@cleocode/core 2026.10.15 → 2026.10.16-rc.ci.685

package/dist/build-provenance.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "gitHead": "0a3b051780d43d8001135df74ec3c1aeef42a45a",
-  "builtAt": "2026-10-15T18:37:56.911Z",
+  "gitHead": "16ca2c7b0ed05b290081e684e01993290d1a13e1",
+  "builtAt": "2026-10-15T22:13:13.185Z",
   "linkedWorktree": null
 }

package/dist/cloud/crypto.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Bytes {@link seal} adds to a plaintext: version byte, salt, nonce and tag. Attachment records
+ * (cloud/journal.ts) are judged by `plaintext + SEAL_OVERHEAD`: a change of the AEAD envelope must
+ * also bump the attachment context (`attachment/v1`), so old and new clients never read each
+ * other's good records as the wrong size and clear them.
+ */
+export declare const SEAL_OVERHEAD: number;
 export declare class DecryptError extends Error {
     constructor(message?: string);
 }

package/dist/cloud/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/cloud/crypto.ts"],"names":[],"mappings":"AA+BA,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAAwE;CAI5F;AAED,eAAO,MAAM,SAAS,QAAO,MAAyB,CAAC;AAMvD,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,gGAAgG;AAChG,wBAAgB,IAAI,CAClB,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CAUR;AAED,wBAAgB,IAAI,CAClB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CAkBR;AAUD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,cAAc,IAAI,OAAO,CAOxC;AASD,kGAAkG;AAClG,wBAAgB,MAAM,CACpB,eAAe,EAAE,UAAU,EAC3B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,MAAM,GACd,MAAM,CAWR;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAwB1F;AAID,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,CAMpE;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,GACpB,OAAO,CAUT;AAID,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,WAAW;;;;CAAgE,CAAC;AAEzF,wBAAgB,YAAY,IAAI,SAAS,CAExC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAcjD;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB/E;AAMD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CASzD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAEvE;AAED,eAAO,MAAM,SAAS,GAAI,GAAG,UAAU,WAAiD,CAAC;AAEzF,eAAO,MAAM,UAAU,GAAI,KAAK,UAAU,EAAE,SAAS,UAAU,KAAG,MACd,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/cloud/crypto.ts"],"names":[],"mappings":"AA+BA;;;;;GAKG;AACH,eAAO,MAAM,aAAa,QAAyB,CAAC;AAEpD,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAAwE;CAI5F;AAED,eAAO,MAAM,SAAS,QAAO,MAAyB,CAAC;AAMvD,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,gGAAgG;AAChG,wBAAgB,IAAI,CAClB,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CAUR;AAED,wBAAgB,IAAI,CAClB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CAkBR;AAUD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,cAAc,IAAI,OAAO,CAOxC;AASD,kGAAkG;AAClG,wBAAgB,MAAM,CACpB,eAAe,EAAE,UAAU,EAC3B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,MAAM,GACd,MAAM,CAWR;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAwB1F;AAID,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,CAMpE;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,GACpB,OAAO,CAUT;AAID,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,WAAW;;;;CAAgE,CAAC;AAEzF,wBAAgB,YAAY,IAAI,SAAS,CAExC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAcjD;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB/E;AAMD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CASzD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAEvE;AAED,eAAO,MAAM,SAAS,GAAI,GAAG,UAAU,WAAiD,CAAC;AAEzF,eAAO,MAAM,UAAU,GAAI,KAAK,UAAU,EAAE,SAAS,UAAU,KAAG,MACd,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/cloud/crypto.js

@@ -10,6 +10,13 @@ const SEAL_VERSION = 0x02;
 const SALT = 32;
 const NONCE = 12;
 const TAG = 16;
+/**
+ * Bytes {@link seal} adds to a plaintext: version byte, salt, nonce and tag. Attachment records
+ * (cloud/journal.ts) are judged by `plaintext + SEAL_OVERHEAD`: a change of the AEAD envelope must
+ * also bump the attachment context (`attachment/v1`), so old and new clients never read each
+ * other's good records as the wrong size and clear them.
