sealkeep 0.9.0 → 0.11.0

package/dist/src/integration-manager.js

@@ -0,0 +1,394 @@
+/** Marker understood by the daemon bootstrap and the standalone manager. */
+export const INTEGRATION_MANAGER_GENERATION_ENV = "SEALKEEP_SERVICE_MANAGER_GENERATION";
+export const INTEGRATION_MANAGER_GENERATION = "darwin-app-policy-v1";
+/**
+ * The durable service manager's exact child command.
+ *
+ * A launchd job registered by an older Sealkeep release can retain its cached
+ * ProcessType=Background policy even after the plist is corrected. Starting
+ * the daemon through taskpolicy's application profile escapes that inherited
+ * job policy before Node evaluates the CLI; every helper the daemon later
+ * starts inherits the corrected policy too. Other platforms keep their byte-
+ * for-byte command because their native service definitions reload normally.
+ */
+export function integrationManagerChildInvocation(receipt, target = process.platform) {
+    return target === "darwin" && receipt.kind === "launchd"
+        ? { executable: "/usr/sbin/taskpolicy", args: ["-a", receipt.executable, ...receipt.args] }
+        : { executable: receipt.executable, args: receipt.args };
+}
+const integrationManagerChildInvocationSource = integrationManagerChildInvocation.toString();
+/**
+ * Source copied outside the npm package when the background service is
+ * installed. npm 7+ deliberately runs no uninstall lifecycle scripts, so a
+ * package cannot clean hooks or services from inside code npm just removed.
+ * This tiny disclosed supervisor survives long enough to notice that the
+ * package target stayed absent beyond an upgrade grace period, remove only the
+ * integration paths named in its receipt, write a tombstone, then remove
+ * itself. Vaults, encrypted archives, outboxes, and keychain items are kept.
+ */
+export const INTEGRATION_MANAGER_SOURCE = String.raw `#!/usr/bin/env node
+import { spawn, spawnSync } from 'node:child_process';
+import { existsSync, statSync } from 'node:fs';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+const receiptPath = process.argv[2];
+if (!receiptPath) process.exit(64);
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const readReceipt = async () => JSON.parse(await readFile(receiptPath, 'utf8'));
+const atomicJson = async (path, value) => {
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  const temp = path + '.' + randomUUID() + '.tmp';
+  await writeFile(temp, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
+  await rename(temp, path);
+};
+
+// Keep this standalone manager's launch plan generated from the same function
+// exported to the package tests. It cannot import package code: surviving a
+// briefly absent npm target during upgrades is its reason for existing.
+const childInvocationFor = (${integrationManagerChildInvocationSource});
+
+const control = (file, args, options = {}) => spawnSync(file, args, {
+  timeout: 5000,
+  killSignal: 'SIGTERM',
+  ...options,
+});
+
+function ownedCommand(command) {
+  return typeof command === 'string' && /\bhook (enqueue|rehydrate|context|context-sync) --agent (codex|claude)\b/.test(command);
+}
+
+function prune(value) {
+  if (Array.isArray(value)) {
+    const kept = value.map(prune).filter((item) => item !== null);
+    return kept.length ? kept : null;
+  }
+  if (!value || typeof value !== 'object') return value;
+  if (ownedCommand(value.command)) return null;
+  const next = { ...value };
+  if (Object.prototype.hasOwnProperty.call(value, 'hooks')) {
+    const hooks = prune(value.hooks);
+    if (hooks === null) return null;
+    next.hooks = hooks;
+  }
+  return next;
+}
+
+async function cleanHook(path, stillCurrent) {
+  try {
+    const raw = await readFile(path, 'utf8');
+    const document = JSON.parse(raw);
+    if (!document || typeof document !== 'object' || Array.isArray(document)) return false;
+    const next = { ...document };
+    const hooks = {};
+    for (const [event, entries] of Object.entries(document.hooks ?? {})) {
+      const kept = prune(entries);
+      if (kept !== null) hooks[event] = kept;
+    }
+    next.hooks = hooks;
+    const before = JSON.stringify(document);
+    if (JSON.stringify(next) === before) return false;
+    if (!await stillCurrent()) return null;
+    const backup = path + '.sealkeep-uninstall-backup-' + new Date().toISOString().replace(/[:.]/g, '-');
+    await writeFile(backup, raw, { mode: 0o600 });
+    if (!await stillCurrent()) return null;
+    await atomicJson(path, next);
+    return true;
+  } catch { return false; }
+}
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]));
+}
+
+function receiptGeneration(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  // missingSince is this manager's own monitor heartbeat, not an installation
+  // generation. Every install has a fresh installedAt and this full canonical
+  // fallback also keeps legacy receipts fail-closed across replacements.
