@needmoretruth/nmts-cli 0.17.2

package/dist/share.js

@@ -0,0 +1,195 @@
+// Sharing one file with one other account: what gets sealed, in what order, and why that order.
+//
+// ⛔ NOTHING HERE TRUSTS THE SERVER WITH A KEY. A share hands a recipient the file's own key,
+//    wrapped so that only they can open it. The server stores an opaque envelope and three sealed
+//    fields; it can open none of them, and it cannot tell whether a share it stored is one that
+//    was actually made.
+//
+// ⛔ THE ORDER IS LOAD-BEARING. The name and the digest are sealed FIRST, and the exact bytes that
+//    result are hashed into the key that wraps the file key. So a name sealed afterwards, or one
+//    byte different from what is actually sent, produces an envelope the recipient cannot open.
+//    That is what stops a server rewriting the name a file arrived under: it would have to produce
+//    a wrapping key it does not have.
+//
+// ⛔ OPENING IT IS THE AUTHENTICATION. There is no separate signature to check. The sender's own
+//    secret is inside the key agreement, so an envelope that opens at all could only have been
+//    made by the account it names. The claimed sender is therefore printed only AFTER the open
+//    succeeds — before that it is a claim, and printing a claim as a fact is how somebody trusts
+//    a file that was not sent by who it says.
+import { AAD, DERIVED } from "./crypto.js";
+import { NmtsError } from "./errors.js";
+import { decodeSharedFileInfo, encodeSharedFileInfo, } from "./shared/lib/share/shared-file-info.js";
+const encoder = new TextEncoder();
+/** Exact sizes the server checks. Named here so a wrong one is caught before a round trip. */
+const ENVELOPE_LEN = 1240;
+const DIGEST_ENVELOPE_LEN = 104;
+const IDENTITY_LEN = 4989;
+/** Derive everything sharing needs from an account code. */
+export function shareKeysOf(crypt, code) {
+    const derived = crypt.kdf_derive(crypt.account_code_parse(code));
+    const slice = (range) => derived.slice(range[0], range[1]);
+    const kemSeed = slice(DERIVED.shareKemSeed);
+    const authSecret = slice(DERIVED.shareAuthSecret);
+    const sigSeed = slice(DERIVED.shareSigSeed);
+    const address = slice(DERIVED.shareAddress);
+    derived.fill(0);
+    const identity = crypt.share_public_key(kemSeed, authSecret, sigSeed);
+    if (identity.length !== IDENTITY_LEN) {
+        throw new NmtsError(`This account's sharing identity came out ${identity.length} bytes.`, {
+            nextStep: "Nothing was sent. The crypto engine and this tool disagree about the format.",
+        });
+    }
+    return {
+        kemSeed,
+        authSecret,
+        sigSeed,
+        address,
+        identity,
+        display: crypt.share_address_display(address),
+        wipe() {
+            kemSeed.fill(0);
+            authSecret.fill(0);
+            sigSeed.fill(0);
+        },
+    };
+}
+/**
+ * Seal one file for one recipient.
+ *
+ * `recipientIdentity` is checked against `recipientAddress` inside the engine before anything is
+ * encrypted to it — length, fingerprint, self-signature and key decoding — which is why both are
+ * arguments and why there is no form of this that takes the identity alone. A tool that fetched an
+ * identity and wrapped to it without naming the address it asked for would hand a readable key to
+ * whoever answered.
+ */
+export function sealShare(crypt, input) {
+    if (input.digest.length !== 32) {
+        throw new NmtsError("This file has no recorded content hash, so it cannot be shared.", {
+            nextStep: "A share carries a hash the recipient checks the bytes against. Without one there is " +
+                "nothing to check, and a share that proves nothing is not one this tool will make.",
+        });
+    }
+    // ⛔ SEALED FIRST, AND THESE EXACT BYTES ARE WHAT GETS SENT. See the module note.