+ */
+export const SEAL_OVERHEAD = 1 + SALT + NONCE + TAG;
 export class DecryptError extends Error {
     constructor(message = 'decryption failed: wrong key, wrong context, or tampered ciphertext') {
         super(message);

package/dist/cloud/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/cloud/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,EAER,WAAW,EACX,IAAI,EACJ,eAAe,EACf,MAAM,GACP,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD;;;;GAIG;AAEH,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,IAAI,GAAG,EAAE,CAAC;AAChB,MAAM,KAAK,GAAG,EAAE,CAAC;AACjB,MAAM,GAAG,GAAG,EAAE,CAAC;AAEf,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAO,GAAG,qEAAqE;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAEvD,SAAS,MAAM,CAAC,GAAe,EAAE,IAAgB,EAAE,OAAe;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,OAAO,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,MAAkB,EAAE,OAAe;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,OAAO,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,IAAI,CAClB,GAAe,EACf,SAAqB,EACrB,OAAe,EACf,OAAe;IAEf,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE;QACpF,aAAa,EAAE,GAAG;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,IAAI,CAClB,GAAe,EACf,QAAoB,EACpB,OAAe,EACf,OAAe;IAEf,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY;QAC5D,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE;YACjF,aAAa,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,0CAA0C;AAE1C,MAAM,IAAI,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAErE,SAAS,YAAY,CAAC,GAAe;IACnC,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9F,CAAC;AAOD,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC;QACpF,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAW,EAAE,WAAW,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAe,EAAE,IAAgB;IACtD,OAAO,gBAAgB,CAAC;QACtB,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QAC/D,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,MAAM,CACpB,eAA2B,EAC3B,SAAqB,EACrB,OAAe;IAEf,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,YAAY,CAAC,eAAe,CAAC;KACzC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAC/F,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAkB,EAAE,MAAkB,EAAE,OAAe;IAChF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY;QACxC,MAAM,IAAI,YAAY,CAAC,8BAA8B,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC;YACpE,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CACnB,QAAQ,CACN,QAAQ,EACR,MAAM,EACN,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAC5C,oBAAoB,EACpB,EAAE,CACH,CACF,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY;YAAE,MAAM,GAAG,CAAC;QAC3C,MAAM,IAAI,YAAY,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC;QACpF,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC;KACvF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAW,EAAE,OAAmB;IAC1D,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE;QAClF,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,SAAqB,EACrB,OAAmB,EACnB,SAAqB;IAErB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;YACvD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAW,CAAC;AAEzF,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAY;IACzC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,CAA+B,EAAE,EAAE,CAC5D,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,IACE,CAAC,CAAC,SAAS,KAAK,UAAU;QAC1B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;QAC1C,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;QAC5C,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,EAAE;QAChB,IAAI,CAAC,MAAM,GAAG,EAAE,EAChB,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,CAAY;IAC5D,cAAc,CAAC,CAAC,CAAC,CAAC;IAClB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CACJ,UAAU,EACV;YACE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAC1D,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,MAAM,EAAE,CAAC,CAAC,UAAU;SACrB,EACD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAE1F,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD,MAAM,UAAU,iBAAiB,CAAC,GAAe;IAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,EAAE,CAAC;IACZ,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAa,EAAE,CAAa;IAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAe,EAAE,OAAmB,EAAU,EAAE,CACzE,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/cloud/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,EAER,WAAW,EACX,IAAI,EACJ,eAAe,EACf,MAAM,GACP,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD;;;;GAIG;AAEH,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,IAAI,GAAG,EAAE,CAAC;AAChB,MAAM,KAAK,GAAG,EAAE,CAAC;AACjB,MAAM,GAAG,GAAG,EAAE,CAAC;AAEf;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,GAAG,CAAC;AAEpD,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAO,GAAG,qEAAqE;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAEvD,SAAS,MAAM,CAAC,GAAe,EAAE,IAAgB,EAAE,OAAe;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,OAAO,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,MAAkB,EAAE,OAAe;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,OAAO,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,IAAI,CAClB,GAAe,EACf,SAAqB,EACrB,OAAe,EACf,OAAe;IAEf,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE;QACpF,aAAa,EAAE,GAAG;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,IAAI,CAClB,GAAe,EACf,QAAoB,EACpB,OAAe,EACf,OAAe;IAEf,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY;QAC5D,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE;YACjF,aAAa,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,0CAA0C;AAE1C,MAAM,IAAI,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAErE,SAAS,YAAY,CAAC,GAAe;IACnC,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9F,CAAC;AAOD,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC;QACpF,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAW,EAAE,WAAW,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAe,EAAE,IAAgB;IACtD,OAAO,gBAAgB,CAAC;QACtB,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QAC/D,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,MAAM,CACpB,eAA2B,EAC3B,SAAqB,EACrB,OAAe;IAEf,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,YAAY,CAAC,eAAe,CAAC;KACzC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAC/F,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAkB,EAAE,MAAkB,EAAE,OAAe;IAChF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY;QACxC,MAAM,IAAI,YAAY,CAAC,8BAA8B,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC;YACpE,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CACnB,QAAQ,CACN,QAAQ,EACR,MAAM,EACN,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAC5C,oBAAoB,EACpB,EAAE,CACH,CACF,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY;YAAE,MAAM,GAAG,CAAC;QAC3C,MAAM,IAAI,YAAY,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC;QACpF,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC;KACvF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAW,EAAE,OAAmB;IAC1D,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE;QAClF,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,SAAqB,EACrB,OAAmB,EACnB,SAAqB;IAErB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;YACvD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAW,CAAC;AAEzF,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAY;IACzC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,CAA+B,EAAE,EAAE,CAC5D,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,IACE,CAAC,CAAC,SAAS,KAAK,UAAU;QAC1B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;QAC1C,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;QAC5C,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,EAAE;QAChB,IAAI,CAAC,MAAM,GAAG,EAAE,EAChB,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,CAAY;IAC5D,cAAc,CAAC,CAAC,CAAC,CAAC;IAClB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CACJ,UAAU,EACV;YACE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAC1D,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,MAAM,EAAE,CAAC,CAAC,UAAU;SACrB,EACD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAE1F,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD,MAAM,UAAU,iBAAiB,CAAC,GAAe;IAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,EAAE,CAAC;IACZ,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAa,EAAE,CAAa;IAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAe,EAAE,OAAmB,EAAU,EAAE,CACzE,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/cloud/doc-bytes.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Doc bytes on the sync stream (T13721). `docs_attachments` rows sync
+ * (T12919), but their bodies live in `.cleo/blobs/blobs/<sha256>`, which no
+ * segment carries. After a push, each doc body this store has not put on the
+ * stream goes up as an encrypted content-addressed blob
+ * ({@link Journal.pushAttachment}); after a pull, each synced row whose body is
+ * missing here is downloaded, verified and written
+ * ({@link Journal.pullAttachment}).
