v3.0.0 — fully local-only

Vaulted is fully local-only again. The opt-in multi-device account sync shipped in 2.1.0 is removed in its entirety: no accounts, no server, no op-log — secrets live only in the encrypted SQLite vault on your machine, and nothing Vaulted does ever touches the network.

Removed

• apps/sync-server and @vaulted/sync: the self-hostable sync server and the shared op-log protocol, along with their Docker/Compose files and CI job.
• CLI account commands: signup, login, logout, recover, account, remote, devices, and sync no longer exist. The --no-sync flags and the VAULTED_SERVER / VAULTED_NO_SYNC / VAULTED_SESSION_TOKEN env overrides are removed with them; local mutations no longer record sync operations or mint a device identity.
• TUI sync surface: the Sync/providers pane (p), the sync-status badge, and the devices/conflicts sections.
• Web dashboard: the unreleased zero-knowledge account dashboard is removed from the website; the docs and marketing site remain.
• Sync crypto: Ed25519 device signing, canonical-JSON hashing, and the HKDF auth-verifier derivation are removed from @vaulted/crypto. The local key hierarchy (Argon2id → AES-256-GCM → RSA-wrapped project keys) is unchanged.
• Password recovery: the recovery code existed only through the sync account. As before 2.1.0, a lost master password means an unreadable vault, by design.

Changed

• Store schema migration v5 drops the sync tables (account, device, sync_op, remote, sync_state). Existing vaults — including vaults that synced under 2.1.0 — migrate forward automatically: secrets, audit history, and every retained project_key version survive, so values encrypted under an older key version stay decryptable, and legacy sync.* audit rows remain readable.

Install

curl -fsSL https://raw.githubusercontent.com/woosal1337/vaulted/main/scripts/install.sh | sh

Full changelog: https://github.com/woosal1337/vaulted/blob/main/CHANGELOG.md