/**
 * Runtime permissions public API barrel.
 *
 * Exports the LayeredPolicyEvaluator, all types, rule evaluators, safety checks,
 * and the createPermissionEvaluator() factory function.
 *
 * Feature flag: `permissions-policy-engine` must be enabled to use this module in production.
 */
export { LayeredPolicyEvaluator } from '@pellux/goodvibes-sdk/platform/runtime/permissions/evaluator';
export { DecisionLog } from '@pellux/goodvibes-sdk/platform/runtime/permissions/decision-log';
export { runSafetyChecks } from '@pellux/goodvibes-sdk/platform/runtime/permissions/safety-checks';
export { PermissionSimulator, SimulationEnforcementError } from '@pellux/goodvibes-sdk/platform/runtime/permissions/simulation';
export { buildDefaultPolicySimulationScenarios, runPolicySimulationScenarios } from '@pellux/goodvibes-sdk/platform/runtime/permissions/simulation-scenarios';
export { lintPolicyConfig } from '@pellux/goodvibes-sdk/platform/runtime/permissions/lint';
export { buildPolicyPreflightReview } from './preflight.js';
export { buildPermissionRuleSuggestions } from './rule-suggestions.js';
// Policy signing
export { signBundle, verifyBundle, canonicalise } from '@pellux/goodvibes-sdk/platform/runtime/permissions/policy-signer';
export { loadPolicyBundle, createUnsignedBundle, PolicySignatureError } from '@pellux/goodvibes-sdk/platform/runtime/permissions/policy-loader';
export { evaluatePrefixRule, evaluateArgShapeRule, evaluatePathScopeRule, evaluateNetworkScopeRule, evaluateModeConstraintRule, } from '@pellux/goodvibes-sdk/platform/runtime/permissions/rules/index';
// Divergence dashboard
export { DivergenceDashboard, DivergenceGateError, } from '@pellux/goodvibes-sdk/platform/runtime/permissions/divergence-dashboard';
// Policy-as-Code
export { PolicyRegistry } from '@pellux/goodvibes-sdk/platform/runtime/permissions/policy-registry';
export { PolicyRuntimeState, } from './policy-runtime.js';
// ── Factory ──────────────────────────────────────────────────────────────────────
import { LayeredPolicyEvaluator } from '@pellux/goodvibes-sdk/platform/runtime/permissions/evaluator';
import { PermissionSimulator } from '@pellux/goodvibes-sdk/platform/runtime/permissions/simulation';
/**
 * createPermissionEvaluator — Factory function for the runtime permission evaluator.
 *
 * Returns a LayeredPolicyEvaluator configured with the given options.
 * Designed as the primary entry point for integrating the runtime permissions system.
 *
 * The returned evaluator exposes:
 *   - `evaluate(toolName, args)` — perform a full layered evaluation
 *   - `recordSessionOverride(...)` — cache a user prompt response
 *   - `log` — DecisionLog for audit queries
 *   - `getMode()` — inspect the active mode
 *
 * @example
 * ```ts
 * const perms = createPermissionEvaluator({ mode: 'default', rules: [] });
 * const decision = perms.evaluate('write', { path: '/tmp/out.txt' });
 * if (!decision.allowed) {
 *   console.error('denied:', decision.reason);
 * }
 * ```
 *
 * @param config     — Optional configuration; all fields have safe defaults.
 * @param provenance — Optional bundle provenance (GC-PERM-011).
 */
export function createPermissionEvaluator(config = {}, provenance) {
    return new LayeredPolicyEvaluator(config, provenance);
}
/**
 * createPermissionSimulator — Factory for `PermissionSimulator`.
 *
 * Creates a dual-evaluator simulation pipeline for the runtime permissions system that runs
 * both the actual and simulated evaluators in parallel, tracking divergence.
 *
 * Requires the `permissions-simulation` feature flag to be enabled.
 *
 * @param actualConfig    — Config for the authoritative evaluator.
 * @param simulatedConfig — Config for the candidate evaluator.
 * @param simulationMode  — Controls enforcement and warning behaviour.
 * @param config          — Optional tuning: record limit, divergence threshold.
 *
 * @example
 * ```ts
 * const simulator = createPermissionSimulator(
 *   { mode: 'default', rules: currentRules },
 *   { mode: 'default', rules: candidateRules },
 *   'warn-on-divergence',
 * );
 * const result = simulator.evaluate('write', { path: '/tmp/out.txt' });
 * const report = simulator.getDivergenceReport();
 * ```
 */
export function createPermissionSimulator(actualConfig, simulatedConfig, simulationMode, config = {}, flagManager) {
    if (flagManager && !flagManager.isEnabled('permissions-simulation')) {
        throw new Error('Feature flag "permissions-simulation" is not enabled');
    }
    return new PermissionSimulator(actualConfig, simulatedConfig, simulationMode, config);
}
