@dataparade/cli 0.0.1

package/dist/src/config/env.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadCliConfigEnv = loadCliConfigEnv;
+const inference_scope_1 = require("./inference-scope");
+const normalize_ai_provider_1 = require("./normalize-ai-provider");
+const scan_env_1 = require("./scan-env");
+function parseNumber(value) {
+    if (value == null)
+        return undefined;
+    const n = Number(value);
+    return Number.isFinite(n) ? n : undefined;
+}
+function parseStringArray(value) {
+    if (!value)
+        return undefined;
+    return value
+        .split(",")
+        .map((v) => v.trim())
+        .filter((v) => v.length > 0);
+}
+function parseBoolean(value) {
+    if (value == null)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "true")
+        return true;
+    if (normalized === "false")
+        return false;
+    return undefined;
+}
+function loadCliConfigEnv(env) {
+    const excludePaths = parseStringArray(env.DATAPARADE_EXCLUDES);
+    const minimumConfidence = parseNumber(env.DATAPARADE_MIN_CONFIDENCE);
+    const aiModel = (0, scan_env_1.resolveByokModel)(env);
+    const aiApiKey = (0, scan_env_1.resolveByokApiKey)(env);
+    const aiProviderRaw = (0, scan_env_1.resolveByokProvider)(env);
+    const { provider: aiProvider } = (0, normalize_ai_provider_1.normalizeAiProviderId)(aiProviderRaw);
+    const aiEndpoint = env.SCAN_AI_ENDPOINT?.trim();
+    const aiTemperature = parseNumber(env.SCAN_AI_TEMPERATURE);
+    const aiMaxTokens = parseNumber(env.SCAN_AI_MAX_TOKENS);
+    const aiMaxModelCalls = parseNumber(env.SCAN_AI_MAX_CALLS);
+    const aiBudgetTokens = parseNumber(env.SCAN_AI_BUDGET_TOKENS);
+    const aiProviderConcurrency = parseNumber(env.SCAN_AI_PROVIDER_CONCURRENCY);
+    const aiMaxCandidatesPerAgent = parseNumber(env.SCAN_AI_MAX_CANDIDATES_PER_AGENT);
+    const enableAiInference = parseBoolean((0, scan_env_1.resolveScanAiInference)(env));
+    const aiInferenceScope = (0, inference_scope_1.parseAiInferenceScope)(env.SCAN_AI_INFERENCE_SCOPE);
+    const aiVerbose = parseBoolean(env.SCAN_AI_VERBOSE);
+    const aiToolLoopMaxRounds = parseNumber(env.SCAN_AI_TOOL_LOOP_MAX_ROUNDS);
+    const aiToolLoopMaxFiles = parseNumber(env.SCAN_AI_TOOL_LOOP_MAX_FILES);
+    const aiToolLoopMaxSearches = parseNumber(env.SCAN_AI_TOOL_LOOP_MAX_SEARCHES);
+    const aiThirdPartyDataFlowEnabled = parseBoolean(env.SCAN_AI_THIRD_PARTY_DATA_FLOW);
+    const workspaceApiKey = (0, scan_env_1.resolveWorkspaceApiKey)(env);
+    return {
+        excludePaths,
+        minimumConfidence,
+        aiModel: aiModel || undefined,
+        aiApiKey: aiApiKey || undefined,
+        aiProvider: aiProvider || undefined,
+        aiEndpoint: aiEndpoint || undefined,
+        aiTemperature,
+        aiMaxTokens,
+        aiMaxModelCalls,
+        aiBudgetTokens,
+        aiProviderConcurrency,
+        aiMaxCandidatesPerAgent,
+        aiInferenceScope,
+        enableAiInference,
+        aiVerbose,
+        aiToolLoopMaxRounds,
+        aiToolLoopMaxFiles,
+        aiToolLoopMaxSearches,
+        aiThirdPartyDataFlowEnabled,
+        workspaceApiKey: workspaceApiKey || undefined,
+    };
+}

