@lanes-sh/link 0.1.0

package/src/connectivity/index.ts

@@ -0,0 +1,94 @@
+/**
+ * Connectivity — what a provider declares, and the code behind each
+ * declaration.
+ *
+ * Two axes, deliberately independent, one folder per option on each:
+ *
+ *   transports/   how we reach a service   (the manifest's `connector.kind`)
+ *   auth/         how we prove who we are  (the manifest's `auth.kind`)
+ *
+ * A provider picks one from each column and adds nothing else. That is why
+ * iCloud can speak IMAP with an app password while Gmail speaks HTTP with
+ * OAuth, and why neither costs the other any code.
+ *
+ * This barrel is also the **provider authoring surface**: a provider must be
+ * writable without reading the rest of the codebase. If you need something not
+ * exported here, that is a bug in this file rather than a reason to reach into
+ * another component. See `docs/detailed/creating-a-provider.md`.
+ */
+
+export type { ScopedStore, Logger, ConnectionInfo, ProviderContext } from './context.ts';
+
+export type {
+  Capability,
+  CapabilityBase,
+  CapabilityResult,
+  ToolCapability,
+  ToolResult,
+  ResourceCapability,
+  ResourceContents,
+  ResourceResult,
+  ResourceListResult,
+  PromptCapability,
+  PromptMessage,
+  PromptResult,
+} from './capability.ts';
+export {
+  isTool,
+  isResource,
+  isPrompt,
+  isToolResult,
+  isResourceResult,
+  isResourceListResult,
+  isPromptResult,
+} from './capability.ts';
+
+/**
+ * Local providers — our own code, for `example` and the M3 owner layer.
+ * Everything else is a manifest.
+ */
+export type { AuthRequirement, ProviderDefinition } from './provider.ts';
+export { defineLocalProvider, defineProviderWithCapabilities } from './provider.ts';
+
+export type {
+  ProviderManifest,
+  ConnectorConfig,
+  AuthBroker,
+  AuthConfig,
+  SetupDeclaration,
+  SetupPrompt,
+  IdentityDeclaration,
+  ScopeBundle,
+  SetupRequirement,
+  SetupNeeds,
+} from './manifest/index.ts';
+export {
+  defineProvider,
+  providerManifestSchema,
+  setupSchema,
+  bundleSchema,
+  credentialRefForConnection,
+  rotatableCredentialRefs,
+  setupRequirements,
+  UNNAMED_ID,
+  RESERVED_PROVIDER_IDS,
+  READ_BUNDLE,
+  WRITE_BUNDLE,
+} from './manifest/index.ts';
+
+export type {
+  AnyConnector,
+  Connector,
+  ConnectorContext,
+  ConnectorKind,
+  DiscoveryContext,
+  DiscoveredCapability,
+  AuthStrategy,
+  AuthStrategyContext,
+} from './connector.ts';
+
+// Re-exported so a provider author imports from one place.
+export type { RedactionRule } from '#audit';
+export { keepKeys, redaction, redactAllValues } from '#audit';
+export type { SecretRef, ScopedSecrets } from '#secrets';
+export type { BlobStore, BlobKey, BlobMetadata } from '#stores/blobs';

package/src/connectivity/mail/attachments.ts

@@ -0,0 +1,368 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { z } from 'zod';
+import type { BlobStore } from '#stores/blobs';
+import type { ResolvedAttachment } from './message.ts';
+import { getStaged } from './staging.ts';
+import { fetchFromUrl, type AddressLookup } from './url.ts';
+
+/**
+ * Turning a named attachment into bytes.
+ *
+ * The whole point of this file is that **the bytes never pass through the model**.
+ * Before it existed, the only way to attach anything was for the caller to emit
+ * base64 in the tool call, which puts a 239 KB PDF at roughly 320,000 characters
+ * — past what a model can write in one message, and absurd even when it fits.
+ *
+ * So a caller names a file and the endpoint fetches it. Each reference carries
+ * exactly one source key:
+ *
+ *   path        a file on the machine running this endpoint
+ *   url         fetched over HTTPS, with the checks in `url.ts`
+ *   handle      bytes staged earlier through the upload route
+ *   message_id  an attachment already sitting in the mailbox being used
+ *   data        base64 inline — the escape hatch, not the path
+ *
+ * `path` is deliberately unrestricted: no allowlist, no confinement to a root.
