Crate coven_format 

Versioned plaintext frames and streaming sealed-object layouts (Appendix F.1).

No I/O, clock, randomness or signing occurs here. File chunks compose crypto with validated headers and ranges. Plaintext frames are bounded; writes and snapshots stream without an object-size bound. spec/format.md specifies stored bytes.

Re-exports

pub use error::Error;

Modules

admin

Admin changes in sequence slots (D6). The enclosing slot supplies identity and author.

authorship

Authorship leaves of a write part, its keyed tree and multiproofs (D11).

chunks

Fixed-size plaintext chunks and bounded reconstruction of individual frames.

code_fields

The fields of a code’s storage part (D13). coven-storage decides what they mean; this module packs them with the format’s own primitives (D2), so a storage part has one encoding and a reader refuses a truncated or malformed one. Every owned buffer erases on drop.

codes

Restore and invite codes keep every owned secret buffer zeroizing (§13).

coordinates

Where a file is, as its record carries it (format.md D12): in storage at a fixed location, or only on one device.

device_gone

The marker a device gone for good leaves among its join requests (D8, D10).

dismissal

Lost-value acknowledgements in ordinary write streams (format.md D5).

error

Failures to encode or decode a format object.

file

The cleartext file header, indexed ciphertext chunks and authenticated ranges.

file_reference

The fixed file identity carried by a synced file row (format.md D12).

floor

The floor’s encrypted header and original announcement frames (D8).

invite_end

The marker an ended invite leaves at its join request’s path (D9, D10).

key

Canonical primary keys in SQLite numeric, binary text and blob order.

loss

One loss record for displaced cells, removed rows and excluded writes.

merge_fields

Unframed fields of snapshot merge metadata, also used in coven’s SQLite blobs.

objects

Signed join request frames (D8).

path

Canonical object names and listing prefixes from format.md D10.

sealed_floor

Streamed floor routing: a key id, first kept slot and original key copies (D9). The clear prefix has no total-size bound. Each returned piece is bounded.

sealed_key

Anonymous key boxes embedded in the clear routing prefix of a slot (D9/D11).

sealed_single

The single-chunk join request envelope (D9).

sealed_slot

Clear slot routing and bounded slot envelopes (D9). Writes stream separately.

sealed_snapshot

Authenticated snapshot routing and coverage (D9).

sealed_stream

Canonical 64-KiB sealed streams used by slots, snapshots and floors.

sealed_write

Piecewise sealed write layout. Crypto supplies and authenticates the bytes.

sequence

Plaintext slot headers and snapshot announcements (D9).

snapshot

Snapshots stream a header, eleven ordered sections and an end marker (§16.1). The caller stages records and supplies the applied write metadata to merge.

snapshot_rows

Snapshot merge rows carry app values and generations; losses travel separately.

snapshot_stream

Feed opened snapshot chunks to the frame decoder without retaining rows.

test_utils

Deterministic examples for consumer tests, built from the production owners’ types.

value

Wire encodings for the identities their owning crates define, and SQLite values.

write

A write’s merge-owned changes, split into audience parts (§4, §15.6).

write_sources

Authenticated identities of the data a row change replaced (D5).

write_stream

Write headers describe independently framed, chunked audience streams (§15.6).

writes_slot

A writes slot’s body codec, inner-write identities and ordering checks (D9).

Enums

FormatVersion

The format of an object or a persisted upload attempt (Appendix C.2).

MemberAccess

An account to share with, or the id of a member’s S3 key.

Object

Independently decoded plaintext objects. Writes use write_stream::WriteEncoder; snapshots use snapshot::SnapshotDecoder with merge metadata; restore and invite codes use their zeroizing byte APIs.

RequiredUpdate

The software version required to decode or apply an input from storage: the app schema its writes use, or the object format it is encoded in. Sync, setup and unlock all report it, so it lives with the formats.

Constants

FORMAT_VERSION

The object format written and read by coven (format.md).

FRAME_PREFIX_LEN

The fixed prefix length: kind, format version, payload length.

STORED_CHUNK_OVERHEAD

Bytes a stored sealed chunk adds to its plaintext: the 4-byte length prefix, then the nonce and tag.

Functions

frame_length

Checks the seven-byte prefix and returns the full frame length, capped at 16 MiB, before a caller allocates or fetches its payload. Extra supplied bytes are ignored here; Object::decode requires exactly one complete frame.