Put and Read: content on the socket, for clients that share no files

The system daemon runs as its own user behind ProtectHome, so it can
neither read a file a desktop app wrote for Add nor write one back for
Materialize - redoal on the system varde failed every get with EACCES.
Put imports base64 bytes carried in the request and Read returns a raw
blob's bytes in the reply, both up to MAX_INLINE_BYTES (16 MiB).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

varde-daemon/src/daemon.rs

@@ -371,6 +371,39 @@ impl Daemon {
                     bytes,
                 })
             }
+            Request::Put { data } => {
+                use base64::Engine as _;
+                let bytes = base64::engine::general_purpose::STANDARD
+                    .decode(data.as_bytes())
+                    .map_err(|e| OpError::InvalidArgument(format!("put: data is not base64: {e}")))?;
+                if bytes.len() as u64 > varde_proto::MAX_INLINE_BYTES {
+                    return Err(OpError::InvalidArgument(format!(
+                        "put: {} bytes, more than {} inline; add it by path",
+                        bytes.len(),
+                        varde_proto::MAX_INLINE_BYTES
+                    )));
+                }
+                let (hash, bytes) = self.store.add_bytes(bytes).await?;
+                self.meta.record_format(&hash.to_hex(), StoredFormat::Raw)?;
+                Ok(ResponseData::Added {
+                    hash: hash.to_hex().to_string(),
+                    bytes,
+                })
+            }
+            Request::Read { hash } => {
+                use base64::Engine as _;
+                let parsed = parse_hash(&hash)?;
+                if self.meta.format_of(&parsed.to_hex()) == StoredFormat::HashSeq {
+                    return Err(OpError::InvalidArgument(format!(
+                        "read: {} is a collection; materialize it",
+                        parsed.to_hex()
+                    )));
+                }
+                let bytes = self.store.read_bytes(parsed, varde_proto::MAX_INLINE_BYTES).await?;
+                Ok(ResponseData::Bytes {
+                    data: base64::engine::general_purpose::STANDARD.encode(bytes),
+                })
+            }
             Request::Pin { hash, policy } => {
                 let parsed = parse_hash(&hash)?;
                 self.meta.pin(&parsed.to_hex(), policy)?;

varde-daemon/src/store.rs

@@ -228,6 +228,30 @@ impl BlobStore {
 
     /// Export `hash` to `dest`. Returns bytes written and whether at least
     /// one file was reflinked.
+    /// Import `data` as one raw blob (`Request::Put`).
+    pub async fn add_bytes(&self, data: Vec<u8>) -> Result<(Hash, u64), OpError> {
+        let size = data.len() as u64;
+        let tag = self.store.add_bytes(data).temp_tag().await.map_err(internal)?;
+        info!(hash = %tag.hash().to_hex(), size, "imported bytes");
+        Ok((tag.hash(), size))
+    }
+
+    /// The whole content of a complete raw blob (`Request::Read`), when it
+    /// is no larger than `limit`.
+    pub async fn read_bytes(&self, hash: Hash, limit: u64) -> Result<Vec<u8>, OpError> {
+        match self.store.blobs().status(hash).await.map_err(internal)? {
+            BlobStatus::Complete { size } if size > limit => Err(OpError::InvalidArgument(format!(
+                "{} is {size} bytes, more than {limit} can be read inline; materialize it",
+                hash.to_hex()
+            ))),
+            BlobStatus::Complete { .. } => {
+                let bytes = self.store.blobs().get_bytes(hash).await.map_err(internal)?;
+                Ok(bytes.to_vec())
+            }
+            _ => Err(OpError::NotFound(format!("{} is not complete in the store", hash.to_hex()))),
+        }
+    }
+
     pub async fn materialize(
         &self,
         hash: Hash,