sealkeep 0.5.3 → 0.6.1

package/ARCHITECTURE.md

@@ -94,7 +94,7 @@ Full specification, test vectors, and tamper coverage: `packages/vaultline-crypt
 
 ## 4. Control-plane API v1
 
-Authentication is on by default. `VAULTLINE_CONTROL_PLANE_DEV=1` disables device signatures
+Authentication is on by default. `SEALKEEP_CONTROL_PLANE_DEV=1` disables device signatures
 and keeps state in memory for local interface work; `/health` reports
 `mode: development-interface` so a misconfigured deployment is visible in one request.
 
@@ -198,4 +198,4 @@ Four gates remain open, none closable by writing more code in this repository:
 3. **OS code-signing certificates.** Releases carry npm provenance and an Ed25519-signed manifest only.
 4. **Browser and accessibility QA** of the dashboard.
 
-Uploads remain off unless `VAULTLINE_ENABLE_SIGNER=1` is set explicitly.
+Uploads remain off unless `SEALKEEP_ENABLE_SIGNER=1` is set explicitly.

package/CHANGELOG.md

@@ -3,6 +3,34 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.6.1 — 2026-08-19
+
+- Reading an offloaded archive now checks for free space first. An index build
+  reads each archive in full, and on a machine already short of space that
+  filled the disk and died mid-build — the failure this product exists to
+  prevent. It refuses in words that name the archive and the shortfall, keeps a
+  512 MB reserve, and lets the build carry on with the rest.
+
+## 0.6.0 — 2026-08-19
+
+**A second machine no longer wipes your search index.** The content index is
+shared by every machine of a vault, but each machine pruned it from its own
+records: a laptop that had never sealed anything concluded every entry was
+dead, deleted them, and pushed the emptied index back — after which the machine
+that built it could not search its own history either. A machine now forgets
+only what it itself indexed. If this bit you, `sealkeep index build` on the
+machine holding the archives restores the phonebook for the whole vault.
+
+- Cross-machine search now finds ordinary uploaded archives, not just streamed
+  ones: a hit with no local record is rebuilt from the archive's own frame.
+- Environment variables are `SEALKEEP_*`. The Vaultline-era names still work,
+  so nothing on an existing machine breaks; the new name wins when both are set.
+- The CLI honours `SEALKEEP_DATA_DIR` — the variable `mcp install` already
+  writes into agent configs — so the agent and the CLI cannot silently work on
+  different vaults.
+- New: `npm run acceptance` drives 22 end-to-end scenarios through the shipped
+  CLI (see `docs/acceptance-matrix.md`).
+
 ## 0.5.3 — 2026-08-19
 
 The account now knows what every destination holds. Machines stamp

package/CONTROL_PLANE.md

@@ -6,7 +6,7 @@ The control plane stores device identities, encrypted manifests, and provider co
 
 ```sh
 npm run control-plane                       # authenticated, durable
-VAULTLINE_CONTROL_PLANE_DEV=1 npm run control-plane   # unauthenticated, in memory
+SEALKEEP_CONTROL_PLANE_DEV=1 npm run control-plane   # unauthenticated, in memory
 docker build -t vaultline-control-plane . && docker run -p 8787:8787 -v vaultline-data:/data vaultline-control-plane
 ```
 
@@ -35,7 +35,7 @@ presented in `x-vaultline-device`, `x-vaultline-timestamp`, `x-vaultline-nonce`,
 refused, and a nonce cache rejects verbatim replays. Binding method, path, and body hash
 into the signature means a captured signature cannot be redirected to another endpoint.
 
-`VAULTLINE_CONTROL_PLANE_DEV=1` disables this and keeps state in memory. It exists for
+`SEALKEEP_CONTROL_PLANE_DEV=1` disables this and keeps state in memory. It exists for
 local interface development. If `/health` reports `development-interface` on anything you
 deployed, stop it.
 
@@ -61,7 +61,7 @@ Input is ciphertext-only metadata: archive ID, encrypted byte length, SHA-256 of
 
 Every lease carries `status` and `uploadable`. In this build they are always `pending-signer` and `false`. `assertLeaseUsable` is the single gate an upload path must pass: it checks expiry first, so a replayed lease is refused as `lease_expired` rather than as an unsigned one, and it then refuses anything that is not an `active` uploadable lease with `signer_not_configured`.
 
-`VAULTLINE_ENABLE_SIGNER=1` permits registering a `ProviderUploadClient`, but no implementation ships. With the flag off, registration and lookup both fail; turning it off again immediately withdraws every registered client.
+`SEALKEEP_ENABLE_SIGNER=1` permits registering a `ProviderUploadClient`, but no implementation ships. With the flag off, registration and lookup both fail; turning it off again immediately withdraws every registered client.
 
 For S3/R2 the response contains `createMultipart`, per-part presigned PUT URLs, and a completion endpoint. For GCS it contains a signed initiation URL plus the resumable session URI returned to the local agent. The client validates the remote checksum and then calls `POST /v1/archives/complete`.
 

package/README.md

@@ -30,7 +30,7 @@ heartbeat every cycle, so `status`, the dashboard, and the local API all answer
 "is it running, when did it last check, and what has it sealed" from the same fact.
 It also raises a native notification when disk is reclaimed or something needs a
 decision — never for routine sealing, which would just train you to ignore it.
-Silence it entirely with `VAULTLINE_NOTIFICATIONS=off`.
+Silence it entirely with `SEALKEEP_NOTIFICATIONS=off`.
 
 Prefer to drive it yourself? `sealkeep quickstart` does the same setup without installing
 a service, and you run `sealkeep queue run` when you feel like it.
@@ -70,7 +70,7 @@ Autopilot runs all four on a loop. To unlock the vault without a human present,
 your phrase in the OS keystore — macOS Keychain, Freedesktop Secret Service, or Windows
 DPAPI. That is a real trade-off, stated plainly: anything running as you can read it once
 you are logged in. Opt out with `--no-remember` and supply
-`VAULTLINE_RECOVERY_PHRASE` to the service yourself. Either way, the phrase you wrote down
+`SEALKEEP_RECOVERY_PHRASE` to the service yourself. Either way, the phrase you wrote down
 stays your disaster-recovery path.
 
 ## Your recovery phrase is 24 words
@@ -191,7 +191,7 @@ and phrase still never leave your machine.
 ```sh
 sealkeep storage configure --provider r2 --bucket encrypted-sessions --prefix accounts/me
 echo '{"accessKeyId":"…","secretAccessKey":"…"}' | sealkeep storage credentials set
-VAULTLINE_ENABLE_SIGNER=1 sealkeep upload --all
+SEALKEEP_ENABLE_SIGNER=1 sealkeep upload --all
 ```
 
 Or skip storage entirely and keep everything local. Sealkeep still seals every archive; it

package/dist/site/index.html

@@ -908,7 +908,18 @@ sealkeep open 08424eb6… ./session.jsonl \
   /* Every error a catch renders into the page goes through this: the first 200
      characters are a message, anything past that is a payload nobody meant to
      put on screen. */
-  const errText = (error) => String((error && error.message) || error || "Something went wrong").slice(0, 200);
+  /* The control plane names its own internals when a step refuses — "Error at
+     step Precondition: that confirmation link is no longer valid". The half
+     after the colon is written for a person; the half before it is our
+     plumbing, and seeing it makes a clear refusal look like a crash. Strip the
+     prefix, keep the sentence, and capitalise what is left. */
+  const errText = (error) => {
+    let text = String((error && error.message) || error || "Something went wrong");
+    text = text.replace(/^\s*Error at step\s+[^:]{0,60}:\s*/i, "");
+    text = text.replace(/^\s*(Error|Exception|Failure)\s*:\s*/i, "");
+    if (text) text = text.charAt(0).toUpperCase() + text.slice(1);
+    return text.slice(0, 200);
+  };
   const bytes = (n) => {
     n = Number(n) || 0;
     for (const [u, d] of [["GB", 1024 ** 3], ["MB", 1024 ** 2], ["KB", 1024]])
@@ -927,7 +938,15 @@ sealkeep open 08424eb6… ./session.jsonl \
     const headers = {};
     if (body) headers["content-type"] = "application/json";
     if (token) headers.authorization = "Bearer " + token;
-    const res = await fetch(API + path, { method, headers, body: body && JSON.stringify(body) });
+    // A dropped connection surfaces as TypeError("Failed to fetch") — the
+    // browser's words, not ours, and they tell a customer nothing about what
+    // to do. Everything else in this panel refuses in a sentence; so does this.
+    let res;
+    try {
+      res = await fetch(API + path, { method, headers, body: body && JSON.stringify(body) });
+    } catch {
+      throw new Error("No answer from the service. Check your connection and try again.");
+    }
     // A gateway answering for a dead service sends an HTML error page, not
     // JSON. That markup used to ride error.message straight into spans like
     // pair-msg — raw <html> on screen. When the body does not parse, the
@@ -961,6 +980,40 @@ sealkeep open 08424eb6… ./session.jsonl \
     if (which === "account" && !wasPanel && !document.body.classList.contains("booting")) enterPanel();
   }
 
