SEA.secret()

const secret = await SEA.secret(theirPublicKey, myKeyPair)

SEA.secret = SEA.secret || (async (key, pair, cb, opt) => {
  opt = opt || {};
  if(!pair || !pair.epriv || !pair.epub){
    if(!SEA.I){ throw 'No secret mix.' }
    pair = await SEA.I(null, {what: key, how: 'secret', why: opt.why});
  }
  var pub = key.epub || key;
  var epub = pair.epub;
  var epriv = pair.epriv;
  var ecdhSubtle = shim.ossl || shim.subtle;
  var pubKeyData = keysToEcdhJwk(pub);
  var props = Object.assign({ 
    public: await ecdhSubtle.importKey(...pubKeyData, true, []) 
  },{name: 'ECDH', namedCurve: 'P-256'});
  var privKeyData = keysToEcdhJwk(epub, epriv);
  var derived = await ecdhSubtle.importKey(...privKeyData, false, ['deriveBits'])
    .then(async (privKey) => {
      var derivedBits = await ecdhSubtle.deriveBits(props, privKey, 256);
      var rawBits = new Uint8Array(derivedBits);
      var derivedKey = await ecdhSubte.importKey('raw', rawBits,
        { name: 'AES-GCM', length: 256 }, true, [ 'encrypt', 'decrypt' ]);
      return ecdhSubtle.exportKey('jwk', derivedKey).then(({ k }) => k);
    })
  return derived;
});

// Alice's side
const alice = await SEA.pair()
const bob = await SEA.pair()

// Alice derives shared secret with Bob's public key
const aliceSecret = await SEA.secret(bob.epub, alice)

// Bob derives the same secret with Alice's public key
const bobSecret = await SEA.secret(alice.epub, bob)

// Both secrets are identical!
console.log(aliceSecret === bobSecret) // true

// Alice sends encrypted message to Bob
async function sendMessage(text, recipient) {
  const user = gun.user()
  const myPair = user._.sea
  
  // Get Bob's public key
  const bobData = await gun.get('~' + recipient).once()
  
  // Derive shared secret
  const secret = await SEA.secret(bobData.epub, myPair)
  
  // Encrypt message
  const encrypted = await SEA.encrypt(text, secret)
  
  // Store encrypted message
  gun.get('messages').get(recipient).set({
    from: myPair.pub,
    msg: encrypted,
    time: Date.now()
  })
}

// Bob receives and decrypts message
async function receiveMessages(sender) {
  const user = gun.user()
  const myPair = user._.sea
  
  // Get Alice's public key
  const aliceData = await gun.get('~' + sender).once()
  
  // Derive same shared secret
  const secret = await SEA.secret(aliceData.epub, myPair)
  
  // Listen for messages
  gun.get('messages').get(myPair.pub).map().on(async (data) => {
    if(data.from === sender) {
      // Decrypt message
      const decrypted = await SEA.decrypt(data.msg, secret)
      console.log('Message from Alice:', decrypted)
    }
  })
}

// Share private data with specific users
async function shareWithUser(data, recipientPub) {
  const user = gun.user()
  if(!user.is) throw 'Not authenticated'
  
  // Get recipient's public key
  const recipient = await gun.get('~' + recipientPub).once()
  
  // Derive shared secret
  const secret = await SEA.secret(recipient.epub, user._.sea)
  
  // Encrypt data
  const encrypted = await SEA.encrypt(data, secret)
  
  // Store in shared space
  gun.get('~' + user.is.pub).get('shared').get(recipientPub).put({
    data: encrypted,
    time: Date.now()
  })
}

async function readSharedData(senderPub) {
  const user = gun.user()
  if(!user.is) throw 'Not authenticated'
  
  // Get sender's public key
  const sender = await gun.get('~' + senderPub).once()
  
  // Derive shared secret
  const secret = await SEA.secret(sender.epub, user._.sea)
  
  // Read and decrypt
  gun.get('~' + senderPub).get('shared').get(user.is.pub).on(async (data) => {
    if(data && data.data) {
      const decrypted = await SEA.decrypt(data.data, secret)
      console.log('Shared data:', decrypted)
    }
  })
}

const secret = await SEA.secret(bob.epub, alice)
console.log(typeof secret) // 'string'
console.log(secret.length) // ~43 characters (base64)

// Encrypt for multiple recipients
async function encryptForGroup(data, recipientPubs) {
  const user = gun.user()
  const encrypted = {}
  
  for(const pub of recipientPubs) {
    const recipient = await gun.get('~' + pub).once()
    const secret = await SEA.secret(recipient.epub, user._.sea)
    encrypted[pub] = await SEA.encrypt(data, secret)
  }
  
  return encrypted
}

// Cache derived secrets to avoid re-derivation
const secretCache = new Map()

async function getCachedSecret(recipientPub, myPair) {
  if(secretCache.has(recipientPub)) {
    return secretCache.get(recipientPub)
  }
  
  const recipient = await gun.get('~' + recipientPub).once()
  const secret = await SEA.secret(recipient.epub, myPair)
  
  secretCache.set(recipientPub, secret)
  return secret
}