@dataparade/cli 0.0.1

package/dist/src/ai-enrichment/third-party-evidence.js

@@ -0,0 +1,426 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildThirdPartyHeuristicProposal = buildThirdPartyHeuristicProposal;
+exports.verifyThirdPartyProposal = verifyThirdPartyProposal;
+const KNOWN_VENDOR_DOCS = {
+    aws: "https://docs.aws.amazon.com",
+    stripe: "https://docs.stripe.com",
+    sentry: "https://docs.sentry.io",
+    auth0: "https://auth0.com/docs",
+    twilio: "https://www.twilio.com/docs",
+    slack: "https://api.slack.com",
+    github: "https://docs.github.com",
+    google: "https://cloud.google.com/docs",
+    azure: "https://learn.microsoft.com/azure",
+};
+function isSparse(value) {
+    if (value === null || value === undefined)
+        return true;
+    if (typeof value === "string")
+        return value.trim().length === 0;
+    if (Array.isArray(value))
+        return value.length === 0;
+    return false;
+}
+function toBand(score) {
+    if (score >= 0.85)
+        return "high";
+    if (score >= 0.65)
+        return "medium";
+    return "low";
+}
+function firstLineMatch(file, pattern) {
+    const lines = file.content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = lines[i];
+        if (pattern.test(line)) {
+            return { line: i + 1, snippet: line.trim().slice(0, 160) };
+        }
+    }
+    return undefined;
+}
+function componentSeedPaths(component) {
+    const seed = new Set();
+    const sectionId = component.properties.section_id;
+    if (typeof sectionId === "string" && sectionId.trim()) {
+        seed.add(sectionId.trim());
+    }
+    for (const loc of component.sourceLocations ?? []) {
+        if (loc.filePath?.trim())
+            seed.add(loc.filePath.trim());
+    }
+    for (const ref of component.detectedFrom ?? []) {
+        const fp = ref.sourceLocation?.filePath;
+        if (fp?.trim())
+            seed.add(fp.trim());
+    }
+    return seed;
+}
+function selectRelevantFiles(component, files) {
+    const seeds = [...componentSeedPaths(component)];
+    if (seeds.length === 0)
+        return [];
+    return files.filter((file) => seeds.some((seed) => file.path.startsWith(seed) || seed.startsWith(file.path)));
+}
+function extractEndpoints(files) {
+    const hits = [];
+    const re = /https?:\/\/[^\s"'`)<>\]]+/g;
+    for (const file of files) {
+        const lines = file.content.split(/\r?\n/);
+        lines.forEach((line, idx) => {
+            const matches = [...line.matchAll(re)];
+            for (const match of matches) {
+                const url = match[0];
+                if (!url)
+                    continue;
+                hits.push({ url, filePath: file.path, line: idx + 1 });
+            }
+        });
+    }
+    return hits;
+}
+function parseDependencies(files) {
+    const out = new Set();
+    for (const file of files) {
+        if (!file.path.endsWith("package.json"))
+            continue;
+        try {
+            const parsed = JSON.parse(file.content);
+            for (const key of Object.keys(parsed.dependencies ?? {}))
+                out.add(key.toLowerCase());
+            for (const key of Object.keys(parsed.devDependencies ?? {}))
+                out.add(key.toLowerCase());
+        }
+        catch {
+            // Ignore malformed package json in scanned repositories.
