Module engine 

End-to-end encrypted sync operations over the isolated encrypted transports.

A database takes part in sync once it holds a seed genesis or enrollment pin. Its server is the locator bound into protected enrollment identity; configuration never redirects it. Other databases stay local until they are set up or joined.

Structs

AssociationStatus

The sync server, verified member count, and open invitation. Local observation only; contacts no server.

Device

One device in verified membership.

DeviceListing

Devices in sync, read from membership the server just verified.

InvitationStatus

Outcome

PendingInvitation

A created device invitation whose inviting device waits for admission.

Progress

Setup and joining progress that a caller may present: the current stage and, for stages that measure it, the work completed so far in this attempt. Amounts count only work this attempt performed, never item contents.

Removal

Result of removing another device, read back from verified membership.

SetupPreview

What setup would publish from this database.

StatusReport

Enums

Admission

How a wait for the invited device ended.

Amount

Completed work within one stage. Counts never decrease within a stage.

Cancellation

DaemonRound

LocalPhase

Where this database stands in sync, from database facts alone. Reads no protected keys and takes no lock, so it describes rather than authorizes.

Reset

What a reset found.

Stage

Where setup or joining is. Stages report position, not how much remains; Progress::amount carries measured work.

SyncState

Constants

NOT_SET_UP

ROUND_LIMIT

Upper bound on bounded rounds in one interactive drain. A round may append a bounded run of ordinary records, but still pulls one page and transfers at most one image, so this primarily bounds catch-up and image work.

SETUP_INVITATION_REQUIRED

The code of a resume_setup refusal that a setup invitation can continue: without the setup secret the server’s refusal leaves open whether this claim can still be made.

Functions

association_status

await_admission

Polls admission until the invited device joins, the invitation is cancelled, or it expires.

await_join

Requests admission and waits until a retained attempt completes or the deadline passes. Local preparation failures are final. A busy post is retried; a refused one ends waiting only when no earlier attempt could still complete, since a refusal proves nothing about the others.

cancel_invitation

create_invitation

Creates a device invitation, or resumes the pending one. Sync keeps running while it is open.

daemon_round

One bounded daemon round that never waits for another sync.

drain

Repeats bounded rounds until metadata is current and image work settles, or until round_limit or the image retry bound stops it.

ensure_join_available

Refuses joining unless this database is fresh or already joining. The fresh check reads without changing the database.

ensure_setup_available

Refuses setup when sync is disabled or this database already takes part.

finish_removal

Continues an unfinished removal or key rotation retained by the engine, as an ordinary sync round would. Returns whether rotation is still pending.

is_set_up

True when this database takes part in sync, including an interrupted setup or join.

load_devices

local_phase

remove_other_device

Removes another device, or resumes its retained removal. Refuses the current device before reaching the engine.

reset

Makes database a local database that never synced: sync state, the outbox and this database’s protected keys are deleted, while tasks, images and history stay. Setup and join then apply as for a new database. Refused while joining or an unexpired invitation is unfinished. An unfinished setup requires explicit permission because abandoning one may orphan server state when its claim succeeded but its response was lost.

resume_setup

Resumes the setup this database started from its retained server origin, setup ID and seed authority, without the setup invitation, and returns the server. Only a claim the server already holds accepts the seed bearer; otherwise this fails with SETUP_INVITATION_REQUIRED and changes nothing.

run_join

Joins sync on a fresh database, or resumes the join it started, and returns the server. invitation is asked for only while enrollment is unfinished; None resumes the request this database already made. With replace, an invitation this join has not used becomes a new attempt from the same device keys; earlier attempts stay able to complete.

run_setup

Sets up sync from this database, or resumes the setup it started. The caller confirms a fresh setup first; a resumed one continues the original capture and never recaptures.

run_to_completion

Runs one interactive drain, waiting briefly for another sync to finish. This is the user-started recheck of a recorded vault deletion: it ignores the record and clears it on success. Automatic callers must not sync while StatusReport::vault_deleted_at is set.

setup_preview

status_report

Local observation only; contacts no server. Waits briefly for a running sync or invitation exchange, which holds the installation exclusively.

try_association_status

Like association_status, but None without waiting while another sync operation holds this database, so periodic observers stay responsive.

unix_now