/**
 * `@oxy.so/core/crypto` — the self-custody identity: keys, signatures, the
 * recovery phrase, and the primitives under them.
 *
 * Its own entry so an app that never holds a key never ships secp256k1, bip39
 * or the AEAD cipher. The SDK's own namespaces (`oxy.auth`, `oxy.identity`,
 * `oxy.civic`, the identity-bound session) and `@oxy.so/services` load it with
 * `import()` on first use — all through THIS module, so a web bundler makes it
 * one lazy chunk. Two lazy roots over the same modules (this entry and a second
 * internal barrel) made Metro hoist the shared stack into the always-loaded
 * common chunk, which is the cost the lazy loading exists to avoid.
 */

// MUST stay the first import: `@noble/hashes` captures `globalThis.crypto` when
// it is evaluated, so the shim has to exist before anything below reaches it.
import './polyfill';

export {
  KeyManager,
  IdentityAlreadyExistsError,
  IdentityPersistError,
  IdentityUnavailableError,
} from './keyManager';
export type { KeyPair, IdentityStatus, IdentityRecoveryResult } from './keyManager';
export { readIdentityMarker, updateIdentityMarker } from './identityMarker';
export type { IdentityMarker } from './identityMarker';
export type { IdentityDeviceBackupStore } from './deviceBackup';
export type { IdentitySignerStore } from './identitySigner';
export { SignatureService } from './signatureService';
export type { SignedMessage, AuthChallenge } from './signatureService';
export { RecoveryPhraseService, BACKUP_KDF_ENCRYPTION_INFO } from './recoveryPhrase';
export type { RecoveryPhraseResult, PendingIdentityResult, BackupMaterial } from './recoveryPhrase';

// Low-level primitives (encrypted backup, device transfer)
export { hkdfSha256 } from './kdf';
export { encryptAead, decryptAead, AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH } from './aead';
export type { AeadResult } from './aead';
export { deriveSharedSecret } from './ecdh';

// What the identity key computes without leaving its holder: the same functions
// Commons' identity host implements natively on Android.
export {
  SCOPED_SEED_KDF_SALT,
  SOCIAL_RECEIVE_CHAIN_CODE_KEY,
  MAX_SOCIAL_RECEIVE_INDEX,
  deriveScopedSeedFromKey,
  deriveSocialReceiveKey,
  signSocialReceiveDigest,
  authChallengeDigest,
} from './identityDerivations';

// Identity proofs — the one signed format for operations on a personal root
// (docs/adr/0024-one-oxy-account-root-holders.md D7)
export { digestIdentityPayload, signIdentityProof } from './identityProof';
// Linking Commons to an account: the code both screens compare (ADR 0029 D3)
export { deriveIdentityLinkCode } from './identityLink';
// The registration proof-of-work and the protocol signing primitives the
// namespaces use, so they load with the rest of the identity stack.
export { solveRegistrationPow } from './registrationPow';
// Content addressing for direct-to-storage uploads (`oxy.assets.uploadLarge`).
export { createContentHasher } from './contentHash';
export type { ContentHasher } from './contentHash';
export { canonicalize, loadCommonsIdentityBridge } from '@oxy.so/protocol';
export { signMessage, verifySignature } from '@oxy.so/protocol/sign';