npm - sealkeep - Versions diffs - 0.5.0 - Mend

sealkeep 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (180) hide show

package/ARCHITECTURE.md +201 -0
package/CHANGELOG.md +218 -0
package/CONTROL_PLANE.md +86 -0
package/LICENSE +34 -0
package/README.md +249 -0
package/THIRD_PARTY.md +22 -0
package/THREAT_MODEL.md +107 -0
package/dist/packages/vaultline-crypto/src/aead.d.ts +12 -0
package/dist/packages/vaultline-crypto/src/aead.js +24 -0
package/dist/packages/vaultline-crypto/src/chunk-access.d.ts +39 -0
package/dist/packages/vaultline-crypto/src/chunk-access.js +93 -0
package/dist/packages/vaultline-crypto/src/envelope.d.ts +71 -0
package/dist/packages/vaultline-crypto/src/envelope.js +188 -0
package/dist/packages/vaultline-crypto/src/format.d.ts +106 -0
package/dist/packages/vaultline-crypto/src/format.js +43 -0
package/dist/packages/vaultline-crypto/src/index.d.ts +5 -0
package/dist/packages/vaultline-crypto/src/index.js +5 -0
package/dist/packages/vaultline-crypto/src/recipients.d.ts +42 -0
package/dist/packages/vaultline-crypto/src/recipients.js +129 -0
package/dist/packages/vaultline-crypto/src/sha256-stream.d.ts +41 -0
package/dist/packages/vaultline-crypto/src/sha256-stream.js +206 -0
package/dist/packages/vaultline-crypto/src/stream.d.ts +139 -0
package/dist/packages/vaultline-crypto/src/stream.js +477 -0
package/dist/site/index.html +1542 -0
package/dist/site.zip +0 -0
package/dist/src/activity.d.ts +22 -0
package/dist/src/activity.js +52 -0
package/dist/src/adapters.d.ts +212 -0
package/dist/src/adapters.js +533 -0
package/dist/src/audit.d.ts +24 -0
package/dist/src/audit.js +41 -0
package/dist/src/autopilot.d.ts +77 -0
package/dist/src/autopilot.js +148 -0
package/dist/src/bip39-wordlist.d.ts +15 -0
package/dist/src/bip39-wordlist.js +272 -0
package/dist/src/branding.d.ts +31 -0
package/dist/src/branding.js +31 -0
package/dist/src/chunk-store.d.ts +142 -0
package/dist/src/chunk-store.js +502 -0
package/dist/src/cli.d.ts +2 -0
package/dist/src/cli.js +2035 -0
package/dist/src/cloud.d.ts +434 -0
package/dist/src/cloud.js +851 -0
package/dist/src/control-plane/auth.d.ts +62 -0
package/dist/src/control-plane/auth.js +123 -0
package/dist/src/control-plane/server.d.ts +31 -0
package/dist/src/control-plane/server.js +263 -0
package/dist/src/control-plane/store.d.ts +101 -0
package/dist/src/control-plane/store.js +82 -0
package/dist/src/control-plane-cli.d.ts +2 -0
package/dist/src/control-plane-cli.js +37 -0
package/dist/src/control-plane-server.d.ts +10 -0
package/dist/src/control-plane-server.js +11 -0
package/dist/src/control-plane.d.ts +78 -0
package/dist/src/control-plane.js +61 -0
package/dist/src/crypto.d.ts +56 -0
package/dist/src/crypto.js +132 -0
package/dist/src/daemon.d.ts +52 -0
package/dist/src/daemon.js +142 -0
package/dist/src/dashboard-cli.d.ts +2 -0
package/dist/src/dashboard-cli.js +20 -0
package/dist/src/disk.d.ts +110 -0
package/dist/src/disk.js +169 -0
package/dist/src/doctor.d.ts +11 -0
package/dist/src/doctor.js +198 -0
package/dist/src/enroll.d.ts +27 -0
package/dist/src/enroll.js +136 -0
package/dist/src/errors.d.ts +26 -0
package/dist/src/errors.js +23 -0
package/dist/src/heartbeat.d.ts +89 -0
package/dist/src/heartbeat.js +120 -0
package/dist/src/index-sync.d.ts +53 -0
package/dist/src/index-sync.js +147 -0
package/dist/src/leakscan.d.ts +48 -0
package/dist/src/leakscan.js +222 -0
package/dist/src/local-api.d.ts +132 -0
package/dist/src/local-api.js +1757 -0
