDir)).id;
+        }
+        catch { /* not signed in; just show the catalogue */ }
+        if (json) {
+            print(JSON.stringify({ current, packages: PACKAGES }, null, 2));
+            return;
+        }
+        print(`\n${heading("Storage packages")}`);
+        print(table([...PACKAGES], [
+            { header: "", get: (item) => (item.id === current ? mark.ok() : dim("·")) },
+            { header: "package", get: (item) => item.name },
+            { header: "storage", get: (item) => (item.managed ? `${item.gigabytes} GB` : dim("your own bucket")), align: "right" },
+            { header: "per month", get: (item) => (item.monthly ? `$${item.monthly}` : dim("free")), align: "right" }
+        ], "none"));
+        print(dim("\n  On a package we run the storage and choose the provider. Your own bucket means\n  your provider, your region, your bill. Either way we hold no key that opens an archive.\n"));
+        return;
+    }
+    if (command === "open") {
+        const [vaultRef, destination] = positionals(args);
+        if (!vaultRef || !destination)
+            fail("invalid_argument", "Usage: sealkeep open <vault-ref> <destination> --recovery-phrase <phrase>");
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required");
+        const cloud = await import("./cloud.js");
+        const outcome = await cloud.openFromCloud(dataDir, vaultRef, destination, phrase);
+        if (json) {
+            print(JSON.stringify(outcome, null, 2));
+            return;
+        }
+        print(`\n  ${mark.ok()} Opened ${bold(bytes(outcome.bytes))} from managed storage to ${outcome.output}\n`);
+        return;
+    }
+    if (command === "recover") {
+        const [rawTarget, destination] = positionals(args);
+        let id = required(rawTarget, "Usage: sealkeep recover <id-or-session-path> [destination] --recovery-phrase <phrase> [--native] [--overwrite refuse|backup|replace]");
+        let native = args.includes("--native");
+        /**
+         * The emergency this command exists for is not "I know the archive id" —
+         * it is an agent's resume pointing at a file that is gone. So the target
+         * may be the PATH (or just the filename) the agent complained about:
+         * matched against archived sources, exact path first, then basename, and
+         * restored NATIVELY by default — back to the exact spot the catalog
+         * expects, so resume simply works again. Two different sessions matching
+         * one fragment is a question, not a guess: both are listed with ids.
+         */
+        const looksLikeId = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
+        if (!looksLikeId) {
+            const { resolve: resolvePath, basename } = await import("node:path");
+            const archives = (await listArchives(dataDir)).filter((record) => record.version === 2);
+            const wanted = id;
+            const exact = archives.filter((record) => record.source.path === resolvePath(wanted));
+            const byName = exact.length > 0 ? exact : archives.filter((record) => basename(record.source.path) === basename(wanted));
+            const fuzzy = byName.length > 0 ? byName : archives.filter((record) => record.source.path.includes(wanted));
+            if (fuzzy.length === 0) {
+                fail("archive_not_found", `No archive covers a session matching "${wanted}". If the file was never archived, Sealkeep cannot bring it back — check \`sealkeep list\` for what it holds.`);
+            }
+            const paths = new Set(fuzzy.map((record) => record.source.path));
+            if (paths.size > 1) {
+                const lines = [...paths].slice(0, 6).map((path) => {
+                    const newest = fuzzy.filter((record) => record.source.path === path).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt))[0];
+                    return `    ${newest.id}  ${path}`;
+                }).join("\n");
+                fail("invalid_argument", `"${wanted}" matches ${paths.size} different sessions — say which:\n${lines}\n  Then: sealkeep recover <id> --native`);
+            }
+            const newest = fuzzy.sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt))[0];
+            id = newest.id;
+            // Matched by the session's own path: the point is putting it BACK.
+            if (!destination)
+                native = true;
+            if (!json)
+                print(`  ${dim(`Matched ${newest.source.path} → archive ${newest.id}${native ? " · restoring to its original location" : ""}`)}`);
+        }
+        const outcome = await restoreArchive(dataDir, id, required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required"), {
+            destination: native ? undefined : required(destination, "Destination is required unless --native is used"),
+            native, home: take(args, "--home"), overwrite: take(args, "--overwrite", "refuse")
+        });
+        if (json) {
+            print(JSON.stringify({ id, output: outcome.output, bytes: outcome.bytes, native: outcome.native, backupPath: outcome.backupPath }, null, 2));
+            return;
+        }
+        print(`  ${mark.ok()} Recovered ${bold(bytes(outcome.bytes))} to ${outcome.output}${outcome.native ? dim(" (original location)") : ""}`);
+        if (outcome.native)
+            print(`  ${dim("The agent's resume points here again — pick the session up where it left off.")}`);
+        if (outcome.backupPath)
+            print(`  ${dim(`Previous file kept at ${outcome.backupPath}`)}`);
+        return;
+    }
+    if (command === "agents") {
+        const [action, agent] = positionals(args);
+        if (action === "detect") {
+            const installs = await detectAgents(take(args, "--home"));
+            if (json) {
+                print(JSON.stringify(installs, null, 2));
+                return;
+            }
+            print(`\n${heading("Agents on this machine")}`);
+            print(table(installs, [
+                { header: "", get: (install) => (install.detected ? mark.ok() : dim("·")) },
+                { header: "agent", get: (install) => install.agent },
+                { header: "location", get: (install) => (install.detected ? dim(shortPath(install.root)) : dim("not installed")) }
+            ], "none"));
+            print("");
+            return;
+        }
+        if (action === "sessions") {
+            const found = await findTranscripts(agentId(agent), take(args, "--home"), Number(take(args, "--limit", "50")));
+            if (json) {
+                print(JSON.stringify(found, null, 2));
+                return;
+            }
+            print(`\n${heading(`${agent} sessions (${found.length}, ${bytes(found.reduce((total, item) => total + item.bytes, 0))})`)}`);
+            print(table(found, [
+                { header: "modified", get: (item) => relativeTime(item.modifiedAt) },
+                { header: "size", get: (item) => bytes(item.bytes), align: "right" },
+                { header: "path", get: (item) => dim(shortPath(item.path, 60)) }
+            ], "no sessions found"));
+            print("");
+            return;
+        }
+        if (action === "hook-config") {
+            print(JSON.stringify(hookConfig(agentId(agent), take(args, "--executable", "vaultline"), dataDir), null, 2));
+            return;
+        }
+        fail("invalid_argument", "Usage: sealkeep agents <detect|sessions|hook-config> [agent]");
+    }
+    if (command === "hook") {
+        const [action] = positionals(args);
+        if (action === "rehydrate") {
+            // The SessionStart side of the hook pair: the agent is about to resume
+            // a session — if its transcript left this disk for the vault, put it
+            // back before the agent reads it. NEVER break the session: every
+            // outcome, including "no phrase available here", is a JSON line and
+            // exit 0.
+            const { rehydrateSession, rehydrateTargetFromPayload } = await import("./rehydrate.js");
+            const target = rehydrateTargetFromPayload(await readStdin());
+            const phrase = await unlock(dataDir).catch(() => undefined);
+            const outcome = await rehydrateSession(dataDir, target, phrase).catch((error) => ({
+                rehydrated: false, reason: "restore-failed",
+                note: error instanceof Error ? error.message.split("\n")[0] : "rehydrate failed"
+            }));
+            print(JSON.stringify(outcome));
+            return;
+        }
+        if (action !== "enqueue" && action !== "archive")
+            fail("invalid_argument", "Usage: sealkeep hook enqueue --agent <codex|claude> --data-dir <path> · sealkeep hook rehydrate --agent <codex|claude> --data-dir <path>");
+        const agent = agentId(take(args, "--agent"));
+        // The hook records intent only: no encryption, no secret, no network. `sealkeep queue run` does the work.
