@chilkat/react-native 11.6.1

package/src/specs/Crypt2.nitro.ts

@@ -0,0 +1,2387 @@
+// Generated by ReactNativeNs.RnGenerator -- do not edit.
+import type { HybridObject } from 'react-native-nitro-modules'
+import type { BinData } from './BinData.nitro'
+import type { Cert } from './Cert.nitro'
+import type { Http } from './Http.nitro'
+import type { JsonObject } from './JsonObject.nitro'
+import type { PrivateKey } from './PrivateKey.nitro'
+import type { SecureString } from './SecureString.nitro'
+import type { StringBuilder } from './StringBuilder.nitro'
+import type { XmlCertVault } from './XmlCertVault.nitro'
+
+/**
+ * Encrypt, decrypt, hash, sign, verify, encode, and authenticate data.
+ *
+ * `Crypt2` is a broad cryptographic utility class for
+ * applications that need symmetric encryption, decryption, hashing, HMACs,
+ * key derivation, random data generation, one-time passwords, binary encoding,
+ * PKCS#7/CMS signatures, CAdES options, and certificate-based public-key
+ * encryption and decryption. It works with strings, files, byte data,
+ * `BinData`, and `StringBuilder` objects, making it useful
+ * for both small in-memory operations and file-based cryptographic workflows.
+ *
+ * **Encryption and decryption**
+ *
+ * Encrypt and decrypt strings, files, byte arrays, and Chilkat buffer
+ * objects using configurable algorithms, modes, keys, IVs, padding, and
+ * encodings.
+ *
+ * **Hashes and HMACs**
+ *
+ * Compute message digests and keyed message authentication codes for text,
+ * files, byte data, and in-memory buffers.
+ *
+ * **PKCS#7 / CMS signatures**
+ *
+ * Create and verify signed data, detached signatures, opaque signatures,
+ * and certificate-based signature formats used in many security workflows.
+ *
+ * **CAdES support**
+ *
+ * Use CAdES-related options when advanced CMS signature profiles are
+ * required for compliance or interoperability.
+ *
+ * **Key and random utilities**
+ *
+ * Derive keys, generate random bytes, create one-time passwords, and
+ * prepare keying material for cryptographic operations.
+ *
+ * **Encoding and data conversion**
+ *
+ * Encode and decode binary data using formats such as Base64, hex, URL
+ * encoding, and other supported binary encodings.
+ *
+ * **Common pattern:**
+ * Choose the cryptographic operation, set the algorithm and related options,
+ * provide keys, certificates, passwords, IVs, or encoding settings as needed,
+ * then call the method matching the data form: string, file, bytes,
+ * `BinData`, or `StringBuilder`. Check
+ * `LastErrorText` when diagnosing algorithm, key, certificate,
+ * signature, or encoding issues.
+ *
+ * For an extended overview, see
+ * [Crypt2 Class Overview](https://www.chilkatsoft.com/crypt2_class_overview.asp).
+ *
+ * Each `Crypt2` instance owns a native Chilkat object. It is released when the JavaScript object is
+ * garbage collected, or immediately by `dispose()`; any use after `dispose()` throws.
+ * Create one with `new Crypt2()`.
+ *
+ * Methods that can take a while (network, files, compression, key generation) also have an
+ * `...Async` form returning a `Promise`; it runs on a native worker thread so the UI keeps
+ * rendering. While such a call is pending, every other call on this object throws, except
+ * {@link Crypt2.abort} and assigning {@link Crypt2.onPercentDone} / {@link Crypt2.onProgressInfo}.
+ */
+export interface Crypt2 extends HybridObject<{ ios: 'c++', android: 'c++' }> {
+  // ---- Properties ----
+
+  /**
+   * Provides HTML-formatted information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorHtml: string
+
+  /**
+   * Provides plain text information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorText: string
+
+  /**
+   * Provides XML-formatted information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorXml: string
+
+  /**
+   * Version of the component/library, such as "10.1.0"
+   *
+   * This property is read-only.
+   */
+  readonly version: string
+
+  /**
+   * If set to a file path, this property logs the LastErrorText of each Chilkat method or property
+   * call to the specified file. This logging helps identify the context and history of Chilkat
+   * calls leading up to any crash or hang, aiding in debugging.
+   *
+   * Enabling the VerboseLogging property provides more detailed information.
+   *
+   * This property is mainly used for debugging rare instances where a Chilkat method call causes a
+   * hang or crash, which should generally not happen.
+   *
+   * Possible causes of hangs include:
+   *
+   * - A timeout property set to 0, indicating an infinite timeout.
+   *
+   * - A hang occurring within an event callback in the application code.
+   *
+   * - An internal bug in the Chilkat code causing the hang.
+   */
+  debugLogFilePath: string
+
+  /**
+   * If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may
+   * contain more verbose information. The default value is `false`. Verbose logging should only be
+   * used for debugging. The potentially large quantity of logged information may adversely affect
+   * peformance.
+   */
+  verboseLogging: boolean
+
+  /**
+   * Indicates the success or failure of the most recent method call: `true` means success, `false`
+   * means failure. This property remains unchanged by property setters or getters. This method is
+   * present to address challenges in checking for null or Nothing returns in certain programming
+   * languages. Note: This property does not apply to methods that return integer values or to
+   * boolean-returning methods where the boolean does not indicate success or failure.
+   */
+  lastMethodSuccess: boolean
+
+  /**
+   * Setting this property to `true` will abort the current method, but only for those methods
+   * having an `Async` alternative. The property automatically resets to `false` at the start of
+   * each method and after an abort. Both synchronous and asynchronous methods can be aborted;
+   * synchronous methods require setting this property from another thread.
+   */
+  abortCurrent: boolean
+
+  /**
+   * This property indicates the block size in bytes for the chosen encryption algorithm. For
+   * instance, if the {@link Crypt2.cryptAlgorithm} is set to `AES`, the BlockSize is automatically
+   * set to 16 bytes. In contrast, the block size for the `ChaCha20` streaming algorithm is 1 byte.
+   *
+   * This property is read-only.
+   */
+  readonly blockSize: number
+
+  /**
+   * This property applies to all `PKCS7` signature creation methods. When set to `true`, it ensures
+   * the inclusion of required attributes (such as `content-type`, `message-digest`, and
+   * `signing-certificate-v2`) to qualify the signature as at least a `CAdES-BES` signature. By
+   * default, this property is set to `false`.
+   */
+  cadesEnabled: boolean
+
+  /**
+   * This property is for PKCS7 CMS signatures that wish to include CAdES `signature policy
+   * attributes`. Set it to the `base64`-encoded hash of the policy document at the {@link
+   * Crypt2.cadesSigPolicyUri} using either `SHA256` or `SHA1`.
+   */
+  cadesSigPolicyHash: string
+
+  /**
+   * This property is for PKCS7 CMS signatures that wish to include CAdES `signature policy
+   * attributes`.
+   * The `CAdES Signature Policy ID` is an object identifier (`OID`) included in a CAdES signature
+   * that specifies the exact signature policy the signer followed. It is the OID associated with
+   * the policy URL. An example OID would look like this: `2.16.840.1.101.3.2.1.48.1`
+   *
+   * An application that wishes to include signature policy attributes should set all three
+   * properties: {@link Crypt2.cadesSigPolicyHash}, {@link Crypt2.cadesSigPolicyUri}, and {@link
+   * Crypt2.cadesSigPolicyId}.
+   */
+  cadesSigPolicyId: string
+
+  /**
+   * This property is for PKCS7 CMS signatures that wish to include CAdES `signature policy
+   * attributes`. The `signature policy URI` in a `CAdES` digital signature is a link that points to
+   * a document describing the rules and conditions under which the signature was created.
+   * Typically the Signature Policy URI in a CAdES signature points to a `.der` file, not a PDF or
+   * human-readable document.
+   *
+   * For example: `http://example.com/policies/my-policy.der`
+   */
+  cadesSigPolicyUri: string
+
+  /**
+   * This property specifies the character encoding used to represent text as bytes for encryption
+   * and hashing. By default, it uses the computer's `ANSI` charset, such as `Windows-1252` for
+   * locales like the United States, United Kingdom, Western Europe, Australia, and New Zealand.
+   *
+   * Most applications are **advised to set this property** to `UTF-8`. Chilkat plans to change its
+   * default to UTF-8 in a future major version to align with current standards. The current default
+   * of ANSI stems from a time when UTF-8 was not widely adopted.
+   */
+  charset: string
+
+  /**
+   * Sets the `cipher mode` for **block encryption algorithms** (AES, Blowfish,TwoFish, DES, 3DES,
+   * RC2). Possible values are `CBC` (the default), `ECB`, `CTR`, `OFB`, `GCM`, and `CFB`. These
+   * acronyms have the following meanings:
+   *
+   * - `CBC`:  Cipher Block Chaining,
+   *
+   * - `ECB`:  Electronic CookBook
+   *
+   * - `CTR`: Counter Mode
+   *
+   * - `CFB`: Cipher Feedback
+   *
+   * - `OFB`: Output Feedback
+   *
+   * - `GCM`: Galois/Counter Mode
+   *
+   * - `XTS`: AES-XTS (starting in Chilkat v9.5.0.91, only works with AES encryption)
+   *
+   * The `GCM` (Galois/Counter Mode) is available with any cipher having a 16-byte block size, such
+   * as AES. The CFB, OFB, CTR, and GCM modes convert block ciphers into stream ciphers. In these
+   * modes of operation, the {@link Crypt2.paddingScheme} property is unused because no padding
+   * occurs.
+   *
+   * **Starting in v9.5.0.91** Chilkat supports `AES-XTS` mode. XTS mode additionally uses a tweak
+   * key and tweak value, which are set via the {@link Crypt2.xtsSetEncodedTweakKey}, {@link
+   * Crypt2.xtsSetEncodedTweakValue}, and {@link Crypt2.xtsSetDataUnitNumber}. (The latter two
+   * functions provide alternative means of setting the tweak value.) Chilkat fully supports AES-XTS
+   * mode with `ciphertext-stealing`, which means it will correctly encrypt/decrypt data with size
+   * not divisible by the block size (i.e. divisible by 16 bytes).
+   */
+  cipherMode: string
+
+  /**
+   * Selects the encryption algorithm for encrypting and decrypting. Possible values are:
+   *
+   * Algorithm
+   * Type
+   * Symmetric?
