@keyhive/keyhive 0.1.0-alpha.3 → 0.1.0-alpha.4

package/pkg/keyhive_wasm_bg.wasm.d.ts

@@ -1,59 +1,25 @@
 /* tslint:disable */
 /* eslint-disable */
 export const memory: WebAssembly.Memory;
-export const __wbg_allagentevents_free: (a: number, b: number) => void;
-export const __wbg_ciphertextstore_free: (a: number, b: number) => void;
+export const __wbg_signedcgkaoperation_free: (a: number, b: number) => void;
+export const signedcgkaoperation_delegation: (a: number) => number;
+export const signedcgkaoperation_signature: (a: number) => [number, number];
+export const signedcgkaoperation_verify: (a: number) => number;
+export const signedcgkaoperation_verifyingKey: (a: number) => [number, number];
 export const __wbg_invocation_free: (a: number, b: number) => void;
 export const __wbg_signedinvocation_free: (a: number, b: number) => void;
-export const allagentevents_agentCgkaSources: (a: number) => any;
-export const allagentevents_agentMembershipSources: (a: number) => any;
-export const allagentevents_agentPrekeySources: (a: number) => any;
-export const allagentevents_cgkaSources: (a: number) => any;
-export const allagentevents_events: (a: number) => any;
-export const allagentevents_membershipSources: (a: number) => any;
-export const allagentevents_prekeySources: (a: number) => any;
-export const ciphertextstore_newFromWebStorage: (a: any) => number;
-export const ciphertextstore_newInMemory: () => number;
-export const __wbg_archive_free: (a: number, b: number) => void;
-export const __wbg_signed_free: (a: number, b: number) => void;
-export const __wbg_stats_free: (a: number, b: number) => void;
-export const archive_toBytes: (a: number) => [number, number, number, number];
-export const archive_tryToKeyhive: (a: number, b: number, c: number, d: any) => any;
-export const archive_try_from_bytes: (a: number, b: number) => [number, number, number];
-export const signed_fromBytes: (a: number, b: number) => [number, number, number];
-export const signed_payload: (a: number) => [number, number];
-export const signed_signature: (a: number) => [number, number];
-export const signed_toBytes: (a: number) => [number, number, number, number];
-export const signed_verify: (a: number) => number;
-export const signed_verifyingKey: (a: number) => [number, number];
-export const stats_activePrekeyCount: (a: number) => bigint;
-export const stats_cgkaOperations: (a: number) => bigint;
-export const stats_delegations: (a: number) => bigint;
-export const stats_docs: (a: number) => bigint;
-export const stats_groups: (a: number) => bigint;
-export const stats_individuals: (a: number) => bigint;
-export const stats_pendingCgkaOperation: (a: number) => bigint;
-export const stats_pendingCgkaOperationByActive: (a: number) => bigint;
-export const stats_pendingDelegated: (a: number) => bigint;
-export const stats_pendingDelegatedByActive: (a: number) => bigint;
-export const stats_pendingPrekeyRotated: (a: number) => bigint;
-export const stats_pendingPrekeyRotatedByActive: (a: number) => bigint;
-export const stats_pendingPrekeysExpanded: (a: number) => bigint;
-export const stats_pendingPrekeysExpandedByActive: (a: number) => bigint;
-export const stats_pendingRevoked: (a: number) => bigint;
-export const stats_pendingRevokedByActive: (a: number) => bigint;
-export const stats_prekeyRotations: (a: number) => bigint;
-export const stats_prekeysExpanded: (a: number) => bigint;
-export const stats_revocations: (a: number) => bigint;
-export const stats_totalOps: (a: number) => bigint;
-export const stats_totalPendingOps: (a: number) => bigint;
+export const symmetricDecrypt: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+export const symmetricEncrypt: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];
 export const __wbg_agent_free: (a: number, b: number) => void;
-export const __wbg_document_free: (a: number, b: number) => void;
+export const __wbg_allagentevents_free: (a: number, b: number) => void;
+export const __wbg_ciphertextstore_free: (a: number, b: number) => void;
+export const __wbg_doccontentrefs_free: (a: number, b: number) => void;
 export const __wbg_encryptedcontentwithupdate_free: (a: number, b: number) => void;
-export const __wbg_group_free: (a: number, b: number) => void;
 export const __wbg_individual_free: (a: number, b: number) => void;
 export const __wbg_keyhive_free: (a: number, b: number) => void;
 export const __wbg_peer_free: (a: number, b: number) => void;
