use ente_core::crypto;

crypto::init().unwrap();  // Optional (no-op for pure Rust)

let derived = argon::derive_sensitive_key("password")?;
let encrypted = secretbox::encrypt(&user_data, &derived.key)?;
// Store: encrypted.encrypted_data, encrypted.nonce, derived.salt

let mut src = File::open("photo.jpg")?;
let mut dst = File::create("photo.enc")?;
let (key, header) = stream::encrypt_file(&mut src, &mut dst, None)?;
// Store key and header for decryption

let mut src = File::open("photo.jpg")?;
let mut dst = File::create("photo.enc")?;
let (key, header, md5) = stream::encrypt_file_with_md5(&mut src, &mut dst, None)?;
let md5_b64 = crypto::encode_b64(&md5);

let sealed = sealed::seal(&secret_data, &recipient_public_key)?;
// Only recipient can open with their secret key
let opened = sealed::open(&sealed, &recipient_pk, &recipient_sk)?;

let kek = argon::derive_key("password", &salt, mem_limit, ops_limit)?;
let login_key = kdf::derive_login_key(&kek)?;