+ *
+ * Healing a junk record (first writer wins on the server): a pull that refuses
+ * a body clears its record when it may (E34); a push checks a recorded blob
+ * before it trusts it, and re-checks a few bodies it already marked sent each
+ * run, so a record cleared after it was marked is recorded again.
+ *
+ * Both legs walk the doc rows in sha256 order from a cursor kept in
+ * `_sync_meta`, so rows that cannot move (no bytes anywhere yet, refused)
+ * never starve the ones behind them. A server without the stream-attachment
+ * routes answers 404: rows still sync, `docs fetch` reports no-content, and
+ * one warning says why. No failure here fails the sync: it becomes a warning.
+ *
+ * @task T13721
+ */
+import type { DatabaseSync } from 'node:sqlite';
+import type { CloudWarning } from '@cleocode/contracts';
+import { type Journal } from './journal.js';
+/** What one run moved. */
+export interface DocBytesReport {
+    /** Bodies uploaded (push) or downloaded and written (pull). */
+    readonly moved: number;
+    /** Bodies refused because they failed verification; nothing was written for them. */
+    readonly refused: number;
+}
+/** Options shared by {@link pushDocBytes} and {@link pullDocBytes}. */
+export interface DocBytesOptions {
+    /** The stream the bodies travel on. */
+    readonly stream: string;
+    /** The store's `.cleo` directory (its blob store is `blobs/blobs/`). */
+    readonly cleoDir: string;
+    /** Where warnings go. */
+    readonly warn: (w: CloudWarning) => void;
+    /** The largest doc ciphertext either leg moves (default 64 MiB; tests shrink it). */
+    readonly maxBytes?: number;
+}
+/**
+ * Put each doc body this store holds, and has not put on the stream, on it.
+ * A body some member already recorded is checked, not uploaded again; a junk
+ * record is cleared and replaced. Then a few bodies already marked sent are
+ * re-checked, and recorded again when their record is gone.
+ *
+ * @param db - The project store.
+ * @param journal - The stream's journal.
+ * @param o - {@link DocBytesOptions}.
+ * @returns What moved.
+ */
+export declare function pushDocBytes(db: DatabaseSync, journal: Pick<Journal, 'pushAttachment' | 'attachmentRecorded'>, o: DocBytesOptions): Promise<DocBytesReport>;
+/**
+ * Download, verify and write each synced doc body missing from this store.
+ * A body that fails verification is refused, nothing is written for it, and
+ * its record is cleared when this device may (so a holder records it again).
+ *
+ * @param db - The project store.
+ * @param journal - The stream's journal.
+ * @param o - {@link DocBytesOptions}.
+ * @returns What moved, and how many bodies were refused.
+ */
+export declare function pullDocBytes(db: DatabaseSync, journal: Pick<Journal, 'pullAttachment' | 'clearAttachment'>, o: DocBytesOptions): Promise<DocBytesReport>;
+//# sourceMappingURL=doc-bytes.d.ts.map

package/dist/cloud/doc-bytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doc-bytes.d.ts","sourceRoot":"","sources":["../../src/cloud/doc-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAkC,KAAK,OAAO,EAAsB,MAAM,cAAc,CAAC;AAUhG,0BAA0B;AAC1B,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,CAAC;IACzC,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AA+FD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,EAAE,EAAE,YAAY,EAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,oBAAoB,CAAC,EAC/D,CAAC,EAAE,eAAe,GACjB,OAAO,CAAC,cAAc,CAAC,CAiFzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,EAAE,EAAE,YAAY,EAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,CAAC,EAC5D,CAAC,EAAE,eAAe,GACjB,OAAO,CAAC,cAAc,CAAC,CAqCzB"}

package/dist/cloud/doc-bytes.js

@@ -0,0 +1,254 @@
+/**
+ * Doc bytes on the sync stream (T13721). `docs_attachments` rows sync
+ * (T12919), but their bodies live in `.cleo/blobs/blobs/<sha256>`, which no
+ * segment carries. After a push, each doc body this store has not put on the
+ * stream goes up as an encrypted content-addressed blob
+ * ({@link Journal.pushAttachment}); after a pull, each synced row whose body is
+ * missing here is downloaded, verified and written
+ * ({@link Journal.pullAttachment}).