+  const { missingSince: _missingSince, ...stable } = value;
+  return JSON.stringify(canonical(stable));
+}
+
+function property(output, name) {
+  const line = String(output ?? '').split(/\r?\n/).find((candidate) => candidate.startsWith(name + '='));
+  return line === undefined ? null : line.slice(name.length + 1);
+}
+
+/**
+ * A service/task name is user-global while receipts are vault-local. Before a
+ * surviving old manager edits current hooks or a unit, prove that the loaded
+ * registration is this exact process, unit, manager, and receipt. A stale
+ * manager must never dismantle a newer vault's registration merely because it
+ * inherited the same product label.
+ */
+function ownsCurrentRegistration(receipt) {
+  if (receipt.kind === 'launchd') {
+    const domain = typeof process.getuid === 'function' ? 'gui/' + process.getuid() + '/' + receipt.label : null;
+    if (!domain) return false;
+    const loaded = control('launchctl', ['print', domain], { encoding: 'utf8' });
+    const loadedPid = Number(/^\s*pid\s*=\s*(\d+)\s*$/m.exec(loaded.stdout)?.[1]);
+    return loaded.status === 0
+      && loadedPid === process.pid
+      && process.argv[1] === receipt.managerPath
+      && process.argv[2] === receipt.receiptPath
+      && loaded.stdout.includes(receipt.managerPath)
+      && loaded.stdout.includes(receipt.receiptPath);
+  }
+  if (receipt.kind === 'systemd') {
+    const loaded = control('systemctl', [
+      '--user', 'show', receipt.label,
+      '--property=MainPID', '--property=FragmentPath', '--property=ExecStart',
+    ], { encoding: 'utf8' });
+    if (loaded.status !== 0) return false;
+    const mainPid = Number(property(loaded.stdout, 'MainPID'));
+    const fragmentPath = property(loaded.stdout, 'FragmentPath');
+    const execStart = property(loaded.stdout, 'ExecStart') ?? '';
+    // MainPID makes process.argv the kernel's exact argument vector for the
+    // current ExecStart, avoiding ambiguous substring parsing (and supporting
+    // paths systemctl renders with C escapes). FragmentPath independently
+    // proves which unit owns that process; a non-empty ExecStart proves the
+    // loaded registration exposes the property we asked systemd to verify.
+    return mainPid === process.pid
+      && fragmentPath === receipt.unitPath
+      && process.argv[1] === receipt.managerPath
+      && process.argv[2] === receipt.receiptPath
+      && execStart.length > 0;
+  }
+  // Task Scheduler is itself the durable registration. Keep its established
+  // cleanup behavior until it can expose the same process/unit identity proof.
+  return receipt.kind === 'schtasks';
+}
+
+async function cleanup(receipt) {
+  const expectedGeneration = receiptGeneration(receipt);
+  const stillCurrent = async () => {
+    if (!expectedGeneration || targetPresent()) return false;
+    const current = await readReceipt().catch(() => null);
+    return receiptGeneration(current) === expectedGeneration && !targetPresent();
+  };
+  // Resolve ownership before touching hooks. Hook commands are intentionally
+  // recognizable across package versions, which also means a stale receipt's
+  // broad matcher would otherwise delete a newer install's current entries.
