sealkeep 0.9.0 → 0.11.1

package/dist/src/team-source-facts-cache.d.ts

@@ -0,0 +1,23 @@
+import type { ContentIndex } from "./search.js";
+import type { TeamIndexCacheIdentity } from "./team-index-cache.js";
+/** Derived facts, never authority: callers still fetch the current native head and grants. */
+export type TeamSourceFactsCacheIdentity = TeamIndexCacheIdentity & {
+    project: string;
+    projectKey?: string;
+};
+export declare const TEAM_SOURCE_FACTS_MAX_BYTES: number;
+export declare const TEAM_SOURCE_FACTS_CACHE_BYTES: number;
+export declare const TEAM_SOURCE_FACTS_MAX_ENTRIES = 32;
+export declare function readTeamSourceFactsCache(dataDir: string, identity: TeamSourceFactsCacheIdentity, privateRaw: Buffer, options?: {
+    maxDecodedBytes?: number;
+    signal?: AbortSignal;
+    onDecoded?: (bytes: number) => void;
+}): Promise<{
+    index: ContentIndex;
+    decodedBytes: number;
+} | null>;
+/** Call only after the checkpoint's AEAD, original hash and coverage verifier succeeds,
+ * and before filtering grants. Grant permissions are neither cached nor inferred. */
+export declare function writeTeamSourceFactsCache(dataDir: string, identity: TeamSourceFactsCacheIdentity, privateRaw: Buffer, verifiedIndex: ContentIndex, options?: {
+    signal?: AbortSignal;
+}): Promise<void>;

package/dist/src/team-source-facts-cache.js

@@ -0,0 +1,255 @@
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { mkdir, open, readdir, rename, stat, unlink } from "node:fs/promises";
+import { join } from "node:path";
+export const TEAM_SOURCE_FACTS_MAX_BYTES = 2 * 1024 * 1024;
+export const TEAM_SOURCE_FACTS_CACHE_BYTES = 64 * 1024 * 1024;
+export const TEAM_SOURCE_FACTS_MAX_ENTRIES = 32;
+const MAX_ARCHIVES = 10_000;
+const HEADER_BYTES = 32; // magic, random 96-bit nonce, 128-bit GCM tag
+const MAGIC = Buffer.from("SKF1");
+const NAME = /^[a-f0-9]{64}\.facts$/;
+const PARTIAL = /^\.(\d+)\.[a-f0-9-]{36}\.partial$/;
+const activePartials = new Set();
+const directory = (dataDir) => join(dataDir, "index", "team-source-facts-cache");
+const hash = (value) => createHash("sha256").update(value).digest();
+const text = (value, max = 8192) => typeof value === "string" && value.length <= max;
+const sha = (value) => typeof value === "string" && /^[a-f0-9]{64}$/i.test(value);
+const integer = (value, min = 0) => Number.isSafeInteger(value) && Number(value) >= min;
+function scope(identity) {
+    const r = identity.receipt;
+    const strings = [identity.origin, identity.vaultId, identity.spaceKey, identity.project, identity.projectKey ?? "",
+        r.generationId, r.committedAt, r.meta.objectKey, r.blob.objectKey];
+    if (strings.some((value) => !text(value)) || !integer(identity.accountId, 1) || !integer(r.revision, 1)
+        || !integer(r.membershipVersion, 1) || !integer(r.meta.bytes, 1) || !integer(r.blob.bytes, 1)
+        || !sha(r.meta.sha256) || !sha(r.blob.sha256))
+        return null;
+    const coverage = Object.entries(r.coverageJson);
+    if (coverage.length > MAX_ARCHIVES || coverage.some(([id, digest]) => !text(id, 512) || !sha(digest)))
+        return null;
+    let coverageBytes = 0;
+    for (const entry of coverage) {
+        coverageBytes += Buffer.byteLength(JSON.stringify(entry)) + 1;
+        if (coverageBytes > TEAM_SOURCE_FACTS_MAX_BYTES)
+            return null;
+    }
+    coverage.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return hash(JSON.stringify(["sealkeep-team-source-facts-v1", ...strings, identity.accountId,
