#!/usr/bin/env node
/**
 * pack-enforcement-bridge — Node CLI invokable from bash hooks.
 *
 * Thomas directive 2026-05-17 evening: "It must start up and report findings
 * to a local database on the compliance and company packs, including what
 * they are allowed and not allowed to do. It must have SHA-256 installed,
 * and everything we plan on offering our clients must work when this works."
 *
 * Pre-fix audit (Explore agent 2026-05-17): shell hooks (audit-logger.sh,
 * destructive-command-guard.sh, secret-leak-scanner.sh) use HARDCODED
 * patterns + never load the bound packs from .governance.json. HIPAA / SOC 2
 * rules are dead data on the customer's machine.
 *
 * This bridge closes the gap. A shell hook runs:
 *
 *   node dist/cli/pack-enforcement-bridge.js \
 *     --tool=Bash \
 *     --input='{"command":"rm -rf /etc"}'
 *
 * and gets a one-line JSON verdict on stdout:
 *
 *   {"verdict":"DENY","triggeringPackIds":["hipaa"],"reason":"Pack policy
 *    enforced: Category 'PHI' (action=BLOCK, packs=[hipaa])",
 *    "categoryMatched":"PHI","timestamp":1715900000000}
 *
 * Exit code is 0 on ALLOW + LOG + WARN, 1 on DENY, 2 on REQUIRE_APPROVAL,
 * 3 on internal error (so hooks can branch on the exit code without
 * parsing JSON if they want a fast path).
 *
 * The bridge reads `.governance.json` from process.cwd() (the project root
 * where the hook fires). If the file is missing, malformed, or has no
 * `packs[]` array, the bridge prints `{"verdict":"ALLOW","reason":"no
 * packs bound"}` and exits 0 — Invariant 2 (advisory, never blocks).
 *
 * @connexum/ai-governance — runtime
 */
export {};
//# sourceMappingURL=pack-enforcement-bridge.d.ts.map