package/dist/src/config/file.d.ts

@@ -0,0 +1,6 @@
+import type { CliConfigFile } from "./types";
+export interface LoadedCliConfigFile {
+    config: CliConfigFile;
+    warnings: string[];
+}
+export declare function loadCliConfigFile(cwd: string): LoadedCliConfigFile | null;

package/dist/src/config/file.js

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadCliConfigFile = loadCliConfigFile;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const zod_1 = require("zod");
+const types_1 = require("../ai-enrichment/types");
+const fileLanguageEnum = zod_1.z.enum([
+    "typescript",
+    "javascript",
+    "json",
+    "yaml",
+    "env",
+    "python",
+    "terraform",
+    "dockerfile",
+]);
+const cliConfigFileSchema = zod_1.z
+    .object({
+    projectName: zod_1.z.string().min(1).max(255).optional(),
+    excludePaths: zod_1.z.array(zod_1.z.string().min(1)).optional(),
+    enableAPIDetection: zod_1.z.boolean().optional(),
+    enableDatabaseDetection: zod_1.z.boolean().optional(),
+    enableDataFlowDetection: zod_1.z.boolean().optional(),
+    languages: zod_1.z.array(fileLanguageEnum).optional(),
+    minimumConfidence: zod_1.z.number().min(0).max(1).optional(),
+    deepAnalysis: zod_1.z.boolean().optional(),
+    terraformJsonPath: zod_1.z.string().min(1).optional(),
+    terraformPlanPath: zod_1.z.string().min(1).optional(),
+    terraformStackSectionPathDepth: zod_1.z.number().int().positive().optional(),
+    autoInferTerraformStackSectionPathDepth: zod_1.z.boolean().optional(),
+    monorepoPackageSectionPathDepth: zod_1.z.number().int().positive().optional(),
+    autoInferMonorepoPackageSectionPathDepth: zod_1.z.boolean().optional(),
+    enableAiInference: zod_1.z.boolean().optional(),
+    aiProvider: zod_1.z.enum(types_1.AI_PROVIDER_IDS).optional(),
+    aiModel: zod_1.z.string().min(1).optional(),
+    aiEndpoint: zod_1.z.string().min(1).optional(),
+    aiTemperature: zod_1.z.number().min(0).max(2).optional(),
+    aiMaxTokens: zod_1.z.number().int().positive().optional(),
+    aiMaxModelCalls: zod_1.z.number().int().positive().optional(),
+    aiBudgetTokens: zod_1.z.number().int().positive().optional(),
+    aiProviderConcurrency: zod_1.z.number().int().positive().optional(),
+    aiMaxCandidatesPerAgent: zod_1.z.number().int().min(0).optional(),
+    aiInferenceScope: zod_1.z.enum(["default", "third_party_only"]).optional(),
+    aiVerbose: zod_1.z.boolean().optional(),
+    aiToolLoopMaxRounds: zod_1.z.number().int().positive().optional(),
+    aiToolLoopMaxFiles: zod_1.z.number().int().positive().optional(),
+    aiToolLoopMaxSearches: zod_1.z.number().int().positive().optional(),
+    aiThirdPartyDataFlowEnabled: zod_1.z.boolean().optional(),
+})
+    .strict();
+function loadCliConfigFile(cwd) {
+    const configPath = path_1.default.join(cwd, "dataparade.config.json");
+    if (!fs_1.default.existsSync(configPath)) {
+        return null;
+    }
+    const contents = fs_1.default.readFileSync(configPath, "utf8");
+    try {
+        const parsed = JSON.parse(contents);
+        const result = cliConfigFileSchema.safeParse(parsed);
+        if (!result.success) {
+            const messages = result.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`);
+            throw new Error(`Invalid dataparade.config.json:\n${messages.join("\n")}`);
+        }
+        return { config: result.data, warnings: [] };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Unknown error parsing config file.";
+        throw new Error(`Failed to read dataparade.config.json: ${message}`);
+    }
+}