+   * Key Size(s)
+   * Block/Stream
+   * Mode of Operation
+   * Notes
+   *
+   * | `aes` |
+   * | Block cipher |
+   * | ✔ Yes |
+   * | 128, 192, 256 bits |
+   * | Block (128-bit) |
+   * | CBC, CTR, GCM, etc. |
+   * | Widely used, FIPS-approved |
+   *
+   * | `pki` (Public-Key Encryption) |
+   * | Asymmetric |
+   * | ✗ No |
+   * | 1024–4096+ bits |
+   * | N/A |
+   * | N/A |
+   * | Used for key exchange, not bulk data |
+   *
+   * | `chacha20` |
+   * | Stream cipher |
+   * | ✔ Yes |
+   * | 256 bits |
+   * | Stream |
+   * | N/A |
+   * | High speed, secure, designed for simplicity |
+   *
+   * | `des` |
+   * | Block cipher |
+   * | ✔ Yes |
+   * | 56 bits |
+   * | Block (64-bit) |
+   * | ECB, CBC, etc. |
+   * | Deprecated, insecure |
+   *
+   * | `3des` |
+   * | Block cipher |
+   * | ✔ Yes |
+   * | 112 or 168 bits |
+   * | Block (64-bit) |
+   * | ECB, CBC, etc. |
+   * | Legacy use, weak by modern standards |
+   *
+   * | `rc2` |
+   * | Block cipher |
+   * | ✔ Yes |
+   * | 40–128 bits (variable) |
+   * | Block (64-bit) |
+   * | ECB, CBC, etc. |
+   * | Obsolete, variable strength |
+   *
+   * | `blowfish2`  (Blowfish) |
+   * | Block cipher |
+   * | ✔ Yes |
+   * | 32–448 bits (variable) |
+   * | Block (64-bit) |
+   * | ECB, CBC, etc. |
+   * | Fast, but 64-bit block size is a limitation |
+   *
+   * | `twofish` |
+   * | Block cipher |
+   * | ✔ Yes |
+   * | Up to 256 bits |
+   * | Block (128-bit) |
+   * | ECB, CBC, etc. |
+   * | AES finalist, secure and flexible |
+   *
+   * | `pbes1` |
+   * | Key derivation |
+   * | ✔ Yes |
+   * | Based on underlying cipher |
+   * | Block (varies) |
+   * | PKCS#5 v1.5 |
+   * | Obsolete, uses DES/RC2 |
+   *
+   * | `pbes2` |
+   * | Key derivation |
+   * | ✔ Yes |
+   * | Based on underlying cipher |
+   * | Block (varies) |
+   * | PKCS#5 v2.0 |
+   * | Modern, supports AES, SHA, etc. |
+   *
+   * | `arc4` (RC4) |
+   * | Stream cipher |
+   * | ✔ Yes |
+   * | 40–2048 bits (variable) |
+   * | Stream |
+   * | N/A |
+   * | Deprecated, insecure due to biases |
+   */
+  cryptAlgorithm: string
+
+  /**
+   * The EncodingMode property specifies the `binary encoding` format (e.g., `base64`, `hex`,
+   * `base58`, `base64url`)
+   * used by functions ending in `"ENC"`, like {@link Crypt2.encryptStringENC} and {@link
+   * Crypt2.decryptStringENC}.
+   * For encryption functions, EncodingMode determines the encoding of the output. For decryption
+   * functions, it specifies the encoding of the input data.
+   *
+   * A `list of supported binary encodings` is available at the link below.
+   *
+   * The default value is `base64`
+   */
+  encodingMode: string
+
+  /**
+   * Using the `FirstChunk` and {@link Crypt2.lastChunk} properties is the way to do streaming
+   * encryption or decryption with Chilkat.
+   *
+   * By default, both FirstChunk and LastChunk are set to `true`, indicating that the data passed to
+   * the encryption or decryption method is the full amount. To process data in multiple chunks,
+   * adjust these settings as follows:
+   *
+   * 1. For the first chunk, set FirstChunk = `true` and LastChunk = `false`.
+   *
+   * 2. For intermediate chunks, set both FirstChunk = `false` and LastChunk = `false`.
+   *
+   * 3. For the final chunk, set FirstChunk = `false` and LastChunk = `true`.
+   *
+   * You can feed data chunks of any size, regardless of the encryption algorithm's block size
+   * (e.g., 16 bytes for AES). Chilkat will handle buffering and, upon receiving the final chunk,
+   * pad the output to the appropriate block size according to the selected {@link
+   * Crypt2.paddingScheme}.
+   */
+  firstChunk: boolean
+
+  /**
+   * Selects the hash algorithm used by methods that create hashes. The valid choices are `sha256`,
+   * `sha384`, `sha512`, `sha3-224`, `sha3-256`, `sha3-384`, `sha3-512`, `sha1`, `md2`, `md5`,
+   * `haval`, `ripemd128`, `ripemd160`,`ripemd256`, or `ripemd320`.
+   *
+   * (Chilkat supports `SHA-2` because it includes the SHA-256, SHA-384, and SHA-512 hash
+   * functions.)
+   *
+   * **The default value is `sha256`.**
+   *
+   * Note: The HAVAL hash algorithm is affected by two other properties: {@link Crypt2.havalRounds}
+   * and {@link Crypt2.keyLength}.
+   *
+   * - The HavalRounds may have values of 3, 4, or 5.
+   *
+   * - For HAVAL hashing, the KeyLength can be 128, 160, 192, 224, or 256.
+   */
+  hashAlgorithm: string
+
+  /**
+   * Applies to the HAVAL hash algorithm only and must be set to the integer value 3, 4, or 5. The
+   * default value is 3.
+   */
+  havalRounds: number
+
+  /**
+   * The interval in milliseconds between each `AbortCheck` event callback, which enables an
+   * application to abort certain method calls before they complete. **By default, HeartbeatMs is
+   * set to **`0`**, meaning no AbortCheck event callbacks will trigger.**
+   *
+   * Methods with event callbacks include: {@link Crypt2.ckDecryptFile}, {@link
+   * Crypt2.ckEncryptFile}, `HashFile`, and {@link Crypt2.hashFileENC}.
+   */
+  heartbeatMs: number
+
+  /**
+   * This applies only to creating digital signatures. By default (`true`), any additional
+   * certificates in the authentication chain are included in the PKCS7 digital signature.
+   */
+  includeCertChain: boolean
+
+  /**
+   * The initial counter for the `ChaCha20` encryption algorithm, which has a default value of 0, is
+   * pre-agreed by both the encryptor and decryptor.
+   */
+  initialCount: number
+
+  /**
+   * The iteration count in password-based encryption (PBE) establishes the computational difficulty
+   * for encryption and decryption, thereby enhancing resistance to exhaustive search attacks. The
+   * default iteration count is `1024`, which is considered low, so it is recommended that
+   * applications increase this number when using `pbes2` encryption.
+   *
+   * **PBES2 Iteration Count Recommendation**s
+   *
+   * Aim for a **100–200 ms** derive time on your target hardware.
+   *
+   * -
+   * Server/Desktop:
+   * `100000 – 1000000+`
+   *
+   * -
+   * Mobile/Embedded:
+   * `50000 - 100000`
+   *
+   * Benchmark annually and increase iterations as hardware improves.
+   */
+  iterationCount: number
+
+  /**
+   * The key length `in bits` for symmetric encryption algorithms.  The default value is `256`.
+   */
+  keyLength: number
+
+  /**
+   * See the documentation for the {@link Crypt2.firstChunk} property.
+   */
+  lastChunk: boolean
+
+  /**
+   * Selects the MAC algorithm to be used for any of the Mac methods, such as MacStringENC,
+   * MacBytes, etc. The default value is `hmac`. Possible values are `hmac` and `poly1305`.
+   */
+  macAlgorithm: string
+
+  /**
+   * This property is set upon verifying a digital signature and indicates the number of signer
+   * certificates. You can retrieve each signing certificate using the {@link Crypt2.lastSignerCert}
+   * method with an index ranging from `0` to `NumSignerCerts`-1.
+   *
+   * This property is read-only.
+   */
+  readonly numSignerCerts: number
+
+  /**
+   * This property defines the padding scheme Chilkat uses for adding padding to input data during
+   * encryption and removing it during decryption. It is applicable only to symmetric block ciphers,
+   * such as AES, Blowfish, and Twofish, which require input sizes matching their exact block size.
+   * Padding ensures the last block is completely filled.
+   *
+   * The possible values are:
+   *
+   * -
+   * **PKCS#5/PKCS#7 (RFC 1423)** `default`
+   *
+   * \*Each pad byte = number of padding bytes.\*
+   *
+   * Block size: 8
+   *
+   * Data: "HELLO" (5 bytes)
+   *
+   * Padding: 0x03 0x03 0x03
+   *
+   * -
+   * **FIPS 81**
+   *
+   * \*Last byte = count; others = random.\*
+   *
+   * Block size: 8
+   *
+   * Data: "HELLO"
+   *
+   * Padding: 0xA4 0x2F 0x9C 0x03
+   *
+   * -
+   * **Random**
+   *
+   * \*All pad bytes random; decryptor must know original length.\*
+   *
+   * Block size: 8
+   *
+   * Data: "HELLO"
+   *
+   * Padding: 0x7D 0x20 0xCB 0x81
+   *
+   * -
+   * **Null (0x00)**
+   *
+   * \*Pad with zeros; no padding if already exact.\*
+   *
+   * Block size: 8
+   *
+   * Data: "HEL" (3 bytes)
+   *
+   * Padding: 0x00 0x00 0x00 0x00 0x00
+   *
+   * -
+   * **Space (0x20)**
+   *
+   * \*Pad with spaces; no padding if already exact.\*
+   *
+   * Block size: 8
+   *
+   * Data: "HEL" (3 bytes)
+   *
+   * Padding: 0x20 0x20 0x20 0x20 0x20
+   */
+  paddingScheme: number
+
+  /**
+   * If the {@link Crypt2.cryptAlgorithm} property is set to `pbes1` or `pbes2`, this property
+   * defines the symmetric encryption algorithm to be used for password-based encryption (PBE). The
+   * default is `"des"`. Applications should set this property equal to `"aes"`.
+   */
+  pbesAlgorithm: string
+
+  /**
+   * The password to be used when the {@link Crypt2.cryptAlgorithm} is `"pbes1"` or `"pbes2"`.
+   */
+  pbesPassword: string
+
+  /**
+   * This property determines the underlying symmetric encryption algorithm when the {@link
+   * Crypt2.cryptAlgorithm} property is set to `pki` for selecting PKCS7 public-key encryption.
+   *
+   * The default is `aes`.
+   */
+  pkcs7CryptAlg: string
+
+  /**
+   * The effective key length (in bits) for the `RC2` encryption algorithm. When using RC2, set both
+   * the {@link Crypt2.keyLength} and Rc2EffectiveKeyLength properties to values between 8 and 1024,
+   * inclusive. The default setting for both is 128.
+   *
+   * The default value is `128`
+   *
+   * RC2 is an old symmetric encryption algorithm, now considered insecure due to its small key size
+   * and vulnerability to cryptanalysis. Modern algorithms like AES are recommended instead.
+   */
+  rc2EffectiveKeyLength: number
+
+  /**
+   * When UU encoding, this is the filename to be embedded in UU encoded output. The default is
+   * `file.dat`. When UU decoding, this is the filename found in the UU encoded input.
+   */
+  uuFilename: string
+
+  /**
+   * When UU encoding, this is the file permissions mode to be embedded in UU encoded output. The
+   * default is `644`. When UU decoding, this property is set to the mode found in the UU encoded
+   * input.
+   */
+  uuMode: string
+
+  /**
+   * The BCrypt work factor determines the computational cost of {@link Crypt2.bCryptHash} and
+   * {@link Crypt2.bCryptVerify}. It represents the base-2 logarithm of the number of hashing
+   * rounds. For instance, a work factor of 12 corresponds to 2^12 hashing rounds. This cost factor
+   * is designed to make computations challenging enough to deter brute-force attacks.
+   *
+   * The work factor must be set between 4 and 31, inclusive, with a `default value of 10`.
+   */
+  bCryptWorkFactor: number
+
+  /**
+   * This property applies when creating RSA signatures.