+ *
+ * Healing a junk record (first writer wins on the server): a pull that refuses
+ * a body clears its record when it may (E34); a push checks a recorded blob
+ * before it trusts it, and re-checks a few bodies it already marked sent each
+ * run, so a record cleared after it was marked is recorded again.
+ *
+ * Both legs walk the doc rows in sha256 order from a cursor kept in
+ * `_sync_meta`, so rows that cannot move (no bytes anywhere yet, refused)
+ * never starve the ones behind them. A server without the stream-attachment
+ * routes answers 404: rows still sync, `docs fetch` reports no-content, and
+ * one warning says why. No failure here fails the sync: it becomes a warning.
+ *
+ * @task T13721
+ */
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { NexusError } from './http.js';
+import { AEAD_OVERHEAD, isClientRefusal, provesContentWrong } from './journal.js';
+/** Most network attempts per push or pull; the rest wait for the next run. */
+const DOC_BYTES_PER_RUN = 100;
+/** Of those, most bodies already marked sent that a push re-checks. */
+const RECHECKS_PER_RUN = 10;
+/** The largest doc ciphertext a pull downloads. */
+const MAX_DOC_BYTES = 64 * 1024 * 1024;
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+// `_sync_meta` keys: this machine's bookkeeping, never synced.
+const sentKey = (stream, sha256) => `doc_bytes_sent:${stream}:${sha256}`;
+const cursorKey = (leg, stream) => `doc_bytes_cursor:${leg}:${stream}`;
+function readMeta(db, key) {
+    const row = db.prepare('SELECT value FROM _sync_meta WHERE key = ?').get(key);
+    return row?.value ?? null;
+}
+function writeMeta(db, key, value) {
+    db.prepare('INSERT INTO _sync_meta (key, value, updated_at) VALUES (?, ?, ?) ' +
+        'ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at').run(key, value, new Date().toISOString());
+}
+/**
+ * Every doc row's sha256 in order, starting after the leg's cursor and
+ * wrapping around, so each run resumes where the last one stopped.
+ */
+function docShasFrom(db, cursor) {
+    const shas = db.prepare('SELECT DISTINCT sha256 FROM docs_attachments ORDER BY sha256').all()
+        .map((r) => r.sha256)
+        .filter((s) => SHA256_HEX.test(s));
+    const at = cursor ? shas.findIndex((s) => s > cursor) : 0;
+    return at <= 0 ? shas : [...shas.slice(at), ...shas.slice(0, at)];
+}
+/**
+ * Visit the doc rows from `key`'s cursor, at most `cap` of them doing work.
+ * The cursor moves past every row visited, whatever became of it, so rows
+ * that cannot move give up their place; a full pass starts over next run.
+ * `stop` (a network failure) keeps the cursor before the failing row.
+ */
+async function walk(db, key, cap, visit) {
+    const from = readMeta(db, key) || null;
+    let tried = 0;
+    let last = null;
+    let stopped = false;
+    for (const sha256 of docShasFrom(db, from)) {
+        if (tried >= cap) {
+            stopped = true;
+            break;
+        }
+        const r = await visit(sha256);
+        if (r === 'skip')
+            continue;
+        if (r === 'stop') {
+            stopped = true;
+            break;
+        }
+        tried++;
+        last = sha256;
+    }
+    writeMeta(db, key, stopped ? (last ?? from ?? '') : '');
+}
+/** A 404: the server has no stream-attachment route (an unknown ref answers `download: null`). */
+const routeMissing = (err) => err instanceof NexusError && err.status === 404;
+function unavailable(o, err) {
+    o.warn({
+        code: 'W_SYNC_DOC_BYTES_UNAVAILABLE',
+        message: routeMissing(err)
+            ? `${o.stream}: the server does not carry doc bytes yet; synced docs fetch as no-content until it does`
+            : `${o.stream}: doc bytes did not move this run (${err instanceof Error ? err.message : String(err)}); the next sync retries`,
+    });
+}
+/** Run one leg; any failure (disk, store, network) is a warning, never a failed sync. */
+async function guarded(o, leg) {
+    try {
+        return await leg();
+    }
+    catch (err) {
+        unavailable(o, err);
+        return { moved: 0, refused: 0 };
+    }
+}
+/**
+ * Put each doc body this store holds, and has not put on the stream, on it.
+ * A body some member already recorded is checked, not uploaded again; a junk
+ * record is cleared and replaced. Then a few bodies already marked sent are
+ * re-checked, and recorded again when their record is gone.
+ *
+ * @param db - The project store.
+ * @param journal - The stream's journal.
+ * @param o - {@link DocBytesOptions}.
+ * @returns What moved.
