// src/core/security/index.ts

/**
 * Security Module
 *
 * Provides capability-based security infrastructure for Matrix components.
 *
 * Key concepts:
 * - SecurityRealm: Composes Supervisor + SecurityPolicy (Joe Armstrong's insight)
 * - Capability tokens: Unforgeable references to rights (Mark Miller's model)
 * - Lisp security contexts: Sandboxing for VLM evaluation
 * - Spawn policies: Control component creation
 *
 * Expert consensus (2025-12-14):
 * - ISecurityRealm is unified (no ISP split) per Vision 27
 * - Switch dispatch for policy sections is correct (value objects)
 * - CapabilityRight uses typed union for compile-time safety
 *
 * See: Vision/27-SECURITY-FEDERATION-DRAFT.md
 * See: src/core/security/IMPLEMENTATION-PLAN-SECURITY.md
 *
 * @module core/security
 */

// ═══════════════════════════════════════════════════════════════════════════
// CAPABILITY TOKENS
// ═══════════════════════════════════════════════════════════════════════════

export type {
  ICapabilityToken,
  CapabilityRight,
  WellKnownRight,
  CustomRight,
} from './ICapabilityToken';

// ═══════════════════════════════════════════════════════════════════════════
// SECURITY POLICY
// ═══════════════════════════════════════════════════════════════════════════

export type { ISecurityPolicy, IRateLimitConfig } from './ISecurityPolicy';

export type {
  ISupervisorSecurityPolicy,
  VerificationDepth,
  AuditLevel,
  CapabilityFlowPolicy,
  SiblingRouting,
  // Policy section base types (for type-safe extension)
  IPolicySectionBase,
  IInboundPolicySection,
  IOutboundPolicySection,
  ISiblingPolicySection,
  IExternalPolicySection,
} from './ISupervisorSecurityPolicy';

export {
  DEFAULT_SECURITY_POLICY,
  STRICT_SECURITY_POLICY,
  DEVELOPMENT_SECURITY_POLICY,
  createSecurityPolicy,
  createDevelopmentPolicy,
} from './defaults';

// ═══════════════════════════════════════════════════════════════════════════
// SECURITY REALM
// ═══════════════════════════════════════════════════════════════════════════

export type {
  ISecurityRealm,
  MessageDirection,
  IVerificationResult,
  IAttenuationOptions,
  IMintOptions,
} from './ISecurityRealm';

export { SecurityRealm } from './SecurityRealm';

// ═══════════════════════════════════════════════════════════════════════════
// LISP SECURITY CONTEXT
// ═══════════════════════════════════════════════════════════════════════════

export type { ILispSecurityContext } from './LispSecurityContext';

export {
  SANDBOX_CONTEXT,
  COMPONENT_CONTEXT,
  DEVELOPER_CONTEXT,
  createLispSecurityContext,
  isPrimitiveAllowed,
  isCallTargetAllowed,
} from './LispSecurityContext';

// ═══════════════════════════════════════════════════════════════════════════
// SECURITY CONFIGURATION (Vision 27 §11.11 - Environment-Based Defaults)
// ═══════════════════════════════════════════════════════════════════════════

export type {
  SecurityMode,
  ISecurityConfiguration,
} from './SecurityConfiguration';

export {
  getSecurityConfiguration,
  getDefaultSecurityContext,
  getSecurityContextByName,
  isDevMode,
  isProductionMode,
  isTestMode,
  _resetSecurityConfigurationForTesting,
} from './SecurityConfiguration';

// ═══════════════════════════════════════════════════════════════════════════
// SPAWN POLICY
// ═══════════════════════════════════════════════════════════════════════════

export type {
  ISpawnPolicyService,
  ISpawnRequest,
  ISpawnDecision,
  ISecurityPrincipal,
  IComponentTrustLevel,
  ISpawnPolicyRules,
} from './ISpawnPolicyService';

export { DefaultSpawnPolicy, StrictSpawnPolicy } from './DefaultSpawnPolicy';

// ═══════════════════════════════════════════════════════════════════════════
// AUDIT TRAIL (Vision 27 Section 7)
// ═══════════════════════════════════════════════════════════════════════════

export type {
  IAuditEvent,
  IAuditEventSummary,
  AuditAction,
  AuditOutcome,
  DataClassification,
} from './IAuditEvent';

export type {
  IAuditService,
  IAuditRecordInput,
  IAuditQuery,
  IAuditQueryResult,
} from './IAuditService';

export {
  SECURITY_CRITICAL_ACTIONS,
  isSecurityCriticalAction,
  shouldAlwaysAudit,
} from './IAuditService';

export {
  SecurityAuditService,
  ConsoleAuditService,
  NullAuditService,
} from './SecurityAuditService';

// ═══════════════════════════════════════════════════════════════════════════
// TOPIC CLAIMING (Vision 27 §11.11 - Supervisor Authority)
// ═══════════════════════════════════════════════════════════════════════════

export type {
  ITopicClaim,
  IClaimResult,
  IClaimOptions,
  IClaimQuery,
} from './ITopicClaim';

export type {
  ITopicClaimRegistry,
  ITopicClaimRegistryConfig,
} from './ITopicClaimRegistry';

export { TopicClaimRegistry } from './TopicClaimRegistry';
// NOTE: Global singleton functions removed per expert panel review
// Use: new TopicClaimRegistry() or inject via config
