//! CLI driver — accepts mixed sensitive input on stdin, prints the
//! redacted version on stdout, and prints a summary on stderr.

use std::io::Read;
use std::process::ExitCode;

use diagnostics_redaction_spike::Redactor;

fn main() -> ExitCode {
    let mut input = String::new();
    if std::io::stdin().read_to_string(&mut input).is_err() {
        eprintln!("failed to read stdin");
        return ExitCode::from(1);
    }

    let redactor = Redactor::with_default_policy();

    // The host application would normally register live secrets here
    // (e.g. as the secure-storage layer materialises them).
    // For the CLI demo, register a fixed plaintext so the audience
    // can see literal scrubbing work.
    redactor
        .known_secrets()
        .register("CHANORA_LITERAL_DEMO_SECRET");

    let out = redactor.redact_text(&input);
    println!("{out}");
    eprintln!("--- redaction applied; rules in policy: {} ---", redactor.policy().rules.len());
    ExitCode::SUCCESS
}