let log = PrismSecurityAuditLog()

log.record(PrismSecurityEvent(kind: .biometricSuccess, detail: "Face ID"))
log.record(PrismSecurityEvent(
    kind: .keychainRead,
    detail: "read apiToken",
    metadata: ["key": "apiToken"]
))

// All entries
let all = log.allEntries

// By kind
let biometric = log.entries(ofKind: .biometricSuccess)

// By date range
let today = log.entries(from: startOfDay, to: .now)

// Recent N
let latest = log.recentEntries(10)

// Count
log.count

if log.verifyIntegrity() {
    // Hash chain intact — no entries tampered
} else {
    // ALERT: audit log has been modified
}

let exporter = PrismAuditExporter()

// JSON export (ISO 8601 dates)
let jsonData = try exporter.exportJSON(log.allEntries)
let jsonString = try exporter.exportJSONString(log.allEntries)

// Summary
let summary = exporter.exportSummary(log.allEntries)
print(summary.totalEntries)                    // 42
print(summary.eventCounts[.biometricSuccess])  // 15

// Cap at 1000 entries (oldest pruned automatically)
let log = PrismSecurityAuditLog(maxEntries: 1000)

// Manual clear
log.clear()

let manager = PrismTokenManager()

await manager.store(PrismTokenPair(
    accessToken: jwtString,
    refreshToken: refreshString
))

// Returns current token if valid, refreshes if expiring soon
let token = try await manager.validAccessToken { pair in
    // Called when token needs refresh
    let newPair = try await authService.refresh(pair.refreshToken!)
    return newPair
}

print(token.subject)    // "user123"
print(token.isExpired)  // false

// 10 concurrent API calls — only ONE refresh request
await withTaskGroup(of: Void.self) { group in
    for _ in 0..<10 {
        group.addTask {
            let token = try await manager.validAccessToken(refresher: refresh)
            // All 10 get the same refreshed token
        }
    }
}

let token = try PrismAccessToken.decode(jwtString)

token.subject       // "user123"
token.issuer        // "auth.example.com"
token.isExpired     // Bool
token.expiresAt     // Date?
token.issuedAt      // Date?

// Custom claims
let role: String? = token.claim("role")
let org: Int? = token.claim("org_id")

// Expiry check with buffer
token.expiresWithin(300)  // true if < 5 min left

let config = PrismTokenConfiguration(
    service: "MyAuth",
    refreshThreshold: 60,           // refresh when < 60s left
    refreshStrategy: .proactive     // refresh before expiry
)

let manager = PrismTokenManager(configuration: config)

let interceptor = PrismTokenInterceptor(manager: manager)

var request = URLRequest(url: apiURL)
request = try await interceptor.intercept(request)
// Adds: Authorization: Bearer <token>

let redactor = PrismRedactor()

redactor.redact("Email: john@example.com")
// → "Email: j***@***.***"

redactor.redact("Call 555-123-4567")
// → "Call ***-***-4567"

redactor.redact("Card: 4111 1111 1111 1234")
// → "Card: ****-****-****-1234"

redactor.redact("SSN: 123-45-6789")
// → "SSN: ***-**-6789"

redactor.redact("IP: 192.168.1.100")
// → "IP: ***.***.***.***"

// Mask (default) — partial reveal
let mask = PrismRedactor(style: .mask)
mask.redactValue("john@example.com", type: .email)
// → "j***@***.***"

// Remove — full replacement
let remove = PrismRedactor(style: .remove)
remove.redactValue("john@example.com", type: .email)
// → "[REDACTED]"

// Hash — first 8 hex chars
let hash = PrismRedactor(style: .hash)
hash.redactValue("john@example.com", type: .email)
// → "a1b2c3d4..."

let guard = PrismPrivacyGuard()

// Redact PII in strings
let safe = guard.redact("Email: test@test.com")

// Classify field sensitivity
guard.classify("password")    // .restricted
guard.classify("email")       // .sensitive
guard.classify("user_id")     // .internal
guard.classify("name")        // .public

// Auto-protect by field name
guard.protect(field: "password", value: "secret123")
// → "[RESTRICTED]"

guard.protect(field: "email", value: "john@example.com")
// → "j***@***.***"

guard.protect(field: "name", value: "John")
// → "John" (public — unchanged)

enum PrismPrivacyLevel: Comparable {
    case `public`     // display names, usernames
    case `internal`   // user IDs, session IDs
    case sensitive    // emails, phone numbers
    case restricted   // passwords, tokens, SSNs
}

// Comparable: public < internal < sensitive < restricted

SensitiveDataView()
    .prismScreenProtection()

PrismSecureView {
    Text("API Key: \(apiKey)")
    Text("Balance: \(balance)")
}

let clipboard = PrismClipboardGuard(clearAfter: 30) // seconds

clipboard.copySecurely("my-api-token")
// Clipboard auto-clears after 30 seconds

clipboard.clearNow()      // immediate clear
clipboard.cancelClear()   // cancel pending auto-clear