+ * The endpoint already holds its owner's credentials, so the filesystem is
+ * treated the same way, and `docs/detailed/creating-a-provider.md`'s note that provider
+ * code is trusted code applies here too. What makes that defensible is the audit
+ * trail rather than a sandbox — every resolved attachment carries its origin and
+ * a SHA-256, and the manifest's `redact` block keeps both, so "was this file ever
+ * mailed out" stays an answerable question. Nothing here ever returns bytes to
+ * the caller; see `receiptFor`.
+ */
+
+/** The source keys, in the order they are reported when a caller supplies two. */
+const SOURCE_KEYS = ['path', 'url', 'handle', 'message_id', 'data'] as const;
+
+export const attachmentRefSchema = z
+  .strictObject({
+    path: z
+      .string()
+      .optional()
+      .describe('Path to a file on the machine running this endpoint. Read as-is.'),
+    url: z.string().optional().describe('HTTPS URL. The endpoint fetches it; you do not.'),
+    handle: z.string().optional().describe('Handle returned by a staged upload.'),
+    message_id: z
+      .string()
+      .optional()
+      .describe('Re-attach an attachment already on a message in this mailbox.'),
+    attachment_id: z
+      .string()
+      .optional()
+      .describe('Which attachment on that message. Required with message_id where the provider ids them.'),
+    data: z
+      .string()
+      .optional()
+      .describe(
+        'Base64 file content, for small files only. Prefer path, url, handle, or message_id — those keep the bytes out of the conversation entirely.',
+      ),
+    filename: z.string().optional().describe('Overrides the name derived from the source.'),
+    content_type: z.string().optional().describe('Overrides the type derived from the source.'),
+  })
+  .describe('One attachment, named by exactly one of path, url, handle, message_id, or data.');
+
+export type AttachmentRef = z.infer<typeof attachmentRefSchema>;
+
+/**
+ * The same shape as JSON Schema, for connectors whose capabilities are
+ * discovered rather than authored.
+ *
+ * Generated from the Zod schema rather than written twice: `imap` declares raw
+ * JSON Schema and a hand-written provider declares Zod, and two hand-maintained
+ * copies of one shape drift the moment a key is added to one of them.
+ */
+export const attachmentsJsonSchema = ((): Record<string, unknown> => {
+  // `$schema` is meaningful at the root of a document and noise on a property,
+  // which is the only place this is ever embedded.
+  const { $schema: _root, ...schema } = z.toJSONSchema(z.array(attachmentRefSchema), {
+    io: 'input',
+  }) as Record<string, unknown>;
+  return schema;
+})();
+
+/** Pulls bytes for `message_id` out of whatever mailbox the caller is already in. */
+export type MailboxAttachmentSource = (reference: {
+  readonly messageId: string;
+  readonly attachmentId: string | undefined;
+}) => Promise<{
+  readonly bytes: Uint8Array;
+  readonly filename: string | null;
+  readonly contentType: string | null;
+}>;
+
+export interface ResolveOptions {
+  /**
+   * Total raw bytes allowed across every attachment.
+   *
+   * Raw rather than encoded, and the caller derives it from whatever its vendor
+   * accepts: base64 inflates by 4/3, so a 20 MB message ceiling is about 14.5 MB
+   * of files. The composed message is checked exactly afterwards — this is the
+   * early, cheap refusal that avoids reading 40 MB to then reject it.
+   */
+  readonly maxTotalBytes: number;
+  readonly storage?: BlobStore | undefined;
+  readonly mailbox?: MailboxAttachmentSource | undefined;
+  readonly fetch?: typeof globalThis.fetch | undefined;
+  readonly addresses?: AddressLookup | undefined;
+  readonly signal?: AbortSignal | undefined;
+}
+
+/**
+ * Resolve every reference, or throw explaining which one failed and why.
+ *
+ * Takes `unknown` on purpose. One caller has already validated against this
+ * schema and the other has not — `imap` reads its arguments as raw casts, so
+ * this is the only gate on that path and has to behave like one.