package/dist/src/managed-chunks.d.ts +55 -0
package/dist/src/managed-chunks.js +108 -0
package/dist/src/mcp-install.d.ts +52 -0
package/dist/src/mcp-install.js +140 -0
package/dist/src/mcp.d.ts +1 -0
package/dist/src/mcp.js +59 -0
package/dist/src/migrate.d.ts +35 -0
package/dist/src/migrate.js +88 -0
package/dist/src/mnemonic.d.ts +60 -0
package/dist/src/mnemonic.js +134 -0
package/dist/src/net.d.ts +2 -0
package/dist/src/net.js +16 -0
package/dist/src/notify.d.ts +46 -0
package/dist/src/notify.js +84 -0
package/dist/src/offload.d.ts +117 -0
package/dist/src/offload.js +331 -0
package/dist/src/onboarding.d.ts +10 -0
package/dist/src/onboarding.js +44 -0
package/dist/src/packages.d.ts +126 -0
package/dist/src/packages.js +114 -0
package/dist/src/passkey.d.ts +26 -0
package/dist/src/passkey.js +54 -0
package/dist/src/password-lock.d.ts +19 -0
package/dist/src/password-lock.js +156 -0
package/dist/src/paths.d.ts +9 -0
package/dist/src/paths.js +24 -0
package/dist/src/providers/gcs.d.ts +133 -0
package/dist/src/providers/gcs.js +235 -0
package/dist/src/providers/gdrive.d.ts +156 -0
package/dist/src/providers/gdrive.js +335 -0
package/dist/src/providers/index.d.ts +45 -0
package/dist/src/providers/index.js +74 -0
package/dist/src/providers/s3.d.ts +174 -0
package/dist/src/providers/s3.js +345 -0
package/dist/src/providers/sigv4.d.ts +78 -0
package/dist/src/providers/sigv4.js +112 -0
package/dist/src/queue.d.ts +185 -0
package/dist/src/queue.js +286 -0
package/dist/src/recovery.d.ts +40 -0
package/dist/src/recovery.js +132 -0
package/dist/src/rehydrate.d.ts +43 -0
package/dist/src/rehydrate.js +66 -0
package/dist/src/restore.d.ts +34 -0
package/dist/src/restore.js +80 -0
package/dist/src/retention.d.ts +251 -0
package/dist/src/retention.js +446 -0
package/dist/src/rotate.d.ts +47 -0
package/dist/src/rotate.js +95 -0
package/dist/src/search.d.ts +147 -0
package/dist/src/search.js +677 -0
package/dist/src/secrets.d.ts +86 -0
package/dist/src/secrets.js +220 -0
package/dist/src/service.d.ts +73 -0
package/dist/src/service.js +197 -0
package/dist/src/share.d.ts +34 -0
package/dist/src/share.js +68 -0
package/dist/src/spool.d.ts +97 -0
package/dist/src/spool.js +213 -0
package/dist/src/start-tui.d.ts +17 -0
package/dist/src/start-tui.js +113 -0
package/dist/src/start.d.ts +75 -0
package/dist/src/start.js +101 -0
package/dist/src/storage-setup.d.ts +49 -0
package/dist/src/storage-setup.js +222 -0
package/dist/src/storage-targets.d.ts +40 -0
package/dist/src/storage-targets.js +147 -0
package/dist/src/stream-to-cloud.d.ts +76 -0
package/dist/src/stream-to-cloud.js +820 -0
package/dist/src/sync-rules.d.ts +85 -0
package/dist/src/sync-rules.js +125 -0
package/dist/src/trash.d.ts +15 -0
package/dist/src/trash.js +63 -0
package/dist/src/tui.d.ts +18 -0
package/dist/src/tui.js +179 -0
package/dist/src/types.d.ts +191 -0
package/dist/src/types.js +3 -0
package/dist/src/ui-server.d.ts +187 -0
package/dist/src/ui-server.js +293 -0
package/dist/src/ui.d.ts +41 -0
package/dist/src/ui.js +102 -0
package/dist/src/update.d.ts +30 -0
package/dist/src/update.js +56 -0
package/dist/src/upload.d.ts +46 -0
package/dist/src/upload.js +80 -0
package/dist/src/vault.d.ts +208 -0
package/dist/src/vault.js +812 -0
package/dist/src/watcher.d.ts +34 -0
package/dist/src/watcher.js +121 -0
package/dist/src/worker.d.ts +52 -0
package/dist/src/worker.js +190 -0
package/package.json +65 -0
package/web/app.js +1372 -0