+  /* In-panel navigation. The pills and the plan chip both land here rather
+     than leaving it to the native anchor jump: a programmatic smooth scroll is
+     dropped on the floor in some browsers — observed live, where the hash
+     changed and the page never moved — so this checks whether anything
+     actually happened and takes the plain jump if not. A nav that does nothing
+     is worse than one that does not animate. The offset clears the sticky nav. */
+  function goTo(el) {
+    if (!el) return;
+    const start = window.scrollY;
+    // The nav wraps to two rows on a phone, so a fixed offset would park the
+    // card underneath it. Measure what is actually sticking.
+    const nav = document.querySelector(".acct-nav");
+    const clearance = (nav ? nav.getBoundingClientRect().height : 0) + 12;
+    const target = Math.max(0, el.getBoundingClientRect().top + start - clearance);
+    const smooth = motionOK();
+    window.scrollTo({ top: target, behavior: smooth ? "smooth" : "instant" });
+    if (!smooth) return;
+    setTimeout(() => {
+      if (Math.abs(window.scrollY - start) < 4 && Math.abs(target - start) > 24) {
+        window.scrollTo({ top: target, behavior: "instant" });
+      }
+    }, 320);
+  }
+  for (const link of document.querySelectorAll(".acct-nav a")) {
+    link.addEventListener("click", (event) => {
+      const id = link.getAttribute("href").slice(1);
+      const target = document.getElementById(id);
+      if (!target) return;
+      event.preventDefault();
+      history.replaceState(null, "", location.pathname + location.search + "#" + id);
+      goTo(target);
+    });
+  }
+
   /* "Account" is a promise the page has to keep on the first click, not the
      second. Routing it here rather than leaving it to the native anchor means
      exactly one thing is scrolling, and it runs after the state that decides
@@ -994,7 +1047,7 @@ sealkeep open 08424eb6… ./session.jsonl \
     $("a-name").value = user.label || "";
     $("a-plan").textContent = paid ? "Managed storage" : "Free";
     $("a-plan").className = "chip" + (paid ? " pro" : "");
-    $("a-plan").onclick = () => $("c-plan").scrollIntoView({ behavior: "smooth", block: "start" });
+    $("a-plan").onclick = () => goTo($("c-plan"));
     $("a-who").textContent = [
       user.email,
       "joined " + day(user.created_at),
@@ -1198,13 +1251,16 @@ sealkeep open 08424eb6… ./session.jsonl \
   // projects, priority}]. Editing here lands on every machine of the vault,
   // because resolveTargets is cloud-first.
   let targetRows = [];
+  let planIsPaid = false;
   const providerLabel = (p) => ({ vaultline: "Sealkeep cloud", gdrive: "Google Drive", r2: "Cloudflare R2", s3: "S3", gcs: "Google Cloud" }[p] || p);
   function renderTargets() {
     const body = $("tg-body");
     body.replaceChildren();
     if (!targetRows.length) {
       $("tg-msg").className = "empty";
-      $("tg-msg").textContent = "No rules yet — everything goes to Sealkeep cloud. Add your Drive or set rules from a machine: sealkeep storage targets add …";
+      $("tg-msg").textContent = planIsPaid
+        ? "No rules yet — everything goes to Sealkeep cloud. Add a destination here, or set rules from a machine: sealkeep storage targets add …"
+        : "No rules yet — each machine seals to the bucket configured on it. Add a destination here to route by project or cap it.";
       $("tg-wrap").style.display = "none";
       return;
     }
@@ -1315,6 +1371,7 @@ sealkeep open 08424eb6… ./session.jsonl \
         // an empty state is prose, so it is set in prose. .msg is mono because
         // it reports what a machine did.
         on("s-intro", false);
+        $("a-count").textContent = "0";
         $("s-msg").className = "empty";
         $("s-msg").textContent = "Nothing stored yet. Archives appear here on their own once a machine is connected.";
         $("s-wrap").style.display = "none";
@@ -1388,6 +1445,9 @@ sealkeep open 08424eb6… ./session.jsonl \
     try { user = await api("/me", { token }); }
     catch { sessionStorage.removeItem(TOKEN); return false; }
 
+    // Set before any card renders: the routing card's empty state asks whether
+    // this account stores with us, and it draws during loadTargets below.
+    planIsPaid = user.plan === "pro";
     renderAccount(user);
     // Each section fails on its own. One dead panel must not blank the rest.
     if (user.plan === "pro") { $("a-count").textContent = "—"; loadStorage(token); }
@@ -1401,18 +1461,28 @@ sealkeep open 08424eb6… ./session.jsonl \
     // The glance line: what is connected, where seals go — from data already fetched.
     $("a-machines").textContent = String(devices);
     $("a-dest").textContent = String(Math.max(targetRows.length, 1));
-    const destNames = (targetRows.length ? targetRows : [{ provider: "vaultline" }])
-      .slice().sort((a, b) => (a.priority ?? 10) - (b.priority ?? 10))
+    const destNames = targetRows.slice()
+      .sort((a, b) => (a.priority ?? 10) - (b.priority ?? 10))
       .map((t) => providerLabel(t.provider) + (t.maxGb ? " ≤" + t.maxGb + " GB" : ""));
     const driveUsed = targetRows.filter((t) => t.provider === "gdrive" && t.usedBytes)
       .reduce((n, t) => n + t.usedBytes, 0);
     const byoUsed = targetRows.filter((t) => t.provider !== "gdrive" && t.provider !== "vaultline" && t.usedBytes)
       .reduce((n, t) => n + t.usedBytes, 0);
-    $("a-hero").textContent = bytes(Number(user.used_bytes) || 0) + " in Sealkeep cloud"
-      + (driveUsed ? " · " + bytes(driveUsed) + " in Google Drive" : "")
-      + (byoUsed ? " · " + bytes(byoUsed) + " in your bucket" : "");
+    // Only a paid account stores with us. Saying "0 B in Sealkeep cloud" to
+    // someone who runs their own bucket states a number about a place their
+    // archives never go — the free line names their storage instead.
+    const paidPlan = planIsPaid;
+    const parts = [];
+    if (paidPlan) parts.push(bytes(Number(user.used_bytes) || 0) + " in Sealkeep cloud");
+    if (driveUsed) parts.push(bytes(driveUsed) + " in Google Drive");
+    if (byoUsed) parts.push(bytes(byoUsed) + " in your bucket");
+    $("a-hero").textContent = parts.length ? parts.join(" · ")
+      : "Your archives live in storage you run";
     $("a-summary").textContent =
-      devices + " machine" + (devices === 1 ? "" : "s") + " connected · new archives go to " + destNames.join(", then ");
+      (devices ? devices + " machine" + (devices === 1 ? "" : "s") + " connected" : "No machine connected yet")
+      + " · new archives go to "
+      + (destNames.length ? destNames.join(", then ")
+         : paidPlan ? "Sealkeep cloud" : "the bucket each machine is configured with");
     const nothingYet = devices === 0 && Number(user.used_bytes) === 0;
     on("a-firstrun", nothingYet);
     $(nothingYet ? "pair-home-first" : "pair-home-more").append($("pair"));

package/dist/src/adapters.js

@@ -286,11 +286,11 @@ export function hookConfig(agent, executable = "vaultline", dataDir = "~/.vaultl
                 PostCompact: entry(3),
                 SessionStart: rehydrateEntry
             },
-            _vaultlineNote: "Run `sealkeep queue run` (with VAULTLINE_RECOVERY_PHRASE set) to encrypt queued sessions. If this Codex version has no SessionStart hook, the entry is ignored; `sealkeep recover <session-file>` is the manual door."
+            _vaultlineNote: "Run `sealkeep queue run` (with SEALKEEP_RECOVERY_PHRASE set) to encrypt queued sessions. If this Codex version has no SessionStart hook, the entry is ignored; `sealkeep recover <session-file>` is the manual door."
         };
     return {
         hooks: { SessionEnd: entry(5), SessionStart: rehydrateEntry },
-        _vaultlineNote: "Merge the hooks object into ~/.claude/settings.json. The hook stores no secret; run `sealkeep queue run` with VAULTLINE_RECOVERY_PHRASE to encrypt queued sessions. SessionStart(resume) puts archived transcripts back before the resume reads them."
+        _vaultlineNote: "Merge the hooks object into ~/.claude/settings.json. The hook stores no secret; run `sealkeep queue run` with SEALKEEP_RECOVERY_PHRASE to encrypt queued sessions. SessionStart(resume) puts archived transcripts back before the resume reads them."
     };
 }
 /**

package/dist/src/autopilot.js

@@ -34,11 +34,11 @@ export async function enableAutopilot(dataDir, options = {}) {
             remembered = await rememberRecoveryPhrase(dataDir, config.vaultId, phrase, options.backend);
         }
         catch (error) {
-            notes.push(`Could not use this machine's keystore (${error instanceof Error ? error.message.split("\n")[0] : "unknown"}). The service will need VAULTLINE_RECOVERY_PHRASE in its environment.`);
+            notes.push(`Could not use this machine's keystore (${error instanceof Error ? error.message.split("\n")[0] : "unknown"}). The service will need SEALKEEP_RECOVERY_PHRASE in its environment.`);
         }
     }
     else if (!remember) {
-        notes.push("The phrase was not stored. Put VAULTLINE_RECOVERY_PHRASE in the service environment yourself, or sessions will queue up unsealed.");
+        notes.push("The phrase was not stored. Put SEALKEEP_RECOVERY_PHRASE in the service environment yourself, or sessions will queue up unsealed.");
     }
     const desired = { policy: reclaim ? "archive-and-reclaim" : "sync-only", olderThanDays: options.olderThanDays ?? DEFAULTS.olderThanDays, graceDays: options.graceDays ?? DEFAULTS.graceDays };
     // A vault written before archive lifecycle existed has no deleteAfterDays; absent means never.
@@ -89,7 +89,7 @@ export async function enableAutopilot(dataDir, options = {}) {
         // this the daemon takes the "uploads are disabled" branch on every tick,
         // and since reclaiming requires a verified remote copy, it also never frees
         // a byte — the one thing the user installed it to do.
-        environment: serviceUnitEnvironment(hasRemoteTarget ? { VAULTLINE_ENABLE_SIGNER: "1" } : {})
+        environment: serviceUnitEnvironment(hasRemoteTarget ? { SEALKEEP_ENABLE_SIGNER: "1" } : {})
     };
     const service = options.dryRun
         ? { kind: servicePlan(serviceOptions).kind, installed: false, path: servicePlan(serviceOptions).path, ranCommands: [], note: "dry run: nothing was installed" }

