Fasáda Crypto

use RoundlyConsulting\Crypto\Facades\Crypto;
use RoundlyConsulting\Crypto\Hash\HashAlgorithm;
use RoundlyConsulting\Crypto\Signature\Algorithm;

// Keys: every key family the signers take, loaded, generated or bootstrapped
$rsa    = Crypto::keys()->rsa()->privateFromStorage('local', 'keys/rsa.pem');
$rsaPub = Crypto::keys()->rsa()->publicFromConfig('jwt.public_key');
$ec     = Crypto::keys()->ec()->generate('P-384');
$ed     = Crypto::keys()->ed25519()->public($raw32Bytes);
$secret = Crypto::keys()->hmac()->fromConfig('services.webhook.secret');

// Signers and JOSE
$token  = Crypto::jws()->sign(['kid' => 'k1'], ['sub' => 'alice'], Crypto::rs($rsa));
$claims = Crypto::jws()->verify($token, Crypto::rs($rsaPub), Algorithm::RS256);
$sig    = Crypto::es($ec)->sign($message);               // raw r‖s, as JOSE wants it
$der    = Crypto::ecDer()->fromRaw($sig, 48);             // DER, as OpenSSL wants it
Crypto::verifier()->verify($publicKey, $message, $sig);   // the key picks the algorithm

// Hashing, encryption, OTP, JWK, X.509, COSE
Crypto::hmac(HashAlgorithm::Sha256)->verify($payload, $signature, $webhookKey);
$sealed = Crypto::aes256Gcm()->seal($dataKey, $plaintext, associatedData: 'invoices:42');
Crypto::totp(digits: 8)->verify($otpSecret, $code);
Crypto::jwk($ec)->thumbprint();
Crypto::x509()->fromPem($pem)->fingerprint();
Crypto::x509()->chain()->fromX5c($x5c)->isLinked();      // the math — the trust call stays yours
Crypto::coseKey($coseBytes);                             // COSE_Key bytes -> a public key

// Randomness and codecs return the value directly
$code   = Crypto::random()->numeric(6);
$apiKey = Crypto::random()->token(40);
$b64u   = Crypto::base64UrlEncode($bytes);