+ */
+export async function resolveAttachments(
+  input: unknown,
+  options: ResolveOptions,
+): Promise<ResolvedAttachment[]> {
+  if (input === undefined || input === null) return [];
+
+  const parsed = z.array(attachmentRefSchema).safeParse(input);
+  if (!parsed.success) {
+    throw new Error(`attachments is not shaped right: ${parsed.error.issues[0]?.message}`);
+  }
+
+  const resolved: ResolvedAttachment[] = [];
+  let total = 0;
+
+  for (const [index, ref] of parsed.data.entries()) {
+    const where = `attachments[${index}]`;
+    const attachment = await resolveOne(ref, where, options);
+
+    total += attachment.bytes.byteLength;
+    if (total > options.maxTotalBytes) {
+      throw new Error(
+        `Attachments total more than ${options.maxTotalBytes} bytes, which is over what this account accepts for one message.`,
+      );
+    }
+
+    resolved.push(attachment);
+  }
+
+  return resolved;
+}
+
+async function resolveOne(
+  ref: AttachmentRef,
+  where: string,
+  options: ResolveOptions,
+): Promise<ResolvedAttachment> {
+  const present = SOURCE_KEYS.filter((key) => ref[key] !== undefined && ref[key] !== '');
+
+  if (present.length === 0) {
+    throw new Error(
+      `${where} names no file. Give exactly one of ${SOURCE_KEYS.join(', ')}, e.g. { "path": "/Users/you/invoice.pdf" }.`,
+    );
+  }
+  if (present.length > 1) {
+    throw new Error(
+      `${where} names ${present.length} sources (${present.join(', ')}). Give exactly one — they are alternatives, not layers.`,
+    );
+  }
+
+  const found = await bytesFor(present[0]!, ref, where, options);
+
+  const filename = ref.filename ?? found.filename ?? 'attachment';
+  return {
+    filename,
+    contentType: ref.content_type ?? found.contentType ?? guessContentType(filename),
+    bytes: found.bytes,
+    sha256: createHash('sha256').update(found.bytes).digest('hex'),
+    origin: found.origin,
+  };
+}
+
+interface FoundBytes {
+  readonly bytes: Uint8Array;
+  readonly filename: string | null;
+  readonly contentType: string | null;
+  readonly origin: string;
+}
+
+async function bytesFor(
+  source: (typeof SOURCE_KEYS)[number],
+  ref: AttachmentRef,
+  where: string,
+  options: ResolveOptions,
+): Promise<FoundBytes> {
+  switch (source) {
+    case 'path':
+      return await fromPath(ref.path!, where, options.maxTotalBytes);
+
+    case 'url': {
+      const fetched = await fetchFromUrl({
+        url: ref.url!,
+        maxBytes: options.maxTotalBytes,
+        ...(options.fetch ? { fetch: options.fetch } : {}),
+        ...(options.addresses ? { addresses: options.addresses } : {}),
+        signal: options.signal,
+      });
+      return {
+        bytes: fetched.bytes,
+        filename: fetched.filename ?? basename(new URL(ref.url!).pathname),
+        contentType: fetched.contentType,
+        origin: `url:${ref.url!}`,
+      };
+    }
+
+    case 'handle':
+      return await fromHandle(ref.handle!, where, options.storage);
+
+    case 'message_id': {
+      if (!options.mailbox) {
+        throw new Error(
+          `${where} uses message_id, which this provider cannot resolve. Fetch the attachment and stage it, or use path or url.`,
+        );
+      }
+      const found = await options.mailbox({
+        messageId: ref.message_id!,
+        attachmentId: ref.attachment_id,
+      });
+      return {
+        bytes: found.bytes,
+        filename: found.filename,
+        contentType: found.contentType,
+        origin: `mailbox:${ref.message_id!}`,
+      };
+    }
+
+    case 'data': {
+      const bytes = decodeBase64(ref.data!, where);
+      return { bytes, filename: null, contentType: null, origin: 'inline' };
+    }
+  }
+}
+
+async function fromPath(path: string, where: string, maxBytes: number): Promise<FoundBytes> {
+  let bytes: Uint8Array;
+  try {
+    bytes = new Uint8Array(await readFile(path));
+  } catch (failure) {
+    const code = (failure as { code?: string }).code;
+    if (code === 'ENOENT') throw new Error(`${where}: no file at ${path}.`);
+    if (code === 'EACCES') throw new Error(`${where}: ${path} is not readable by this endpoint.`);