package/dist/src/config/inference-scope.d.ts

@@ -0,0 +1,2 @@
+import type { AiInferenceScope } from "../ai-enrichment/types";
+export declare function parseAiInferenceScope(raw: string | undefined): AiInferenceScope | undefined;

package/dist/src/config/inference-scope.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAiInferenceScope = parseAiInferenceScope;
+function parseAiInferenceScope(raw) {
+    if (raw == null || raw.trim() === "")
+        return undefined;
+    const normalized = raw.trim().toLowerCase().replace(/-/g, "_");
+    if (normalized === "default") {
+        return "default";
+    }
+    if (normalized === "third_party_only" || normalized === "thirdpartyonly") {
+        return "third_party_only";
+    }
+    return undefined;
+}

package/dist/src/config/load-cli-env.d.ts

@@ -0,0 +1 @@
+export declare function loadCliDotenv(): void;

package/dist/src/config/load-cli-env.js

@@ -0,0 +1,54 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadCliDotenv = loadCliDotenv;
+/**
+ * Loads `cli/.env` when not running under Jest.
+ * Imported from `bin/load-env` and `src/cli` so both entrypoints behave the same.
+ *
+ * Resolves the `@dataparade/cli` package root (walks up from this file) so we never
+ * load a monorepo-parent `.env`.
+ */
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const dotenv_1 = require("dotenv");
+const CLI_PACKAGE_NAME = "@dataparade/cli";
+const tried = { current: false };
+function findCliPackageRoot(startDir) {
+    let dir = node_path_1.default.resolve(startDir);
+    const { root } = node_path_1.default.parse(dir);
+    while (dir !== root) {
+        const pkgPath = node_path_1.default.join(dir, "package.json");
+        if (node_fs_1.default.existsSync(pkgPath)) {
+            try {
+                const raw = node_fs_1.default.readFileSync(pkgPath, "utf8");
+                const pkg = JSON.parse(raw);
+                if (pkg.name === CLI_PACKAGE_NAME) {
+                    return dir;
+                }
+            }
+            catch {
+                // ignore unreadable or invalid package.json
+            }
+        }
+        dir = node_path_1.default.dirname(dir);
+    }
+    return undefined;
+}
+function loadCliDotenv() {
+    if (tried.current)
+        return;
+    tried.current = true;
+    if (process.env.NODE_ENV === "test")
+        return;
+    const cliRoot = findCliPackageRoot(__dirname);
+    if (!cliRoot)
+        return;
+    const envPath = node_path_1.default.join(cliRoot, ".env");
+    if (node_fs_1.default.existsSync(envPath)) {
+        (0, dotenv_1.config)({ path: envPath, override: false });
+    }
+}
+loadCliDotenv();

package/dist/src/config/normalize-ai-provider.d.ts

@@ -0,0 +1,5 @@
+import { type AiProviderId } from "../ai-enrichment/types";
+export declare function normalizeAiProviderId(value: string | undefined): {
+    provider: AiProviderId | undefined;
+    warning?: string;
+};

package/dist/src/config/normalize-ai-provider.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeAiProviderId = normalizeAiProviderId;
+const types_1 = require("../ai-enrichment/types");
+const KNOWN_PROVIDERS = new Set(types_1.AI_PROVIDER_IDS);
+function normalizeAiProviderId(value) {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+        return { provider: undefined };
+    }
+    if (KNOWN_PROVIDERS.has(trimmed)) {
+        return { provider: trimmed };
+    }
+    return {
+        provider: undefined,
+        warning: `Unknown SCAN_BYOK_PROVIDER "${trimmed}"; expected one of: ${types_1.AI_PROVIDER_IDS.join(", ")}. Using default provider.`,
+    };
+}

