Put and Read: content on the socket, for clients that share no files

The system daemon runs as its own user behind ProtectHome, so it can
neither read a file a desktop app wrote for Add nor write one back for
Materialize - redoal on the system varde failed every get with EACCES.
Put imports base64 bytes carried in the request and Read returns a raw
blob's bytes in the reply, both up to MAX_INLINE_BYTES (16 MiB).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

varde-proto/src/lib.rs

@@ -20,6 +20,10 @@ use serde::{Deserialize, Serialize};
 /// Bumped on incompatible changes; reported in [`GlobalStatus`].
 pub const PROTOCOL_VERSION: u32 = 2;
 
+/// The most bytes a [`Request::Put`] or a [`Request::Read`] reply carries
+/// inline. Larger content goes through `Add`/`Materialize` and a path.
+pub const MAX_INLINE_BYTES: u64 = 16 * 1024 * 1024;
+
 /// A request from a client to the daemon. One JSON object per line.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(tag = "type", rename_all = "snake_case")]
@@ -61,6 +65,24 @@ pub enum Request {
         #[serde(default)]
         mode: MaterializeMode,
     },
+    /// Import bytes carried in the request, base64 (standard alphabet),
+    /// at most [`MAX_INLINE_BYTES`]. Replies [`ResponseData::Added`].
+    ///
+    /// For a client that shares no filesystem with the daemon: the system
+    /// daemon runs as its own user with `ProtectHome`, so it can neither
+    /// read a file a desktop app wrote for `Add` nor write one back for
+    /// `Materialize`. Added in varde 0.1.4.
+    Put {
+        /// The content, base64.
+        data: String,
+    },
+    /// Read a complete raw blob back in the reply, base64, at most
+    /// [`MAX_INLINE_BYTES`]. Replies [`ResponseData::Bytes`]. The
+    /// counterpart of [`Request::Put`]; added in varde 0.1.4.
+    Read {
+        /// Hash (hex) of the blob.
+        hash: String,
+    },
     /// Query daemon status, globally or for one hash.
     Status {
         /// If set, report on this hash; otherwise report global status.
@@ -228,6 +250,11 @@ pub enum ResponseData {
         /// Whether at least one file was reflinked rather than copied.
         reflinked: bool,
     },
+    /// A blob's content, base64. Reply to [`Request::Read`].
+    Bytes {
+        /// The content, base64 (standard alphabet).
+        data: String,
+    },
     /// Global daemon status. Reply to [`Request::Status`] without a hash.
     Status(GlobalStatus),
     /// Per-hash status. Reply to [`Request::Status`] with a hash.