+        const event = await hookEventFromStdin(agent, await readStdin());
+        const { job, deduped } = await new ArchiveQueue(dataDir).enqueue({ sourcePath: event.sourcePath, agent, event: event.event, sessionId: event.sessionId });
+        print(JSON.stringify({ queued: true, deduped, jobId: job.id, event: job.event, note: action === "archive" ? "`hook archive` now queues work; run `sealkeep queue run` to encrypt it" : undefined }));
+        return;
+    }
+    if (command === "queue") {
+        const [action, jobId] = positionals(args);
+        const queue = new ArchiveQueue(dataDir);
+        if (action === "list" || action === undefined) {
+            const status = take(args, "--status");
+            const jobs = await queue.list(status ? { status } : undefined);
+            if (json) {
+                print(JSON.stringify(jobs, null, 2));
+                return;
+            }
+            print(`\n${heading(`Queue (${jobs.length})`)}`);
+            print(table(jobs, [
+                { header: "", get: (job) => statusMark(job.status) },
+                { header: "status", get: (job) => job.status },
+                { header: "agent", get: (job) => job.agent },
+                { header: "event", get: (job) => dim(job.event) },
+                { header: "tries", get: (job) => String(job.attempts), align: "right" },
+                { header: "source", get: (job) => dim(shortPath(job.sourcePath)) },
+                { header: "note", get: (job) => (job.lastError ? mark.warn() + " " + dim(job.lastError.code) : "") }
+            ], "Nothing queued."));
+            print("");
+            return;
+        }
+        if (action === "run") {
+            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Pass --recovery-phrase, set VAULTLINE_RECOVERY_PHRASE, or run `sealkeep autopilot` so this machine remembers it.");
+            const processed = await drainQueue(dataDir, phrase, { max: Number(take(args, "--max", "25")) });
+            if (json) {
+                print(JSON.stringify(processed, null, 2));
+                return;
+            }
+            const done = processed.filter((job) => job.status === "done");
+            const failed = processed.filter((job) => job.status !== "done");
+            const archived = done.reduce((total, job) => total + (job.result?.bytes ?? 0), 0);
+            print(processed.length === 0
+                ? `  ${dim("Nothing waiting.")}`
+                : `  ${mark.ok()} Encrypted ${bold(String(done.length))} session${done.length === 1 ? "" : "s"} ${dim(`· ${bytes(archived)} of history preserved`)}`);
+            for (const job of failed)
+                print(`  ${mark.warn()} ${shortPath(job.sourcePath)} ${dim(`— ${job.lastError?.message ?? "will retry"}`)}`);
+            return;
+        }
+        if (action === "retry") {
+            const job = await queue.retry(required(jobId, "Usage: sealkeep queue retry <job-id>"));
+            if (json) {
+                print(JSON.stringify(job, null, 2));
+                return;
+            }
+            print(`  ${mark.ok()} Job ${dim(job.id.slice(0, 8))} queued again.`);
+            return;
+        }
+        fail("invalid_argument", "Usage: sealkeep queue <list|run|retry> [options]");
+    }
+    // `desktop` did this job on a fixed port before the window had a name. It is
+    // kept dispatching so nobody's muscle memory breaks, and dropped from help so
+    // there is one advertised way in.
+    /**
+     * The memory side of the product: an agent asking Sealkeep what it did last
+     * time, rather than a human running `search`.
+     *
+     * `mcp` runs the server over stdio, which is how every agent starts one.
+     * `mcp install` registers it, because a server nothing points at is a server
+     * nobody uses — the state this shipped in. Worse, `onboarding.ts` has been
+     * writing a config fragment that runs `sealkeep mcp`, a command that did not
+     * exist until now: anyone who merged it got an agent that failed to start.
+     */
+    if (command === "mcp") {
+        const [action] = positionals(args);
+        if (action === "install") {
+            const { installMcpServer } = await import("./mcp-install.js");
+            const only = take(args, "--agent");
+            const result = await installMcpServer(dataDir, { only, exec: undefined });
+            if (json) {
+                print(JSON.stringify(result, null, 2));
+                return;
+            }
+            print("");
+            for (const entry of result.agents) {
+                if (entry.installed)
+                    print(`  ${mark.ok()} ${entry.label} — ${entry.detail}`);
+                else
+                    print(`  ${mark.warn()} ${entry.label} — ${entry.detail}`);
+            }
+            // Only claimed when something was actually registered. Printing it
+            // unconditionally is the same defect this whole command was written to
+            // stop: a cheerful line that is false for the person reading it.
+            const registered = result.agents.filter((entry) => entry.installed).length;
+            if (registered > 0)
+                print(dim("\n  Ask one of those agents to search your history and it will find these sessions.\n"));
+            else if (result.agents.length > 0)
+                print(dim("\n  Nothing was registered, so no agent can search your history yet.\n"));
+            else
+                print(dim("\n  No agents found on this machine.\n"));
+            return;
+        }
+        if (action && action !== "run")
+            fail("invalid_argument", "Usage: sealkeep mcp [run|install] [--agent <name>]");
+        // No banner, no colour: stdout is the protocol channel here, and anything
+        // printed to it corrupts the first message the client reads.
+        await import("./mcp.js");
+        return;
+    }
+    if (command === "ui" || command === "desktop") {
+        // `sealkeep ui hostname` prints the one line that turns the address bar
+        // into something readable. It is printed rather than applied because
+        // writing /etc/hosts needs a password, and a tool that archives transcripts
+        // has no business asking for one.
+        if (positionals(args)[0] === "hostname") {
+            const port = (await readUiRecord(dataDir))?.port ?? DEFAULT_UI_PORT;
+            print(`\n${heading("A nicer address")}`);
+            print(`  Sealkeep already answers to ${bold("vault.line")}; what is missing is your`);
+            print(`  machine knowing where that is. One line does it:\n`);
+            print(`    ${cmd(`echo "127.0.0.1 vault.line" | sudo tee -a /etc/hosts`)}\n`);
+            print(`  Then the vault lives at ${bold(`http://vault.line:${port}`)}`);
+            print(dim(`  Undo it by deleting that line from /etc/hosts. Nothing else changes:`));
+            print(dim(`  the server is bound to 127.0.0.1 either way, and ${DISPLAY_HOST}:${port} keeps working.\n`));
+            return;
+        }
+        const requested = take(args, "--port");
+        // A stable port, because the address bar is part of the product: a URL that
+        // changes every run cannot be bookmarked, read aloud, or recognised. Two
+        // vaults on one machine still work — the second finds 7477 busy and falls
+        // back to a free port rather than refusing to start.
+        // --no-browser: scripts and sandboxes start the server without a window
+        // popping over whatever the person is doing. The flag was accepted and
+        // silently ignored for a while, which is worse than not existing.
+        const handle = await startUi(dataDir, { port: requested ? await freePort(Number(requested)) : undefined, openBrowser: !args.includes("--no-browser") });
+        if (json) {
+            // The token is left out on purpose — see printUi. A script that needs it
+            // reads the token file, which is the same file the browser gate names.