package/dist/src/config/property-detection-config.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Shared property-detection config loader.
+ * Reads patterns/property.patterns.yaml (language-agnostic regexes and rules).
+ * Used by TypeScript and other analyzers to map findings → component properties.
+ */
+export interface EnhanceConfig {
+    mainAppSubtypes: Set<string>;
+    defaultThirdPartyHosting: string;
+    cloudAssetSubtypes: Set<string>;
+    onPremAssetSubtypes: Set<string>;
+    supportedOperationsBySubType: Record<string, string[]>;
+}
+export interface PropertyDetectionConfig {
+    regexes: Record<string, RegExp>;
+    cloudProviderEnv: Array<{
+        regex: RegExp;
+        value: string;
+    }>;
+    knownDatabaseNames: Set<string>;
+    externalApiKnownDocumentationUrls: Record<string, string>;
+    externalApiKnownPackageNames: Record<string, string>;
+    lookupTables: Record<string, Record<string, string>>;
+    inferenceRules: Record<string, unknown[]>;
+    enhance: EnhanceConfig;
+}
+export declare function clearPropertyDetectionConfigCache(): void;
+export declare function loadPropertyDetectionConfig(): PropertyDetectionConfig;

package/dist/src/config/property-detection-config.js

@@ -0,0 +1,355 @@
+"use strict";
+/**
+ * Shared property-detection config loader.
+ * Reads patterns/property.patterns.yaml (language-agnostic regexes and rules).
+ * Used by TypeScript and other analyzers to map findings → component properties.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearPropertyDetectionConfigCache = clearPropertyDetectionConfigCache;
+exports.loadPropertyDetectionConfig = loadPropertyDetectionConfig;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const yaml_1 = __importDefault(require("yaml"));
+const zod_1 = require("zod");
+const detection_1 = require("../core/types/detection");
+const enhance_defaults_1 = require("../classifier/enhance-defaults");
+function getConfigPath() {
+    const parts = __dirname.split(path_1.default.sep);
+    const distIndex = parts.lastIndexOf("dist");
+    const cliRoot = distIndex !== -1
+        ? parts.slice(0, distIndex).join(path_1.default.sep)
+        : path_1.default.resolve(__dirname, "..", "..");
+    return path_1.default.join(cliRoot, "patterns", "property.patterns.yaml");
+}
+function compileRegexes(raw) {
+    const regexes = {};
+    if (!raw || typeof raw !== "object")
+        return regexes;
+    for (const [name, pattern] of Object.entries(raw)) {
+        if (typeof pattern === "string") {
+            try {
+                regexes[name] = new RegExp(pattern, "i");
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                throw new Error(`property-detection.regexes['${name}'] invalid regex: ${msg}`);
+            }
+        }
+    }
+    return regexes;
+}
+let cached;
+function clearPropertyDetectionConfigCache() {
+    cached = undefined;
+}
+function loadPropertyDetectionConfig() {
+    if (cached)
+        return cached;
+    const configPath = getConfigPath();
+    let raw;
+    try {
+        raw = fs_1.default.readFileSync(configPath, "utf8");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Property detection config is required but could not be read from '${configPath}': ${message}`);
+    }
+    const parsed = yaml_1.default.parse(raw);
+    if (!parsed || typeof parsed !== "object") {
+        throw new Error(`Property detection config at '${configPath}' did not parse to an object.`);
+    }
+    const regexes = compileRegexes(parsed.regexes);
+    const cloudProviderEnv = [];
+    if (Array.isArray(parsed.cloud_provider_env)) {
+        for (const entry of parsed.cloud_provider_env) {
+            const re = regexes[entry.regex];
+            if (re && typeof entry.value === "string") {
+                cloudProviderEnv.push({ regex: re, value: entry.value });
+            }
+        }
+    }
+    const knownDatabaseNames = new Set();
+    if (Array.isArray(parsed.known_database_names)) {
+        for (const name of parsed.known_database_names) {
+            if (typeof name === "string" && name.trim()) {
+                knownDatabaseNames.add(name.trim().toLowerCase());
+            }
+        }
+    }
+    const externalApiKnownDocumentationUrls = {};
+    if (parsed.external_api_known_documentation_urls &&
