sealkeep 0.5.0

package/web/sessions-view.js

@@ -0,0 +1,448 @@
+/**
+ * The Memory pool, as a dashboard view.
+ *
+ * This was sessions.html — its own page, which meant every trip between
+ * "pick what to archive" and anywhere else was a full load: white flash,
+ * rail redrawn, list refetched, scroll lost. Nothing about the page needed
+ * a page. It is now a view in the one panel: entering it the first time
+ * loads the list; entering it again just shows the table that is already
+ * there, refreshing the data quietly underneath.
+ *
+ * The code is the page's script, moved. It shares `api` and `token` with
+ * app.js (classic scripts, one scope) and keeps its own small formatters —
+ * shadowed locals beat a refactor of working code. Everything it touches
+ * lives inside #view-sessions except the chip queries, which are scoped to
+ * this view's #chips container so no future chip elsewhere gets rewired.
+ */
+(() => {
+  const $ = (id) => document.getElementById(id);
+
+  const bytes = (value) => {
+    if (!Number.isFinite(value) || value <= 0) return "0 B";
+    const units = ["B", "KB", "MB", "GB", "TB"];
+    let size = value, unit = 0;
+    while (size >= 1024 && unit < units.length - 1) { size /= 1024; unit += 1; }
+    return `${size < 10 && unit > 0 ? size.toFixed(1) : Math.round(size)} ${units[unit]}`;
+  };
+
+  const when = (iso) => {
+    const days = Math.floor((Date.now() - Date.parse(iso)) / 86400000);
+    if (!Number.isFinite(days)) return "";
+    if (days <= 0) return "today";
+    if (days === 1) return "yesterday";
+    if (days < 60) return `${days}d ago`;
+    return `${Math.floor(days / 30)}mo ago`;
+  };
+
+  let sessions = [];
+  const chosen = new Set();
+
+  const DAY = 86400000;
+
+  /**
+   * The rows that survive the current filters, in the chosen order.
+   *
+   * Selection deliberately persists across filter changes: someone narrowing to
+   * "over 1 GB", ticking four, then switching to "untouched 90 days" has not
+   * changed their mind about the four. Clearing a filter must not silently
+   * discard work.
+   */
+  /** The active chip in a group, or "" for none. */
+  const chip = (group) => $("chips").querySelector(`.chip.on[data-group="${group}"]`)?.dataset.value ?? "";
+
+  function visible() {
+    const needle = $("f-search").value.trim().toLowerCase();
+    const agent = chip("agent");
+    const state = chip("state");
+    const project = chip("project");
+    const minBytes = Number(chip("size")) || 0;
+    const idleDays = Number(chip("age")) || 0;
+    const now = Date.now();
+
+    const rows = sessions.filter((row) => {
+      if (needle && !row.path.toLowerCase().includes(needle)) return false;
+      if (agent && row.agent !== agent) return false;
+      // "(none)" collects the sessions whose transcripts never said where they
+      // ran; any other project chip is a name to match exactly.
+      if (project === "(none)") { if (row.project) return false; }
+      else if (project && row.project !== project) return false;
+      if (state === "archived" && !row.archived) return false;
+      // A queued row is on its way into the vault: no decision is pending on
+      // it, so it is not "not archived yet" — it has its own chip. The three
+      // chips partition the table the same way the state column words it.
+      if (state === "unarchived" && (row.archived || row.queued)) return false;
+      if (state === "sealing" && !row.queued) return false;
+      // Cloud state: "stored" is a verified remote copy; "unstored" is anything
+      // that would be lost with this disk, sealed-but-local included.