+            print(JSON.stringify({ origin: handle.origin, port: handle.port, reused: handle.reused, browserOpened: handle.browser.opened, tokenFile: localApiTokenPath(dataDir) }, null, 2));
+        }
+        else
+            printUi(handle, dataDir);
+        if (handle.reused)
+            return;
+        holdUntilStopped(handle);
+        return;
+    }
+    if (command === "api") {
+        // Headless and on a predictable port: this is the address the TUI, the MCP
+        // server and anything else local is pointed at, so it neither opens a
+        // window nor inherits an ephemeral port from a UI that happens to be up.
+        const handle = await startUi(dataDir, { port: await freePort(Number(take(args, "--port", "4180"))), openBrowser: false, reuse: false });
+        print(`\n${BRAND}  local API on ${bold(handle.origin.replace("http://", ""))}`);
+        print(`  ${dim(`Token file (do not share): ${shortPath(localApiTokenPath(dataDir), 60)}`)}`);
+        print(`  ${dim("Ctrl-C to stop.")}\n`);
+        holdUntilStopped(handle);
+        return;
+    }
+    if (command === "tui") {
+        await runTui(dataDir, { base: take(args, "--api"), token: take(args, "--token") });
+        return;
+    }
+    if (command === "update") {
+        const [action] = positionals(args);
+        if (action !== "verify")
+            fail("invalid_argument", "Usage: sealkeep update verify --manifest <path> [--artifact <path>] [--key <public-key.pem>]");
+        const manifestPath = required(take(args, "--manifest"), "--manifest is required");
+        const signed = JSON.parse(await readFile(manifestPath, "utf8"));
+        const keyPath = take(args, "--key");
+        const config = await readConfig(dataDir).catch(() => null);
+        const trusted = keyPath ? { [signed.keyId]: await readFile(keyPath, "utf8") } : config?.updateKeys ?? {};
+        if (Object.keys(trusted).length === 0)
+            fail("forbidden", "No trusted release keys. Pass --key, or record one under `updateKeys` in the vault config.");
+        const manifest = verifyManifest(signed, trusted);
+        assertNotDowngrade(manifest.release, take(args, "--current", "0.1.0"));
+        const artifact = take(args, "--artifact");
+        if (artifact) {
+            const entry = manifest.artifacts.find((item) => artifact.endsWith(item.name));
+            if (!entry)
+                fail("invalid_argument", `The manifest does not describe ${artifact}`);
+            await verifyArtifact(artifact, entry);
+        }
+        if (json) {
+            print(JSON.stringify({ verified: true, release: manifest.release, keyId: signed.keyId }, null, 2));
+            return;
+        }
+        print(`  ${mark.ok()} Release ${bold(manifest.release)} verified ${dim(`(signed by ${signed.keyId})`)}${artifact ? `\n  ${mark.ok()} Artifact checksum matches` : ""}`);
+        return;
+    }
+    if (command === "upload") {
+        const [archiveId] = positionals(args);
+        const endpoint = take(args, "--endpoint");
+        const parsed = endpoint ? new URL(endpoint) : undefined;
+        const overrides = parsed ? { host: parsed.hostname, port: parsed.port ? Number(parsed.port) : undefined, protocol: parsed.protocol.replace(":", ""), pathStyle: true } : undefined;
+        const options = { overrides, storageConfigId: take(args, "--config-id") };
+        const result = archiveId && !args.includes("--all") ? await uploadArchive(dataDir, archiveId, options) : await uploadPending(dataDir, options);
+        if (json) {
+            print(JSON.stringify(result, null, 2));
+            return;
+        }
+        if ("uploaded" in result) {
+            print(`  ${mark.ok()} Uploaded and verified ${bold(String(result.uploaded.length))} archive${result.uploaded.length === 1 ? "" : "s"}${result.skipped ? dim(` · ${result.skipped} already durable`) : ""}`);
+            for (const failure of result.failed)
+                print(`  ${mark.warn()} ${dim(failure.archiveId.slice(0, 8))} ${dim(failure.error)}`);
+        }
+        else {
+            print(`  ${mark.ok()} ${bold(bytes(result.bytes))} uploaded and verified ${dim(`→ ${result.objectKey}`)}`);
+        }
+        return;
+    }
+    if (command === "search") {
+        const [query] = positionals(args);
+        const mode = args.includes("--content") ? "content" : "metadata";
+        const hits = await search(dataDir, required(query, "Usage: sealkeep search <query> [--content] [--agent <name>]"), {
+            mode, agent: take(args, "--agent"),
+            phrase: mode === "content" ? required(await unlock(dataDir, take(args, "--recovery-phrase")), "Content search decrypts locally and needs --recovery-phrase") : undefined
+        });
+        if (json) {
+            print(JSON.stringify({ mode, hits }, null, 2));
+            return;
+        }
+        print(`\n${heading(`${hits.length} result${hits.length === 1 ? "" : "s"} ${dim(`· ${mode} search`)}`)}`);
+        if (hits.length === 0) {
+            print(`  ${dim(mode === "metadata" ? "Nothing matched. Metadata search covers paths, agents, and dates — try --content to search inside sessions." : "Nothing matched inside your sessions.")}\n`);
+            return;
+        }
+        for (const hit of hits) {
+            print(`  ${bold(shortPath(hit.path, 60))}`);
+            print(`  ${dim(`${hit.agent} · ${bytes(hit.bytes)} · ${relativeTime(hit.createdAt)} · ${hit.id.slice(0, 8)}`)}`);
+            if (hit.matched === "content")
+                for (const snippet of hit.snippets)
+                    print(`    ${blue("│")} ${dim(snippet.trim().slice(0, 96))}`);
+            print("");
+        }
+        return;
+    }
+    if (command === "index") {
+        const [action] = positionals(args);
+        const phrase = async () => required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required");
+        if (action === "build") {
+            const built = await buildContentIndex(dataDir, await phrase());
+            if (json) {
+                print(JSON.stringify(built, null, 2));
+                return;
+            }
+            print(`  ${mark.ok()} Indexed ${bold(String(built.archives))} archives ${dim(`(${built.tokens} terms)`)}`);
+            print(`  ${dim("The index is encrypted at rest and never uploaded. Remove it with `sealkeep index drop`.")}`);
+            return;
+        }
+        if (action === "drop") {
+            await dropContentIndex(dataDir);
+            print(`  ${mark.ok()} Content index removed.`);
+            return;
+        }
+        if (action === "status") {
+            const { indexCoverage } = await import("./search.js");
+            const coverage = await indexCoverage(dataDir);
+            if (json) {
+                print(JSON.stringify(coverage, null, 2));
+                return;
+            }
+            print(`\n  ${bold(String(coverage.indexed))} of ${bold(String(coverage.total))} archives searchable ${dim(`· index ${bytes(coverage.indexBytes)}${coverage.builtAt ? ` · updated ${coverage.builtAt.slice(0, 16).replace("T", " ")}` : ""}`)}`);
+            if (coverage.missing.length > 0) {
+                print(`  ${dim(`${coverage.missing.length} not yet indexed — new seals index themselves; \`sealkeep index build\` adds the rest:`)}`);
+                for (const item of coverage.missing.slice(0, 5))
+                    print(`    ${dim("·")} ${item.path.split("/").pop() ?? item.id} ${dim(item.agent)}`);
+                if (coverage.missing.length > 5)
+                    print(`    ${dim(`… and ${coverage.missing.length - 5} more`)}`);
+            }
+            print("");
+            return;
+        }
+        fail("invalid_argument", "Usage: sealkeep index <build|status|drop> --recovery-phrase <phrase>");
+    }
+    if (command === "audit") {
+        const [action] = positionals(args);
+        const events = await readAudit(dataDir, { limit: Number(take(args, "--limit", "200")) });
+        if (action === "export") {
+            print(toCsv(events));
+            return;
+        }
+        if (json) {
+            print(JSON.stringify(events, null, 2));
+            return;
+        }
+        print(`\n${heading(`Activity (${events.length})`)}`);
+        print(table(events, [
+            { header: "when", get: (event) => relativeTime(event.at) },
+            { header: "", get: (event) => (event.outcome === "allowed" ? mark.ok() : mark.fail()) },
+            { header: "action", get: (event) => event.action },
+            { header: "detail", get: (event) => dim(Object.entries(event.detail ?? {}).slice(0, 3).map(([key, value]) => `${key}=${String(value).slice(0, 28)}`).join(" ")) }
+        ], "Nothing has happened yet."));
+        print(`\n${hint(`${cmd("sealkeep audit export")} writes CSV`)}\n`);
+        return;
+    }
+    if (command === "recovery") {
+        const [action] = positionals(args);
+        const config = await readConfig(dataDir);
+        if (action === "kit") {
+            // The kit is read after the machine is gone, so it must name the cloud
+            // account when there is one.