+        typeof parsed.external_api_known_documentation_urls === "object") {
+        for (const [k, v] of Object.entries(parsed.external_api_known_documentation_urls)) {
+            if (typeof v === "string") {
+                externalApiKnownDocumentationUrls[k.toLowerCase()] = v;
+            }
+        }
+    }
+    const externalApiKnownPackageNames = {};
+    if (parsed.external_api_known_package_names && typeof parsed.external_api_known_package_names === "object") {
+        for (const [k, v] of Object.entries(parsed.external_api_known_package_names)) {
+            if (typeof v === "string") {
+                externalApiKnownPackageNames[k.toLowerCase()] = v;
+            }
+        }
+    }
+    const inferenceRules = (parsed.inference_rules && typeof parsed.inference_rules === "object"
+        ? parsed.inference_rules
+        : {}) ?? {};
+    const allowedInferenceInputs = new Set([
+        "content",
+        "key",
+        "library",
+        "strategy",
+        "strategyStr",
+        "serviceName",
+        "documentationUrl",
+        "apiVersion",
+        "url",
+        "httpMethods",
+        "path",
+    ]);
+    const inferenceRuleWhenSchema = zod_1.z.lazy(() => zod_1.z.union([
+        zod_1.z.object({ always: zod_1.z.boolean() }).strict(),
+        zod_1.z.object({ notSet: zod_1.z.string() }).strict(),
+        zod_1.z.object({ exists: zod_1.z.string() }).strict(),
+        zod_1.z.object({
+            regex: zod_1.z.object({
+                input: zod_1.z.string(),
+                regex: zod_1.z.string(),
+            }),
+        }).strict(),
+        zod_1.z.object({
+            equals: zod_1.z.object({
+                input: zod_1.z.string(),
+                value: zod_1.z.any(),
+            }),
+        }).strict(),
+        zod_1.z.object({
+            anyOf: zod_1.z.array(inferenceRuleWhenSchema),
+        }).strict(),
+        zod_1.z.object({
+            allOf: zod_1.z.array(inferenceRuleWhenSchema),
+        }).strict(),
+        zod_1.z.object({
+            not: inferenceRuleWhenSchema,
+        }).strict(),
+    ]));
+    const lookupAssignmentSchema = zod_1.z.object({
+        lookup: zod_1.z.object({
+            map: zod_1.z.string(),
+            keyInput: zod_1.z.string(),
+            transform: zod_1.z.string().optional(),
+            onMissing: zod_1.z.string().optional(),
+        }),
+    });
+    const preferInputOrConstantSchema = zod_1.z.object({
+        preferInputOrConstant: zod_1.z.object({
+            input: zod_1.z.string(),
+            fallback: zod_1.z.union([zod_1.z.string(), zod_1.z.number(), zod_1.z.boolean()]),
+        }),
+    });
+    const fromInputAssignmentSchema = zod_1.z.object({
+        fromInput: zod_1.z.string(),
+    });
+    const assignmentSchema = zod_1.z.union([
+        // Constants.
+        zod_1.z.string(),
+        zod_1.z.number(),
+        zod_1.z.boolean(),
+        zod_1.z.null(),
+        // Derived values.
+        fromInputAssignmentSchema,
+        preferInputOrConstantSchema,
+        lookupAssignmentSchema,
+    ]);
+    const setSchema = zod_1.z.record(zod_1.z.string(), assignmentSchema);
+    const inferenceRuleSchema = zod_1.z.object({
+        when: inferenceRuleWhenSchema,
+        set: setSchema,
+    });
+    const inferenceRulesSchema = zod_1.z.record(zod_1.z.string(), zod_1.z.array(inferenceRuleSchema));
+    const validatedInference = inferenceRulesSchema.safeParse(inferenceRules);
+    if (!validatedInference.success) {
+        const messages = validatedInference.error.issues
+            .slice(0, 10)
+            .map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`)
+            .join("; ");
+        throw new Error(`Property inference rules invalid at 'inference_rules': ${messages}`);
+    }
+    const invalidPatternKeys = Object.keys(inferenceRules).filter((pid) => !detection_1.PATTERN_IDS.includes(pid));
+    if (invalidPatternKeys.length > 0) {
+        throw new Error(`Property inference rules invalid patternId keys: ${invalidPatternKeys.join(", ")}`);
+    }
+    const lookupTables = {
+        external_api_known_documentation_urls: externalApiKnownDocumentationUrls,
+        external_api_known_package_names: externalApiKnownPackageNames,
+    };
