telstore 0.1.10 → 0.1.11

package/src/commands/join.js

@@ -0,0 +1,273 @@
+import { createHash } from 'node:crypto'
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+
+import { askConfirm } from '../confirm.js'
+import { chunkCipher } from '../cipher.js'
+import { chunkFileName, isEncrypted, parseManifest, safeOutName } from '../manifest.js'
+import { askPassword as realAskPassword, unlockManifest } from '../password.js'
+import { createProgress, formatBytes } from '../progress.js'
+
+// Big enough that a 1800MB chunk is a couple of hundred reads, small enough that one buffer
+// reused for every chunk is nothing next to the file being written.
+const COPY_SIZE = 8 * 1024 * 1024
+
+// A backup id becomes part of a path below, and it comes out of a file a person downloaded
+// and can edit. Every id telstore writes is `telstore-YYYYMMDD-<hex>`; anything carrying a
+// separator or a leading dot would have join read chunks from somewhere other than beside
+// the manifest, so it is refused rather than followed.
+function assertPlainId(id) {
+  if (typeof id !== 'string' || !/^[\w.-]+$/.test(id) || id.startsWith('.')) {
+    throw new Error(
+      `The manifest gives ${JSON.stringify(id)} as its backup id, which is not a plain name, ` +
+        'so telstore cannot tell which files beside it are its chunks.',
+    )
+  }
+}
+
+async function readManifest(manifestPath) {
+  let bytes
+
+  try {
+    bytes = await fs.readFile(manifestPath)
+  } catch (err) {
+    throw new Error(`Cannot read the manifest ${manifestPath}: ${err.message}`)
+  }
+
+  return parseManifest(bytes)
+}
+
+// Every chunk is checked for presence and length before a byte is written, and every fault
+// is named in one message: a download by hand that missed three files should cost one more
+// trip to the chat, not three.
+async function checkChunkFiles(manifest, files, dir) {
+  const missing = []
+  const wrong = []
+
+  for (const [index, chunk] of manifest.chunks.entries()) {
+    const name = path.basename(files[index])
+    let stat
+
+    try {
+      stat = await fs.stat(files[index])
+    } catch (err) {
+      if (err.code !== 'ENOENT') throw err
+      missing.push(name)
+      continue
+    }
+
+    if (!stat.isFile()) {
+      wrong.push(`${name} is not a file.`)
+    } else if (stat.size !== chunk.size) {
+      wrong.push(`${name} has ${stat.size} bytes, the manifest records ${chunk.size} bytes.`)
+    }
+  }
+
+  if (missing.length === 0 && wrong.length === 0) return
+
+  const lines = [`Cannot join ${manifest.id}:`]
+
+  if (missing.length > 0) {
+    lines.push(`${missing.length} of ${manifest.chunks.length} chunks are not in ${dir}:`)
+    lines.push(...missing.map((name) => `  ${name}`))
+  }
+
+  lines.push(...wrong)
+  lines.push(
+    'Download them from the chat into that folder under exactly these names and run join ' +
+      'again. A browser that saved a name twice may have added " (1)" to it.',
+  )
+
+  throw new Error(lines.join('\n'))
+}
+
+async function writeAll(handle, buffer, length, position) {
+  let written = 0
+
+  while (written < length) {
+    const { bytesWritten } = await handle.write(buffer, written, length - written, position + written)
+    written += bytesWritten
+  }
+}
+
+// Copies one chunk file into place and hashes exactly the bytes it copied. The length was
+// checked up front, and is checked again here because the file is read now, not then: a
+// download still being written, or replaced in between, is a different file from the one
+// that was stat'd.
+//
+// For an encrypted backup the file holds ciphertext: that is what is hashed against the
+// manifest, and the plaintext written into place is hashed against the seal.
+async function copyChunk({ file, handle, offset, chunk, count, buffer, advance, cipher = null, plainSha256 = null }) {
+  const name = path.basename(file)
+  const source = await fs.open(file, 'r')
+  const hash = createHash('sha256')
+  const plain = cipher ? createHash('sha256') : null
+  let copied = 0
+
+  try {
+    for (;;) {
+      const { bytesRead } = await source.read(buffer, 0, buffer.length, copied)
+
+      if (bytesRead === 0) break
+
+      if (copied + bytesRead > chunk.size) {
+        throw new Error(`${name} grew past the ${chunk.size} bytes the manifest records while it was being read.`)
+      }
+
+      const read = buffer.subarray(0, bytesRead)
+      const out = cipher ? cipher.apply(read, copied) : read
+
+      hash.update(read)
+      plain?.update(out)
+      await writeAll(handle, out, bytesRead, offset + copied)
+      copied += bytesRead
+      advance(bytesRead)
+    }
+  } finally {
+    await source.close()
+  }
+
+  if (copied !== chunk.size) {
+    throw new Error(`${name} has ${copied} bytes, the manifest records ${chunk.size} bytes.`)
+  }
+
+  if (hash.digest('hex') !== chunk.sha256) {
+    throw new Error(
+      `${name} does not match the sha256 the manifest records for chunk ${chunk.i + 1}/${count}. ` +