package/web/index.html +476 -0
package/web/rail.js +308 -0
package/web/retention.html +17 -0
package/web/rules-view.js +249 -0
package/web/sessions-view.js +448 -0
package/web/sessions.html +17 -0
package/web/setup-api.js +181 -0
package/web/setup-logic.js +394 -0
package/web/setup.html +419 -0
package/web/setup.js +697 -0
package/web/style.css +990 -0

package/web/index.html ADDED Viewed

@@ -0,0 +1,476 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<title>Sealkeep</title>
+<link rel="stylesheet" href="./style.css">
+<style>
+  /* Memory pool: the project column. The name answers "which repo", the dim
+     folder under it answers "which one exactly" — needed because two folders
+     can share a last segment, and a Codex row's path column is a rollout
+     filename that says nothing about where it ran. */
+  td.proj-cell { white-space: nowrap; }
+  td.proj-cell .name { display: block; }
+  td.proj-cell .name.filterable { cursor: pointer; text-decoration: underline dotted var(--rule); text-underline-offset: 3px; }
+  td.proj-cell .where {
+    display: block;
+    max-width: 22ch;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    color: var(--soft);
+    font-size: 11px;
+  }
+  /* The session column shows the file's name, not its address: a full path is
+     ninety characters of which a person reads none. Click for the whole thing
+     (to copy, or to be sure), click again to fold it away. */
+  td.path .short {
+    display: inline-block;
+    max-width: 34ch;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    vertical-align: bottom;
+    cursor: pointer;
+  }
+  td.path .full { cursor: pointer; overflow-wrap: anywhere; }
+  /* Rules view: the armed step of the design system's destructive pattern —
+     the same button, filled with the warning colour while one click from acting. */
+  #copies-body .del[data-armed=yes] { background: var(--warn); border-color: var(--warn); color: var(--card); }
+  #copies-wrap { overflow-x: auto; }
+  #copies-body td.num { white-space: nowrap; }
+  #copies-body .rowmsg { display: block; max-width: 34ch; font-size: .8rem; color: var(--warn); }
+  #copies-body .lastmark { font-size: .75rem; color: var(--soft); border: 1px solid var(--rule); border-radius: 3px; padding: 0 .35em; margin-left: .5em; white-space: nowrap; }
+  /* The sentence an armed destructive button shows: what goes, what remains.
+     Warn-coloured because it precedes a warn-worthy click, never decoration. */
+  .act-note { display: block; max-width: 44ch; font-size: .78rem; color: var(--warn); margin-top: .3rem; }
+  /* The vault's folder shape: project headers you open, chains you unfold. */
+  .group-row td { background: var(--card); border-top: 1px solid var(--rule); }
+  .group-row b { font-family: var(--mono); }
+  .chain-row td { color: var(--soft); }
+  .chain-row td:nth-child(4)::before { content: "└ "; color: var(--rule); }
+  .chain-fold td { padding-top: 0; }
+</style>
+</head>
+<body>
+<aside>
+  <div class="brand"><span>⌑</span>Sealkeep</div>
+  <!-- The identity strip is always first (design-system: components/cards.html):
+       who this vault belongs to, what they pay for, and how much of it is used —
+       before any navigation. Populated by app.js; hidden until it can be. -->
+  <!-- A fixed skeleton, deliberately: every slot exists before the data does,
+       values overwrite placeholders in place, and the nav below never moves.