package/dist/src/cli.js

@@ -36,6 +36,7 @@ import { setupPlan } from "./storage-setup.js";
 import { connectGdrive } from "./providers/gdrive.js";
 import { resolveRecoveryPhrase } from "./secrets.js";
 import { amber, bold, blue, bytes, callout, command as cmd, dim, green, heading, hint, keyValue, mark, relativeTime, shortPath, steps, table, vaultline } from "./ui.js";
+import { envVar } from "./env.js";
 const VALUE_FLAGS = new Set(["--data-dir", "--recovery-phrase", "--agent", "--home", "--limit", "--executable", "--provider", "--bucket", "--prefix", "--region", "--older-than-days", "--status", "--max", "--port", "--overwrite", "--label", "--public-key", "--config-id", "--backend", "--endpoint", "--policy", "--grace-days", "--interval", "--manifest", "--artifact", "--key", "--current", "--api", "--token", "--group", "--cli-path", "--account-id", "--project", "--out", "--password"]);
 function take(args, flag, fallback) { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : fallback; }
 function positionals(args) { return args.filter((value, index) => !value.startsWith("-") && !VALUE_FLAGS.has(args[index - 1] ?? "")); }
@@ -47,7 +48,7 @@ function agentId(value) { const agent = required(value, "Agent must be codex or
 async function unlock(dataDir, explicit) {
     const config = await readConfig(dataDir).catch(() => null);
     if (!config)
-        return explicit ?? process.env.VAULTLINE_RECOVERY_PHRASE;
+        return explicit ?? envVar("RECOVERY_PHRASE");
     const resolved = await resolveRecoveryPhrase(dataDir, config.vaultId, explicit);
     if (resolved)
         return resolved;
@@ -250,7 +251,12 @@ function usage() {
 }
 async function main() {
     const [command, ...args] = process.argv.slice(2);
-    const dataDir = take(args, "--data-dir", defaultDataDir());
+    // The product itself writes SEALKEEP_DATA_DIR into the agent configs that
+    // `mcp install` generates, and the MCP server honours it — so a person who
+    // exports it and then runs the CLI reasonably expects the same vault. It used
+    // to be ignored here, which meant the CLI quietly worked on a different vault
+    // than the agent did. An explicit --data-dir still wins over the variable.
+    const dataDir = take(args, "--data-dir", envVar("DATA_DIR") ?? defaultDataDir());
     const json = args.includes("--json");
     // --version is the first thing anyone types at an unfamiliar CLI, and it was
     // answering "Unknown command". Read it from the manifest rather than hardcoding
@@ -371,7 +377,7 @@ async function main() {
                     ? `automatically ${dim(`· phrase kept in ${result.remembered.backend}`)}`
                     : dryRun && !args.includes("--no-remember")
                         ? `automatically ${dim("· the phrase would be kept in this machine's keystore")}`
-                        : `${mark.warn()} needs VAULTLINE_RECOVERY_PHRASE`],
+                        : `${mark.warn()} needs SEALKEEP_RECOVERY_PHRASE`],
             ["Reclaims", result.reclaimEnabled ? `after ${result.retention.olderThanDays}d ${dim(`+ ${result.retention.graceDays}d grace, once a remote copy is verified`)}` : dim("never — sync only")],
             ["Starts", result.service.installed ? `at login ${dim(`· ${result.service.kind}`)}` : dryRun ? dim(`${result.service.kind} service at ${shortPath(result.service.path, 44)}`) : `${mark.warn()} not installed`]
         ]));
@@ -424,7 +430,7 @@ async function main() {
             print(`  ${dim("Could not reach your account, so the last known sync rules are in force.")}`);
         print(heading("Next"));
         print(steps([
-            `Encrypt what is queued:  ${cmd(`VAULTLINE_RECOVERY_PHRASE="…" sealkeep queue run`)}`,
+            `Encrypt what is queued:  ${cmd(`SEALKEEP_RECOVERY_PHRASE="…" sealkeep queue run`)}`,
             `Archive automatically:   ${cmd("vaultline agents hook-config codex")} ${dim("(review, then merge)")}`,
             `See it:                  ${cmd("sealkeep desktop")}`
         ]));
@@ -441,7 +447,7 @@ async function main() {
             print(`\n${BRAND}\n`);
             const choice = await onboard();
             const filled = choice.mode === "paid"
-                ? { ...choice, password: process.env.VAULTLINE_CLOUD_PASSWORD ?? await promptForPhrase("Choose a password (12+ characters): ") }
+                ? { ...choice, password: envVar("CLOUD_PASSWORD") ?? await promptForPhrase("Choose a password (12+ characters): ") }
                 : choice;
             const result = await start(dataDir, filled);
             print(`\n${recoveryPhraseScreen(result.phrase)}`);
@@ -471,7 +477,7 @@ async function main() {
             ? await start(dataDir, {
                 mode: "paid",
                 email: take(args, "--email") ?? fail("invalid_argument", "--email is required for a paid account"),
-                password: process.env.VAULTLINE_CLOUD_PASSWORD ?? await promptForPhrase("Choose a password (12+ characters): "),
+                password: envVar("CLOUD_PASSWORD") ?? await promptForPhrase("Choose a password (12+ characters): "),
                 label: take(args, "--label", "this machine")
             })
             : await start(dataDir, {
@@ -558,12 +564,12 @@ async function main() {
             const email = take(args, "--email") ?? fail("invalid_argument", "--email is required");
             // A one-time code from the panel is the only way in for an account that
             // signed up with Google, and it works for password accounts too.
-            const code = take(args, "--code") ?? process.env.VAULTLINE_CLOUD_CODE;
+            const code = take(args, "--code") ?? envVar("CLOUD_CODE");
             const account = code
                 ? await cloud.loginWithCode(dataDir, { email: email, token: code })
                 : await cloud.login(dataDir, {
                     email: email,
-                    password: process.env.VAULTLINE_CLOUD_PASSWORD ?? await promptForPhrase("Password: ")
+                    password: envVar("CLOUD_PASSWORD") ?? await promptForPhrase("Password: ")
                 });
             if (json) {
                 print(JSON.stringify(account, null, 2));
@@ -1155,7 +1161,7 @@ async function main() {
             return;
         }
         if (action === "run") {
-            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Pass --recovery-phrase, set VAULTLINE_RECOVERY_PHRASE, or run `sealkeep autopilot` so this machine remembers it.");
+            const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Pass --recovery-phrase, set SEALKEEP_RECOVERY_PHRASE, or run `sealkeep autopilot` so this machine remembers it.");
             const processed = await drainQueue(dataDir, phrase, { max: Number(take(args, "--max", "25")) });
             if (json) {
                 print(JSON.stringify(processed, null, 2));
@@ -1563,7 +1569,7 @@ async function main() {
         return;
     }
     if (command === "migrate") {
-        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or set VAULTLINE_RECOVERY_PHRASE)");
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or set SEALKEEP_RECOVERY_PHRASE)");
         const result = await migrateVault(dataDir, phrase);
         if (json) {
             print(JSON.stringify(result, null, 2));
@@ -1573,7 +1579,7 @@ async function main() {
         return;
     }
     if (command === "rewrap") {
-        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or set VAULTLINE_RECOVERY_PHRASE)");
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "--recovery-phrase is required (or set SEALKEEP_RECOVERY_PHRASE)");
         const result = await rewrapVault(dataDir, phrase, { group: take(args, "--group") });
         if (json) {
             print(JSON.stringify(result, null, 2));
@@ -1757,8 +1763,8 @@ async function main() {
             const backend = take(args, "--backend");
             // The account's shared Google client first: no console visit, no env
             // var — the consent screen is the whole setup. The PKCE desktop path
-            // stays for self-hosters who set VAULTLINE_GDRIVE_CLIENT_ID.
-            const viaCloud = !process.env.VAULTLINE_GDRIVE_CLIENT_ID;
+            // stays for self-hosters who set SEALKEEP_GDRIVE_CLIENT_ID.
+            const viaCloud = !envVar("GDRIVE_CLIENT_ID");
             const credentials = viaCloud ? await (await import("./cloud.js")).connectGdriveViaCloud(dataDir, {
                 onConsentUrl: (url) => {
                     print(`\n  ${dim("Approve Sealkeep in the browser window. If none opened, use this link:")}`);
@@ -1982,7 +1988,7 @@ async function main() {
         fail("invalid_argument", "Usage: sealkeep retention <preview|apply|prune|offload|approve|policy> [options]");
     }
     if (command === "daemon") {
-        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Run `sealkeep autopilot` so this machine can unlock itself, or set VAULTLINE_RECOVERY_PHRASE.");
+        const phrase = required(await unlock(dataDir, take(args, "--recovery-phrase")), "No recovery phrase available. Run `sealkeep autopilot` so this machine can unlock itself, or set SEALKEEP_RECOVERY_PHRASE.");
         const reclaim = args.includes("--reclaim");
         const daemon = await startDaemon(dataDir, {
             phrase, intervalMs: Number(take(args, "--interval", "30")) * 1000, home: take(args, "--home"),
@@ -2012,10 +2018,10 @@ async function main() {
 }
 const HINTS = {
     vault_not_initialized: "run `sealkeep quickstart`",
-    recovery_phrase_missing: "pass --recovery-phrase, or set VAULTLINE_RECOVERY_PHRASE",
+    recovery_phrase_missing: "pass --recovery-phrase, or set SEALKEEP_RECOVERY_PHRASE",
     recovery_phrase_mismatch: "check the phrase from your recovery kit",
     storage_not_configured: "run `sealkeep storage configure --provider … --bucket … --prefix …`",
-    signer_not_configured: "set VAULTLINE_ENABLE_SIGNER=1 and store credentials",
+    signer_not_configured: "set SEALKEEP_ENABLE_SIGNER=1 and store credentials",
     destination_exists: "add --overwrite backup to keep the existing file",
     destination_unwritable: "free some space, or restore to a different <destination> on another volume",
     archive_not_found: "run `sealkeep list` to see archive ids",