+    const nameCt = crypt.envelope_seal(input.dek, encoder.encode(AAD.shareName), encoder.encode(encodeSharedFileInfo({ name: input.name, size: input.size })));
+    const digestCt = crypt.envelope_seal(input.dek, encoder.encode(AAD.shareContentHash), input.digest);
+    if (digestCt.length !== DIGEST_ENVELOPE_LEN) {
+        throw new NmtsError(`A sealed content hash came out ${digestCt.length} bytes.`);
+    }
+    const envelope = crypt.share_wrap_dek(input.keys.authSecret, input.keys.sigSeed, input.recipientIdentity, input.recipientAddress, input.dek, input.itemId, nameCt, digestCt);
+    if (envelope.length !== ENVELOPE_LEN) {
+        throw new NmtsError(`A share envelope came out ${envelope.length} bytes.`);
+    }
+    return {
+        dek_share_ct: Buffer.from(envelope).toString("base64url"),
+        name_share_ct: Buffer.from(nameCt).toString("base64url"),
+        content_hash_share_ct: Buffer.from(digestCt).toString("base64url"),
+    };
+}
+/**
+ * Open one received share.
+ *
+ * ⛔ A ROW THAT WILL NOT OPEN IS STILL RETURNED. Dropping it would tell the account it was sent
+ *    less than it was, and the honest answer to "this one will not open" is to say so on its own
+ *    line — not to leave a gap somebody has no way to notice.
+ */
+export function openReceived(crypt, keys, row) {
+    const base = {
+        id: row.id,
+        itemId: row.item_id,
+        createdAt: row.created_at,
+        digestCt: row.content_hash_share_ct,
+    };
+    const unopened = (problem) => ({
+        ...base,
+        name: null,
+        size: null,
+        sender: null,
+        dek: null,
+        problem,
+    });
+    if (row.sender_public_key === undefined || row.sender_public_key === "") {
+        // The sender's identity is what the open is checked against. Without it there is nothing to
+        // authenticate against, and an unauthenticated open is not one worth doing.
+        return unopened("the sender's published identity is not available");
+    }
+    const envelope = new Uint8Array(Buffer.from(row.dek_share_ct, "base64url"));
+    const nameCt = new Uint8Array(Buffer.from(row.name_share_ct, "base64url"));
+    const digestCt = new Uint8Array(Buffer.from(row.content_hash_share_ct, "base64url"));
+    const senderPublic = new Uint8Array(Buffer.from(row.sender_public_key, "base64url"));
+    let dek;
+    try {
+        dek = crypt.share_unwrap_dek(keys.kemSeed, keys.authSecret, keys.sigSeed, senderPublic, envelope, row.item_id, nameCt, digestCt);
+    }
+    catch {
+        return unopened("it did not open with this account's keys");
+    }
+    // ⛔ ONLY NOW. Before the unwrap succeeded this was a claim printed next to a file name, which is
+    //    exactly how somebody comes to trust a file that was not sent by who it says.
+    let sender;
+    try {
+        sender = crypt.share_address_display(crypt.share_claimed_sender(envelope));
+    }
+    catch {
+        dek.fill(0);
+        return unopened("the sender it names is not a readable address");
+    }
+    let info;
+    try {
+        info = decodeSharedFileInfo(new TextDecoder().decode(crypt.envelope_open(dek, encoder.encode(AAD.shareName), nameCt)));
+    }
+    catch {
+        dek.fill(0);
+        return unopened("the file's name did not open");
+    }
+    return {
+        ...base,
+        name: info.name,
+        size: info.size ?? null,
+        sender,
+        dek,
+        problem: null,
+    };
+}
+/** The digest a recipient checks the downloaded bytes against. */
+export function openSharedDigest(crypt, dek, digestCt) {
+    try {
+        return crypt.envelope_open(dek, encoder.encode(AAD.shareContentHash), new Uint8Array(Buffer.from(digestCt, "base64url")));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Turn what a person typed into the 16 bytes behind a public code.
