sealkeep 0.9.0 → 0.11.0

package/dist/src/ui.d.ts

@@ -11,7 +11,6 @@ export declare const blue: (value: string) => string;
 export declare const green: (value: string) => string;
 export declare const amber: (value: string) => string;
 export declare const red: (value: string) => string;
-export declare const underline: (value: string) => string;
 /** State markers. Text-first so they survive `NO_COLOR` and screen readers. */
 export declare const mark: {
     ok: () => string;
@@ -21,7 +20,7 @@ export declare const mark: {
 };
 export declare function heading(text: string): string;
 /** The recurring device: the line past which plaintext does not travel. */
-export declare function vaultline(label?: string): string;
+export declare function divider(label?: string): string;
 export declare function keyValue(pairs: [string, string][], indent?: string): string;
 export declare function bytes(value: number): string;
 export declare function relativeTime(iso: string): string;

package/dist/src/ui.js

@@ -14,7 +14,6 @@ export const blue = wrap("38;5;33", "39");
 export const green = wrap("38;5;29", "39");
 export const amber = wrap("38;5;172", "39");
 export const red = wrap("38;5;160", "39");
-export const underline = wrap("4", "24");
 /** State markers. Text-first so they survive `NO_COLOR` and screen readers. */
 export const mark = {
     ok: () => green("ok"),
@@ -26,7 +25,7 @@ export function heading(text) {
     return `\n${bold(text)}\n${dim("─".repeat(Math.min(text.length + 12, 60)))}`;
 }
 /** The recurring device: the line past which plaintext does not travel. */
-export function vaultline(label = "plaintext ends here") {
+export function divider(label = "plaintext ends here") {
     return `${dim("─".repeat(4))}${dim("┤")} ${blue(label)} ${dim("├")}${dim("─".repeat(Math.max(4, 52 - label.length)))}`;
 }
 export function keyValue(pairs, indent = "  ") {

package/dist/src/upload.d.ts

@@ -1,5 +1,6 @@
 import { type ProviderUploadClient, type UploadLease } from "./control-plane.js";
 import { type EndpointOverrides } from "./providers/index.js";
+import { type ArchiveRecordV2 } from "./types.js";
 export type UploadOptions = {
     /** Routed multi-target override: upload to THIS storage instead of config.remoteStorage. */
     remoteStorage?: {
@@ -16,15 +17,41 @@ export type UploadOptions = {
     overrides?: EndpointOverrides;
     now?: number;
     ttlMs?: number;
+    signal?: AbortSignal;
+    /** Cumulative bytes read or sent; used only to reset an owning idle deadline. */
+    onProgress?: (bytes: number) => void;
+    /** Sustained upload ceiling. The daemon supplies the per-machine setting;
+     * an explicit/manual upload may omit it. */
+    maxBytesPerSecond?: number;
+    /** Deterministic pacing seams. */
+    paceNow?: () => number;
+    paceSleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    /** Internal bridge path for a provider-to-provider transfer. */
+    ciphertextPath?: string;
+    /**
+     * A transfer run coalesces this advisory account update after all of its
+     * destination verifies and source deletes. Ordinary one-off/queue uploads
+     * keep the non-blocking default.
+     */
+    reportTargetUsage?: boolean;
 };
 export type UploadOutcome = {
     archiveId: string;
     objectKey: string;
+    copyId: string;
     bytes: number;
     checksum: string;
     verified: boolean;
     provider: string;
 };
+export declare function archiveWrapsEveryMember(record: ArchiveRecordV2, publicKeys: string[]): boolean;
+/** Retry grants for durable project archives, including ones uploaded offline. */
+export declare function reconcileManagedTeamArchives(dataDir: string, options?: {
+    signal?: AbortSignal;
+}): Promise<{
+    registered: number;
+    failed: number;
+}>;
 /**
  * Uploads one archive's ciphertext and verifies it landed intact.