+ */
+export function pushDocBytes(db, journal, o) {
+    return guarded(o, async () => {
+        const { blobReadBySha } = await import('../store/blob-ops.js');
+        let moved = 0;
+        let failed = false;
+        const isSent = (sha256) => readMeta(db, sentKey(o.stream, sha256)) === '1';
+        // A body this store lacks (a row pulled before its bytes) is not ours to send.
+        const max = o.maxBytes ?? MAX_DOC_BYTES;
+        let tooLarge = 0;
+        // A body every puller would refuse as too large is never sent (pull has the same cap).
+        const bytesOf = async (sha256) => {
+            const bytes = await blobReadBySha(sha256, dirname(o.cleoDir)).catch(() => null);
+            if (bytes !== null && bytes.length + AEAD_OVERHEAD > max) {
+                tooLarge++;
+                return null;
+            }
+            return bytes;
+        };
+        const put = async (sha256, bytes) => {
+            let outcome;
+            try {
+                outcome = await journal.pushAttachment(sha256, Buffer.from(bytes));
+            }
+            catch (err) {
+                unavailable(o, err);
+                failed = true;
+                return 'stop';
+            }
+            if (outcome === 'contested') {
+                // Not marked: the next push checks the ref again, and heals it once it may.
+                o.warn({
+                    code: 'W_SYNC_DOC_BYTES_CONTESTED',
+                    message: `${o.stream}: doc ${sha256.slice(0, 12)}… is recorded with a blob that is not these bytes and that this device may not clear; a project owner can clear it, then the next sync re-records it`,
+                });
+                return 'done';
+            }
+            if (outcome === 'unverified') {
+                // A per-body delivery fault: warn, leave it unmarked, move on to the rest.
+                o.warn({
+                    code: 'W_SYNC_DOC_BYTES_UNVERIFIED',
+                    message: `${o.stream}: doc ${sha256.slice(0, 12)}…'s recorded blob could not be checked (a size or hash fault of its download); it is kept, and the next sync checks it again`,
+                });
+                return 'done';
+            }
+            if (outcome === 'sent')
+                moved++;
+            writeMeta(db, sentKey(o.stream, sha256), '1');
+            return 'done';
+        };
+        await walk(db, cursorKey('push', o.stream), DOC_BYTES_PER_RUN, async (sha256) => {
+            if (isSent(sha256))
+                return 'skip';
+            const bytes = await bytesOf(sha256);
+            return bytes === null ? 'skip' : put(sha256, bytes);
+        });
+        const warnTooLarge = () => {
+            if (tooLarge > 0) {
+                o.warn({
+                    code: 'W_SYNC_DOC_BYTES_TOO_LARGE',
+                    message: `${o.stream}: ${tooLarge} doc bod${tooLarge === 1 ? 'y is' : 'ies are'} over the ${max}-byte stream limit and stay on this device; a vault snapshot still carries them`,
+                });
+            }
+        };
+        if (failed) {
+            warnTooLarge();
+            return { moved, refused: 0 };
+        }
+        // A record cleared after this store marked it sent (a refused pull, an owner's clear).
+        await walk(db, cursorKey('recheck', o.stream), RECHECKS_PER_RUN, async (sha256) => {
+            if (!isSent(sha256))
+                return 'skip';
+            const bytes = await bytesOf(sha256);
+            if (bytes === null)
+                return 'skip';
+            try {
+                if (await journal.attachmentRecorded(sha256))
+                    return 'done';
+            }
+            catch (err) {
+                unavailable(o, err);
+                return 'stop';
+            }
+            writeMeta(db, sentKey(o.stream, sha256), '0');
+            return put(sha256, bytes);
+        });
+        warnTooLarge();
+        return { moved, refused: 0 };
+    });
+}
+/**
+ * Download, verify and write each synced doc body missing from this store.
+ * A body that fails verification is refused, nothing is written for it, and
+ * its record is cleared when this device may (so a holder records it again).
+ *
+ * @param db - The project store.
+ * @param journal - The stream's journal.
+ * @param o - {@link DocBytesOptions}.
+ * @returns What moved, and how many bodies were refused.
+ */
+export function pullDocBytes(db, journal, o) {
+    return guarded(o, async () => {
+        const { writeFileAtomic } = await import('../tools/fs.js');
+        const dir = join(o.cleoDir, 'blobs', 'blobs');
+        let moved = 0;
+        let refused = 0;
+        await walk(db, cursorKey('pull', o.stream), DOC_BYTES_PER_RUN, async (sha256) => {
+            const target = join(dir, sha256);
+            if (existsSync(target))
+                return 'skip';
+            let bytes;
+            try {
+                bytes = await journal.pullAttachment(sha256, o.maxBytes ?? MAX_DOC_BYTES);
+            }
+            catch (err) {
+                if (!isClientRefusal(err)) {
+                    unavailable(o, err);
+                    return 'stop';
+                }
+                // Skip it, keep the rest. Only provably wrong content (it matched its sha256 and still failed
+                // the AEAD or the plaintext hash) clears the record: a size or hash fault of the download, or
+                // this device's cap, proves nothing, and clearing on it would make every holder re-upload.
