"""Public auth API for browser-cli.

Implementation lives in focused modules:
- ``auth.agent``: SSH-agent/YubiKey helpers
- ``auth.keys``: file keys and authorized_keys management
- ``auth.signing``: canonical payload signing/verification
- ``auth.pq``: ML-KEM KEX and encrypted transport helpers
"""
from browser_cli.auth.agent import (
  AgentKey,
  agent_find_key,
  agent_list_keys,
  agent_roundtrip as _agent_roundtrip,
  agent_sign_raw,
  pack_ssh_string as _pack_str,
  unpack_ssh_string as _unpack_str,
)
from browser_cli.auth.keys import (
  add_authorized_key,
  format_authorized_line,
  generate_keypair,
  load_authorized_keys,
  load_authorized_keys_with_names,
  load_authorized_keys_with_policies,
  load_private_key,
  public_key_hex,
)
from browser_cli.auth.pq import (
  new_nonce,
  pq_decrypt,
  pq_encrypt,
  pq_kex_client_encapsulate,
  pq_kex_server_decapsulate,
  pq_kex_server_keypair,
  pq_transport_key as _pq_transport_key,
)
from browser_cli.auth.signing import (
  auth_message as _auth_message,
  canonical_payload,
  sign,
  verify,
)
from browser_cli.constants import DEFAULT_AUTHORIZED_KEYS_PATH, DEFAULT_KEY_PATH, PQ_KEX_ALG, PQ_TRANSPORT_ALG

__all__ = [
  "AgentKey",
  "DEFAULT_AUTHORIZED_KEYS_PATH",
  "DEFAULT_KEY_PATH",
  "PQ_KEX_ALG",
  "PQ_TRANSPORT_ALG",
  "add_authorized_key",
  "agent_find_key",
  "agent_list_keys",
  "agent_sign_raw",
  "canonical_payload",
  "format_authorized_line",
  "generate_keypair",
  "load_authorized_keys",
  "load_authorized_keys_with_names",
  "load_authorized_keys_with_policies",
  "load_private_key",
  "new_nonce",
  "pq_decrypt",
  "pq_encrypt",
  "pq_kex_client_encapsulate",
  "pq_kex_server_decapsulate",
  "pq_kex_server_keypair",
  "public_key_hex",
  "sign",
  "verify",
]