  *

package/dist/src/upload.js

@@ -1,12 +1,142 @@
 import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
+import { open } from "node:fs/promises";
 import { assertLeaseUsable } from "./control-plane.js";
 import { fail } from "./errors.js";
 import { recordAudit } from "./audit.js";
 import { createActiveLease } from "./providers/index.js";
 import { uploadClientFromStore } from "./providers/index.js";
 import { isV2 } from "./types.js";
-import { listArchives, readConfig, writeRecord } from "./vault.js";
+import { listArchives, mutateArchiveRecord, readConfig } from "./vault.js";
+import { STORAGE_PREFIX_DEFAULT } from "./branding.js";
+import { appendArchiveCopy, archiveCopies, archiveCopyId, hasVerifiedCopy } from "./archive-copies.js";
+import { collectChunks, digestChunks, fileHandleChunks, LEGACY_BUFFER_LIMIT_BYTES, tapDigest } from "./byte-stream.js";
+import { paceBackgroundByteStream } from "./background-bandwidth.js";
+export function archiveWrapsEveryMember(record, publicKeys) {
+    if (!record.envelope || publicKeys.length === 0)
+        return false;
+    const wanted = [...new Set(publicKeys)].sort();
+    const actual = record.envelope.wrappedKeys
+        .filter((entry) => entry.type === "x25519")
+        .map((entry) => entry.recipientPublicKey)
+        .sort();
+    // Phrase recovery remains private to the owner and is not a team identity.
+    // Every x25519 recipient, however, is an account/device that can open the
+    // object once the hosted membership gate serves it. A subset check retained
+    // removed or unrelated keys and could make an old grant look current.
+    return actual.length === wanted.length
+        && actual.every((publicKey, index) => publicKey === wanted[index]);
+}
+function configuredSpaceKeyForRecord(config, record, project) {
+    const bindings = config.teamSpaces ?? {};
+    const stableScope = record.source.projectScope;
+    if (stableScope) {
+        return Object.values(bindings).some((binding) => binding.spaceKey === stableScope)
+            ? stableScope
+            : null;
+    }
+    return project ? bindings[project]?.spaceKey ?? null : null;
+}
+/**
+ * Publish the membership-gated project grant after the account copy is proven
+ * durable. This is deliberately idempotent and best-effort at the upload call
+ * site: the daemon-wide reconciliation below retries every missed grant, so a
+ * short control-plane outage never turns a successful backup into a failed
+ * backup or requires a person to run a sharing command.
+ */
+async function registerManagedTeamArchive(dataDir, record, options = {}) {
+    options.signal?.throwIfAborted();
+    if (!archiveCopies(record).some((copy) => copy.provider === "vaultline" && copy.verifiedAt))
+        return false;
+    const config = await readConfig(dataDir);
+    const { projectOfRecord } = await import("./adapters.js");
+    const project = record.source.projectScope ? null : await projectOfRecord(record).catch(() => null);
+    const spaceKey = configuredSpaceKeyForRecord(config, record, project);
+    if (!spaceKey)
+        return false;
+    const { getTeamRoster, listTeamArchives, registerTeamArchive } = await import("./cloud.js");
+    const roster = await getTeamRoster(dataDir, spaceKey, undefined, { signal: options.signal });
+    if (!archiveWrapsEveryMember(record, roster.members.map((member) => member.public_key)))
+        return false;
+    const existing = await listTeamArchives(dataDir, spaceKey, undefined, { signal: options.signal });
+    if (existing.some((row) => row.vault_ref === record.id && row.membership_version === roster.membership_version))
+        return true;
+    await registerTeamArchive(dataDir, spaceKey, record.id, roster.membership_version, undefined, { signal: options.signal });
+    return true;
+}
+/** Retry grants for durable project archives, including ones uploaded offline. */
+export async function reconcileManagedTeamArchives(dataDir, options = {}) {
+    options.signal?.throwIfAborted();
+    const config = await readConfig(dataDir);
+    if (!config.teamSpaces || Object.keys(config.teamSpaces).length === 0)
+        return { registered: 0, failed: 0 };
+    const { projectOfRecord } = await import("./adapters.js");
+    const bySpace = new Map();
+    for (const record of await listArchives(dataDir)) {
+        if (!isV2(record) || !archiveCopies(record).some((copy) => copy.provider === "vaultline" && copy.verifiedAt))
+            continue;