+        r.revision, r.membershipVersion, r.meta.bytes, r.meta.sha256, r.blob.bytes, r.blob.sha256, coverage]));
+}
+function copyFacts(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const f = value;
+    if (f.v !== 1 || !text(f.createdAt, 128) || !text(f.algorithm, 128) || !integer(f.sourceBytes)
+        || !integer(f.storedBytes, 1) || !integer(f.chunks, 1) || !sha(f.sourceSha256) || !sha(f.ciphertextSha256)
+        || (f.envelopeArchiveId !== undefined && !text(f.envelopeArchiveId, 512))
+        || (f.envelopeSha256 !== undefined && !sha(f.envelopeSha256))
+        || (f.teamCustody !== undefined && f.teamCustody !== true))
+        return null;
+    if (f.delta && (!text(f.delta.baseArchiveId, 512) || !integer(f.delta.baseBytes, 1) || f.delta.baseBytes >= f.sourceBytes))
+        return null;
+    if (f.supersedes && (!text(f.supersedes.archiveId, 512) || !integer(f.supersedes.bytes)))
+        return null;
+    return { v: 1, createdAt: f.createdAt, algorithm: f.algorithm, sourceBytes: f.sourceBytes,
+        storedBytes: f.storedBytes, chunks: f.chunks, sourceSha256: f.sourceSha256, ciphertextSha256: f.ciphertextSha256,
+        ...(f.envelopeArchiveId !== undefined ? { envelopeArchiveId: f.envelopeArchiveId } : {}),
+        ...(f.envelopeSha256 !== undefined ? { envelopeSha256: f.envelopeSha256 } : {}),
+        ...(f.teamCustody ? { teamCustody: true } : {}),
+        ...(f.delta ? { delta: { baseArchiveId: f.delta.baseArchiveId, baseBytes: f.delta.baseBytes } } : {}),
+        ...(f.supersedes ? { supersedes: { archiveId: f.supersedes.archiveId, bytes: f.supersedes.bytes } } : {}) };
+}
+/** Whitelist facts only, preserving every archive/dependency, never query tokens or summaries. */
+function factsIndex(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const raw = value;
+    if (!text(raw.builtAt, 128) || !raw.archives || !raw.meta)
+        return null;
+    const rows = Object.entries(raw.archives);
+    if (rows.length > MAX_ARCHIVES)
+        return null;
+    const index = { version: 2, builtAt: raw.builtAt, archives: Object.create(null), tokens: {}, meta: Object.create(null) };
+    let serializedBytes = 128;
+    for (const [id, row] of rows) {
+        const facts = copyFacts(raw.meta[id]?.archiveRecord);
+        if (!text(id, 512) || !Array.isArray(row) || row.length > 8 || !row.every((item) => text(item)) || !facts)
+            return null;
+        const line = [...row];
+        serializedBytes += Buffer.byteLength(JSON.stringify([id, line, facts])) + Buffer.byteLength(JSON.stringify(id)) + 40;
+        if (serializedBytes > TEAM_SOURCE_FACTS_MAX_BYTES)
+            return null;
+        index.archives[id] = line;
+        index.meta[id] = { archiveRecord: facts };
+    }
+    for (const [id, metadata] of Object.entries(index.meta)) {
+        const delta = metadata.archiveRecord.delta;
+        if (delta && (!index.archives[delta.baseArchiveId]
+            || index.meta[delta.baseArchiveId]?.archiveRecord?.sourceBytes !== delta.baseBytes
+            || delta.baseArchiveId === id))
+            return null;
+    }
+    return index;
+}
+async function cleanup(dataDir, keep) {
+    const dir = directory(dataDir);
+    const names = await readdir(dir).catch(() => []);
+    for (const name of names) {
+        const match = PARTIAL.exec(name);
+        if (!match)
+            continue;
+        const path = join(dir, name), pid = Number(match[1]);