+            let managed = null;
+            try {
+                const cloud = await import("./cloud.js");
+                const account = await cloud.accountStatus(dataDir);
+                if (account?.email)
+                    managed = { email: account.email };
+            }
+            catch { /* not signed in; the kit says "this machine only" */ }
+            const sheet = recoveryKit(config, { managed });
+            const target = take(args, "--out");
+            if (target) {
+                const { writeFile } = await import("node:fs/promises");
+                await writeFile(target, sheet, { mode: 0o600 });
+                print(`  ${mark.ok()} Recovery kit written to ${target}`);
+                print(`  ${dim("Print it, fill in the words by hand, and keep it away from this machine.")}`);
+                return;
+            }
+            print(sheet);
+            return;
+        }
+        if (action === "verify") {
+            const typed = take(args, "--recovery-phrase") ?? await promptForPhrase("  Type your recovery phrase (input hidden): ");
+            const result = await verifyAgainstVault(dataDir, typed);
+            if (json) {
+                print(JSON.stringify(result, null, 2));
+                return;
+            }
+            if (result.valid) {
+                print(`\n  ${mark.ok()} That opens this vault. Your written copy is correct.\n`);
+                for (const note of result.problems)
+                    print(`  ${dim(note)}`);
+                return;
+            }
+            print(`\n  ${mark.fail()} That does not open this vault.`);
+            for (const problem of result.problems)
+                print(`  ${dim("·")} ${problem}`);
+            print(`\n  ${dim("Nothing was changed. Check your kit and try again.")}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (action === "seal") {
+            // The account panel warns that losing this machine loses every archive on
+            // it, and tells people to run exactly this. It did not exist, so the
+            // warning had no remedy behind it.
+            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required");
+            const cloud = await import("./cloud.js");
+            const { readConfig, addRecipient } = await import("./vault.js");
+            const { generateDeviceKeys } = await import("./start.js");
+            const config = await readConfig(dataDir);
+            // This used to seal `{vaultId, sealedAt}` — an id and a timestamp — while
+            // printing that the vault's key was stored. A device private key is never
+            // written to disk, so by the time this command runs there is no existing
+            // key to seal: the honest way to keep the promise is to mint one, register
+            // its public half so future archives can be opened with it, and escrow the
+            // private half under the phrase.
+            const keys = generateDeviceKeys();
+            await addRecipient(dataDir, "sealed key copy", keys.publicKeyBase64);
+            await cloud.pushEscrow(dataDir, { vaultId: config.vaultId, devicePrivateKey: keys.privateKeyBase64, createdAt: new Date().toISOString() }, phrase);
+            if (json) {
+                print(JSON.stringify({ sealed: true, vaultId: config.vaultId }, null, 2));
+                return;
+            }
+            print(`\n  ${mark.ok()} A sealed copy of this vault's key is stored with your account.`);
+            print(dim("  It is sealed with your recovery phrase, which we never receive. Losing"));
+            print(dim("  the phrase still loses the archives — that is the point.\n"));
+            return;
+        }
+        if (action === "open") {
+            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required");
+            const cloud = await import("./cloud.js");
+            const material = await cloud.pullEscrow(dataDir, phrase);
+            if (json) {
+                print(JSON.stringify(material, null, 2));
+                return;
+            }
+            print(`\n  ${mark.ok()} Opened the sealed copy stored with your account.`);
+            for (const [key, value] of Object.entries(material))
+                print(`  ${key}: ${String(value)}`);
+            print("");
+            return;
+        }
+        fail("invalid_argument", "Usage: sealkeep recovery <kit|verify|seal|open> [--out <path>]");
+    }
+    if (command === "phrase" && positionals(args)[0] === "rotate") {
+        const { rotateVaultPhrase, rotatedPhrasePath } = await import("./rotate.js");
+        const { hasPasswordLock } = await import("./password-lock.js");
+        const current = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or let the keystore answer)");
+        const password = (await hasPasswordLock(dataDir))
+            ? (take(args, "--password") ?? await promptForPhrase("Vault password: "))
+            : undefined;
+        const out = take(args, "--out") ?? rotatedPhrasePath(dataDir);
+        const { report } = await rotateVaultPhrase(dataDir, { currentPhrase: current, password, phraseFile: out });
+        if (json) {
+            print(JSON.stringify(report, null, 2));
+            return;
+        }
+        // The new words are deliberately NOT printed: a phrase in a terminal lands
+        // in scrollback, transcripts and logs — which is how the last one burned.