+        const project = record.source.projectScope ? null : await projectOfRecord(record).catch(() => null);
+        const spaceKey = configuredSpaceKeyForRecord(config, record, project);
+        if (!spaceKey)
+            continue;
+        const records = bySpace.get(spaceKey) ?? [];
+        records.push(record);
+        bySpace.set(spaceKey, records);
+    }
+    const { getTeamRoster, listTeamArchives, registerTeamArchive } = await import("./cloud.js");
+    let registered = 0;
+    let failed = 0;
+    const membershipVersionBySpace = new Map();
+    for (const [spaceKey, records] of bySpace) {
+        options.signal?.throwIfAborted();
+        let shareable;
+        try {
+            const roster = await getTeamRoster(dataDir, spaceKey, undefined, { signal: options.signal });
+            const memberKeys = roster.members.map((member) => member.public_key);
+            shareable = records.filter((record) => archiveWrapsEveryMember(record, memberKeys));
+            membershipVersionBySpace.set(spaceKey, roster.membership_version);
+        }
+        catch (error) {
+            if (options.signal?.aborted)
+                throw options.signal.reason ?? error;
+            failed += records.length;
+            continue;
+        }
+        if (shareable.length === 0)
+            continue;
+        let existing;
+        try {
+            const membershipVersion = membershipVersionBySpace.get(spaceKey);
+            existing = new Set((await listTeamArchives(dataDir, spaceKey, undefined, { signal: options.signal }))
+                .filter((row) => row.membership_version === membershipVersion)
+                .map((row) => row.vault_ref));
+        }
+        catch (error) {
+            if (options.signal?.aborted)
+                throw options.signal.reason ?? error;
+            failed += shareable.length;
+            continue;
+        }
+        for (const record of shareable) {
+            options.signal?.throwIfAborted();
+            if (existing.has(record.id))
+                continue;
+            try {
+                const membershipVersion = membershipVersionBySpace.get(spaceKey);
+                if (!membershipVersion)
+                    throw new Error("team_roster_version_missing");
+                await registerTeamArchive(dataDir, spaceKey, record.id, membershipVersion, undefined, { signal: options.signal });
+                existing.add(record.id);
+                registered += 1;
+            }
+            catch (error) {
+                if (options.signal?.aborted)
+                    throw options.signal.reason ?? error;
+                failed += 1;
+            }
+        }
+    }
+    return { registered, failed };
+}
 /**
  * Uploads one archive's ciphertext and verifies it landed intact.
  *
@@ -17,64 +147,274 @@ import { listArchives, readConfig, writeRecord } from "./vault.js";
  */
 export async function uploadArchive(dataDir, archiveId, options = {}) {
     const config = await readConfig(dataDir);
-    const remoteStorage = options.remoteStorage ?? config.remoteStorage ?? fail("storage_not_configured", "No remote target configured. Run: sealkeep storage configure ...");
     const record = (await listArchives(dataDir)).find((item) => item.id === archiveId);
     if (!record)
         fail("archive_not_found", `Archive not found: ${archiveId}`, { archiveId });
     if (!isV2(record))
         fail("invalid_argument", `Archive ${archiveId} uses format v1. Run: sealkeep migrate`, { archiveId });
-    const ciphertext = await readFile(record.objectPath);
-    const localChecksum = createHash("sha256").update(ciphertext).digest("base64");
-    const providerConfig = remoteStorage;
-    const lease = createActiveLease(providerConfig, { archiveId, ciphertextSha256: record.cipher.ciphertextSha256, bytes: ciphertext.length, now: options.now, ttlMs: options.ttlMs });
-    assertLeaseUsable(lease, options.now);
-    const client = options.client ?? await uploadClientFromStore(dataDir, options.storageConfigId ?? config.vaultId, providerConfig, options.overrides);
-    const uploaded = await client.upload(lease, ciphertext);
-    const head = await client.head(lease);
-    // What the provider should be holding. For a single-part object that is the
-    // whole-object SHA-256; for a multipart one it is S3's composite of the part
-    // digests, which `upload` returns. Comparing the stored checksum against
-    // `localChecksum` unconditionally would fail every multipart archive.
