PqForgeSecureSession class final

Encrypts and decrypts application payloads into self-describing AEAD wire packets, with an explicit choice of cipher suite and backend engine.

final session = PqForgeSecureSession(
  secretKey: derivedHybridKey,                       // 32 bytes
  cipherSuite: PqForgeCipherSuite.chaCha20Poly1305,
  engineProvider: PqForgeEngineProvider.pureDart,    // or .nativeCryptography
);

final packet = await session.encrypt(payload, associatedData: header);
final clear  = await session.decrypt(packet, associatedData: header);
session.dispose(); // wipe the key when finished

Wire format

Every packet is a single contiguous byte array:

+-----------------------------+------------------------------------+
|      Nonce / IV (12 B)      |      Ciphertext + Tag (variable)   |
+-----------------------------+------------------------------------+

encrypt generates a fresh cryptographically secure nonce, prepends it, and appends the AEAD ciphertext-and-tag. decrypt slices the leading PqForgeCipherSuite.nonceLength bytes back off as the nonce before authenticating the remainder. Because both engines emit the identical ciphertext || tag layout, a packet produced by one PqForgeEngineProvider decrypts cleanly under the other.