+                refused++;
+                const cleared = provesContentWrong(err) && (await journal.clearAttachment(sha256).catch(() => false));
+                o.warn({
+                    code: 'W_SYNC_DOC_BYTES_REFUSED',
+                    message: `${o.stream}: doc ${sha256.slice(0, 12)}… refused (${String(err.details?.reason)}): ${err.message}; nothing was written; ${cleared ? 'its record was cleared, so a device holding the bytes records them again on its next sync' : 'its record is kept'}`,
+                });
+                return 'done';
+            }
+            if (bytes === null)
+                return 'done'; // not on the stream yet
+            await writeFileAtomic({ path: target, content: bytes });
+            writeMeta(db, sentKey(o.stream, sha256), '1');
+            moved++;
+            return 'done';
+        });
+        return { moved, refused };
+    });
+}
+//# sourceMappingURL=doc-bytes.js.map

package/dist/cloud/doc-bytes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doc-bytes.js","sourceRoot":"","sources":["../../src/cloud/doc-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAgB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEhG,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,mDAAmD;AACnD,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAsBpC,+DAA+D;AAC/D,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,EAAE,CAAC,kBAAkB,MAAM,IAAI,MAAM,EAAE,CAAC;AACzF,MAAM,SAAS,GAAG,CAAC,GAAgC,EAAE,MAAc,EAAE,EAAE,CACrE,oBAAoB,GAAG,IAAI,MAAM,EAAE,CAAC;AAEtC,SAAS,QAAQ,CAAC,EAAgB,EAAE,GAAW;IAC7C,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,GAAG,CAE/D,CAAC;IACd,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,EAAgB,EAAE,GAAW,EAAE,KAAa;IAC7D,EAAE,CAAC,OAAO,CACR,mEAAmE;QACjE,yFAAyF,CAC5F,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,EAAgB,EAAE,MAAqB;IAC1D,MAAM,IAAI,GACR,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,EAG/E;SACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,IAAI,CACjB,EAAgB,EAChB,GAAW,EACX,GAAW,EACX,KAA4D;IAE5D,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM;QACR,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,MAAM;YAAE,SAAS;QAC3B,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM;QACR,CAAC;QACD,KAAK,EAAE,CAAC;QACR,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IACD,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,kGAAkG;AAClG,MAAM,YAAY,GAAG,CAAC,GAAY,EAAW,EAAE,CAAC,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;AAEhG,SAAS,WAAW,CAAC,CAAkB,EAAE,GAAY;IACnD,CAAC,CAAC,IAAI,CAAC;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC;YACxB,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,0FAA0F;YACvG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B;KAChI,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,OAAO,CACpB,CAAkB,EAClB,GAAkC;IAElC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,EAAgB,EAChB,OAA+D,EAC/D,CAAkB;IAElB,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;QAC3B,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC;QACnF,+EAA+E;QAC/E,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC;QACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,uFAAuF;QACvF,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAChF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,GAAG,GAAG,EAAE,CAAC;gBACzD,QAAQ,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,KAAK,EAAE,MAAc,EAAE,KAAiB,EAA4B,EAAE;YAChF,IAAI,OAAuD,CAAC;YAC5D,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpB,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,4EAA4E;gBAC5E,CAAC,CAAC,IAAI,CAAC;oBACL,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,sJAAsJ;iBACvM,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,2EAA2E;gBAC3E,CAAC,CAAC,IAAI,CAAC;oBACL,IAAI,EAAE,6BAA6B;oBACnC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8HAA8H;iBAC/K,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,OAAO,KAAK,MAAM;gBAAE,KAAK,EAAE,CAAC;YAChC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9E,IAAI,MAAM,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,CAAC,CAAC,IAAI,CAAC;oBACL,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,QAAQ,WAAW,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,aAAa,GAAG,iFAAiF;iBACjL,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/B,CAAC;QACD,uFAAuF;QACvF,MAAM,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAChF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC;oBAAE,OAAO,MAAM,CAAC;YAC9D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,EAAgB,EAChB,OAA4D,EAC5D,CAAkB;IAElB,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;QAC3B,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjC,IAAI,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YACtC,IAAI,KAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBACpB,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,8FAA8F;gBAC9F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,OAAO,EAAE,CAAC;gBACV,MAAM,OAAO,GACX,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxF,CAAC,CAAC,IAAI,CAAC;oBACL,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,0BAA0B,OAAO,CAAC,CAAC,CAAC,2FAA2F,CAAC,CAAC,CAAC,oBAAoB,EAAE;iBACnQ,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC,CAAC,wBAAwB;YAC3D,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9C,KAAK,EAAE,CAAC;YACR,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cloud/journal.d.ts

@@ -1,6 +1,6 @@
 import { AppendSegmentResult, type Checkpoint, type Manifest, type ReplicaHeads, type RevocationPins, type Segment } from '@cleocode/contracts/cloud';
 import { type KeyPair } from './crypto.js';
-import { type FetchLike, type Http } from './http.js';
+import { type FetchLike, type Http, NexusError } from './http.js';
 import { type TrustedSigners } from './keys.js';
 import { type SegmentMetaFields } from './signing.js';
 export type Uploader = (url: string, headers: Record<string, string>, bytes: Buffer) => Promise<void>;
@@ -11,6 +11,25 @@ export type Downloader = (url: string, maxBytes: number) => Promise<Buffer>;
  * caller (and the tests) can tell the checks apart. None of them is retryable as is.
