Module sealed 

NaCl sealed-box wrapper for recipient-encrypted secret reads.

Wire format is the standard libsodium sealed box (ephemeral pubkey || box(plaintext)) so PyNaCl, tweetnacl-js, libsodium nacl/box, and Go nacl/box all decrypt. Pure RustCrypto — compiles to wasm32-unknown-unknown.

Structs

RecipientPrivateKey

A 32-byte X25519 recipient private key.

RecipientPublicKey

A 32-byte X25519 recipient public key.

SealedSecret

A sealed secret payload — recipient-encrypted ciphertext plus identifying metadata.

Enums

SealedError

Errors produced by sealed-box operations.

Functions

fingerprint

Compute a stable, short fingerprint for a recipient public key.

open

Open a base64-encoded libsodium sealed-box ciphertext with recipient_priv.

open_raw

Open a raw libsodium sealed-box ciphertext (as produced by seal_raw) with recipient_priv.

seal

Seal plaintext to recipient_pub using a libsodium-compatible sealed box.

seal_raw

Seal plaintext to recipient_pub and return the raw libsodium sealed-box ciphertext bytes (no base64 encoding, no SealedSecret metadata wrapper).