+        'It is damaged or belongs to another backup — download it again.',
+    )
+  }
+
+  if (plain && plain.digest('hex') !== plainSha256) {
+    throw new Error(
+      `${name} matched its encrypted sha256 but decrypted to bytes that do not match the ` +
+        `manifest for chunk ${chunk.i + 1}/${count}. That points at telstore rather than at the download.`,
+    )
+  }
+}
+
+// The offline half of restore: the chunks and the manifest were downloaded by hand, from
+// Telegram web or anywhere else, and only the reassembly is left. Nothing here talks to
+// the network, so nothing here needs a login or a message id — but every guarantee restore
+// makes about the bytes still holds, because the manifest is what makes them, not the chat.
+export async function runJoin(manifestPath, options = {}, deps = {}) {
+  const {
+    confirm = askConfirm,
+    cwd = process.cwd(),
+    writeErr = (line) => process.stderr.write(line),
+    log: writeLog = (line) => console.log(line),
+    silent = false,
+    onTempChunk = () => {},
+    askPassword = realAskPassword,
+    interactive = () => Boolean(process.stdin.isTTY),
+  } = deps
+
+  const log = silent ? () => {} : writeLog
+  const warn = silent ? () => {} : writeErr
+
+  const manifest = await readManifest(manifestPath)
+  assertPlainId(manifest.id)
+
+  const dir = path.dirname(path.resolve(cwd, manifestPath))
+  const files = manifest.chunks.map((chunk) => path.join(dir, chunkFileName(manifest.id, chunk.i)))
+
+  await checkChunkFiles(manifest, files, dir)
+
+  // After the files are known to be there — that costs nothing and needs no password — and
+  // before the overwrite question, for restore's reason: nobody should answer [y/N] about a
+  // file telstore then cannot decrypt.
+  const opened = isEncrypted(manifest)
+    ? await unlockManifest(manifest, { askPassword, interactive, say: log })
+    : null
+
+  const target = path.resolve(cwd, options.out ?? safeOutName(manifest.name))
+
+  // Not `.partial`: that name belongs to restore, which resumes from it, and a join aimed at
+  // the same file would otherwise truncate hours of somebody's download without asking.
+  const joining = `${target}.joining`
+
+  // Only ENOENT means "no file yet". Treating a permission or I/O error as absence would have
+  // telstore overwrite the user's file without asking.
+  let exists = true
+  try {
+    await fs.stat(target)
+  } catch (err) {
+    if (err.code !== 'ENOENT') throw err
+    exists = false
+  }
+
+  if (exists && !(await confirm(`${target} already exists. Overwrite? [y/N] `))) {
+    throw new Error('Cancelled on request.')
+  }
+
+  log(`Backup ${manifest.id}`)
+  if (opened) log('Lock   encrypted')
+  log(`File   ${target} (${formatBytes(manifest.size)}, ${manifest.chunks.length} chunks)`)
+  log(`From   ${dir}\n`)
+
+  // Said before the open, so a Ctrl-C that lands between the two still has the name to remove.
+  onTempChunk(joining)
+
+  let handle = null
+
+  try {
+    handle = await fs.open(joining, 'w')
+
+    const buffer = Buffer.allocUnsafe(COPY_SIZE)
+    const count = manifest.chunks.length
+    const progress = createProgress({ total: manifest.size, label: `Chunk 1/${count}`, write: warn })
+
+    try {
+      for (const [index, chunk] of manifest.chunks.entries()) {
+        progress.setLabel(`Chunk ${chunk.i + 1}/${count}`)
+
+        await copyChunk({
+          file: files[index],
+          handle,
+          offset: chunk.i * manifest.chunkSize,
+          chunk,
+          count,
+          buffer,
+          advance: progress.advance,
+          cipher: opened ? chunkCipher(opened.keys.chunkKey, chunk.iv) : null,
+          plainSha256: opened ? opened.plainSha256[chunk.i] : null,
+        })
+      }
+    } finally {
+      progress.finish()
+    }
+
+    await handle.close()
+    handle = null
+
+    // Last line of defence, as in restore: every chunk matched and the file is still the
+    // wrong length means the layout went wrong somewhere, and the rename must not happen.
+    const written = await fs.stat(joining)
+
+    if (written.size !== manifest.size) {
+      throw new Error(
+        `The joined file has ${written.size} bytes, the manifest records ${manifest.size} bytes — mismatch.`,
+      )
+    }
+
+    await fs.rename(joining, target)
+  } catch (err) {
+    if (handle) await handle.close().catch(() => {})
+
+    // Unlike restore's .partial there is nothing here worth keeping: the chunks are still on
+    // disk, and a half-joined file is only somewhere a wrong file could be picked up from.
+    try {
+      await fs.rm(joining, { force: true })
+    } catch (rmErr) {
+      warn(`\nCould not remove ${joining} (${rmErr.message}). It is incomplete — remove it by hand.\n`)
+    }
+
+    throw err
+  } finally {
+    onTempChunk(null)
+  }
+
+  log(`\nDone. Wrote ${formatBytes(manifest.size)} to ${target}`)
+
+  return { path: target, size: manifest.size }
+}