+        if (!integer(pid, 1) || activePartials.has(path))
+            continue;
+        let alive = pid !== process.pid;
+        if (alive) {
+            try {
+                process.kill(pid, 0);
+            }
+            catch (error) {
+                alive = error.code !== "ESRCH";
+            }
+        }
+        if (!alive)
+            await unlink(path).catch(() => undefined);
+    }
+    const rows = await Promise.all(names.filter((name) => NAME.test(name)).map(async (name) => {
+        const info = await stat(join(dir, name)).catch(() => null);
+        return info?.isFile() ? { name, bytes: info.size, at: info.mtimeMs } : null;
+    }));
+    const ordered = rows.filter((row) => row !== null)
+        .sort((a, b) => Number(b.name === keep) - Number(a.name === keep) || b.at - a.at || a.name.localeCompare(b.name));
+    let bytes = 0, count = 0;
+    for (const row of ordered) {
+        bytes += row.bytes;
+        count += 1;
+        if (row.bytes > TEAM_SOURCE_FACTS_MAX_BYTES + HEADER_BYTES || bytes > TEAM_SOURCE_FACTS_CACHE_BYTES
+            || count > TEAM_SOURCE_FACTS_MAX_ENTRIES)
+            await unlink(join(dir, row.name)).catch(() => undefined);
+    }
+}
+export async function readTeamSourceFactsCache(dataDir, identity, privateRaw, options = {}) {
+    options.signal?.throwIfAborted();
+    const aad = scope(identity);
+    const limit = options.maxDecodedBytes ?? TEAM_SOURCE_FACTS_MAX_BYTES;
+    if (!aad || privateRaw.length !== 32 || !integer(limit))
+        return null;
+    let key, plaintext;
+    let callbackFailure;
+    try {
+        await cleanup(dataDir);
+        const handle = await open(join(directory(dataDir), `${aad.toString("hex")}.facts`), constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        let bytes;
+        try {
+            const before = await handle.stat();
+            if (!before.isFile() || before.size <= HEADER_BYTES || before.size > HEADER_BYTES + Math.min(limit, TEAM_SOURCE_FACTS_MAX_BYTES))
+                return null;
+            bytes = Buffer.alloc(before.size);
+            let at = 0;
+            while (at < bytes.length) {
+                options.signal?.throwIfAborted();
+                const read = await handle.read(bytes, at, bytes.length - at, at);
+                if (!read.bytesRead)
+                    return null;
+                at += read.bytesRead;
+            }
+            const after = await handle.stat();
+            if (after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs)
+                return null;
+        }
+        finally {
+            await handle.close();
+        }
+        if (!bytes.subarray(0, 4).equals(MAGIC))
+            return null;
+        key = Buffer.from(hkdfSync("sha256", privateRaw, aad, "sealkeep-source-facts-cache-v1", 32));
+        const decipher = createDecipheriv("aes-256-gcm", key, bytes.subarray(4, 16));
+        decipher.setAAD(aad);
+        decipher.setAuthTag(bytes.subarray(16, HEADER_BYTES));
+        plaintext = decipher.update(bytes.subarray(HEADER_BYTES));
+        // Even rejected ciphertext consumed bounded decoded memory. Account for
+        // that attempt before a caller decides whether a full-verifier fallback fits.
+        try {
+            options.onDecoded?.(plaintext.length);
+        }
+        catch (error) {
+            callbackFailure = { error };
+            throw error;
+        }
+        const final = decipher.final(); // GCM authentication before JSON parsing or publication.