+   *
+   * It defines the `RSA signature scheme`. The default is `PKCS1-v1_5`. You can change it to
+   * `RSASSA-PSS` (or `pss`) to use the RSASSA-PSS signature scheme.
+   *
+   * -
+   * **PKCS#1 v1.5**
+   *
+   * \*Older, deterministic scheme.\*
+   *
+   * - Simple padding.
+   *
+   * - Vulnerable to certain attacks if not used carefully.
+   *
+   * - Still widely used for compatibility.
+   *
+   * -
+   * **RSASSA-PSS**
+   *
+   * \*Newer, probabilistic scheme (recommended by modern standards).\*
+   *
+   * - Adds random salt for each signature.
+   *
+   * - More secure against chosen-plaintext and padding oracle attacks.
+   *
+   * - Recommended by modern standards like PKCS#1 v2.1 and FIPS.
+   */
+  signingAlg: string
+
+  /**
+   * Selects the hash algorithm for use within OAEP padding when encrypting using `pki` with
+   * RSAES-OAEP. The valid choices are `sha1`, `sha256`, `sha384`, `sha512`,
+   *
+   * The default value is `sha256`
+   */
+  oaepHash: string
+
+  /**
+   * Selects the RSA encryption scheme when encrypting using `pki` (with a certificate and private
+   * key). The default value is `false`, which selects RSAES_PKCS1-V1_5. If set to `true`, then
+   * RSAES_OAEP is used.
+   */
+  oaepPadding: boolean
+
+  /**
+   * Selects the MGF hash algorithm for use within OAEP padding when encrypting using `pki` with
+   * RSAES-OAEP. The valid choices are `sha1`, `sha256`, `sha384`, `sha512`, The default is
+   * `sha256`.
+   */
+  oaepMgfHash: string
+
+  /**
+   * Contains JSON to specify the authenticated (signed) attributes or unauthenticated (unsigned)
+   * attributes that are to be included in CMS signatures. The default value is:
+   *
+   * ```
+   * {
+   *     "contentType": true,
+   *     "signingTime": true,
+   *     "messageDigest": true
+   * }
+   * ```
+   */
+  signingAttributes: string
+
+  /**
+   * A JSON string to manage additional CMS (PKCS7) signature and validation options. Possible
+   * options are:
+   *
+   * - boolean `OmitAlgorithmIdNull`: Set this JSON member to `true` to omit the explicit NULL
+   *   within an AlgorithmIdentifier ASN.1 within the PKCS7. This should almost never be used, but
+   *   helps for rare cases where a validator dislikes the explicit NULL being present.
+   *
+   * - boolean `ValidateTimestampTokens`: Tells Chilkat to also validate the timestamp tokens when
+   *   validating a signature that includes a timestamp.
+   *
+   * - boolean `ConstructedOctets`: When set to `true`, tells Chilkat to use the `ASN.1 constructed
+   *   octets` format for the data contained in the CMS (PKCS7) signed-data.
+   *
+   * - boolean `CanonicalizeITIDA`: This applies to `Egypt ITIDA`, which requires signed documents
+   *   in a CAdES-BES CMS format, using ITIDA’s JSON canonicalization (for JSON payloads), with only
+   *   the Base64‑encoded signature attached - not the original data itself. When set to `true`,
+   *   Chilkat will `automatically do the special ITIDA JSON canonicalization`.
+   */
+  cmsOptions: string
+
+  /**
+   * This is a catch-all property to be used for uncommon needs. This property defaults to the empty
+   * string and should typically remain empty.
+   *
+   * Can be set to a list of the following comma separated keywords:
+   *
+   * - `UseConstructedOctets` - Introduced in v9.5.0.83. When creating opaque CMS signatures
+   *   (signatures that embed the data being signed), will use the `constructed octets` form of the
+   *   ASN.1 that holds the data. This is to satify some validators that are brittle/fragile/picky
+   *   and require a particular format, such as for the ICP-Brazil Digital Signature Standard.
+   */
+  uncommonOptions: string
+
+  // ---- Methods ----
+
+  /**
+   * Adds a certificate for public-key encryption. To enable public-key encryption with digital
+   * certificates, set the {@link Crypt2.cryptAlgorithm} property to `pki`. Call {@link
+   * Crypt2.addEncryptCert} separately for each certificate you wish to use for encryption.
+   *
+   * Any of the `Encrypt*` methods will do `RSA public-key encryption` when the `CryptAlgorithm` is
+   * set to the keyword `pki`. The output is a `PKCS#7 enveloped-data` secure container.
+   */
+  addEncryptCert(cert: Cert): void
+
+  /**
+   * Adds a `PFX` file to the object's list of sources for locating certificates and private keys
+   * during public-key decryption or signing. To add multiple PFX sources, call this method multiple
+   * times.
+   *
+   * **Note:** Information about the certificate(s) needed for `public-key decryption` are included
+   * in the `PKCS#7 enveloped-data`. Chilkat will automatically find a usable certificate and
+   * private key from sources like Windows certificate stores, the Apple keychain, or other sources
+   * provided by the application.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  addPfxSourceFile(pfxFilePath: string, pfxPassword: string): void
+
+  /**
+   * File-to-file decryption that supports files of any size by using internal streaming mode.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.ckDecryptFileAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  ckDecryptFile(srcFile: string, destFile: string): void
+
+  /**
+   * Asynchronous form of {@link Crypt2.ckDecryptFile}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  ckDecryptFileAsync(srcFile: string, destFile: string): Promise<void>
+
+  /**
+   * Encrypts a file to another file using streaming mode, allowing files of virtually any size to
+   * be processed without loading the entire file into memory. The exception is when the
+   * `CryptAlgorithm` property is set to `"pki"`, in which case the entire input file must reside in
+   * memory because public-key encryption is performed in-memory rather than as a streaming
+   * operation.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.ckEncryptFileAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  ckEncryptFile(srcFile: string, destFile: string): void
+
+  /**
+   * Asynchronous form of {@link Crypt2.ckEncryptFile}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  ckEncryptFileAsync(srcFile: string, destFile: string): Promise<void>
+
+  /**
+   * Clears the internal list of digital certificates to be used for public-key encryption.
+   */
+  clearEncryptCerts(): void
+
+  /**
+   * Calculates the CRC for a file's contents using the CRC algorithm specified by `crcAlg`.
+   * Possible algorithms are:
+   *
+   * - `crc-32` - This is the CRC used in the Zip file format.
+   *
+   * - `crc8`
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.crcFileAsync}.
+   */
+  crcFile(crcAlg: string, path: string): number
+
+  /**
+   * Asynchronous form of {@link Crypt2.crcFile}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   */
+  crcFileAsync(crcAlg: string, path: string): Promise<number>
+
+  /**
+   * Signs the contents of `inFilename` and writes the enveloping (i.e. opaque) `PKCS7` signature
+   * (`.p7m`) to `p7mPath`.
+   *
+   * In a **PKCS#7/CMS signature**, the signer computes a **cryptographic hash** (e.g. SHA-256) of
+   * the data, then uses their **private key** to sign that hash.
+   *
+   * The signature = `Sign( Hash(data) )`
+   *
+   * This signed hash is what gets stored in the signature file. For enveloping/opaque signatures,
+   * the signed data is also stored in the signature file.
+   *
+   * Set the `HashAlgorithm` property to specify the hash algorithmg. The valid options are
+   * `sha256`, `sha1`, `sha384`, and `sha512`.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.createP7MAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  createP7M(inFilename: string, p7mPath: string): void
+
+  /**
+   * Asynchronous form of {@link Crypt2.createP7M}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  createP7MAsync(inFilename: string, p7mPath: string): Promise<void>
+
+  /**
+   * Signs the contents of `inFilename` and writes the detached `PKCS7` signature (`.p7s`) to
+   * `p7sPath`.
+   *
+   * In a **PKCS#7/CMS detached signature**, the signer computes a **cryptographic hash** (e.g.
+   * SHA-256) of the data, then uses their **private key** to sign that hash.
+   *
+   * The signature = `Sign( Hash(data) )`
+   *
+   * This signed hash is what gets stored in the signature file.
+   *
+   * Set the `HashAlgorithm` property to specify the hash algorithmg. The valid options are
+   * `sha256`, `sha1`, `sha384`, and `sha512`.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.createP7SAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  createP7S(inFilename: string, p7sPath: string): void
+
+  /**
+   * Asynchronous form of {@link Crypt2.createP7S}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  createP7SAsync(inFilename: string, p7sPath: string): Promise<void>
+
+  /**
+   * Decodes from an encoding back to the original string. The `encoding` can be set to any of the
+   * following strings: `base64`, `hex`, `quoted-printable`, `url`, `base32`, `Q`, `B`,
+   * `url_rc1738`, `url_rfc2396`, `url_rfc3986`, `url_oauth`, `uu`, `modBase64`, or `html` (for HTML
+   * entity encoding).
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  decodeString(inStr: string, charset: string, encoding: string): string
+
+  /**
+   * Decrypts encoded encrypted data, and returns the decrypted data as a binary encoded string. For
+   * example:
+   *
+   * **Input** → **Decode** `EncodingMode` → **Decrypt** → **Encode** `EncodingMode` → **Output**
+   *
+   * The encoding (e.g. `base64`, `hex`, etc.) is determined by the {@link Crypt2.encodingMode}
+   * property.
+   *
+   * This method supports `symmetric key` and `public key` decryption. For more information on
+   * **properties that affect decryption**, such as {@link Crypt2.cryptAlgorithm}, {@link
+   * Crypt2.cipherMode}, etc., refer to the {@link Crypt2.decryptBd} method documentation.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  decryptEncoded(encodedEncryptedData: string): string
+
+  /**
+   * This function is intended for use when the **expected decrypted output is text**. It decrypts
+   * binary encoded encrypted bytes passed in `str` and appends the resulting string to ARG2. Ensure
+   * that the {@link Crypt2.charset} property, such as `utf-8,` matches the one used during
+   * encryption to interpret the decrypted bytes correctly as characters.
+   *
+   * **Input** → **Decode using** `EncodingMode` → **Decrypt** → **Interpret Bytes according to**
+   * `Charset` → **Output**
+   *
+   * The encoding (e.g. `base64`, `hex`, etc.) is determined by the {@link Crypt2.encodingMode}
+   * property.
+   *
+   * This method supports `symmetric key` and `public key` decryption. For more information on
+   * **properties that affect decryption**, such as {@link Crypt2.cryptAlgorithm}, {@link
+   * Crypt2.cipherMode}, etc., refer to the {@link Crypt2.decryptBd} method documentation.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  decryptStringENC(str: string): string
+
+  /**
+   * Encode binary data to base64, hex, quoted-printable, or URL-encoding. The ARG3 can be set to
+   * any of the following strings: `base64`, `hex`, `quoted-printable`, `url`, `base32`, `Q`, `B`,
+   * `url_rc1738`, `url_rfc2396`, `url_rfc3986`, `url_oauth`, `uu`, `modBase64`, or `html` (for HTML
+   * entity encoding).
+   *
+   * The `byteData` points to the bytes to be encoded. The `encoding` specifies the number of bytes
+   * to encode.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  encodeBytes(byteData: ArrayBuffer, encoding: string): string
+
+  /**
+   * Binary encodes a string. The `toEncodingName` can be set to **any of the binary encodings
+   * supported by Chilkat**, such as `base64`, `hex`, etc. (see the link below for the full list of
+   * encodings). The `charsetName`, such as `"utf-8"`, determines the bytes that are encoded.