package/src/commands/list.js

@@ -1,4 +1,4 @@
-import { parseManifestCaption } from '../caption.js'
+import { parseManifestCaption, terminalSafe } from '../caption.js'
 import { chatName, describeChat } from '../chat.js'
 import {
   closeQuietly,
@@ -22,6 +22,7 @@ const COLUMNS = [
   { header: 'CHUNKS', key: 'chunks', right: true },
   { header: 'CREATED', key: 'created' },
   { header: 'NOTE', key: 'note' },
+  { header: 'LOCK', key: 'lock' },
 ]
 
 // The table is read at a glance, and the note is the one field with no shape at all — 500
@@ -97,6 +98,7 @@ function toRow(message) {
       chunks: UNKNOWN,
       created: utcDay(message.date),
       note: UNKNOWN,
+      lock: UNKNOWN,
     }
   }
 
@@ -107,6 +109,9 @@ function toRow(message) {
     chunks: String(card.chunks),
     created: card.createdAt.slice(0, 10),
     note: card.note ? shorten(card.note) : UNKNOWN,
+    // The hint is here because this is where someone who forgot a password looks first. It comes
+    // off a caption anyone in the chat can edit, so it is made safe to print before it is printed.
+    lock: card.encrypted ? (card.hint ? `🔒 ${shorten(terminalSafe(card.hint))}` : '🔒') : UNKNOWN,
   }
 }
 
