//! Jellyfish Merkle Tree state layer for the Newton operator.
//!
//! Provides a single unified state tree with three logical namespaces:
//!
//! - **Identity** (`0x01`) — encrypted identity data (KYC attestations, on-chain bindings)
//! - **Confidential** (`0x02`) — encrypted provider data (blacklists, allowlists)
//! - **Secrets** (`0x03`) — policy client secrets (HPKE-encrypted WASM secrets)
//!
//! Namespaces share one JMT via a 1-byte prefix at `leaf_key[0]`. One version counter,
//! one state root, one proof cache.
//!
//! Built over [redb](https://docs.rs/redb) for persistence and
//! [jmt](https://docs.rs/jmt) for sparse merkle proofs with SHA-256 hashing.
//!
//! # Async / Tokio callers
//!
//! All redb operations are **synchronous** and may block on file I/O. Callers on
//! a tokio runtime must wrap [`StateTree`] calls in [`tokio::task::spawn_blocking`]
//! to avoid stalling the async executor.

mod cache;
mod error;
mod grant;
mod header;
mod key;
mod metrics;
mod storage;
mod tree;

pub use cache::ProofCache;
pub use error::StateTreeError;
pub use grant::{extract_grant_status, GrantDecodeError, GrantStatus, GrantValue};
pub use header::LeafHeaderV1;
pub use key::{extract_confidential_grant, extract_identity_linkage, NamespaceId, NamespaceKey};
pub use tree::{LeafProof, StateRoot, StateTree, StateTreeConfig};