+        }
+    }
+    return [...out].sort();
+}
+function inferVendor(component, evidence) {
+    const refs = [];
+    const candidates = new Set();
+    const fromName = component.name?.trim();
+    if (fromName)
+        candidates.add(fromName.toLowerCase());
+    const fromClient = component.properties.client;
+    if (typeof fromClient === "string" && fromClient.trim()) {
+        candidates.add(fromClient.trim().toLowerCase());
+    }
+    for (const dep of evidence.dependencyNames) {
+        const normalized = dep.replace(/^@/, "").split("/")[0]?.trim();
+        if (normalized)
+            candidates.add(normalized.toLowerCase());
+    }
+    for (const endpoint of evidence.endpoints) {
+        try {
+            const host = new URL(endpoint.url).hostname.replace(/^api\./, "");
+            const base = host.split(".")[0]?.toLowerCase();
+            if (base)
+                candidates.add(base);
+            refs.push({
+                filePath: endpoint.filePath,
+                startLine: endpoint.line,
+                endLine: endpoint.line,
+                reason: `endpoint host suggests vendor ${base ?? host}`,
+            });
+        }
+        catch {
+            // Ignore invalid urls.
+        }
+    }
+    const ranked = [...candidates]
+        .map((raw) => {
+        if (KNOWN_VENDOR_DOCS[raw])
+            return { raw, score: 0.92 };
+        if (raw.length >= 3)
+            return { raw, score: 0.78 };
+        return { raw, score: 0.62 };
+    })
+        .sort((a, b) => b.score - a.score || a.raw.localeCompare(b.raw));
+    const winner = ranked[0];
+    if (!winner)
+        return { score: 0, refs: [] };
+    const depEvidence = evidence.files.find((f) => f.path.endsWith("package.json"));
+    if (depEvidence) {
+        refs.push({
+            filePath: depEvidence.path,
+            startLine: 1,
+            endLine: 1,
+            reason: "dependency manifest contributes vendor inference",
+        });
+    }
+    return { vendor: winner.raw[0].toUpperCase() + winner.raw.slice(1), score: winner.score, refs };
+}
+function inferAuthHints(files) {
+    const hints = new Set();
+    const patterns = [
+        { id: "oauth2", re: /\boauth2?\b/i },
+        { id: "jwt", re: /\bjwt\b/i },
+        { id: "api_key", re: /\bapi[_-]?key\b/i },
+        { id: "bearer_token", re: /\bbearer\b/i },
+        { id: "basic_auth", re: /\bbasic auth\b/i },
+    ];
+    for (const file of files) {
+        for (const pattern of patterns) {
+            if (pattern.re.test(file.content))
+                hints.add(pattern.id);
+        }
+    }
+    return hints;
+}
+function inferImportHints(files) {
+    const hints = new Set();
+    for (const file of files) {
+        const lines = file.content.split(/\r?\n/);
+        for (const line of lines) {
+            if (/\b(import|require)\b/.test(line))
+                hints.add("sdk");
+            if (/\bfetch\(|\baxios\b|\bhttp[s]?:\/\//i.test(line))
+                hints.add("api");
+            if (/\bgraphql\b|\/graphql\b/i.test(line))
+                hints.add("graphql");
+            if (/\bwebhook\b/i.test(line))
+                hints.add("webhook");
+        }
+    }
+    return hints;
+}
+function buildBundle(candidate, component, files) {
+    const relevant = selectRelevantFiles(component, files);
+    const endpoints = extractEndpoints(relevant);
+    return {
+        candidate,
+        component,
+        files: relevant,
+        endpoints,
+        dependencyNames: parseDependencies(relevant),
+        authHints: inferAuthHints(relevant),
+        importHints: inferImportHints(relevant),
+    };
+}
+function buildPropertyEvidence(refs, property) {
+    return { [property]: refs.slice(0, 4) };
+}
+function buildThirdPartyHeuristicProposal(input) {
+    const bundle = buildBundle(input.candidate, input.component, input.files);
+    if (bundle.files.length === 0)
+        return undefined;
+    const setProperties = {};
+    const propertyEvidence = {};
+    const allEvidence = [];
+    const scores = [];
+    const vendorResult = inferVendor(bundle.component, bundle);
+    if (vendorResult.vendor && isSparse(bundle.component.properties.vendor)) {
+        setProperties.vendor = vendorResult.vendor;
+        propertyEvidence.vendor = vendorResult.refs;
+        allEvidence.push(...vendorResult.refs);
+        scores.push(vendorResult.score);
+    }
+    const vendorLower = typeof setProperties.vendor === "string"
+        ? String(setProperties.vendor).toLowerCase()
+        : undefined;