@@ -150,10 +155,12 @@ function matchesTerm(message, term) {
 }
 
 function renderTable(rows) {
-  // Most people never write a note, and a column of dashes tells them nothing they did not
-  // already know while costing every other column the width it takes.
+  // Most people never write a note or encrypt, and a column of dashes tells them nothing they
+  // did not already know.
   const columns = COLUMNS.filter(
-    (column) => column.key !== 'note' || rows.some((row) => row.note !== UNKNOWN),
+    (column) =>
+      (column.key !== 'note' || rows.some((row) => row.note !== UNKNOWN)) &&
+      (column.key !== 'lock' || rows.some((row) => row.lock !== UNKNOWN)),
   )
 
   const widths = columns.map((column) =>

package/src/commands/restore-stream.js

@@ -9,7 +9,9 @@ import {
   readMessageBytes as realReadMessageBytes,
 } from '../client.js'
 import { configFile, defaultConfigDir, loadConfig } from '../config.js'
-import { parseManifest } from '../manifest.js'
+import { chunkCipher, decryptInPlace } from '../cipher.js'
+import { isEncrypted, parseManifest } from '../manifest.js'
+import { askPassword as realAskPassword, unlockManifest } from '../password.js'
 import { createProgress, formatBytes, plural } from '../progress.js'
 import { assertLoggedIn } from '../session.js'
 import { requireChat, resolveSettings } from '../settings.js'
@@ -50,6 +52,8 @@ export async function runRestoreStream(backupId, childArgv, options = {}, deps =
     // tarx only. The alias promises gzip, so it checks the claim before spending a gigabyte
     // finding out; `restore <id> -- tar xf -` promises nothing and is asked nothing.
     requireGzipName = false,
+    askPassword = realAskPassword,
+    interactive = () => Boolean(process.stdin.isTTY),
   } = deps
 
   const config = await loadConfig(configDir)
@@ -109,8 +113,16 @@ export async function runRestoreStream(backupId, childArgv, options = {}, deps =
       )
     }
 
+    // Before the command is started, for the reason the gzip check above runs before the
+    // download: a restore that cannot be decrypted should cost nothing, and a command started
+    // for it would be a tar waiting on a pipe that is never going to carry anything.
+    const opened = isEncrypted(manifest)
+      ? await unlockManifest(manifest, { askPassword, interactive, say: log })
+      : null
+
     log(`Backup ${backupId}`)
     log(`Name   ${manifest.name} (${plural(manifest.chunks.length, 'chunk')}, ${formatBytes(manifest.size)})`)
+    if (opened) log('Lock   encrypted')
     log(`From   ${describeChat(chat)}`)
     log(`Into   ${childArgv.join(' ')}\n`)
 
@@ -240,6 +252,21 @@ export async function runRestoreStream(backupId, childArgv, options = {}, deps =
             )
           }
 
+          // The rule this file keeps — no byte reaches the command before its chunk is verified —
+          // now means verified as plaintext: decrypted in the temp file, hashed against the seal,
+          // and only then pumped.
+          if (opened) {
+            const clear = await decryptInPlace(handle, 0, size, chunkCipher(opened.keys.chunkKey, chunk.iv))
+
+            if (clear !== opened.plainSha256[chunk.i]) {
+              throw new Error(
+                `Chunk ${chunk.i + 1} matched its encrypted sha256 but decrypted to bytes that do ` +
+                  'not match the manifest. That points at telstore rather than at the backup. ' +
+                  `${received(childArgv, written)}`,
+              )
+            }
+          }
+
           // Only now, and this line is the guarantee: everything above it is what makes the
           // difference between handing a command the backup and handing it whatever arrived.
           //

package/src/commands/restore.js

@@ -11,8 +11,10 @@ import { askConfirm } from '../confirm.js'
 import { configFile, defaultConfigDir, loadConfig } from '../config.js'
 import { assertLoggedIn } from '../session.js'
 import { requireChat, resolveSettings } from '../settings.js'
+import { chunkCipher, decryptInPlace } from '../cipher.js'
 import { downloadToFile, hashRange } from '../downloader.js'
-import { parseManifest } from '../manifest.js'
+import { isEncrypted, parseManifest, safeOutName } from '../manifest.js'
+import { askPassword as realAskPassword, unlockManifest } from '../password.js'
 import { createProgress, formatBytes, formatDuration } from '../progress.js'
 import { clearRestore, pruneRestores, restoreKey, saveRestore } from '../state.js'
 
@@ -59,29 +61,12 @@ export async function realDownloadChunk(client, message, handle, offset, onProgr
   return await downloadToFile(client, message, handle.fd, { offset, onProgress, ...options })
 }
 