+   *
+   * The `toEncodingName` can also be set to the value `html` for HTML entity encoding.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  encodeString(strToEncode: string, charsetName: string, toEncodingName: string): string
+
+  /**
+   * Encrypts binary-encoded data and returns it as a binary-encoded string.  For example:
+   *
+   * **Input** → **Decode** `EncodingMode` → **Encrypt** → **Encode** `EncodingMode` → **Output**
+   *
+   * The encoding (e.g. `base64`, `hex`, etc.) is determined by the {@link Crypt2.encodingMode}
+   * property.
+   *
+   * This method supports `symmetric key` and `public key` decryption. For more information on
+   * **properties that affect decryption**, such as {@link Crypt2.cryptAlgorithm}, {@link
+   * Crypt2.cipherMode}, etc., refer to the method documentation.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  encryptEncoded(str: string): string
+
+  /**
+   * Encrypts the `str` and returns the encrypted bytes as a binary encoded string. The {@link
+   * Crypt2.charset} property determines the actual bytes that are encrypted.
+   *
+   * **Input** → **Get bytes according to** `Charset` → **Encrypt** → **Encode using**
+   * `EncodingMode` → **Output**
+   *
+   * The encoding (e.g. `base64`, `hex`, etc.) is determined by the {@link Crypt2.encodingMode}
+   * property.
+   *
+   * This method supports `symmetric key` and `public key` encryption. For more information on
+   * **properties that affect encryption**, such as {@link Crypt2.cryptAlgorithm}, {@link
+   * Crypt2.cipherMode}, etc., refer to the {@link Crypt2.encryptBd} method documentation.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  encryptStringENC(str: string): string
+
+  /**
+   * Generates `numBytes` random bytes and returns them as an encoded string. The encoding format
+   * (e.g., base64, hex) is determined by the {@link Crypt2.encodingMode} property. It utilizes the
+   * `Fortuna` cryptographically secure random number generator, auto-seeded by an OS-dependent
+   * secure entropy source.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  genRandomBytesENC(numBytes: number): string
+
+  /**
+   * Generates a random UUID string having standard UUID format, such as
+   * `de305d54-75b4-431b-adb2-eb6b9e546014`.
+   *
+   * Note: This generates a `version 4 UUID` using random byte values.  See RFC 4122.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  generateUuid(): string
+
+  /**
+   * When encrypting in `GCM` mode, Chilkat generates the `GCM authentication tag`. The application
+   * can then use this method to retrieve the tag, which should be sent to the decrypting party
+   * along with the encrypted data. For further details on GCM authenticated encryption, please
+   * refer to the web pages linked below.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  getEncodedAuthTag(encoding: string): string
+
+  /**
+   * This method retrieves the IV set by the application during the last call to {@link
+   * Crypt2.setEncodedIV} or {@link Crypt2.randomizeIV}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  getEncodedIV(encoding: string): string
+
+  /**
+   * This method retrieves the signing time of the Nth certificate in a digital signature after
+   * verification. The signing time for the first certificate is at index 0. The {@link
+   * Crypt2.numSignerCerts} property indicates the total number of signing certificates, although
+   * typically only one is used.
+   *
+   * Note: Before accessing the signing time, use the {@link Crypt2.hasSignatureSigningTime} method
+   * to verify its availability, and skip indices lacking a signing time. The signing time is
+   * returned in `RFC822 string format`.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  getSignatureSigningTimeStr(index: number): string
+
+  /**
+   * After verifying a digital signature with a signature verification method, you can call this
+   * method. It returns `true` if the signing time for the Nth certificate is available and can be
+   * accessed using the {@link Crypt2.getSignatureSigningTimeStr} method.
+   */
+  hasSignatureSigningTime(index: number): boolean
+
+  /**
+   * To hash a large amount of text, start by processing the first chunk using this method. For
+   * subsequent chunks, use the {@link Crypt2.hashMoreString} method as needed. Conclude by calling
+   * {@link Crypt2.hashFinalENC} to obtain the final result. The hash algorithm is determined by the
+   * {@link Crypt2.hashAlgorithm} property setting.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hashBeginString(strData: string): void
+
+  /**
+   * Hashes a file and returns the hash as an encoded string.
+   *
+   * The hash algorithm is specified by the `HashAlgorithm` property, The encoding is controlled by
+   * the `EncodingMode` property, which can be set to `base64`, `hex`, `base64url`, or any of the
+   * encodings listed at the link below.
+   *
+   * Any size file is supported because the file is hashed internally in streaming mode (keeping
+   * memory usage low and constant).
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.hashFileENCAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hashFileENC(path: string): string
+
+  /**
+   * Asynchronous form of {@link Crypt2.hashFileENC}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hashFileENCAsync(path: string): Promise<string>
+
+  /**
+   * Finalizes a multi-step hash computation and returns the hash bytes encoded according to the
+   * {@link Crypt2.encodingMode} property setting.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hashFinalENC(): string
+
+  /**
+   * Adds more text to the hash currently under computation.  (See {@link Crypt2.hashBeginString})
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hashMoreString(strData: string): void
+
+  /**
+   * Hashes the `str` and returns the hash as a binary encoded string. The {@link Crypt2.charset}
+   * property determines the actual bytes that are hashed.
+   *
+   * **Input** → **Get bytes according to** `Charset` → **Hash** → **Encode using** `EncodingMode` →
+   * **Output**
+   *
+   * The encoding (e.g. `base64`, `hex`, etc.) is determined by the {@link Crypt2.encodingMode}
+   * property.
+   *
+   * The hash algorithm is determined by the {@link Crypt2.hashAlgorithm} property.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hashStringENC(str: string): string
+
+  /**
+   * Computes a Message Authentication Code (MAC) and returns it as a binary encoded string. The MAC
+   * algorithm is defined by the {@link Crypt2.macAlgorithm} property. The {@link Crypt2.charset}
+   * property determines the actual bytes that are hashed.
+   *
+   * **Input** → **Get bytes according to** `Charset` → **MAC** → **Encode using** `EncodingMode` →
+   * **Output**
+   *
+   * The encoding (e.g. `base64`, `hex`, etc.) is determined by the {@link Crypt2.encodingMode}
+   * property.
+   *
+   * The hash algorithm is determined by the {@link Crypt2.hashAlgorithm} property. The secret key
+   * must be set beforehand by calling {@link Crypt2.setMacKeyEncoded}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  macStringENC(inText: string): string
+
+  /**
+   * Matches `MySQL`'s `AES_DECRYPT` function. `strEncryptedHex` is a hex-encoded AES-encrypted
+   * string, and the return value is the original unencrypted string.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  mySqlAesDecrypt(strEncryptedHex: string, strPassword: string): string
+
+  /**
+   * This function replicates `MySQL`'s `AES_ENCRYPT`, returning the encrypted data as a hex-encoded
+   * string. In MySQL, this is done using: `HEX(AES_ENCRYPT('The quick brown fox jumps over the lazy
+   * dog', 'password'))`.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  mySqlAesEncrypt(strData: string, strPassword: string): string
+
+  /**
+   * Digitally signs a string and returns `PKCS#7 signed-data` as a `binary encoded string`. The
+   * {@link Crypt2.encodingMode} property determines the binary encoding, such as `base64`, `hex`,
+   * `hex_lower`, `base64_mime`, etc. The {@link Crypt2.charset} property determines the actual
+   * bytes that are hashed and signed. The {@link Crypt2.hashAlgorithm} property specifies the hash
+   * algorithm for creating the data's hash during signing.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.opaqueSignStringENCAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  opaqueSignStringENC(str: string): string
+
+  /**
+   * Asynchronous form of {@link Crypt2.opaqueSignStringENC}: the same call on a native worker
+   * thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  opaqueSignStringENCAsync(str: string): Promise<string>
+
+  /**
+   * This function verifies a `PKCS#7 signed-data` binary-encoded signature and returns the original
+   * text data. The {@link Crypt2.encodingMode} property determines how `p7m` is decoded to bytes.
+   * If the signature does not verify successfully, it returns an empty string. The {@link
+   * Crypt2.charset} property specifies how the original data bytes are converted to characters. You
+   * can obtain signer certificates using the {@link Crypt2.numSignerCerts} property and the {@link
+   * Crypt2.lastSignerCert} method.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  opaqueVerifyStringENC(p7m: string): string
+
+  /**
+   * This function implements the `PBKDF1` (Password-Based Key Derivation Function #1) algorithm.
+   * Follow these guidelines to use it:
+   *
+   * -
+   * **`password`** (the password) is first converted using the character encoding specified by
+   * **`charset`** before being processed by the key derivation function.
+   *
+   * -
+   * **`hashAlg`** specifies the hash function to use, such as `md5`, `sha1`, or `md2`.
+   *
+   * -
+   * **`salt`** represents the salt, which should be random data of at least 8 bytes (64 bits). You
+   * can use the {@link Crypt2.genRandomBytesENC} method to generate this.
+   *
+   * -
+   * **`iterationCount`** sets the iteration count, which must be a minimum of 1000.
+   *
+   * -
+   * **`outputKeyBitLen`** determines the length (in bits) of the derived key.
+   *
+   * -
+   * **`encoding`** defines the output encoding format, such as `base64` or `hex`, and also the
+   * expected encoding of **`salt`** (the salt).
+   *
+   * The function returns the derived key.
+   *
+   * Note: If `charset` is specified as hex or base64, the password (`password`) will be treated as
+   * binary data encoded in that format. It will be decoded into binary form and used directly as
+   * such.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  pbkdf1(password: string, charset: string, hashAlg: string, salt: string, iterationCount: number, outputKeyBitLen: number, encoding: string): string
+
+  /**
+   * Implements the `PBKDF2` algorithm as follows:
+   *
+   * - Convert `password` to the character encoding specified by `charset` before using it in the
+   *   key derivation function.
+   *
+   * - `hashAlg` specifies the hash algorithm. Options include `sha256`, `sha384`, `sha512`, `md5`,
+   *   `sha1`, `md2`, or any algorithm listed in the HashAlgorithm property.
+   *
+   * - Provide a random `salt` value that is at least 8 bytes (64 bits) long. Use methods like
+   *   {@link Crypt2.genRandomBytesENC} to generate this salt value.
+   *
+   * - Ensure `iterationCount` is 1000 or greater.
+   *
+   * - Control the length of the derived key output using `outputKeyBitLen`.
+   *
+   * - Set `encoding` to specify the encoding format for the output and the expected encoding for
+   *   `salt`. Options include `base64` and `hex`.
+   *
+   * The derived key is the output of this process. Internally, PBKDF2 uses a pseudorandom function
+   * (PRF), specifically a keyed HMAC. The hash algorithm chosen with `hashAlg` dictates this PRF;
+   * for example, `SHA256` uses HMAC-SHA256, while `SHA1` uses HMAC-SHA1.
+   *
+   * Note: If `charset` is `hex` or `base64`, `password` is treated as binary data. It will be
+   * decoded and used directly as a binary password.
+   * `SHA256` uses HMAC-SHA256, while `SHA1` uses HMAC-SHA1.
+   *
+   * PBKDF1 and PBKDF2 are both key derivation functions used to strengthen passwords for
+   * cryptographic purposes, but PBKDF2 is the improved version.
+   *
+   * - **PBKDF1**: Older and limited - it can only generate small keys (up to the hash function’s
+   *   output size), making it less flexible and secure.