+    if (vendorLower && isSparse(bundle.component.properties.serviceName)) {
+        setProperties.serviceName = String(setProperties.vendor);
+        propertyEvidence.serviceName = propertyEvidence.vendor ?? [];
+        scores.push(0.9);
+    }
+    if (vendorLower && isSparse(bundle.component.properties.client)) {
+        setProperties.client = vendorLower;
+        propertyEvidence.client = propertyEvidence.vendor ?? [];
+        scores.push(0.86);
+    }
+    if (isSparse(bundle.component.properties.integration_method)) {
+        const methods = [];
+        if (bundle.importHints.has("api"))
+            methods.push("api");
+        if (bundle.importHints.has("sdk"))
+            methods.push("sdk");
+        if (bundle.importHints.has("webhook"))
+            methods.push("webhook");
+        if (methods.length > 0) {
+            setProperties.integration_method = [...new Set(methods)];
+            const file = bundle.files[0];
+            const match = firstLineMatch(file, /\b(import|require|fetch\(|axios|webhook)\b/i);
+            if (match) {
+                propertyEvidence.integration_method = buildPropertyEvidence([
+                    {
+                        filePath: file.path,
+                        startLine: match.line,
+                        endLine: match.line,
+                        reason: "integration style inferred from imports/call sites",
+                    },
+                ], "integration_method").integration_method;
+                allEvidence.push(...(propertyEvidence.integration_method ?? []));
+            }
+            scores.push(0.82);
+        }
+    }
+    if (isSparse(bundle.component.properties.api_type)) {
+        let apiType;
+        if (bundle.importHints.has("graphql"))
+            apiType = "graphql";
+        else if (bundle.importHints.has("webhook"))
+            apiType = "webhook";
+        else if (bundle.endpoints.length > 0 || bundle.importHints.has("api"))
+            apiType = "rest";
+        if (apiType) {
+            setProperties.api_type = apiType;
+            const hit = bundle.endpoints[0];
+            if (hit) {
+                propertyEvidence.api_type = [
+                    {
+                        filePath: hit.filePath,
+                        startLine: hit.line,
+                        endLine: hit.line,
+                        reason: `endpoint usage suggests ${apiType} API`,
+                    },
+                ];
+                allEvidence.push(...propertyEvidence.api_type);
+            }
+            scores.push(apiType === "graphql" ? 0.86 : 0.8);
+        }
+    }
+    if (isSparse(bundle.component.properties.authentication_method)) {
+        let method;
+        if (bundle.authHints.has("oauth2"))
+            method = "oauth2";
+        else if (bundle.authHints.has("api_key"))
+            method = "api_key";
+        else if (bundle.authHints.has("bearer_token"))
+            method = "bearer_token";
+        else if (bundle.authHints.has("jwt"))
+            method = "jwt";
+        else if (bundle.authHints.has("basic_auth"))
+            method = "basic_auth";
+        if (method) {
+            setProperties.authentication_method = method;
+            const matchFile = bundle.files.find((file) => /\boauth2?\b|\bapi[_-]?key\b|\bbearer\b|\bjwt\b|\bbasic auth\b/i.test(file.content));
+            if (matchFile) {
+                const match = firstLineMatch(matchFile, /\boauth2?\b|\bapi[_-]?key\b|\bbearer\b|\bjwt\b|\bbasic auth\b/i);
+                if (match) {
+                    propertyEvidence.authentication_method = [
+                        {
+                            filePath: matchFile.path,
+                            startLine: match.line,
+                            endLine: match.line,
+                            reason: "auth token/header pattern detected",
+                        },
+                    ];
+                    allEvidence.push(...propertyEvidence.authentication_method);
+                }
+            }
+            scores.push(0.78);
+        }
+    }
+    if (bundle.endpoints.length > 0 && isSparse(bundle.component.properties.api_endpoint)) {
+        const endpoint = bundle.endpoints[0];
+        setProperties.api_endpoint = endpoint.url;
+        propertyEvidence.api_endpoint = [
+            {
+                filePath: endpoint.filePath,
+                startLine: endpoint.line,
+                endLine: endpoint.line,
+                reason: "external endpoint found in section code",
+            },
+        ];