-// manifest.name comes from data downloaded off Telegram — don't trust it when picking
-// a path ourselves. path.basename stops "../../x" but still returns "..", "." or "" for
-// a few pathological names: path.resolve('..') is the parent directory, so a multi-GB
-// .partial file would land outside the current directory and only blow up at rename.
-function safeOutName(name) {
-  const base = path.basename(String(name ?? ''))
-
-  if (base === '' || base === '.' || base === '..') {
-    throw new Error(
-      `The name in the manifest ("${name}") cannot be used as a file name. ` +
-        'Run again with --out <path> to choose where to write.',
-    )
-  }
-
-  return base
-}
-
 // How many chunks at the front of a .partial already hold what the manifest says they
 // should. The evidence is the file, never a record: a record makes claims about a local
 // file anyone can edit between runs, and a claim that is wrong here renames a corrupt file
 // into place. Every chunk in the finished file was hashed against the manifest by the run
 // that renamed it, whether this run downloaded it or found it already there.
-async function scanPartial(handle, manifest, log) {
+async function scanPartial(handle, manifest, log, expected) {
   let done = 0
 
   for (const chunk of manifest.chunks) {
@@ -90,7 +75,7 @@ async function scanPartial(handle, manifest, log) {
     // Downloads run in order, so what is already present is a prefix. The first chunk that
     // does not match is where this run starts, and reading past it would hash gigabytes
     // nobody has written yet.
-    if (digest !== chunk.sha256) break
+    if (digest !== expected(chunk)) break
 
     done += 1
     log(`Chunk ${chunk.i + 1}/${manifest.chunks.length} already restored, skipping.`)
@@ -114,6 +99,10 @@ export async function runRestore(backupId, options = {}, deps = {}) {
     log: writeLog = (line) => console.log(line),
     silent = false,
     onBackupId = () => {},
+    askPassword = realAskPassword,
+    interactive = () => Boolean(process.stdin.isTTY),
+    // Passwords that opened an earlier backup in the same batch, tried before asking again.
+    knownPasswords = [],
   } = deps
 
   const config = await loadConfig(configDir)
@@ -140,6 +129,17 @@ export async function runRestore(backupId, options = {}, deps = {}) {
     }
 
     const manifest = parseManifest(await readMessageBytes(client, manifestMessage))
+
+    // Before the overwrite question and before the .partial: a password that cannot be had must
+    // cost nothing, and nobody should answer [y/N] about a file telstore then cannot write.
+    const opened = isEncrypted(manifest)
+      ? await unlockManifest(manifest, { askPassword, interactive, known: knownPasswords, say: log })
+      : null
+
+    // What each finished chunk hashes to in the .partial. A decrypted chunk is plaintext there,
+    // and only the sealed hash says what that plaintext must be.
+    const onDisk = (chunk) => (opened ? opened.plainSha256[chunk.i] : chunk.sha256)
+
     // When the user passes --out, respect that path verbatim.
     const target = path.resolve(options.out ?? safeOutName(manifest.name))
     const partial = `${target}.partial`
@@ -194,6 +194,7 @@ export async function runRestore(backupId, options = {}, deps = {}) {
     }
 
     log(`Backup ${manifest.id}`)
+    if (opened) log('Lock   encrypted')
     log(`File   ${target} (${formatBytes(manifest.size)}, ${manifest.chunks.length} chunks)\n`)
 
     let handle
@@ -226,7 +227,7 @@ export async function runRestore(backupId, options = {}, deps = {}) {
         // that long is the hang this project refuses everywhere: the heading lands before
         // the first read and a line per chunk arrives as the scan advances.
         log(`Checking what is already in ${partial}...`)
-        done = await scanPartial(handle, manifest, log)
+        done = await scanPartial(handle, manifest, log, onDisk)
         if (done === 0) log(`Nothing in ${partial} matches this backup, starting over.`)
         log('')
       }
@@ -302,6 +303,26 @@ export async function runRestore(backupId, options = {}, deps = {}) {
               )
             }
 
