sealkeep 0.5.2 → 0.6.0

package/dist/src/adapters.js

@@ -286,11 +286,11 @@ export function hookConfig(agent, executable = "vaultline", dataDir = "~/.vaultl
                 PostCompact: entry(3),
                 SessionStart: rehydrateEntry
             },
-            _vaultlineNote: "Run `sealkeep queue run` (with VAULTLINE_RECOVERY_PHRASE set) to encrypt queued sessions. If this Codex version has no SessionStart hook, the entry is ignored; `sealkeep recover <session-file>` is the manual door."
+            _vaultlineNote: "Run `sealkeep queue run` (with SEALKEEP_RECOVERY_PHRASE set) to encrypt queued sessions. If this Codex version has no SessionStart hook, the entry is ignored; `sealkeep recover <session-file>` is the manual door."
         };
     return {
         hooks: { SessionEnd: entry(5), SessionStart: rehydrateEntry },
-        _vaultlineNote: "Merge the hooks object into ~/.claude/settings.json. The hook stores no secret; run `sealkeep queue run` with VAULTLINE_RECOVERY_PHRASE to encrypt queued sessions. SessionStart(resume) puts archived transcripts back before the resume reads them."
+        _vaultlineNote: "Merge the hooks object into ~/.claude/settings.json. The hook stores no secret; run `sealkeep queue run` with SEALKEEP_RECOVERY_PHRASE to encrypt queued sessions. SessionStart(resume) puts archived transcripts back before the resume reads them."
     };
 }
 /**

package/dist/src/autopilot.js

@@ -34,11 +34,11 @@ export async function enableAutopilot(dataDir, options = {}) {
             remembered = await rememberRecoveryPhrase(dataDir, config.vaultId, phrase, options.backend);
         }
         catch (error) {
-            notes.push(`Could not use this machine's keystore (${error instanceof Error ? error.message.split("\n")[0] : "unknown"}). The service will need VAULTLINE_RECOVERY_PHRASE in its environment.`);
+            notes.push(`Could not use this machine's keystore (${error instanceof Error ? error.message.split("\n")[0] : "unknown"}). The service will need SEALKEEP_RECOVERY_PHRASE in its environment.`);
         }
     }
     else if (!remember) {
-        notes.push("The phrase was not stored. Put VAULTLINE_RECOVERY_PHRASE in the service environment yourself, or sessions will queue up unsealed.");
+        notes.push("The phrase was not stored. Put SEALKEEP_RECOVERY_PHRASE in the service environment yourself, or sessions will queue up unsealed.");
     }
     const desired = { policy: reclaim ? "archive-and-reclaim" : "sync-only", olderThanDays: options.olderThanDays ?? DEFAULTS.olderThanDays, graceDays: options.graceDays ?? DEFAULTS.graceDays };
     // A vault written before archive lifecycle existed has no deleteAfterDays; absent means never.
@@ -89,7 +89,7 @@ export async function enableAutopilot(dataDir, options = {}) {
         // this the daemon takes the "uploads are disabled" branch on every tick,
         // and since reclaiming requires a verified remote copy, it also never frees
         // a byte — the one thing the user installed it to do.
-        environment: serviceUnitEnvironment(hasRemoteTarget ? { VAULTLINE_ENABLE_SIGNER: "1" } : {})
+        environment: serviceUnitEnvironment(hasRemoteTarget ? { SEALKEEP_ENABLE_SIGNER: "1" } : {})
     };
     const service = options.dryRun
         ? { kind: servicePlan(serviceOptions).kind, installed: false, path: servicePlan(serviceOptions).path, ranCommands: [], note: "dry run: nothing was installed" }

package/dist/src/chunk-store.js

@@ -407,6 +407,12 @@ async function runChunkSeal(ctx, args) {
         indexed = true;
     }
     catch { /* the next `index build` re-indexes this archive */ }
+    // The account learns what each destination holds from the machines that
+    // write to them — refresh the stamps now that this archive is recorded.
+    {
+        const { pushTargetUsage } = await import("./storage-targets.js");
+        void pushTargetUsage(ctx.dataDir);
+    }
     return { record, folder: args.folder, storedBytes: sealed.storedBytes, chunkCount: envelope.chunks.length, reusedChunks: args.reusedChunks, heldAtMostBytes, indexed };
 }
 /**