+        if (final.length) {
+            final.fill(0);
+            return null;
+        }
+        options.signal?.throwIfAborted();
+        const index = factsIndex(JSON.parse(plaintext.toString("utf8")));
+        if (!index)
+            return null;
+        return { index, decodedBytes: plaintext.length };
+    }
+    catch (error) {
+        if (callbackFailure)
+            throw callbackFailure.error;
+        if (options.signal?.aborted)
+            throw error;
+        return null;
+    }
+    finally {
+        key?.fill(0);
+        plaintext?.fill(0);
+    }
+}
+/** Call only after the checkpoint's AEAD, original hash and coverage verifier succeeds,
+ * and before filtering grants. Grant permissions are neither cached nor inferred. */
+export async function writeTeamSourceFactsCache(dataDir, identity, privateRaw, verifiedIndex, options = {}) {
+    options.signal?.throwIfAborted();
+    const aad = scope(identity), index = factsIndex(verifiedIndex);
+    if (!aad || privateRaw.length !== 32 || !index)
+        return;
+    const plaintext = Buffer.from(JSON.stringify(index));
+    if (plaintext.length > TEAM_SOURCE_FACTS_MAX_BYTES) {
+        plaintext.fill(0);
+        return;
+    }
+    const dir = directory(dataDir), name = `${aad.toString("hex")}.facts`;
+    const temporary = join(dir, `.${process.pid}.${randomUUID()}.partial`);
+    let key;
+    try {
+        key = Buffer.from(hkdfSync("sha256", privateRaw, aad, "sealkeep-source-facts-cache-v1", 32));
+        const nonce = randomBytes(12), cipher = createCipheriv("aes-256-gcm", key, nonce);
+        cipher.setAAD(aad);
+        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        await cleanup(dataDir);
+        activePartials.add(temporary);
+        const handle = await open(temporary, "wx", 0o600);
+        try {
+            await handle.writeFile(Buffer.concat([MAGIC, nonce, cipher.getAuthTag(), ciphertext]));
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        options.signal?.throwIfAborted();
+        await rename(temporary, join(dir, name));
+        const parent = await open(dir, "r").catch(() => null);
+        try {
+            await parent?.sync().catch(() => undefined);
+        }
+        finally {
+            await parent?.close();
+        }
+        await cleanup(dataDir, name);
+    }
+    catch (error) {
+        if (options.signal?.aborted)
+            throw error;
+        // Derived cache failure never prevents an otherwise verified source read.
+    }
+    finally {
+        key?.fill(0);
+        plaintext.fill(0);
+        activePartials.delete(temporary);
+        await unlink(temporary).catch(() => undefined);
+    }
+}

package/dist/src/trash.d.ts

@@ -1,6 +1,6 @@
 export type TrashResult = {
     movedTo: string;
-    strategy: "macos-trash" | "xdg-trash" | "windows-recycle-bin" | "vaultline-trash";
+    strategy: "macos-trash" | "xdg-trash" | "windows-recycle-bin" | "sealkeep-trash";
 };
 /**
  * Moves a reclaimed source to the operating system's trash, so a mistake is

package/dist/src/trash.js

@@ -50,7 +50,7 @@ export async function moveToTrash(path, options) {
     await mkdir(root, { recursive: true, mode: 0o700 });
     const target = await uniquePath(root, name);
     await rename(path, target);
-    return { movedTo: target, strategy: "vaultline-trash" };
+    return { movedTo: target, strategy: "sealkeep-trash" };
 }
 export function defaultStrategy() {
     if (platform() === "darwin")
@@ -59,5 +59,5 @@ export function defaultStrategy() {
         return "xdg-trash";
     if (platform() === "win32")
         return "windows-recycle-bin";
-    return "vaultline-trash";
+    return "sealkeep-trash";
 }

package/dist/src/tui.js

@@ -1,13 +1,13 @@
-import { PRODUCT_MARK, PRODUCT_NAME } from "./branding.js";
+import { PRODUCT_MARK, PRODUCT_NAME, providerLabel } from "./branding.js";
 import { emitKeypressEvents } from "node:readline";
-import { createLocalApiServer, localApiToken } from "./local-api.js";
-import { freePort } from "./net.js";
+import { localApiToken } from "./local-api.js";
+import { startUi } from "./ui-server.js";
 /**
  * A keyboard-first terminal view over the local API.
  *
  * It renders with plain ANSI and reads only from `/v1`, so it shows exactly what
- * the dashboard shows and works unchanged over SSH. If no agent is listening it
- * starts a private one on a loopback port for the lifetime of the session.
+ * the dashboard shows and works unchanged over SSH. If no address was supplied
+ * it borrows the vault's singleton loopback API, or owns it for this session.