+        allEvidence.push(...propertyEvidence.api_endpoint);
+        scores.push(0.84);
+    }
+    if (bundle.endpoints.length > 0 && isSparse(bundle.component.properties.https_enforced)) {
+        const httpsOnly = bundle.endpoints.every((item) => item.url.startsWith("https://"));
+        setProperties.https_enforced = httpsOnly;
+        const endpoint = bundle.endpoints[0];
+        propertyEvidence.https_enforced = [
+            {
+                filePath: endpoint.filePath,
+                startLine: endpoint.line,
+                endLine: endpoint.line,
+                reason: httpsOnly ? "all discovered endpoints are HTTPS" : "non-HTTPS endpoint found",
+            },
+        ];
+        allEvidence.push(...propertyEvidence.https_enforced);
+        scores.push(httpsOnly ? 0.9 : 0.7);
+    }
+    if (vendorLower && isSparse(bundle.component.properties.documentation_url)) {
+        const docs = KNOWN_VENDOR_DOCS[vendorLower];
+        if (docs) {
+            setProperties.documentation_url = docs;
+            propertyEvidence.documentation_url = propertyEvidence.vendor ?? [];
+            scores.push(0.86);
+        }
+    }
+    if (bundle.dependencyNames.length > 0 && isSparse(bundle.component.properties.sdk_available)) {
+        setProperties.sdk_available = true;
+        const depFile = bundle.files.find((file) => file.path.endsWith("package.json"));
+        if (depFile) {
+            propertyEvidence.sdk_available = [
+                {
+                    filePath: depFile.path,
+                    startLine: 1,
+                    endLine: 1,
+                    reason: "dependency manifest indicates SDK/library usage",
+                },
+            ];
+            allEvidence.push(...propertyEvidence.sdk_available);
+        }
+        scores.push(0.83);
+    }
+    if ((bundle.importHints.has("api") || bundle.importHints.has("sdk")) &&
+        isSparse(bundle.component.properties.integration_status)) {
+        setProperties.integration_status = "active";
+        const file = bundle.files[0];
+        if (file) {
+            propertyEvidence.integration_status = [
+                {
+                    filePath: file.path,
+                    startLine: 1,
+                    endLine: 1,
+                    reason: "client calls/imports indicate active integration",
+                },
+            ];
+            allEvidence.push(...propertyEvidence.integration_status);
+        }
+        scores.push(0.8);
+    }
+    const normalizedSetProperties = { ...setProperties };
+    if (Object.keys(normalizedSetProperties).length === 0)
+        return undefined;
+    const confidenceScore = scores.length > 0 ? Math.max(0.65, Math.min(0.96, scores.reduce((a, b) => a + b, 0) / scores.length)) : 0.65;
+    return {
+        kind: "component_patch",
+        targetComponentId: bundle.component.id,
+        candidateType: "third_party",
+        setProperties: normalizedSetProperties,
+        propertyEvidence,
+        confidence: {
+            score: Number(confidenceScore.toFixed(2)),
+            band: toBand(confidenceScore),
+        },
+        evidence: allEvidence.slice(0, 16),
+        provider: "mock",
+        model: "third_party_evidence_v1",
+        agent: "tpAgent",
+    };
+}
+function verifyPropertyEvidence(patch) {
+    if (!patch.propertyEvidence)
+        return false;
+    for (const key of Object.keys(patch.setProperties)) {
+        const refs = patch.propertyEvidence[key];
+        if (!refs || refs.length === 0)
+            return false;
+    }
+    return true;
+}
+function verifyThirdPartyProposal(proposal) {
+    if (proposal.kind !== "component_patch")
+        return { ok: false, reason: "not_component_patch" };
+    if (proposal.candidateType !== "third_party")
+        return { ok: false, reason: "not_third_party_candidate" };
+    if (proposal.evidence.length === 0)
+        return { ok: false, reason: "missing_evidence" };
+    if (!verifyPropertyEvidence(proposal))
+        return { ok: false, reason: "missing_property_evidence" };
+    return { ok: true };
+}

package/dist/src/ai-enrichment/third-party-property-matrix.d.ts

@@ -0,0 +1,14 @@
+export type ThirdPartyInferenceKind = "direct" | "heuristic" | "not_inferable_v1";
+export interface ThirdPartyPropertyMatrixEntry {
+    property: string;
+    kind: ThirdPartyInferenceKind;
+    notes: string;
+}
+/**
+ * v1 matrix for third-party autofill. Keep this intentionally conservative:
+ * - `direct`: can usually be read from explicit code/config/docs signals.
