@dataparade/cli 0.0.1

package/dist/src/config/resolve.d.ts

@@ -0,0 +1,15 @@
+import type { ResolveConfigOptions, ResolvedScanConfiguration } from "./types";
+/**
+ * Resolve the effective scan configuration overrides for a given working dir.
+ *
+ * Precedence (lowest to highest):
+ * 1) `dataparade.config.json` in `cwd`
+ * 2) Environment variables (`DATAPARADE_*`)
+ * 3) CLI flags
+ *
+ * The resulting `overrides` object is intended to be passed to
+ * `createDefaultScanConfiguration` to obtain a full `ScanConfiguration`.
+ * Any validation or clamping of individual fields happens in this function
+ * or its helpers.
+ */
+export declare function resolveScanConfiguration(options: ResolveConfigOptions): ResolvedScanConfiguration;

package/dist/src/config/resolve.js

@@ -0,0 +1,361 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveScanConfiguration = resolveScanConfiguration;
+const normalize_ai_provider_1 = require("./normalize-ai-provider");
+const file_1 = require("./file");
+const env_1 = require("./env");
+/**
+ * Normalize user-supplied language identifiers from flags/config into the
+ * internal `FileLanguage` union.
+ *
+ * Unknown values are silently dropped; if no valid languages remain the
+ * function returns `undefined` to signal \"no language filter\".
+ */
+function normalizeLanguages(values) {
+    if (!values || values.length === 0)
+        return undefined;
+    const normalized = values.map((v) => v.toLowerCase().trim());
+    // Filter to known languages; fall back to leaving them out if none match.
+    const allowed = [
+        "typescript",
+        "javascript",
+        "json",
+        "yaml",
+        "env",
+        "python",
+        "terraform",
+        "dockerfile",
+    ];
+    const result = normalized.filter((v) => allowed.includes(v));
+    return result.length > 0 ? result : undefined;
+}
+/**
+ * Convert raw CLI flags into a partial `ScanConfiguration` override object.
+ *
+ * This helper is the single place where flag semantics are enforced
+ * (clamping numeric values, validating language names, etc.) so that
+ * `resolveScanConfiguration` can compose flags with config file and env
+ * overrides in a predictable way.
+ */
+function normalizeFlags(flags) {
+    const overrides = {};
+    if (flags.projectName) {
+        overrides.projectName = flags.projectName;
+    }
+    if (flags.exclude && flags.exclude.length > 0) {
+        overrides.excludePaths = flags.exclude;
+    }
+    if (typeof flags.minimumConfidence === "number") {
+        const clamped = Math.max(0, Math.min(flags.minimumConfidence, 1));
+        overrides.minimumConfidence = clamped;
+    }
+    if (flags.language && flags.language.length > 0) {
+        const languages = normalizeLanguages(flags.language);
+        if (languages && languages.length > 0) {
+            overrides.languages = languages;
+        }
+    }
+    if (typeof flags.deepAnalysis === "boolean") {
+        overrides.deepAnalysis = flags.deepAnalysis;
+    }
+    if (flags.terraformJson?.trim()) {
+        overrides.terraformJsonPath = flags.terraformJson.trim();
+    }
+    if (flags.terraformPlan?.trim()) {
+        overrides.terraformPlanPath = flags.terraformPlan.trim();
+    }
+    if (typeof flags.terraformStackSectionPathDepth === "number" &&
+        Number.isInteger(flags.terraformStackSectionPathDepth) &&
+        flags.terraformStackSectionPathDepth > 0) {
