export {
  KeyManager,
  type KeySource,
  type KeychainBackend,
  type KeyManagerOptions,
} from './crypto/key-manager.js';
export {
  DEFAULT_SCRYPT,
  DEFAULT_ARGON2ID,
  type ScryptParams,
  type Argon2idParams,
  deriveMasterKey,
  deriveMasterKeyArgon2id,
  deriveStorageKey,
  deriveFieldKey,
  deriveNonce,
  buildAad,
  hkdfDerive,
  deriveBlobSlotId,
  deriveBlobKey,
  deriveBlobSigningSeed,
} from './crypto/kdf.js';
export {
  AEAD_NONCE_LEN,
  AEAD_TAG_LEN,
  aeadSeal,
  aeadOpen,
} from './crypto/aead.js';
export { EncryptedSQLiteStorage } from './storage/encrypted-sqlite.js';
export {
  EncryptedPostgresStorage,
  ensureEncryptedClientTables,
} from './storage/encrypted-postgres.js';
// EncryptedIndexedDBStorage is browser-only; import it from
// `@shade/storage-encrypted/idb` (or rely on the `browser` condition
// resolving to ./index.browser.ts).
export {
  migrateSqliteToEncrypted,
  rotateSqliteEncryptionKey,
  type MigrateOptions,
  type RotateOptions,
  type MigrateReport,
} from './migrate/migrate-sqlite.js';