+    function validateWhenSemantic(when, ctx) {
+        if (!when || typeof when !== "object")
+            return;
+        if (when.always === true)
+            return;
+        if (typeof when.notSet === "string") {
+            const input = when.notSet;
+            // `notSet` checks whether the output property is still undefined (i.e.
+            // `out[input] === undefined`), so it refers to output property keys.
+            if (!enhance_defaults_1.DETECTABLE_PROPERTY_KEYS.has(input)) {
+                throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].when.notSet input '${input}': must be a detectable/assignable property key.`);
+            }
+            return;
+        }
+        if (typeof when.exists === "string") {
+            const input = when.exists;
+            if (!allowedInferenceInputs.has(input)) {
+                throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].when.exists input '${input}'.`);
+            }
+            return;
+        }
+        if (when.regex && typeof when.regex === "object") {
+            const input = String(when.regex.input);
+            const regexName = String(when.regex.regex);
+            if (!allowedInferenceInputs.has(input)) {
+                throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].when.regex.input '${input}'.`);
+            }
+            if (!(regexName in regexes)) {
+                throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].when.regex.regex '${regexName}' (missing from property.patterns.yaml.regexes).`);
+            }
+            return;
+        }
+        if (when.equals && typeof when.equals === "object") {
+            const input = String(when.equals.input);
+            if (!allowedInferenceInputs.has(input)) {
+                throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].when.equals.input '${input}'.`);
+            }
+            return;
+        }
+        if (Array.isArray(when.anyOf)) {
+            for (let i = 0; i < when.anyOf.length; i += 1) {
+                validateWhenSemantic(when.anyOf[i], ctx);
+            }
+            return;
+        }
+        if (Array.isArray(when.allOf)) {
+            for (let i = 0; i < when.allOf.length; i += 1) {
+                validateWhenSemantic(when.allOf[i], ctx);
+            }
+            return;
+        }
+        if (when.not) {
+            validateWhenSemantic(when.not, ctx);
+            return;
+        }
+    }
+    function validateSetSemantic(setObj, ctx) {
+        if (!setObj || typeof setObj !== "object")
+            return;
+        for (const [outKey, assignment] of Object.entries(setObj)) {
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+            const _outKey = outKey;
+            if (assignment === undefined || assignment === null)
+                continue;
+            if (!enhance_defaults_1.DETECTABLE_PROPERTY_KEYS.has(outKey)) {
+                throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].set.${outKey}: unknown/unsupported property key (must be in DETECTABLE_PROPERTY_KEYS).`);
+            }
+            if (typeof assignment === "string" || typeof assignment === "number" || typeof assignment === "boolean") {
+                continue;
+            }
+            if (typeof assignment !== "object") {
+                throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].set value for '${outKey}'.`);
+            }
+            const a = assignment;
+            if (typeof a.fromInput === "string") {
+                const input = a.fromInput;
+                if (!allowedInferenceInputs.has(input)) {
+                    throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].set.${outKey}.fromInput '${input}'.`);
+                }
+                continue;
+            }
+            if (a.preferInputOrConstant && typeof a.preferInputOrConstant === "object") {
+                const input = String(a.preferInputOrConstant.input);
+                if (!allowedInferenceInputs.has(input)) {
+                    throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].set.${outKey}.preferInputOrConstant.input '${input}'.`);
+                }
+                continue;
+            }
+            if (a.lookup && typeof a.lookup === "object") {