+       The card used to appear whole once /v1/status answered — which read as
+       the rail jumping on every load. -->
+  <div class="acct" id="acct-card">
+    <div class="acct-plan" id="acct-plan"><span id="acct-plan-name">—</span></div>
+    <div class="acct-email" id="acct-email">…</div>
+    <div class="acct-meter" id="acct-meter"><div class="acct-fill" id="acct-fill" style="width:0%"></div></div>
+    <div class="acct-usage" id="acct-usage">—</div>
+    <ul class="acct-facts">
+      <li id="acct-phrase"><span class="dot"></span><span class="acct-fact-text" id="acct-phrase-text">—</span></li>
+      <li id="acct-storage"><span class="dot"></span><span class="acct-fact-text" id="acct-storage-text">—</span></li>
+      <li id="acct-disk"><span class="dot"></span><span class="acct-fact-text" id="acct-disk-text">—</span></li>
+    </ul>
+    <div class="acct-door-slot" id="acct-door-slot"></div>
+  </div>
+  <nav>
+    <button class="active" data-view="overview"><span class="glyph">▦</span>Overview</button>
+    <!-- A view like the rest: it was its own page once, which made every trip
+         between "pick what to archive" and anywhere else a full reload. The
+         list mounts on first entry and stays mounted — switching back is
+         instant. -->
+    <button data-view="sessions"><span class="glyph">◱</span>Memory pool</button>
+    <button data-view="queue"><span class="glyph">◴</span>Queue<span class="count" id="count-queue"></span></button>
+    <button data-view="archives"><span class="glyph">▣</span>My vault<span class="count" id="count-archives"></span></button>
+    <button data-view="settings"><span class="glyph">◧</span>Settings</button>
+    <!-- Badged like Queue and Archives. It was the one nav item without a
+         count, on a product where "if this machine is lost, so is every
+         archive on it" is a Health warning. -->
+    <button data-view="health"><span class="glyph">⚙</span>Health<span class="count" id="count-health"></span></button>
+  </nav>
+  <div class="privacy">
+    <b>Local only</b>
+    This page reads from the agent on 127.0.0.1. It cannot decrypt an archive.
+  </div>
+</aside>
+<main>
+  <header>
+    <h1 id="headline">Your agent history</h1>
+    <p class="lede" id="lede">Reading live state from the Sealkeep agent on this machine.</p>
+    <p class="pill busy" id="connection">Connecting</p>
+    <p class="pill" id="daemon" hidden></p>
+  </header>
+  <section id="gate" class="panel gate pad" hidden>
+    <h3>Local token required</h3>
+    <p class="note">This browser has not been given its key yet. Paste the token from <code id="token-path">~/.vaultline/local-api-token</code> — a local file, so nothing here is sent anywhere. The browser <code>vaultline ui</code> opened is signed in already.</p>
+    <form id="token-form">
+      <input id="token-input" type="password" autocomplete="off" spellcheck="false" placeholder="local API token" aria-label="Local API token">
+      <button type="submit" class="action">Connect</button>
+    </form>
+    <p id="gate-error" class="error" hidden></p>
+  </section>
+  <div id="app" hidden>
+    <section id="view-overview" class="view">
+      <div class="metrics">
+        <div class="metric"><h3>Sessions preserved</h3><b id="m-archives">–</b><small id="m-bytes"></small></div>
+        <div class="metric"><h3>Waiting</h3><b id="m-queue">–</b><small id="m-queue-detail"></small></div>
+        <div class="metric"><h3>Off this machine</h3><b id="m-remote" class="small">–</b><small id="m-remote-hint"></small></div>
+        <div class="metric"><h3>Disk you can reclaim</h3><b id="m-reclaim">–</b><small id="m-policy"></small></div>
+      </div>
+      <!-- The signature device: the same rule the product is named after, with live numbers on both sides. -->
+      <div class="boundary">
+        <span class="side" id="boundary-above"></span>
+        <b>plaintext ends here</b>
+        <span class="side sealed" id="boundary-below"></span>
+      </div>
+      <p class="note" id="boundary-note">Everything below this line is ciphertext. Nothing above it leaves this machine.</p>
+      <h2>Agents</h2>
+      <div class="panel" id="agents"></div>
+    </section>
+    <section id="view-queue" class="view" hidden>
+      <!-- The machine's side of the product: what is sealing now, what waits,
+           what uploads, and what the automatic rules would reclaim. The vault
+           is the library; this is the conveyor. -->
+      <div class="panel pad">
+        <div class="row">
+          <div>
+            <b id="retention-headline" style="font-family:var(--mono)">–</b>
+            <p class="note" id="retention-summary"></p>
+          </div>
+          <div class="actions">
+            <button id="upload" class="action" type="button">Upload pending</button>
+            <button id="reclaim" class="action danger" type="button" disabled>Move sources to trash</button>
+          </div>
+        </div>
+        <div id="upload-progress" hidden>
+          <div class="meter"><div class="meter-fill" id="upload-fill" style="width:0%"></div></div>