package/dist/src/cloud.js

@@ -6,6 +6,7 @@ import { canonicalPhrase } from "./mnemonic.js";
 import { fail, isVaultlineError, VaultlineError } from "./errors.js";
 import { sha256 } from "./crypto.js";
 import { listArchives, readConfig, writeRecord } from "./vault.js";
+import { envVar } from "./env.js";
 /**
  * Sealkeep Cloud: the managed tier.
  *
@@ -16,7 +17,7 @@ import { listArchives, readConfig, writeRecord } from "./vault.js";
  * control plane is never sent a key that opens it.
  */
 export const DEFAULT_CLOUD_URL = "https://shared.spala.ai/p04946/api";
-const cloudUrl = (env = process.env) => (env.VAULTLINE_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
+const cloudUrl = (env = process.env) => (envVar("CLOUD_URL", env) ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
 /**
  * Where this vault's cloud token lives in the keystore.
  *

package/dist/src/control-plane-cli.js

@@ -4,18 +4,19 @@ import { join } from "node:path";
 import { createControlPlaneServer } from "./control-plane/server.js";
 import { defaultDataDir } from "./vault.js";
 import { freePort } from "./net.js";
+import { envVar } from "./env.js";
 /**
  * Runs the control plane.
  *
- * Authentication is on by default. `VAULTLINE_CONTROL_PLANE_DEV=1` turns it off for
+ * Authentication is on by default. `SEALKEEP_CONTROL_PLANE_DEV=1` turns it off for
  * local interface work and the banner says so loudly, because an unauthenticated
  * instance reachable from a network would let anyone enumerate account metadata.
  */
-const development = process.env.VAULTLINE_CONTROL_PLANE_DEV === "1";
-const storePath = process.env.VAULTLINE_CONTROL_PLANE_STORE ?? join(defaultDataDir(), "control-plane", "state.json");
-const tls = process.env.VAULTLINE_TLS_CERT && process.env.VAULTLINE_TLS_KEY
-    ? { cert: readFileSync(process.env.VAULTLINE_TLS_CERT), key: readFileSync(process.env.VAULTLINE_TLS_KEY) }
-    : undefined;
+const development = envVar("CONTROL_PLANE_DEV") === "1";
+const storePath = envVar("CONTROL_PLANE_STORE") ?? join(defaultDataDir(), "control-plane", "state.json");
+const tlsCert = envVar("TLS_CERT");
+const tlsKey = envVar("TLS_KEY");
+const tls = tlsCert && tlsKey ? { cert: readFileSync(tlsCert), key: readFileSync(tlsKey) } : undefined;
 const server = createControlPlaneServer({
     storePath: development ? undefined : storePath,
     requireAuth: !development,
@@ -31,7 +32,7 @@ async function listen() {
         if (development)
             console.log("MODE: development — device authentication is DISABLED and state is in memory. Do not expose this.");
         else
-            console.log(`Durable state: ${storePath}${tls ? "" : "\nWARNING: no TLS configured. Set VAULTLINE_TLS_CERT and VAULTLINE_TLS_KEY before accepting non-loopback traffic."}`);
+            console.log(`Durable state: ${storePath}${tls ? "" : "\nWARNING: no TLS configured. Set SEALKEEP_TLS_CERT and SEALKEEP_TLS_KEY before accepting non-loopback traffic."}`);
     });
 }
 void listen();

package/dist/src/control-plane.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { fail } from "./errors.js";
+import { envVar } from "./env.js";
 export const DEFAULT_LEASE_TTL_MS = 15 * 60_000;
 class PlannedProvider {
     provider;
@@ -44,13 +45,13 @@ export function assertLeaseUsable(lease, now = Date.now()) {
 }
 /** Feature flag for provider work in progress. Off by default and read per call so tests and operators can flip it. */
 export function signerEnabled(env = process.env) {
-    return env.VAULTLINE_ENABLE_SIGNER === "1";
+    return envVar("ENABLE_SIGNER", env) === "1";
 }
 const uploadClients = new Map();
 /** Registration is refused unless the operator explicitly enabled signer work. */
 export function registerUploadClient(client, env = process.env) {
     if (!signerEnabled(env))
-        fail("signer_not_configured", "Set VAULTLINE_ENABLE_SIGNER=1 to register a provider upload client", { provider: client.kind });
+        fail("signer_not_configured", "Set SEALKEEP_ENABLE_SIGNER=1 to register a provider upload client", { provider: client.kind });
     uploadClients.set(client.kind, client);
 }
 export function uploadClientFor(kind, env = process.env) {

package/dist/src/dashboard-cli.js

@@ -5,7 +5,8 @@
 import { defaultDataDir } from "./vault.js";
 import { createLocalApiServer, localApiToken, localApiTokenPath } from "./local-api.js";
 import { freePort } from "./net.js";
-const dataDir = process.env.VAULTLINE_DATA_DIR ?? defaultDataDir();
+import { envVar } from "./env.js";
+const dataDir = envVar("DATA_DIR") ?? defaultDataDir();
 async function listen() {
     const token = await localApiToken(dataDir);
     const server = createLocalApiServer(dataDir, token);

package/dist/src/doctor.js

@@ -10,6 +10,7 @@ import { quotaMessage, quotaState } from "./packages.js";
 import { loadProviderCredentials, resolveRecoveryPhrase } from "./secrets.js";
 import { ENVELOPE_VERSION, SUITES } from "../packages/vaultline-crypto/src/index.js";
 import { readConfig } from "./vault.js";
+import { envVar } from "./env.js";
 async function writable(directory) {
     const probe = join(directory, `.vaultline-write-probe-${randomUUID()}`);
     try {
@@ -175,7 +176,7 @@ export async function runDoctor(dataDir, env = process.env) {
     // missing and named an environment variable as the cure.
     const phraseAvailable = config
         ? await resolveRecoveryPhrase(dataDir, config.vaultId, undefined, env).then((phrase) => Boolean(phrase)).catch(() => false)
-        : Boolean(env.VAULTLINE_RECOVERY_PHRASE);
+        : Boolean(envVar("RECOVERY_PHRASE", env));
     checks.push(phraseAvailable
         ? { name: "recovery-phrase", status: "pass", detail: "This machine can unlock the vault on its own, so archiving runs unattended." }
         : { name: "recovery-phrase", status: "warn", detail: "This machine doesn't hold your recovery phrase, so it can't archive on its own. Add it under Settings › Unlocking to let archiving run unattended. Your vault and archives are unaffected." });

package/dist/src/enroll.js

@@ -18,7 +18,7 @@ import { setRetentionPolicy, retentionSettings, DEFAULT_RETENTION } from "./rete
  * injectable — this module has to be testable against a fake today and
  * work unchanged against the real thing later.
  */
-const cloudUrl = (env = process.env) => (env.VAULTLINE_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
+const cloudUrl = (env = process.env) => (env.SEALKEEP_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
 /**
  * The token location comes from cloud.ts rather than being restated here.
  *

package/dist/src/env.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Environment variables, under the product's own name.
+ *
+ * The product was called Vaultline until August 2026, and its variables carried
+ * that name. They still work — someone's launchd plist or CI file should not
+ * break because we renamed a brand — but everything the product prints, writes,
+ * and documents now says SEALKEEP_. When both are set the new name wins, so a
+ * machine can be migrated one variable at a time.
+ */
+/** Reads `SEALKEEP_<name>`, falling back to the Vaultline-era name. */
+export declare function envVar(name: string, env?: NodeJS.ProcessEnv): string | undefined;
+/** True when either spelling is set to something truthy. */
+export declare function envFlag(name: string, env?: NodeJS.ProcessEnv): boolean;
+/** The name to print or write into a config file — always the current one. */
+export declare const envName: (name: string) => string;
+/** Both spellings, for messages that tell someone what to set. */
+export declare const envNames: (name: string) => string[];