package/dist/src/cli.js

@@ -36,6 +36,7 @@ import { setupPlan } from "./storage-setup.js";
 import { connectGdrive } from "./providers/gdrive.js";
 import { resolveRecoveryPhrase } from "./secrets.js";
 import { amber, bold, blue, bytes, callout, command as cmd, dim, green, heading, hint, keyValue, mark, relativeTime, shortPath, steps, table, vaultline } from "./ui.js";
+import { envVar } from "./env.js";
 const VALUE_FLAGS = new Set(["--data-dir", "--recovery-phrase", "--agent", "--home", "--limit", "--executable", "--provider", "--bucket", "--prefix", "--region", "--older-than-days", "--status", "--max", "--port", "--overwrite", "--label", "--public-key", "--config-id", "--backend", "--endpoint", "--policy", "--grace-days", "--interval", "--manifest", "--artifact", "--key", "--current", "--api", "--token", "--group", "--cli-path", "--account-id", "--project", "--out", "--password"]);
 function take(args, flag, fallback) { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : fallback; }
 function positionals(args) { return args.filter((value, index) => !value.startsWith("-") && !VALUE_FLAGS.has(args[index - 1] ?? "")); }
@@ -47,7 +48,7 @@ function agentId(value) { const agent = required(value, "Agent must be codex or
 async function unlock(dataDir, explicit) {
     const config = await readConfig(dataDir).catch(() => null);
     if (!config)
-        return explicit ?? process.env.VAULTLINE_RECOVERY_PHRASE;
+        return explicit ?? envVar("RECOVERY_PHRASE");
     const resolved = await resolveRecoveryPhrase(dataDir, config.vaultId, explicit);
     if (resolved)
         return resolved;
@@ -250,7 +251,12 @@ function usage() {
 }
 async function main() {
     const [command, ...args] = process.argv.slice(2);
-    const dataDir = take(args, "--data-dir", defaultDataDir());
+    // The product itself writes SEALKEEP_DATA_DIR into the agent configs that
+    // `mcp install` generates, and the MCP server honours it — so a person who
+    // exports it and then runs the CLI reasonably expects the same vault. It used
+    // to be ignored here, which meant the CLI quietly worked on a different vault
+    // than the agent did. An explicit --data-dir still wins over the variable.
+    const dataDir = take(args, "--data-dir", envVar("DATA_DIR") ?? defaultDataDir());
     const json = args.includes("--json");
     // --version is the first thing anyone types at an unfamiliar CLI, and it was
     // answering "Unknown command". Read it from the manifest rather than hardcoding
@@ -371,7 +377,7 @@ async function main() {
                     ? `automatically ${dim(`· phrase kept in ${result.remembered.backend}`)}`
                     : dryRun && !args.includes("--no-remember")
                         ? `automatically ${dim("· the phrase would be kept in this machine's keystore")}`
-                        : `${mark.warn()} needs VAULTLINE_RECOVERY_PHRASE`],
+                        : `${mark.warn()} needs SEALKEEP_RECOVERY_PHRASE`],
             ["Reclaims", result.reclaimEnabled ? `after ${result.retention.olderThanDays}d ${dim(`+ ${result.retention.graceDays}d grace, once a remote copy is verified`)}` : dim("never — sync only")],
             ["Starts", result.service.installed ? `at login ${dim(`· ${result.service.kind}`)}` : dryRun ? dim(`${result.service.kind} service at ${shortPath(result.service.path, 44)}`) : `${mark.warn()} not installed`]
         ]));
@@ -424,7 +430,7 @@ async function main() {
             print(`  ${dim("Could not reach your account, so the last known sync rules are in force.")}`);
         print(heading("Next"));
         print(steps([
-            `Encrypt what is queued:  ${cmd(`VAULTLINE_RECOVERY_PHRASE="…" sealkeep queue run`)}`,
+            `Encrypt what is queued:  ${cmd(`SEALKEEP_RECOVERY_PHRASE="…" sealkeep queue run`)}`,
             `Archive automatically:   ${cmd("vaultline agents hook-config codex")} ${dim("(review, then merge)")}`,
             `See it:                  ${cmd("sealkeep desktop")}`
         ]));
@@ -441,7 +447,7 @@ async function main() {
             print(`\n${BRAND}\n`);
             const choice = await onboard();
             const filled = choice.mode === "paid"
-                ? { ...choice, password: process.env.VAULTLINE_CLOUD_PASSWORD ?? await promptForPhrase("Choose a password (12+ characters): ") }
+                ? { ...choice, password: envVar("CLOUD_PASSWORD") ?? await promptForPhrase("Choose a password (12+ characters): ") }
                 : choice;
             const result = await start(dataDir, filled);
             print(`\n${recoveryPhraseScreen(result.phrase)}`);
@@ -471,7 +477,7 @@ async function main() {
             ? await start(dataDir, {
                 mode: "paid",
                 email: take(args, "--email") ?? fail("invalid_argument", "--email is required for a paid account"),
-                password: process.env.VAULTLINE_CLOUD_PASSWORD ?? await promptForPhrase("Choose a password (12+ characters): "),
+                password: envVar("CLOUD_PASSWORD") ?? await promptForPhrase("Choose a password (12+ characters): "),