+      if (state === "stored" && !row.stored) return false;
+      if (state === "unstored" && row.stored) return false;
+      if (row.bytes < minBytes) return false;
+      if (idleDays && (now - Date.parse(row.modifiedAt)) < idleDays * DAY) return false;
+      return true;
+    });
+
+    const order = $("f-sort").value;
+    rows.sort((a, b) => order === "size"
+      ? b.bytes - a.bytes
+      : order === "oldest"
+        ? Date.parse(a.modifiedAt) - Date.parse(b.modifiedAt)
+        : Date.parse(b.modifiedAt) - Date.parse(a.modifiedAt));
+    return rows;
+  }
+
+  function refreshChoice() {
+    const total = sessions.filter((row) => chosen.has(row.path)).reduce((sum, row) => sum + row.bytes, 0);
+    $("chosen").textContent = chosen.size === 0 ? "Nothing selected." : `${chosen.size} selected · ${bytes(total)}`;
+    $("archive").disabled = chosen.size === 0;
+  }
+
+  let draw = function () {
+    const body = $("rows");
+    const rows = visible();
+    body.textContent = "";
+
+    // What the filters are currently hiding, said out loud. A list that silently
+    // shows 12 of 697 looks like a list of 12.
+    const shownBytes = rows.reduce((sum, row) => sum + row.bytes, 0);
+    $("filter-count").textContent = sessions.length === 0
+      ? ""
+      : `Showing ${rows.length} of ${sessions.length} sessions · ${bytes(shownBytes)}`;
+
+    if (rows.length === 0) {
+      const row = body.insertRow();
+      const cell = row.insertCell();
+      cell.colSpan = 6;
+      cell.className = "note";
+      cell.textContent = sessions.length === 0
+        ? "No sessions found for the agents this build can archive."
+        : "No session matches these filters. Widen them, or clear them to see everything.";
+      return;
+    }
+    for (const item of rows) {
+      const row = body.insertRow();
+      if (item.archived) row.className = "done";
+
+      const tick = row.insertCell();
+      const box = document.createElement("input");
+      box.type = "checkbox";
+      box.checked = chosen.has(item.path);
+      // An archive already covers this file at exactly this length, so sealing
+      // it again would write a duplicate of something we hold. A queued row is
+      // already on its way into the vault — re-selecting it makes no sense.
+      box.disabled = item.archived || item.queued;
+      box.onchange = () => { box.checked ? chosen.add(item.path) : chosen.delete(item.path); refreshChoice(); };
+      tick.append(box);
+
+      const size = row.insertCell(); size.className = "n"; size.textContent = bytes(item.bytes);
+      const age = row.insertCell(); age.className = "n"; age.textContent = when(item.modifiedAt);
+      // Its own column: the name answers "which repo", the folder under it
+      // answers "which one exactly". A Codex row's session column is a rollout
+      // filename that carries no location at all, so this column is the only
+      // place its whereabouts appear. Clicking a name applies that project's
+      // chip when one exists (only the largest projects earn chips).
+      const proj = row.insertCell(); proj.className = "proj-cell";
+      if (item.project) {
+        const name = document.createElement("span");
+        name.className = "name";
+        name.textContent = item.project;
+        const matching = $("chips").querySelector(`.chip[data-group="project"][data-value="${CSS.escape(item.project)}"]`);
+        if (matching) {
+          name.classList.add("filterable");
+          name.title = "Show only this project";
+          name.onclick = () => matching.click();
+        }
+        proj.append(name);
+        if (item.projectPath) {
+          const where = document.createElement("span");
+          where.className = "where";
+          where.textContent = item.projectPath.replace(/^\/(?:Users|home)\/[^/]+/, "~");
+          where.title = item.projectPath;
+          proj.append(where);
+        }
+      } else {
+        proj.textContent = "—";
+      }
+      const path = row.insertCell(); path.className = "path";
+      // The name, not the address. A person recognises "rollout-…f2.jsonl";
+      // nobody reads /Users/…/sessions/2026/08/11/ across 731 rows. The full
+      // path is one click away when it is actually needed.
+      const short = document.createElement("span");
+      short.className = "short";
+      short.textContent = item.path.split("/").pop();
+      short.title = `${item.path} — click for the full path`;
+      const full = document.createElement("span");
+      full.className = "full";
+      full.textContent = item.path;
+      full.title = "Click to fold the path away";
+      full.hidden = true;
+      short.onclick = () => { short.hidden = true; full.hidden = false; };
+      full.onclick = () => { full.hidden = true; short.hidden = false; };
+      path.append(short, full);
+      // The same words as the chips, and nothing that is not a state: the
+      //   agent name used to stand here for unarchived rows, which meant the
+      //   column answered a different question per row. "in your cloud" is
+      //   the strongest true state — it implies archived — and matches the
+      //   Pro chip that filters on it.