+    if (code === 'EISDIR') throw new Error(`${where}: ${path} is a directory, not a file.`);
+    throw new Error(`${where}: could not read ${path} — ${(failure as Error).message}`);
+  }
+
+  if (bytes.byteLength > maxBytes) {
+    throw new Error(
+      `${where}: ${path} is ${bytes.byteLength} bytes, over the ${maxBytes} byte limit for one message.`,
+    );
+  }
+
+  return {
+    bytes,
+    filename: basename(path),
+    contentType: null,
+    origin: `path:${path}`,
+  };
+}
+
+async function fromHandle(
+  handle: string,
+  where: string,
+  storage: BlobStore | undefined,
+): Promise<FoundBytes> {
+  if (!storage) {
+    throw new Error(`${where} uses a handle, but this provider has no staging store.`);
+  }
+
+  const stored = await getStaged(storage, handle);
+  if (!stored) {
+    throw new Error(
+      `${where}: no staged attachment "${handle}". Handles expire, so stage the file again.`,
+    );
+  }
+
+  return {
+    bytes: stored.bytes,
+    filename: stored.filename,
+    contentType: stored.contentType,
+    origin: `handle:${handle}`,
+  };
+}
+
+function decodeBase64(value: string, where: string): Uint8Array {
+  // Both alphabets, because the two obvious places a caller gets base64 from
+  // disagree: a mail API hands back base64url (RFC 4648 §5) while every
+  // general-purpose encoder emits the standard one. Rejecting the former would
+  // be a correct-looking failure with a corrupt-file outcome.
+  const normalized = value.replaceAll('-', '+').replaceAll('_', '/').replaceAll(/\s+/g, '');
+
+  try {
+    const buffer = Buffer.from(normalized, 'base64');
+    // Buffer.from is lenient and silently drops invalid characters, so a typo
+    // becomes a shorter file rather than an error. Re-encoding and comparing
+    // lengths catches that.
+    const expected = Math.floor((normalized.replace(/=+$/, '').length * 3) / 4);
+    if (buffer.byteLength !== expected) throw new Error('not base64');
+    return new Uint8Array(buffer);
+  } catch {
+    throw new Error(`${where}: data is not valid base64.`);
+  }
+}
+
+function basename(path: string): string | null {
+  const name = path.split(/[/\\]/).pop();
+  return name ? decodeURIComponent(name) : null;
+}
+
+/**
+ * Type from the filename, since three of the five sources do not report one.
+ *
+ * A table rather than `Bun.file().type`, which would resolve this in one line:
+ * Bun-specific APIs are confined to two named files, and a mail composer is not
+ * one of them. Deliberately short — what an attachment actually is, not a mime
+ * database. Anything unlisted becomes `application/octet-stream`, which every
+ * mail client handles as "a file", so the failure mode is a generic icon rather
+ * than a broken attachment.
+ */
+const CONTENT_TYPES: Readonly<Record<string, string>> = {
+  pdf: 'application/pdf',
+  txt: 'text/plain',
+  md: 'text/markdown',
+  csv: 'text/csv',
+  html: 'text/html',
+  json: 'application/json',
+  xml: 'application/xml',
+  ics: 'text/calendar',
+  vcf: 'text/vcard',
+  png: 'image/png',
+  jpg: 'image/jpeg',
+  jpeg: 'image/jpeg',
+  gif: 'image/gif',
+  webp: 'image/webp',
+  svg: 'image/svg+xml',
+  heic: 'image/heic',
+  tiff: 'image/tiff',
+  zip: 'application/zip',
+  gz: 'application/gzip',
+  mp3: 'audio/mpeg',
+  m4a: 'audio/mp4',
+  wav: 'audio/wav',
+  mp4: 'video/mp4',
+  mov: 'video/quicktime',
+  doc: 'application/msword',
+  docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  xls: 'application/vnd.ms-excel',
+  xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  ppt: 'application/vnd.ms-powerpoint',
+  pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+  // `.pages`, `.numbers` and `.key` are absent on purpose. Their registered
+  // media types carry a vendor name, and `architecture.test.ts` refuses one
+  // anywhere a request passes through — correctly, even though an IANA type is
+  // not the vendor *knowledge* that rule is aimed at. They fall through to
+  // octet-stream, which mail clients show as a file and the recipient's system
+  // opens by extension anyway. Adding them back will fail the suite.
