CLI & API reference.

# install (Homebrew / cargo / direct, once released)
brew install veilcc/tap/veil

# sign in from the browser (people), stores a token locally
veil login
veil whoami

# or use an API key (CI)
export VEILCC_KEY="veil_sk_live_…"        # or pass --api-key

veil protect [FLAGS] <input.o | module.ll> -o <output>

# seal a C/C++ object (functions auto-discovered from veil:seal)
veil protect --level seal app.o -o app.sealed.o

# seal by symbol + signature (Rust / any C-ABI object)
veil protect --level seal --symbols check_license \
  --proto "uint32_t check_license(const unsigned char*, size_t)" \
  liblicense.o -o license.sealed.o

# obfuscate IR with a fixed, reproducible seed
veil protect --level obfuscate --seed 0x9f3ac1… module.ll -o module.o

# device-bound: the key is unwrapped at runtime, never in the file
veil protect --level device-bound --key-provider veil_key \
  attest.o -o attest.sealed.o --receipt build-receipt.json

veil verify build-receipt.json --artifact app.sealed.o
# → receipt hash matches · sealed: check_license · level seal · ok

curl https://veilcc.com/api/protect \
  -H "Authorization: Bearer $VEILCC_KEY" \
  -F "binary=@license.o" \
  -F "level=seal" \
  -F "proto=uint32_t check_license(const char*)" \
  -F "anti_debug=1" \
  -o response.json

{
  "ok": true,
  "artifact_b64": "f0VMRgIBAQ…",          // the protected object, base64
  "receipt": {
    "sealed_symbol": "check_license",
    "level": "seal",
    "target": "arm64-macos",
    "plaintext_in_file": "none",
    "hot_paths": "left native",
    "key_cache": "ephemeral (scrubbed per call)",
    "anti_debug": "on (traced process decrypts to garbage)",
    "seed": "0x9f3ac1…",
    "receipt_hash": "b7a4…e39c"
  },
  "quota": { "used": 42, "limit": 500 }
}