Rust quickstart

[dependencies]
evb-e2ee-core = { git = "https://github.com/everabyte/crypto-sdk.git" }

use evb_e2ee_core::{keys, wrap, content, names};

// 96 bytes: 32-byte X25519 secret || 64-byte ML-KEM-768 seed.
let umk = wrap::generate_umk();
let public = umk.public()?; // { public_key_x25519: [u8;32], public_key_mlkem: [u8;1184] }

let phrase = obtain_fresh_bip39_phrase_from_your_recovery_ui(); // never hard-code a test phrase
let salt: [u8; 16] = rand::random();
let nonce: [u8; 12] = rand::random();
let mnemonic_blob = wrap::wrap_umk_with_mnemonic(&umk, phrase, &salt, &nonce)?;
// POST /e2ee/keys/register { publicKeyX25519, publicKeyMlkem, wraps: [{ wrapKind: "mnemonic", wrappedBlob }] }

let plaintext = std::fs::read("contract.pdf")?;

let dek = keys::generate_dek();                       // [u8;32] — per-file, never persisted
let file_nonce: [u8; 12] = rand::random();

// EVB1 chunked AES-256-GCM (64 KiB authenticated chunks).
let payload = content::seal_all(&dek, &file_nonce, &plaintext)?;

// Opaque wire alias + encrypted display name.
let wire_name = names::derive_wire_alias(&umk, "contract.pdf")?;      // "evb-<hex64>"
let name_nonce: [u8; 12] = rand::random();
let encrypted_name = names::encrypt_file_name(&dek, "contract.pdf", &name_nonce)?;

// Wrap the DEK to the account key — HPKE v2 (RFC 9180 PSK, X25519 + ML-KEM-768).
let envelope = wrap::wrap_dek_to_umk(&dek, &public)?;                 // serde JSON, v: 2
let envelope_json = serde_json::to_string(&envelope)?;

// POST /files/upload/{bucketId}  (multipart) — file part named `wire_name`
// POST /e2ee/files/by-path/envelope { bucketId, fileName: wire_name, encryptedName, ..envelope }

// GET /e2ee/files/{fileId}/envelope  → envelope JSON
// GET /files/{fileId}/stream?download=true → stored ciphertext
let dek_back = wrap::unwrap_dek_from_umk_json(&envelope_json, &umk)?;
let original = content::open_all(&dek_back, &stored_ciphertext)?;
assert_eq!(original, plaintext);
let real_name = names::decrypt_file_name(&dek_back, &encrypted_name_b64)?;

let mut enc = content::Encryptor::new(&dek)?;
for chunk in read_in_64k_chunks("contract.pdf") {
    let block = enc.push(&chunk)?;   // returns the authenticated block
    write_to_pipe(&block);
}
let tail = enc.finish()?;            // final block (may be empty plaintext)