+            // Only after the ciphertext has matched: that match is what proves these are the bytes
+            // that went up, and the manifest's seal is what proves the hash itself. The plaintext
+            // check that follows is the second one, and it exists for telstore's own mistakes.
+            if (opened) {
+              const clear = await decryptInPlace(
+                handle,
+                chunk.i * manifest.chunkSize,
+                chunk.size,
+                chunkCipher(opened.keys.chunkKey, chunk.iv),
+              )
+
+              if (clear !== opened.plainSha256[chunk.i]) {
+                throw new Error(
+                  `Chunk ${chunk.i + 1} matched its encrypted sha256 but decrypted to bytes that do ` +
+                    'not match the manifest. That points at telstore rather than at the backup; ' +
+                    `nothing was renamed, and the download is kept at ${partial} for inspection.`,
+                )
+              }
+            }
+
             await note(chunk.i + 1)
           }
         } finally {
@@ -402,11 +423,15 @@ export async function runRestores(backupIds, options = {}, deps = {}) {
   const warn = silent ? () => {} : writeErr
 
   let shared = null
+  // Shared across every id in the batch, so a password that opened the first backup is tried
+  // silently on the rest before asking again.
+  const passwords = []
   const perId = {
     ...deps,
     connect: async (theirConfig, connectOptions) =>
       (shared ??= await connect(theirConfig, connectOptions)),
     disconnect: async () => {},
+    knownPasswords: passwords,
   }
 
   const results = []

package/src/commands/status.js

@@ -39,7 +39,11 @@ function field(label, value) {
 function resumeCommand(state, destination) {
   const matches = destination !== null && state.chat === String(destination)
 
-  return `npx telstore ${shellArg(state.path)}${matches ? '' : ` --chat ${shellArg(state.chat)}`}`
+  // An encrypted record refuses a run without --encrypt, so a line without it would be a command
+  // telstore prints to be pasted and then turns away.
+  const encrypt = state.enc ? ' --encrypt' : ''
+
+  return `npx telstore ${shellArg(state.path)}${encrypt}${matches ? '' : ` --chat ${shellArg(state.chat)}`}`
 }
 
 // status is the command someone runs *because* something is wrong, so a record a truncated
@@ -83,6 +87,7 @@ const NO_RESUME = {
   changed: 'the file has changed since the backup started',
   'not-a-file': 'that path is no longer a file',
   unreadable: 'the record does not name a file that can be read',
+  damaged: 'the record is damaged, and upload refuses to carry on from it',
 }
 
 // Why the .partial cannot be resumed from, in the same spirit as NO_RESUME above: an

package/src/commands/upload-stream.js

@@ -1,9 +1,11 @@
+import { createHash } from 'node:crypto'
 import { promises as fs } from 'node:fs'
 import path from 'node:path'
 
 import { MAX_CHUNKS, PART_SIZE } from '../chunking.js'
-import { chunkCaption, manifestCaption, parseNote } from '../caption.js'
+import { chunkCaption, manifestCaption, parseNote, terminalSafe } from '../caption.js'
 import { chatName, describeChat } from '../chat.js'
+import { chunkCipher, deriveKeys, newIv, newSalt, sealManifest } from '../cipher.js'
 import {
   MESSAGE_BATCH_SIZE,
   closeQuietly,
@@ -18,6 +20,7 @@ import {
   newBackupId,
   serializeManifest,
 } from '../manifest.js'
+import { askNewPassword as realAskNewPassword } from '../password.js'
 import { createStreamProgress, formatBytes, plural } from '../progress.js'
 import { requireChat, resolveSettings } from '../settings.js'
 import { deleteCommand } from '../shell.js'
@@ -67,6 +70,8 @@ export async function runStreamUpload(name, childArgv, options = {}, deps = {})
     // `discardChunkFile` can still take it with it. Said before the file is opened and unsaid
     // after it is removed, so the caller's copy is never narrower than what is actually on disk.
     onTempChunk = () => {},
+    askNewPassword = realAskNewPassword,
+    secret = null,
   } = deps
 