package/dist/src/env.js

@@ -0,0 +1,28 @@
+/**
+ * Environment variables, under the product's own name.
+ *
+ * The product was called Vaultline until August 2026, and its variables carried
+ * that name. They still work — someone's launchd plist or CI file should not
+ * break because we renamed a brand — but everything the product prints, writes,
+ * and documents now says SEALKEEP_. When both are set the new name wins, so a
+ * machine can be migrated one variable at a time.
+ */
+const LEGACY_PREFIX = "VAULTLINE_";
+const PREFIX = "SEALKEEP_";
+/** Reads `SEALKEEP_<name>`, falling back to the Vaultline-era name. */
+export function envVar(name, env = process.env) {
+    const current = env[PREFIX + name];
+    if (current !== undefined && current !== "")
+        return current;
+    const legacy = env[LEGACY_PREFIX + name];
+    return legacy === "" ? undefined : legacy;
+}
+/** True when either spelling is set to something truthy. */
+export function envFlag(name, env = process.env) {
+    const value = envVar(name, env);
+    return value === "1" || value === "true" || value === "yes";
+}
+/** The name to print or write into a config file — always the current one. */
+export const envName = (name) => PREFIX + name;
+/** Both spellings, for messages that tell someone what to set. */
+export const envNames = (name) => [PREFIX + name, LEGACY_PREFIX + name];

package/dist/src/errors.d.ts

@@ -3,7 +3,7 @@
  * between releases; these codes are a contract for the CLI, local API, and MCP.
  * Details are operational only: never place plaintext, phrases, or keys here.
  */
-export type VaultlineErrorCode = "invalid_argument" | "vault_not_initialized" | "vault_already_initialized" | "config_unsupported_version" | "recovery_phrase_missing" | "recovery_phrase_mismatch" | "archive_not_found" | "source_unreadable" | "destination_exists" | "destination_unwritable" | "path_not_permitted" | "native_restore_unavailable" | "ciphertext_integrity_failed" | "plaintext_integrity_failed" | "hook_payload_invalid" | "queue_job_not_found" | "queue_lease_invalid" | "queue_lease_expired" | "queue_job_exhausted" | "storage_not_configured" | "provider_unsupported" | "signer_not_configured" | "lease_expired" | "unauthorized" | "forbidden" | "internal";
+export type VaultlineErrorCode = "invalid_argument" | "vault_not_initialized" | "vault_already_initialized" | "config_unsupported_version" | "recovery_phrase_missing" | "recovery_phrase_mismatch" | "archive_not_found" | "source_unreadable" | "destination_exists" | "destination_unwritable" | "insufficient_disk_space" | "path_not_permitted" | "native_restore_unavailable" | "ciphertext_integrity_failed" | "plaintext_integrity_failed" | "hook_payload_invalid" | "queue_job_not_found" | "queue_lease_invalid" | "queue_lease_expired" | "queue_job_exhausted" | "storage_not_configured" | "provider_unsupported" | "signer_not_configured" | "lease_expired" | "unauthorized" | "forbidden" | "internal";
 export declare class VaultlineError extends Error {
     readonly code: VaultlineErrorCode;
     readonly details: Record<string, unknown>;

package/dist/src/local-api.js

@@ -24,6 +24,7 @@ import { isV2 } from "./types.js";
 import * as cloud from "./cloud.js";
 import { configureRemoteStorage, initialize, listArchives, previewRetention, readConfig, vaultStatus, writeRecord } from "./vault.js";
 import { sha256 } from "./crypto.js";
+import { envVar } from "./env.js";
 const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
 /**
  * `vault.line` and `vault.localhost` join the list because the address bar is
@@ -303,7 +304,7 @@ export async function testStorageTarget(input) {
     const payload = Buffer.from(`sealkeep write test ${randomBytes(16).toString("hex")}\n`);
     const digest = sha256(payload);
     try {
-        // VAULTLINE_ENABLE_SIGNER gates *uploading archives* through a provider
+        // SEALKEEP_ENABLE_SIGNER gates *uploading archives* through a provider
         // client, and it is off unless the installed service turns it on. That gate
         // is right for archives and wrong for this: refusing to check a bucket
         // because archives are not enabled yet would mean the only way to find out
@@ -312,7 +313,7 @@ export async function testStorageTarget(input) {
         // fifty bytes the person explicitly asked to have written, to a bucket they
         // just named, with a credential they just typed. Nothing else in this
         // process gains the flag and the archive path is untouched.
-        const probeEnv = { ...process.env, VAULTLINE_ENABLE_SIGNER: "1" };
+        const probeEnv = { ...process.env, SEALKEEP_ENABLE_SIGNER: "1" };
         const target = { provider, bucket, prefix, ...(region ? { region } : {}) };
         const client = createUploadClient(target, credentials, endpoint ? endpointOverrides(endpoint) : {}, probeEnv);
         const lease = createActiveLease(target, {
@@ -648,12 +649,13 @@ async function cloudPlanAndQuota(dataDir) {
 /**
  * The account panel lives on the product domain, which is no longer the API's
  * origin — deriving it from the cloud URL sent people to the old address after
- * the rename. A self-hosted plane (VAULTLINE_CLOUD_URL set) still derives from
+ * the rename. A self-hosted plane (SEALKEEP_CLOUD_URL set) still derives from
  * its own origin, because there is no sealkeep.spala.ai panel for it.
  */
 async function panelUrl() {
-    if (process.env.VAULTLINE_CLOUD_URL) {
-        const origin = process.env.VAULTLINE_CLOUD_URL.replace(/\/+$/, "").replace(/\/api$/, "");
+    const selfHosted = envVar("CLOUD_URL");
+    if (selfHosted) {
+        const origin = selfHosted.replace(/\/+$/, "").replace(/\/api$/, "");
         return `${origin}/#account`;
     }
     const { PRODUCT_URL } = await import("./branding.js");
@@ -950,7 +952,7 @@ export function createLocalApiServer(dataDir, token, options = {}) {
         if (offerCache && Date.now() - offerCache.at < 10 * 60_000)
             return offerCache.value;
         try {
-            const base = (process.env.VAULTLINE_CLOUD_URL ?? cloud.DEFAULT_CLOUD_URL).replace(/\/$/, "");
+            const base = (envVar("CLOUD_URL") ?? cloud.DEFAULT_CLOUD_URL).replace(/\/$/, "");
             const response = await fetch(`${base}/v1/public/offer`, { signal: AbortSignal.timeout(4000) });
             const body = response.ok ? await response.json() : null;
             offerCache = { at: Date.now(), value: body?.offer ?? null };
@@ -1500,7 +1502,7 @@ export function createLocalApiServer(dataDir, token, options = {}) {
                 const { capGb } = parseBody(rollingCapSchema, await readJsonBody(request));
                 const { cloudToken, DEFAULT_CLOUD_URL } = await import("./cloud.js");
                 const token = await cloudToken(dataDir);
-                const base = (process.env.VAULTLINE_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
+                const base = (envVar("CLOUD_URL") ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
                 const pushed = await fetch(`${base}/v1/cloud/rolling`, {
                     method: "PUT",
                     headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
@@ -1596,11 +1598,11 @@ export function createLocalApiServer(dataDir, token, options = {}) {
                         remembered = await rememberRecoveryPhrase(dataDir, config.vaultId, phrase);
                     }
                     catch (error) {
-                        notes.push(`This machine's keystore refused the phrase (${error instanceof Error ? error.message.split("\n")[0] : "unknown error"}). The background service will need VAULTLINE_RECOVERY_PHRASE in its environment.`);
+                        notes.push(`This machine's keystore refused the phrase (${error instanceof Error ? error.message.split("\n")[0] : "unknown error"}). The background service will need SEALKEEP_RECOVERY_PHRASE in its environment.`);
                     }
                 }
                 else {
-                    notes.push("The phrase was not stored on this machine, so the background service cannot seal sessions until VAULTLINE_RECOVERY_PHRASE is in its environment.");
+                    notes.push("The phrase was not stored on this machine, so the background service cannot seal sessions until SEALKEEP_RECOVERY_PHRASE is in its environment.");
                 }
                 if (password) {
                     // Failure may not cost the person this response: the vault already
@@ -1748,7 +1750,7 @@ export function createLocalApiServer(dataDir, token, options = {}) {
                     // verified remote copy it would never free a byte either — see the
                     // note on `environment` in service.ts. serviceUnitEnvironment adds
                     // the secret-backend choice, without which the daemon cannot unlock.
-                    environment: serviceUnitEnvironment(config.remoteStorage ? { VAULTLINE_ENABLE_SIGNER: "1" } : {})
+                    environment: serviceUnitEnvironment(config.remoteStorage ? { SEALKEEP_ENABLE_SIGNER: "1" } : {})
                 }));
                 return json(response, outcome.installed ? 201 : 200, {
                     service: { kind: outcome.kind, installed: outcome.installed, alreadyInstalled: false, path: outcome.path, ranCommands: outcome.ranCommands, note: outcome.note ?? null },

