Module sync 

Credential bundle encryption and relay upload/download for shunt push / shunt login.

Security model:

• Transfer code = 9 random bytes encoded as 18 hex chars, prefixed with “SH-”
• Encryption key = SHA-256(code) — 32 bytes, never sent to the relay
• Cipher: AES-256-GCM with a random 12-byte nonce
• Wire payload = base64(nonce_12B ‖ ciphertext_with_tag)
• Relay stores only ciphertext; bundle is deleted after first download

Structs

SyncBundle

Functions

decrypt_bundle

Decrypt a base64-encoded payload into a SyncBundle.

decrypt_bytes

Decrypt a base64 payload into bytes using the given code.

encrypt_bundle

Encrypt a SyncBundle and return a base64-encoded payload string.

encrypt_bytes

Encrypt arbitrary bytes with the given code; returns a base64 payload string. Uses the same AES-256-GCM scheme as encrypt_bundle.

generate_code

Generate a random transfer code like SH-a3f2b1c4d5e6f7a8b9.

generate_remote_code

Generate a random remote-watch code like RM-a3f2b1c4d5e6f7a8b9.

pull_from_relay

Download and delete the encrypted payload for the given code from the relay. Returns the base64 payload string.

push_to_relay

Upload an encrypted payload to the relay under the given code.

validate_code

Validate that a code looks like what we generated.

validate_remote_code

Validate that a remote-watch code looks like what we generated.