// Public package facade for security runtime helpers.

export {
  appendRegularFile,
  assertNoSymlinkParents,
  assertNoSymlinkParentsSync,
  buildUntrustedChannelMetadata,
  canonicalPathFromExistingAncestor,
  compileSafeRegexDetailed,
  ensurePortAvailable,
  evaluateSupplementalContextVisibility,
  expandAllowFromWithAccessGroups,
  extractErrorCode,
  filterSupplementalContextItems,
  findExistingAncestor,
  formatErrorMessage,
  FsSafeError,
  hasProxyEnvConfigured,
  isPathInside,
  isPrivateNetworkAllowedByPolicy,
  matchesHostnameAllowlist,
  movePathWithCopyFallback,
  normalizeHostname,
  openLocalFileSafely,
  parseAccessGroupAllowFromEntry,
  pathExists,
  pathExistsSync,
  pathScope,
  privateFileStoreSync,
  readRegularFile,
  readRegularFileSync,
  redactSensitiveText,
  replaceFileAtomic,
  resolveAbsolutePathForRead,
  resolveAbsolutePathForWrite,
  resolveExistingPathsWithinRoot,
  resolveLocalPathFromRootsSync,
  resolvePinnedHostnameWithPolicy,
  resolvePinnedMainDmOwnerFromAllowlist,
  resolvePreferredOpenClawTmpDir,
  resolveStrictExistingPathsWithinRoot,
  root,
  safeEqualSecret,
  sanitizeUntrustedFileName,
  shouldIncludeSupplementalContext,
  SsrFBlockedError,
  statRegularFile,
  statRegularFileSync,
  withTimeout,
  wrapExternalContent,
  wrapWebContent,
  writeExternalFileWithinRoot,
} from "../../../src/plugin-sdk/security-runtime.js";
export type {
  ContextVisibilityDecision,
  LookupFn,
  SafeRegexRejectReason,
  SsrFPolicy,
} from "../../../src/plugin-sdk/security-runtime.js";