+ *
+ * ⛔ A TYPO FAILS HERE, NOT AS A LOOKUP. Sending a mistyped address to the server would ask it a
+ *    question about somebody who might exist, and the answer is not ours to collect.
+ */
+export function addressFromTyped(crypt, typed) {
+    try {
+        return crypt.share_address_parse(typed.trim());
+    }
+    catch {
+        throw new NmtsError(`"${typed.trim()}" is not a public code.`, {
+            exitCode: 2,
+            nextStep: "Nothing was sent. An address has a check symbol built in, so this was caught here " +
+                "rather than by asking the server about it.",
+        });
+    }
+}
+/**
+ * Check that an identity the server handed back is the one that was asked for.
+ *
+ * The engine checks this again inside the wrap, and this exists so the refusal says WHICH thing
+ * was wrong rather than failing inside a sealing step.
+ */
+export function identityMatches(crypt, identity, address) {
+    if (identity.length !== IDENTITY_LEN)
+        return false;
+    try {
+        return Buffer.from(crypt.share_address_of(identity)).equals(Buffer.from(address));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/shared/lib/crypto/size-padding.js

@@ -0,0 +1,126 @@
+// Rounding a file's stored size up, so the exact length of what somebody stored is not published.
+//
+// A sealed stream states the length it was sealed from, in the clear, at a fixed place in its
+// header. That header is authenticated but not encrypted — it has to be readable to be decrypted
+// against — so on a public storage network the exact byte length of every stored file is legible to
+// anyone who fetches it. Padding is what takes that away: seal from a rounded-up length, and the
+// number on the wire is the rounded one.
+//
+// ⛔ ONLY THE FINAL PART OF A FILE MAY BE PADDED. A reader recovers each part's real length from
+//    the file's own size and the lengths the stored streams declare, and that answer is unique only
+//    because every earlier part is exactly full. Padding one of them would not be caught here — it
+//    would be caught years later, by a download that wrote padding into the middle of a file.
+//
+// ⛔ TWO PROGRAMS MUST ROUND THE SAME WAY. This is copied verbatim into other programs; a file
+//    uploaded by one and one uploaded by the other must not be tellable apart by the shape of their
+//    lengths, or the padding has replaced one fingerprint with another.
+//
+// It depends on nothing, and the two numbers it needs about the sealing format are arguments rather
+// than imports, so that the program using it supplies the ones its own sealing actually uses.
+/**
+ * Padmé: round up to a multiple of 2^(E−S), where E = floor(log2 L) and S = floor(log2 E)+1.
+ *
+ * About 32 possible lengths per doubling, for roughly 1% more storage. Lengths below 4 are
+ * returned unchanged — the step there would be a single byte, which hides nothing.
+ */
+export function padmeLen(len) {
+    if (len < 4)
+        return len;
+    const e = Math.floor(Math.log2(len));
+    const s = Math.floor(Math.log2(e)) + 1;
+    const z = e - s;
+    if (z <= 0)
+        return len;
+    const step = 2 ** z;
+    return Math.ceil(len / step) * step;
+}
+/** The next power of two at or above `len`: one possible length per doubling. Below 2, unchanged. */
+export function pow2Len(len) {
+    if (len < 2)
+        return len;
+    return 2 ** Math.ceil(Math.log2(len));
+}
+/** Chunks a stream of this plaintext length splits into. Empty is one chunk, not zero. */
+export function chunkCount(plaintextLen, shape) {
+    return plaintextLen === 0 ? 1 : Math.ceil(plaintextLen / shape.chunkSize);
+}
+/** How many bytes one sealed stream of this plaintext length occupies. */
+export function sealedLenFor(plaintextLen, shape) {
+    return shape.headerLen + plaintextLen + shape.tagLen * chunkCount(plaintextLen, shape);
+}
+/**
+ * The largest plaintext length whose sealed stream still fits inside bytes already paid for.