package/dist/src/mcp-install.d.ts

@@ -30,7 +30,7 @@ export declare function mcpServerSpec(dataDir: string, executable?: string): {
     command: string;
     args: string[];
     env: {
-        VAULTLINE_DATA_DIR: string;
+        SEALKEEP_DATA_DIR: string;
     };
 };
 /**

package/dist/src/mcp-install.js

@@ -10,7 +10,7 @@ export function mcpServerSpec(dataDir, executable = "vaultline") {
     return {
         command: executable,
         args: ["mcp"],
-        env: { VAULTLINE_DATA_DIR: dataDir }
+        env: { SEALKEEP_DATA_DIR: dataDir }
     };
 }
 /**
@@ -44,7 +44,7 @@ async function installForClaude(dataDir, exec = run) {
     try {
         await exec("claude", [
             "mcp", "add", "--transport", "stdio", "--scope", "user", "vaultline",
-            "--env", `VAULTLINE_DATA_DIR=${dataDir}`,
+            "--env", `SEALKEEP_DATA_DIR=${dataDir}`,
             "--", spec.command, ...spec.args
         ]);
         return { installed: true, detail: "registered with Claude Code — ask it to search your sessions" };
@@ -74,7 +74,7 @@ async function installForCodex(dataDir, home) {
         `args = ${JSON.stringify(spec.args)}`,
         "",
         "[mcp_servers.vaultline.env]",
-        `VAULTLINE_DATA_DIR = ${JSON.stringify(dataDir)}`,
+        `SEALKEEP_DATA_DIR = ${JSON.stringify(dataDir)}`,
         ""
     ].join("\n");
     await mkdir(dirname(fragmentPath), { recursive: true });

package/dist/src/mcp.js

@@ -4,12 +4,13 @@ import { z } from "zod";
 import { archiveFile, defaultDataDir, listArchives, previewRetention, vaultStatus } from "./vault.js";
 import { restoreArchive } from "./restore.js";
 import { providers } from "./control-plane.js";
-const dataDir = process.env.VAULTLINE_DATA_DIR ?? defaultDataDir();
-const phrase = process.env.VAULTLINE_RECOVERY_PHRASE;
+import { envVar } from "./env.js";
+const dataDir = envVar("DATA_DIR") ?? defaultDataDir();
+const phrase = envVar("RECOVERY_PHRASE");
 const server = new McpServer({ name: "vaultline", version: "0.1.0" });
 function text(value) { return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }] }; }
 function requirePhrase() { if (!phrase)
-    throw new Error("VAULTLINE_RECOVERY_PHRASE is required for archive and recovery actions"); return phrase; }
+    throw new Error("SEALKEEP_RECOVERY_PHRASE is required for archive and recovery actions"); return phrase; }
 server.registerTool("vaultline_status", {
     title: "Sealkeep status",
     description: "Read local Sealkeep health, archive count, and encrypted storage usage. No session content is returned.",

package/dist/src/notify.js

@@ -1,9 +1,10 @@
 import { execFile } from "node:child_process";
 import { platform } from "node:os";
+import { envVar } from "./env.js";
 const run = (file, args) => new Promise((resolve) => execFile(file, args, () => resolve()));
 /** Off by an explicit opt-out, and off automatically where there is no desktop session. */
 export function notificationsEnabled(env = process.env, target = platform()) {
-    if (env.VAULTLINE_NOTIFICATIONS === "off")
+    if (envVar("NOTIFICATIONS", env) === "off")
         return false;
     if (target === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY)
         return false;

package/dist/src/offload.js

@@ -116,7 +116,7 @@ export async function offloadArchives(dataDir, options = {}) {
 /**
  * Downloads an archive's ciphertext from the bucket it was offloaded to.
  *
- * VAULTLINE_ENABLE_SIGNER gates *uploading*, and it is off unless the installed
+ * SEALKEEP_ENABLE_SIGNER gates *uploading*, and it is off unless the installed
  * service turns it on. Reading back an archive in order to restore it is not
  * uploading, and refusing it on that flag would mean an offloaded archive could
  * not be recovered by the person who owns it — which would turn a space-saving
@@ -191,7 +191,7 @@ async function fetchCiphertext(dataDir, record, client) {
     const resolved = client ?? await uploadClientFromStore(dataDir, config.vaultId, target, {}, undefined);
     const lease = createActiveLease(target, {
         archiveId: record.id, ciphertextSha256: record.cipher.ciphertextSha256, bytes: record.cipher.storedBytes
-    }, { ...process.env, VAULTLINE_ENABLE_SIGNER: "1" });
+    }, { ...process.env, SEALKEEP_ENABLE_SIGNER: "1" });
     const readable = resolved;
     if (typeof readable.download !== "function") {
         fail("provider_unsupported", `${target.provider} cannot be read back by this build, so this archive cannot be fetched`);
@@ -257,7 +257,7 @@ export async function checkRemoteCopy(dataDir, archiveId, client) {
     const resolved = client ?? await uploadClientFromStore(dataDir, config.vaultId, target, {}, undefined);
     const lease = createActiveLease(target, {
         archiveId: record.id, ciphertextSha256: record.cipher.ciphertextSha256, bytes: record.cipher.storedBytes
-    }, { ...process.env, VAULTLINE_ENABLE_SIGNER: "1" });
+    }, { ...process.env, SEALKEEP_ENABLE_SIGNER: "1" });
     const probing = resolved;
     if (typeof probing.head !== "function")
         fail("provider_unsupported", `${target.provider} cannot be probed by this build`);
@@ -320,6 +320,19 @@ export async function checkRemoteCopyMany(dataDir, ids, client) {
 export async function materialiseArchive(dataDir, record, client) {
     if (!isV2(record) || !record.offloaded)
         return { path: record.objectPath, release: async () => { } };
+    // Reading an offloaded archive means writing it back to disk in full, and
+    // this runs in a loop during an index build. On a machine that offloaded
+    // BECAUSE it was short of space, that filled the disk and died on ENOSPC
+    // mid-build — the exact failure this product exists to prevent. Ask first,
+    // and refuse in words that name the archive and the shortfall.
+    const { freeBytes } = await import("./disk.js");
+    const free = await freeBytes(tmpdir());
+    const needed = record.cipher.storedBytes ?? record.remote?.bytes ?? 0;
+    const RESERVE = 512 * 1024 * 1024;
+    if (free !== undefined && needed > 0 && free < needed + RESERVE) {
+        const gb = (n) => `${(n / 1024 ** 3).toFixed(1)} GB`;
+        fail("insufficient_disk_space", `Reading archive ${record.id.slice(0, 8)} needs about ${gb(needed)} of temporary space and this machine has ${gb(free)} free. Nothing was written. Free some space, or reclaim what is already archived, and try again.`, { archiveId: record.id, free, needed });
+    }
     const ciphertext = await fetchCiphertext(dataDir, record, client);
     if (sha256(ciphertext) !== record.cipher.ciphertextSha256) {
         fail("ciphertext_integrity_failed", `The copy of archive ${record.id} in ${record.offloaded.bucket} is not the archive that was stored there`, { archiveId: record.id });

package/dist/src/providers/gdrive.d.ts

@@ -16,7 +16,7 @@ import type { ProviderKind, ProviderUploadClient, UploadLease } from "../control
  * into the OS keystore via secrets.ts and never into a config file.
  */
 export declare const GDRIVE_SCOPE = "https://www.googleapis.com/auth/drive.file";
-/** Placeholder until a first-party client id ships. Point VAULTLINE_GDRIVE_CLIENT_ID at your own Desktop-app OAuth client to connect today. */
+/** Placeholder until a first-party client id ships. Point SEALKEEP_GDRIVE_CLIENT_ID at your own Desktop-app OAuth client to connect today. */
 export declare const GDRIVE_CLIENT_ID_PLACEHOLDER = "000000000000-vaultline-placeholder.apps.googleusercontent.com";
 export declare function gdriveClientId(env?: NodeJS.ProcessEnv): string;
 export declare const GDRIVE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";

package/dist/src/providers/gdrive.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 import { fail, VaultlineError } from "../errors.js";
+import { envVar } from "../env.js";
 /**
  * Google Drive as a bring-your-own storage provider (Drive API v3).
  *
@@ -19,10 +20,10 @@ import { fail, VaultlineError } from "../errors.js";
  * into the OS keystore via secrets.ts and never into a config file.
  */
 export const GDRIVE_SCOPE = "https://www.googleapis.com/auth/drive.file";
-/** Placeholder until a first-party client id ships. Point VAULTLINE_GDRIVE_CLIENT_ID at your own Desktop-app OAuth client to connect today. */
+/** Placeholder until a first-party client id ships. Point SEALKEEP_GDRIVE_CLIENT_ID at your own Desktop-app OAuth client to connect today. */
 export const GDRIVE_CLIENT_ID_PLACEHOLDER = "000000000000-vaultline-placeholder.apps.googleusercontent.com";
 export function gdriveClientId(env = process.env) {
-    return env.VAULTLINE_GDRIVE_CLIENT_ID?.trim() || GDRIVE_CLIENT_ID_PLACEHOLDER;
+    return envVar("GDRIVE_CLIENT_ID", env)?.trim() || GDRIVE_CLIENT_ID_PLACEHOLDER;
 }
 export const GDRIVE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 export const GDRIVE_TOKEN_URL = "https://oauth2.googleapis.com/token";