+                const lookupMap = String(a.lookup.map);
+                const keyInput = String(a.lookup.keyInput);
+                if (!(lookupMap in lookupTables)) {
+                    throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].set.${outKey}.lookup.map '${lookupMap}'.`);
+                }
+                if (!allowedInferenceInputs.has(keyInput)) {
+                    throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].set.${outKey}.lookup.keyInput '${keyInput}'.`);
+                }
+                const transform = a.lookup.transform;
+                if (transform !== undefined && transform !== "lowercase") {
+                    throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].set.${outKey}.lookup.transform '${String(transform)}' (only 'lowercase' is supported).`);
+                }
+                const onMissing = a.lookup.onMissing;
+                if (onMissing !== undefined && onMissing !== "skip") {
+                    throw new Error(`Invalid inference_rules['${ctx.patternId}'][${ctx.ruleIdx}].set.${outKey}.lookup.onMissing '${String(onMissing)}' (only 'skip' is supported).`);
+                }
+                continue;
+            }
+        }
+    }
+    // Semantic validation pass (fail-fast) after schema validation.
+    // Validates:
+    // - `when.*.input` refers to a supported inference context input
+    // - `when.regex.regex` refers to an actual regex in `regexes`
+    // - `set.*.lookup.map` refers to a known lookup table
+    // - `set.*` only assigns detectable/supported property keys
+    for (const [patternId, rulesForPattern] of Object.entries(inferenceRules)) {
+        const pid = String(patternId);
+        const rulesArray = Array.isArray(rulesForPattern) ? rulesForPattern : [];
+        for (let ruleIdx = 0; ruleIdx < rulesArray.length; ruleIdx += 1) {
+            const rule = rulesArray[ruleIdx];
+            validateWhenSemantic(rule?.when, { patternId: pid, ruleIdx });
+            validateSetSemantic(rule?.set, { patternId: pid, ruleIdx });
+        }
+    }
+    const rawEnhance = parsed.enhance;
+    const enhance = {
+        mainAppSubtypes: toSet(rawEnhance?.main_app_subtypes, ["api", "service"]),
+        defaultThirdPartyHosting: typeof rawEnhance?.default_third_party_hosting === "string"
+            ? rawEnhance.default_third_party_hosting
+            : "saas",
+        cloudAssetSubtypes: toSet(rawEnhance?.cloud_asset_subtypes, [
+            "api",
+            "service",
+            "database",
+            "cache",
+            "container",
+            "auth_service",
+            "function",
+        ]),
+        onPremAssetSubtypes: toSet(rawEnhance?.on_prem_asset_subtypes, ["config"]),
+        supportedOperationsBySubType: rawEnhance?.supported_operations && typeof rawEnhance.supported_operations === "object"
+            ? rawEnhance.supported_operations
+            : {},
+    };
+    cached = {
+        regexes,
+        cloudProviderEnv,
+        knownDatabaseNames,
+        externalApiKnownDocumentationUrls,
+        externalApiKnownPackageNames,
+        lookupTables,
+        inferenceRules: validatedInference.data,
+        enhance,
+    };
+    return cached;
+}
+function toSet(arr, defaultVal) {
+    const out = new Set();
+    const src = Array.isArray(arr) && arr.length > 0 ? arr : defaultVal;
+    for (const s of src) {
+        if (typeof s === "string" && s.trim())
+            out.add(s.trim());
+    }
+    return out;
+}

package/dist/src/config/redact.d.ts

@@ -0,0 +1,3 @@
+import type { ScanConfiguration } from "../core/types";
+/** Redact secret fields before printing configuration to stdout. */
+export declare function redactScanConfigurationForDisplay(config: ScanConfiguration): ScanConfiguration;

package/dist/src/config/redact.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactScanConfigurationForDisplay = redactScanConfigurationForDisplay;
+/** Redact secret fields before printing configuration to stdout. */
+function redactScanConfigurationForDisplay(config) {
+    const redacted = { ...config };
+    if (config.aiApiKey?.trim()) {
+        redacted.aiApiKey = "<redacted>";
+    }
+    if (config.workspaceApiKey?.trim()) {
+        redacted.workspaceApiKey = "<redacted>";
+    }
+    return redacted;
+}