+};
+
+function guessContentType(filename: string): string {
+  const extension = filename.split('.').pop()?.toLowerCase();
+  return (extension ? CONTENT_TYPES[extension] : undefined) ?? 'application/octet-stream';
+}

package/src/connectivity/mail/compose.ts

@@ -0,0 +1,73 @@
+import nodemailer from 'nodemailer';
+import type { ComposedMessage, OutgoingMessage } from './message.ts';
+
+/**
+ * Turn a message into the bytes that will go out.
+ *
+ * Nodemailer rather than a hand-rolled builder, and the reasoning is the same one
+ * that admits `postal-mime` on the reading side: the protocol talk is short and
+ * stable, but *composition* is not. Quoted-printable, the 998-octet line limit,
+ * RFC 2047 encoded-words in a subject, `multipart/mixed` boundaries that must not
+ * occur in any part body (RFC 2046 §5.1.1), base64 wrapped at 76 columns (RFC
+ * 2045 §6.8), `Content-Disposition` filenames, `Message-ID` and `Date` — each
+ * fails quietly and partially, which is the worst way for mail to break. It is
+ * zero-dependency and MIT-0, so accepting it costs nothing but the name.
+ *
+ * `streamTransport` with `buffer` composes without sending. That was originally
+ * so the copy filed in Sent is byte-identical to what the recipient got rather
+ * than a re-render of the same intent; it is now also how an HTTP mail API gets
+ * a message to base64url, since those APIs take assembled MIME and will not
+ * assemble it for you.
+ */
+export async function composeMime(input: {
+  /**
+   * Omit to leave the `From` header off entirely.
+   *
+   * SMTP always has one — it is the authenticated account, and the envelope needs
+   * it. An HTTP mail API does not: it fills the header from the credential, and
+   * guessing a value to hand it risks writing an address the account is not
+   * allowed to send as.
+   */
+  readonly from?: string | undefined;
+  /**
+   * The human name to show beside the address — "Ada Lovelace <a@b>".
+   *
+   * Its absence is why a sent message can look machine-generated: a bare address
+   * is what a recipient sees when nothing supplies one. It is not a spam signal
+   * on its own (alignment and DKIM decide that), but it is the difference between
+   * mail from a person and mail from a process.
+   *
+   * Passed as a structured pair rather than a pre-joined string so nodemailer
+   * does the RFC 2047 encoding — a name with an accent or a comma in it needs it,
+   * and hand-joining is where that breaks.
+   */
+  readonly fromName?: string | undefined;
+  readonly message: OutgoingMessage;
+}): Promise<ComposedMessage> {
+  const { from, fromName, message } = input;
+
+  const composer = nodemailer.createTransport({ streamTransport: true, buffer: true });
+  const built = await composer.sendMail({
+    ...(from ? { from: fromName ? { name: fromName, address: from } : from } : {}),
+    to: [...message.to],
+    ...(message.cc?.length ? { cc: [...message.cc] } : {}),
+    ...(message.bcc?.length ? { bcc: [...message.bcc] } : {}),
+    subject: message.subject,
+    ...(message.text ? { text: message.text } : {}),
+    ...(message.html ? { html: message.html } : {}),
+    // Threading is two headers, and clients that only read one of them are
+    // common enough that setting just `In-Reply-To` orphans the reply.
+    ...(message.inReplyTo ? { inReplyTo: message.inReplyTo, references: [message.inReplyTo] } : {}),
+    ...(message.attachments?.length
+      ? {
+          attachments: message.attachments.map((attachment) => ({
+            filename: attachment.filename,
+            content: attachment.bytes,
+            contentType: attachment.contentType,
+          })),
+        }
+      : {}),
+  });
+
+  return { messageId: built.messageId, raw: new Uint8Array(built.message) };
+}

package/src/connectivity/mail/index.ts

@@ -0,0 +1,40 @@
+/**
+ * Mail composition, shared by every transport that sends it.