  */
 const ESC = "[";
 const RESET = `${ESC}0m`;
@@ -67,7 +67,7 @@ export function renderFrame(view, state, width = 100) {
         const retention = state.retention ?? {};
         lines.push(`Archives   ${BOLD}${status.archiveCount ?? 0}${RESET}  (${formatBytes(status.archivedBytes ?? 0)} of source preserved)`);
         lines.push(`Queue      ${status.queue?.ready ?? 0} ready · ${status.queue?.leased ?? 0} in flight · ${status.queue?.done ?? 0} archived · ${status.queue?.failed ?? 0} failed`);
-        lines.push(`Remote     ${status.remoteStorage ? `${status.remoteStorage.provider}://${status.remoteStorage.bucket}/${status.remoteStorage.prefix}` : `${DIM}none configured${RESET}`}`);
+        lines.push(`Remote     ${status.remoteStorage ? `${providerLabel(status.remoteStorage.provider)} · ${status.remoteStorage.bucket}/${status.remoteStorage.prefix}` : `${DIM}none configured${RESET}`}`);
         lines.push(`Retention  policy ${retention.policy ?? "?"} · ${formatBytes(retention.reclaimableBytes ?? 0)} reclaimable`);
         lines.push("");
         for (const agent of state.agents ?? []) {
@@ -96,7 +96,7 @@ export function renderFrame(view, state, width = 100) {
     if (view === "retention") {
         const retention = state.retention ?? {};
         lines.push(`Policy ${BOLD}${retention.policy ?? "?"}${RESET} · older than ${retention.olderThanDays ?? "?"} days · ${retention.graceDays ?? "?"}-day grace`);
-        lines.push(`${DIM}Reclaimed sources move to the OS trash. Preview never touches the disk.${RESET}`);
+        lines.push(`${DIM}Confirmed reclaim permanently frees only verified, searchable, unchanged, idle originals. Preview never touches the disk.${RESET}`);
         lines.push("");
         for (const candidate of (retention.candidates ?? []).slice(0, 15)) {
             lines.push(`${candidate.eligible ? `${GREEN}eligible${RESET}` : `${DIM}held    ${RESET}`} ${truncate(candidate.path, 40)} ${DIM}${candidate.blockers?.[0] ?? ""}${RESET}`);
@@ -130,10 +130,8 @@ export async function runTui(dataDir, options = {}) {
     let base = options.base;
     const token = options.token ?? await localApiToken(dataDir);
     if (!base) {
-        owned = createLocalApiServer(dataDir, token);
-        const port = await freePort(4190);
-        await new Promise((ready) => owned.listen(port, "127.0.0.1", ready));
-        base = `http://127.0.0.1:${port}`;
+        owned = await startUi(dataDir, { port: 4190, openBrowser: false, owner: "interactive" });
+        base = owned.origin;
     }
     const client = apiClient(base, token);
     let view = "overview";
@@ -175,5 +173,6 @@ export async function runTui(dataDir, options = {}) {
         };
         input.on("keypress", onKey);
     });
-    await new Promise((closed) => (owned ? owned.close(() => closed()) : closed()));
+    if (owned)
+        await owned.close();
 }

package/dist/src/types.d.ts

@@ -1,4 +1,25 @@
-import type { Envelope, Suite } from "../packages/vaultline-crypto/src/index.js";
+import type { Envelope, Suite } from "../packages/sealkeep-crypto/src/index.js";
+/**
+ * Immutable, non-secret identity of an object-store destination.
+ *
+ * A routing target id is deliberately mutable, while bucket names are not
+ * globally unique for R2, B2, MinIO, or other S3-compatible accounts.  Copies
+ * and locally-held credentials therefore bind to this canonical description,
+ * not to the routing label alone.  `endpoint` is a canonical origin.  `prefix`
+ * is included for credentials because changing it changes the namespace that
+ * credential was explicitly tested against; an individual copy's objectKey
+ * still names the exact object within it.
