> ## Documentation Index > Fetch the complete documentation index at: https://docs.everabyte.com/llms.txt > Use this file to discover all available pages before exploring further. # SDK API reference > Every exported function of the Rust core, the WASM/TypeScript binding and the Dart FFI binding, grouped by purpose. All three bindings expose the same operations over the same wire format (PHP/Java/C#/Go integrations use the same operations through the [C ABI](https://docs.everabyte.com/sdk/c-abi-reference.md)). Base64 fields are standard base64; JSON shapes are camelCase and shared with the Everabyte REST API. Source of truth: [everabyte/crypto-sdk](https://github.com/everabyte/crypto-sdk). ## Account key (UMK) The UMK is 96 bytes: 32-byte X25519 secret ‖ 64-byte ML-KEM-768 seed (`d‖z`). | Operation | Rust (`evb_e2ee_core::wrap`) | WASM/TS (`evb-e2ee-wasm`) | Dart (`EvbE2ee`) | | - | - | - | - | | Generate a UMK | `generate_umk() -> UmkSecrets` | `generate_umk() -> Uint8Array(96)` | `generateUmk() -> Uint8List(96)` | | Derive public keys | `UmkSecrets::public()` → `{public_key_x25519, public_key_mlkem}` | `umk_public_keys(sk, seed) -> JSON` | `umkPublicKeys(sk, seed) -> JSON` | | Seal under recovery phrase (Argon2id v3) | `wrap_umk_with_mnemonic(umk, phrase, salt16, nonce12) -> blob` | `wrap_umk_with_mnemonic(sk, seed, phrase) -> blob_b64` | `wrapUmkWithMnemonic(sk, seed, phrase) -> blob_b64` | | Open with recovery phrase | `unwrap_umk_with_mnemonic(blob, phrase)` — candidate chain v3→RFC9106→v2 | `unwrap_umk_with_mnemonic(blob, phrase) -> Uint8Array(96)` | `unwrapUmkWithMnemonic(blob, phrase) -> Uint8List(96)` | | Seal to a device secret | `wrap_umk_with_device_key(umk, secret32) -> blob` | `wrap_umk_with_device_key(sk, seed, secret32)` | `wrapUmkWithDeviceKey(sk, seed, secret32)` | | Open with device secret | `unwrap_umk_with_device_key(blob, secret32)` | `unwrap_umk_with_device_key(blob, secret32)` | `unwrapUmkWithDeviceKey(blob, secret32)` | Recovery phrases are normalized (NFKD, lowercased, whitespace-collapsed) before the KDF in every binding — a phrase typed with stray newlines still opens its blob. ## File keys (DEK) and envelopes A DEK is 32 bytes. Envelopes bind it to an account key; wire format v2 is HPKE RFC 9180 mode PSK. | Operation | Rust | WASM/TS | Dart | | - | - | - | - | | Generate DEK / nonces / salt | `keys::generate_dek`, `keys::generate_nonce`, `keys::generate_salt16` | `generate_random_32()`, `generate_random_12()` | `generateRandom32()`, `generateRandom12()` | | Wrap DEK to a UMK (v2, HPKE) | `wrap_dek_to_umk(dek, recipient_public)` → envelope | `wrap_dek_to_umk(dek, pkX25519, pkMlkem) -> JSON` | `wrapDekToUmk(dek, pkX25519, pkMlkem) -> JSON` | | Wrap DEK (legacy v1 — compatibility) | `wrap_dek_to_umk_legacy` | — (unwrap only) | — (unwrap only) | | Unwrap DEK from an envelope | `unwrap_dek_from_umk_json(envelope_json, umk)` | `unwrap_dek_from_umk(envelope_json, sk, seed)` | `unwrapDekFromUmk(envelope, sk, seed)` | Every unwrap dispatches on the envelope's `v` field: `v: 2` → HPKE v2, absent → legacy v1. Both wire formats carry `wrappedDek` as `ct‖tag` (48 bytes decoded). Envelope JSON (v2): `{ v: 2, scheme: "evb-e2ee-file-wrap-hpke-psk-v1", kemId: 32, kdfId: 1, aeadId: 3, ephPublicX25519, kemCiphertext, wrappedDek }` — no transported nonce; the base nonce is derived from the HPKE key schedule. ## Content (EVB1) | Operation | Rust (`content`) | WASM/TS | Dart | | - | - | - | - | | Encrypt whole buffer | `content::seal_all(dek, file_nonce12, plaintext)` | `evb1_seal_all(dek, nonce, plaintext)` | `sealAll(dek, nonce, plaintext)` | | Decrypt whole buffer | `content::open_all(dek, payload)` | `evb1_open_all(dek, payload)` | `openAll(dek, payload)` | | Streaming encrypt | `content::Encryptor::new/push/finish` | — (chunk via seal per block) | — | | Streaming decrypt | `content::Decryptor::new/push/finish` | — | — | | Expected ciphertext length | `content::ciphertext_len_for(len)` | — | `ciphertextLenFor(len)` | | HKDF-SHA256 helper | `wrap::hkdf_sha256_32(ikm, info)` | `hkdf_sha256(ikm, info)` | `hkdfSha256(ikm, info)` | Streaming variants buffer at most one 64 KiB chunk in memory; DEK material is zeroized on drop. ## Names (metadata encryption) | Operation | Rust (`names`) | WASM/TS | Dart | | - | - | - | - | | Opaque wire alias (deterministic HMAC, `evb-`) | `derive_opaque_wire_name(umk, real_name)` | `derive_wire_alias(sk, seed, real_name)` | `deriveWireAlias(sk, seed, real_name)` | | Encrypt a display name (AES-256-GCM under the DEK) | `encrypt_file_name(dek, real_name, nonce12) -> blob` | `encrypt_file_name(dek, real_name, nonce)` | `encryptFileName(dek, real_name, nonce)` | | Decrypt a display name | `decrypt_file_name(dek, blob_b64)` | `decrypt_file_name(dek, blob)` | `decryptFileName(dek, blob)` | ## Sharing wraps | Operation | Rust | WASM/TS | Dart | | - | - | - | - | | Wrap a DEK under a link key (public links) | `wrap_dek_with_link_key(dek, link_key32)` | `wrap_dek_with_link_key(dek, link_key)` | via Rust/WASM | | Unwrap with the link key | `unwrap_dek_with_link_key(wrap, link_key32)` | `unwrap_dek_with_link_key(wrap, link_key)` | via Rust/WASM | | Wrap under an invitation key share | `wrap_dek_with_invite_key(dek, key_share32)` | `wrap_dek_with_invite_key(dek, key_share)` | via Rust/WASM | | Unwrap with the key share | `unwrap_dek_with_invite_key(wrap, key_share32)` | `unwrap_dek_with_invite_key(wrap, key_share)` | via Rust/WASM | Link keys and invitation key shares travel only in URL fragments (`#k=…`, `#iks=…`) — the Everabyte backend never receives them. The same pattern applies to your own integration: a symmetric key you generate client-side makes a share readable without exposing your account key. ## Frozen test vectors `evb-e2ee-v1.json` (20 vectors: EVB1 content edges ×9, DEK envelope v1 + HPKE v2, mnemonic Argon2id v3 + PBKDF2 v2, device wrap, name alias + encrypted name, link + invite wraps, primitives) is consumed by the test suites of every binding. A binding that does not open the grid is not Everabyte-compatible; run the suites when you upgrade. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.