/**
 * relay-auth (P5) public barrel — the authorization surface P1/P3/P6 import. Imports
 * relay-contracts (§4) read-only; never redefines a frozen contract. Socket-free (no ws/xterm/ANSI
 * parser → INV2/INV11 hold by construction).
 */
export * from './types.js'

// Config (INV9)
export {
  configureVerifyKey,
  loadVerifyKeyFromEnv,
  getVerifyKey,
  KeyConfigError,
} from './config/keys.js'

// T2 capability tokens + DPoP + device-auth proof
export { issueCapabilityToken, CONNECT_TOKEN_MIN_TTL_SEC, CONNECT_TOKEN_MAX_TTL_SEC } from './capability/issue.js'
export {
  verifyCapabilityToken,
  verifyDpopProof,
  readCnfJkt,
  subAccountId,
  hasRight,
  peekExp,
  type DpopContext,
} from './capability/verify.js'
export { CapabilityError } from './capability/errors.js'
export {
  signDeviceAuthProof,
  verifyDeviceProof,
  deviceProofAccount,
  type DeviceProofBinding,
} from './capability/device-proof.js'

// T3 authz
export {
  authorizeConnect,
  authorizeReattach,
  type AuthzOutcome,
  type ConnectRequest,
  type ReattachRequest,
} from './authz/decide.js'
export { accountIdFromToken, principalFromToken, AuthzInputError } from './authz/principal.js'

// T4 audit
export { buildAuditEvent, audit } from './audit/log.js'
export { assertZeroPayload, ZeroPayloadViolation, MAX_METADATA_LEN } from './audit/redact.js'
export { onAuditEvent, type Alerter, type AlertKind } from './audit/alert.js'

// T5–T8 human auth
export { startRegistration, finishRegistration } from './human/webauthn/register.js'
export { startAuthentication, finishAuthentication } from './human/webauthn/authenticate.js'
export * from './human/webauthn/verifier.js'
export {
  generateTotpSecret,
  verifyTotp,
  checkTotpAttemptRate,
  recordTotpFailure,
} from './human/totp/totp.js'
export {
  buildAuthUrl,
  exchangeCode,
  verifyIdToken,
  randomUrlToken,
  pkceChallenge,
  OidcError,
  type OidcConfig,
  type OidcTokenSet,
} from './human/oidc/oidc.js'
export {
  policyForHost,
  needsStepUp,
  recordStepUp,
  DEFAULT_STEPUP_MAX_AGE_SECONDS,
} from './human/stepup/stepup.js'

// T9 mTLS / SPIFFE
export { spiffeIdFor, parseSpiffeId, trustDomain, SpiffeError } from './agent/spiffe.js'
export type { SpiffeKind } from './agent/spiffe.js'
export {
  verifyAgentCert,
  defaultParseX509,
  type MtlsVerifyResult,
  type ParsedCert,
  type ParseCert,
} from './agent/verify-mtls.js'
export { shouldRotate, DEFAULT_ROTATION_PLAN, DEFAULT_CERT_TTL_SECONDS, type RotationPlan } from './agent/rotate.js'

// T10 revocation
export { revoke, revokeToken } from './revocation/revoke.js'
export { isTokenRevoked, killsScope } from './revocation/check.js'

// T11 rate-limits
export {
  policyForPlan,
  PRE_AUTH_POLICY,
  checkPreAuthRate,
  checkConnectRate,
  checkConcurrentSessions,
  checkEnrollRate,
} from './ratelimit/quota.js'

// T12 enforcement
export { onUpgrade, type UpgradeContext, type EnforceDeps } from './enforce/onUpgrade.js'
export { onReattach, type ReattachContext } from './enforce/onReattach.js'