using nigelcrypt::PasswordKeyProvider;

using nigelcrypt::SecureString;

using nigelcrypt::Algorithm;

using nigelcrypt::RuntimeBinding;

// Passphrase must NOT be a string literal in your binary.

// Provide it at runtime, e.g. via environment variable.

const char* pass = std::getenv("NIGELCRYPT_PASSPHRASE");

if (!pass || !*pass) {

std::cerr << "Set NIGELCRYPT_PASSPHRASE before running.\n";

return 1;

}

// Optional policy enforcement.

nigelcrypt::RegionPolicy rp;

rp.enable = false;

rp.resolver = []() { return std::string("US"); };

rp.allowlist = {"US"};

nigelcrypt::set_region_policy(rp);

nigelcrypt::set_policy(nigelcrypt::hardened_policy());

// Strict mode (hard-fail unless requirements are met).

nigelcrypt::StrictMode sm;

sm.enabled = false;

sm.require_aad = true;

sm.require_binding = true;

sm.require_algorithm = Algorithm::Aes256Gcm;

nigelcrypt::set_strict_mode(sm);

// Configure key provider from the generated header parameters.

std::vector<uint8_t> salt(

nigelcrypt_packed::secret_salt.begin(),

nigelcrypt_packed::secret_salt.end()

);

auto provider = std::make_shared<PasswordKeyProvider>(

std::string(pass),

salt,

nigelcrypt_packed::secret_iterations,

nigelcrypt_packed::secret_key_id

);

nigelcrypt::set_key_provider(provider);

// Import the encrypted envelope (ciphertext only).

std::vector<uint8_t> blob(

nigelcrypt_packed::secret_blob.begin(),

nigelcrypt_packed::secret_blob.end()

);

if (blob.empty()) {

std::cerr << "Packed blob is empty. Generate it with nigelcrypt_pack.\n";

return 1;

}

auto info = nigelcrypt::audit_envelope(blob);

(void)info;

auto s = SecureString::import_envelope(blob);

auto opt = nigelcrypt::hardened_decrypt_options();

auto plain = s.decrypt("aad:packed", opt);

std::cout << "Decrypted: " << plain.c_str() << "\n";

// DPAPI secure storage example.

std::vector<uint8_t> blob_plain = {1, 2, 3};

auto blob_protected = nigelcrypt::encrypt_blob_dpapi(blob_plain, true);

auto blob_unprotected = nigelcrypt::decrypt_blob_dpapi(blob_protected);

(void)blob_unprotected;

// Optional: protect/unprotect plaintext pages.

plain.protect();

plain.unprotect();

// Optional: decrypt into a caller-provided buffer (stack).

char buf[256] = {};

s.decrypt_to(buf, sizeof(buf), "aad:packed");

// Example: in-memory secret with runtime binding + custom metadata.

std::vector<uint8_t> meta = {0x4E,0x69,0x67,0x65,0x6C,0x43,0x72,0x79,0x70,0x74}; // "NigelCrypt"

SecureString runtime_secret;

runtime_secret.set_custom_meta(meta);

runtime_secret.encrypt("runtime-only", "aad:runtime", Algorithm::Aes256Gcm, RuntimeBinding::Process);

auto runtime_plain = runtime_secret.decrypt("aad:runtime", opt);

std::cout << "Runtime: " << runtime_plain.c_str() << "\n";

// Example: rekey to rotate to a new key provider.

auto provider2 = std::make_shared<PasswordKeyProvider>(

std::string(pass),

salt,

nigelcrypt_packed::secret_iterations,

2

);

runtime_secret.rekey(provider2, "aad:runtime", Algorithm::Aes256Gcm, RuntimeBinding::Process);

return 0;