"""mgf-auth — ISP-split auth verifier seams (session + webhook).

A `mgf-common` sibling under the `mgf.*` namespace. The top-level export
is the *generic, vendor-neutral* surface so importing ``mgf.auth`` pulls
no vendor SDK:

  * :class:`SessionVerifier` (generic over the consumer's principal type)
    + :class:`WebhookVerifier` — the two ISP seams (ADR-016).
  * :class:`WebhookEvent` — the verified-webhook DTO.
  * :class:`InvalidSessionError` / :class:`InvalidWebhookSignatureError`
    — typed 401 errors (subclass ``mgf.common`` ``HttpUnauthorizedError``).
  * :class:`MockSessionVerifier` / :class:`MockWebhookVerifier` — test
    doubles.

The Clerk adapters live in submodules so ``pyjwt`` stays behind the
``[clerk]`` extra:

  * ``from mgf.auth.clerk_session import ClerkSessionVerifier, ClerkClaims``
  * ``from mgf.auth.clerk_webhook import ClerkWebhookVerifier``

Identity resolution (Clerk ids → the consumer's principal) is the
consumer's ``principal_resolver`` — mgf-auth never imposes a principal
shape, so an app keeps its own role-typed principal.
"""

from __future__ import annotations

from mgf.auth._errors import InvalidSessionError, InvalidWebhookSignatureError
from mgf.auth._events import WebhookEvent
from mgf.auth._protocols import SessionVerifier, WebhookVerifier
from mgf.auth.mock import MockSessionVerifier, MockWebhookVerifier

__all__ = [
    "InvalidSessionError",
    "InvalidWebhookSignatureError",
    "MockSessionVerifier",
    "MockWebhookVerifier",
    "SessionVerifier",
    "WebhookEvent",
    "WebhookVerifier",
    "__version__",
]

__version__ = "0.1.8"