package/dist/src/providers/index.js

@@ -18,7 +18,7 @@ function isGdriveCredentials(credentials) {
  */
 export function createUploadClient(config, credentials, overrides = {}, env = process.env) {
     if (!signerEnabled(env))
-        fail("signer_not_configured", "Uploads are disabled. Set VAULTLINE_ENABLE_SIGNER=1 to enable a configured provider client.", { provider: config.provider });
+        fail("signer_not_configured", "Uploads are disabled. Set SEALKEEP_ENABLE_SIGNER=1 to enable a configured provider client.", { provider: config.provider });
     if (config.provider === "gdrive") {
         if (!isGdriveCredentials(credentials))
             fail("invalid_argument", "Google Drive needs an OAuth credential. Run: sealkeep storage connect gdrive");

package/dist/src/rehydrate.js

@@ -29,7 +29,7 @@ export async function rehydrateSession(dataDir, target, phrase, options = {}) {
             return { rehydrated: false, reason: "already-present" };
     }
     if (!phrase)
-        return { rehydrated: false, reason: "no-phrase", note: "No recovery phrase is available to this machine (keystore or VAULTLINE_RECOVERY_PHRASE), so the sealed copy stays sealed." };
+        return { rehydrated: false, reason: "no-phrase", note: "No recovery phrase is available to this machine (keystore or SEALKEEP_RECOVERY_PHRASE), so the sealed copy stays sealed." };
     try {
         const outcome = await restoreArchive(dataDir, newest.id, phrase, { native: true, overwrite: "refuse", home: options.home });
         await recordAudit(dataDir, "archive.restore", "allowed", { archiveId: newest.id, path: outcome.output, rehydrated: true });

package/dist/src/search.js

@@ -10,6 +10,20 @@ import { isV2 } from "./types.js";
 const indexPath = (dataDir) => join(dataDir, "index", "content-index.vlindex");
 const envelopePath = (dataDir) => join(dataDir, "index", "content-index.json");
 const coveragePath = (dataDir) => join(dataDir, "index", "coverage.json");
+/**
+ * The ids THIS machine has indexed, from its own unsealed sidecar. Used to
+ * decide what this machine is entitled to forget: entries it never wrote
+ * belong to another machine of the vault and are not ours to delete.
+ */
+async function ownCoverage(dataDir) {
+    try {
+        const raw = JSON.parse(await readFile(coveragePath(dataDir), "utf8"));
+        return Array.isArray(raw.indexed) ? raw.indexed : [];
+    }
+    catch {
+        return [];
+    }
+}
 const MIN_TOKEN = 3;
 const MAX_TOKENS_PER_ARCHIVE = 4000;
 /**
@@ -201,10 +215,21 @@ export async function buildContentIndex(dataDir, rawPhrase, options = {}) {
     // Drop entries for archives that no longer exist, then index only what is
     // NEW — the difference between "re-decrypt 53 archives" and "decrypt the
     // two sealed since the last build".
+    //
+    // "No longer exists" is a judgement only the machine that sealed it can
+    // make. The index is shared by every machine of the vault, so a laptop that
+    // has never sealed anything must not conclude that the desktop's fifty
+    // archives are gone: it used to delete every entry it had no local record
+    // for and push the emptied index back, which wiped the phonebook for the
+    // whole vault and left the machine that built it unable to search its own
+    // history. A machine may forget only what it itself indexed.
     const liveIds = new Set(records.map((record) => record.id));
+    const mine = new Set(await ownCoverage(dataDir));
     for (const id of Object.keys(index.archives)) {
         if (liveIds.has(id))
             continue;
+        if (!mine.has(id))
+            continue; // another machine's archive
         delete index.archives[id];
         for (const token of Object.keys(index.tokens)) {
             index.tokens[token] = index.tokens[token].filter((entry) => entry !== id && !entry.startsWith(`${id}@`));
@@ -515,6 +540,34 @@ async function remoteOnlyRecord(dataDir, id, phrase) {
         const { pullCiphertext, unframeObject } = await import("./cloud.js");
         const { openIdentity } = await import("./chunk-store.js");
         const { unwrapArchiveKey } = await import("../packages/vaultline-crypto/src/recipients.js");
+        // An ordinary archive pushed to managed storage is ONE object with its
+        // envelope in the frame — no identity sidecar, because nothing was
+        // chunked. That shape used to fall through to null here, so a second
+        // machine could find a streamed archive and not an uploaded one, which
+        // is not a distinction anybody asked for. Try it before the chunk layout.
+        const single = await pullCiphertext(dataDir, id).catch(() => null);
+        if (single) {
+            const { envelope: only } = unframeObject(single.ciphertext);
+            if (only?.manifest) {
+                const bytes = only.manifest.originalBytes ?? only.manifest.plaintextBytes ?? 0;
+                return {
+                    version: 2, id, createdAt: only.manifest.createdAt ?? new Date(0).toISOString(),
+                    source: {
+                        path: only.manifest.sourcePath ?? only.manifest.adapter?.sourcePath ?? `archive ${id.slice(0, 8)}`,
+                        agent: only.manifest.adapter?.agent ?? "unknown",
+                        bytes,
+                        sha256: only.manifest.originalSha256 ?? only.manifest.plaintextSha256
+                    },
+                    cipher: { algorithm: only.suite, ciphertextSha256: "", storedBytes: single.ciphertext.length, chunks: only.chunks?.length ?? 1 },
+                    envelope: only,
+                    objectPath: join(dataDir, "never-materialised", `${id}.vlarchive`),
+                    remote: {
+                        provider: "vaultline", bucket: "vaultline-managed", objectKey: id,
+                        bytes: single.ciphertext.length, checksum: "", verifiedAt: only.manifest.createdAt ?? new Date(0).toISOString()
+                    }
+                };
+            }
+        }
         const { ciphertext: sidecar } = await pullCiphertext(dataDir, `${id}.envelope.vlmeta`);
         const { envelope, ciphertext: identityBlob } = unframeObject(sidecar);
         if (!envelope)

package/dist/src/secrets.d.ts

@@ -29,7 +29,7 @@ export declare class FileSecretBackend implements SecretBackend {
 export declare function secretBackends(dataDir: string): SecretBackend[];
 /**
  * Picks the strongest backend this machine supports. The file fallback always
- * qualifies. `VAULTLINE_SECRET_BACKEND` pins the choice, which is how a test suite
+ * qualifies. `SEALKEEP_SECRET_BACKEND` pins the choice, which is how a test suite
  * or a sandboxed environment stays out of the real OS keystore.
  */
 export declare function chooseBackend(dataDir: string, preferred?: BackendName, env?: NodeJS.ProcessEnv): Promise<SecretBackend>;

package/dist/src/secrets.js

@@ -4,6 +4,7 @@ import { platform } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { fail } from "./errors.js";
+import { envVar } from "./env.js";
 const run = promisify(execFile);
 async function commandExists(command) {
     try {
@@ -130,11 +131,11 @@ export function secretBackends(dataDir) {
 }
 /**
  * Picks the strongest backend this machine supports. The file fallback always
- * qualifies. `VAULTLINE_SECRET_BACKEND` pins the choice, which is how a test suite
+ * qualifies. `SEALKEEP_SECRET_BACKEND` pins the choice, which is how a test suite
  * or a sandboxed environment stays out of the real OS keystore.
  */
 export async function chooseBackend(dataDir, preferred, env = process.env) {
-    preferred = preferred ?? env.VAULTLINE_SECRET_BACKEND;
+    preferred = preferred ?? envVar("SECRET_BACKEND", env);
     const backends = secretBackends(dataDir);
     if (preferred) {
         const chosen = backends.find((backend) => backend.name === preferred);
@@ -190,7 +191,7 @@ export async function forgetRecoveryPhrase(dataDir, vaultId, preferred) {
  * everything, without the keystore's opt-in or its stated trade-off.
  */
 export async function resolveRecoveryPhrase(dataDir, vaultId, explicit, env = process.env, preferred) {
-    return explicit ?? env.VAULTLINE_RECOVERY_PHRASE ?? (await recallRecoveryPhrase(dataDir, vaultId, preferred).catch(() => null));
+    return explicit ?? envVar("RECOVERY_PHRASE", env) ?? (await recallRecoveryPhrase(dataDir, vaultId, preferred).catch(() => null));
 }
 /**
  * Provider credentials are addressed by storage config id, never by bucket name,

package/dist/src/service.d.ts

@@ -11,7 +11,7 @@ export type ServiceOptions = {
      *
      * A service manager starts the daemon with a bare environment — it does not
      * inherit the shell that installed it. The upload pass is gated on
-     * `VAULTLINE_ENABLE_SIGNER`, so a service definition that carries no
+     * `SEALKEEP_ENABLE_SIGNER`, so a service definition that carries no
      * environment produces a daemon that seals sessions, uploads nothing, and
      * therefore reclaims nothing, logging one line to `daemon.log` that nobody
      * reads. Whatever the installer decides uploads need, it has to be written
@@ -58,7 +58,7 @@ export declare function serviceStatus(options: ServiceOptions): Promise<{
  * The environment a service unit needs beyond its flags. A service manager
  * starts the daemon bare, so anything the installing session was told about
  * where secrets live has to ride along in the unit — a vault set up with
- * VAULTLINE_SECRET_BACKEND=file kept its phrase in a keystore the daemon then
+ * SEALKEEP_SECRET_BACKEND=file kept its phrase in a keystore the daemon then
  * never looked in, and every tick died on "No recovery phrase available".
  */
 export declare function serviceUnitEnvironment(base?: Record<string, string>, env?: NodeJS.ProcessEnv): Record<string, string>;

