"""
djb.secrets - Encrypted secrets management with SOPS

Provides encrypted secrets storage using SOPS with age encryption.
Compatible with Kubernetes secrets and cloud deployments.

Multi-recipient encryption is configured via .sops.yaml with email comments.

Age private keys are protected with GPG symmetric encryption to avoid
storing them in plaintext on disk.
"""

from djb.secrets.core import (
    SecretsManager,
    SopsError,
    check_age_installed,
    check_sops_installed,
    create_sops_config,
    decrypt_file,
    encrypt_file,
    find_placeholder_secrets,
    format_identity,
    generate_age_key,
    get_all_recipients,
    get_default_key_path,
    get_default_secrets_dir,
    get_public_key_from_private,
    is_placeholder_value,
    is_valid_age_public_key,
    load_secrets,
    load_secrets_for_mode,
    parse_identity,
    parse_sops_config,
    rotate_keys,
)
from djb.secrets.gpg import (
    GpgError,
    check_gpg_installed,
    gpg_decrypt_file,
    gpg_encrypt_file,
    is_gpg_encrypted,
)
from djb.secrets.init import (
    SECRETS_ENVIRONMENTS,
    SecretsStatus,
    init_or_upgrade_secrets,
)
from djb.secrets.protected import (
    ProtectedFileError,
    is_age_key_protected,
    protect_age_key,
    protected_age_key,
    unprotect_age_key,
)

__all__ = [
    # Core SOPS functions
    "SecretsManager",
    "SopsError",
    "check_age_installed",
    "check_sops_installed",
    "create_sops_config",
    "decrypt_file",
    "encrypt_file",
    "find_placeholder_secrets",
    "format_identity",
    "generate_age_key",
    "get_all_recipients",
    "get_default_key_path",
    "get_default_secrets_dir",
    "get_public_key_from_private",
    "is_placeholder_value",
    "is_valid_age_public_key",
    "load_secrets",
    "load_secrets_for_mode",
    "parse_identity",
    "parse_sops_config",
    "rotate_keys",
    # GPG encryption
    "GpgError",
    "check_gpg_installed",
    "gpg_decrypt_file",
    "gpg_encrypt_file",
    "is_gpg_encrypted",
    # Protected file access
    "ProtectedFileError",
    "is_age_key_protected",
    "protect_age_key",
    "protected_age_key",
    "unprotect_age_key",
    # Initialization
    "SECRETS_ENVIRONMENTS",
    "SecretsStatus",
    "init_or_upgrade_secrets",
]
