//! Role-Based Access Control (RBAC) Module
//!
//! Two independent layers:
//!
//! 1. **Database-driven RBAC** (`rbac` feature, existing): `conditional`,
//!    `config`, `repository`, `service` — UserCategory/UserTag from DB.
//!
//! 2. **File-driven RBAC** (`rbac` feature): `file_config`, `effect_executor`,
//!    `ncl_middleware` — policy rules loaded from `rbac.ncl`. Hot-reload is
//!    activated by the `rbac-watcher` feature.

#[cfg(feature = "auth")]
pub mod conditional;
#[cfg(feature = "auth")]
pub mod config;

// File-based RBAC layer (requires `rbac` feature which includes `auth`)
#[cfg(feature = "rbac")]
pub mod effect_executor;
#[cfg(feature = "rbac")]
pub mod file_config;
#[cfg(feature = "rbac")]
pub mod ncl_middleware;

// Hot-reload watcher (requires notify dep via `rbac-watcher` feature)
#[cfg(feature = "rbac-watcher")]
pub mod watcher;

// Re-export database-driven RBAC types (requires auth feature)
#[cfg(feature = "auth")]
pub use conditional::ConditionalRBACService;
#[cfg(feature = "auth")]
pub use config::{RBACConfigLoader, RBACSettings, RBACTomlConfig};
