payloads

type EncPayload struct {
	// Key is the file's wrapped symmetric key (raw bytes; the byte
	// layer owns its format). Empty for inline rows if the caller
	// chose to seal the bytes directly.
	Key []byte
	// Name is the user-facing file name.
	Name string
	// SHA256 is the plaintext content hash — the whole-file dedup key.
	SHA256 []byte
	// Mime is the content type hint.
	Mime string
	// Inline holds the file bytes for the inline tier (< InlineMaxSize),
	// which has no rootCid / S3 / networkSign and rides the CRDT.
	Inline []byte
	// Variant tags this row as an alternate representation (e.g.
	// "thumbnail") of VariantOf. Variants are ordinary sibling rows —
	// own tier, own durability, own refcount; the relationship lives
	// only here in the sealed meta, so the network sees N independent
	// files.
	Variant string
	// VariantOf is the fileId of the original this row is a variant of.
	VariantOf string
}

type Handler struct {
	crdt.DefaultHandler
}

type KeyProvider interface {
	CurrentKey(ctx context.Context) (kid string, key crypto.SymKey, err error)
	KeyById(ctx context.Context, kid string) (crypto.SymKey, error)
}

type NotWrittenError struct{ Err error }

type Row struct {
	// Id is the fileId — derived from the creating change
	// (crdt.DeriveRecordId of its ChangeId), deterministic and never
	// reused.
	Id string
	// RootCid is the UnixFS root of the encrypted file. Empty for
	// inline rows.
	RootCid string
	// Size is the plaintext byte size (cleartext hint; quota uses the
	// node's own measurement).
	Size int64
	// NetworkSign is the node's durable-custody receipt. Empty until
	// the file is durable; always empty for inline rows.
	NetworkSign string
	// Author is the account that registered the file (derived from the
	// creating change's signer).
	Author string
	// ObjectId is the object the file is bound to (cleartext parent
	// reference — the derived payloads-object id stays internal).
	ObjectId string
	// EncKid is the ACL key-record id the `enc` blob was sealed under
	// (cleartext — needed to pick the unseal key after ACL rotation).
	EncKid string

	// Enc holds the unsealed member-only secrets after Unseal.
	Enc EncPayload
	// Sealed is true until Unseal succeeds. A keyless reader keeps
	// Sealed rows — that's the broker view, not an error.
	Sealed bool
	// UnsealErr records why a KEYED unseal failed (GCM rejection —
	// the writer stamped a kid that doesn't match the sealing key —
	// or a malformed enc). The row stays Sealed. Kept per-row so one
	// poisoned row (any write-permitted member can produce one)
	// degrades to an unreadable row instead of failing every listing.
	UnsealErr error
	// contains filtered or unexported fields
}