+        overrides.terraformStackSectionPathDepth = flags.terraformStackSectionPathDepth;
+    }
+    if (flags.noTerraformStackSectionAuto === true) {
+        overrides.autoInferTerraformStackSectionPathDepth = false;
+    }
+    if (typeof flags.monorepoPackageSectionPathDepth === "number" &&
+        Number.isInteger(flags.monorepoPackageSectionPathDepth) &&
+        flags.monorepoPackageSectionPathDepth > 0) {
+        overrides.monorepoPackageSectionPathDepth = flags.monorepoPackageSectionPathDepth;
+    }
+    if (flags.noMonorepoPackageSectionAuto === true) {
+        overrides.autoInferMonorepoPackageSectionPathDepth = false;
+    }
+    if (typeof flags.aiInference === "boolean") {
+        overrides.enableAiInference = flags.aiInference;
+    }
+    if (flags.aiProvider) {
+        overrides.aiProvider = flags.aiProvider;
+    }
+    if (flags.aiModel) {
+        overrides.aiModel = flags.aiModel;
+    }
+    if (flags.aiEndpoint) {
+        overrides.aiEndpoint = flags.aiEndpoint;
+    }
+    if (typeof flags.aiTemperature === "number") {
+        overrides.aiTemperature = Math.max(0, Math.min(flags.aiTemperature, 2));
+    }
+    if (typeof flags.aiMaxTokens === "number" && Number.isFinite(flags.aiMaxTokens)) {
+        overrides.aiMaxTokens = Math.max(1, Math.floor(flags.aiMaxTokens));
+    }
+    if (typeof flags.aiMaxModelCalls === "number" &&
+        Number.isFinite(flags.aiMaxModelCalls)) {
+        overrides.aiMaxModelCalls = Math.max(1, Math.floor(flags.aiMaxModelCalls));
+    }
+    if (typeof flags.aiBudgetTokens === "number" &&
+        Number.isFinite(flags.aiBudgetTokens)) {
+        overrides.aiBudgetTokens = Math.max(1, Math.floor(flags.aiBudgetTokens));
+    }
+    if (typeof flags.aiProviderConcurrency === "number" &&
+        Number.isFinite(flags.aiProviderConcurrency)) {
+        overrides.aiProviderConcurrency = Math.max(1, Math.floor(flags.aiProviderConcurrency));
+    }
+    if (typeof flags.aiMaxCandidatesPerAgent === "number" &&
+        Number.isFinite(flags.aiMaxCandidatesPerAgent)) {
+        overrides.aiMaxCandidatesPerAgent = Math.max(0, Math.floor(flags.aiMaxCandidatesPerAgent));
+    }
+    if (flags.aiInferenceScope) {
+        overrides.aiInferenceScope = flags.aiInferenceScope;
+    }
+    if (typeof flags.aiVerbose === "boolean") {
+        overrides.aiVerbose = flags.aiVerbose;
+    }
+    if (typeof flags.aiToolLoopMaxRounds === "number") {
+        overrides.aiToolLoopMaxRounds = Math.max(1, Math.floor(flags.aiToolLoopMaxRounds));
+    }
+    if (typeof flags.aiToolLoopMaxFiles === "number") {
+        overrides.aiToolLoopMaxFiles = Math.max(1, Math.floor(flags.aiToolLoopMaxFiles));
+    }
+    if (typeof flags.aiToolLoopMaxSearches === "number") {
+        overrides.aiToolLoopMaxSearches = Math.max(1, Math.floor(flags.aiToolLoopMaxSearches));
+    }
+    if (typeof flags.aiThirdPartyDataFlowEnabled === "boolean") {
+        overrides.aiThirdPartyDataFlowEnabled = flags.aiThirdPartyDataFlowEnabled;
+    }
+    return overrides;
+}
+/**
+ * Resolve the effective scan configuration overrides for a given working dir.
+ *
+ * Precedence (lowest to highest):
+ * 1) `dataparade.config.json` in `cwd`
+ * 2) Environment variables (`DATAPARADE_*`)
+ * 3) CLI flags
+ *
+ * The resulting `overrides` object is intended to be passed to
+ * `createDefaultScanConfiguration` to obtain a full `ScanConfiguration`.
+ * Any validation or clamping of individual fields happens in this function
+ * or its helpers.
