/**
 * scai workspace-policy guardrails — the operator-owned layer that bounds
 * which Sitecore environments scai may operate against, deny-by-default.
 *
 * See docs/policy-and-guardrails.md for the design and threat model.
 */
export { enforceEnvironmentPolicy } from "./enforce.js";
export type { EnforceEnvironmentPolicyParams } from "./enforce.js";
export { enforceOrganizationPolicy, resolveEffectiveOrganizationPolicy, } from "./organization-policy.js";
export type { EffectiveOrganizationPolicy, EnforceOrganizationPolicyParams, } from "./organization-policy.js";
export { authorizeOperation } from "./authorize.js";
export type { AuthorizeOperationParams } from "./authorize.js";
export { resolveCallerContext } from "./caller.js";
export type { CallerContext, CallerKind } from "./caller.js";
export { enrollEnvironment, repinEnvironment, setEnvironmentFlags, unenrollEnvironment, } from "./enroll.js";
export type { EnrollEnvironmentParams, EnrollResult, EnvironmentFlags } from "./enroll.js";
export { resolveEffectivePolicy } from "./resolve.js";
export { OPERATION_RISK, riskTierForOperation } from "./operations.js";
export type { OperationId } from "./operations.js";
export { isManaged, readRepoPolicy, readWorkspacePolicy, writeWorkspacePolicy } from "./store.js";
export { describeIdentityDrift, extractIdentity, identityMatchesPin } from "./identity.js";
export { resolvePolicyDir, resolveRepoPolicyPath, resolveUserPolicyPath } from "./paths.js";
export { RISK_TIERS, minTier, riskRank } from "./types.js";
export type { EffectivePolicy, EnrollSource, EnvIdentity, OrgIdentity, PolicyEnvironment, PolicyOrganization, RepoPolicy, RiskTier, WorkspacePolicy, } from "./types.js";