import { RemoteScanner } from 'sigil-sdk';

// Fetches 43+ verified patterns at startup, falls back to built-ins if offline
const scanner = await RemoteScanner.fromRegistry();

console.log(`Loaded ${scanner.ruleCount} rules from: ${scanner.source}`);

const hit = scanner.scan('Authorization: Bearer sk-abc123...');
if (hit) {
  console.log(`Sensitive: ${hit.name} (${hit.severity})`);
  // → { name: 'openai_api_key', category: 'credential', severity: 'critical', hint: '[SIGIL-VAULT: OPENAI_KEY]' }
}

const clean = scanner.redact(`
  export OPENAI_API_KEY=sk-abc123...
  export DB_URL=postgres://user:pass@host/db
`);
// → All matches replaced with their vault hints

const scanner = await RemoteScanner.fromUrl('http://localhost:3100/patterns/bundle');

import { SigilClient } from 'sigil-sdk';
import { etc } from '@noble/ed25519';

const privateKey = etc.randomPrivateKey(); // or load from secure store
const client = new SigilClient();

await client.submitPattern({
  name: 'my_api_key',
  description: 'My service API key (msk_ prefix)',
  category: 'credential',
  pattern: 'msk_[a-zA-Z0-9]{32}',
  severity: 'high',
  authorDid: 'did:sigil:my_namespace_01',
  privateKey,
});

interface ScanHit {
  name: string;      // e.g. "aws_access_key_id"
  category: string;  // e.g. "credential"
  hint: string;      // e.g. "[SIGIL-VAULT: AWS_KEY_ID]"
  severity: string;  // "low" | "medium" | "high" | "critical"
}