+ */
+function resolveScanConfiguration(options) {
+    const { cwd, flags } = options;
+    const warnings = [];
+    const overrides = {};
+    // 1) Config file (lowest precedence)
+    try {
+        const fileResult = (0, file_1.loadCliConfigFile)(cwd);
+        if (fileResult) {
+            const { config } = fileResult;
+            if (config.projectName)
+                overrides.projectName = config.projectName;
+            if (config.excludePaths)
+                overrides.excludePaths = config.excludePaths;
+            if (typeof config.enableAPIDetection === "boolean") {
+                overrides.enableAPIDetection = config.enableAPIDetection;
+            }
+            if (typeof config.enableDatabaseDetection === "boolean") {
+                overrides.enableDatabaseDetection = config.enableDatabaseDetection;
+            }
+            if (typeof config.enableDataFlowDetection === "boolean") {
+                overrides.enableDataFlowDetection = config.enableDataFlowDetection;
+            }
+            if (config.languages) {
+                overrides.languages = config.languages;
+            }
+            if (typeof config.minimumConfidence === "number") {
+                const clamped = Math.max(0, Math.min(config.minimumConfidence, 1));
+                overrides.minimumConfidence = clamped;
+            }
+            if (typeof config.deepAnalysis === "boolean") {
+                overrides.deepAnalysis = config.deepAnalysis;
+            }
+            if (config.terraformJsonPath?.trim()) {
+                overrides.terraformJsonPath = config.terraformJsonPath.trim();
+            }
+            if (config.terraformPlanPath?.trim()) {
+                overrides.terraformPlanPath = config.terraformPlanPath.trim();
+            }
+            if (typeof config.terraformStackSectionPathDepth === "number" &&
+                Number.isInteger(config.terraformStackSectionPathDepth) &&
+                config.terraformStackSectionPathDepth > 0) {
+                overrides.terraformStackSectionPathDepth =
+                    config.terraformStackSectionPathDepth;
+            }
+            if (typeof config.autoInferTerraformStackSectionPathDepth === "boolean") {
+                overrides.autoInferTerraformStackSectionPathDepth =
+                    config.autoInferTerraformStackSectionPathDepth;
+            }
+            if (typeof config.monorepoPackageSectionPathDepth === "number" &&
+                Number.isInteger(config.monorepoPackageSectionPathDepth) &&
+                config.monorepoPackageSectionPathDepth > 0) {
+                overrides.monorepoPackageSectionPathDepth =
+                    config.monorepoPackageSectionPathDepth;
+            }
+            if (typeof config.autoInferMonorepoPackageSectionPathDepth === "boolean") {
+                overrides.autoInferMonorepoPackageSectionPathDepth =
+                    config.autoInferMonorepoPackageSectionPathDepth;
+            }
+            if (typeof config.enableAiInference === "boolean") {
+                overrides.enableAiInference = config.enableAiInference;
+            }
+            if (config.aiProvider)
+                overrides.aiProvider = config.aiProvider;
+            if (config.aiModel)
+                overrides.aiModel = config.aiModel;
+            if (config.aiEndpoint)
+                overrides.aiEndpoint = config.aiEndpoint;
+            if (typeof config.aiTemperature === "number") {
+                overrides.aiTemperature = Math.max(0, Math.min(config.aiTemperature, 2));
+            }
+            if (typeof config.aiMaxTokens === "number") {
+                overrides.aiMaxTokens = Math.max(1, Math.floor(config.aiMaxTokens));
+            }
+            if (typeof config.aiMaxModelCalls === "number") {