                 label: take(args, "--label", "this machine")
             })
             : await start(dataDir, {
@@ -558,12 +564,12 @@ async function main() {
             const email = take(args, "--email") ?? fail("invalid_argument", "--email is required");
             // A one-time code from the panel is the only way in for an account that
             // signed up with Google, and it works for password accounts too.
-            const code = take(args, "--code") ?? process.env.VAULTLINE_CLOUD_CODE;
+            const code = take(args, "--code") ?? envVar("CLOUD_CODE");
             const account = code
                 ? await cloud.loginWithCode(dataDir, { email: email, token: code })
                 : await cloud.login(dataDir, {
                     email: email,
-                    password: process.env.VAULTLINE_CLOUD_PASSWORD ?? await promptForPhrase("Password: ")
+                    password: envVar("CLOUD_PASSWORD") ?? await promptForPhrase("Password: ")
                 });
             if (json) {
                 print(JSON.stringify(account, null, 2));
@@ -1155,7 +1161,7 @@ async function main() {
             return;
         }
         if (action === "run") {
-            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Pass --recovery-phrase, set VAULTLINE_RECOVERY_PHRASE, or run `sealkeep autopilot` so this machine remembers it.");
+            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Pass --recovery-phrase, set SEALKEEP_RECOVERY_PHRASE, or run `sealkeep autopilot` so this machine remembers it.");
             const processed = await drainQueue(dataDir, phrase, { max: Number(take(args, "--max", "25")) });
             if (json) {
                 print(JSON.stringify(processed, null, 2));
@@ -1563,7 +1569,7 @@ async function main() {
         return;
     }
     if (command === "migrate") {
-        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or set VAULTLINE_RECOVERY_PHRASE)");
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or set SEALKEEP_RECOVERY_PHRASE)");
         const result = await migrateVault(dataDir, phrase);
         if (json) {
             print(JSON.stringify(result, null, 2));
@@ -1573,7 +1579,7 @@ async function main() {
         return;
     }
     if (command === "rewrap") {
-        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or set VAULTLINE_RECOVERY_PHRASE)");
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or set SEALKEEP_RECOVERY_PHRASE)");
         const result = await rewrapVault(dataDir, phrase, { group: take(args, "--group") });
         if (json) {
             print(JSON.stringify(result, null, 2));
@@ -1757,8 +1763,8 @@ async function main() {
             const backend = take(args, "--backend");
             // The account's shared Google client first: no console visit, no env
             // var — the consent screen is the whole setup. The PKCE desktop path
-            // stays for self-hosters who set VAULTLINE_GDRIVE_CLIENT_ID.
-            const viaCloud = !process.env.VAULTLINE_GDRIVE_CLIENT_ID;
+            // stays for self-hosters who set SEALKEEP_GDRIVE_CLIENT_ID.
+            const viaCloud = !envVar("GDRIVE_CLIENT_ID");
             const credentials = viaCloud ? await (await import("./cloud.js")).connectGdriveViaCloud(dataDir, {
                 onConsentUrl: (url) => {
                     print(`\n  ${dim("Approve Sealkeep in the browser window. If none opened, use this link:")}`);
@@ -1982,7 +1988,7 @@ async function main() {
         fail("invalid_argument", "Usage: sealkeep retention <preview|apply|prune|offload|approve|policy> [options]");
     }
     if (command === "daemon") {
-        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Run `sealkeep autopilot` so this machine can unlock itself, or set VAULTLINE_RECOVERY_PHRASE.");
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Run `sealkeep autopilot` so this machine can unlock itself, or set SEALKEEP_RECOVERY_PHRASE.");
         const reclaim = args.includes("--reclaim");
         const daemon = await startDaemon(dataDir, {
             phrase, intervalMs: Number(take(args, "--interval", "30")) * 1000, home: take(args, "--home"),
@@ -2012,10 +2018,10 @@ async function main() {
 }
 const HINTS = {
     vault_not_initialized: "run `sealkeep quickstart`",
-    recovery_phrase_missing: "pass --recovery-phrase, or set VAULTLINE_RECOVERY_PHRASE",
+    recovery_phrase_missing: "pass --recovery-phrase, or set SEALKEEP_RECOVERY_PHRASE",
     recovery_phrase_mismatch: "check the phrase from your recovery kit",
     storage_not_configured: "run `sealkeep storage configure --provider … --bucket … --prefix …`",
-    signer_not_configured: "set VAULTLINE_ENABLE_SIGNER=1 and store credentials",
+    signer_not_configured: "set SEALKEEP_ENABLE_SIGNER=1 and store credentials",
     destination_exists: "add --overwrite backup to keep the existing file",
     destination_unwritable: "free some space, or restore to a different <destination> on another volume",
     archive_not_found: "run `sealkeep list` to see archive ids",

