/**
 * Browser-safe entry point — exports KeyManager + crypto primitives only.
 *
 * Use this subpath when bundling for the browser to avoid pulling
 * `bun:sqlite` (Bun-only) or `postgres` (Node-only) into the output.
 *
 * ```ts
 * import { KeyManager } from '@shade/storage-encrypted/crypto';
 * ```
 *
 * For backend storage, import `@shade/storage-encrypted/sqlite` (Bun) or
 * `@shade/storage-encrypted/postgres` (Node). For browser storage, import
 * `@shade/storage-encrypted/idb`.
 */

export {
  KeyManager,
  type KeySource,
  type KeychainBackend,
  type KeyManagerOptions,
} from './crypto/key-manager.js';
export {
  DEFAULT_SCRYPT,
  DEFAULT_ARGON2ID,
  type ScryptParams,
  type Argon2idParams,
  deriveMasterKey,
  deriveMasterKeyArgon2id,
  deriveStorageKey,
  deriveFieldKey,
  deriveNonce,
  buildAad,
  hkdfDerive,
} from './crypto/kdf.js';
export {
  AEAD_NONCE_LEN,
  AEAD_TAG_LEN,
  aeadSeal,
  aeadOpen,
} from './crypto/aead.js';
export {
  COL,
  TBL,
  sealString,
  openString,
  sealBytes,
  openBytes,
  sealIdentity,
  openIdentity,
  sealConfig,
  openConfig,
  sealSignedPreKey,
  openSignedPreKey,
  sealOneTimePreKey,
  openOneTimePreKey,
  sealSession,
  openSession,
  sealTrust,
  openTrust,
  sealRetired,
  openRetired,
  sealStreamSensitive,
  openStreamSensitive,
} from './crypto/row-codec.js';