+        print(`\n${BRAND}  phrase rotated`);
+        print(`  ${mark.ok()} ${bold(String(report.rewrapped))} archives now open with the new phrase ${dim("(the old one still opens them locally — retire it once you hold the new words)")}`);
+        print(`  ${mark.ok()} The new phrase is in ${bold(out)} ${dim("— read it, write it down, then delete the file.")}`);
+        if (report.passwordLockRewrapped)
+            print(`  ${mark.ok()} Your password now opens the new phrase.`);
+        if (report.staleCloudCopies > 0)
+            print(`  ${mark.warn()} ${report.staleCloudCopies} cloud ${report.staleCloudCopies === 1 ? "copy" : "copies"} still carry the old wraps until re-pushed — anyone holding the OLD phrase and those objects can still open them.`);
+        if (report.skipped.length > 0)
+            print(`  ${mark.warn()} ${report.skipped.length} skipped: ${report.skipped[0].reason}`);
+        print("");
+        return;
+    }
+    if (command === "share") {
+        const [sub, a, b] = positionals(args);
+        const { createShareBundle, openShareBundle } = await import("./share.js");
+        if (sub === "open") {
+            const passcode = take(args, "--passcode") ?? await promptForPhrase("Share passcode: ");
+            const opened = await openShareBundle(required(a, "Usage: sealkeep share open <bundle> <destination> --passcode <words>"), required(b, "Usage: sealkeep share open <bundle> <destination>"), passcode);
+            print(`\n${BRAND}  ${mark.ok()} Opened ${bold(bytes(opened.bytes))} to ${b} ${dim("— no vault needed; the passcode was the key.")}\n`);
+            return;
+        }
+        const archiveId = required(sub, "Usage: sealkeep share <archive-id> --out <bundle> [--passcode <words>]");
+        const vaultPhrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or let the keystore answer)");
+        const out = take(args, "--out") ?? `${archiveId.slice(0, 8)}.vlshare`;
+        const result = await createShareBundle(dataDir, archiveId, out, { vaultPhrase, passcode: take(args, "--passcode") });
+        print(`\n${BRAND}  share bundle written`);
+        print(`  ${mark.ok()} ${bold(bytes(result.bytes))} → ${result.bundlePath}`);
+        print(`  ${mark.ok()} Passcode: ${bold(result.passcode)}`);
+        print(`  ${dim("Send the bundle over anything — without the passcode it is noise. Send the passcode another way.")}`);
+        print(`  ${dim("They open it with:")} ${cmd(`sealkeep share open ${result.bundlePath} <destination>`)}`);
+        print(`  ${dim("Your vault phrase does NOT open the bundle; only this passcode does.")}\n`);
+        return;
+    }
+    if (command === "password" && positionals(args)[0] === "change") {
+        const { changeVaultPassword } = await import("./rotate.js");
+        const current = take(args, "--current") ?? await promptForPhrase("Current password: ");
+        const fresh = take(args, "--new") ?? await promptForPhrase("New password (12+ characters): ");
+        await changeVaultPassword(dataDir, current, fresh);
+        print(`\n${BRAND}  password changed`);
+        print(`  ${mark.ok()} The vault opens with the new password from now on. The recovery phrase is unchanged.\n`);
+        return;
+    }
+    if (command === "migrate") {
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or set VAULTLINE_RECOVERY_PHRASE)");
+        const result = await migrateVault(dataDir, phrase);
+        if (json) {
+            print(JSON.stringify(result, null, 2));
+            return;
+        }
+        print(`  ${mark.ok()} ${result.migrated} archive${result.migrated === 1 ? "" : "s"} upgraded to the current format${result.alreadyCurrent ? dim(` · ${result.alreadyCurrent} already current`) : ""}`);
+        return;
+    }
+    if (command === "rewrap") {
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or set VAULTLINE_RECOVERY_PHRASE)");
+        const result = await rewrapVault(dataDir, phrase, { group: take(args, "--group") });
+        if (json) {
+            print(JSON.stringify(result, null, 2));
+            return;
+        }
+        print(`  ${mark.ok()} ${result.rewrapped} archive${result.rewrapped === 1 ? "" : "s"} now open to ${bold(String(result.recipients))} recipient${result.recipients === 1 ? "" : "s"}`);
+        for (const skip of result.skipped)
+            print(`  ${mark.warn()} ${dim(skip.id.slice(0, 8))} ${dim(skip.reason)}`);
+        return;
+    }
+    if (command === "recipients") {
+        const [action, value] = positionals(args);
+        if (action === "list" || action === undefined) {
+            const recipients = (await readConfig(dataDir)).recipients ?? [];
+            if (json) {
+                print(JSON.stringify(recipients, null, 2));
+                return;
+            }
+            print(`\n${heading(`Recipients (${recipients.length + 1})`)}`);
+            print(`  ${green("always")}  ${dim("your recovery phrase")}`);
+            print(table(recipients, [
+                { header: "added", get: (recipient) => relativeTime(recipient.addedAt) },
+                { header: "label", get: (recipient) => recipient.label },
+                { header: "group", get: (recipient) => dim(recipient.group ?? "—") },
+                { header: "id", get: (recipient) => dim(recipient.id.slice(0, 12)) }
+            ], "No device keys registered."));
+            print("");
+            return;
+        }
+        if (action === "add") {
+            const config = await addRecipient(dataDir, required(take(args, "--label"), "--label is required"), required(take(args, "--public-key"), "--public-key is required (base64 X25519)"), take(args, "--group"));
+            if (json) {
+                print(JSON.stringify(config.recipients, null, 2));
+                return;
+            }
+            print(`  ${mark.ok()} Added. New archives include it.`);
+            print(`  ${hint(`${cmd("sealkeep rewrap")} extends access to archives you already have`)}`);
+            return;
+        }
+        if (action === "remove") {
+            await removeRecipient(dataDir, required(value, "Usage: sealkeep recipients remove <recipient-id>"));
+            print(`  ${mark.ok()} Removed from future archives.`);
+            print(`  ${hint(`${cmd("sealkeep rewrap")} revokes access to archives you already have`)}`);
+            return;
+        }
+        fail("invalid_argument", "Usage: sealkeep recipients <list|add|remove> [options]");
+    }
+    if (command === "device") {
+        const [action] = positionals(args);
+        if (action !== "keygen")
+            fail("invalid_argument", "Usage: sealkeep device keygen");
+        const pair = generateKeyPairSync("x25519");
+        const privateRaw = pair.privateKey.export({ type: "pkcs8", format: "der" }).subarray(-32);
+        const publicKey = rawPublicKey(pair.publicKey).toString("base64");
+        if (json) {
+            print(JSON.stringify({ publicKey, privateKey: privateRaw.toString("base64"), recipientId: keyRecipientId(rawPublicKey(pair.publicKey)) }, null, 2));
+            return;
+        }
+        print(`\n${callout("Device private key — store it offline now", [bold(privateRaw.toString("base64")), "", dim("Shown once. This device can open archives without the phrase.")])}\n`);
+        print(`${heading("Register the public half")}`);
+        print(`  ${cmd(`sealkeep recipients add --label "<device name>" --public-key ${publicKey}`)}\n`);
+        return;
+    }
+    if (command === "storage") {
+        const [action, archiveId] = positionals(args);
+        if (action === "targets") {
+            const sub = positionals(args)[1];
+            const { resolveTargets, targetUsage, setStorageTargets } = await import("./storage-targets.js");
+            if (sub === "add") {
+                const provider = required(take(args, "--provider"), "--provider is required");
+                const id = take(args, "--id") ?? provider;
+                const existing = (await readConfig(dataDir)).storageTargets ?? await resolveTargets(dataDir);
+                const bucketFlag = take(args, "--bucket");
+                const target = {
+                    id, provider,
+                    // A Drive target's "bucket" is the visible folder in the Drive; it
+                    // defaults to the product name so a rebrand renames NEW folders in
+                    // one place (src/branding.ts).
