polyc-query 2026.9.0

// QRY-6: every one of these modules is `pub(crate)` on `polyc_query` (see
// `crate::authority`'s "Pinning the seal" module doc, and `crate`'s own
// module doc for the full sealed/public split) — none of them, or the items
// inside them, may resolve from a crate that isn't `polyc_query` itself.
// `authority` (`QueryAuthority`/`Principal`/`ScopedQuery`), `output`
// (`QueryResultJson`), and the `SearchIndex`/`SearchIndexError` wiring handle
// re-exported at the crate root are the crate's genuinely `pub` surface and
// are deliberately NOT named here. `SearchIndex` widens nothing: `search_index`
// itself stays `pub(crate)` — the line below proves it — and the handle only
// lets a Container open, register, and supervise the projection. It reads
// nothing back out.
//
// The `core_*` modules and `credential` carry the projected query plane. They
// are sealed the same way and for the same reason: a root re-export of one
// would hand a downstream crate the read path's own internals. `core_redaction`
// is absent deliberately — it is `#![cfg(test)]`, so it is not in a normal
// build at all and cannot widen anything.
//
// This guards two vectors: a QUALIFIED path into a sealed module (the
// `polyc_query::<module>::<item>` lines below), and a future CRATE-ROOT
// RE-EXPORT of a sealed item (the unqualified `polyc_query::<item>` lines).
// `lib.rs` already does `pub use engine::QueryLimits;` for the one
// legitimately root-exported resource-config struct, so a qualified-path
// check alone would stay green even if a future PR added e.g.
// `pub use engine::QueryEngine;` at the root — that would make the engine
// reachable as `polyc_query::QueryEngine` from any downstream crate,
// defeating the seal, while every line below kept compiling to the same
// errors. The unqualified imports close that hole: each currently fails to
// resolve (E0432, nothing of that name at the crate root today); if a root
// re-export is later added, that one line starts compiling, its expected
// error disappears, and trybuild fails the diff.

use polyc_query::decode::REGISTRY;
use polyc_query::engine::QueryEngine;
use polyc_query::provider::EventsTableProvider;
use polyc_query::session::QueryScope;
use polyc_query::statement_gate::check_statement_allowed;
use polyc_query::views::COMMITTED_TURNS_VIEW_SQL;
use polyc_query::search_index::PostingsRecord;
use polyc_query::core_evidence::evidence_of;
use polyc_query::core_execution::CoreExecutionAdmission;
use polyc_query::core_production::DirectCoreMetadata;
use polyc_query::core_resolution::CompiledCoreQuery;
use polyc_query::credential::CredentialAuthority;

use polyc_query::REGISTRY as ROOT_REGISTRY;
use polyc_query::QueryEngine as RootQueryEngine;
use polyc_query::EventsTableProvider as RootEventsTableProvider;
use polyc_query::QueryScope as RootQueryScope;
use polyc_query::check_statement_allowed as root_check_statement_allowed;
use polyc_query::COMMITTED_TURNS_VIEW_SQL as ROOT_COMMITTED_TURNS_VIEW_SQL;
use polyc_query::PostingsRecord as RootPostingsRecord;
use polyc_query::evidence_of as root_evidence_of;
use polyc_query::CoreExecutionAdmission as RootCoreExecutionAdmission;
use polyc_query::DirectCoreMetadata as RootDirectCoreMetadata;
use polyc_query::CompiledCoreQuery as RootCompiledCoreQuery;
use polyc_query::CredentialAuthority as RootCredentialAuthority;

fn main() {}