+      const state = row.insertCell();
+      if (item.stored) state.innerHTML = '<span class="ok">in your cloud</span>';
+      else if (item.archived) state.innerHTML = '<span class="ok">archived</span>';
+      else if (item.queued && item.held) {
+        // Queued but refused on its last attempt — today that means the disk
+        // guard stopped it. "sealing…" here was a lie the queue knew better
+        // than; the guard's own sentence rides on the tooltip.
+        const span = document.createElement("span");
+        span.className = "note";
+        span.textContent = "waiting for room";
+        span.title = item.held;
+        state.append(span);
+      }
+      else if (item.queued) state.innerHTML = `<span class="queued">sealing…${item.sealingPct !== null && item.sealingPct !== undefined ? ` ${item.sealingPct}%` : ""}</span>`;
+      else state.innerHTML = '<span class="note">not archived</span>';
+    }
+  };
+
+  // Selects what is on screen, not what exists. A tick-all that reached past the
+  // filters would be the single most expensive misunderstanding on this page:
+  // someone filters to four large sessions, ticks the header box, and archives
+  // six hundred.
+  // Only rows that can actually be sealed: not archived, not already queued.
+  const selectable = () => visible().filter((item) => !item.archived && !item.queued);
+
+  // The button says how many it would take, so it reads as a sentence: "Select
+  // all 13 shown (21 GB)". When some visible rows are already archived or in
+  // the queue, "all N shown" would disagree with the summary line above it —
+  // 579 shown, 22 GB, yet the button offering 529 and 456 MB — which reads as
+  // the page miscounting. The number it acts on is the still-archivable
+  // subset, so when the two differ the button says exactly that.
+  const originalDraw = draw;
+  draw = function () {
+    originalDraw();
+    const rows = selectable();
+    const shown = visible().length;
+    const total = rows.reduce((sum, row) => sum + row.bytes, 0);
+    $("select-shown").textContent = !rows.length ? "Nothing to select"
+      : rows.length === shown ? `Select all ${rows.length} shown (${bytes(total)})`
+      : `Select the ${rows.length} not yet archived (${bytes(total)})`;
+    $("select-shown").disabled = rows.length === 0;
+  };
+
+  // Shared by the static chips and the project chips built after load — a
+  // dynamic chip with different click behavior would be two filter languages
+  // on one row.
+  function wireChip(button) {
+    button.onclick = () => {
+      const on = button.classList.contains("on");
+      // One chip per group: choosing "older than 30 days" replaces "older than
+      // 7 days" rather than stacking two ages. Clicking the active chip clears
+      // the group.
+      for (const other of $("chips").querySelectorAll(`.chip[data-group="${button.dataset.group}"]`)) other.classList.remove("on");
+      if (!on) button.classList.add("on");
+      draw();
+      refreshChoice();
+    };
+  }
+
+  /**
+   * Project chips cannot be static markup: which projects exist is a fact
+   * about this machine's sessions. Top eight by total bytes — the page is
+   * about disk, so the projects holding the most of it earn the chips — plus
+   * one for sessions whose transcripts never said where they ran. They sit
+   * before the age group so the row reads as what, then when, then how big.
+   */
+  function buildProjectChips() {
+    if ($("chips").querySelector('.chip[data-group="project"]')) return;
+    const totals = new Map();
+    let unplaced = 0;
+    for (const row of sessions) {
+      if (row.project) totals.set(row.project, (totals.get(row.project) ?? 0) + row.bytes);
+      else unplaced += 1;
+    }
+    // A machine where no transcript names a project gets no dead chip row.