+                    ...(bucketFlag ? { bucket: bucketFlag } : provider === "gdrive" ? { bucket: DRIVE_FOLDER_DEFAULT } : {}),
+                    ...(take(args, "--prefix") ? { prefix: take(args, "--prefix") } : {}),
+                    ...(take(args, "--region") ? { region: take(args, "--region") } : {}),
+                    ...(take(args, "--max-gb") ? { maxGb: Number(take(args, "--max-gb")) } : {}),
+                    ...(take(args, "--projects") ? { projects: take(args, "--projects").split(",").map((p) => p.trim()).filter(Boolean) } : {}),
+                    ...(take(args, "--priority") ? { priority: Number(take(args, "--priority")) } : {})
+                };
+                await setStorageTargets(dataDir, [...existing.filter((t) => t.id !== id), target]);
+                print(`  ${mark.ok()} Target ${bold(id)} saved.`);
+                return;
+            }
+            if (sub === "remove") {
+                const id = required(positionals(args)[2], "Usage: sealkeep storage targets remove <id>");
+                const existing = (await readConfig(dataDir)).storageTargets ?? [];
+                await setStorageTargets(dataDir, existing.filter((t) => t.id !== id));
+                print(`  ${mark.ok()} Target ${bold(id)} removed. Archives already there stay readable — records remember where they live.`);
+                return;
+            }
+            const targets = await resolveTargets(dataDir);
+            const usage = await targetUsage(dataDir, targets);
+            if (json) {
+                print(JSON.stringify(targets.map((t) => ({ ...t, usedBytes: usage.get(t.id) ?? 0 })), null, 2));
+                return;
+            }
+            if (targets.length === 0) {
+                print(`  ${dim("No storage targets. Configure one, or sign in to Sealkeep Cloud.")}`);
+                return;
+            }
+            print("");
+            for (const t of targets) {
+                const used = usage.get(t.id) ?? 0;
+                const cap = t.maxGb !== undefined ? ` of ${t.maxGb} GB` : "";
+                const pins = t.projects?.length ? ` · projects: ${t.projects.join(", ")}` : "";
+                print(`  ${bold(t.id.padEnd(12))} ${t.provider}${t.bucket ? `://${t.bucket}` : ""} ${dim(`· ${bytes(used)}${cap}${pins} · priority ${t.priority ?? (t.provider === "vaultline" ? 0 : 10)}`)}`);
+            }
+            print(`  ${dim("New seals go to the pinned project target first, then lowest priority with room. Reads always follow each archive's own record.")}\n`);
+            return;
+        }
+        if (action === "show" || action === undefined) {
+            const remote = (await readConfig(dataDir)).remoteStorage;
+            if (json) {
+                print(JSON.stringify(remote ?? null, null, 2));
+                return;
+            }
+            print(remote
+                ? `  ${bold(`${remote.provider}://${remote.bucket}/${remote.prefix}`)}${remote.region ? dim(` · ${remote.region}`) : ""}`
+                : `  ${dim("No remote target. Set one with `sealkeep storage configure --provider r2 --bucket … --prefix …`")}`);
+            return;
+        }
+        if (action === "configure") {
+            const provider = required(take(args, "--provider"), "--provider is required");
+            if (!Object.hasOwn(providers, provider))
+                fail("provider_unsupported", "--provider must be vaultline, s3, r2, or gcs");
+            const config = await configureRemoteStorage(dataDir, { provider, bucket: required(take(args, "--bucket"), "--bucket is required"), prefix: required(take(args, "--prefix"), "--prefix is required"), region: take(args, "--region") });
+            if (json) {
+                print(JSON.stringify(config.remoteStorage, null, 2));
+                return;
+            }
+            print(`  ${mark.ok()} Target saved: ${bold(`${config.remoteStorage.provider}://${config.remoteStorage.bucket}/${config.remoteStorage.prefix}`)}`);
+            print(`  ${hint("Store credentials next: echo '{\"accessKeyId\":\"…\",\"secretAccessKey\":\"…\"}' | sealkeep storage credentials set")}`);
+            return;
+        }
+        if (action === "setup") {
+            const provider = required(take(args, "--provider"), "--provider is required (s3, r2, or gcs)");
+            const config = await readConfig(dataDir).catch(() => null);
+            const plan = setupPlan({
+                provider,
+                bucket: required(take(args, "--bucket") ?? config?.remoteStorage?.bucket, "--bucket is required"),
+                prefix: take(args, "--prefix") ?? config?.remoteStorage?.prefix ?? `vaultline/${config?.vaultId?.slice(0, 8) ?? "me"}`,
+                region: take(args, "--region"), accountId: take(args, "--account-id"), project: take(args, "--project")
+            });
+            if (json) {
+                print(JSON.stringify(plan, null, 2));
+                return;
+            }
+            print(`\n${BRAND}  ${dim(`${plan.provider} setup for ${plan.bucket}/${plan.prefix}`)}`);
+            print(`${dim("  Nothing here runs automatically. Read each step, then paste it yourself.")}`);
+            for (const [index, step] of plan.steps.entries()) {
+                print(`\n${blue(String(index + 1))}  ${bold(step.title)}`);
+                print(`   ${dim(step.why)}`);
+                if (step.link)
+                    print(`   ${dim("open:")} ${step.link}`);
+                for (const line of step.commands ?? [])
+                    print(`\n   ${line.split("\n").join("\n   ")}`);
+                if (step.document) {
+                    print(`\n   ${dim(`save as ${step.document.name}:`)}`);
+                    print(step.document.body.split("\n").map((line) => `   ${dim("│")} ${line}`).join("\n"));
+                }
+            }
+            print(`\n${heading("Then tell Sealkeep about it")}`);
+            for (const line of plan.finish)
+                print(`   ${line.split("\n").join("\n   ")}`);
+            for (const note of plan.notes)
+                print(`\n  ${dim("note:")} ${dim(note)}`);
+            print("");
+            return;
+        }
+        if (action === "connect") {
+            // `archiveId` is just the second positional here: the provider to connect.
+            if (archiveId !== "gdrive")
+                fail("invalid_argument", "Usage: sealkeep storage connect gdrive [--config-id <id>] [--backend <name>]");
+            const configId = take(args, "--config-id") ?? (await readConfig(dataDir)).vaultId;
+            const backend = take(args, "--backend");
+            // The account's shared Google client first: no console visit, no env
+            // var — the consent screen is the whole setup. The PKCE desktop path
+            // stays for self-hosters who set VAULTLINE_GDRIVE_CLIENT_ID.
+            const viaCloud = !process.env.VAULTLINE_GDRIVE_CLIENT_ID;
+            const credentials = viaCloud ? await (await import("./cloud.js")).connectGdriveViaCloud(dataDir, {
+                onConsentUrl: (url) => {
+                    print(`\n  ${dim("Approve Sealkeep in the browser window. If none opened, use this link:")}`);
+                    print(`  ${url}`);
+                    print(`\n  ${dim("The request is for drive.file only: Google lets Sealkeep see files it created — sealed ciphertext — and nothing else in your Drive.")}`);
+                    print(`  ${dim("Waiting for the browser…")}`);
+                }
+            }) : await connectGdrive({
+                onConsentUrl: (url) => {
+                    print(`\n  ${dim("Approve Sealkeep in the browser window. If none opened, use this link:")}`);
+                    print(`  ${url}`);
+                    print(`\n  ${dim("The request is for drive.file only: Google lets Sealkeep see files it created — sealed ciphertext — and nothing else in your Drive.")}`);
+                    print(`  ${dim("Waiting for the browser…")}`);
+                }
+            });
+            const stored = await storeProviderCredentials(dataDir, configId, credentials, backend);
+            if (json) {
+                print(JSON.stringify({ provider: "gdrive", backend: stored.backend, configId }, null, 2));
+                return;
+            }
+            print(`\n  ${mark.ok()} Google Drive connected ${dim(`· refresh token stored in ${stored.backend} for ${configId.slice(0, 8)}`)}`);
+            print(`  ${hint("Google only ever receives ciphertext: archives are sealed on this machine before anything leaves it.")}`);
+            return;
+        }
+        if (action === "credentials") {
+            const [, mode] = positionals(args);
+            const configId = take(args, "--config-id") ?? (await readConfig(dataDir)).vaultId;
+            const backend = take(args, "--backend");
+            if (mode === "set") {
+                // Read the credential from stdin: an argument would be visible in the process list.