+ * - `heuristic`: inferable from patterns but may need confidence gating.
+ * - `not_inferable_v1`: generally legal/commercial/governance fields.
+ */
+export declare const THIRD_PARTY_PROPERTY_MATRIX: ThirdPartyPropertyMatrixEntry[];
+export declare function getThirdPartyPropertyInferability(property: string): ThirdPartyInferenceKind;

package/dist/src/ai-enrichment/third-party-property-matrix.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.THIRD_PARTY_PROPERTY_MATRIX = void 0;
+exports.getThirdPartyPropertyInferability = getThirdPartyPropertyInferability;
+/**
+ * v1 matrix for third-party autofill. Keep this intentionally conservative:
+ * - `direct`: can usually be read from explicit code/config/docs signals.
+ * - `heuristic`: inferable from patterns but may need confidence gating.
+ * - `not_inferable_v1`: generally legal/commercial/governance fields.
+ */
+exports.THIRD_PARTY_PROPERTY_MATRIX = [
+    { property: "vendor", kind: "direct", notes: "Vendor name from package/import/domain evidence." },
+    { property: "serviceName", kind: "direct", notes: "Service/vendor identity from evidence." },
+    { property: "client", kind: "heuristic", notes: "Lowercase normalized vendor/client identifier." },
+    { property: "integration_method", kind: "direct", notes: "API/SDK/webhook style integration markers." },
+    { property: "api_type", kind: "heuristic", notes: "REST/GraphQL/webhook hints from usage and endpoints." },
+    { property: "authentication_method", kind: "heuristic", notes: "Bearer/API key/OAuth/JWT/basic signals." },
+    { property: "documentation_url", kind: "direct", notes: "Known vendor docs URL when vendor is high-confidence." },
+    { property: "sdk_available", kind: "direct", notes: "Dependency/import evidence for vendor SDKs." },
+    { property: "https_enforced", kind: "direct", notes: "All discovered endpoints use HTTPS." },
+    { property: "api_endpoint", kind: "heuristic", notes: "Most representative vendor endpoint found in code/config." },
+    { property: "integration_status", kind: "heuristic", notes: "Active when imports/calls indicate live usage." },
+    {
+        property: "technical_owner_team",
+        kind: "not_inferable_v1",
+        notes: "Org ownership is typically not provable from code.",
+    },
+    {
+        property: "vendor_soc2_iso27001",
+        kind: "not_inferable_v1",
+        notes: "Compliance attestations are not code-evidenced reliably.",
+    },
+    {
+        property: "data_processing_agreement_dpa",
+        kind: "not_inferable_v1",
+        notes: "Contractual/legal status requires non-code source of truth.",
+    },
+    {
+        property: "dpa_expiry_date",
+        kind: "not_inferable_v1",
+        notes: "Contract date not reliably inferable from repository artifacts.",
+    },
+    {
+        property: "vendor_support_contact",
+        kind: "not_inferable_v1",
+        notes: "Support contacts are usually contractual/ops metadata.",
+    },
+];
+const inferabilityByProperty = new Map(exports.THIRD_PARTY_PROPERTY_MATRIX.map((entry) => [entry.property, entry.kind]));
+function getThirdPartyPropertyInferability(property) {
+    return inferabilityByProperty.get(property) ?? "not_inferable_v1";
+}

package/dist/src/ai-enrichment/third-party-subtype.d.ts

@@ -0,0 +1,14 @@
+import type { DetectedComponent } from "../core/types/component";
+/**
+ * Canonical third-party subtypes (aligned with product thirdPartyTypes + classifier catalog).