+          <div class="row" style="align-items:baseline">
+            <p class="note" id="upload-line" style="margin:0"></p>
+            <button id="upload-cancel" class="action" type="button">Stop after this archive</button>
+          </div>
+        </div>
+        <p class="note">The button reclaims what the rules allow: a verified remote copy, the grace period passed, nothing using the file. Any vault row can also do it one at a time. Reclaimed files go to your trash — Sealkeep never deletes.</p>
+        <p class="note"><a href="#rules">Edit the rules that decide what becomes eligible →</a></p>
+      </div>
+      <div class="panel pad" id="automation-panel" style="margin-top:var(--gap)" hidden></div>
+      <div class="panel" id="queue-panel" style="margin-top:var(--gap)"></div>
+    </section>
+    <section id="view-archives" class="view" hidden>
+      <!-- The library: folders of sessions, every verb on its row. The
+           automatic side (uploads, rules-driven reclaim) lives with the Queue,
+           where work in motion belongs. -->
+      <div class="panel" id="archives-panel"></div>
+      <div class="panel pad" style="margin-top:var(--gap)">
+        <p class="note"><b>If this machine is lost:</b> your recovery phrase plus <code>vaultline cloud login</code> on any machine reaches every copy in managed storage. The phrase is the only key — no copy anywhere can be opened without it.</p>
+      </div>
+    </section>
+    <section id="view-settings" class="view" hidden>
+      <div class="metrics">
+        <div class="metric"><h3>Waiting to encrypt</h3><b id="set-queue">–</b><small id="set-queue-detail"></small></div>
+        <div class="metric"><h3>Last checked in</h3><b id="set-sync" class="small">–</b><small id="set-sync-ago"></small></div>
+        <div class="metric"><h3>Sessions preserved</h3><b id="set-archives">–</b><small>on this machine</small></div>
+        <div class="metric"><h3>Next reclaim window</h3><b id="set-reclaim-window" class="small">–</b><small id="set-reclaim-detail"></small></div>
+      </div>
+      <form id="settings-form">
+        <div class="panel pad">
+          <h3>Identity</h3>
+          <div class="field">
+            <label for="f-device-label">Device label</label>
+            <input id="f-device-label" type="text" maxlength="80" autocomplete="off" spellcheck="false" placeholder="this machine's name">
+          </div>
+          <h3>Watching</h3>
+          <div class="field">
+            <label class="opt"><input id="f-watch-codex" type="checkbox"> Codex</label>
+            <label class="opt"><input id="f-watch-claude" type="checkbox"> Claude Code</label>
+          </div>
+          <div class="field">
+            <label for="f-watched-paths">Extra paths to watch, one per line</label>
+            <textarea id="f-watched-paths" rows="3" spellcheck="false" placeholder="/mnt/extra-sessions"></textarea>
+          </div>
+          <div class="field">
+            <label for="f-exclusions">Never watch these, one per line</label>
+            <textarea id="f-exclusions" rows="3" spellcheck="false" placeholder="/Users/me/client-work/**"></textarea>
+          </div>
+          <h3>Unlocking</h3>
+          <div class="field" id="remember-panel">
+            <p class="note" id="remember-state">Checking whether this machine holds the recovery phrase…</p>
+            <div class="row" id="remember-form" hidden>
+              <input id="f-remember-phrase" type="password" autocomplete="off" spellcheck="false" placeholder="your 24-word recovery phrase" aria-label="Recovery phrase">
+              <button type="button" class="action" id="remember-go">Remember it on this machine</button>
+            </div>
+            <p class="note error" id="remember-error" hidden></p>
+            <p class="note">Kept in this machine's keychain so archiving can run without you typing the phrase each time. It is checked against the vault before it is stored, and it is never sent anywhere.</p>
+          </div>
+          <h3>Automatic archiving</h3>
+          <div class="field" id="autopilot-panel">
+            <p class="note" id="autopilot-state">Checking whether the background service is running…</p>
+            <div class="row" id="autopilot-form" hidden>
+              <button type="button" class="action" id="autopilot-go">Turn on automatic archiving</button>
+            </div>
+            <p class="note error" id="autopilot-error" hidden></p>
+            <p class="note">When on, Sealkeep runs at login and archives new sessions on its own — no terminal, nothing to keep open. Off by default; you can always archive by hand from the <a href="#sessions">Memory pool</a>.</p>
+          </div>
+          <h3>Reclaiming</h3>
+          <div class="field">
+            <label class="opt"><input id="f-reclaim-enabled" type="checkbox"> Let this machine reclaim disk space on its own</label>