+                const raw = required((await readStdin()).trim(), "Pipe provider credentials as JSON on stdin, for example: echo '{\"accessKeyId\":\"…\",\"secretAccessKey\":\"…\"}' | sealkeep storage credentials set");
+                let parsed;
+                try {
+                    parsed = JSON.parse(raw);
+                }
+                catch {
+                    fail("invalid_argument", "Credentials on stdin must be JSON");
+                }
+                const stored = await storeProviderCredentials(dataDir, configId, parsed, backend);
+                print(`  ${mark.ok()} Stored in ${bold(stored.backend)} ${dim(`for ${configId.slice(0, 8)}`)}`);
+                return;
+            }
+            if (mode === "delete") {
+                const removed = await deleteProviderCredentials(dataDir, configId, backend);
+                print(`  ${mark.ok()} Removed from ${removed.backend}.`);
+                return;
+            }
+            if (mode === "check") {
+                const credentials = await loadProviderCredentials(dataDir, configId, backend);
+                print(`  ${mark.ok()} Credentials present ${dim(`(${"accessKeyId" in credentials ? "access key" : "service account"})`)}`);
+                return;
+            }
+            fail("invalid_argument", "Usage: sealkeep storage credentials <set|check|delete> [--config-id <id>] [--backend <name>]");
+        }
+        if (action === "lease") {
+            const config = await readConfig(dataDir);
+            if (!config.remoteStorage)
+                fail("storage_not_configured", "No remote storage configured. Run: sealkeep storage configure ...");
+            const record = (await listArchives(dataDir)).find((item) => item.id === required(archiveId, "Usage: sealkeep storage lease <archive-id>"));
+            if (!record)
+                fail("archive_not_found", `Archive not found: ${archiveId}`);
+            print(JSON.stringify(providers[config.remoteStorage.provider].createUploadLease(config.remoteStorage, { archiveId: record.id, ciphertextSha256: record.cipher.ciphertextSha256, bytes: record.source.bytes }), null, 2));
+            return;
+        }
+        fail("invalid_argument", "Usage: sealkeep storage <show|configure|setup|connect|credentials|lease> [options]");
+    }
+    if (command === "retention") {
+        const [action, ...rest] = positionals(args);
+        const olderThanDays = take(args, "--older-than-days");
+        const options = olderThanDays === undefined ? {} : { olderThanDays: Number(olderThanDays) };
+        if (action === "preview" || action === undefined) {
+            const evaluation = await evaluateRetention(dataDir, options);
+            if (json) {
+                print(JSON.stringify(evaluation, null, 2));
+                return;
+            }
+            const eligible = evaluation.candidates.filter((candidate) => candidate.eligible);
+            print(`\n${heading("Retention")}`);
+            print(keyValue([
+                ["Policy", `${bold(evaluation.policy)} ${dim(`· older than ${evaluation.olderThanDays}d · ${evaluation.graceDays}d grace`)}`],
+                ["Eligible", eligible.length === 0 ? dim("nothing — every source is still protected") : `${bold(String(eligible.length))} sources ${dim(`· ${bytes(evaluation.reclaimableBytes)} would be freed`)}`]
+            ]));
+            print("");
+            print(table(evaluation.candidates, [
+                { header: "", get: (candidate) => (candidate.eligible ? green("free") : dim("held")) },
+                { header: "size", get: (candidate) => bytes(candidate.bytes), align: "right" },
+                { header: "source", get: (candidate) => dim(shortPath(candidate.path)) },
+                { header: "why not", get: (candidate) => dim(candidate.blockers[0] ?? "") }
+            ], "No local sources are being tracked."));
+            print("");
+            return;
+        }
+        if (action === "offload") {
+            // Reclaiming a source is only half of freeing a disk: the sealed archive
+            // stays, and on real transcripts that is about two thirds of what it
+            // replaced. This removes local archives the bucket has a verified copy of.
+            const { offloadArchives } = await import("./offload.js");
+            const result = await offloadArchives(dataDir, { confirm: args.includes("--confirm") });
+            if (json) {
+                print(JSON.stringify(result, null, 2));
+                return;
+            }
+            if (result.mode === "preview") {
+                if (result.wouldOffload.length === 0) {
+                    print(`  ${dim("No archive has a verified remote copy this build can read back.")}`);
+                    for (const item of result.blocked.slice(0, 3))
+                        print(`  ${dim(`${item.id.slice(0, 8)}: ${item.reason}`)}`);
+                    return;
+                }
+                print(`\n  ${bold(bytes(result.freedBytes))} held locally by ${result.wouldOffload.length} archive${result.wouldOffload.length === 1 ? "" : "s"} already in your bucket`);
+                print(dim("  Removing them frees that space. Restoring downloads the archive back,"));
+                print(dim("  so they stop being readable while offline — that is the trade.\n"));
+                print(`  ${hint(`${cmd("sealkeep retention offload --confirm")} removes them`)}\n`);
+                return;
+            }
+            print(`  ${mark.ok()} Offloaded ${bold(String(result.offloaded.length))} archive${result.offloaded.length === 1 ? "" : "s"}, freeing ${bold(bytes(result.freedBytes))}`);
+            if (result.failed.length)
+                print(`  ${dim(`${result.failed.length} kept: ${result.failed[0].error}`)}`);
+            return;
+        }
+        if (action === "prune") {
+            // Snapshots of a session that was still growing. Each is standalone, so
+            // the earlier ones are duplication once a newer one exists — and until
+            // now nothing ever noticed, so they were kept, and paid for, forever.
+            const result = await pruneRedundantArchives(dataDir, { confirm: args.includes("--confirm") });
+            if (json) {
+                print(JSON.stringify(result, null, 2));
+                return;
+            }
+            if (result.mode === "preview") {
+                if (result.wouldRemove.length === 0) {
+                    print(`  ${dim("No archive is a duplicate of a newer one.")}`);
+                    return;
+                }
+                print(`\n  ${bold(bytes(result.freedBytes))} in ${result.wouldRemove.length} superseded snapshot${result.wouldRemove.length === 1 ? "" : "s"}`);
+                print(table(result.wouldRemove, [
+                    { header: "size", get: (item) => bytes(item.storedBytes), align: "right" },
+                    { header: "source", get: (item) => dim(shortPath(item.path)) },
+                    { header: "replaced by", get: (item) => dim(item.supersededBy.slice(0, 8)) }
+                ], ""));
+                print(`  ${hint(`${cmd("sealkeep retention prune --confirm")} removes them`)}\n`);
+                return;
+            }
+            print(`  ${mark.ok()} Removed ${bold(String(result.removed.length))} superseded snapshot${result.removed.length === 1 ? "" : "s"}, freeing ${bold(bytes(result.freedBytes))}`);
+            if (result.failed.length)
+                print(`  ${dim(`${result.failed.length} could not be removed`)}`);
+            return;
+        }
+        if (action === "apply") {
+            // Without --confirm this is a dry run, and a dry run changes nothing on disk.