+  if (!await stillCurrent() || !ownsCurrentRegistration(receipt) || !await stillCurrent()) return;
+
+  const removedHooks = [];
+  let ownedLingerUid = null;
+  for (const path of receipt.hookFiles ?? []) {
+    const result = await cleanHook(path, stillCurrent);
+    if (result === null) return;
+    if (result) removedHooks.push(path);
+  }
+  for (const path of receipt.ownedFragments ?? []) {
+    if (!await stillCurrent()) return;
+    await rm(path, { force: true }).catch(() => undefined);
+  }
+  for (const path of receipt.ownedRuntimeFiles ?? []) {
+    if (!await stillCurrent()) return;
+    await rm(path, { force: true }).catch(() => undefined);
+  }
+
+  if (receipt.kind === 'launchd') {
+    if (!await stillCurrent()) return;
+    await rm(receipt.unitPath, { force: true }).catch(() => undefined);
+    if (!await stillCurrent()) return;
+    control('launchctl', ['remove', receipt.label], { stdio: 'ignore' });
+  } else if (receipt.kind === 'systemd') {
+    if (!await stillCurrent()) return;
+    control('systemctl', ['--user', 'disable', receipt.label], { stdio: 'ignore' });
+    if (!await stillCurrent()) return;
+    await rm(receipt.unitPath, { force: true }).catch(() => undefined);
+    if (!await stillCurrent()) return;
+    control('systemctl', ['--user', 'daemon-reload'], { stdio: 'ignore' });
+    // Linger is user-wide, not unit-local. Reverse it only when the owner-only
+    // receipt says Sealkeep proved it was off and enabled it, and only for the
+    // numeric account currently executing this manager. A forged/stale receipt
+    // can therefore never make a privileged cleanup target another user.
+    const currentUid = typeof process.getuid === 'function' ? process.getuid() : null;
+    const ownedLinger = receipt.linuxLinger?.enabledBySealkeep === true
+      && Number.isInteger(receipt.linuxLinger.uid)
+      && receipt.linuxLinger.uid === currentUid;
+    if (ownedLinger) ownedLingerUid = currentUid;
+  } else if (receipt.kind === 'schtasks') {
+    if (!await stillCurrent()) return;
+    control('schtasks', ['/delete', '/f', '/tn', receipt.label], { stdio: 'ignore' });
+  }
+
+  const tombstonePath = join(receipt.dataDir, 'integrations', 'uninstalled.json');
+  const tombstone = {
+    version: 1,
+    cleanedAt: new Date().toISOString(),
+    reason: 'package absent after upgrade grace period',
+    removedHooks,
+    removedService: receipt.unitPath,
+    removedLinger: false,
+    lingerCleanup: ownedLingerUid === null ? 'not-owned' : 'requested',
+    preserved: ['encrypted archives', 'unsynced outbox', 'recovery material in native keychain', 'remote objects'],
+  };
+  if (!await stillCurrent()) return;
+  await atomicJson(tombstonePath, tombstone);
+  if (!await stillCurrent()) return;
+  await rm(receipt.managerPath, { force: true }).catch(() => undefined);
+  if (!await stillCurrent()) return;
+  await rm(receiptPath, { force: true }).catch(() => undefined);
+  if (ownedLingerUid !== null) {
+    // Do this strictly last. On a logged-out headless host, disabling linger
+    // may stop the user manager — including this process — immediately. By
+    // then hooks, unit, receipt, manager, and the requested-cleanup tombstone
+    // are already durable. If logind leaves us alive, refine the receipt with
+    // the command's verified exit status.