+    if (totals.size === 0) return;
+    const anchor = $("chips").querySelector('.chip[data-group="age"]');
+    const add = (node) => anchor.parentElement.insertBefore(node, anchor);
+    const make = (value, label, title) => {
+      const button = document.createElement("button");
+      button.type = "button";
+      button.className = "chip";
+      button.dataset.group = "project";
+      button.dataset.value = value;
+      button.textContent = label;
+      if (title) button.title = title;
+      wireChip(button);
+      add(button);
+    };
+    for (const [name] of [...totals.entries()].sort((a, b) => b[1] - a[1]).slice(0, 8)) make(name, name);
+    if (unplaced > 0) make("(none)", "No project", "Sessions whose transcripts do not say which project they belong to");
+    const sep = document.createElement("span");
+    sep.className = "chip-sep";
+    add(sep);
+  }
+
+  /**
+   * What the plan is, and how much of it is left.
+   *
+   * A paying customer should be able to see what they are paying for somewhere
+   * other than a card statement. Free vaults get nothing here rather than an
+   * upsell: a bar reading "0 of 0" would be worse than silence.
+   */
+  async function drawPlan() {
+    try {
+      const status = await api("/v1/status");
+      if (!status.plan || !status.quota) return;
+      // The cloud-state chips only mean something once the account has storage.
+      for (const proChip of $("chips").querySelectorAll(".pro-chip")) proChip.hidden = false;
+      const used = Number(status.quota.usedBytes) || 0;
+      const limit = Number(status.quota.quotaBytes) || 0;
+      const room = limit - used;
+      if (limit && room > 0) {
+        $("planbar").hidden = false;
+        $("plan-note").textContent = `Room for about ${bytes(room)} more in your cloud storage — roughly ${bytes(room / 0.7)} of sessions at this machine's compression.`;
+      }
+    } catch { /* a vault with no account simply shows nothing here */ }
+  }
+
+  /**
+   * The button queues; the machine seals. Sealing used to run inside this
+   * page's own loop, so refreshing mid-way silently abandoned everything after
+   * the current batch and the list kept offering the same rows for
+   * re-selection. Now one request queues the whole selection, the server's
+   * background drain does the work, and this page — or any later visit to it —
+   * just reads progress from the rows' `queued` flag. Refresh changes nothing.
+   */
+  let pollTimer = null;
+  function stopPolling() { if (pollTimer) { clearInterval(pollTimer); pollTimer = null; } }
+  function startPolling() {
+    if (pollTimer) return;
+    pollTimer = setInterval(async () => {
+      try {
+        const data = await api("/v1/sessions");
+        sessions = data.sessions;
+        draw();
+        refreshChoice();
+        reportProgress();
+      } catch { /* one missed poll is fine; the next tick retries */ }
+    }, 3000);
+  }
+  function reportProgress() {
+    const queued = sessions.filter((row) => row.queued);
+    const waiting = queued.filter((row) => row.held).length;
+    const sealing = queued.length;
+    if (sealing > 0) {
+      $("result").textContent = waiting === sealing
+        ? `${waiting} waiting for disk room — ${queued.find((row) => row.held).held} Free some space and they seal on their own.`
+        : `Sealing in the background — ${sealing - waiting} working${waiting ? `, ${waiting} waiting for room` : ""}. You can close or refresh this page; it carries on without it.`;
+    } else {
+      stopPolling();
+      $("result").textContent = "Everything queued is sealed. The originals are untouched — reclaim them from the retention page when you are ready.";
+      // The watching chip has nothing left to watch. Hand the person to the
+      // outcome — the rows they queued, now archived — instead of an empty
+      // table under "Sealing now".
+      const active = $("chips").querySelector('.chip[data-group="state"].on');
+      if (active?.dataset.value === "sealing") {
+        active.classList.remove("on");
+        $("chips").querySelector('.chip[data-group="state"][data-value="archived"]')?.classList.add("on");
+        draw();
+        refreshChoice();
+      }
+    }
+  }
+
+  async function load() {
+    try {
+      const data = await api("/v1/sessions");
+      sessions = data.sessions;
+      buildProjectChips();
+      // A selection can go stale across a refresh: anything now archived or
+      // already queued must not be re-submitted.