  */
 export type RefusalReason = 'unknown-signer' | 'bad-signature' | 'hash-mismatch' | 'blob-hash' | 'blob-size' | 'decrypt' | 'payload' | 'seq-order' | 'replica-device' | 'replica-replay' | 'replica-gap' | 'page' | 'checkpoint-stream' | 'checkpoint-rollback' | 'checkpoint-replicas' | 'revoked-signer' | 'too-large';
+/**
+ * Whether `err` is this client refusing what the server sent (status 0, a {@link RefusalReason}), as
+ * opposed to a server or network error.
+ *
+ * @param err - Anything thrown.
+ * @returns True for a client refusal.
+ */
+export declare const isClientRefusal: (err: unknown) => err is NexusError;
+/** An attachment's ciphertext size is its plaintext size plus this ({@link SEAL_OVERHEAD}). */
+export declare const AEAD_OVERHEAD: number;
+/**
+ * Whether a refusal proves the recorded content wrong, not just its delivery: the ciphertext matched
+ * its announced sha256 and still failed the AEAD or the plaintext sha256. A size or hash mismatch of the
+ * download (a flaky proxy, a lying server) or a client cap proves nothing about the record.
+ *
+ * @param err - Anything thrown.
+ * @returns True for `decrypt` and `hash-mismatch` refusals.
+ */
+export declare const provesContentWrong: (err: unknown) => boolean;
 /** The default downloader: https only, no redirects, and it stops reading past `maxBytes`. */
 export declare function cappedDownloader(fetchImpl: FetchLike): Downloader;
 export type SegmentMeta = SegmentMetaFields;
@@ -175,5 +194,48 @@ export declare class Journal {
      * announced size is read, and the bytes must match that size and the segment's sha256.
      */
     downloadSegmentBlob(s: Pick<Segment, 'seq' | 'blobSha256'>): Promise<Buffer>;
+    /** The stream path of an attachment's ref: an HMAC of its plaintext sha256, so the server learns nothing. */
+    private attachmentPath;
+    /**
+     * Put a content-addressed attachment (a doc body) on the stream (T13721): encrypted under the stream
+     * key, bound to the stream and its plaintext sha256, uploaded as an `attachment` blob and recorded
+     * under its ref (E32). A ref already recorded is checked like a pull would check it: a good one is not
+     * uploaded again; a junk one (a squat, a buggy client) is cleared (E34) and replaced with these bytes.
+     *
+     * @param sha256 - The plaintext sha256 the synced row names.
+     * @param plaintext - The bytes; they must hash to `sha256`.
+     * @returns `sent` when this call recorded it, `present` when the stream already had a good copy,
+     *   `contested` when the ref holds another blob this caller may not clear, or a racer recorded first,
+     *   and `unverified` when the recorded blob could not be checked (a size or hash fault of its
+     *   download): nothing is cleared, and the next push checks it again.
+     */
+    pushAttachment(sha256: string, plaintext: Buffer): Promise<'sent' | 'present' | 'contested' | 'unverified'>;
+    /**
+     * Read a content-addressed attachment from the stream (T13721), uploaded by any member (E33). The
+     * ciphertext must match the announced size and sha256, decrypt under the stream key in this stream
+     * and sha256's context, and hash to `sha256`; anything else is refused before a byte is returned.
+     *
+     * @param sha256 - The plaintext sha256 the synced row names.
+     * @param maxBytes - The largest ciphertext to download.
+     * @returns The verified plaintext, or null when no member has put it on the stream yet.
+     */
+    pullAttachment(sha256: string, maxBytes: number): Promise<Buffer | null>;
+    /**
+     * Whether some member has recorded a blob for an attachment (E33), without downloading it.
+     *
+     * @param sha256 - The plaintext sha256 the synced row names.
+     * @returns True when a record exists.
+     */
+    attachmentRecorded(sha256: string): Promise<boolean>;
+    /**
+     * Clear an attachment's record (E34), so a holder of the real bytes can record them again. Allowed
+     * for the member who recorded it and for a project owner; the server refuses anyone else.
+     *
+     * @param sha256 - The plaintext sha256 the synced row names.
+     * @returns True when this call removed a record.