+    const removedLinger = control('loginctl', ['disable-linger', String(ownedLingerUid)], { stdio: 'ignore' }).status === 0;
+    await atomicJson(tombstonePath, {
+      ...tombstone,
+      removedLinger,
+      lingerCleanup: removedLinger ? 'completed' : 'failed',
+    }).catch(() => undefined);
+  }
+}
+
+const receipt = await readReceipt();
+const targetPresent = () => existsSync(receipt.packageTarget);
+const targetIdentity = () => {
+  try {
+    const entry = statSync(receipt.packageTarget);
+    return [entry.dev, entry.ino, entry.size, entry.mtimeMs].join(':');
+  } catch { return null; }
+};
+if (!targetPresent()) {
+  await delay(Math.max(0, receipt.cleanupGraceMs ?? 300000));
+  if (!targetPresent()) await cleanup(receipt);
+  process.exit(0);
+}
+
+const childInvocation = childInvocationFor(receipt, process.platform);
+const child = spawn(childInvocation.executable, childInvocation.args, {
+  env: {
+    ...process.env,
+    // Exact paths, not a generic boolean: service reconciliation may only
+    // defer a self-restart when it is running under this precise manager and
+    // ownership receipt.
+    SEALKEEP_SERVICE_MANAGER_PATH: receipt.managerPath,
+    SEALKEEP_SERVICE_RECEIPT_PATH: receipt.receiptPath,
+    ${JSON.stringify(INTEGRATION_MANAGER_GENERATION_ENV)}: ${JSON.stringify(INTEGRATION_MANAGER_GENERATION)},
+  },
+  stdio: 'inherit'
+});
+// Attach before the first await. A daemon that exits immediately (for example
+// because an older generation still owns the vault) can otherwise disappear
+// while this manager is publishing its startup heartbeat. EventEmitter does
+// not replay the exit event, leaving a childless supervisor alive forever.
+const childExit = new Promise((resolve) => child.once('exit', (code, signal) => resolve({ code, signal })));
+let launchedTargetIdentity = targetIdentity();
+let restartingForUpgrade = false;
+let removingForUninstall = false;
+let forceStopTimer = null;
+const scheduleForcedStop = () => {
+  if (forceStopTimer) return;
+  // A daemon normally drains its current bounded unit before exiting. A bad
+  // provider or inherited old build must not strand an upgrade forever: after
+  // the grace period the supervisor ends only its own child, then the native
+  // service manager launches the new package. Tests may shorten the internal
+  // receipt value; installed receipts use the ten-second default.
+  const graceMs = Math.max(50, Math.min(10000, receipt.forceStopMs ?? 10000));
+  forceStopTimer = setTimeout(() => child.kill('SIGKILL'), graceMs);
+  forceStopTimer.unref?.();
+};
+
+// A freshly logged-in machine can spend a while loading the package and
+// discovering a large agent-history tree before the daemon writes its first
+// detailed heartbeat.  The service manager already knows the child exists, so
+// publish that narrow fact immediately.  If the child exits, the normal
+// liveness check sees that this pid is gone; once the daemon is ready it
+// replaces this record with its real roots and progress.
+const heartbeatPath = join(receipt.dataDir, 'daemon-state.json');
+const previousHeartbeat = await readFile(heartbeatPath, 'utf8')
+  .then((raw) => JSON.parse(raw))
+  .catch(() => null);
+const startedAt = new Date().toISOString();
+await atomicJson(heartbeatPath, {
+  version: 1,
+  pid: child.pid ?? process.pid,
+  startedAt,
+  lastTickAt: startedAt,
+  intervalMs: 30000,
+  totals: previousHeartbeat?.totals ?? { archived: 0, indexed: 0, uploaded: 0, reclaimed: 0, failed: 0 },
+  last: { archived: 0, indexed: 0, uploaded: 0, reclaimed: 0, failed: 0, notes: ['starting automatic memory preservation'] },
+  paused: false,
+  watching: []
+}).catch(() => undefined);
+
+let missingSince = null;
+const intervalMs = Math.max(250, Math.min(30000, receipt.monitorIntervalMs ?? 30000));
+const monitor = setInterval(async () => {
+  if (targetPresent()) {
+    missingSince = null;
+    const currentIdentity = targetIdentity();
+    if (launchedTargetIdentity && currentIdentity && currentIdentity !== launchedTargetIdentity) {
+      // npm replaces the CLI while an existing Node process keeps the old
+      // JavaScript in memory. End this supervisor with a non-zero upgrade code
+      // so launchd/systemd starts it again and the next child loads the newly
+      // installed package. No person, login, or machine restart is required.
