//! FIPS-mode rustls crypto provider for iroh QUIC endpoints.
//!
//! Every iroh `Endpoint::builder()` call in peat-mesh must select a
//! FIPS-approved crypto provider explicitly. `ring` is not FIPS 140-3
//! validated and is therefore forbidden by CLAUDE.md for any iroh
//! endpoint in the peat ecosystem; `aws-lc-rs` is the approved
//! provider under SP 800-56C / SP 800-108. iroh 0.98 makes this an
//! explicit builder concern via the `.crypto_provider()` method
//! (n0-computer/iroh#3978 / #4261).
//!
//! Centralizing the provider construction in one helper means:
//!
//! - **No comment-block divergence** between endpoint construction
//!   sites. Previously each site had its own `Arc::new(rustls::crypto::
//!   aws_lc_rs::default_provider())` plus its own rationale comment;
//!   they drifted over time (peat-mesh#158 QA cycles). One helper,
//!   one rationale.
//! - **Future-proof against new endpoint sites.** Anyone adding a new
//!   iroh endpoint just calls `iroh_quic_provider()` and gets the
//!   approved provider by construction.
//! - **Structurally pinned by `aws_lc_rs_provider_is_linked`**
//!   (see [`crate::storage::iroh_blob_store`]'s test module) — the
//!   helper only compiles when `rustls`'s `aws-lc-rs` feature is
//!   active in peat-mesh's feature set, so a future flip back to
//!   `ring` becomes a loud build failure instead of a silent FIPS
//!   regression.

use std::sync::Arc;

/// Returns the FIPS-approved rustls crypto provider that every iroh
/// QUIC endpoint in peat-mesh must use.
///
/// Wire as: `Endpoint::builder(preset).crypto_provider(iroh_quic_provider())`.
///
/// Each call constructs a fresh `Arc<CryptoProvider>` rather than a
/// process-static singleton. iroh consumes it by `Arc` and the
/// construction is cheap (a few struct initializations), so the
/// duplication is intentional — keeps each endpoint's provider
/// independent and avoids any shared-state surprises across
/// concurrent endpoint constructions.
pub fn iroh_quic_provider() -> Arc<rustls::crypto::CryptoProvider> {
    Arc::new(rustls::crypto::aws_lc_rs::default_provider())
}