+      for (const row of sessions) if (row.archived || row.queued) chosen.delete(row.path);
+      const done = sessions.filter((item) => item.archived).length;
+      $("summary").textContent = `${bytes(data.totalBytes)} across ${sessions.length} sessions. `
+        + `${bytes(data.unarchivedBytes)} in ${sessions.length - done} not yet archived.`;
+      draw();
+      refreshChoice();
+      // A background seal keeps going whether or not this view is open. If one
+      // is running, a fresh visit picks the progress line straight back up.
+      if (sessions.some((row) => row.queued)) { reportProgress(); startPolling(); }
+    } catch (error) {
+      $("summary").textContent = token
+        ? `Could not read sessions: ${error.message}`
+        : "Connect the dashboard first so it can read this machine's sessions.";
+      $("rows").textContent = "";
+    }
+  }
+
+  function wire() {
+    for (const button of $("chips").querySelectorAll(".chip")) wireChip(button);
+    $("f-search").addEventListener("input", () => { draw(); refreshChoice(); });
+    $("f-sort").addEventListener("change", () => { draw(); refreshChoice(); });
+    $("f-clear").onclick = () => {
+      for (const other of $("chips").querySelectorAll(".chip")) other.classList.remove("on");
+      $("chips").querySelector('.chip[data-value="unarchived"]').classList.add("on");
+      $("f-search").value = "";
+      $("f-sort").value = "size";
+      draw();
+      refreshChoice();
+    };
+
+    $("all").onchange = () => {
+      const rows = selectable();
+      if ($("all").checked) for (const item of rows) chosen.add(item.path);
+      else for (const item of rows) chosen.delete(item.path);
+      draw();
+      refreshChoice();
+    };
+
+    // "Select all shown" is the second click of the flow this view exists for:
+    // filter to what you mean, then take all of it. It reaches only what the
+    // filters left visible and only what is not already archived.
+    $("select-shown").onclick = () => {
+      for (const item of selectable()) chosen.add(item.path);
+      draw();
+      refreshChoice();
+      $("archive").focus();
+    };
+
+    $("archive").onclick = async () => {
+      const paths = [...chosen];
+      $("archive").disabled = true;
+      $("result").textContent = `Queueing ${paths.length} session${paths.length === 1 ? "" : "s"}…`;
+      try {
+        const outcome = await api("/v1/sessions/archive", { method: "POST", body: JSON.stringify({ paths }) });
+        const failures = outcome.results.filter((item) => !item.ok);
+        chosen.clear();
+        const data = await api("/v1/sessions");
+        sessions = data.sessions;
+        // The rows just queued belong to "Sealing now", not "Not archived yet" —
+        // staying on the old chip would show an empty table the moment the
+        // person acted. Follow the work: switch to the chip that watches it.
+        if (outcome.queued > 0) {
+          const sealingChip = $("chips").querySelector('.chip[data-group="state"][data-value="sealing"]');
+          for (const other of $("chips").querySelectorAll('.chip[data-group="state"]')) other.classList.remove("on");
+          sealingChip?.classList.add("on");
+        }
+        draw();
+        refreshChoice();
+        $("result").textContent = `Queued ${outcome.queued} of ${outcome.requested} — sealing runs in the background on this machine.`
+          + (failures.length ? ` ${failures.length} could not be queued: ${failures[0].error}` : "");
+        startPolling();
+      } catch (error) {
+        $("result").textContent = `Nothing was queued: ${error.message}`;
+        $("archive").disabled = chosen.size === 0;
+      }
+    };
+  }
+
+  let initialised = false;
+  // Called by app.js when the view is entered. First entry wires and loads;
+  // every later entry shows the already-rendered table instantly and refreshes
+  // the data underneath it — no placeholder, no flash, no lost scroll.
+  window.initSessionsView = function () {
+    if (!initialised) {
+      initialised = true;
+      wire();
+      void drawPlan();
+    }
+    void load();
+  };
+})();

package/web/sessions.html

@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Sealkeep — memory pool</title>
+<meta name="referrer" content="no-referrer">
+</head>
+<body>
+<!-- The Memory pool is a dashboard view now (index.html#sessions) — one page,
+     no reloads between views. This stub keeps old bookmarks and links working,
+     preserving a #token=… fragment when one is carried. -->
+<script>
+  const h = location.hash.replace(/^#/, "");
+  location.replace(h.includes("token=") ? `./index.html#${h}` : "./index.html#sessions");
+</script>
+</body>
+</html>

package/web/setup-api.js

@@ -0,0 +1,181 @@
+/**
+ * The only place the setup wizard talks to the machine.