package/dist/src/cloud.js

@@ -6,6 +6,7 @@ import { canonicalPhrase } from "./mnemonic.js";
 import { fail, isVaultlineError, VaultlineError } from "./errors.js";
 import { sha256 } from "./crypto.js";
 import { listArchives, readConfig, writeRecord } from "./vault.js";
+import { envVar } from "./env.js";
 /**
  * Sealkeep Cloud: the managed tier.
  *
@@ -16,7 +17,7 @@ import { listArchives, readConfig, writeRecord } from "./vault.js";
  * control plane is never sent a key that opens it.
  */
 export const DEFAULT_CLOUD_URL = "https://shared.spala.ai/p04946/api";
-const cloudUrl = (env = process.env) => (env.VAULTLINE_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
+const cloudUrl = (env = process.env) => (envVar("CLOUD_URL", env) ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
 /**
  * Where this vault's cloud token lives in the keystore.
  *

package/dist/src/control-plane-cli.js

@@ -4,18 +4,19 @@ import { join } from "node:path";
 import { createControlPlaneServer } from "./control-plane/server.js";
 import { defaultDataDir } from "./vault.js";
 import { freePort } from "./net.js";
+import { envVar } from "./env.js";
 /**
  * Runs the control plane.
  *
- * Authentication is on by default. `VAULTLINE_CONTROL_PLANE_DEV=1` turns it off for
+ * Authentication is on by default. `SEALKEEP_CONTROL_PLANE_DEV=1` turns it off for
  * local interface work and the banner says so loudly, because an unauthenticated
  * instance reachable from a network would let anyone enumerate account metadata.
  */
-const development = process.env.VAULTLINE_CONTROL_PLANE_DEV === "1";
-const storePath = process.env.VAULTLINE_CONTROL_PLANE_STORE ?? join(defaultDataDir(), "control-plane", "state.json");
-const tls = process.env.VAULTLINE_TLS_CERT && process.env.VAULTLINE_TLS_KEY
-    ? { cert: readFileSync(process.env.VAULTLINE_TLS_CERT), key: readFileSync(process.env.VAULTLINE_TLS_KEY) }
-    : undefined;
+const development = envVar("CONTROL_PLANE_DEV") === "1";
+const storePath = envVar("CONTROL_PLANE_STORE") ?? join(defaultDataDir(), "control-plane", "state.json");
+const tlsCert = envVar("TLS_CERT");
+const tlsKey = envVar("TLS_KEY");
+const tls = tlsCert && tlsKey ? { cert: readFileSync(tlsCert), key: readFileSync(tlsKey) } : undefined;
 const server = createControlPlaneServer({
     storePath: development ? undefined : storePath,
     requireAuth: !development,
@@ -31,7 +32,7 @@ async function listen() {
         if (development)
             console.log("MODE: development — device authentication is DISABLED and state is in memory. Do not expose this.");
         else
-            console.log(`Durable state: ${storePath}${tls ? "" : "\nWARNING: no TLS configured. Set VAULTLINE_TLS_CERT and VAULTLINE_TLS_KEY before accepting non-loopback traffic."}`);
+            console.log(`Durable state: ${storePath}${tls ? "" : "\nWARNING: no TLS configured. Set SEALKEEP_TLS_CERT and SEALKEEP_TLS_KEY before accepting non-loopback traffic."}`);
     });
 }
 void listen();

package/dist/src/control-plane.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { fail } from "./errors.js";
+import { envVar } from "./env.js";
 export const DEFAULT_LEASE_TTL_MS = 15 * 60_000;
 class PlannedProvider {
     provider;
@@ -44,13 +45,13 @@ export function assertLeaseUsable(lease, now = Date.now()) {
 }
 /** Feature flag for provider work in progress. Off by default and read per call so tests and operators can flip it. */
 export function signerEnabled(env = process.env) {
-    return env.VAULTLINE_ENABLE_SIGNER === "1";
+    return envVar("ENABLE_SIGNER", env) === "1";
 }
 const uploadClients = new Map();
 /** Registration is refused unless the operator explicitly enabled signer work. */
 export function registerUploadClient(client, env = process.env) {
     if (!signerEnabled(env))
-        fail("signer_not_configured", "Set VAULTLINE_ENABLE_SIGNER=1 to register a provider upload client", { provider: client.kind });
+        fail("signer_not_configured", "Set SEALKEEP_ENABLE_SIGNER=1 to register a provider upload client", { provider: client.kind });
     uploadClients.set(client.kind, client);
 }
 export function uploadClientFor(kind, env = process.env) {

package/dist/src/dashboard-cli.js

@@ -5,7 +5,8 @@
 import { defaultDataDir } from "./vault.js";
 import { createLocalApiServer, localApiToken, localApiTokenPath } from "./local-api.js";
 import { freePort } from "./net.js";
-const dataDir = process.env.VAULTLINE_DATA_DIR ?? defaultDataDir();
+import { envVar } from "./env.js";
+const dataDir = envVar("DATA_DIR") ?? defaultDataDir();
 async function listen() {
     const token = await localApiToken(dataDir);
     const server = createLocalApiServer(dataDir, token);