   // Before the command is started, let alone connected to Telegram: the note is the one thing
@@ -80,6 +85,20 @@ export async function runStreamUpload(name, childArgv, options = {}, deps = {})
   const chunkSize = settings.chunkSize
   const concurrency = settings.uploadConcurrency
 
+  // Before the record, the connection and the command: a run that cannot get a password has
+  // nothing to unwind, and nobody should watch pg_dump start before being asked for one. No
+  // check value is kept — a stream is never resumed, so there is no second run to compare with.
+  let keys = null
+  let enc = null
+
+  if (options.encrypt) {
+    const chosen = secret ?? (await askNewPassword())
+    const salt = newSalt()
+
+    keys = await deriveKeys(chosen.password, salt)
+    enc = { salt, ...(chosen.hint ? { hint: chosen.hint } : {}) }
+  }
+
   const id = newBackupId()
   const key = streamKey(id)
 
@@ -210,6 +229,7 @@ export async function runStreamUpload(name, childArgv, options = {}, deps = {})
 
   log(`Backup ${id}`)
   log(`Name   ${name} (chunks of ${formatBytes(chunkSize)})`)
+  if (enc) log(`Lock   encrypted${enc.hint ? ` (hint: ${terminalSafe(enc.hint)})` : ''}`)
   log(`From   ${childArgv.join(' ')}`)
   log(`To     ${describeChat(chat)}\n`)
 
@@ -292,6 +312,12 @@ export async function runStreamUpload(name, childArgv, options = {}, deps = {})
                 progress.setLabel(`Chunk ${count + 1}`)
               }
 
+              // A fresh iv per chunk; see newIv in src/cipher.js for why it is never derived
+              // from the index.
+              const iv = keys ? newIv() : null
+              const cipher = keys ? chunkCipher(keys.chunkKey, iv) : null
+              const plain = keys ? createHash('sha256') : null
+
               // Offset 0 of a file holding exactly this chunk: uploadRange neither knows nor
               // cares that the bytes arrived through a pipe rather than off a disk.
               const { inputFile, sha256 } = await uploadRange(client, handle.fd, {
@@ -302,6 +328,12 @@ export async function runStreamUpload(name, childArgv, options = {}, deps = {})
                 partSize,
                 onProgress: (bytes) => progress.advance(bytes),
                 retryOptions: { ...retryOptions, onRetry },
+                transform: cipher
+                  ? (bytes, at) => {
+                      plain.update(bytes)
+                      return cipher.apply(bytes, at)
+                    }
+                  : undefined,
               })
 
               const message = await sendChunk(client, chat, {
@@ -323,7 +355,12 @@ export async function runStreamUpload(name, childArgv, options = {}, deps = {})
                 key,
                 state,
                 count,
-                { msgId: message.id, size: filled.bytes, sha256 },
+                {
+                  msgId: message.id,
+                  size: filled.bytes,
+                  sha256,
+                  ...(cipher ? { iv, plainSha256: plain.digest('hex') } : {}),
+                },
                 configDir,
               )
 
@@ -371,15 +408,24 @@ export async function runStreamUpload(name, childArgv, options = {}, deps = {})
         throw new Error(`${childArgv[0]} wrote nothing, so there is no backup to make.`)
       }
 
-      const manifest = buildManifest({
+      let manifest = buildManifest({
         id,
         name,
         size,
         chunkSize,
         note,
+        enc,
         chunks: Array.from({ length: count }, (_, i) => ({ i, ...state.done[String(i)] })),
       })
 
+      if (keys) {
+        manifest = sealManifest(
+          manifest,
+          keys,
+          Array.from({ length: count }, (_, i) => state.done[String(i)].plainSha256),
+        )
+      }
+
       const card = await sendManifest(client, chat, {
         bytes: serializeManifest(manifest),
         fileName: manifestFileName(id),
@@ -390,6 +436,8 @@ export async function runStreamUpload(name, childArgv, options = {}, deps = {})
           chunks: manifest.chunks.length,
           createdAt: manifest.createdAt,
           note: manifest.note ?? null,
+          encrypted: Boolean(keys),
+          hint: manifest.enc?.hint ?? null,
         }),
       })