+ *
+ * Storage for a file of its own is charged in whole units, so every byte between the real sealed
+ * length and the next unit boundary has already been bought. Filling them is the one padding that
+ * costs nothing at all, which is why it applies before any rule and whichever rule was chosen.
+ *
+ * `unitBytes` is the billing unit. Pass 0 when the bytes are not billed that way — a file sharing a
+ * stored object with others is billed alongside them, and there is no free room to claim.
+ */
+export function freeCeiling(len, unitBytes, shape) {
+    if (unitBytes <= 0)
+        return len;
+    const paidBytes = Math.ceil(sealedLenFor(len, shape) / unitBytes) * unitBytes;
+    // Invert the sealed-length arithmetic conservatively: assume the padded stream needs one more
+    // chunk than the real one might, then walk back until the sealed length actually fits. At most
+    // two steps.
+    let chunks = Math.max(1, Math.ceil((paidBytes - shape.headerLen) / shape.chunkSize));
+    for (;;) {
+        const candidate = paidBytes - shape.headerLen - shape.tagLen * chunks;
+        if (candidate >= len && sealedLenFor(candidate, shape) <= paidBytes)
+            return candidate;
+        if (chunks <= 1)
+            return len;
+        chunks -= 1;
+    }
+}
+/**
+ * The plaintext length to seal a final part from. Never smaller than `len`.
+ *
+ * ⛔ FINAL PART ONLY — see the module note.
+ */
+export function paddedPlaintextLen(len, rule, options) {
+    if (!Number.isSafeInteger(len) || len < 0) {
+        throw new RangeError(`padded length needs a non-negative safe integer, got ${len}`);
+    }
+    const byRule = rule === "pow2" ? pow2Len(len) : padmeLen(len);
+    return Math.max(len, byRule, freeCeiling(len, options.unitBytes, options.shape));
+}
+/**
+ * Each part's REAL contributed length, from the file's real size and what each stored stream
+ * declares. The read side of the same contract, and the only place that arithmetic is written.
+ *
+ * Throws rather than repairing. Numbers that do not reconcile would hand back a file with bytes
+ * missing or padding in the middle of it, and neither announces itself afterwards.
+ */
+export function keepLengths(size, streamLens) {
+    if (!Number.isSafeInteger(size) || size < 0) {
+        throw new RangeError(`a file size must be a non-negative safe integer, got ${size}`);
+    }
+    if (streamLens.length === 0) {
+        throw new RangeError("a file with no parts has nothing to keep");
+    }
+    const keep = [];
+    let remaining = size;
+    for (let i = 0; i < streamLens.length; i += 1) {
+        const declared = streamLens[i] ?? 0;
+        if (!Number.isSafeInteger(declared) || declared < 0) {
+            throw new RangeError(`part ${i} declares a length that is not a byte count: ${declared}`);
+        }
+        const isLast = i === streamLens.length - 1;
+        const take = isLast ? remaining : declared;
+        if (take > declared) {
+            throw new RangeError(`part ${i} must contribute ${take} bytes but its stream only holds ${declared}`);
+        }
+        if (take > remaining) {
+            throw new RangeError(`part ${i} contributes ${take} bytes but only ${remaining} of the file are left`);
+        }
+        keep.push(take);
+        remaining -= take;
+    }
+    // No total check follows, and none is possible to write honestly: the last part is GIVEN whatever
+    // is left, so the sum is `size` by construction. A file whose parts fall short shows up one line
+    // above, as a last part whose stream cannot hold what remains.
+    return keep;
+}

package/dist/shared/lib/drive/manifest-codec.js

@@ -0,0 +1,287 @@
+// NMF-1 — the on-the-wire form of the sealed file list (CRYPTO-FORMAT-NCF3.md §6). ⚠ PUBLISHED —
+// copied byte-for-byte into the `nmts` command-line package; keep comments self-contained English.