package/dist/src/doctor.js

@@ -10,6 +10,7 @@ import { quotaMessage, quotaState } from "./packages.js";
 import { loadProviderCredentials, resolveRecoveryPhrase } from "./secrets.js";
 import { ENVELOPE_VERSION, SUITES } from "../packages/vaultline-crypto/src/index.js";
 import { readConfig } from "./vault.js";
+import { envVar } from "./env.js";
 async function writable(directory) {
     const probe = join(directory, `.vaultline-write-probe-${randomUUID()}`);
     try {
@@ -175,7 +176,7 @@ export async function runDoctor(dataDir, env = process.env) {
     // missing and named an environment variable as the cure.
     const phraseAvailable = config
         ? await resolveRecoveryPhrase(dataDir, config.vaultId, undefined, env).then((phrase) => Boolean(phrase)).catch(() => false)
-        : Boolean(env.VAULTLINE_RECOVERY_PHRASE);
+        : Boolean(envVar("RECOVERY_PHRASE", env));
     checks.push(phraseAvailable
         ? { name: "recovery-phrase", status: "pass", detail: "This machine can unlock the vault on its own, so archiving runs unattended." }
         : { name: "recovery-phrase", status: "warn", detail: "This machine doesn't hold your recovery phrase, so it can't archive on its own. Add it under Settings › Unlocking to let archiving run unattended. Your vault and archives are unaffected." });

package/dist/src/enroll.js

@@ -18,7 +18,7 @@ import { setRetentionPolicy, retentionSettings, DEFAULT_RETENTION } from "./rete
  * injectable — this module has to be testable against a fake today and
  * work unchanged against the real thing later.
  */
-const cloudUrl = (env = process.env) => (env.VAULTLINE_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
+const cloudUrl = (env = process.env) => (env.SEALKEEP_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
 /**
  * The token location comes from cloud.ts rather than being restated here.
  *

package/dist/src/env.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Environment variables, under the product's own name.
+ *
+ * The product was called Vaultline until August 2026, and its variables carried
+ * that name. They still work — someone's launchd plist or CI file should not
+ * break because we renamed a brand — but everything the product prints, writes,
+ * and documents now says SEALKEEP_. When both are set the new name wins, so a
+ * machine can be migrated one variable at a time.
+ */
+/** Reads `SEALKEEP_<name>`, falling back to the Vaultline-era name. */
+export declare function envVar(name: string, env?: NodeJS.ProcessEnv): string | undefined;
+/** True when either spelling is set to something truthy. */
+export declare function envFlag(name: string, env?: NodeJS.ProcessEnv): boolean;
+/** The name to print or write into a config file — always the current one. */
+export declare const envName: (name: string) => string;
+/** Both spellings, for messages that tell someone what to set. */
+export declare const envNames: (name: string) => string[];

package/dist/src/env.js

@@ -0,0 +1,28 @@
+/**
+ * Environment variables, under the product's own name.
+ *
+ * The product was called Vaultline until August 2026, and its variables carried
+ * that name. They still work — someone's launchd plist or CI file should not
+ * break because we renamed a brand — but everything the product prints, writes,
+ * and documents now says SEALKEEP_. When both are set the new name wins, so a
+ * machine can be migrated one variable at a time.
+ */
+const LEGACY_PREFIX = "VAULTLINE_";
+const PREFIX = "SEALKEEP_";
+/** Reads `SEALKEEP_<name>`, falling back to the Vaultline-era name. */
+export function envVar(name, env = process.env) {
+    const current = env[PREFIX + name];
+    if (current !== undefined && current !== "")
+        return current;
+    const legacy = env[LEGACY_PREFIX + name];
+    return legacy === "" ? undefined : legacy;
+}
+/** True when either spelling is set to something truthy. */
+export function envFlag(name, env = process.env) {
+    const value = envVar(name, env);
+    return value === "1" || value === "true" || value === "yes";
+}
+/** The name to print or write into a config file — always the current one. */
+export const envName = (name) => PREFIX + name;
+/** Both spellings, for messages that tell someone what to set. */
+export const envNames = (name) => [PREFIX + name, LEGACY_PREFIX + name];