+export const __wbg_revocation_free: (a: number, b: number) => void;
+export const __wbg_stats_free: (a: number, b: number) => void;
 export const agent_id: (a: number) => number;
 export const agent_isDocument: (a: number) => number;
 export const agent_isGroup: (a: number) => number;
@@ -61,21 +27,23 @@ export const agent_isIndividual: (a: number) => number;
 export const agent_keyOpHashes: (a: number) => any;
 export const agent_keyOps: (a: number) => any;
 export const agent_toString: (a: number) => [number, number];
-export const document___wasm_refgen_toJsDocument: (a: number) => number;
-export const document_doc_id: (a: number) => number;
-export const document_id: (a: number) => number;
-export const document_members: (a: number) => any;
-export const document_toAgent: (a: number) => number;
-export const document_toMembered: (a: number) => number;
-export const document_toPeer: (a: number) => number;
+export const allagentevents_agentCgkaSources: (a: number) => any;
+export const allagentevents_agentMembershipSources: (a: number) => any;
+export const allagentevents_agentPrekeySources: (a: number) => any;
+export const allagentevents_cgkaSources: (a: number) => any;
+export const allagentevents_events: (a: number) => any;
+export const allagentevents_membershipSources: (a: number) => any;
+export const allagentevents_prekeySources: (a: number) => any;
+export const ciphertextstore_newFromWebStorage: (a: any) => number;
+export const ciphertextstore_newInMemory: () => number;
+export const doccontentrefs_addChangeId: (a: number, b: number) => any;
+export const doccontentrefs_change_hashes: (a: number) => any;
+export const doccontentrefs_docId: (a: number) => number;
+export const doccontentrefs_new: (a: number, b: number, c: number) => [number, number, number];
+export const encryptedcontentwithupdate_applicationSecret: (a: number) => [number, number];
 export const encryptedcontentwithupdate_encrypted_content: (a: number) => number;
 export const encryptedcontentwithupdate_update_op: (a: number) => number;
-export const group___wasm_refgen_toJsGroup: (a: number) => number;
-export const group_members: (a: number) => any;
-export const group_toAgent: (a: number) => number;
-export const group_toMembered: (a: number) => number;
-export const group_toPeer: (a: number) => number;
-export const individual_individualId: (a: number) => number;
+export const individual_id: (a: number) => number;
 export const individual_pickPrekey: (a: number, b: number) => any;
 export const individual_toAgent: (a: number) => number;
 export const individual_toPeer: (a: number) => number;
@@ -102,7 +70,7 @@ export const keyhive_importPrekeySecrets: (a: number, b: number, c: number) => a
 export const keyhive_individual: (a: number) => any;
 export const keyhive_ingestArchive: (a: number, b: number) => any;
 export const keyhive_ingestEventsBytes: (a: number, b: any) => any;
-export const keyhive_init: (a: number, b: number, c: any, d: number) => any;
+export const keyhive_init: (a: number, b: number, c: any) => any;
 export const keyhive_intoArchive: (a: number) => any;
 export const keyhive_membershipOpsForAgent: (a: number, b: number) => any;
 export const keyhive_pendingEventHashes: (a: number) => any;
@@ -114,6 +82,7 @@ export const keyhive_rotatePrekey: (a: number, b: number) => any;
 export const keyhive_stats: (a: number) => any;
 export const keyhive_toArchive: (a: number) => any;
 export const keyhive_tryDecrypt: (a: number, b: number, c: number) => any;
+export const keyhive_tryDecryptWithKey: (a: number, b: number, c: number) => any;
 export const keyhive_tryEncrypt: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => any;
 export const keyhive_tryEncryptArchive: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => any;
 export const keyhive_tryPcsKeyHash: (a: number, b: number) => any;
@@ -124,41 +93,34 @@ export const peer_isDocument: (a: number) => number;
 export const peer_isGroup: (a: number) => number;
 export const peer_isIndividual: (a: number) => number;
 export const peer_toString: (a: number) => [number, number];
-export const setPanicHook: () => void;
-export const group_groupId: (a: number) => number;
-export const group_id: (a: number) => number;
-export const individual_id: (a: number) => number;
-export const peer_id: (a: number) => number;
-export const __wbg_signedcgkaoperation_free: (a: number, b: number) => void;
-export const signedcgkaoperation_delegation: (a: number) => number;
