[rustemar]

What this changes

Closes #125.

A 416 response with a strictly parsed, safe Content-Range: bytes */N matching a nonempty local file now permits one GET without Range. That retry must return 200, replaces the old bytes, and uses the existing size and optional MD5 checks. Other 416 responses still fail. The completion callback runs after verification.

How I tested it

• npm run build succeeds
• npm run smoke prints SMOKE_OK
• Ran the REPL and exercised the change
• Dry-run send
• Real gasless send

npm test: 627 passed, no failures or skips. The downloader suite passes all 58 tests, including 31 new regressions; against the original script, 17 of these fail. An independent 44-case check also passes.

The real CLI with a 33-byte loopback fixture succeeds on a completed-file rerun, replaces corrupt same-size bytes, and exits 1 without completion on a failed full retry. Tests cover strict range parsing, response-body cancellation, exact request counts and headers, ignored 416 metadata, and fallback status/stream/size/MD5 failures.

npm run smoke stops at missing WDK_SEED; it did not print SMOKE_OK. No wallet, RPC or model was used for the downloader verification. The existing policy for absent or zero declared lengths is unchanged.

Model / platform tested on: Linux x64, Node 22.22.2; no model is needed for this downloader change. Fork CI passes on Node 22.23.3: Linux 627 passed; Windows 626 passed, with one existing skip for trailing spaces in a policy-file path. Both platforms pass installation and build. The validation branch has identical source and tests; only its CI push trigger differs.

Scope check

• This stays within v0 scope.

Conventions

• I used npm and did not add a global sodium-native override.
• I did not commit .env, seeds, keys, or model weights.

[portdeveloper]

nice, lgtm