"""GreyMatter Security — defense in depth.

Layer 0: API Authentication (HMAC-signed bearer tokens, stateless verification)
Layer 1: Input Validation (size limits, rate limiting)
Layer 2: Content Scanning (secret detection, 21 regex patterns)
Layer 3: Policy Engine (declarative YAML rules)
Layer 4: Encrypted Storage (SQLCipher AES-256 + sync AES-256-GCM with ML-KEM key wrap)

FIPS: All crypto routed through fips.py — OpenSSL FIPS provider when
      GM_FIPS_MODE=1, Python stdlib fallback otherwise.

Transport: TLS with post-quantum hybrid certs (ECDSA + ML-DSA-65 via pqx)

See SECURITY.md for the full security model, docs/fips-crypto.md for the
FIPS crypto wrapper reference, and docs/auth-middleware.md for the
authentication integration guide.
"""

from greymatter_core.security.tokens import (
    generate_node_token,
    verify_node_token,
    TokenStore,
)
from greymatter_core.security.encryption import (
    encrypt_sync_payload,
    decrypt_sync_payload,
    MLKEM_AVAILABLE,
)
from greymatter_core.security.fips import (
    fips_random_bytes,
    fips_sha256,
    fips_hmac_sha256,
    fips_pbkdf2,
    fips_token_urlsafe,
    fips_token_bytes,
    fips_choice,
    is_fips_mode,
)

__all__ = [
    "generate_node_token",
    "verify_node_token",
    "TokenStore",
    "encrypt_sync_payload",
    "decrypt_sync_payload",
    "MLKEM_AVAILABLE",
    # FIPS-aware crypto primitives
    "fips_random_bytes",
    "fips_sha256",
    "fips_hmac_sha256",
    "fips_pbkdf2",
    "fips_token_urlsafe",
    "fips_token_bytes",
    "fips_choice",
    "is_fips_mode",
]

# Middleware requires FastAPI — import only when available
try:
    from greymatter_core.security.middleware import (
        require_auth,
        AuthMiddleware,
        PUBLIC_PATHS,
    )
    __all__.extend(["require_auth", "AuthMiddleware", "PUBLIC_PATHS"])
except ImportError:
    pass
