#!/usr/bin/env node
/**
 * data-classifier-bridge.ts -- Bridge between shell hooks and DataClassifier.
 *
 * Called by secret-leak-scanner.sh to run the full TypeScript DataClassifier
 * against file content. Provides richer detection (Luhn, validators, etc.)
 * than regex-only shell scanning.
 *
 * Usage:
 *   echo '{"content":"...", "file":"...", "agent":"..."}' | npx tsx src/hooks/data-classifier-bridge.ts
 *
 * Output (JSON):
 *   {"hasSensitiveData": true, "action": "BLOCK", "findings": [...]}
 *
 * Exit codes:
 *   0 = no action needed or WARN/LOG
 *   2 = BLOCK (sensitive data found, action=BLOCK)
 *
 * T-040: Integrate DataClassifier into scanner hook.
 *
 * @connexum/ai-governance
 */
import { DataClassifier } from '../security/data-classifier.js';
async function main() {
    let input = '';
    // Read from stdin
    for await (const chunk of process.stdin) {
        input += chunk;
    }
    if (!input.trim()) {
        process.stdout.write(JSON.stringify({ hasSensitiveData: false, action: 'LOG', findings: [] }));
        process.exit(0);
    }
    let parsed;
    try {
        parsed = JSON.parse(input);
    }
    catch {
        process.stderr.write('Invalid JSON input\n');
        process.exit(0);
    }
    if (!parsed.content) {
        process.stdout.write(JSON.stringify({ hasSensitiveData: false, action: 'LOG', findings: [] }));
        process.exit(0);
    }
    const logDir = process.env.GOVERNANCE_LOG_DIR || '/tmp/governance/logs';
    const classifier = new DataClassifier({
        logDir,
        enablePHI: true,
        enablePII: true,
        enablePAN: true,
        defaultAction: process.env.DATA_CLASSIFIER_ACTION || 'WARN',
    });
    const result = classifier.scan(parsed.content, {
        file: parsed.file,
        agent: parsed.agent,
    });
    // Output result as JSON
    process.stdout.write(JSON.stringify({
        hasSensitiveData: result.hasSensitiveData,
        action: result.action,
        classification: result.classification,
        findingCount: result.findings.length,
        findings: result.findings.map(f => ({
            type: f.type,
            category: f.category,
            level: f.level,
            redacted: f.redacted,
            line: f.line,
        })),
    }));
    // Exit 2 if BLOCK action
    if (result.action === 'BLOCK') {
        process.exit(2);
    }
}
main().catch(() => process.exit(0));
//# sourceMappingURL=data-classifier-bridge.js.map