package/dist/src/local-api.js

@@ -24,6 +24,7 @@ import { isV2 } from "./types.js";
 import * as cloud from "./cloud.js";
 import { configureRemoteStorage, initialize, listArchives, previewRetention, readConfig, vaultStatus, writeRecord } from "./vault.js";
 import { sha256 } from "./crypto.js";
+import { envVar } from "./env.js";
 const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
 /**
  * `vault.line` and `vault.localhost` join the list because the address bar is
@@ -303,7 +304,7 @@ export async function testStorageTarget(input) {
     const payload = Buffer.from(`sealkeep write test ${randomBytes(16).toString("hex")}\n`);
     const digest = sha256(payload);
     try {
-        // VAULTLINE_ENABLE_SIGNER gates *uploading archives* through a provider
+        // SEALKEEP_ENABLE_SIGNER gates *uploading archives* through a provider
         // client, and it is off unless the installed service turns it on. That gate
         // is right for archives and wrong for this: refusing to check a bucket
         // because archives are not enabled yet would mean the only way to find out
@@ -312,7 +313,7 @@ export async function testStorageTarget(input) {
         // fifty bytes the person explicitly asked to have written, to a bucket they
         // just named, with a credential they just typed. Nothing else in this
         // process gains the flag and the archive path is untouched.
-        const probeEnv = { ...process.env, VAULTLINE_ENABLE_SIGNER: "1" };
+        const probeEnv = { ...process.env, SEALKEEP_ENABLE_SIGNER: "1" };
         const target = { provider, bucket, prefix, ...(region ? { region } : {}) };
         const client = createUploadClient(target, credentials, endpoint ? endpointOverrides(endpoint) : {}, probeEnv);
         const lease = createActiveLease(target, {
@@ -648,12 +649,13 @@ async function cloudPlanAndQuota(dataDir) {
 /**
  * The account panel lives on the product domain, which is no longer the API's
  * origin — deriving it from the cloud URL sent people to the old address after
- * the rename. A self-hosted plane (VAULTLINE_CLOUD_URL set) still derives from
+ * the rename. A self-hosted plane (SEALKEEP_CLOUD_URL set) still derives from
  * its own origin, because there is no sealkeep.spala.ai panel for it.
  */
 async function panelUrl() {
-    if (process.env.VAULTLINE_CLOUD_URL) {
-        const origin = process.env.VAULTLINE_CLOUD_URL.replace(/\/+$/, "").replace(/\/api$/, "");
+    const selfHosted = envVar("CLOUD_URL");
+    if (selfHosted) {
+        const origin = selfHosted.replace(/\/+$/, "").replace(/\/api$/, "");
         return `${origin}/#account`;
     }
     const { PRODUCT_URL } = await import("./branding.js");
@@ -950,7 +952,7 @@ export function createLocalApiServer(dataDir, token, options = {}) {
         if (offerCache && Date.now() - offerCache.at < 10 * 60_000)
             return offerCache.value;
         try {
-            const base = (process.env.VAULTLINE_CLOUD_URL ?? cloud.DEFAULT_CLOUD_URL).replace(/\/$/, "");
+            const base = (envVar("CLOUD_URL") ?? cloud.DEFAULT_CLOUD_URL).replace(/\/$/, "");
             const response = await fetch(`${base}/v1/public/offer`, { signal: AbortSignal.timeout(4000) });
             const body = response.ok ? await response.json() : null;
             offerCache = { at: Date.now(), value: body?.offer ?? null };
@@ -1500,7 +1502,7 @@ export function createLocalApiServer(dataDir, token, options = {}) {
                 const { capGb } = parseBody(rollingCapSchema, await readJsonBody(request));
                 const { cloudToken, DEFAULT_CLOUD_URL } = await import("./cloud.js");
                 const token = await cloudToken(dataDir);
-                const base = (process.env.VAULTLINE_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
+                const base = (envVar("CLOUD_URL") ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
                 const pushed = await fetch(`${base}/v1/cloud/rolling`, {
                     method: "PUT",
                     headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
@@ -1596,11 +1598,11 @@ export function createLocalApiServer(dataDir, token, options = {}) {
                         remembered = await rememberRecoveryPhrase(dataDir, config.vaultId, phrase);
                     }
                     catch (error) {
-                        notes.push(`This machine's keystore refused the phrase (${error instanceof Error ? error.message.split("\n")[0] : "unknown error"}). The background service will need VAULTLINE_RECOVERY_PHRASE in its environment.`);
+                        notes.push(`This machine's keystore refused the phrase (${error instanceof Error ? error.message.split("\n")[0] : "unknown error"}). The background service will need SEALKEEP_RECOVERY_PHRASE in its environment.`);
                     }
                 }
                 else {
-                    notes.push("The phrase was not stored on this machine, so the background service cannot seal sessions until VAULTLINE_RECOVERY_PHRASE is in its environment.");
+                    notes.push("The phrase was not stored on this machine, so the background service cannot seal sessions until SEALKEEP_RECOVERY_PHRASE is in its environment.");
                 }
                 if (password) {
                     // Failure may not cost the person this response: the vault already
@@ -1748,7 +1750,7 @@ export function createLocalApiServer(dataDir, token, options = {}) {
                     // verified remote copy it would never free a byte either — see the
                     // note on `environment` in service.ts. serviceUnitEnvironment adds
                     // the secret-backend choice, without which the daemon cannot unlock.
-                    environment: serviceUnitEnvironment(config.remoteStorage ? { VAULTLINE_ENABLE_SIGNER: "1" } : {})
+                    environment: serviceUnitEnvironment(config.remoteStorage ? { SEALKEEP_ENABLE_SIGNER: "1" } : {})
                 }));
                 return json(response, outcome.installed ? 201 : 200, {
                     service: { kind: outcome.kind, installed: outcome.installed, alreadyInstalled: false, path: outcome.path, ranCommands: outcome.ranCommands, note: outcome.note ?? null },

