Module sync 

Credential bundle encryption and relay upload/download for shunt push / shunt login.

Security model:

• Transfer code = 9 random bytes encoded as 18 hex chars, prefixed with “SH-”
• Encryption key = SHA-256(code) — 32 bytes, never sent to the relay
• Cipher: AES-256-GCM with a random 12-byte nonce
• Wire payload = base64(nonce_12B ‖ ciphertext_with_tag)
• Relay stores only ciphertext; bundle is deleted after first download

Structs

SyncBundle

Functions

decrypt_bundle

Decrypt a base64-encoded payload into a SyncBundle.

encrypt_bundle

Encrypt a SyncBundle and return a base64-encoded payload string.

generate_code

Generate a random transfer code like SH-a3f2b1c4d5e6f7a8b9.

pull_from_relay

Download and delete the encrypted payload for the given code from the relay. Returns the base64 payload string.

push_to_relay

Upload an encrypted payload to the relay under the given code.

validate_code

Validate that a code looks like what we generated.