+ */
+export type StorageDestinationIdentity = {
+    version: 1;
+    provider: "s3" | "r2" | "b2" | "gcs" | "gdrive";
+    bucket: string;
+    prefix: string;
+    region: string | null;
+    endpoint: string | null;
+    /** Provider account identity when routing metadata exposes one separately. */
+    account: string | null;
+};
 /** The original prototype envelope. Still readable; never written by this build. */
 export type ArchiveRecordV1 = {
     version: 1;
@@ -26,8 +47,20 @@ export type ArchiveRecordV1 = {
     };
     objectPath: string;
 };
+export type TeamCustody = {
+    version: 1;
+    spaceKey: string;
+    envelopeArchiveId: string;
+};
+/** Custody is a narrowly scoped exception to locator/envelope identity equality. */
+export declare function teamCustodyRecordIsValid(value: unknown): boolean;
 /** A remote copy the client uploaded and then verified. Written only after verification. */
 export type RemoteObject = {
+    /**
+     * Stable identity for this physical copy. Older records do not carry it;
+     * archive-copies derives the same id from provider, bucket and object key.
+     */
+    copyId?: string;
     provider: string;
     bucket: string;
     /** Single-object layout: the object's key. Chunk layout: the FOLDER prefix (no trailing slash). */
@@ -38,7 +71,7 @@ export type RemoteObject = {
     verifiedAt: string;
     /**
      * Present when the remote is a FOLDER of chunk objects (`chunk-000000`…)
-     * plus an `envelope.vlmeta` sidecar, instead of one blob. Every chunk is
+     * plus an `envelope.skmeta` sidecar, instead of one blob. Every chunk is
      * independently sealed and independently fetchable; the sidecar makes the
      * folder self-recovering with nothing but the recovery phrase. Absent means
      * the original single-object layout, which stays readable forever.
@@ -49,8 +82,15 @@ export type RemoteObject = {
     };
     /** Which configured storage target this copy went to, for usage accounting. */
     targetId?: string;
+    /**
+     * Immutable physical destination recorded when this copy verified.  Older
+     * records omit both fields and are handled by an explicit legacy policy;
+     * they must never be silently rebound to an arbitrary custom endpoint.
+     */
+    destination?: StorageDestinationIdentity;
+    destinationFingerprint?: string;
 };
-/** The current record: a `vaultline-crypto` v2 envelope plus local bookkeeping. */
+/** The current record: a `sealkeep-crypto` v2 envelope plus local bookkeeping. */
 export type ArchiveRecordV2 = {
     version: 2;
     id: string;
@@ -60,6 +100,12 @@ export type ArchiveRecordV2 = {
         agent: string;
         bytes: number;
         sha256: string;
+        /** The project this session belonged to, recorded at seal time — the only place that knows it for certain. */
+        project?: string;
+        /** Collision-safe local identity used to select a team binding. `project` is display-only. */
+        projectKey?: string;
+        /** Stable shared-project scope. Local folder/project names may differ on every machine; this opaque id does not. */
+        projectScope?: string;
     };
     /** Summary of the stored object, shared with v1 so callers can treat both alike. */
     cipher: {
@@ -69,13 +115,42 @@ export type ArchiveRecordV2 = {
         chunks: number;
     };
     envelope: Envelope;
+    /** Explicit owner custody alias: the storage locator differs from the sealed
+     * AEAD identity. This is authorized only for the named shared project. */
+    teamCustody?: TeamCustody;
     objectPath: string;
+    /**
+     * Additional verified remote copies. `remote` remains the primary copy so
+     * older Sealkeep builds keep reading v2 records; this array never needs to
+     * repeat the primary and is normalised by archive-copies on mutation.
+     */
+    copies?: RemoteObject[];
     remote?: RemoteObject;
-    /** Set once the local source has been moved to the trash. The archive itself stays. */
+    /**
+     * Set once the verified/searchable local source has been reclaimed. Current
+     * builds permanently purge the transaction-staged original only after the
+     * record and audit decision are durable. Older records may still name a
+     * recoverable Trash path.