package/dist/src/mcp-install.d.ts

@@ -30,7 +30,7 @@ export declare function mcpServerSpec(dataDir: string, executable?: string): {
     command: string;
     args: string[];
     env: {
-        VAULTLINE_DATA_DIR: string;
+        SEALKEEP_DATA_DIR: string;
     };
 };
 /**

package/dist/src/mcp-install.js

@@ -10,7 +10,7 @@ export function mcpServerSpec(dataDir, executable = "vaultline") {
     return {
         command: executable,
         args: ["mcp"],
-        env: { VAULTLINE_DATA_DIR: dataDir }
+        env: { SEALKEEP_DATA_DIR: dataDir }
     };
 }
 /**
@@ -44,7 +44,7 @@ async function installForClaude(dataDir, exec = run) {
     try {
         await exec("claude", [
             "mcp", "add", "--transport", "stdio", "--scope", "user", "vaultline",
-            "--env", `VAULTLINE_DATA_DIR=${dataDir}`,
+            "--env", `SEALKEEP_DATA_DIR=${dataDir}`,
             "--", spec.command, ...spec.args
         ]);
         return { installed: true, detail: "registered with Claude Code — ask it to search your sessions" };
@@ -74,7 +74,7 @@ async function installForCodex(dataDir, home) {
         `args = ${JSON.stringify(spec.args)}`,
         "",
         "[mcp_servers.vaultline.env]",
-        `VAULTLINE_DATA_DIR = ${JSON.stringify(dataDir)}`,
+        `SEALKEEP_DATA_DIR = ${JSON.stringify(dataDir)}`,
         ""
     ].join("\n");
     await mkdir(dirname(fragmentPath), { recursive: true });

package/dist/src/mcp.js

@@ -4,12 +4,13 @@ import { z } from "zod";
 import { archiveFile, defaultDataDir, listArchives, previewRetention, vaultStatus } from "./vault.js";
 import { restoreArchive } from "./restore.js";
 import { providers } from "./control-plane.js";
-const dataDir = process.env.VAULTLINE_DATA_DIR ?? defaultDataDir();
-const phrase = process.env.VAULTLINE_RECOVERY_PHRASE;
+import { envVar } from "./env.js";
+const dataDir = envVar("DATA_DIR") ?? defaultDataDir();
+const phrase = envVar("RECOVERY_PHRASE");
 const server = new McpServer({ name: "vaultline", version: "0.1.0" });
 function text(value) { return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }] }; }
 function requirePhrase() { if (!phrase)
-    throw new Error("VAULTLINE_RECOVERY_PHRASE is required for archive and recovery actions"); return phrase; }
+    throw new Error("SEALKEEP_RECOVERY_PHRASE is required for archive and recovery actions"); return phrase; }
 server.registerTool("vaultline_status", {
     title: "Sealkeep status",
     description: "Read local Sealkeep health, archive count, and encrypted storage usage. No session content is returned.",

package/dist/src/notify.js

@@ -1,9 +1,10 @@
 import { execFile } from "node:child_process";
 import { platform } from "node:os";
+import { envVar } from "./env.js";
 const run = (file, args) => new Promise((resolve) => execFile(file, args, () => resolve()));
 /** Off by an explicit opt-out, and off automatically where there is no desktop session. */
 export function notificationsEnabled(env = process.env, target = platform()) {
-    if (env.VAULTLINE_NOTIFICATIONS === "off")
+    if (envVar("NOTIFICATIONS", env) === "off")
         return false;
     if (target === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY)
         return false;

package/dist/src/offload.js

@@ -116,7 +116,7 @@ export async function offloadArchives(dataDir, options = {}) {
 /**
  * Downloads an archive's ciphertext from the bucket it was offloaded to.
  *
- * VAULTLINE_ENABLE_SIGNER gates *uploading*, and it is off unless the installed
+ * SEALKEEP_ENABLE_SIGNER gates *uploading*, and it is off unless the installed
  * service turns it on. Reading back an archive in order to restore it is not
  * uploading, and refusing it on that flag would mean an offloaded archive could
  * not be recovered by the person who owns it — which would turn a space-saving
@@ -191,7 +191,7 @@ async function fetchCiphertext(dataDir, record, client) {
     const resolved = client ?? await uploadClientFromStore(dataDir, config.vaultId, target, {}, undefined);
     const lease = createActiveLease(target, {
         archiveId: record.id, ciphertextSha256: record.cipher.ciphertextSha256, bytes: record.cipher.storedBytes
-    }, { ...process.env, VAULTLINE_ENABLE_SIGNER: "1" });
+    }, { ...process.env, SEALKEEP_ENABLE_SIGNER: "1" });
     const readable = resolved;
     if (typeof readable.download !== "function") {
         fail("provider_unsupported", `${target.provider} cannot be read back by this build, so this archive cannot be fetched`);
@@ -257,7 +257,7 @@ export async function checkRemoteCopy(dataDir, archiveId, client) {
     const resolved = client ?? await uploadClientFromStore(dataDir, config.vaultId, target, {}, undefined);
     const lease = createActiveLease(target, {
         archiveId: record.id, ciphertextSha256: record.cipher.ciphertextSha256, bytes: record.cipher.storedBytes
-    }, { ...process.env, VAULTLINE_ENABLE_SIGNER: "1" });
+    }, { ...process.env, SEALKEEP_ENABLE_SIGNER: "1" });
     const probing = resolved;
     if (typeof probing.head !== "function")
         fail("provider_unsupported", `${target.provider} cannot be probed by this build`);