+//
+// This module is ONLY the byte format: entries ⇄ the plaintext that gets sealed. It performs no
+// I/O, holds no key and never touches the network, so it is unit-testable without a browser and
+// is the single place the format is written down in TypeScript.
+//
+// SHAPE: `flag(1) || json` where flag 0x00 = raw UTF-8 JSON and 0x01 = gzip of it. The flag lives
+//   INSIDE the sealed plaintext: beside it, it would be an unauthenticated input an attacker
+//   could flip, and the server would be able to see which form was used.
+//
+// FIELD NAMES ARE ONE OR TWO LETTERS on purpose. This blob is rewritten in full on every change
+//   and downloaded on every cold start, so the key strings are a real fraction of its size — at
+//   ~10k entries, spelling them out costs hundreds of kilobytes per save on someone's phone.
+//   Readability lives in ManifestEntry below, which is what the rest of the app actually uses.
+// Relative, with the extension, because `node --test` type-strips this module directly for the
+// codec round-trip suite and resolves no path aliases.
+import { NETWORK_WHEN_UNRECORDED } from "../storage-network.js";
+import { settingsFromWire, settingsToWire, TEXT_SCALE_DEFAULT_PCT, TEXT_SCALE_MAX_PCT, TEXT_SCALE_MIN_PCT, } from "./manifest-settings.js";
+export { TEXT_SCALE_DEFAULT_PCT, TEXT_SCALE_MAX_PCT, TEXT_SCALE_MIN_PCT };
+/**
+ * Current format version this build writes.
+ *
+ * STAYS 1 WHEN OPTIONAL FIELDS ARE ADDED (favorite · pinned · labels · account settings landed
+ * this way). The reader
+ * below refuses any version it does not know, so bumping would lock every already-open tab out of
+ * the drive to buy nothing: an older build ignores fields it has never heard of and renders the
+ * list correctly. The cost of that choice is real and bounded — an older build that SAVES rewrites
+  * the entries without the marks it dropped, so a stale tab can clear stars and labels. Bump only for
+ * a change an old build would MISREAD, not one it would merely not show.
+ */
+export const MANIFEST_FORMAT_VERSION = 1;
+/** base64url SHA-256 of a sealed blob — the value a later list carries as its `prev`. */
+export async function manifestFingerprint(ct) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(ct));
+    let bin = "";
+    for (const b of new Uint8Array(digest))
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+const FLAG_RAW = 0x00;
+const FLAG_GZIP = 0x01;
+function toWire(e) {
+    const w = {
+        i: e.id,
+        p: e.parentId,
+        k: e.kind,
+        n: e.name,
+        s: e.size,
+        c: e.createdAt,
+        u: e.updatedAt,
+    };
+    // Optional fields are OMITTED rather than written as null: "absent" and "present but empty"
+    // must stay distinguishable, and omitting is also the cheaper encoding.
+    if (e.deletedAt !== undefined)
+        w.d = e.deletedAt;
+    if (e.dekWrapped !== undefined)
+        w.w = e.dekWrapped;
+    if (e.contentHashCt !== undefined)
+        w.h = e.contentHashCt;
+    // Marks are written only when set, and `labels` only when it holds something: an empty array
+    // would cost bytes on every entry of every save to say exactly what its absence already says.
+    if (e.favorite)
+        w.f = 1;
+    if (e.pinned)
+        w.pn = 1;
+    if (e.labels && e.labels.length > 0)
+        w.l = e.labels;
+    // Walrus is written as absence: it is what every entry that lacks the field already means, so
+    // spelling it out would cost bytes on every file of every save to say nothing new.