+      restartingForUpgrade = true;
+      clearInterval(monitor);
+      if (!child.kill('SIGTERM')) process.exit(75);
+      else scheduleForcedStop();
+    } else if (!launchedTargetIdentity && currentIdentity) {
+      launchedTargetIdentity = currentIdentity;
+    }
+    return;
+  }
+  if (missingSince === null) {
+    missingSince = Date.now();
+    await atomicJson(receiptPath, { ...receipt, missingSince: new Date(missingSince).toISOString() }).catch(() => undefined);
+    return;
+  }
+  if (Date.now() - missingSince < (receipt.cleanupGraceMs ?? 300000)) return;
+  removingForUninstall = true;
+  clearInterval(monitor);
+  if (child.exitCode === null && child.signalCode === null) {
+    child.kill('SIGTERM');
+    scheduleForcedStop();
+  }
+  // Ownership files are the evidence needed to stop this exact child. Never
+  // erase them while a SIGTERM-ignoring historical daemon can remain alive;
+  // the bounded timer escalates only this manager's child to SIGKILL.
+  await childExit;
+  if (forceStopTimer) clearTimeout(forceStopTimer);
+  // A slow upgrade can outlast the absence grace while the old child is still
+  // quiescing. Recheck at the destructive boundary: if the package returned,
+  // preserve its manager, receipt, hooks and native unit, then ask the service
+  // manager to launch the restored generation just like an in-place upgrade.
+  if (targetPresent()) process.exit(75);
+  await cleanup(receipt);
+  process.exit(0);
+}, intervalMs);
+
+// launchd/systemd stop the supervisor, not the daemon child directly. Without
+// forwarding the signal the manager exits while Node leaves its child running
+// as an orphan; the service manager then starts a second daemon beside it.
+// Give the child enough time to close its queue/index writers cleanly, but do
+// not let a stuck historical task make uninstall or upgrade hang forever.
+let stoppingSignal = null;
+for (const signal of ['SIGINT', 'SIGTERM']) process.on(signal, () => {
+  if (stoppingSignal) return;
+  stoppingSignal = signal;
+  clearInterval(monitor);
+  if (!child.kill(signal)) process.exit(0);
+  scheduleForcedStop();
+});
+void childExit.then(async ({ code }) => {
+  clearInterval(monitor);
+  if (forceStopTimer) clearTimeout(forceStopTimer);
+  if (removingForUninstall) return;
+  if (stoppingSignal) process.exit(0);
+  if (restartingForUpgrade) process.exit(75);
+  if (!targetPresent()) {
+    await delay(Math.max(0, receipt.cleanupGraceMs ?? 300000));
+    if (!targetPresent()) await cleanup(receipt);
+  }
+  process.exit(code ?? 1);
+});
+`;

package/dist/src/leakscan.js

@@ -120,7 +120,7 @@ const BENIGN_VALUE_SHAPES = [
     /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, // UUIDs: session ids, request ids, vault ids
     /^[0-9a-f]{32,}$/i, // hex digests (sha256 and friends): integrity data, not credentials
     /^AAAA/, // base64 of leading zero bytes: well-known placeholders and ssh key headers
-    /^(?:vlt|vault)_/i // vaultline's own refs (vlt_…, vault_ref ids), which are public by design
+    /^(?:vlt|vault)_/i // Sealkeep's own refs (vlt_…, vault_ref ids), which are public by design
 ];
 function scanLine(line, lineNumber) {
     const findings = [];

package/dist/src/local-api.d.ts

@@ -2,8 +2,12 @@ import { type Server } from "node:http";
 import { z } from "zod";
 import { type AgentId } from "./adapters.js";
 import { ArchiveQueue } from "./queue.js";
-import { localApiTokenPath } from "./paths.js";
+import { drainQueue } from "./worker.js";
+import { localApiTokenPath, localUiProofKeyPath } from "./paths.js";
+type GdriveConnector = typeof cloud.connectGdriveViaCloud;
 import { type ServiceOptions } from "./service.js";
+import * as cloud from "./cloud.js";
+import type { McpExec } from "./mcp-install.js";