-export const signedcgkaoperation_signature: (a: number) => [number, number];
-export const signedcgkaoperation_verify: (a: number) => number;
-export const signedcgkaoperation_verifyingKey: (a: number) => [number, number];
-export const __wbg_cannotparseidentifier_free: (a: number, b: number) => void;
-export const __wbg_changeid_free: (a: number, b: number) => void;
-export const __wbg_doccontentrefs_free: (a: number, b: number) => void;
-export const __wbg_identifier_free: (a: number, b: number) => void;
-export const __wbg_revocation_free: (a: number, b: number) => void;
-export const __wbg_sharekey_free: (a: number, b: number) => void;
-export const __wbg_signedrevocation_free: (a: number, b: number) => void;
-export const changeid___wasm_refgen_toJsChangeId: (a: number) => number;
-export const changeid_bytes: (a: number) => [number, number];
-export const changeid_new: (a: number, b: number) => number;
-export const doccontentrefs_addChangeId: (a: number, b: number) => any;
-export const doccontentrefs_change_hashes: (a: number) => any;
-export const doccontentrefs_docId: (a: number) => number;
-export const doccontentrefs_new: (a: number, b: number, c: number) => [number, number, number];
-export const identifier_new: (a: number, b: number) => [number, number, number];
-export const identifier_publicId: () => number;
-export const identifier_toBytes: (a: number) => [number, number];
 export const revocation_after: (a: number) => number;
 export const revocation_proof: (a: number) => number;
 export const revocation_revoked: (a: number) => number;
 export const revocation_subject_id: (a: number) => number;
-export const signedrevocation_delegation: (a: number) => number;
-export const signedrevocation_signature: (a: number) => [number, number];
-export const signedrevocation_verify: (a: number) => number;
-export const signedrevocation_verifyingKey: (a: number) => [number, number];
+export const setPanicHook: () => void;
+export const stats_activePrekeyCount: (a: number) => bigint;
+export const stats_cgkaOperations: (a: number) => bigint;
+export const stats_delegations: (a: number) => bigint;
+export const stats_docs: (a: number) => bigint;
+export const stats_groups: (a: number) => bigint;
+export const stats_individuals: (a: number) => bigint;
+export const stats_pendingCgkaOperation: (a: number) => bigint;
+export const stats_pendingCgkaOperationByActive: (a: number) => bigint;
+export const stats_pendingDelegated: (a: number) => bigint;
+export const stats_pendingDelegatedByActive: (a: number) => bigint;
+export const stats_pendingPrekeyRotated: (a: number) => bigint;
+export const stats_pendingPrekeyRotatedByActive: (a: number) => bigint;
+export const stats_pendingPrekeysExpanded: (a: number) => bigint;
+export const stats_pendingPrekeysExpandedByActive: (a: number) => bigint;
+export const stats_pendingRevoked: (a: number) => bigint;
+export const stats_pendingRevokedByActive: (a: number) => bigint;
+export const stats_prekeyRotations: (a: number) => bigint;
+export const stats_prekeysExpanded: (a: number) => bigint;
+export const stats_revocations: (a: number) => bigint;
+export const stats_totalOps: (a: number) => bigint;
+export const stats_totalPendingOps: (a: number) => bigint;
+export const individual_individualId: (a: number) => number;
+export const peer_id: (a: number) => number;
 export const __wbg_access_free: (a: number, b: number) => void;
 export const __wbg_cannotparseed25519signingkey_free: (a: number, b: number) => void;
 export const __wbg_cgkaoperation_free: (a: number, b: number) => void;
@@ -168,6 +130,7 @@ export const __wbg_encrypted_free: (a: number, b: number) => void;
 export const __wbg_event_free: (a: number, b: number) => void;
 export const __wbg_generatewebcryptoerror_free: (a: number, b: number) => void;
 export const __wbg_groupid_free: (a: number, b: number) => void;
+export const __wbg_individualid_free: (a: number, b: number) => void;
 export const __wbg_signer_free: (a: number, b: number) => void;
 export const access_toString: (a: number) => [number, number];
 export const access_tryFromString: (a: number, b: number) => number;
@@ -185,6 +148,7 @@ export const documentid_toJsValue: (a: number) => any;
 export const documentid_toString: (a: number) => [number, number];
 export const encrypted_ciphertext: (a: number) => [number, number];
 export const encrypted_content_ref: (a: number) => [number, number];