+            <p class="note">Off by default. When on, the source moves to the trash only once its archive is verified in storage and the grace period has passed. Policy and timing stay in the <a href="#rules">Free up disk rules</a> — this only switches this machine's permission to act on them.</p>
+          </div>
+          <div class="field">
+            <label for="f-trash-strategy">Trash location</label>
+            <select id="f-trash-strategy">
+              <option value="auto">Automatic — this machine's own trash</option>
+              <option value="macos-trash">macOS Trash</option>
+              <option value="xdg-trash">XDG Trash</option>
+              <option value="windows-recycle-bin">Windows Recycle Bin</option>
+              <option value="vaultline-trash">Sealkeep-owned trash folder</option>
+            </select>
+            <p class="note" id="f-trash-resolved"></p>
+          </div>
+          <h3>Schedule and bandwidth</h3>
+          <div class="row">
+            <div class="field"><label for="f-interval">Check every (minutes)</label><input id="f-interval" type="number" min="1" max="1440"></div>
+            <div class="field"><label for="f-bandwidth">Upload limit, Mbps (blank for none)</label><input id="f-bandwidth" type="number" min="0" placeholder="unlimited"></div>
+            <div class="field">
+              <label for="f-reserve">Always keep free, MB (blank for automatic)</label>
+              <input id="f-reserve" type="number" min="200" placeholder="automatic">
+              <p class="note">Automatic scales with this disk: 2% of it, at least 400&nbsp;MB, at most 2&nbsp;GB. On a tight disk you can go as low as 200&nbsp;MB — below that the OS itself starts failing, so Sealkeep will not.</p>
+            </div>
+          </div>
+          <div class="row">
+            <p class="note" id="settings-saved"></p>
+            <div class="actions"><button type="submit" class="action">Save</button></div>
+          </div>
+        </div>
+      </form>
+      <h2>Account</h2>
+      <div class="panel pad">
+        <p class="note">Set from <a id="set-panel-link" href="https://shared.spala.ai" target="_blank" rel="noopener">the account panel</a>, not here — these apply to every machine on the account, and this machine only mirrors them.</p>
+        <div class="metrics">
+          <div class="metric"><h3>What leaves this machine</h3><b id="set-sync-mode" class="small">–</b><small id="set-sync-source"></small></div>
+          <div class="metric"><h3>Plan</h3><b id="set-plan" class="small">–</b><small>&nbsp;</small></div>
+          <div class="metric"><h3>Storage used</h3><b id="set-quota" class="small">–</b><small id="set-quota-detail"></small></div>
+        </div>
+      </div>
+    </section>
+    <section id="view-sessions" class="view" hidden>
+      <!-- Plan and quota, shown to the person paying for it. A customer on a paid
+           tier should be able to see what they are getting somewhere other than an
+           invoice. -->
+      <div class="planbar" id="planbar" hidden>
+        <!-- Plan name, meter and usage live in the rail's identity strip;
+             repeating them here said the same thing twice on one screen. What
+             stays is the one fact only this view can use well: how much more
+             would fit. -->
+        <p class="note" id="plan-note"></p>
+      </div>
+      <fieldset>
+        <legend>What is on disk</legend>
+        <p id="summary" class="note">Looking…</p>
+        <!-- 697 rows is not a list, it is a haystack. Filtering is the difference
+             between "pick what to archive" being a decision and being a chore. -->
+        <!-- One click each, and they combine. "Older than 30 days" plus "over
+             1 GB" is two clicks and reads back as a sentence; the same question
+             through five dropdowns had to be assembled. Chips in the same group
+             (ages, sizes, agents) replace each other; groups stack. -->
+        <div class="chips" id="chips" role="group" aria-label="Show only">
+          <button type="button" class="chip on" data-group="state" data-value="unarchived">Not archived yet</button>
+          <button type="button" class="chip" data-group="state" data-value="sealing">Queued to seal</button>
+          <button type="button" class="chip" data-group="state" data-value="archived">Already archived</button>
+          <!-- Cloud-state chips are a plan feature: they answer "which of these
+               would survive losing this disk", which only means something when the
+               account has storage. Unhidden by drawPlan() when a plan exists. -->
+          <button type="button" class="chip pro-chip" data-group="state" data-value="stored" hidden title="Sessions with a verified copy in your cloud storage">In your cloud</button>
+          <button type="button" class="chip pro-chip" data-group="state" data-value="unstored" hidden title="Sessions that would be lost with this disk — not yet verified in your cloud">Not in cloud yet</button>
+          <span class="chip-sep"></span>
+          <button type="button" class="chip" data-group="age" data-value="7">Older than 7 days</button>