+     */
     reclaimed?: {
         at: string;
-        trashPath: string;
+        /** Legacy recoverable-trash location. Absent for permanent disk reclaim. */
+        trashPath?: string;
+        /** Internal crash-recovery staging path; normally absent by the time callers read the record. */
+        stagingPath?: string;
         strategy: string;
+        transactionId?: string;
+        originalBytes?: number;
+        /** Allocated filesystem blocks released, net of a tiny native resume pointer. */
+        freedBytes?: number;
+        purgedAt?: string;
+        /** Exact tiny rollout left behind so Codex can still resolve `resume <sessionId>`. */
+        resumeStub?: {
+            version: 1;
+            sessionId: string;
+            bytes: number;
+            sha256: string;
+        };
     };
     /**
      * Set once the local *archive* has been removed because a verified remote
@@ -92,6 +167,12 @@ export type ArchiveRecordV2 = {
         provider: string;
         bucket: string;
         objectKey: string;
+        /** Present only while a crash-recoverable local-cache removal is in flight. */
+        transactionId?: string;
+        /** Logical ciphertext length displaced from this machine. */
+        localBytes?: number;
+        /** Filesystem allocation actually released (st_blocks * 512 where available). */
+        freedBytes?: number;
     };
     /**
      * The archive whose bytes this one re-archived, and how many of them.
@@ -127,15 +208,34 @@ export type ArchiveRecord = ArchiveRecordV1 | ArchiveRecordV2;
 export type StorageTargetConfig = {
     id: string;
     provider: "vaultline" | "s3" | "r2" | "b2" | "gcs" | "gdrive";
+    /** False keeps the destination available for restore/move but excludes it from all new writes. */
+    enabled?: boolean;
     bucket?: string;
     prefix?: string;
     region?: string;
+    /** Non-secret provider endpoint shared with every machine (required by R2/custom S3). */
+    endpoint?: string;
     maxGb?: number;
     projects?: string[];
     priority?: number;
     /** Stamped by machines when they push: bytes this target holds, per their records. */
     usedBytes?: number;
     usedAt?: string;
+    /**
+     * Non-secret local credential evidence reported by each enrolled machine.
+     * Provider credentials never leave that machine. This does not claim the
+     * provider answered now; `verifiedAt` names the last explicit full probe.
+     */
+    connectionHealth?: Record<string, {
+        /** Backward-compatible availability bit: local credentials/session exist. */
+        connected: boolean;
+        /** What was actually observed; this is never presented as a live provider ping. */
+        status?: "credentials_verified" | "credentials_saved" | "credentials_missing" | "account_session";
+        checkedAt: string;
+        /** Time of the last successful provider write/read/delete/absence probe. */
+        verifiedAt?: string | null;
+        label?: string;
+    }>;
 };
 export declare function isV2(record: ArchiveRecord): record is ArchiveRecordV2;
 export type VaultConfig = {
@@ -162,6 +262,20 @@ export type VaultConfig = {
     };
     /** Multiple simultaneous storage targets with routing rules; wins over remoteStorage when present. */
     storageTargets?: StorageTargetConfig[];
+    /**
+     * Provenance for the local routing copy. Account-derived rows are usable only
+     * while this machine is still in the exact Cloud auth generation which read
+     * or edited them; otherwise an account switch could route the next archive
+     * through the previous account's Drive or bucket credentials while offline.
+     * `local` is reserved for an explicit machine-only configuration. Absence is
+     * a legacy, unknown origin and is treated conservatively while signed in.
+     */
+    storageTargetsScope?: {
+        kind: "local";
+    } | {
+        kind: "account";
+        accountScope: string | null;
+    };
     recovery: {
         phraseCheck: string;
     };
@@ -175,6 +289,8 @@ export type VaultConfig = {
         group?: string;
         /** Sharing scope: set, this key is a member of one project and is wrapped into that project's archives only. */
         project?: string;
+        /** Stable project identity for new scoped recipients. Legacy label-only recipients remain readable. */
+        projectKey?: string;
     }[];
     /** `deleteAfterDays` is optional so vaults written before archive lifecycle existed still load; absent means never. */
     retention?: {
@@ -185,8 +301,58 @@ export type VaultConfig = {
     };
     /** Ed25519 public keys, by key id, that may sign a release this client will accept. */
     updateKeys?: Record<string, string>;
-    /** How many seals may run at once (1–4). Absent means one at a time. */
-    sealConcurrency?: number;
+    /**
+     * Per-project sharing tempo. "active": the moment a session of this project
+     * seals, the content index syncs and a `finished` presence line is published
+     * — teammates' agents can find the work in minutes. Absent or "passive":
+     * archive-at-rest behaviour, nothing extra moves.
