/**
 * Runtime permissions public API barrel.
 *
 * Exports the LayeredPolicyEvaluator, all types, rule evaluators, safety checks,
 * and the createPermissionEvaluator() factory function.
 *
 * Feature flag: `permissions-policy-engine` must be enabled to use this module in production.
 */
export { LayeredPolicyEvaluator } from './evaluator.js';
export { DecisionLog } from './decision-log.js';
export { runSafetyChecks } from './safety-checks.js';
export { PermissionSimulator, SimulationEnforcementError } from './simulation.js';
export { buildDefaultPolicySimulationScenarios, runPolicySimulationScenarios } from './simulation-scenarios.js';
export { lintPolicyConfig } from './lint.js';
export { buildPolicyPreflightReview } from './preflight.js';
export { buildPermissionRuleSuggestions } from './rule-suggestions.js';
// Policy signing
export { signBundle, verifyBundle, canonicalise } from './policy-signer.js';
export { loadPolicyBundle, createUnsignedBundle, PolicySignatureError } from './policy-loader.js';
export { evaluatePrefixRule, evaluateArgShapeRule, evaluatePathScopeRule, evaluateNetworkScopeRule, evaluateModeConstraintRule, } from './rules/index.js';
// Divergence dashboard
export { DivergenceDashboard, DivergenceGateError, } from './divergence-dashboard.js';
// Policy-as-Code
export { PolicyRegistry } from './policy-registry.js';
export { PolicyRuntimeState, } from './policy-runtime.js';
// ── Factory ──────────────────────────────────────────────────────────────────────
import { LayeredPolicyEvaluator } from './evaluator.js';
import { PermissionSimulator } from './simulation.js';
import { DivergenceDashboard } from './divergence-dashboard.js';
import { PolicyRegistry } from './policy-registry.js';
import { requireFeatureGate } from '../feature-flags/index.js';
/**
 * createPermissionEvaluator — Factory function for the runtime permission evaluator.
 *
 * Returns a LayeredPolicyEvaluator configured with the given options.
 * Designed as the primary entry point for integrating the runtime permissions system.
 *
 * The returned evaluator exposes:
 *   - `evaluate(toolName, args)` — perform a full layered evaluation
 *   - `recordSessionOverride(...)` — cache a user prompt response
 *   - `log` — DecisionLog for audit queries
 *   - `getMode()` — inspect the active mode
 *
 * @example
 * ```ts
 * const perms = createPermissionEvaluator({ mode: 'default', rules: [] });
 * const decision = perms.evaluate('write', { path: '/tmp/out.txt' });
 * if (!decision.allowed) {
 *   console.error('denied:', decision.reason);
 * }
 * ```
 *
 * @param config     — Optional configuration; all fields have safe defaults.
 * @param provenance — Optional bundle provenance (GC-PERM-011).
 */
export function createPermissionEvaluator(config = {}, provenance, flagManager) {
    if (flagManager && !flagManager.isEnabled('permissions-policy-engine')) {
        throw new Error('Feature flag "permissions-policy-engine" is not enabled');
    }
    return new LayeredPolicyEvaluator(config, provenance);
}
/**
 * createPermissionSimulator — Factory for `PermissionSimulator`.
 *
 * Creates a dual-evaluator simulation pipeline for the runtime permissions system that runs
 * both the actual and simulated evaluators in parallel, tracking divergence.
 *
 * Requires the `permissions-simulation` feature flag to be enabled.
 *
 * @param actualConfig    — Config for the authoritative evaluator.
 * @param simulatedConfig — Config for the candidate evaluator.
 * @param simulationMode  — Controls enforcement and warning behaviour.
 * @param config          — Optional tuning: record limit, divergence threshold.
 *
 * @example
 * ```ts
 * const simulator = createPermissionSimulator(
 *   { mode: 'default', rules: currentRules },
 *   { mode: 'default', rules: candidateRules },
 *   'warn-on-divergence',
 * );
 * const result = simulator.evaluate('write', { path: '/tmp/out.txt' });
 * const report = simulator.getDivergenceReport();
 * ```
 */
export function createPermissionSimulator(actualConfig, simulatedConfig, simulationMode, config = {}, flagManager) {
    if (flagManager && !flagManager.isEnabled('permissions-simulation')) {
        throw new Error('Feature flag "permissions-simulation" is not enabled');
    }
    return new PermissionSimulator(actualConfig, simulatedConfig, simulationMode, config);
}
/**
 * createDivergenceDashboard — Factory for the permissions divergence dashboard.
 *
 * Requires the `permission-divergence-dashboard` feature flag when a flag manager
 * is supplied. Hosts without the feature-flag subsystem can gate this factory
 * at their own boundary before calling it.
 */
export function createDivergenceDashboard(simulator, mode, config = {}, flagManager) {
    requireFeatureGate(flagManager, 'permission-divergence-dashboard', 'create divergence dashboard');
    return new DivergenceDashboard(simulator, mode, config);
}
/**
 * createPolicyRegistry — Factory for the policy-as-code registry.
 *
 * Requires the `policy-as-code` feature flag when a flag manager is supplied.
 * Hosts without the feature-flag subsystem can gate this factory at their own
 * boundary before calling it.
 */
export function createPolicyRegistry(config = {}, flagManager) {
    requireFeatureGate(flagManager, 'policy-as-code', 'create policy registry');
    return new PolicyRegistry(config);
}