+ * `ai_provider` is accepted from the classifier and mapped in the UI to api_provider.
+ */
+export declare const THIRD_PARTY_SUBTYPE_TAXONOMY: readonly ["b2b_customer", "saas_service", "payment_processor", "cloud_provider", "api_provider", "ai_provider", "data_provider", "government_regulator", "partner", "ad_network", "professional_services", "data_processor", "data_controller", "joint_controller", "vendor", "service_provider", "marketing_partner", "analytics_provider", "support_provider", "consultant", "subprocessor", "other"];
+export declare function normalizeThirdPartySubType(raw: string | undefined | null): (typeof THIRD_PARTY_SUBTYPE_TAXONOMY)[number] | undefined;
+/**
+ * Infer a third-party subtype from vendor/client/name signals when the classifier
+ * did not match a catalog entry.
+ */
+export declare function inferThirdPartySubType(component: DetectedComponent): (typeof THIRD_PARTY_SUBTYPE_TAXONOMY)[number];
+/** Fill missing subType on all third_party components (post-classify / post-AI). */
+export declare function ensureThirdPartySubTypes(components: DetectedComponent[]): number;

package/dist/src/ai-enrichment/third-party-subtype.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.THIRD_PARTY_SUBTYPE_TAXONOMY = void 0;
+exports.normalizeThirdPartySubType = normalizeThirdPartySubType;
+exports.inferThirdPartySubType = inferThirdPartySubType;
+exports.ensureThirdPartySubTypes = ensureThirdPartySubTypes;
+const config_1 = require("../classifier/config");
+/**
+ * Canonical third-party subtypes (aligned with product thirdPartyTypes + classifier catalog).
+ * `ai_provider` is accepted from the classifier and mapped in the UI to api_provider.
+ */
+exports.THIRD_PARTY_SUBTYPE_TAXONOMY = [
+    "b2b_customer",
+    "saas_service",
+    "payment_processor",
+    "cloud_provider",
+    "api_provider",
+    "ai_provider",
+    "data_provider",
+    "government_regulator",
+    "partner",
+    "ad_network",
+    "professional_services",
+    "data_processor",
+    "data_controller",
+    "joint_controller",
+    "vendor",
+    "service_provider",
+    "marketing_partner",
+    "analytics_provider",
+    "support_provider",
+    "consultant",
+    "subprocessor",
+    "other",
+];
+const SUBTYPE_ALIASES = {
+    saas: "saas_service",
+    saas_service: "saas_service",
+    "saas service": "saas_service",
+    api: "api_provider",
+    api_provider: "api_provider",
+    "api provider": "api_provider",
+    ai: "ai_provider",
+    ai_provider: "ai_provider",
+    "ai provider": "ai_provider",
+    llm: "ai_provider",
+    payment: "payment_processor",
+    payment_processor: "payment_processor",
+    cloud: "cloud_provider",
+    cloud_provider: "cloud_provider",
+    analytics: "analytics_provider",
+    analytics_provider: "analytics_provider",
+    auth: "saas_service",
+    identity: "saas_service",
+    database: "saas_service",
+    storage: "saas_service",
+    cdn: "saas_service",
+    email: "saas_service",
+    messaging: "saas_service",
+};
+const NAME_HEURISTICS = [
+    { re: /\b(openai|anthropic|claude|gemini|cohere|mistral|llm|gpt)\b/i, subType: "ai_provider" },
+    { re: /\b(stripe|paypal|braintree|adyen|checkout\.com)\b/i, subType: "payment_processor" },
+    { re: /\b(aws|amazon web services|gcp|google cloud|azure|microsoft azure)\b/i, subType: "cloud_provider" },
+    { re: /\b(auth0|okta|supabase|firebase|twilio|sendgrid|segment|sentry)\b/i, subType: "saas_service" },