+          <button type="button" class="chip" data-group="age" data-value="30">Older than 30 days</button>
+          <button type="button" class="chip" data-group="age" data-value="90">Older than 90 days</button>
+          <span class="chip-sep"></span>
+          <button type="button" class="chip" data-group="size" data-value="104857600">Over 100 MB</button>
+          <button type="button" class="chip" data-group="size" data-value="1073741824">Over 1 GB</button>
+          <span class="chip-sep"></span>
+          <button type="button" class="chip" data-group="agent" data-value="codex">Codex</button>
+          <button type="button" class="chip" data-group="agent" data-value="claude">Claude Code</button>
+        </div>
+        <div class="filters">
+          <input type="search" id="f-search" placeholder="Search paths…" aria-label="Search session paths">
+          <select id="f-sort" aria-label="Sort by">
+            <option value="size">Biggest first</option>
+            <option value="oldest">Oldest first</option>
+            <option value="newest">Newest first</option>
+          </select>
+          <button type="button" id="f-clear" class="linkish">Clear filters</button>
+        </div>
+        <!-- The count and the action sit together: "13 shown · 21 GB" next to the
+             button that selects exactly those 13, so the sentence and the click are
+             the same thing. -->
+        <div class="shown">
+          <span class="note" id="filter-count"></span>
+          <button type="button" class="action" id="select-shown">Select all shown</button>
+        </div>
+        <div class="scroll">
+          <table>
+            <thead><tr>
+              <th style="width:2rem"><input type="checkbox" id="all" title="Select every unarchived session"></th>
+              <th class="n">size</th><th class="n">last touched</th><th>project</th><th>session</th><th>state</th>
+            </tr></thead>
+            <tbody id="rows"><tr><td colspan="6" class="note">Reading sessions…</td></tr></tbody>
+          </table>
+        </div>
+        <div class="bar">
+          <button type="button" id="archive" class="action primary" disabled>Archive selected</button>
+          <span id="chosen" class="note"></span>
+        </div>
+        <p id="result" class="note" style="margin:.8rem 0 0"></p>
+      </fieldset>
+      <div class="note">
+        <strong>Archiving costs disk before it saves any.</strong> A sealed copy is written next to your vault while the
+        original is still there, so free space dips before it rises. On this machine's transcripts the sealed copy is about
+        two thirds of the original, so archiving a 4&nbsp;GB session needs roughly 6&nbsp;GB free while it works.
+        Reclaiming the originals is a separate, explicit step — each row in <a href="#archives">My vault</a> hands it to you once its copy is verified.
+      </div>
+    </section>
+    <section id="view-rules" class="view" hidden>
+      <fieldset>
+        <legend>Policy</legend>
+        <label class="opt"><input type="radio" name="policy" value="local-only" checked>
+          <div><b>Keep everything</b><span>Never reclaim a source file. Safest, and the default.</span></div></label>
+        <label class="opt"><input type="radio" name="policy" value="sync-only">
+          <div><b>Upload, but keep the original</b><span>Archives go to storage; nothing is removed from disk.</span></div></label>
+        <label class="opt"><input type="radio" name="policy" value="archive-and-reclaim">
+          <div><b>Reclaim once safely stored</b><span>The source moves to the trash after the archive is verified in storage and the grace period has passed.</span></div></label>
+        <label class="opt"><input type="radio" name="policy" value="manual-approval">
+          <div><b>Ask me first</b><span>Sealkeep lists what it would reclaim and waits for approval.</span></div></label>
+      </fieldset>
+      <fieldset>
+        <legend>Timing</legend>
+        <div class="rowgrid">
+          <div><label class="f" for="older">Keep the source for at least (days)</label><input type="number" id="older" min="0" value="30"></div>
+          <div><label class="f" for="grace">Then wait this long after it is verified (days)</label><input type="number" id="grace" min="0" value="7"></div>
+        </div>
+        <div class="rowgrid" style="margin-top:.75rem">
+          <div><label class="f" for="deleteAfter">Delete the archive from storage after (days)</label><input type="number" id="deleteAfter" min="0" placeholder="never"></div>
+          <div><label class="f">&nbsp;</label><span style="font-size:.85rem;color:var(--dim)">Leave empty for never.</span></div>
+        </div>
+      </fieldset>
+      <fieldset>
+        <legend>Which sessions</legend>
+        <p style="margin:0 0 .9rem;font-size:.9rem;color:var(--dim)">
+          The timings above measure the <em>archive</em> — how long Sealkeep has held a copy. These two measure the
+          <em>session</em>: when you last touched it, and whether it is big enough to be worth the trouble.
