Incremental encryption compatible with released clients.
Write nonce, each update result, and the final authentication tag to a private staged file. Publish that file only after finish succeeds.
Guide and performance
Start a stream with Rust-generated key material and nonce.
Released base64 enc value for authenticated attachment metadata.
enc
Fresh 12-byte nonce that must prefix the encrypted output.
Zeroize state and reject further updates without publishing output.
Cancel unfinished work and release the native stream.
Finalize authentication and return hashes plus the tag to append.
Encrypt the next plaintext chunk and return its ciphertext bytes.