Java quickstart

// Load the shared library once (FFM):
Linker linker = Linker.nativeLinker();
SymbolLookup lib = SymbolLookup.libraryLookup("/path/to/libevb_e2ee_ffi.so", Arena.global());
// Convenience: symbols are also resolvable by name through linker.defaultLookup().

static final MethodHandle GENERATE_UMK = linker.downcallHandle(
    lib.lookup("evb_generate_umk").orElseThrow(),
    FunctionDescriptor.ofVoid(ADDRESS, JAVA_LONG, ADDRESS));

static final MethodHandle SEAL_ALL = linker.downcallHandle(
    lib.lookup("evb1_seal_all").orElseThrow(),
    FunctionDescriptor.of(JAVA_INT, ADDRESS, ADDRESS, ADDRESS, JAVA_LONG, ADDRESS, JAVA_LONG, ADDRESS));

try (Arena arena = Arena.ofConfined()) {
    MemorySegment umk = arena.allocate(96);
    MemorySegment len = arena.allocate(JAVA_LONG);
    GENERATE_UMK.invoke(umk, 96L, len);

    // evb_umk_public_keys → JSON {publicKeyX25519, publicKeyMlkem} → POST /e2ee/keys/register
    // evb_wrap_umk_with_mnemonic(sk, seed, phrase, salt(16), nonce(12), blob, 8192)
    // → recovery blob; store it with the registration call.
}

byte[] dek = randomBytes(32);        // your CSPRNG — never persisted
byte[] fileNonce = randomBytes(12);
byte[] plaintext = Files.readAllBytes(Path.of("contract.pdf"));

try (Arena arena = Arena.ofConfined()) {
    MemorySegment pt = arena.allocateArray(JAVA_BYTE, plaintext);
    MemorySegment ct = arena.allocateArray(JAVA_BYTE, plaintext.length + 65536 + 16);
    MemorySegment ctLen = arena.allocate(JAVA_LONG);
    int rc = (int) SEAL_ALL.invoke(
        arena.allocateArray(JAVA_BYTE, dek),
        arena.allocateArray(JAVA_BYTE, fileNonce),
        pt, (long) plaintext.length,
        ct, (long) ct.byteSize(), ctLen);
    if (rc != 0) throw new IllegalStateException("seal failed: " + lastError(lib, arena));

    byte[] ciphertext = ct.asByteBuffer().limit((int) ctLen.get(JAVA_LONG, 0)).array();

    // wireName = evb_derive_wire_alias(...) → "evb-<hex64>"
    // encryptedName = evb_encrypt_file_name(dek, "contract.pdf", nonce12)
    // envelope = evb_wrap_dek_to_umk(dek, pkX25519, pkMlkem) → JSON
    //
    // POST /files/upload/{bucketId}  (multipart, filename = wireName)
    // POST /e2ee/files/by-path/envelope { bucketId, fileName, encryptedName, ...envelope }
}

// GET /e2ee/files/{id}/envelope → envelope JSON
// GET /files/{id}/stream?download=true → stored ciphertext
// evb_unwrap_dek_from_umk(envelopeJson, sk, seed, out32, 32, len) → DEK
// evb1_open_all(dek, stored, len, out, cap, outLen) → ORIGINAL plaintext
// evb_decrypt_file_name(dek, encryptedName, out, cap, outLen) → real name