Export and unlock

Export creates the complete document. Unlock is the only operation that returns secret key material, and it verifies the recovered private key against the stored public key before returning.

TypeScript

const encoded = await exportPrivateKey(input);
const document = parseDocument(encoded);
const result = await unlockDocument(document, password);
// result.privateKey is a Uint8Array; keep it in memory only as long as needed.

Go

encoded, err := keyhold.ExportPrivateKey(input)
if err != nil { return err }
document, err := keyhold.Parse(encoded)
if err != nil { return err }
result, err := keyhold.Unlock(document, password)
if err != nil { return err }
// result.PrivateKey is []byte; keep it in memory only as long as needed.

exportEncryptedState is for callers that already hold the encrypted bytes and need canonical document serialization. It never needs the password or plaintext private key.