+ *
+ * The endpoints in PRODUCT_ARCHITECTURE.md §7 are being built in parallel with
+ * this page, so every call is confined to this file: when they land, nothing
+ * above this layer changes, and until they land `missing()` is true and the
+ * page says so in words instead of rendering blank.
+ *
+ * Three rules are enforced here rather than trusted to callers:
+ *
+ *  1. Paths come from a fixed list. A caller cannot build a URL, so a bucket
+ *     name, a secret key or a recovery phrase cannot end up in one — not in a
+ *     query string, not in a path segment, not in the server's access log.
+ *  2. The phrase is returned by exactly one call, `createVault`, and there is
+ *     no function here that reads it back. There is no endpoint to add one to.
+ *  3. Nothing is logged. No console call exists in this file, because a
+ *     console line is a copy of a secret in a place nobody remembers to clear.
+ */
+
+/**
+ * Every path this page may ever request. Nothing is concatenated onto them.
+ *
+ * The agents and hooks routes left with the screen that used them: the
+ * background service finds sessions by watching the agent folders itself, so
+ * setup no longer edits another program's configuration at all.
+ */
+export const ROUTES = {
+  state: "/v1/setup/state",
+  vault: "/v1/setup/vault",
+  unlockCheck: "/v1/setup/unlock-check",
+  storage: "/v1/setup/storage",
+  storageTest: "/v1/setup/storage/test",
+  enroll: "/v1/setup/enroll",
+  service: "/v1/setup/service"
+};
+
+const TOKEN_KEY = "vaultline.localApiToken";
+
+export class SetupError extends Error {
+  constructor(message, { status = 0, route = "", missing = false } = {}) {
+    super(message);
+    this.name = "SetupError";
+    this.status = status;
+    this.route = route;
+    /** True when this build of Sealkeep has no such endpoint yet. */
+    this.missing = missing;
+  }
+}
+
+let token = "";
+
+/**
+ * The token arrives in the URL fragment, which browsers never send to a server,
+ * and is kept in sessionStorage — the same key and the same rules as the
+ * dashboard, so opening the dashboard after setup needs no second sign-in.
+ * The persistent half of web storage is never touched: it outlives the window,
+ * and a token that outlives the window is a token nobody remembers to revoke.
+ */
+export function readTokenFromLocation() {
+  if (typeof location === "undefined") return token;
+  const hash = new URLSearchParams(String(location.hash ?? "").replace(/^#/, ""));
+  const fromHash = hash.get("token");
+  if (fromHash) {
+    sessionStorage.setItem(TOKEN_KEY, fromHash);
+    if (typeof history !== "undefined") history.replaceState(null, "", location.pathname);
+  }
+  token = sessionStorage.getItem(TOKEN_KEY) ?? "";
+  return token;
+}
+
+/**
+ * Accepts a token from anywhere, and keeps it where the fragment path keeps
+ * one.
+ *
+ * Setting only the module variable meant a token pasted by a person was
+ * forgotten the moment anything called `readTokenFromLocation` again — which
+ * `boot` does first thing — so signing a second browser in appeared to do
+ * nothing at all. Session storage, not local: a token that outlives the window
+ * is a token nobody remembers to revoke.
