e2edecrypt

type Cleanup struct {
	Versions bool `json:"versions"`
	Trash    bool `json:"trash"`
}

type ConvertFailure struct {
	Path string
	Err  error
}

type ConvertIO interface {
	// List is the raw listing of a folder.
	List(dir string) ([]ConvertRow, error)
	// Head is the first bytes of a file (at least 9 when it has them).
	Head(path string) ([]byte, error)
	// Convert encrypts the file `row` (in `dir`) under the folder key and
	// writes it over itself as a conversion write, on condition that it is
	// still the file listed (expect). Errors when the server refuses (a
	// changed file: 412).
	Convert(dir string, row ConvertRow, expect string) error
	// Stopped is asked between files.
	Stopped() bool
}

type ConvertProgress struct {
	// Total is the files found (everything but the key file and sidecars).
	Total int
	// Done is the files converted by this run; Large of them as STREAM.
	Done, Large int
	// Skipped is the files already encrypted (converted earlier, or written
	// encrypted).
	Skipped int
	// Failed is the files that could not be read or written; Failures says
	// which and why.
	Failed   int
	Failures []ConvertFailure
	// OnFile, when set, is told every file as its turn comes.
	OnFile func(path string, size int64)
}

type ConvertRow struct {
	// Path is the entry's full path on the server (adapter://rel).
	Path string
	// Name is its stored name.
	Name string
	Dir  bool
	// Size in bytes and Modified in Unix milliseconds, as listed; -1 when the
	// listing did not say. Together they are the write's precondition.
	Size     int64
	Modified int64
}

type CorruptError struct {
	Path string // plaintext path where known, with the stored name
	Err  error
}

type CreateOptions struct {
	// Iterations of PBKDF2. Never fewer than MinIterations; 0 means that.
	Iterations int
	// EscrowPublicKey is the installation's escrow key (base64 SPKI DER, as
	// /api/capabilities publishes it), or "" for no escrow slot.
	EscrowPublicKey string
	// EncryptNames makes a level-2 folder (v3, feature "names").
	EncryptNames bool
	// NamesPending marks the names slot pending: an existing folder whose
	// entries still carry their plaintext names (enableNames does the same).
	NamesPending bool
	// Rand is where every random byte comes from; nil is crypto/rand.
	Rand io.Reader
}

type Created struct {
	// Marker is the key file, ready to write as `.filex-e2e.json`.
	Marker []byte
	// Keys are the folder key (and the name key, at level 2).
	Keys *Keys
	// RecoveryKey is shown ONCE. filex never stores it.
	RecoveryKey string
}

type EncryptTreeJob struct {
	// contains filtered or unexported fields
}

type EncryptTreeOptions struct {
	// Out is the output folder. Empty: "<input>-encrypted" next to the input.
	Out string
	// Names encrypts file and folder names too (level 2).
	Names bool
	// EscrowPublicKey is an installation's escrow key (base64 SPKI) to seal
	// the folder key to, or "" for none.
	EscrowPublicKey string
	// Iterations and Rand are for tests; writers use MinIterations and
	// crypto/rand.
	Iterations int
	Rand       io.Reader
}

type EncryptTreeResult struct {
	Out   string
	Files int
	Dirs  int
	// Kept is the files a resumed run found already written.
	Kept int
	// Large is the files written as STREAM (over 200 MB).
	Large    int
	Warnings []string
}

type EncryptedName struct {
	Stored         string // the entry's name on the server
	Encoded        string // the encoded ciphertext S (without a folder's ".D")
	SidecarName    string // set only for a long name
	SidecarContent string
}

type FxeHeader struct {
	// contains filtered or unexported fields
}

type FxeKeys struct {
	DEK  []byte
	Name string
}

type Job struct {
	Marker *Marker
	// contains filtered or unexported fields
}

type Keys struct {
	FMK      []byte
	Names    *NameKey
	Previous []byte
}

type Marker struct {
	V      int
	Salt   []byte
	Iter   int
	Verify string
	Fmk    string // "" (v1), "kek" or "wrapped"
	FmkPw  string
	Rk     *RecoverySlot
	Req    []string
	Names  *NamesSlot
	// Rekey is the previous FMK sealed under the current one, while a re-key
	// (a password change that replaced the folder key) is re-wrapping the
	// files' keys. Feature "rekey"; nil otherwise.
	Rekey *RekeySlot
	// ConvPending: an existing folder is being encrypted in place (feature
	// "conv"); files it has not reached yet are still plaintext.
	ConvPending bool
}

type NameKey struct {
	Long   int    // shortening threshold the folder was created with
	RootID []byte // the encrypted root's own folder id
	// contains filtered or unexported fields
}

type NameKind int

type NamePassIO interface {
	// List is the raw listing of a folder (stored names).
	List(dir string) ([]ConvertRow, error)
	// ReadSidecar is a sibling sidecar's content; ok is false when there is
	// none.
	ReadSidecar(dir, name string) ([]byte, bool)
	WriteSidecar(dir, name, content string) error
	// Rename gives row (in dir) the stored name `to`.
	Rename(dir string, row ConvertRow, to string) error
	// Stopped is asked between entries.
	Stopped() bool
}

type NamePassProgress struct {
	// Seen is the entries found needing a name; Renamed of them were given
	// one, Repaired of those had been moved without being re-sealed.
	Seen, Renamed, Repaired int
	// Failed is the entries that could not be renamed (no permission, a name
	// a disk cannot hold, a name that cannot be read at all).
	Failed   int
	Failures []ConvertFailure
}

type NameState int

type NamesSlot struct {
	Alg  string `json:"alg"`
	Enc  string `json:"enc"`
	Long int    `json:"long"`
	Key  string `json:"key"`
	// RootID is the encrypted root's own folder id (16 bytes, base64url):
	// the associated data of every name directly inside the root.
	RootID  string `json:"root_id"`
	Pending bool   `json:"pending,omitempty"`
}

type OpenOptions struct {
	// Out is the output directory. Empty: "<input>-decrypted" next to it
	// (".zip" dropped).
	Out string
	// MarkerPath is an explicit .filex-e2e.json, for an input that does not
	// carry its own (a subfolder, a single file, a zip made below the root).
	MarkerPath string
	// GOOS overrides runtime.GOOS for the output-name rules (tests).
	GOOS string
}

type RecoverySlot struct {
	Salt string `json:"salt"`
	Blob string `json:"blob"`
}

type RekeySlot struct {
	From    string `json:"from"`
	Pending bool   `json:"pending"`
}

type Result struct {
	Out      string
	Files    int
	Dirs     int
	Warnings []string
}

type StoredName struct {
	Kind    NameKind
	Hash    string // long, longdir, sidecar: the 43-character hash they share
	Encoded string // file, dir: the encoded ciphertext S
	DirID   []byte // dir, longdir: the folder's id
}

type UnsupportedError struct{ Features []string }