 declare const setupStorageSchema: z.ZodObject<{
     provider: z.ZodEnum<{
         s3: "s3";
@@ -36,13 +40,15 @@ declare const setupStorageSchema: z.ZodObject<{
  * the B2 key is a native one rather than S3-compatible. All of that is knowable
  * in a second while the person is still looking at the form.
  *
- * It writes a small object, reads it back, and compares the bytes, because
- * anything less proves less: a successful PUT says nothing about whether GET is
- * permitted, and this product's whole promise is that the bytes come back.
+ * It writes a small object, reads it back, compares the bytes, deletes it, and
+ * confirms it is gone. Anything less proves less: a successful PUT says
+ * nothing about whether GET is permitted, while a target that cannot delete
+ * cannot support move/cleanup workflows safely.
  *
- * Nothing is stored. The credential is used to build a client, held for the
- * round trip, and dropped — the caller has not committed to this target yet,
- * and a test that saved a broken configuration would be worse than no test.
+ * No probe object or credential is retained. The credential is used to build a
+ * client, held for the round trip, and dropped — the caller has not committed
+ * to this target yet, and a test that saved a broken configuration would be
+ * worse than no test.
  */
 export declare function testStorageTarget(input: z.infer<typeof setupStorageSchema>): Promise<{
     ok: boolean;
@@ -56,16 +62,27 @@ export type SessionRow = {
     modifiedAt: string;
     /** True when an archive already covers this file at exactly this length. */
     archived: boolean;
-    /** True when that archive also has a verified copy in storage — off this machine, not just sealed on it. */
+    /** True when one exact archive and every delta-chain link it needs have verified copies off this machine. */
     stored: boolean;
-    /** True while a queued or in-flight job exists for this file: it is being sealed and must not be selected again. */
+    /**
+     * Exact V2 archive head whose complete chain is present on this machine and
+     * can therefore enter normal storage routing. Null unless the live session
+     * is archived-but-not-stored; the dashboard must never infer this from
+     * `archived` alone.
+     */
+    sendableArchiveId: string | null;
+    /** True while a queued or in-flight job exists for this file. It may be waiting; it must not be selected again. */
     queued: boolean;
-    /** Why a queued job is waiting instead of running — today, the disk guard's message. Null when it is genuinely being worked. A held row saying "sealing…" was a lie the queue knew better than. */
+    /** Why a queued job is waiting instead of running. Null when it is genuinely being worked. A held row saying "sealing…" would be a lie the queue knows better than. */
     held: string | null;
+    /** What is holding a ready job. Policy pauses do not need a three-second browser retry loop; disk/retry holds still do. */
+    heldKind: "policy" | "space" | "retry" | null;
     /** Whole percentages of the source read so far while sealing, else null. The number a person actually watches on a 1.6 GB row. */
     sealingPct: number | null;
     /** The project this session ran in, when its metadata says — the Sessions page filters and labels on it. Null when nothing says. */
     project: string | null;
+    /** Stable identity used for team mapping; the display label above is never an access key. */
+    projectKey: string | null;
     /** The working directory behind `project`, best-effort decoded; a tooltip, never a filter. */
     projectPath: string | null;
 };
@@ -83,13 +100,15 @@ export type SessionRow = {
  * done" is as useful as "this one is not", and hiding them would make the list
  * shrink as you work and lose your place.
