The SPE1 envelope
What is actually stored, byte for byte.
Layout
A magic marker, a version, a two-byte header length, a JSON header, then length-prefixed AES-256-GCM chunks of at most 1 MiB. The header carries the public salt, the nonce base, whether a passphrase is set and the chunk size - never anything secret.
Keys
A 32-byte content key is generated in the browser. HKDF-SHA-256 derives the encryption key from it and the salt. With a passphrase, PBKDF2-SHA-256 at 600,000 iterations produces two halves: one the server stores a hash of, one that never leaves the device.
Chunk nonces
Each chunk's nonce is the 7-byte nonce base, the chunk index as a big-endian uint32, and a last-chunk flag. A truncated stream fails to authenticate rather than decrypting to a shorter file.