+   *
+   * - **PBKDF2**: More advanced - it can generate longer keys, is more resistant to attacks, and is
+   *   widely recommended for modern security needs.
+   *
+   * In short, `PBKDF2` is stronger and more versatile than `PBKDF1`.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  pbkdf2(password: string, charset: string, hashAlg: string, salt: string, iterationCount: number, outputKeyBitLen: number, encoding: string): string
+
+  /**
+   * Sets the initialization vector (IV) to a random value. The {@link Crypt2.cryptAlgorithm}
+   * property should be set prior to calling this method.
+   *
+   * A **random IV** is used in symmetric encryption (like AES-CBC or AES-GCM) to ensure that
+   * encrypting the same plaintext with the same key produces **different ciphertext each time**.
+   * This prevents attackers from recognizing patterns in encrypted data and strengthens security.
+   *
+   * **Why use a random IV?**
+   *
+   * - It ensures **semantic security** (i.e. same plaintext never results in same ciphertext).
+   *
+   * - Prevents replay and pattern attacks.
+   *
+   * - Especially important in modes like **CBC** and **GCM**.
+   *
+   * **How is the IV sent to the decrypting party?**
+   *
+   * The IV is **not secret**, but it must be **available** for decryption. Common methods:
+   *
+   * - **Prepended** to the ciphertext (e.g., `IV || ciphertext`)
+   *
+   * - **Sent in a separate field** (e.g., JSON field, HTTP header)
+   *
+   * - **Concatenated and encoded** (e.g., base64 of IV + ciphertext)
+   *
+   * At the receiving side, the decryptor **extracts the IV** and uses it with the shared key to
+   * decrypt the ciphertext correctly.
+   */
+  randomizeIV(): void
+
+  /**
+   * This method converts between different encodings, such as from `base64` to `hex`. Each argument
+   * can be **any binary encoding supported by Chilkat**.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  reEncode(encodedData: string, fromEncoding: string, toEncoding: string): string
+
+  /**
+   * Sets the digital certificate for decryption when the {@link Crypt2.cryptAlgorithm} property is
+   * set to `"pki"`. This method requires that the certificate has a private key.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  setDecryptCert(cert: Cert): void
+
+  /**
+   * Sets the digital certificate and associated private key for decryption when the {@link
+   * Crypt2.cryptAlgorithm} property is set to `"pki"`. The private key must be the one that matches
+   * the certificate's public key.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  setDecryptCert2(cert: Cert, key: PrivateKey): void
+
+  /**
+   * Sets the optional authenticated additional data (`AAD`) for AES encryption in `GCM` mode. The
+   * data is provided as a binary-encoded string using the specified `encoding`, and any binary
+   * encoding supported by Chilkat can be used.
+   *
+   * In GCM (Galois/Counter Mode) encryption, AAD (Additional Authenticated Data) is optional input
+   * that is not encrypted but is authenticated along with the ciphertext. It's used to verify
+   * integrity of associated data like headers or metadata. If AAD is modified, decryption will fail
+   * due to authentication tag mismatch.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  setEncodedAad(aadStr: string, encoding: string): void
+
+  /**
+   * In GCM mode, the authentication tag is a short value (e.g. 16 bytes) **generated during
+   * encryption** that ensures the integrity and authenticity of both the ciphertext and any AAD. It
+   * must be verified during decryption to confirm the data hasn't been altered.
+   *
+   * When decrypting AES-GCM, applications must call this method to provide the expected
+   * authentication tag.
+   *
+   * To prevent Chilkat from checking the authentication tag after decryption, you can set the
+   * authentication tag to the special `hex` value `FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF` (16 bytes of
+   * 0xFF).
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  setEncodedAuthTag(authTagStr: string, encoding: string): void
+
+  /**
+   * Sets the initialization vector used in **symmetric encrpytion** (`AES`, `Blowfish`, etc.) from
+   * a binary-encoded string using any Chilkat-supported encoding method (e.g., `base64`, `hex`).
+   *
+   * An **Initialization Vector (IV)** is a random or unique value used in symmetric encryption to
+   * ensure that encrypting the same plaintext multiple times produces different ciphertexts. It
+   * prevents pattern leakage.
+   *
+   * **Cipher Modes That Require an IV:**
+   *
+   * - `CBC` (Cipher Block Chaining)
+   *
+   * - `CFB` (Cipher Feedback)
+   *
+   * - `OFB` (Output Feedback)
+   *
+   * - `CTR` (Counter Mode)
+   *
+   * - `GCM` (Galois/Counter Mode)
+   *
+   * **ECB (Electronic Codebook)** does \*not\* use an IV, which makes it less secure.
+   */
+  setEncodedIV(ivStr: string, encoding: string): void
+
+  /**
+   * Sets the encryption key used in **symmetric encryption** (`AES`, `Blowfish`, etc.) from a
+   * binary-encoded string using any Chilkat-supported encoding method (e.g., `base64`, `hex`).
+   *
+   * The key must have a byte size equal to the {@link Crypt2.keyLength} property. For instance, a
+   * KeyLength of `128 bits` requires a `16-byte` key, and a KeyLength of `256 bits` requires a
+   * `32-byte` key.
+   */
+  setEncodedKey(keyStr: string, encoding: string): void
+
+  /**
+   * Sets the `pbes2` or `pbes1` salt bytes from a binary-encoded string using any Chilkat-supported
+   * encoding method (e.g., `base64`, `hex`).
+   *
+   * This salt is used for encryption and decryption when the {@link Crypt2.cryptAlgorithm} property
+   * is set to `pbes1` or `pbes2`. Note: This does not apply to the {@link Crypt2.pbkdf1} or {@link
+   * Crypt2.pbkdf2} methods, where the salt is provided as a function argument.
+   */
+  setEncodedSalt(saltStr: string, encoding: string): void
+
+  /**
+   * Instructs the encryption library to use a specified digital certificate for public-key
+   * encryption. To encrypt using multiple certificates, call {@link Crypt2.addEncryptCert} for each
+   * one. This action is equivalent to calling {@link Crypt2.clearEncryptCerts} before {@link
+   * Crypt2.addEncryptCert}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  setEncryptCert(cert: Cert): void
+
+  /**
+   * Sets the initialization vector (IV) for a symmetric encryption algorithm like AES.
+   */
+  setIV(byteData: ArrayBuffer): void
+
+  /**
+   * Sets the MAC key from a binary-encoded string using any Chilkat-supported encoding method
+   * (e.g., `base64`, `hex`).
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  setMacKeyEncoded(key: string, encoding: string): void
+
+  /**
+   * Sets the MAC key from a string. The {@link Crypt2.charset} property determines the actual bytes
+   * used for the MAC key.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  setMacKeyString(key: string): void
+
+  /**
+   * Sets the encryption key used in **symmetric encrpytion** (`AES`, `Blowfish`, etc.).
+   *
+   * The key must have a byte size equal to the {@link Crypt2.keyLength} property. For instance, a
+   * KeyLength of `128 bits` requires a `16-byte` key, and a KeyLength of `256 bits` requires a
+   * `32-byte` key.
+   */
+  setSecretKey(byteData: ArrayBuffer): void
+
+  /**
+   * Sets the digital certificate to be used for signing. Signing requires that the certificate has
+   * a private key.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  setSigningCert(cert: Cert): void
+
+  /**
+   * Sets the digital certificate and associated private key for signing. The private key must be
+   * the one that matches the certificate's public key.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  setSigningCert2(cert: Cert, privateKey: PrivateKey): void
+
+  /**
+   * Assigns the digital certificate for signature verification. Typically, a PKCS7 (CMS) signature
+   * includes the signing certificate information, making it **unnecessary to call this method
+   * explicitly**. This is only required in rare instances.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  setVerifyCert(cert: Cert): void
+
+  /**
+   * Digitally signs a string and returns a `detached` signature (`PKCS#7 signed-data`) as a
+   * binary-encoded string. The {@link Crypt2.encodingMode} property determines the binary-encoding.
+   * Possible encodings include `base64`, `base64_mime`, `hex`, and `hex_lower`. The {@link
+   * Crypt2.hashAlgorithm} property specifies the hash algorithm for creating the data's hash during
+   * signing. The {@link Crypt2.charset} property determines the actual bytes that are hashed and
+   * signed.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.signStringENCAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  signStringENC(str: string): string
+
+  /**
+   * Asynchronous form of {@link Crypt2.signStringENC}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  signStringENCAsync(str: string): Promise<string>
+
+  /**
+   * Adds an XML certificate vault to the object's internal list of sources to be searched for
+   * certificates and private keys when encrypting/decrypting or signing/verifying. Unlike the
+   * AddPfxSourceData and AddPfxSourceFile methods, only a single XML certificate vault can be used.
+   * If UseCertVault is called multiple times, only the last certificate vault will be used, as each
+   * call to UseCertVault will replace the certificate vault provided in previous calls.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  useCertVault(vault: XmlCertVault): void
+
+  /**
+   * Verifies an `opaque digital signature` contained in a `.p7m` file and extracts the original
+   * data to `destPath`. Returns `true` if the .p7m is validated and the original data was
+   * extracted. Otherwise returns `false`.
+   *
+   * Afterwards, you can retrieve signer certificates by using the {@link Crypt2.numSignerCerts}
+   * property and the {@link Crypt2.lastSignerCert} method.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  verifyP7M(p7mPath: string, destPath: string): void
+
+  /**
+   * Verifies a `detached digital signature` contained in a `.p7s` file against the original data
+   * contained in `originalDataPath`. Returns `true` if the signature is verified.
+   *
+   * Afterwards, you can retrieve signer certificates by using the {@link Crypt2.numSignerCerts}
+   * property and the {@link Crypt2.lastSignerCert} method.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  verifyP7S(originalDataPath: string, p7sPath: string): void
+
+  /**
+   * Verifies a `detached digital signature` against the original text in `str`. Returns `true` if
+   * the signature is verified. The `encodedSig` holds a binary-encoded `PKCS#7 signed-data`
+   * detached signature. The type of binary encoding, such as `base64,` `hex,` or `base64_mime,` is
+   * determined by the {@link Crypt2.encodingMode} property. The {@link Crypt2.charset} property
+   * determines how the text in `str` is converted to bytes for signature validation.
+   *
+   * Afterwards, you can retrieve signer certificates by using the {@link Crypt2.numSignerCerts}
+   * property and the {@link Crypt2.lastSignerCert} method.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  verifyStringENC(str: string, encodedSig: string): void
+
+  /**
+   * Computes and returns a bcrypt hash of the `password`. The number of rounds of hashing is
+   * determined by the `BCryptWorkFactor` property.
+   *
+   * Starting in v9.5.0.76, if the `password` is prefixed with `$2b$` then the output will use the
+   * $2b version of bcrypt. For example, to create a `$2b$` bcrypt has for the password `secret`,
+   * pass in the string `$2b$secret` for `password`.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  bCryptHash(password: string): string
+
+  /**
+   * Verifies the `password` against a previously computed BCrypt hash. Returns `true` if the
+   * password matches the `bcryptHash`. Returns `false` if the password does not match.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  bCryptVerify(password: string, bcryptHash: string): void
+
+  /**
+   * Implements the `AES Key Wrap Algorithm` (RFC 3394). The `kek` is the `Key Encryption Key` (the
+   * AES key used to encrypt the `keyData`). The arguments and return value are binary encoded
+   * strings using the encoding specified by `encoding` (which can be `base64`, `hex`, `base64url`,
+   * etc.) The full list of supported encodings is available at the link below.
