"""andrea_svc_auth — shared service auth for the Andrea pods.

API-key (internal automation/services) OR Keycloak OIDC (user pass-through),
constant-time and fail-closed, never by-IP. The core + client are stdlib-only;
the OIDC validator and the aiohttp/Django adapters pull their deps lazily.

    from andrea_svc_auth import authenticate, verify_api_key, OIDCValidator
    from andrea_svc_auth.client import post_event              # service -> gem event
    from andrea_svc_auth.aiohttp_guard import require_auth      # aiohttp handlers
    from andrea_svc_auth.django_auth import ServiceOrOIDCAuthentication  # DRF
"""
from .client import API_KEY_ENV, post_event
from .core import (
    DEFAULT_API_KEY_HEADER,
    AuthResult,
    OIDCValidator,
    Principal,
    authenticate,
    verify_api_key,
)

__version__ = "0.1.0"
__all__ = [
    "authenticate", "verify_api_key", "OIDCValidator", "Principal", "AuthResult",
    "DEFAULT_API_KEY_HEADER", "post_event", "API_KEY_ENV",
]