+        </p>
+        <div class="rowgrid">
+          <div>
+            <label class="f" for="idle">Only if untouched for at least (days)</label>
+            <input type="number" id="idle" min="0" placeholder="any">
+            <span style="font-size:.85rem;color:var(--dim)">Empty means a session's own age is not considered.</span>
+          </div>
+          <div>
+            <label class="f" for="minSize">Only if larger than (MB)</label>
+            <input type="number" id="minSize" min="0" placeholder="any">
+            <span style="font-size:.85rem;color:var(--dim)">Most sessions are tiny; the space is in a few huge ones.</span>
+          </div>
+        </div>
+      </fieldset>
+      <fieldset>
+        <legend>Apply</legend>
+        <p id="effect" style="margin:0 0 .9rem">Reading the current rules…</p>
+        <div style="display:flex;gap:.6rem;align-items:center;flex-wrap:wrap">
+          <button type="button" class="action primary" id="save">Save these rules</button>
+          <span id="saved" style="font-size:.85rem;color:var(--dim)"></span>
+        </div>
+        <p style="margin:1.1rem 0 .35rem"><span class="f">or, if you prefer a terminal</span></p>
+        <pre id="out">…</pre>
+      </fieldset>
+      <fieldset>
+        <legend>Stored copies</legend>
+        <p style="margin:0 0 .9rem;font-size:.9rem;color:var(--soft)">
+          What your storage is holding right now, and the way to take a copy back out of it. Deleting a stored copy never
+          touches the session or the archive on this machine — unless that copy is the last one left anywhere, and then
+          this view will stop and say so before anything happens.
+        </p>
+        <p id="copies-line" style="margin:0 0 .9rem">Looking at what is stored off this machine…</p>
+        <div id="copies-wrap">
+          <table id="copies-table" hidden>
+            <thead><tr><th>Ref</th><th>Size</th><th>Age</th><th></th></tr></thead>
+            <tbody id="copies-body"></tbody>
+          </table>
+        </div>
+        <div id="rolling" hidden style="margin-top:1.2rem;padding-top:1rem;border-top:1px solid var(--rule)">
+          <div style="display:flex;gap:.6rem;align-items:center;flex-wrap:wrap">
+            <label class="f" for="cap" style="margin:0">Keep only the newest</label>
+            <input type="number" id="cap" min="1" placeholder="no cap" style="width:7ch">
+            <span style="font-size:.9rem">GB in cloud storage</span>
+            <button type="button" class="action" id="cap-save">Save cap</button>
+            <span id="cap-msg" style="font-size:.85rem;color:var(--soft)"></span>
+          </div>
+          <span style="display:block;margin-top:.5rem;font-size:.85rem;color:var(--soft)">
+            Your account trims the oldest stored copies past the cap — it applies within a day, not instantly.
+            Sessions and archives on this machine are never touched by it. Leave the box empty to keep every copy.
+          </span>
+        </div>
+      </fieldset>
+      <div class="note">
+        <strong>Reclaiming is not deleting.</strong> Sources move to the OS trash, never <code>unlink</code>, and only after
+        the archive is verified in remote storage, the age and grace periods have both passed, and the file is idle.
+        If any of those cannot be established, Sealkeep keeps the file.
+      </div>
+      <div class="note" id="gap">
+        <strong>Deleting archives:</strong> set how long an archive is kept in storage before it may be deleted, or leave it at
+        <em>never</em> — the default, because the surprising outcome for an archive tool is losing an archive, not keeping one.
+        Sealkeep reports what has expired; it never deletes an archive on its own.
+      </div>
+    </section>
+    <section id="view-health" class="view" hidden>
+      <div class="panel" id="checks"></div>
+    </section>
+  </div>
+  <footer>
+    <div>
+      <b id="footer-title">Encrypted before it leaves</b>
+      <span id="footer-note">Archives are sealed on this machine before any provider sees them.</span>
+    </div>
+    <button id="refresh" class="action" type="button">Refresh</button>
+  </footer>
+</main>
+<script src="./rail.js"></script>
+<script src="./app.js"></script>
+<script src="./sessions-view.js"></script>
+<script src="./rules-view.js"></script>
+</body>
+</html>