+   *
+   * The `kek` should be an `AES key` of `16 bytes`, `24 bytes`, or `32 bytes` (i.e. 128-bits, 192-
+   * bits, or 256-bits). For example, if passed as a hex string, then the `kek` should be 32 chars
+   * in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex).
+   *
+   * The `keyData` contains the data to be key wrapped. It must be a multiple of 64-bits in length.
+   * In other words, if the `keyData` is decoded to binary, it should be a number of bytes that is a
+   * multiple of 8.
+   *
+   * The return string, if decoded to binary bytes, is equal to the size of the key data + 8
+   * additional bytes.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  aesKeyWrap(kek: string, keyData: string, encoding: string): string
+
+  /**
+   * Implements the `AES Key Wrap Algorithm` (RFC 3394) for unwrapping. The `kek` is the `Key
+   * Encryption Key` (the AES key used to unwrap the `wrappedKeyData`). The arguments and return
+   * value are binary encoded strings using the encoding specified by `encoding` (which can be
+   * `base64`, `hex`, `base64url`, etc.) The full list of supported encodings is available at the
+   * link below.
+   *
+   * The `kek` should be an `AES key` of `16 bytes`, `24 bytes`, or `32 bytes` (i.e. 128-bits, 192-
+   * bits, or 256-bits). For example, if passed as a hex string, then the `kek` should be 32 chars
+   * in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex).
+   *
+   * The `wrappedKeyData` contains the data to be unwrapped. The result, if decoded, is 8 bytes less
+   * than the wrapped key data. For example, if a 256-bit AES key (32 bytes) is wrapped, the size of
+   * the wrapped key data is 40 bytes. Unwrapping restores it to the original 32 bytes.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  aesKeyUnwrap(kek: string, wrappedKeyData: string, encoding: string): string
+
+  /**
+   * Hashes the bytes in `bd` and returns the hash as a binary-encoded string. The hash algorithm is
+   * determined by the {@link Crypt2.hashAlgorithm} property, while the encoding is specified by the
+   * {@link Crypt2.encodingMode} property. Encoding options include `base64`, `hex`, `base64url`, or
+   * others listed at the link below.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hashBdENC(bd: BinData): string
+
+  /**
+   * Generates a **Message Authentication Code** (MAC) for the bytes in `bd` using the algorithm
+   * defined by the {@link Crypt2.macAlgorithm} property. The resulting MAC is encoded into a string
+   * based on the {@link Crypt2.encodingMode} property (e.g., `base64` or `hex`). The {@link
+   * Crypt2.hashAlgorithm} property determines the internal hash function. Before generating the
+   * MAC, specify the secret key using {@link Crypt2.setMacKeyEncoded}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  macBdENC(bd: BinData): string
+
+  /**
+   * Encrypts the contents of `bd`. This method can do either `symmetric key encryption` or `CMS
+   * public key encryption` (e.g., `PKCS#7 EnvelopedData`).
+   *
+   * Before calling this method for `symmetric key encryption` (e.g., `AES`, `ChaCha20`, `Blowfish`,
+   * etc.), ensure the following setup:
+   *
+   * - Define the encryption algorithm using the {@link Crypt2.cryptAlgorithm} property.
+   *
+   * - Specify the encryption key length with the {@link Crypt2.keyLength} property.
+   *
+   * - Establish the cipher mode through the {@link Crypt2.cipherMode} property.
+   *
+   * - Use the {@link Crypt2.setEncodedIV} method to set the IV, if needed by the cipher mode.
+   *
+   * - Set the encryption key with the {@link Crypt2.setEncodedKey} method.
+   *
+   * - Set the {@link Crypt2.paddingScheme} property if needing something different than the
+   *   default.
+   *
+   * When calling this method for `public key encryption` (i.e. creating a `PKCS7 CMS message`), the
+   * following setup is required:
+   *
+   * - The {@link Crypt2.cryptAlgorithm} property should be set to the string `"pki"`.
+   *
+   * - To specify the encryption certificate, use {@link Crypt2.setEncryptCert}. For multiple
+   *   certificates, call {@link Crypt2.addEncryptCert} for each one.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  encryptBd(bd: BinData): void
+
+  /**
+   * Decrypts the contents of `bd`. This method can do either `symmetric key decryption` or `CMS
+   * public key decryption` (e.g., `PKCS#7 EnvelopedData`).
+   *
+   * Before calling this method for `symmetric key decryption` (e.g., `AES`, `ChaCha20`, `Blowfish`,
+   * etc.), ensure the following setup:
+   *
+   * - Define the encryption algorithm using the `CryptAlgorithm` property.
+   *
+   * - Specify the encryption key length with the `KeyLength` property.
+   *
+   * - Establish the cipher mode through the `CipherMode` property.
+   *
+   * - Use the `SetEncodedIV` method to set the IV, if needed by the cipher mode.
+   *
+   * - Set the encryption key with the `SetEncodedKey` method.
+   *
+   * - Ensure the `PaddingScheme` property matches the encryptor's value.
+   *
+   * When calling this method for `public key decryption` (i.e. decrypting a `PKCS7 CMS message`),
+   * the following setup is required:
+   *
+   * - The `CryptAlgorithm` property should be set to the string `"pki"`.
+   *
+   * - Optionally specify the certificate to be used for decryption by calling `SetDecryptCert`. If
+   *   SetDecryptCert is not called, then Chilkat will automatically search certificate sources
+   *   (`Windows certificate stores`, `Apple keychain`, etc.) for the required certificate.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  decryptBd(bd: BinData): void
+
+  /**
+   * Encrypts text and appends the encrypted bytes in `bdOut`.
+   * The {@link Crypt2.charset} property, such as `utf-8`, determines the actual bytes that are
+   * encrypted.
+   *
+   * `StringBuilder` → **Get bytes according to** `Charset` → **Encrypt** → **Append to ** `BinData`
+   *
+   * This method supports `symmetric key` and `public key` encryption. For more information on
+   * **properties that affect encryption**, such as {@link Crypt2.cryptAlgorithm}, {@link
+   * Crypt2.cipherMode}, etc., refer to the {@link Crypt2.encryptBd} method documentation.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  encryptSb(sbIn: StringBuilder, bdOut: BinData): void
+
+  /**
+   * This function is intended for use when the **expected decrypted output is text**. It decrypts
+   * the contents of `bdIn` and appends the resulting string to `sbOut`. Ensure that the {@link
+   * Crypt2.charset} property, such as `utf-8,` matches the one used during encryption to interpret
+   * the decrypted bytes correctly as characters.
+   *
+   * **Input** → **Decrypt** → **Interpret Bytes according to** `Charset` → **Append to
+   * StringBuilder**
+   *
+   * This method supports `symmetric key` and `public key` decryption. For more information on
+   * **properties that affect decryption**, such as {@link Crypt2.cryptAlgorithm}, {@link
+   * Crypt2.cipherMode}, etc., refer to the {@link Crypt2.decryptBd} method documentation.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  decryptSb(bdIn: BinData, sbOut: StringBuilder): void
+
+  /**
+   * Digitally signs the content in `dataToSign` and returns a `detached` signature (`PKCS#7
+   * signed-data`) as a binary-encoded string. The {@link Crypt2.encodingMode} property determines
+   * the binary-encoding. Possible encodings include `base64`, `base64_mime`, `hex`, and
+   * `hex_lower`. The {@link Crypt2.hashAlgorithm} property specifies the hash algorithm for
+   * creating the data's hash during signing.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.signBdENCAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  signBdENC(dataToSign: BinData): string
+
+  /**
+   * Asynchronous form of {@link Crypt2.signBdENC}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  signBdENCAsync(dataToSign: BinData): Promise<string>
+
+  /**
+   * Digitally signs the text contained in `sb` and returns a `detached` signature (`PKCS#7
+   * signed-data`) as a binary-encoded string. The {@link Crypt2.encodingMode} property determines
+   * the binary-encoding. Possible encodings include `base64`, `base64_mime`, `hex`, and
+   * `hex_lower`. The {@link Crypt2.hashAlgorithm} property specifies the hash algorithm for
+   * creating the data's hash during signing. The {@link Crypt2.charset} property determines the
+   * actual bytes that are hashed and signed.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.signSbENCAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  signSbENC(sb: StringBuilder): string
+
+  /**
+   * Asynchronous form of {@link Crypt2.signSbENC}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  signSbENCAsync(sb: StringBuilder): Promise<string>
+
+  /**
+   * Digitally signs the contents of `bd`. If successful, the contents of `bd` are replaced with the
+   * `PKCS#7 signed-data`, which embeds the original data within the signature. Ensure a certificate
+   * is set using {@link Crypt2.setSigningCert} before invoking this method. The {@link
+   * Crypt2.hashAlgorithm} property specifies the hash algorithm for creating the data's hash during
+   * signing.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.opaqueSignBdAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  opaqueSignBd(bd: BinData): void
+
+  /**
+   * Asynchronous form of {@link Crypt2.opaqueSignBd}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  opaqueSignBdAsync(bd: BinData): Promise<void>
+
+  /**
+   * The method performs in-place verification of the `PKCS#7 signed-data` content of `bd`. If the
+   * signature is successfully verified, the content of `bd` is replaced with the original data, and
+   * the method returns `true`. If verification fails, `bd` remains unchanged, and the method
+   * returns `false`. Afterwards, you can retrieve signer certificates by using the {@link
+   * Crypt2.numSignerCerts} property and the {@link Crypt2.lastSignerCert} method.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  opaqueVerifyBd(bd: BinData): void
+
+  /**
+   * Verifies a `detached digital signature` against the original data contained in `data`. Returns
+   * `true` if the signature is verified. The `encodedSig` holds a binary-encoded `PKCS#7
+   * signed-data` detached signature. The type of binary encoding, such as `base64,` `hex,` or
+   * `base64_mime,` is determined by the {@link Crypt2.encodingMode} property.
+   *
+   * Afterwards, you can retrieve signer certificates by using the {@link Crypt2.numSignerCerts}
+   * property and the {@link Crypt2.lastSignerCert} method.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  verifyBdENC(data: BinData, encodedSig: string): void
+
+  /**
+   * Verifies a `detached digital signature` against the original text contained in `sb`. Returns
+   * `true` if the signature is verified. The `encodedSig` holds a binary-encoded `PKCS#7
+   * signed-data` detached signature. The type of binary encoding, such as `base64,` `hex,` or
+   * `base64_mime,` is determined by the {@link Crypt2.encodingMode} property. The {@link
+   * Crypt2.charset} property determines how the text in `sb` is converted to bytes for signature
+   * validation.
+   *
+   * Afterwards, you can retrieve signer certificates by using the {@link Crypt2.numSignerCerts}
+   * property and the {@link Crypt2.lastSignerCert} method.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  verifySbENC(sb: StringBuilder, encodedSig: string): void
+
+  /**
+   * Encrypts the secure string and returns the encrypted bytes as a binary encoded string. The
+   * {@link Crypt2.charset} property determines the actual bytes that are encrypted.
+   *
+   * `SecureString` → **Get bytes according to** `Charset` → **Encrypt** → **Encode using**
+   * `EncodingMode` → **Output**
+   *
+   * The encoding (e.g. `base64`, `hex`, etc.) is determined by the {@link Crypt2.encodingMode}
+   * property.