package/dist/src/providers/gdrive.d.ts

@@ -16,7 +16,7 @@ import type { ProviderKind, ProviderUploadClient, UploadLease } from "../control
  * into the OS keystore via secrets.ts and never into a config file.
  */
 export declare const GDRIVE_SCOPE = "https://www.googleapis.com/auth/drive.file";
-/** Placeholder until a first-party client id ships. Point VAULTLINE_GDRIVE_CLIENT_ID at your own Desktop-app OAuth client to connect today. */
+/** Placeholder until a first-party client id ships. Point SEALKEEP_GDRIVE_CLIENT_ID at your own Desktop-app OAuth client to connect today. */
 export declare const GDRIVE_CLIENT_ID_PLACEHOLDER = "000000000000-vaultline-placeholder.apps.googleusercontent.com";
 export declare function gdriveClientId(env?: NodeJS.ProcessEnv): string;
 export declare const GDRIVE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";

package/dist/src/providers/gdrive.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 import { fail, VaultlineError } from "../errors.js";
+import { envVar } from "../env.js";
 /**
  * Google Drive as a bring-your-own storage provider (Drive API v3).
  *
@@ -19,10 +20,10 @@ import { fail, VaultlineError } from "../errors.js";
  * into the OS keystore via secrets.ts and never into a config file.
  */
 export const GDRIVE_SCOPE = "https://www.googleapis.com/auth/drive.file";
-/** Placeholder until a first-party client id ships. Point VAULTLINE_GDRIVE_CLIENT_ID at your own Desktop-app OAuth client to connect today. */
+/** Placeholder until a first-party client id ships. Point SEALKEEP_GDRIVE_CLIENT_ID at your own Desktop-app OAuth client to connect today. */
 export const GDRIVE_CLIENT_ID_PLACEHOLDER = "000000000000-vaultline-placeholder.apps.googleusercontent.com";
 export function gdriveClientId(env = process.env) {
-    return env.VAULTLINE_GDRIVE_CLIENT_ID?.trim() || GDRIVE_CLIENT_ID_PLACEHOLDER;
+    return envVar("GDRIVE_CLIENT_ID", env)?.trim() || GDRIVE_CLIENT_ID_PLACEHOLDER;
 }
 export const GDRIVE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 export const GDRIVE_TOKEN_URL = "https://oauth2.googleapis.com/token";

package/dist/src/providers/index.js

@@ -18,7 +18,7 @@ function isGdriveCredentials(credentials) {
  */
 export function createUploadClient(config, credentials, overrides = {}, env = process.env) {
     if (!signerEnabled(env))
-        fail("signer_not_configured", "Uploads are disabled. Set VAULTLINE_ENABLE_SIGNER=1 to enable a configured provider client.", { provider: config.provider });
+        fail("signer_not_configured", "Uploads are disabled. Set SEALKEEP_ENABLE_SIGNER=1 to enable a configured provider client.", { provider: config.provider });
     if (config.provider === "gdrive") {
         if (!isGdriveCredentials(credentials))
             fail("invalid_argument", "Google Drive needs an OAuth credential. Run: sealkeep storage connect gdrive");

package/dist/src/rehydrate.js

@@ -29,7 +29,7 @@ export async function rehydrateSession(dataDir, target, phrase, options = {}) {
             return { rehydrated: false, reason: "already-present" };
     }
     if (!phrase)
-        return { rehydrated: false, reason: "no-phrase", note: "No recovery phrase is available to this machine (keystore or VAULTLINE_RECOVERY_PHRASE), so the sealed copy stays sealed." };
+        return { rehydrated: false, reason: "no-phrase", note: "No recovery phrase is available to this machine (keystore or SEALKEEP_RECOVERY_PHRASE), so the sealed copy stays sealed." };
     try {
         const outcome = await restoreArchive(dataDir, newest.id, phrase, { native: true, overwrite: "refuse", home: options.home });
         await recordAudit(dataDir, "archive.restore", "allowed", { archiveId: newest.id, path: outcome.output, rehydrated: true });