+export const encrypted_decryptWithKey: (a: number, b: number, c: number) => [number, number, number, number];
 export const encrypted_fromBytes: (a: number, b: number) => [number, number, number];
 export const encrypted_nonce: (a: number) => [number, number];
 export const encrypted_pcs_key_hash: (a: number) => [number, number];
@@ -198,6 +162,7 @@ export const event_tryIntoSignedRevocation: (a: number) => number;
 export const event_variant: (a: number) => [number, number];
 export const generatewebcryptoerror_message: (a: number) => [number, number];
 export const groupid_toString: (a: number) => [number, number];
+export const individualid_bytes: (a: number) => [number, number];
 export const signer_clone: (a: number) => number;
 export const signer_generate: () => any;
 export const signer_generateMemory: () => number;
@@ -208,39 +173,81 @@ export const signer_variant: (a: number) => [number, number];
 export const signer_verifyingKey: (a: number) => [number, number];
 export const signer_webCryptoSigner: (a: any) => any;
 export const encrypted_toBytes: (a: number) => [number, number];
-export const __wbg_addmemberupdate_free: (a: number, b: number) => void;
+export const __wbg_archive_free: (a: number, b: number) => void;
+export const __wbg_cannotparseidentifier_free: (a: number, b: number) => void;
 export const __wbg_capability_free: (a: number, b: number) => void;
-export const __wbg_delegation_free: (a: number, b: number) => void;
-export const __wbg_history_free: (a: number, b: number) => void;
-export const __wbg_individualid_free: (a: number, b: number) => void;
+export const __wbg_changeid_free: (a: number, b: number) => void;
+export const __wbg_identifier_free: (a: number, b: number) => void;
 export const __wbg_membered_free: (a: number, b: number) => void;
 export const __wbg_membership_free: (a: number, b: number) => void;
+export const __wbg_sharekey_free: (a: number, b: number) => void;
+export const __wbg_signed_free: (a: number, b: number) => void;
 export const __wbg_signeddelegation_free: (a: number, b: number) => void;
-export const __wbg_summary_free: (a: number, b: number) => void;
-export const addmemberupdate_delegation: (a: number) => number;
-export const addmemberupdate_leafSecrets: (a: number) => [number, number];
+export const __wbg_signedrevocation_free: (a: number, b: number) => void;
+export const archive_toBytes: (a: number) => [number, number, number, number];
+export const archive_tryToKeyhive: (a: number, b: number, c: number, d: any) => any;
+export const archive_try_from_bytes: (a: number, b: number) => [number, number, number];
 export const capability_can: (a: number) => number;
 export const capability_proof: (a: number) => number;
 export const capability_who: (a: number) => number;
-export const delegation_after: (a: number) => number;
-export const delegation_can: (a: number) => number;
-export const delegation_delegate: (a: number) => number;
-export const delegation_proof: (a: number) => number;
-export const history_contentRefs: (a: number) => [number, number];
-export const history_delegations: (a: number) => [number, number];
-export const history_revocations: (a: number) => [number, number];
-export const individualid_bytes: (a: number) => [number, number];
+export const changeid___wasm_refgen_toJsChangeId: (a: number) => number;
+export const changeid_bytes: (a: number) => [number, number];
+export const changeid_new: (a: number, b: number) => number;
+export const identifier_new: (a: number, b: number) => [number, number, number];
+export const identifier_publicId: () => number;
+export const identifier_toBytes: (a: number) => [number, number];
 export const membership_can: (a: number) => number;
 export const membership_who: (a: number) => number;
+export const signed_fromBytes: (a: number, b: number) => [number, number, number];
+export const signed_payload: (a: number) => [number, number];
+export const signed_signature: (a: number) => [number, number];
+export const signed_toBytes: (a: number) => [number, number, number, number];
+export const signed_verify: (a: number) => number;
+export const signed_verifyingKey: (a: number) => [number, number];
 export const signeddelegation_delegation: (a: number) => number;
 export const signeddelegation_signature: (a: number) => [number, number];
 export const signeddelegation_subjectId: (a: number) => number;
 export const signeddelegation_verify: (a: number) => number;
 export const signeddelegation_verifyingKey: (a: number) => [number, number];