+   *
+   * This method supports `symmetric key` and `public key` encryption. For more information on
+   * **properties that affect encryption**, such as {@link Crypt2.cryptAlgorithm}, {@link
+   * Crypt2.cipherMode}, etc., refer to the {@link Crypt2.encryptBd} method documentation.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  encryptSecureENC(secureStr: SecureString): string
+
+  /**
+   * This function is intended for use when the **expected decrypted output is text**. It decrypts
+   * binary encoded encrypted bytes passed in `cipherText` and appends the resulting string to
+   * `secureStr`. Ensure that the {@link Crypt2.charset} property, such as `utf-8,` matches the one
+   * used during encryption to interpret the decrypted bytes correctly as characters.
+   *
+   * **Input** → **Decode using** `EncodingMode` → **Decrypt** → **Interpret Bytes according to**
+   * `Charset` → **Append to Secure String**
+   *
+   * The encoding (e.g. `base64`, `hex`, etc.) is determined by the {@link Crypt2.encodingMode}
+   * property.
+   *
+   * This method supports `symmetric key` and `public key` decryption. For more information on
+   * **properties that affect decryption**, such as {@link Crypt2.cryptAlgorithm}, {@link
+   * Crypt2.cipherMode}, etc., refer to the {@link Crypt2.decryptBd} method documentation.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  decryptSecureENC(cipherText: string, secureStr: SecureString): void
+
+  /**
+   * Extracts the signed (authenticated) attributes for the Nth signer, where `signerIndex` is
+   * typically 0, as most signatures have only one signer.
+   *
+   * Provide the binary PKCS7 in `pkcs7Der`. If successful, `sbJson` will hold the signed attributes
+   * in JSON format.
+   *
+   * Sample JSON output:
+   *
+   * ```
+   * {
+   *   "signedAttributes": [
+   *     {
+   *       "oid": "1.2.840.113549.1.9.3",
+   *       "name": "Content Type"
+   *     },
+   *     {
+   *       "oid": "1.2.840.113549.1.9.5",
+   *       "name": "Signing Time"
+   *     },
+   *     {
+   *       "oid": "1.2.840.113549.1.9.4"
+   *       "name": "Message Digest"
+   *     },
+   *     {
+   *       "oid": "1.2.840.113549.1.9.16.2.47",
+   *       "name": "Signing Certificate V2"
+   *     }
+   *   ]
+   * }
+   * ```
+   */
+  getSignedAttributes(signerIndex: number, pkcs7Der: BinData, sbJson: StringBuilder): boolean
+
+  /**
+   * Implements RFC 4226: HOTP: An HMAC-Based One-Time Password Algorithm. The arguments to this
+   * method are:
+   *
+   * - `secret`: The shared secret in an enocded representation such as base64, hex, ascii, etc.
+   *
+   * - `secretEnc`: The encoding of the shared secret, such as `base64`
+   *
+   * - `counterHex`: The 8-byte counter in hexidecimal format.
+   *
+   * - `numDigits`: The number of decimal digits to return.
+   *
+   * - `truncOffset`: Normally set this to -1 for dynamic truncation. Otherwise can be set in the
+   *   range 0..15.
+   *
+   * - `hashAlg`: Normally set to `sha1`. Can be set to other hash algorithms such as `sha256`,
+   *   `sha512`, etc.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hotp(secret: string, secretEnc: string, counterHex: string, numDigits: number, truncOffset: number, hashAlg: string): string
+
+  /**
+   * Encodes an integer to N bytes and returns in the specified encoding. If `littleEndian` is
+   * `true`, then `little-endian` byte ordering is used. Otherwise `big-endian` byte order is used.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  encodeInt(value: number, numBytes: number, littleEndian: boolean, encoding: string): string
+
+  /**
+   * Implements RFC 6238: TOTP: Time-Based One-Time Password Algorithm. The arguments to this method
+   * are:
+   *
+   * - `secret`: The shared secret in an enocded representation such as base64, hex, ascii, etc.
+   *
+   * - `secretEnc`: The encoding of the shared secret, such as `base64`
+   *
+   * - `t0`: The Unix time to start counting time steps. It is a number in decimal string form. A
+   *   Unix time is the number of seconds elapsed since midnight UTC of January 1, 1970. `0` is a
+   *   typical value used for this argument.
+   *
+   * - `tNow`: The current Unix time in decimal string form. To use the current system date/time,
+   *   pass an empty string for this argument.
+   *
+   * - `tStep`: The time step in seconds. A typical value is 30. Note: Both client and server must
+   *   pre-agree on the secret, the t0, and the tStep.
+   *
+   * - `numDigits`: The number of decimal digits to return.
+   *
+   * - `truncOffset`: Normally set this to -1 for dynamic truncation. Otherwise can be set in the
+   *   range 0..15.
+   *
+   * - `hashAlg`: Normally set to `sha1`. Can be set to other hash algorithms such as `sha256`,
+   *   `sha512`, etc.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  totp(secret: string, secretEnc: string, t0: string, tNow: string, tStep: number, numDigits: number, truncOffset: number, hashAlg: string): string
+
+  /**
+   * If timestamp server communications are needed for signing and special Internet settings like a
+   * proxy server are necessary, this method can provide an Http object configured with these
+   * settings.
+   */
+  setTsaHttpObj(http: Http): void
+
+  /**
+   * To hash binary data in chunks, start by hashing the first chunk using this method. For
+   * additional chunks, use the `HashMoreBytes` method as needed. Complete the process with
+   * `HashFinal` or {@link Crypt2.hashFinalENC} to obtain the hash result. The hash algorithm used
+   * is determined by the {@link Crypt2.hashAlgorithm} property setting.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hashBeginBytes2(byteData: ArrayBuffer): void
+
+  /**
+   * The same as HashMoreBytes except the binary data is passed via a pointer and length.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hashMoreBytes2(byteData: ArrayBuffer): void
+
+  /**
+   * Call this method once per certificate to add `multiple certificates for signing`. If signing
+   * with a single certificate, then the `SetSigningCert` or `SetSigningCert2` methods can be used
+   * instead.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  addSigningCert(cert: Cert): void
+
+  /**
+   * Clears the set of certificates to be used in signing.
+   */
+  clearSigningCerts(): void
+
+  /**
+   * Co-sign's an existing CMS signature. `bdIn` contains the existing CMS signature. If successful,
+   * `cert` is the output co-signed CMS signature.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  coSign(bdIn: BinData, cert: Cert, bdOut: BinData): void
+
+  /**
+   * Digitally signs a pre-computed hash and returns a `detached` signature (`PKCS#7 signed-data`)
+   * as a binary-encoded string. The {@link Crypt2.encodingMode} property determines the
+   * binary-encoding. Possible encodings include `base64`, `base64_mime`, `hex`, and `hex_lower`
+   *
+   * `encodedHash` is a binary-encoded hash to be signed, with its encoding format specified by
+   * `hashEncoding` (e.g., `base64`, `hex`). `hashAlg` specifies the hash algorithm (e.g., `sha256`,
+   * `sha1`, `sha512`) used for `encodedHash`.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link Crypt2.signHashENCAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  signHashENC(encodedHash: string, hashAlg: string, hashEncoding: string): string
+
+  /**
+   * Asynchronous form of {@link Crypt2.signHashENC}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link Crypt2.abort} (which cancels it) and the {@link Crypt2.onPercentDone} /
+   * {@link Crypt2.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  signHashENCAsync(encodedHash: string, hashAlg: string, hashEncoding: string): Promise<string>
+
+  /**
+   * Sets the XTS-AES mode tweak value from an encoded string. The encoding argument can be set to
+   * any of the following strings: `base64`, `hex`, `quoted-printable`, `ascii`, or `url`.
+   *
+   * The tweak value must be 16 bytes in length. An application can set the initial tweak value by
+   * calling this method, or by calling XtsSetDataUnitNumber (but not both).
+   */
+  xtsSetEncodedTweakValue(tweak: string, encoding: string): void
+
+  /**
+   * Sets the XTS-AES mode data unit number. The data unit number is a 64-bit unsigned integer. It
+   * is passed in as two 32-bit unsigned integers representing the high and low 32-bits.
+   *
+   * Setting the data unit number is one way of setting the tweak value. The tweak value is 16 bytes
+   * in length and can alternatively be set by calling XtsSetEncodedTweakValue.
+   *
+   * This method sets the tweak value such that the first 8 bytes are composed of the little-endian
+   * 64-bit data unit number, followed by 8 zero bytes.
+   *
+   * (Unfortunately, Chilkat cannot use 64-bit integers in method arguments because many older
+   * programming environments, such as ActiveX, do not support it. Chilkat must present an identical
+   * and uniform API across all programming languages.)
+   */
+  xtsSetDataUnitNumber(loUint32: number, hiUint32: number): void
+
+  /**
+   * Sets the XTS-AES mode tweak key from an encoded string. The encoding argument can be set to any
+   * of the following strings: `base64`, `hex`, `quoted-printable`, `ascii`, or `url`. The tweak key
+   * should be equal in size to the encryption key. For example, to do 256-bit AES-XTS, the
+   * encryption key is 256-bits, and the tweak key is also 256-bits.
+   */
+  xtsSetEncodedTweakKey(key: string, encoding: string): void
+
+  /**
+   * Implements the `AES Key Wrap with Padding Algorithm` (RFC 5649). The `kek` is the `Key
+   * Encryption Key` (the AES key used to encrypt the `keyData`). The arguments and return value are
+   * binary encoded strings using the encoding specified by `encoding` (which can be `base64`,
+   * `hex`, `base64url`, etc.)
+   *
+   * The `kek` should be an `AES key` of `16 bytes`, `24 bytes`, or `32 bytes` (i.e. 128-bits, 192-
+   * bits, or 256-bits). For example, if passed as a hex string, then the `kek` should be 32 chars
+   * in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex).
+   *
+   * The `keyData` contains the data to be key wrapped.
+   *
+   * Returns the wrapped key using the encoding specified in `encoding`.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  aesKeyWrapWithPadding(kek: string, keyData: string, encoding: string): string
+
+  /**
+   * Implements the `AES Key Wrap with Padding Algorithm` (RFC 5649) for unwrapping. The `kek` is
+   * the `Key Encryption Key` (the AES key used to unwrap the `wrappedKeyData`). The arguments and
+   * return value are binary encoded strings using the encoding specified by `encoding` (which can
+   * be `base64`, `hex`, `base64url`, etc.)
+   *
+   * The `kek` should be an `AES key` of `16 bytes`, `24 bytes`, or `32 bytes` (i.e. 128-bits, 192-
+   * bits, or 256-bits). For example, if passed as a hex string, then the `kek` should be 32 chars
+   * in length, 48 chars, or 64 chars (because each byte is represented as 2 chars in hex).
+   *
+   * The `wrappedKeyData` contains the data to be unwrapped.
+   *
+   * The unwrapped key is returned as an encoded string (using the encoding specified in
+   * `encoding`).
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  aesKeyUnwrapWithPadding(kek: string, wrappedKeyData: string, encoding: string): string
+
+  /**
+   * Offers details on the last method executed. While many methods provide no information, some do
+   * through GetLastJsonData. For instance, after invoking a signature verification method,
+   * GetLastJsonData will return JSON detailing the algorithms used.