+    { re: /\b(google analytics|mixpanel|amplitude|heap)\b/i, subType: "analytics_provider" },
+];
+function normalizeToken(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[\/\s]+/g, "_")
+        .replace(/-+/g, "_");
+}
+function normalizeThirdPartySubType(raw) {
+    if (!raw || !raw.trim())
+        return undefined;
+    const normalized = normalizeToken(raw);
+    if (exports.THIRD_PARTY_SUBTYPE_TAXONOMY.includes(normalized)) {
+        return normalized;
+    }
+    return SUBTYPE_ALIASES[normalized];
+}
+function collectMatchCandidates(component) {
+    const props = component.properties ?? {};
+    const out = [];
+    const push = (v) => {
+        if (typeof v === "string" && v.trim())
+            out.push(v.toLowerCase());
+    };
+    push(component.name);
+    push(props.client);
+    push(props.serviceName);
+    push(props.service_name);
+    push(props.vendor);
+    push(props.api_endpoint);
+    return out;
+}
+function inferFromClassifierCatalog(candidates) {
+    const { thirdParties } = (0, config_1.loadClassifierConfig)();
+    let bestLen = 0;
+    let bestSubType;
+    for (const tp of thirdParties) {
+        for (const mk of tp.matchKeys) {
+            const k = mk.toLowerCase().trim();
+            if (k.length < 3 || k.startsWith("@"))
+                continue;
+            for (const c of candidates) {
+                if (!c.includes(k))
+                    continue;
+                if (k.length > bestLen) {
+                    const normalized = normalizeThirdPartySubType(tp.subType);
+                    if (!normalized)
+                        continue;
+                    bestLen = k.length;
+                    bestSubType = normalized;
+                }
+            }
+        }
+    }
+    return bestSubType;
+}
+function inferFromNameHeuristics(candidates) {
+    const blob = candidates.join(" ");
+    for (const { re, subType } of NAME_HEURISTICS) {
+        if (re.test(blob))
+            return subType;
+    }
+    return undefined;
+}
+/**
+ * Infer a third-party subtype from vendor/client/name signals when the classifier
+ * did not match a catalog entry.
+ */
+function inferThirdPartySubType(component) {
+    const existing = normalizeThirdPartySubType(component.subType);
+    if (existing)
+        return existing;
+    const candidates = collectMatchCandidates(component);
+    const fromCatalog = inferFromClassifierCatalog(candidates);
+    const normalizedCatalog = normalizeThirdPartySubType(fromCatalog);
+    if (normalizedCatalog)
+        return normalizedCatalog;
+    const fromHeuristic = inferFromNameHeuristics(candidates);
+    if (fromHeuristic)
+        return fromHeuristic;
+    return "saas_service";
+}
+/** Fill missing subType on all third_party components (post-classify / post-AI). */
+function ensureThirdPartySubTypes(components) {
+    let filled = 0;
+    for (const component of components) {
+        if (component.type !== "third_party")
+            continue;
+        if (component.subType?.trim()) {
+            const normalized = normalizeThirdPartySubType(component.subType);
+            if (normalized && normalized !== component.subType) {
+                component.subType = normalized;
+            }
+            continue;
+        }
+        component.subType = inferThirdPartySubType(component);
+        filled += 1;
+    }
+    return filled;
+}