+     */
+    clearAttachment(sha256: string): Promise<boolean>;
+    /** Download and verify the blob behind an attachment ref; any mismatch is a client refusal. */
+    private readAttachment;
 }
 //# sourceMappingURL=journal.d.ts.map

package/dist/cloud/journal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../src/cloud/journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,EAEnB,KAAK,UAAU,EAOf,KAAK,QAAQ,EAGb,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,OAAO,EAOb,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,IAAI,EAGV,MAAM,WAAW,CAAC;AACnB,OAAO,EAAwC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAEtF,OAAO,EAML,KAAK,iBAAiB,EAIvB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,QAAQ,GAAG,CACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,IAAI,CAAC,CAAC;AACnB,yFAAyF;AACzF,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE5E;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,WAAW,GACX,WAAW,GACX,SAAS,GACT,SAAS,GACT,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,MAAM,GACN,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,gBAAgB,GAChB,WAAW,CAAC;AAmBhB,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAsCjE;AAED,MAAM,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE5C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+GAA+G;IAC/G,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE;AAED,eAAO,MAAM,iBAAiB,QAAO,UAInC,CAAC;AAEH,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,UAAU,CAM/F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,EAAE,GAChG,cAAc,CAchB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iFAAiF;IACjF,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAMD,yGAAyG;AACzG,eAAO,MAAM,eAAe,GAAI,GAAG,iBAAiB,WAA6C,CAAC;AAClG,6EAA6E;AAC7E,eAAO,MAAM,YAAY,GAAI,GAAG,QAAQ,WAA0C,CAAC;AAEnF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,YAAY,WAA0C,CAAC;AAuCvF;;;;GAIG;AACH,qBAAa,OAAO;IAMN,OAAO,CAAC,QAAQ,CAAC,CAAC;IAL9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAEhB,CAAC,EAAE,cAAc;IAQ9C;;;;OAIG;IACG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,UAAU,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC;IAiC/B;;;OAGG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM;IASjF;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,SAAM;;;;;YAwD5D,aAAa;IAkE3B,OAAO,CAAC,OAAO;IAUf;;;;;;;OAOG;IACG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,EAAE,QAAQ,CAAC;QACnB,MAAM,EAAE,UAAU,CAAC;QACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC;;;;WAIG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,UAAU,CAAC;IAqDvB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IA4CtE;;;OAGG;IACG,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;IAe5F;;;;;OAKG;IACG,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,cAAc,EAC9B,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;YA0C5D,UAAU;IAyBxB;;;;OAIG;IACG,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,GAAG,YAAY,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAqCnF"}
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../src/cloud/journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,EAEnB,KAAK,UAAU,EASf,KAAK,QAAQ,EAIb,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAIL,KAAK,OAAO,EAQb,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,IAAI,EAET,UAAU,EACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAAwC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAEtF,OAAO,EAML,KAAK,iBAAiB,EAIvB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,QAAQ,GAAG,CACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,IAAI,CAAC,CAAC;AACnB,yFAAyF;AACzF,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE5E;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,WAAW,GACX,WAAW,GACX,SAAS,GACT,SAAS,GACT,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,MAAM,GACN,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,gBAAgB,GAChB,WAAW,CAAC;AAKhB;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,OAAO,KAAG,GAAG,IAAI,UACoC,CAAC;AAE3F,+FAA+F;AAC/F,eAAO,MAAM,aAAa,QAAgB,CAAC;AAE3C;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAI,KAAK,OAAO,KAAG,OAE8B,CAAC;AAgBjF,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAsCjE;AAED,MAAM,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE5C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+GAA+G;IAC/G,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE;AAED,eAAO,MAAM,iBAAiB,QAAO,UAInC,CAAC;AAEH,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,UAAU,CAM/F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,EAAE,GAChG,cAAc,CAchB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iFAAiF;IACjF,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAMD,yGAAyG;AACzG,eAAO,MAAM,eAAe,GAAI,GAAG,iBAAiB,WAA6C,CAAC;AAClG,6EAA6E;AAC7E,eAAO,MAAM,YAAY,GAAI,GAAG,QAAQ,WAA0C,CAAC;AAEnF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,YAAY,WAA0C,CAAC;AAyCvF;;;;GAIG;AACH,qBAAa,OAAO;IAMN,OAAO,CAAC,QAAQ,CAAC,CAAC;IAL9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAEhB,CAAC,EAAE,cAAc;IAQ9C;;;;OAIG;IACG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,UAAU,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC;IAiC/B;;;OAGG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM;IASjF;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,SAAM;;;;;YAwD5D,aAAa;IAkE3B,OAAO,CAAC,OAAO;IAUf;;;;;;;OAOG;IACG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,EAAE,QAAQ,CAAC;QACnB,MAAM,EAAE,UAAU,CAAC;QACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC;;;;WAIG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,UAAU,CAAC;IAqDvB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IA4CtE;;;OAGG;IACG,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;IAe5F;;;;;OAKG;IACG,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,cAAc,EAC9B,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;YA0C5D,UAAU;IAyBxB;;;;OAIG;IACG,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,GAAG,YAAY,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAsClF,6GAA6G;IAC7G,OAAO,CAAC,cAAc;IAKtB;;;;;;;;;;;;OAYG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;IAuC3D;;;;;;;;OAQG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS9E;;;;;OAKG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS1D;;;;;;OAMG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASvD,+FAA+F;YACjF,cAAc;CAkB7B"}