+export const signedrevocation_delegation: (a: number) => number;
+export const signedrevocation_signature: (a: number) => [number, number];
+export const signedrevocation_verify: (a: number) => number;
+export const signedrevocation_verifyingKey: (a: number) => [number, number];
+export const __wbg_addmemberupdate_free: (a: number, b: number) => void;
+export const __wbg_decryptedwithkey_free: (a: number, b: number) => void;
+export const __wbg_delegation_free: (a: number, b: number) => void;
+export const __wbg_document_free: (a: number, b: number) => void;
+export const __wbg_group_free: (a: number, b: number) => void;
+export const __wbg_history_free: (a: number, b: number) => void;
+export const __wbg_summary_free: (a: number, b: number) => void;
+export const addmemberupdate_delegation: (a: number) => number;
+export const decryptedwithkey_applicationSecret: (a: number) => [number, number];
+export const decryptedwithkey_plaintext: (a: number) => [number, number];
+export const delegation_after: (a: number) => number;
+export const delegation_can: (a: number) => number;
+export const delegation_delegate: (a: number) => number;
+export const delegation_proof: (a: number) => number;
+export const document___wasm_refgen_toJsDocument: (a: number) => number;
+export const document_doc_id: (a: number) => number;
+export const document_id: (a: number) => number;
+export const document_members: (a: number) => any;
+export const document_toAgent: (a: number) => number;
+export const document_toMembered: (a: number) => number;
+export const document_toPeer: (a: number) => number;
+export const group___wasm_refgen_toJsGroup: (a: number) => number;
+export const group_members: (a: number) => any;
+export const group_toAgent: (a: number) => number;
+export const group_toMembered: (a: number) => number;
+export const group_toPeer: (a: number) => number;
+export const history_contentRefs: (a: number) => [number, number];
+export const history_delegations: (a: number) => [number, number];
+export const history_revocations: (a: number) => [number, number];
 export const summary_access: (a: number) => number;
 export const summary_doc: (a: number) => number;
-export const wasm_bindgen__convert__closures_____invoke__hd575a1431d676418: (a: number, b: number, c: any) => [number, number];
-export const wasm_bindgen__convert__closures_____invoke__h1ce7fe53f08aa9a8: (a: number, b: number, c: any, d: any) => void;
+export const group_groupId: (a: number) => number;
+export const group_id: (a: number) => number;
+export const wasm_bindgen__convert__closures_____invoke__h9887d5ab72723f8a: (a: number, b: number, c: any) => [number, number];
+export const wasm_bindgen__convert__closures_____invoke__h58982df154245cbc: (a: number, b: number, c: any, d: any) => void;
 export const __wbindgen_malloc: (a: number, b: number) => number;
 export const __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
 export const __wbindgen_exn_store: (a: number) => void;

package/pkg-node/keyhive_wasm.d.ts

@@ -10,23 +10,13 @@ export class Access {
 }
 
 /**
- * The result of adding a member: the membership delegation, plus any new leaf
- * secrets produced by auto-rekeying a non-forward-secret document on add.
+ * The result of adding a member: the membership delegation.
  */
 export class AddMemberUpdate {
     private constructor();
     free(): void;
     [Symbol.dispose](): void;
     readonly delegation: SignedDelegation;
-    /**
-     * New leaf secret keypairs from auto-rekeying a non-forward-secret document
-     * when this reader was added, serialized as a
-     * `BTreeMap<ShareKey, ShareSecretKey>` (the format `importPrekeySecrets`
-     * accepts). A sibling instance of this identity (e.g. a tab and its
-     * SharedWorker) installs them to derive the rotated key. `undefined` when
-     * no rotation occurred (a forward-secret document).
-     */
-    readonly leafSecrets: Uint8Array | undefined;
 }
 
 export class Agent {
@@ -135,6 +125,23 @@ export class ContactCard {
     readonly shareKey: ShareKey;
 }
 
+/**
+ * Plaintext plus the application secret key that decrypted it.
+ *
+ * The key lets the consumer recover the blob's external predecessor-secret
+ * chain and chain further encryptions onto it, without re-entering CGKA.
+ */
+export class DecryptedWithKey {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * The 32-byte application secret key used to decrypt this content.
