Securely read and import a complete Cyd Bluesky archive v2

[micahflee]

Note

In this issue, “version 2” and “v2 archive” mean version 2 of the Cyd Bluesky archive contract. Cyd archive formats and version histories are platform-specific; this issue does not define version 2 for X, Facebook, Mastodon, or any other platform.

Parent

• Add full Bluesky platform support with mobile-compatible archives #672

What to build

A free user can import a validated Cyd Bluesky archive at version 2 into an offline-capable local account without any live mutation before validation completes.

Acceptance criteria

• Identity and format come from internal content, so renaming is harmless; Desktop clearly rejects v1 and newer unsupported formats.
• Streaming extraction into isolated staging rejects traversal, absolute paths, symlinks, unexpected types, duplicate/forged paths, and unsafe metadata.
• All payload sizes and SHA-256 digests are verified before merge.
• Schema, metadata, relationships, expected assets, and completeness are validated.
• A valid Cyd Bluesky archive makes every category and full video browsable offline without importing credentials.
• Large Cyd Bluesky archives use conservative confirmation thresholds rather than a small fixed cap.
• Real-ZIP tests cover valid, renamed, complete, corrupt, malformed, versioned, and adversarial Cyd Bluesky archives.

Blocked by

• Replace the dormant Bluesky model with isolated local accounts #673
• Define the normative Cyd Bluesky archive v2 contract and fixtures #675
• Save and browse public Bluesky records offline #676
• Save and browse Bluesky conversations offline #677

(This was written by an LLM.)