-    const expected = uploaded.remoteChecksum;
-    const problems = [];
-    if (!head.exists)
-        problems.push("the provider does not report the object as present");
-    if (head.bytes !== ciphertext.length)
-        problems.push(`the provider stored ${head.bytes} bytes; ${ciphertext.length} were sent`);
-    if (head.checksum === undefined) {
-        // Previously this case silently skipped the comparison, which left byte
-        // count as the only real check — an endpoint returning the right length of
-        // wrong bytes verified clean. Reclaim depends on this verdict, so an
-        // unprovable upload is a failed upload.
-        problems.push("the provider did not report a stored checksum, so the bytes it holds cannot be proven");
+    const project = record.source.project ?? null;
+    // A stable scope means the archive was sealed for a team even if this
+    // machine has since removed or renamed its local binding. Older records may
+    // carry only the project, so the current binding is the second proof.
+    const teamBound = Boolean(record.source.projectScope || (project && config.teamSpaces?.[project]));
+    const explicitTransport = options.remoteStorage !== undefined || options.client !== undefined;
+    let targetId = options.targetId;
+    let remoteStorage = options.remoteStorage ?? config.remoteStorage ?? null;
+    let routedTarget = null;
+    if (explicitTransport) {
+        // Explicit transports are test/advanced seams and keep their old behavior,
+        // but they may not move a team-readable archive into personal storage.
+        const provider = options.remoteStorage?.provider ?? options.client?.kind ?? remoteStorage?.provider;
+        if (teamBound && provider !== "vaultline") {
+            fail("storage_not_configured", "Shared project memory must be stored in Sealkeep Cloud so every approved member can reach the same encrypted archive.");
+        }
+        // A caller may choose an account target while supplying its transport
+        // shape explicitly (the CLI's Drive single-object path does this). The id
+        // still owns the credential and endpoint; explicit transport must not
+        // silently fall back to the vault-wide legacy secret.
+        if (targetId && options.remoteStorage) {
+            const { resolveTargets } = await import("./storage-targets.js");
+            const named = (await resolveTargets(dataDir)).find((target) => target.id === targetId);
+            if (!named)
+                fail("storage_not_configured", `Storage target "${targetId}" is not configured on this machine.`);
+            if (named.provider !== options.remoteStorage.provider
+                || named.bucket !== options.remoteStorage.bucket) {
+                fail("invalid_argument", `Storage target "${targetId}" no longer describes the supplied ${options.remoteStorage.provider} destination.`);
+            }
+            routedTarget = named;
+        }
     }
-    else if (head.checksum !== expected) {
-        problems.push(`the provider's stored checksum ${head.checksum} does not match the ${expected} we uploaded`);
+    else {
+        // This is the single routing boundary for every ordinary caller: dashboard,
+        // daemon, CLI upload-pending, and integrations all inherit account order,
+        // caps and project pins without each surface reimplementing them.
+        const { chooseTarget } = await import("./storage-targets.js");
+        const target = await chooseTarget(dataDir, {
+            project,
+            projectKey: record.source.projectKey ?? null,
+            bytes: record.cipher.storedBytes,
+            requireManaged: teamBound,
+            ...(targetId ? { targetId } : {}),
+        });
+        routedTarget = target;
+        targetId = target.id;
+        remoteStorage = target.provider === "vaultline"
+            ? null
+            : {
+                provider: target.provider,
+                bucket: target.bucket ?? (target.provider === "gdrive" ? "Sealkeep" : ""),
+                prefix: target.prefix ?? STORAGE_PREFIX_DEFAULT,
+                ...(target.region ? { region: target.region } : {}),
+            };
     }
-    if (problems.length > 0) {
-        await recordAudit(dataDir, "upload.verify", "denied", { archiveId, objectKey: lease.objectKey, problems: problems.length });
-        fail("ciphertext_integrity_failed", `Refusing to mark ${archiveId} durable: ${problems.join("; ")}`, { archiveId, objectKey: lease.objectKey });
+    /**
+     * A managed account IS a remote target.
+     *
+     * This gated on a configured bucket alone, so a paying account signed in to
+     * managed storage was told "No remote target configured" for every one of
+     * 1,035 archives — the plan's 500 GB sat at 0 B used while the only copy of
+     * everything stayed on one disk. Managed accounts take the plane's leased
+     * path, which verifies durability before reporting success; a configured
+     * bucket still wins when both exist.