+     */
+    projectSharing?: Record<string, "active" | "passive">;
+    /**
+     * Visible local bindings between a checkout/project and an opaque hosted
+     * collaboration space. The space key is an identifier, not an encryption
+     * key; the actual feed key lives only in the OS keystore. A binding is made
+     * once from the dashboard and every supported agent hook uses it thereafter.
+     */
+    teamSpaces?: Record<string, {
+        /** Stable logical space id used by REST, encryption AAD, and local inboxes. */
+        spaceKey: string;
+        role?: "owner" | "member";
+        keyVersion?: number;
+        /** Rotatable opaque Socket.IO route. Absent on pre-rotation/v1 bindings. */
+        realtimeKey?: string;
+        /** True only after this machine's user chose the local project mapping. */
+        localConfirmed?: true;
+        /** Human-facing label for bindings stored under an opaque project key. */
+        localProject?: string;
+    }>;
+    /**
+     * Hosted spaces this particular machine deliberately disconnected from.
+     * Membership remains owned by SealKeep Cloud, but automatic reconciliation
+     * must not silently reconnect a checkout the user removed here.
+     */
+    teamSpaceOptOuts?: string[];
+    /**
+     * A local, privacy-preserving handoff from folder discovery to the account
+     * panel. The browser records only the logical project name in the cloud;
+     * these machine-specific folder/project names never leave this vault.
+     *
+     * When the matching cloud project appears, the daemon binds every listed
+     * local project to its one stable space id and removes the draft. Keeping
+     * this in config (rather than browser storage) makes the handoff survive a
+     * closed tab, service restart, or package upgrade.
+     */
+    teamProjectDrafts?: Array<{
+        projectName: string;
+        /** Legacy display labels, retained so older clients can still render the draft. */
+        projects: string[];
+        /** Exact selections used by new clients; labels never decide access when these are present. */
+        projectSelections?: Array<{
+            projectKey: string;
+            project: string;
+        }>;
+        createdAt: string;
+    }>;
     /**
      * How chunk-folder remotes are named. "readable" (default): project/date/
      * session as words — browsable in your own bucket's console. "hashed":

package/dist/src/types.js

@@ -1,3 +1,23 @@
+/** Custody is a narrowly scoped exception to locator/envelope identity equality. */
+export function teamCustodyRecordIsValid(value) {
+    const object = (entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry) ? entry : null;
+    const uuid = (entry) => typeof entry === "string"
+        && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(entry);
+    const record = object(value);
+    const custody = object(record?.teamCustody);
+    const cipher = object(record?.cipher);
+    const envelope = object(record?.envelope);
+    const source = object(record?.source);
+    return record?.version === 2 && uuid(record.id)
+        && custody?.version === 1 && uuid(custody.envelopeArchiveId)
+        && typeof custody.spaceKey === "string" && /^[A-Za-z0-9_-]{43}$/.test(custody.spaceKey)
+        && source?.projectScope === custody.spaceKey
+        && (cipher?.algorithm === "aes-256-gcm" || cipher?.algorithm === "chacha20-poly1305")
+        && envelope?.version === 2 && envelope.archiveId === custody.envelopeArchiveId
+        && envelope.suite === cipher.algorithm
+        && Array.isArray(envelope.wrappedKeys) && envelope.wrappedKeys.length === 1
+        && object(envelope.wrappedKeys[0])?.type === "phrase";
+}
 export function isV2(record) {
     return record.version === 2;
 }