+ *
+ * A third folder beside `transports/` and `auth/`, and it earns the place by
+ * being needed from both sides of that split: SMTP composes and submits in one
+ * step, while an HTTP mail API wants assembled MIME handed to it as a field. The
+ * alternative was a second MIME builder, which is a second set of boundary and
+ * transfer-encoding bugs.
+ *
+ * Nothing here names a vendor.
+ */
+
+export type {
+  AttachmentReceipt,
+  ComposedMessage,
+  OutgoingMessage,
+  ResolvedAttachment,
+} from './message.ts';
+export { receiptFor } from './message.ts';
+
+export { composeMime } from './compose.ts';
+
+export type { AttachmentRef, MailboxAttachmentSource, ResolveOptions } from './attachments.ts';
+export { attachmentRefSchema, attachmentsJsonSchema, resolveAttachments } from './attachments.ts';
+
+export type { StagedFile, StagedMetadata } from './staging.ts';
+export {
+  getStaged,
+  isHandle,
+  newHandle,
+  putStaged,
+  stagedBytesKey,
+  stagedMetaKey,
+  sweepStaged,
+  STAGED_PREFIX,
+  STAGED_TTL_MS,
+} from './staging.ts';
+
+export type { AddressLookup, FetchedFile } from './url.ts';
+export { fetchFromUrl, isBlocked } from './url.ts';

package/src/connectivity/mail/message.ts

@@ -0,0 +1,82 @@
+/**
+ * What an outgoing message is, independent of how it gets sent.
+ *
+ * Its own folder because two transports now compose one: SMTP submits the bytes
+ * itself, and an HTTP mail API wants the same bytes base64url'd into a JSON
+ * field. Both need identical MIME, and a second composer would be a second set
+ * of quoted-printable and boundary bugs.
+ *
+ * No vendor name here, and none in the files beside it — this is protocol, and
+ * `architecture.test.ts` checks that claim.
+ */
+
+/**
+ * An attachment with its bytes in hand.
+ *
+ * The resolver produces these; a composer consumes them. By the time one exists
+ * the reference has already been read, fetched, or pulled from a mailbox, so
+ * nothing downstream needs to know which it was.
+ */
+export interface ResolvedAttachment {
+  readonly filename: string;
+  readonly contentType: string;
+  readonly bytes: Uint8Array;
+  /**
+   * Hex SHA-256 of `bytes`.
+   *
+   * Carried on the resolved attachment rather than recomputed by each caller
+   * because both consumers want it: the audit log records it, and the tool
+   * result hands it back as a receipt. Computing it twice from the same buffer
+   * would be waste, and computing it in only one place is how the two disagree.
+   */
+  readonly sha256: string;
+  /**
+   * Where the bytes came from, for the audit log — `path:/Users/…`,
+   * `url:https://…`, `mailbox:18f…`, `handle:att_…`, or `inline`.
+   *
+   * A description, never something to parse. It exists because with unrestricted
+   * paths this string is the only record of which file left the machine.
+   */
+  readonly origin: string;
+}
+
+export interface OutgoingMessage {
+  readonly to: readonly string[];
+  readonly cc?: readonly string[] | undefined;
+  readonly bcc?: readonly string[] | undefined;
+  readonly subject: string;
+  readonly text?: string | undefined;
+  readonly html?: string | undefined;
+  readonly inReplyTo?: string | undefined;
+  readonly attachments?: readonly ResolvedAttachment[] | undefined;
+}
+
+/** The exact bytes of a composed message, before anything transmits them. */
+export interface ComposedMessage {
+  readonly messageId: string;
+  readonly raw: Uint8Array;
+}
+
+/**
+ * What a send reports about one attachment.
+ *
+ * Deliberately not the bytes. Echoing content back would rebuild the
+ * context-window problem this whole path exists to avoid, and — because a
+ * `path` attachment may name any readable file — it would turn a send tool into
+ * a general file-read tool by way of the result.
+ */
+export interface AttachmentReceipt {
+  readonly filename: string;
+  readonly bytes: number;
+  readonly content_type: string;
+  readonly sha256: string;
+}
+
+export function receiptFor(attachment: ResolvedAttachment): AttachmentReceipt {
+  return {
+    filename: attachment.filename,
+    bytes: attachment.bytes.byteLength,
+    content_type: attachment.contentType,
+    sha256: attachment.sha256,
+  };
+}