+    if (e.network !== undefined && e.network !== NETWORK_WHEN_UNRECORDED)
+        w.sn = e.network;
+    if (e.shares && e.shares.length > 0) {
+        w.sh = e.shares.map((r) => (r.revoked ? { a: r.address, t: r.at, r: 1 } : { a: r.address, t: r.at }));
+    }
+    return w;
+}
+function fromWire(w) {
+    const e = {
+        id: w.i,
+        parentId: w.p ?? null,
+        kind: w.k,
+        name: w.n,
+        size: w.s,
+        createdAt: w.c,
+        updatedAt: w.u,
+    };
+    if (w.d !== undefined)
+        e.deletedAt = w.d;
+    if (w.w !== undefined)
+        e.dekWrapped = w.w;
+    if (w.h !== undefined)
+        e.contentHashCt = w.h;
+    if (w.f === 1)
+        e.favorite = true;
+    if (w.pn === 1)
+        e.pinned = true;
+    // Defensive: another build (or a partially applied edit) could leave a non-array or blank
+    // entries here. Labels drive a whole navigation surface, so anything unusable is dropped rather
+    // than rendered as a label the person cannot select, rename or remove.
+    if (Array.isArray(w.l)) {
+        const clean = w.l.filter((s) => typeof s === "string" && s.trim() !== "");
+        if (clean.length > 0)
+            e.labels = clean;
+    }
+    // Carried through even when this build does not recognise the code: dropping it would REWRITE
+    // the entry without it on the next save, turning "stored somewhere I do not know" into
+    // "stored on Walrus" — a claim about someone else's bytes that nothing would ever correct.
+    if (typeof w.sn === "number")
+        e.network = w.sn;
+    // Defensive in the same way labels are, and for a sharper reason: a receipt with a blank address
+    // or a broken instant would be compared against the server's rows and could produce a warning
+    // about a share nobody ever made. Anything unusable is dropped — a receipt that cannot be
+    // checked says nothing, and saying nothing is the honest outcome.
+    if (Array.isArray(w.sh)) {
+        const clean = [];
+        for (const raw of w.sh) {
+            if (!raw || typeof raw !== "object")
+                continue;
+            const { a, t, r } = raw;
+            if (typeof a !== "string" || a === "")
+                continue;
+            if (typeof t !== "number" || !Number.isFinite(t))
+                continue;
+            clean.push(r === 1 ? { address: a, at: t, revoked: true } : { address: a, at: t });
+        }
+        if (clean.length > 0)
+            e.shares = clean;
+    }
+    return e;
+}
+/** Thrown when the plaintext is not a manifest this build can read. */
+export class ManifestFormatError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ManifestFormatError";
+    }
+}
+/**
+ * Entries → the plaintext to seal.
+ *
+ * Compresses when the platform offers `CompressionStream`, which is the normal case and roughly
+ * halves the blob (names and repeated JSON keys compress well). When it does not, the raw form is
+ * written instead of failing: an older browser must still be able to save its drive.
+ */
+export async function encodeManifest(entries, seq, prev, settings) {
+    if (!Number.isSafeInteger(seq) || seq < 1) {
+        throw new ManifestFormatError(`manifest seq must be a positive integer, got ${seq}`);
+    }
+    // Version 1 has nothing before it; every later version must name what it continued from, or the
+    // fork check has a hole exactly where a fork would be introduced.
+    if (seq > 1 && !prev) {
+        throw new ManifestFormatError(`manifest seq ${seq} must name the version it was built on`);
+    }
+    const st = settingsToWire(settings);
+    const wire = {
+        v: MANIFEST_FORMAT_VERSION,
+        seq,
+        ...(prev ? { p: prev } : {}),
+        items: entries.map(toWire),
+        ...(st ? { st } : {}),
+    };
+    const json = new TextEncoder().encode(JSON.stringify(wire));
+    const gz = await gzip(json);
+    return gz ? withFlag(FLAG_GZIP, gz) : withFlag(FLAG_RAW, json);
+}
+/**
+ * Sealed plaintext → entries.
+ *
+ * Throws `ManifestFormatError` on anything it cannot read — including a version from the future.
+ * Callers must NOT treat a throw as "the drive is empty": it is the signal to try the retained
+ * previous version, because rendering an empty drive invites the user to re-upload everything.
