feat(encryption): add envelope range decryption

[BravoNatalie]

Part of #968

Description

Adds random-access reads for chunked objects: inspect an envelope without a key, then decrypt one plaintext byte range while fetching only the chunks it covers.

Changes

• parse(source): unauthenticated inspection of scheme, headers and recipients. For chunked objects it also returns params that range reads can reuse to skip re-reading the envelope.
• decryptRange(source, cek, range, options?) and decryptRangeWith(source, unwrapper, range, options?): return the range length, total plaintext length and ciphertext span before any ciphertext is fetched, then stream the range from one contiguous request. Each chunk is authenticated before its plaintext is released.
• RandomAccessSource contract (size plus openRange), with a built-in Uint8Array adapter.
• HTTP-like ranges (suffixes, clamping, empty ranges rejected) and two new errors: InvalidRangeError and InvalidSourceLengthError.

Not included

• Persisting params (they're in-memory only).
• An abort signal on openRange.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/FilOzone/synapse-sdk/@filoz/filecoin-encryption-envelope@989

npm i https://pkg.pr.new/FilOzone/synapse-sdk/@filoz/synapse-core@989

npm i https://pkg.pr.new/FilOzone/synapse-sdk/@filoz/synapse-react@989

npm i https://pkg.pr.new/FilOzone/synapse-sdk/@filoz/synapse-sdk@989

commit: 30608dd

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	synapse-dev	30608dd	Commit Preview URL Branch Preview URL	Sep 28 2026, 12:23 AM