+     */
+    readonly applicationSecret: Uint8Array;
+    readonly plaintext: Uint8Array;
+}
+
 export class Delegation {
     private constructor();
     free(): void;
@@ -183,6 +190,12 @@ export class Encrypted {
     private constructor();
     free(): void;
     [Symbol.dispose](): void;
+    /**
+     * Decrypt this content with an explicit 32-byte application secret key,
+     * bypassing CGKA. The consumer uses this to follow the external
+     * predecessor-secret chain once it has recovered a blob's key.
+     */
+    decryptWithKey(key: Uint8Array): Uint8Array;
     static fromBytes(bytes: Uint8Array): Encrypted;
     serialize(): Uint8Array;
     toBytes(): Uint8Array;
@@ -199,6 +212,13 @@ export class EncryptedContentWithUpdate {
     [Symbol.dispose](): void;
     encrypted_content(): Encrypted;
     update_op(): SignedCgkaOperation | undefined;
+    /**
+     * The 32-byte application secret key used to encrypt this content.
+     *
+     * Lets the consumer build the external predecessor-secret chain and chain
+     * further encryptions onto this blob.
+     */
+    readonly applicationSecret: Uint8Array;
 }
 
 export class Event {
@@ -334,14 +354,8 @@ export class Keyhive {
     ingestEventsBytes(events_bytes_array: Array<any>): Promise<Array<any>>;
     /**
      * Initialize a peer.
-     *
-     * `forward_secrecy` is this peer's policy for all documents it creates or
-     * receives. When `false`, documents carry the CGKA predecessor key chain
-     * (a member added later reads the whole prior history) and adding a reader
-     * auto-rekeys (see `addMember`'s `leafSecrets`). When `true`, a member
-     * added later cannot read content from before they joined.
      */
-    static init(signer: Signer, ciphertext_store: CiphertextStore, event_handler: Function, forward_secrecy: boolean): Promise<Keyhive>;
+    static init(signer: Signer, ciphertext_store: CiphertextStore, event_handler: Function): Promise<Keyhive>;
     intoArchive(): Promise<Archive>;
     membershipOpsForAgent(agent: Agent): Promise<Map<any, any>>;
     pendingEventHashes(): Promise<Set<any>>;
@@ -353,6 +367,13 @@ export class Keyhive {
     stats(): Promise<Stats>;
     toArchive(): Promise<Archive>;
     tryDecrypt(doc: Document, encrypted: Encrypted): Promise<Uint8Array>;
+    /**
+     * Decrypt content and also return the 32-byte application secret key used.
+     *
+     * The consumer follows the external predecessor-secret chain from this key
+     * with `Encrypted.decryptWithKey`, avoiding further CGKA dives.
+     */
+    tryDecryptWithKey(doc: Document, encrypted: Encrypted): Promise<DecryptedWithKey>;
     tryEncrypt(doc: Document, content_ref: ChangeId, js_pred_refs: ChangeId[], content: Uint8Array): Promise<EncryptedContentWithUpdate>;
     tryEncryptArchive(doc: Document, content_ref: ChangeId, pred_refs: ChangeId[], content: Uint8Array): Promise<EncryptedContentWithUpdate>;
     tryPcsKeyHash(doc: Document): Promise<Uint8Array | undefined>;
@@ -514,3 +535,19 @@ export class Summary {
  * https://rustwasm.github.io/docs/wasm-pack/tutorials/npm-browser-packages/template-deep-dive/src-utils-rs.html#2-what-is-console_error_panic_hook
  */
 export function setPanicHook(): void;
+
+/**
+ * Inverse of [`symmetric_encrypt`]. Reads `nonce(24) || ciphertext`.
+ */
+export function symmetricDecrypt(key: Uint8Array, blob: Uint8Array): Uint8Array;
+
+/**
+ * AEAD-encrypt `plaintext` under a 32-byte `key`.
+ *
+ * `associated_data` flavors the synthetic nonce (e.g. the document or content
+ * id) so identical plaintext under the same key in different contexts produces
+ * distinct ciphertext. Returns `nonce(24) || ciphertext` (the ciphertext
+ * includes the Poly1305 tag). The nonce is carried in the output, so
+ * [`symmetric_decrypt`] does not need the associated data.
+ */
+export function symmetricEncrypt(key: Uint8Array, plaintext: Uint8Array, associated_data: Uint8Array): Uint8Array;