+ */
+export async function decodeManifest(body) {
+    if (body.length < 1)
+        throw new ManifestFormatError("empty manifest body");
+    const flag = body[0];
+    const rest = body.subarray(1);
+    let json;
+    if (flag === FLAG_RAW) {
+        json = rest;
+    }
+    else if (flag === FLAG_GZIP) {
+        const out = await gunzip(rest);
+        if (!out)
+            throw new ManifestFormatError("manifest is gzipped but this platform cannot expand it");
+        json = out;
+    }
+    else {
+        throw new ManifestFormatError(`unknown manifest compression flag ${flag}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(json));
+    }
+    catch {
+        throw new ManifestFormatError("manifest body is not valid JSON");
+    }
+    if (!parsed || typeof parsed !== "object") {
+        throw new ManifestFormatError("manifest body is not an object");
+    }
+    const doc = parsed;
+    if (doc.v !== MANIFEST_FORMAT_VERSION) {
+        // A newer version means another device wrote a format this build predates. Refusing is the
+        // safe answer: guessing at unknown fields and then SAVING would drop whatever it did not
+        // understand, silently destroying entries the other device could still read.
+        throw new ManifestFormatError(`unsupported manifest version ${String(doc.v)}`);
+    }
+    if (!Array.isArray(doc.items)) {
+        throw new ManifestFormatError("manifest has no item list");
+    }
+    // The sealed version is required. Treating a missing one as "0" or "unknown" would reopen
+    // exactly the hole this field closes: the server could strip its way back to an unchecked read.
+    if (!Number.isSafeInteger(doc.seq) || doc.seq < 1) {
+        throw new ManifestFormatError(`manifest has no sealed version (seq=${String(doc.seq)})`);
+    }
+    const seq = doc.seq;
+    if (seq > 1 && typeof doc.p !== "string") {
+        throw new ManifestFormatError(`manifest ${seq} does not say what it was built on`);
+    }
+    const settings = settingsFromWire(doc.st);
+    return {
+        v: doc.v,
+        seq,
+        ...(typeof doc.p === "string" ? { prev: doc.p } : {}),
+        entries: doc.items.map(fromWire),
+        ...(settings ? { settings } : {}),
+    };
+}
+/** Prepend the compression flag byte. */
+function withFlag(flag, body) {
+    const out = new Uint8Array(body.length + 1);
+    out[0] = flag;
+    out.set(body, 1);
+    return out;
+}
+/** gzip, or null when the platform has no `CompressionStream`. */
+async function gzip(bytes) {
+    const C = globalThis.CompressionStream;
+    if (!C)
+        return null;
+    return collect(streamThrough(bytes, new C("gzip")));
+}
+/** gunzip, or null when the platform has no `DecompressionStream`. */
+async function gunzip(bytes) {
+    const D = globalThis.DecompressionStream;
+    if (!D)
+        return null;
+    return collect(streamThrough(bytes, new D("gzip")));
+}
+function streamThrough(bytes, 
+// `CompressionStream`'s writable side is typed `BufferSource`, its readable side `Uint8Array`.
+// The pair is spelled out here rather than constrained to one element type so both directions
+// type-check without an `as` on the transform itself.
+transform) {
+    const source = new ReadableStream({
+        start(controller) {
+            // Copied into a view over a plain ArrayBuffer: a `Uint8Array` may sit on a
+            // SharedArrayBuffer, which the stream's `BufferSource` input does not accept. One copy of
+            // an already-serialised list is negligible next to the compression pass that follows.
+            const owned = new Uint8Array(new ArrayBuffer(bytes.length));
+            owned.set(bytes);
+            controller.enqueue(owned);
+            controller.close();
+        },
+    });
+    return source.pipeThrough(transform);
+}
+async function collect(stream) {
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        chunks.push(value);
+        total += value.length;
+    }
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const c of chunks) {
+        out.set(c, at);
+        at += c.length;
+    }
+    return out;
+}