+            const result = await applyRetention(dataDir, { ...options, confirm: args.includes("--confirm") });
+            if (json) {
+                print(JSON.stringify(result, null, 2));
+                return;
+            }
+            if (result.mode === "dry-run") {
+                if (result.wouldReclaim === 0) {
+                    print(`  ${dim("Nothing is eligible. Every source is still protected.")}`);
+                    // The evaluation collects every reason deliberately, and this used to
+                    // throw them all away — leaving "still protected" with no way to act
+                    // on it. Show the distinct reasons, so the answer to "why is nothing
+                    // being reclaimed" is on screen instead of in --json.
+                    const reasons = new Map();
+                    for (const candidate of result.candidates) {
+                        for (const blocker of candidate.blockers)
+                            reasons.set(blocker, (reasons.get(blocker) ?? 0) + 1);
+                    }
+                    for (const [reason, count] of [...reasons].sort((a, b) => b[1] - a[1]).slice(0, 6)) {
+                        print(`  ${dim("·")} ${reason}${count > 1 ? dim(` (${count} sources)`) : ""}`);
+                    }
+                    return;
+                }
+                print(`  ${bold(String(result.wouldReclaim))} source${result.wouldReclaim === 1 ? "" : "s"} would move to the trash, freeing ${bold(bytes(result.wouldFreeBytes))}.\n  ${hint(`re-run with ${cmd("--confirm")} to do it`)}`);
+                return;
+            }
+            print(`  ${mark.ok()} Moved ${bold(String(result.reclaimed.length))} source${result.reclaimed.length === 1 ? "" : "s"} to the trash, freeing ${bold(bytes(result.freedBytes))}`);
+            print(`  ${dim("They are recoverable from the trash, and their archives are untouched.")}`);
+            for (const failure of result.failed)
+                print(`  ${mark.warn()} ${dim(failure.id.slice(0, 8))} ${dim(failure.error)}`);
+            return;
+        }
+        if (action === "approve") {
+            if (rest.length === 0)
+                fail("invalid_argument", "Usage: sealkeep retention approve <archive-id> [...]");
+            const approved = await approveReclamation(dataDir, rest);
+            print(`  ${mark.ok()} ${rest.length} approved ${dim(`· ${approved.length} total`)}`);
+            return;
+        }
+        if (action === "policy") {
+            const policy = take(args, "--policy");
+            const graceDays = take(args, "--grace-days");
+            // "off" rather than an omitted flag, so turning a rule back off is a thing
+            // you can type. Both accept it; both default to off.
+            const idleDays = take(args, "--idle-days");
+            const minBytes = take(args, "--min-bytes");
+            const nullable = (value) => (value === undefined ? undefined : value === "off" || value === "null" ? null : Number(value));
+            const describe = (settings) => [
+                `older than ${settings.olderThanDays}d`,
+                `${settings.graceDays}d grace`,
+                settings.sourceIdleDays === null ? "any idle time" : `untouched ${settings.sourceIdleDays}d`,
+                settings.minSourceBytes === null ? "any size" : `over ${bytes(settings.minSourceBytes)}`
+            ].join(" · ");
+            if (!policy && olderThanDays === undefined && graceDays === undefined && idleDays === undefined && minBytes === undefined) {
+                const settings = retentionSettings(await readConfig(dataDir));
+                if (json) {
+                    print(JSON.stringify(settings, null, 2));
+                    return;
+                }
+                print(`  ${bold(settings.policy)} ${dim(`· ${describe(settings)}`)}`);
+                return;
+            }
+            const config = await setRetentionPolicy(dataDir, {
+                ...(policy ? { policy } : {}), ...options,
+                ...(graceDays === undefined ? {} : { graceDays: Number(graceDays) }),
+                ...(idleDays === undefined ? {} : { sourceIdleDays: nullable(idleDays) }),
+                ...(minBytes === undefined ? {} : { minSourceBytes: nullable(minBytes) })
+            });
+            print(`  ${mark.ok()} Policy set to ${bold(config.retention.policy)} ${dim(`· ${describe(retentionSettings(config))}`)}`);
+            return;
+        }
+        fail("invalid_argument", "Usage: sealkeep retention <preview|apply|prune|offload|approve|policy> [options]");
+    }
+    if (command === "daemon") {
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Run `sealkeep autopilot` so this machine can unlock itself, or set VAULTLINE_RECOVERY_PHRASE.");
+        const reclaim = args.includes("--reclaim");
+        const daemon = await startDaemon(dataDir, {
+            phrase, intervalMs: Number(take(args, "--interval", "30")) * 1000, home: take(args, "--home"),
+            watch: !args.includes("--no-watch"), upload: !args.includes("--no-upload"), reclaim,
+            notifications: args.includes("--quiet") ? false : undefined,
+            onTick: (result) => {
+                if (!(result.archived || result.uploaded || result.reclaimed || result.failed))
+                    return;
+                const parts = [result.archived && `${result.archived} archived`, result.uploaded && `${result.uploaded} uploaded`, result.reclaimed && `${result.reclaimed} reclaimed`, result.failed && `${result.failed} failed`].filter(Boolean);
+                print(`  ${dim(new Date().toLocaleTimeString())}  ${parts.join(dim(" · "))}`);
+            }
+        });
+        const status = await daemon.status();
+        print(`\n${BRAND}  ${green("watching")}`);
+        print(keyValue([
+            ["Roots", status.watching.length ? status.watching.map((root) => shortPath(root, 50)).join("\n         ") : dim("none found")],
+            ["Reclaim", reclaim ? "enabled" : dim("disabled")]
+        ]));
+        print(`  ${dim("Ctrl-C to stop.")}\n`);
+        for (const signal of ["SIGINT", "SIGTERM"])
+            process.on(signal, () => { void daemon.close().then(() => process.exit(0)); });
+        await daemon.tick();
+        return;
+    }
+    print(`${mark.fail()} Unknown command: ${command}\n${hint(`run ${cmd("sealkeep help")}`)}`);
+    process.exitCode = 1;
+}
+const HINTS = {
+    vault_not_initialized: "run `sealkeep quickstart`",
+    recovery_phrase_missing: "pass --recovery-phrase, or set VAULTLINE_RECOVERY_PHRASE",
+    recovery_phrase_mismatch: "check the phrase from your recovery kit",
+    storage_not_configured: "run `sealkeep storage configure --provider … --bucket … --prefix …`",
+    signer_not_configured: "set VAULTLINE_ENABLE_SIGNER=1 and store credentials",
+    destination_exists: "add --overwrite backup to keep the existing file",
+    destination_unwritable: "free some space, or restore to a different <destination> on another volume",
+    archive_not_found: "run `sealkeep list` to see archive ids",
+    // The scariest error the product can print. The refusal is the protection —
+    // nothing was written — and only this local sealed file is damaged; a stored
+    // copy, if one exists, is unaffected and `sealkeep verify` proves it.
+    ciphertext_integrity_failed: "the local sealed file is damaged; nothing was written. If this archive has a stored copy, `sealkeep verify` checks it and `sealkeep open <ref> <destination>` reads it back"
+};
+main().catch((error) => {
+    const { error: payload } = errorPayload(error);
+    console.error(`\n  ${mark.fail()} ${payload.message}`);
+    const suggestion = HINTS[payload.code];
+    if (suggestion)
+        console.error(`  ${hint(suggestion)}`);
+    console.error(`  ${dim(payload.code)}\n`);
+    process.exitCode = 1;
+});