+     */
+    // "vaultline" as an explicit remoteStorage entry is the older of the two
+    // equally valid enrolled-vault shapes (the newer carries only the cloud
+    // token). Both mean the same thing — managed storage — so both take the
+    // plane's leased path; the provider ladder below is for buckets the USER
+    // brings, and handing it "vaultline" ends at "enable a signer", an
+    // instruction no managed account can follow.
+    if (!remoteStorage || remoteStorage.provider === "vaultline") {
+        const { cloudToken, pushArchive } = await import("./cloud.js");
+        await cloudToken(dataDir, undefined, { signal: options.signal }).catch((error) => {
+            if (options.signal?.aborted)
+                throw options.signal.reason ?? error;
+            return fail("storage_not_configured", "No remote target configured. Run: sealkeep storage configure ...  (or sign in with `sealkeep cloud login`)");
+        });
+        const pushed = await pushArchive(dataDir, archiveId, undefined, {
+            signal: options.signal,
+            onProgress: options.onProgress,
+            maxBytesPerSecond: options.maxBytesPerSecond,
+            paceNow: options.paceNow,
+            paceSleep: options.paceSleep,
+            ...(options.ciphertextPath ? { ciphertextPath: options.ciphertextPath } : {}),
+        });
+        if (!pushed.durable) {
+            fail("ciphertext_integrity_failed", pushed.note ?? `Managed storage did not verify archive ${archiveId}; the local copy is untouched.`, {
+                archiveId,
+                objectKey: pushed.objectKey,
+            });
+        }
+        let current = (await listArchives(dataDir)).find((item) => isV2(item) && item.id === archiveId);
+        if (current && targetId) {
+            current = await mutateArchiveRecord(config.storage.root, archiveId, (latest) => {
+                if (!isV2(latest))
+                    return latest;
+                const managed = archiveCopies(latest).find((copy) => copy.provider === "vaultline" && copy.objectKey === pushed.objectKey);
+                return managed ? appendArchiveCopy(latest, { ...managed, targetId }) : latest;
+            });
+        }
+        if (current) {
+            try {
+                await registerManagedTeamArchive(dataDir, current, { signal: options.signal });
+            }
+            catch (error) {
+                if (options.signal?.aborted)
+                    throw options.signal.reason ?? error;
+                // Registration is retried by the daemon-wide reconciliation lane.
+            }
+        }
+        if (options.reportTargetUsage !== false) {
+            const { pushTargetUsage } = await import("./storage-targets.js");
+            void pushTargetUsage(dataDir);
+        }
+        return {
+            archiveId: pushed.archiveId,
+            objectKey: pushed.objectKey,
+            copyId: archiveCopyId({ provider: "vaultline", bucket: "vaultline-managed", objectKey: pushed.objectKey }),
+            bytes: pushed.bytes,
+            checksum: "",
+            verified: true,
+            provider: "vaultline"
+        };
+    }
+    const ciphertextPath = options.ciphertextPath ?? record.objectPath;
+    const handle = await open(ciphertextPath, "r").catch(() => fail("archive_not_found", `Archive ciphertext is not readable: ${ciphertextPath}`, { archiveId, path: ciphertextPath }));
+    try {
+        const measured = await digestChunks(fileHandleChunks(handle, { signal: options.signal }), options.onProgress);
+        if (measured.sha256Hex !== record.cipher.ciphertextSha256 || measured.bytes !== record.cipher.storedBytes) {
+            fail("ciphertext_integrity_failed", `The sealed bytes for ${archiveId} changed on this disk; nothing was uploaded.`, { archiveId });
+        }
+        const localChecksum = measured.sha256Base64;
+        const providerConfig = remoteStorage;
+        const lease = createActiveLease(providerConfig, { archiveId, ciphertextSha256: record.cipher.ciphertextSha256, bytes: measured.bytes, now: options.now, ttlMs: options.ttlMs });
+        assertLeaseUsable(lease, options.now);
+        // Target-id credentials let one machine connect more than one personal
+        // destination. Only the synthesized `primary` target may fall back to the
+        // legacy vault-id secret, so upgrades keep working without letting named
+        // targets borrow one another's credentials.