  */
-export declare function listSessions(dataDir: string, queue?: ArchiveQueue): Promise<{
+export declare function listSessions(dataDir: string, queue?: ArchiveQueue, home?: string): Promise<{
     sessions: SessionRow[];
     totalBytes: number;
     unarchivedBytes: number;
 }>;
-export declare function ensureDraining(dataDir: string, queue: ArchiveQueue): Promise<void>;
-export declare function archiveSelected(dataDir: string, paths: string[], queue: ArchiveQueue): Promise<{
+export declare function ensureDraining(dataDir: string, queue: ArchiveQueue, operations?: {
+    drainQueue?: typeof drainQueue;
+}): Promise<void>;
+export declare function archiveSelected(dataDir: string, paths: string[], queue: ArchiveQueue, home?: string): Promise<{
     requested: number;
     queued: number;
     bytes: number;
@@ -101,23 +120,34 @@ export declare function archiveSelected(dataDir: string, paths: string[], queue:
         error?: string;
     }[];
 }>;
-export { localApiTokenPath };
+export { localApiTokenPath, localUiProofKeyPath };
 /** Mints the loopback token once and keeps it owner-readable. It is never logged or returned by an endpoint. */
 export declare function localApiToken(dataDir: string): Promise<string>;
+/** Keyed listener identity proof; it grants no access to any /v1 data. */
+export declare function localUiProofKey(dataDir: string): Promise<string>;
+export declare const LOCAL_UI_PROOF_VERSION = 1;
+export declare const localUiProof: (secret: string, nonce: string, port: number, instanceId: string) => string;
+/** Owner-authenticated request for a short-lived browser bootstrap ticket. */
+export declare const localUiBootstrapProof: (secret: string, nonce: string, port: number, instanceId: string) => string;
 /** One row of GET /v1/cloud/copies: a copy held off this machine, wherever it is held. */
 export type StoredCopy = {
     ref: string;
+    archiveId?: string;
+    copyId?: string;
+    provider?: string;
+    targetId?: string | null;
     bytes: number;
     addedAt: string | null;
     state: string;
     /** True when this machine no longer holds the archive's bytes, so this stored copy is the archive. */
     lastCopy: boolean;
 };
-/** Test seam: the setup endpoints act on the real machine, so tests need a home and a service manager of their own. */
+/** Test seams: setup acts on the real machine, so tests need a home and command runners of their own. */
 export type SetupEnvironment = {
     home?: string;
     platform?: NodeJS.Platform;
     exec?: ServiceOptions["exec"];
+    mcpExec?: McpExec;
 };
 /**
  * The loopback API shared by the CLI, dashboard, and MCP surfaces. It is the only
@@ -129,4 +159,15 @@ export type SetupEnvironment = {
 export declare function createLocalApiServer(dataDir: string, token: string, options?: {
     queue?: ArchiveQueue;
     setup?: SetupEnvironment;
+    gdriveConnector?: GdriveConnector;
+    listenerInstanceId?: string;
+    /** True hands post-unlock draining to the supervised daemon that is waiting to start. */
+    onRecoveryPhraseAvailable?: () => boolean;
+    /** Deterministic transfer seam; production dynamically loads uploadArchive. */
+    uploadArchive?: typeof import("./upload.js")["uploadArchive"];
+    /** Maximum silence between real transfer byte/checkpoint progress. */
+    uploadIdleMs?: number;
+    /** Short seams keep browser handoff expiry tests fast; production uses the defaults. */
+    bootstrapRequestTtlMs?: number;
+    bootstrapTicketTtlMs?: number;
 }): Server;