Encrypted Files

The safest way to handle the storage sequence is:

1. Validate the plaintext file while it is still in memory.
2. Encrypt its bytes with the active key from the keyring.
3. Serialize the key version, nonce, authentication tag, and ciphertext.
4. Write only that serialized encrypted payload to storage.

In other words, the plaintext bytes never touch the disk, only memory.

The upload flow, archive imports, authorized downloads, and automatic migration are already wired together. Complete the two byte transforms in src/uploads/taxDocuments.ts, then move the sample fixture out of runtime storage.

1. In src/uploads/taxDocuments.ts, import the encryption helpers from "../storage/keyring.ts":
   • decryptWithKeyring
   • deserializeEncryptedPayload
   • encryptWithKeyring
   • serializeEncryptedPayload
2. Implement encryptTaxDocument:
   1. Encrypt using the keyring.
   2. Serialize the versioned payload.
3. Store encrypted documents under random UUID filenames ending in .enc.
4. Implement readTaxDocument:
   1. Read and deserialize the stored payload.
   2. Decrypt it with the keyring.
5. Move data/uploads/mystery-shack-tax-exemption.pdf to data/fixtures.
6. Remove its exceptions from .gitignore and .dockerignore.
7. Update Dockerfile to copy the "Mystery Shack" PDF file to data/fixtures.
8. Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.