package/dist/src/service.js

@@ -5,6 +5,7 @@ import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 import { promisify } from "node:util";
 import { fail } from "./errors.js";
+import { envVar } from "./env.js";
 const run = promisify(execFile);
 export const SERVICE_LABEL = "ai.vaultline.agent";
 function kindFor(target) {
@@ -165,11 +166,12 @@ export async function serviceStatus(options) {
  * The environment a service unit needs beyond its flags. A service manager
  * starts the daemon bare, so anything the installing session was told about
  * where secrets live has to ride along in the unit — a vault set up with
- * VAULTLINE_SECRET_BACKEND=file kept its phrase in a keystore the daemon then
+ * SEALKEEP_SECRET_BACKEND=file kept its phrase in a keystore the daemon then
  * never looked in, and every tick died on "No recovery phrase available".
  */
 export function serviceUnitEnvironment(base = {}, env = process.env) {
-    return { ...(env.VAULTLINE_SECRET_BACKEND ? { VAULTLINE_SECRET_BACKEND: env.VAULTLINE_SECRET_BACKEND } : {}), ...base };
+    const backend = envVar("SECRET_BACKEND", env);
+    return { ...(backend ? { SEALKEEP_SECRET_BACKEND: backend } : {}), ...base };
 }
 /** The argv the service should run: this package's CLI, with the daemon subcommand. */
 export function daemonInvocation(dataDir, options = {}) {

package/dist/src/storage-setup.js

@@ -64,7 +64,7 @@ function s3Plan(input) {
         finish: [
             `sealkeep storage configure --provider s3 --bucket ${bucket} --prefix ${prefix} --region ${region}`,
             `echo '{"accessKeyId":"AKIA…","secretAccessKey":"…"}' | sealkeep storage credentials set`,
-            `VAULTLINE_ENABLE_SIGNER=1 sealkeep upload --all`
+            `SEALKEEP_ENABLE_SIGNER=1 sealkeep upload --all`
         ],
         notes: [
             "Enable versioning on the bucket if you want protection against an accidental overwrite.",
@@ -100,7 +100,7 @@ function r2Plan(input) {
         finish: [
             `sealkeep storage configure --provider r2 --bucket ${bucket} --prefix ${prefix} --region auto`,
             `echo '{"accessKeyId":"<R2 access key id>","secretAccessKey":"<R2 secret>"}' | sealkeep storage credentials set`,
-            `VAULTLINE_ENABLE_SIGNER=1 sealkeep upload --all --endpoint https://${accountId}.r2.cloudflarestorage.com`
+            `SEALKEEP_ENABLE_SIGNER=1 sealkeep upload --all --endpoint https://${accountId}.r2.cloudflarestorage.com`
         ],
         notes: [
             "R2 tokens are scoped per bucket in the dashboard, so the prefix restriction is Sealkeep's own object-key discipline rather than an IAM condition.",
@@ -151,7 +151,7 @@ function gcsPlan(input) {
             `sealkeep storage configure --provider gcs --bucket ${bucket} --prefix ${prefix}`,
             `node -e 'const k=require("./vaultline-key.json");process.stdout.write(JSON.stringify({clientEmail:k.client_email,privateKey:k.private_key}))' \\\n  | sealkeep storage credentials set`,
             `rm vaultline-key.json   # the key now lives in your keychain`,
-            `VAULTLINE_ENABLE_SIGNER=1 sealkeep upload --all`
+            `SEALKEEP_ENABLE_SIGNER=1 sealkeep upload --all`
         ],
         notes: [
             "Delete the downloaded key file once it is in your keychain. A key on disk is the usual way these leak.",
@@ -188,7 +188,7 @@ function gdrivePlan(input) {
                 title: "Connect your Google account",
                 why: `Sealkeep asks for drive.file only: it can see files it created — a "${folder}" folder of ciphertext — and nothing else in the Drive.`,
                 commands: [
-                    `export VAULTLINE_GDRIVE_CLIENT_ID="<your-client-id>.apps.googleusercontent.com"`,
+                    `export SEALKEEP_GDRIVE_CLIENT_ID="<your-client-id>.apps.googleusercontent.com"`,
                     `sealkeep storage connect gdrive`
                 ]
             }
@@ -196,7 +196,7 @@ function gdrivePlan(input) {
         finish: [
             `# once the provider registry accepts gdrive targets:`,
             `sealkeep storage configure --provider gdrive --bucket ${folder} --prefix ${prefix}`,
-            `VAULTLINE_ENABLE_SIGNER=1 sealkeep upload --all`
+            `SEALKEEP_ENABLE_SIGNER=1 sealkeep upload --all`
         ],
         notes: [
             `Archives land in a "${folder}" folder as sealed ciphertext; a prefix of "appdata" uses Drive's hidden per-app area instead.`,

package/dist/src/storage-targets.js

@@ -1,6 +1,7 @@
 import { fail } from "./errors.js";
 import { readConfig, listArchives } from "./vault.js";
 import { isV2 } from "./types.js";
+import { envVar } from "./env.js";
 const defaultPriority = (target) => target.priority ?? (target.provider === "vaultline" ? 0 : 10);
 /**
  * The effective target list. Explicit `storageTargets` in config wins;
@@ -43,7 +44,7 @@ async function pullTargetsFromCloud(dataDir) {
     if (!token)
         return null;
     const { DEFAULT_CLOUD_URL } = await import("./cloud.js");
-    const base = (process.env.VAULTLINE_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
+    const base = (envVar("CLOUD_URL") ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
     const response = await fetch(`${base}/v1/cloud/storage-targets`, { headers: { authorization: `Bearer ${token}` } });
     if (!response.ok)
         return null;
@@ -82,7 +83,7 @@ export async function pushTargetsToCloud(dataDir, targets) {
         }
         const { cloudToken, DEFAULT_CLOUD_URL } = await import("./cloud.js");
         const token = await cloudToken(dataDir);
-        const base = (process.env.VAULTLINE_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
+        const base = (envVar("CLOUD_URL") ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "");
         const response = await fetch(`${base}/v1/cloud/storage-targets`, {
             method: "PUT",
             headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },

package/dist/src/vault.js

@@ -10,6 +10,7 @@ import { decryptArchive as openEnvelope, hashFilePrefixes, hashFileRange, keyRec
 import { fail, VaultlineError } from "./errors.js";
 import { recordAudit } from "./audit.js";
 import { isV2 } from "./types.js";
+import { envVar } from "./env.js";
 /** Bumped when the adapter's preservation behaviour changes, recorded in every envelope. */
 /**
  * Writes one archive record atomically.
@@ -130,14 +131,14 @@ export async function initialize(dataDir, providedPhrase, opts = {}) {
  * sessions on a 16 GB machine were simply refused. Archiving now streams a
  * chunk at a time, so a transcript's size no longer predicts what it costs to
  * archive and a machine-derived refusal would only turn away sessions this
- * build can handle. Only an explicit VAULTLINE_MAX_ARCHIVE_BYTES still refuses.
+ * build can handle. Only an explicit SEALKEEP_MAX_ARCHIVE_BYTES still refuses.
  */
 function assertArchivable(absolute, size) {
-    const ceiling = Number(process.env.VAULTLINE_MAX_ARCHIVE_BYTES ?? "");
+    const ceiling = Number(envVar("MAX_ARCHIVE_BYTES") ?? "");
     if (!Number.isFinite(ceiling) || ceiling <= 0 || size <= ceiling)
         return;
     const gb = (value) => `${(value / 1024 ** 3).toFixed(1)} GB`;
-    fail("source_unreadable", `${absolute} is ${gb(size)}, above the VAULTLINE_MAX_ARCHIVE_BYTES ceiling of ${gb(ceiling)}. Raise or unset VAULTLINE_MAX_ARCHIVE_BYTES to archive it.`, { sourcePath: absolute, bytes: size, ceiling });
+    fail("source_unreadable", `${absolute} is ${gb(size)}, above the SEALKEEP_MAX_ARCHIVE_BYTES ceiling of ${gb(ceiling)}. Raise or unset SEALKEEP_MAX_ARCHIVE_BYTES to archive it.`, { sourcePath: absolute, bytes: size, ceiling });
 }
 /**
  * The archive whose bytes are still a prefix of this source, and how many.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.5.3",
+  "version": "0.6.1",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "license": "SEE LICENSE IN LICENSE",
@@ -39,7 +39,9 @@
     "control-plane": "tsx src/control-plane-cli.ts",
     "dashboard": "tsx src/dashboard-cli.ts",
     "build:site": "node tools/build-site.mjs",
-    "bundle:site": "node tools/build-site.mjs && cd dist/site && zip -q -X ../site.zip index.html && cd - >/dev/null && echo \"dist/site.zip ready ($(wc -c < dist/site.zip) bytes)\""
+    "bundle:site": "node tools/build-site.mjs && cd dist/site && zip -q -X ../site.zip index.html && cd - >/dev/null && echo \"dist/site.zip ready ($(wc -c < dist/site.zip) bytes)\"",
+    "acceptance": "node scripts/acceptance.mjs",
+    "acceptance:managed": "node scripts/acceptance.mjs --managed"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",