internal/

Package draftbundle packs and unpacks non-git project content as age-encrypted, content-addressed blobs (DRAFT-02).

Package hub implements the Cloudflare R2 zero-knowledge production backend for the DevStrap sync hub.

Package ignore is the canonical .devstrapignore compiler (DRAFT-03).

Package pairing encodes the one-paste device pairing code (P4-SEC-04 part 2): a single copy-paste blob replacing the seven hand-pasted values of the manual ceremony.

Package redact provides value-level secret scrubbing for logs, errors, event payloads, and subprocess output.

snapshot_reads.go holds the producer-side reads for full-state snapshot production (P4-HUB-11, `devstrap hub compact`): the derived namespace map, surviving tombstones, per-device chain anchors, and the current local HLC.

ack.go is the wire format for signed per-device sync acknowledgements (P4-SYNC-06, P6-HUB-04 completion).

Package workspacekeys implements the Workspace Content Key (WCK) epoch keyring for envelope encryption of the namespace-map event log (P4-SEC-02 / P4-SEC-07).