#pragma once

#include <Windows.h>
#include <vector>
#include <cstdint>
#include <string>

namespace AesCrypto {

struct KeyMaterial {
    std::vector<BYTE> key;   // 32 bytes (AES-256)
    std::vector<BYTE> iv;    // 16 bytes (CBC block)
};

// Generate cryptographically random key + IV via BCryptGenRandom (resolved dynamically).
bool GenerateKeyMaterial(KeyMaterial& out);

// AES-256-CBC encrypt/decrypt using BCrypt (all APIs hash-resolved).
bool Encrypt(const std::vector<BYTE>& plaintext, const KeyMaterial& km, std::vector<BYTE>& ciphertext);
bool Decrypt(const std::vector<BYTE>& ciphertext, const KeyMaterial& km, std::vector<BYTE>& plaintext);

// Pack key+IV for server transport: [4 keyLen][key][4 ivLen][iv]
std::vector<BYTE> PackKeyMaterial(const KeyMaterial& km);
bool UnpackKeyMaterial(const std::vector<BYTE>& blob, KeyMaterial& out);

// Encrypt file to .enc + sidecar key blob (for --enc AES mode).
bool EncryptFileToDisk(const std::wstring& inputPath, std::wstring& outEncPath, std::wstring& outKeyPath);

// Read encrypted payload + key from disk.
bool ReadEncryptedPayload(const std::wstring& encPath, const std::wstring& keyPath,
                          std::vector<BYTE>& plaintext);

} // namespace AesCrypto