+        const routedConnection = routedTarget
+            ? await (async () => {
+                const { credentialConfigIdForTarget, endpointOverridesForResolvedTarget } = await import("./storage-targets.js");
+                return {
+                    credentialId: await credentialConfigIdForTarget(dataDir, routedTarget),
+                    overrides: await endpointOverridesForResolvedTarget(dataDir, routedTarget),
+                };
+            })()
+            : null;
+        if (routedTarget && !routedConnection?.credentialId) {
+            fail("signer_not_configured", `Storage target "${routedTarget.id}" is not connected on this machine. Connect it in Settings before uploading.`);
+        }
+        const client = options.client ?? await uploadClientFromStore(dataDir, options.storageConfigId ?? routedConnection?.credentialId ?? config.vaultId, providerConfig, 
+        // An explicit/first-run endpoint belongs only to the legacy primary.
+        // Named targets always sign against their own account routing metadata.
+        routedTarget
+            ? routedTarget.id === "primary" ? (options.overrides ?? routedConnection.overrides) : routedConnection.overrides
+            : options.overrides);
+        // Every production storage client implements uploadStream. The bounded
+        // compatibility branch keeps small injected/test clients working, but a
+        // legacy client can never make a multi-GB file become one giant Buffer.
+        const streaming = client;
+        let uploaded;
+        if (typeof streaming.uploadStream === "function") {
+            const sentHash = createHash("sha256");
+            let sentBytes = 0;
+            const body = tapDigest(fileHandleChunks(handle, { signal: options.signal }), sentHash, (bytes) => {
+                sentBytes += bytes;
+                options.onProgress?.(sentBytes);
+            });
+            uploaded = await streaming.uploadStream(lease.objectKey, options.maxBytesPerSecond
+                ? paceBackgroundByteStream(dataDir, body, options.maxBytesPerSecond, {
+                    signal: options.signal,
+                    now: options.paceNow,
+                    sleep: options.paceSleep,
+                })
+                : body, { bytes: measured.bytes, ...(options.signal ? { signal: options.signal } : {}) });
+            if (sentBytes !== measured.bytes || sentHash.digest("hex") !== record.cipher.ciphertextSha256) {
+                fail("ciphertext_integrity_failed", `The sealed bytes for ${archiveId} changed while they were uploading; the remote object was not marked durable.`, { archiveId });
+            }
+        }
+        else {
+            if (measured.bytes > LEGACY_BUFFER_LIMIT_BYTES) {
+                fail("provider_unsupported", `The ${client.kind} client cannot stream this ${measured.bytes}-byte archive. Update the client before retrying; nothing was marked durable.`, { archiveId, bytes: measured.bytes });
+            }
+            const ciphertext = await collectChunks(fileHandleChunks(handle, { signal: options.signal }), LEGACY_BUFFER_LIMIT_BYTES, options.onProgress);
+            uploaded = await client.upload(lease, ciphertext);
+        }
+        const head = await client.head(lease);
+        // What the provider should be holding. For a single-part object that is the
+        // whole-object SHA-256; for a multipart one it is S3's composite of the part
+        // digests, which `upload` returns. Comparing the stored checksum against
+        // `localChecksum` unconditionally would fail every multipart archive.
+        const expected = uploaded.remoteChecksum;
+        const problems = [];
+        if (uploaded.bytes !== measured.bytes)
+            problems.push(`the upload client consumed ${uploaded.bytes} bytes; ${measured.bytes} were expected`);
+        if (!head.exists)
+            problems.push("the provider does not report the object as present");
+        if (head.bytes !== measured.bytes)
+            problems.push(`the provider stored ${head.bytes} bytes; ${measured.bytes} were sent`);
+        if (head.checksum === undefined) {
+            // Previously this case silently skipped the comparison, which left byte
+            // count as the only real check — an endpoint returning the right length of
+            // wrong bytes verified clean. Reclaim depends on this verdict, so an
+            // unprovable upload is a failed upload.
