let encryptor = PrismEncryptor()  // .aesGCM by default
let key = encryptor.generateKey()

let encrypted = try encryptor.encrypt(Data("secret".utf8), using: key)
let decrypted = try encryptor.decrypt(encrypted, using: key)

let encryptor = PrismEncryptor(algorithm: .chaChaPoly)
let key = encryptor.generateKey()

let encrypted = try encryptor.encrypt(data, using: key)

struct Credentials: Codable, Sendable {
    let token: String
    let refreshToken: String
}

let encrypted = try encryptor.encrypt(credentials, using: key)
let decoded = try encryptor.decrypt(Credentials.self, from: encrypted, using: key)

let keyData = encryptor.exportKey(key)   // Data
let imported = encryptor.importKey(keyData)  // SymmetricKey

let hasher = PrismHasher()
let hash = hasher.hash(Data("message".utf8))          // Data (SHA-256)
let hex = hasher.hashHex(Data("message".utf8))         // String

let sha384 = PrismHasher(algorithm: .sha384)
let sha512 = PrismHasher(algorithm: .sha512)

let key = SymmetricKey(size: .bits256)
let mac = hasher.hmac(for: data, using: key)   // Data
let valid = hasher.verifyHMAC(mac, for: data, using: key)  // Bool

let derived = PrismKeyDerivation.deriveKey(
    from: sharedSecret,
    salt: salt,
    info: Data("context".utf8),
    outputByteCount: 32
)

let salt = PrismKeyDerivation.generateSalt()
let key = PrismKeyDerivation.deriveFromPassword("hunter2", salt: salt)

let keychain = PrismKeychain()
let item = PrismKeychainItem(id: "apiKey", service: "MyApp")

// String
try keychain.save(string: "sk-secret-123", for: item)
let key = try keychain.loadString(for: item)

// Data
try keychain.save(data: rawData, for: item)
let data = try keychain.loadData(for: item)

// Codable
try keychain.save(codable: credentials, for: item)
let creds = try keychain.load(Credentials.self, for: item)

let item = PrismKeychainItem(
    id: "sensitiveKey",
    accessControl: .biometricAny  // requires Face ID / Touch ID
)

// Presets: .default, .biometricAny, .biometricCurrentSet,
//          .devicePasscode, .biometricOrPasscode

let exists = keychain.exists(item)
try keychain.delete(item)
try keychain.deleteAll(service: "MyApp")

let enclave = PrismSecureEnclave()

// Generate a key pair (stored in Secure Enclave)
let publicKey = try enclave.generateKeyPair(tag: "com.app.signing")

// Sign data
let signature = try enclave.sign(data: message, tag: "com.app.signing")

// Verify
let valid = try enclave.verify(
    signature: signature,
    for: message,
    tag: "com.app.signing"
)

// Delete
try enclave.deleteKeyPair(tag: "com.app.signing")

let store = PrismSecureStore(configuration: .biometricProtected)

// Save
try store.save(myCredentials, forKey: "credentials")

// Load
let creds = try store.load(Credentials.self, forKey: "credentials")

// Delete
try store.delete(forKey: "credentials")

// Custom
let config = PrismSecureStoreConfiguration(
    service: "VaultApp",
    algorithm: .chaChaPoly,
    accessControl: .biometricOrPasscode
)
let store = PrismSecureStore(configuration: config)