+   */
+  getLastJsonData(json: JsonObject): void
+
+  /**
+   * Returns in `cert` the last certificate used for public-key decryption.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  lastDecryptCert(cert: Cert): void
+
+  /**
+   * Retrieves the Nth certificate used for signing in `cert`, where the first certificate is at
+   * index 0. Use this method **after verifying a digital signature** to access the signer
+   * certificates. The {@link Crypt2.numSignerCerts} property indicates the total number of signing
+   * certificates. Usually, only one certificate is used when creating a digital signature.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  lastSignerCert(index: number, cert: Cert): void
+
+  /**
+   * Adds a `PFX` file to the object's list of sources for locating certificates and private keys
+   * during public-key decryption or signing. To add multiple PFX sources, call this method multiple
+   * times. `bd` should contain the bytes of a PFX file (also known as `PKCS12` or `.p12`).
+   *
+   * **Note:** Information about the certificate(s) needed for `public-key decryption` are included
+   * in the `PKCS#7 enveloped-data`. Chilkat will automatically find a usable certificate and
+   * private key from sources like Windows certificate stores, the Apple keychain, or other sources
+   * provided by the application.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  addPfxSourceBd(bd: BinData, password: string): void
+
+  /**
+   * Computes a CRC for data contained in `crcAlg`, which can be either `crc-32` used in the Zip
+   * file format, or `crc8` for the CRC8 algorithm.
+   */
+  crcBd(crcAlg: string, bd: BinData): number
+
+  /**
+   * Start or continue hashing data in chunks. Set `firstChunk` to `true` for the first chunk, and
+   * `false` for subsequent chunks. Finish by calling `HashFinalENC` to obtain the result. The hash
+   * algorithm used is determined by the `HashAlgorithm` property.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  hashChunkBd(firstChunk: boolean, bd: BinData): void
+
+  /**
+   * Derives a key from a password using **Argon2**, the memory-hard key derivation function
+   * specified in RFC 9106. Argon2 is deliberately expensive in both CPU time and memory, which is
+   * what makes a brute-force search of the password space costly.
+   *
+   * `password` is the password. `json` is a JSON string containing the Argon2 options (described
+   * below). The derived key is returned in `bdKey`, which is cleared before the derived key is
+   * stored in it.
+   *
+   * A `salt` member is **required** in `json`. There is no default, because a key derivation salt
+   * is chosen and stored by the application. Use {@link Crypt2.genRandomBytesENC} to generate one.
+   *
+   * Every other member is optional. Passing an empty string for `json` is the same as passing `{}`
+   * and would fail only because no salt was given.
+   *
+   * The JSON is validated strictly before it is used, so malformed JSON is rejected rather than
+   * partially applied. It must be a single JSON object, and every member value must be a simple
+   * value (string, number, `true`, `false` or `null`) -- no Argon2 member takes an object or an
+   * array. Member names are matched exactly, and any member not listed below is an **error** rather
+   * than something ignored. A member given twice, or a member given together with its short alias,
+   * is also an error, because which one would win is ambiguous. All of this is deliberate. A
+   * misspelled name such as `iteration`, a miscapitalized one such as `memoryCostKB`, or a single
+   * missing comma would otherwise be discarded in silence and the default used in its place. For a
+   * cost parameter that is a silent downgrade, and it produces a hash that looks perfectly valid,
+   * so nothing downstream would catch it. The specific problem is reported in the `LastErrorText`.
+   *
+   * - `variant` - `argon2id` (the default), `argon2i`, or `argon2d`. Use `argon2id` unless there is
+   *   a specific reason not to: it combines Argon2i's resistance to side-channel attacks with
+   *   Argon2d's resistance to time-memory tradeoff attacks.
+   *
+   * - `version` - `19` (the default, 0x13) or `16` (0x10). Only set `16` to reproduce a hash made
+   *   by an old implementation.
+   *
+   * - `iterations` - the number of passes over memory, called `t` in RFC 9106. Must be at least 1.
+   *   Defaults to `3`.
+   *
+   * - `memoryCostKb` - the amount of memory used, in KB, called `m` in RFC 9106. Must be at least 8
+   *   times `parallelism`. Defaults to `65536` (64 MB). This is the parameter that does the most to
+   *   make an attack expensive.
+   *
+   * - `parallelism` - the number of lanes, called `p` in RFC 9106. Defaults to `1`. Changing it
+   *   changes the derived key. Chilkat computes all lanes on the calling thread, so raising it does
+   *   not make the computation faster.
+   *
+   * - `keyLen` - the length of the derived key in bytes. Must be between 4 and 1048576. Defaults to
+   *   `32`.
+   *
+   * - `salt` - the salt, which must be at least 8 bytes. 16 random bytes is the usual choice.
+   *
+   * - `secret` - the optional secret value `K` of RFC 9106, often called a `pepper`: a key held by
+   *   the application and **not** stored alongside the hash, so that a stolen database of hashes
+   *   cannot be attacked without it.
+   *
+   * - `ad` - the optional associated data `X` of RFC 9106: additional non-secret data bound into
+   *   the derivation.
+   *
+   * - `encoding` - how the `salt`, `secret` and `ad` members are encoded. Defaults to `base64`. May
+   *   be any encoding Chilkat supports, such as `hex`, or `utf-8` to use the characters of the
+   *   member itself as the bytes.
+   *
+   * - `saltEncoding`, `secretEncoding`, `adEncoding` - override `encoding` for one member.
+   *
+   * - `passwordCharset` - the character encoding the password is converted to before use. Defaults
+   *   to `utf-8`. If set to `hex` or `base64`, `password` is instead treated as encoded binary and
+   *   decoded, exactly as for the charset argument of {@link Crypt2.pbkdf2}.
+   *
+   * - `maxMemoryKb` - refuses to allocate more than this many KB. This is not an Argon2 parameter;
+   *   it is a guard so that an unreasonable `memoryCostKb` cannot exhaust memory. Defaults to
+   *   `2097152` (2 GB).
+   *
+   * The short names used in RFC 9106 and in PHC hash strings are accepted as aliases: `t` for
+   * `iterations`, `m` for `memoryCostKb`, `p` for `parallelism`, and `v` for `version`. This means
+   * the parameters of an existing hash string such as `$argon2id$v=19$m=65536,t=3,p=1$...` can be
+   * transcribed directly.
+   *
+   * For example, to derive a 32-byte key:
+   *
+   * `{ "iterations": 3, "memoryCostKb": 65536, "parallelism": 1, "keyLen": 32, "salt":
+   * "cmFuZG9tc2FsdDEyMzQ=" }`
+   *
+   * To hash a password for storage, use {@link Crypt2.argon2HashPassword} instead, which generates
+   * a random salt and returns a self-describing string.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  argon2DeriveKey(password: string, json: string, bdKey: BinData): void
+
+  /**
+   * Hashes a password using **Argon2** (RFC 9106) and returns the result as a PHC format string,
+   * such as
+   *
+   * `$argon2id$v=19$m=65536,t=3,p=1$c29tZXJhbmRvbXNhbHQ$3fJ7v1qKcVJ0lHqXjBQZ8mYm3sNTfSPRt0bqDl9kEyM`
+   *
+   * The string records the variant, version, memory cost, iterations, parallelism, salt and hash,
+   * so it is everything needed to verify the password later with {@link
+   * Crypt2.argon2VerifyPassword}. Store the whole string.
+   *
+   * `password` is the password. `json` is a JSON string containing the Argon2 options, which are
+   * the same members documented for {@link Crypt2.argon2DeriveKey}, with one difference: **the salt
+   * is optional here**. As with all of the Argon2 methods, an unrecognized member name is an error.
+   * When no `salt` member is present, a cryptographically random salt is generated for this hash,
+   * which is what should normally happen. A `saltLen` member (default `16`, allowed range 8 to
+   * 1024) sets how many random bytes to generate.
+   *
+   * Passing an empty string for `json` uses all defaults: Argon2id, version 19, 3 iterations, 64 MB
+   * of memory, 1 lane, a 32-byte hash and a 16-byte random salt.
+   *
+   * Note that if a `secret` (pepper) or `ad` is used, it is **not** stored in the returned string.
+   * The same value must be supplied to {@link Crypt2.argon2VerifyPassword} for the password to
+   * verify.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link Crypt2.lastErrorText}.
+   */
+  argon2HashPassword(password: string, json: string): string
+
+  /**
+   * Verifies `password` against a PHC format Argon2 hash string previously produced by {@link
+   * Crypt2.argon2HashPassword} (or by any other RFC 9106 implementation).
+   *
+   * Returns one of three values:
+   *
+   * - `1` - the password matched.
+   *
+   * - `0` - the password did not match.
+   *
+   * - `-1` - the verification could not be performed at all: `phcHash` was not a valid Argon2 hash
+   *   string, its parameters were out of range, or an internal failure occurred. The reason is
+   *   written to the `LastErrorText`.
+   *
+   * Test for a match with `== 1`, never for `!= 0`, so that an unusable hash string is not mistaken
+   * for a successful login.
+   *
+   * The variant, version, memory cost, iterations, parallelism, salt and hash length are all read
+   * from `phcHash`, so none of the Argon2 cost options need to be supplied. Pass an empty string
+   * for `json` unless the hash was created with a `secret` (pepper) or `ad`, in which case `json`
+   * must contain the same values that were used to create it. Only the `secret`, `ad`, `encoding`,
+   * `passwordCharset` and `maxMemoryKb` members of `json` are used; everything else is ignored. The
+   * other documented members are still accepted here, so that one JSON string can be shared between
+   * hashing and verifying, but an unrecognized member name is an error.
+   *
+   * A return of `0` and a return of `-1` call for different handling. `0` is a normal failed login
+   * attempt. `-1` means the stored hash itself is unusable, which is a data or configuration
+   * problem rather than a bad password, and is worth logging or alerting on separately.
+   *
+   * The `maxMemoryKb` member is worth setting when the hash strings come from an untrusted source.
+   * The memory cost is taken from `phcHash`, so a hash claiming an enormous `m` would otherwise
+   * cause a very large allocation. It defaults to 2 GB and is checked before any memory is
+   * allocated.
+   */
+  argon2VerifyPassword(password: string, json: string, phcHash: string): number
+
+  // ---- Events (ReactNativeGen_DESIGN.md §6) ----
+
+  /**
+   * Called with the percent completed (0..100) while a long-running method runs, when Chilkat
+   * can measure progress. Runs on the JavaScript thread, so it is only useful with the
+   * `...Async` methods (during a synchronous call the thread is busy and the events arrive
+   * after it returns). Assign `undefined` to remove.
+   */
+  onPercentDone?: (pctDone: number) => void
+
+  /**
+   * Called with a name/value pair of progress information while a long-running method runs
+   * (what is reported depends on the class and method). Runs on the JavaScript thread; see
+   * {@link Crypt2.onPercentDone}. Assign `undefined` to remove.
+   */
+  onProgressInfo?: (name: string, value: string) => void
+
+  /**
+   * Requests that the pending `...Async` call on this object stop at its next progress check.
+   * The promise then rejects with Chilkat's abort error. Chilkat checks at least every
+   * `heartbeatMs` milliseconds on the classes that have that property, so set it (e.g. 250)
+   * for a responsive cancel. Harmless when nothing is pending.
+   */
+  abort(): void
+}