+            problems.push("the provider did not report a stored checksum, so the bytes it holds cannot be proven");
+        }
+        else if (!expected || head.checksum !== expected) {
+            problems.push(`the provider's stored checksum ${head.checksum} does not match the ${expected ?? "missing checksum"} we uploaded`);
+        }
+        if (problems.length > 0) {
+            await recordAudit(dataDir, "upload.verify", "denied", { archiveId, objectKey: lease.objectKey, problems: problems.length });
+            fail("ciphertext_integrity_failed", `Refusing to mark ${archiveId} durable: ${problems.join("; ")}`, { archiveId, objectKey: lease.objectKey });
+        }
+        const storageTargets = await import("./storage-targets.js");
+        const explicitEndpoint = options.overrides?.host
+            ? `${options.overrides.protocol ?? "https"}://${options.overrides.host}${options.overrides.port ? `:${options.overrides.port}` : ""}`
+            : undefined;
+        const destination = routedTarget
+            ? await storageTargets.destinationIdentityForTarget(dataDir, routedTarget)
+            : storageTargets.storageDestinationIdentity({
+                id: targetId ?? "explicit",
+                provider: remoteStorage.provider,
+                bucket: remoteStorage.bucket,
+                prefix: remoteStorage.prefix,
+                ...(remoteStorage.region ? { region: remoteStorage.region } : {}),
+                ...(explicitEndpoint ? { endpoint: explicitEndpoint } : {}),
+            }, explicitEndpoint);
+        const remote = {
+            provider: lease.provider,
+            bucket: remoteStorage.bucket,
+            objectKey: lease.objectKey,
+            bytes: measured.bytes,
+            checksum: localChecksum,
+            verifiedAt: new Date(options.now ?? Date.now()).toISOString(),
+            destination,
+            destinationFingerprint: storageTargets.storageDestinationFingerprint(destination),
+            ...(targetId ? { targetId } : {}),
+        };
+        await mutateArchiveRecord(config.storage.root, archiveId, (current) => isV2(current) ? appendArchiveCopy(current, remote) : current);
+        await recordAudit(dataDir, "upload.verify", "allowed", { archiveId, objectKey: lease.objectKey, bytes: measured.bytes, provider: lease.provider });
+        if (options.reportTargetUsage !== false)
+            void storageTargets.pushTargetUsage(dataDir);
+        return { archiveId, objectKey: lease.objectKey, copyId: archiveCopyId(remote), bytes: measured.bytes, checksum: localChecksum, verified: true, provider: lease.provider };
     }
-    const remote = { provider: lease.provider, bucket: remoteStorage.bucket, objectKey: lease.objectKey, bytes: ciphertext.length, checksum: localChecksum, verifiedAt: new Date(options.now ?? Date.now()).toISOString(), ...(options.targetId ? { targetId: options.targetId } : {}) };
-    const next = { ...record, remote };
-    await writeRecord(config.storage.root, next);
-    await recordAudit(dataDir, "upload.verify", "allowed", { archiveId, objectKey: lease.objectKey, bytes: ciphertext.length, provider: lease.provider });
-    {
-        const { pushTargetUsage } = await import("./storage-targets.js");
-        void pushTargetUsage(dataDir);
+    finally {
+        await handle.close();
     }
-    return { archiveId, objectKey: lease.objectKey, bytes: ciphertext.length, checksum: localChecksum, verified: true, provider: lease.provider };
 }
 /** Uploads every archive that has no verified remote object yet. */
 export async function uploadPending(dataDir, options = {}) {
-    const records = await listArchives(dataDir);
+    const records = (await listArchives(dataDir)).sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.id.localeCompare(b.id));
     const uploaded = [];
     const failed = [];
     for (const record of records) {
-        if (isV2(record) && record.remote?.verifiedAt)
+        if (isV2(record) && hasVerifiedCopy(record))
             continue;
         try {
-            uploaded.push(await uploadArchive(dataDir, record.id, options));
+            const outcome = await uploadArchive(dataDir, record.id, options);
+            if (!outcome.verified)
+                throw new Error("storage did not verify this upload as durable");
+            uploaded.push(outcome);
         }
         catch (error) {
             failed.push({ archiveId: record.id, error: error instanceof Error ? error.message : "upload failed" });