+ */
+export function setToken(value) {
+  token = String(value ?? "");
+  if (typeof sessionStorage === "undefined") return;
+  if (token) sessionStorage.setItem(TOKEN_KEY, token);
+  else sessionStorage.removeItem(TOKEN_KEY);
+}
+export function hasToken() { return token.length > 0; }
+
+async function request(route, { method = "GET", body } = {}) {
+  if (!Object.values(ROUTES).includes(route)) throw new SetupError(`Refusing to request ${route}: not a setup route.`, { route });
+
+  let response;
+  try {
+    response = await fetch(route, {
+      method,
+      headers: { "content-type": "application/json", accept: "application/json", authorization: `Bearer ${token}` },
+      body: body === undefined ? undefined : JSON.stringify(body)
+    });
+  } catch {
+    throw new SetupError("Sealkeep on this machine stopped answering. Is it still running in the terminal you started it from?", { route });
+  }
+
+  if (response.status === 401 || response.status === 403) {
+    throw new SetupError("This page is not signed in to Sealkeep on this machine. Start it again with sealkeep ui, which opens the page already signed in.", { status: response.status, route });
+  }
+  if (response.status === 404) {
+    throw new SetupError(`This build of Sealkeep has no ${route} endpoint yet.`, { status: 404, route, missing: true });
+  }
+
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) throw new SetupError(payload?.error?.message ?? `${response.status} ${response.statusText || "request failed"}`, { status: response.status, route });
+  return payload;
+}
+
+/** What is already done on this machine, so a reopened page does not offer to redo it. */
+export const fetchState = () => request(ROUTES.state);
+
+/**
+ * Creates the vault and returns the recovery phrase.
+ *
+ * This is the one call in the product that returns a secret over HTTP, and it
+ * returns it exactly once. The caller must render it and drop it; there is
+ * deliberately no second function here that could fetch it again.
+ */
+// `confirm: true` is the server's guard on the calls that change something
+// real. The wizard has already shown the warning the guard exists for by the
+// time it calls, so it confirms. Omitting the flag (the old bug) made the call
+// fail on a fresh machine, so the wizard could not actually set anything up.
+// `remember` defaults to true server-side, so the new vault keeps its phrase
+// without asking again here.
+//
+// `storageMode` and `password` are named exactly as setupVaultSchema declares
+// them — the schema is `.strict()`, and this seam has drifted three times
+// before. The mode always travels, even at its default, so the vault created
+// is the one the person saw selected; anything but the literal "plain" is sent
+// as "sealed" so a stray value cannot smuggle an unencrypted vault past the
+// choice. The password is omitted rather than sent empty: min(8) would reject
+// "" and fail the whole create over a field the person never filled in.
+export const createVault = ({ password, storageMode } = {}) => request(ROUTES.vault, {
+  method: "POST",
+  body: {
+    confirm: true,
+    storageMode: storageMode === "plain" ? "plain" : "sealed",
+    ...(password ? { password } : {})
+  }
+});
+
+/**
+ * Whether a password lock really exists on this machine now.
+ *
+ * Asked after a password vault is created, because the server deliberately
+ * refuses to fail the create over a lock it could not write — the phrase is
+ * being shown exactly once and must not be lost to a keychain hiccup. The done
+ * screen reports what is true rather than what was requested, and this is
+ * where the truth comes from.
+ */
+export const fetchUnlockCheck = () => request(ROUTES.unlockCheck);
+
+/** Write-only by contract: no function here reads storage credentials back, masked or otherwise. */
+export const saveStorage = (config) => request(ROUTES.storage, { method: "POST", body: config });
+
+/**
+ * Proves a target works without committing to it. Stores nothing: the credential
+ * is used for one small write and read, then dropped, so a failed test cannot
+ * leave a broken configuration behind.
+ */
+export const testStorage = (config) => request(ROUTES.storageTest, { method: "POST", body: config });
+
+// `reclaim` is deliberately left at its server default of false: the service
+// starts, but does not get standing permission to move a person's files to the
+// trash from a single wizard click. That permission is granted knowingly, later,
+// from Settings. The old body sent `{ enabled: true }`, a field the strict
+// schema does not have, so the call was rejected and the service never started.
+export const startService = () => request(ROUTES.service, { method: "POST", body: { confirm: true } });
+
+/**
+ * A pairing code and the email it belongs to — never a password, never a
+ * phrase. The panel issues these under "Show a pairing code"; see the endpoint
+ * for why that distinction is load-bearing.
+ */
+export const enrollDevice = (email, code) => request(ROUTES.enroll, { method: "POST", body: { email, code } });