+                overrides.aiMaxModelCalls = Math.max(1, Math.floor(config.aiMaxModelCalls));
+            }
+            if (typeof config.aiBudgetTokens === "number") {
+                overrides.aiBudgetTokens = Math.max(1, Math.floor(config.aiBudgetTokens));
+            }
+            if (typeof config.aiProviderConcurrency === "number") {
+                overrides.aiProviderConcurrency = Math.max(1, Math.floor(config.aiProviderConcurrency));
+            }
+            if (typeof config.aiMaxCandidatesPerAgent === "number") {
+                overrides.aiMaxCandidatesPerAgent = Math.max(0, Math.floor(config.aiMaxCandidatesPerAgent));
+            }
+            if (config.aiInferenceScope) {
+                overrides.aiInferenceScope = config.aiInferenceScope;
+            }
+            if (typeof config.aiVerbose === "boolean") {
+                overrides.aiVerbose = config.aiVerbose;
+            }
+            if (typeof config.aiToolLoopMaxRounds === "number") {
+                overrides.aiToolLoopMaxRounds = Math.max(1, Math.floor(config.aiToolLoopMaxRounds));
+            }
+            if (typeof config.aiToolLoopMaxFiles === "number") {
+                overrides.aiToolLoopMaxFiles = Math.max(1, Math.floor(config.aiToolLoopMaxFiles));
+            }
+            if (typeof config.aiToolLoopMaxSearches === "number") {
+                overrides.aiToolLoopMaxSearches = Math.max(1, Math.floor(config.aiToolLoopMaxSearches));
+            }
+            if (typeof config.aiThirdPartyDataFlowEnabled === "boolean") {
+                overrides.aiThirdPartyDataFlowEnabled = config.aiThirdPartyDataFlowEnabled;
+            }
+            warnings.push(...fileResult.warnings);
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "Unknown error loading config file.";
+        throw new Error(message);
+    }
+    // 2) Environment variables (override file for secrets / defaults)
+    const envConfig = (0, env_1.loadCliConfigEnv)(process.env);
+    if (envConfig.excludePaths && envConfig.excludePaths.length > 0) {
+        overrides.excludePaths = envConfig.excludePaths;
+    }
+    if (typeof envConfig.minimumConfidence === "number") {
+        const clamped = Math.max(0, Math.min(envConfig.minimumConfidence, 1));
+        overrides.minimumConfidence = clamped;
+    }
+    if (typeof envConfig.enableAiInference === "boolean") {
+        overrides.enableAiInference = envConfig.enableAiInference;
+    }
+    const byokProviderRaw = process.env.SCAN_BYOK_PROVIDER?.trim();
+    if (byokProviderRaw) {
+        const { provider, warning } = (0, normalize_ai_provider_1.normalizeAiProviderId)(byokProviderRaw);
+        if (warning)
+            warnings.push(warning);
+        if (provider)
+            overrides.aiProvider = provider;
+    }
+    else if (envConfig.aiProvider) {
+        overrides.aiProvider = envConfig.aiProvider;
+    }
+    if (envConfig.workspaceApiKey) {
+        overrides.workspaceApiKey = envConfig.workspaceApiKey;
+    }
+    if (envConfig.aiModel) {
+        overrides.aiModel = envConfig.aiModel;
+    }
+    if (envConfig.aiApiKey) {
+        overrides.aiApiKey = envConfig.aiApiKey;
+    }
+    if (envConfig.aiEndpoint) {
+        overrides.aiEndpoint = envConfig.aiEndpoint;
+    }
+    if (typeof envConfig.aiTemperature === "number") {
+        overrides.aiTemperature = Math.max(0, Math.min(envConfig.aiTemperature, 2));
+    }
+    if (typeof envConfig.aiMaxTokens === "number") {
+        overrides.aiMaxTokens = Math.max(1, Math.floor(envConfig.aiMaxTokens));
+    }
+    if (typeof envConfig.aiMaxModelCalls === "number") {
+        overrides.aiMaxModelCalls = Math.max(1, Math.floor(envConfig.aiMaxModelCalls));
+    }
+    if (typeof envConfig.aiBudgetTokens === "number") {
+        overrides.aiBudgetTokens = Math.max(1, Math.floor(envConfig.aiBudgetTokens));
+    }
+    if (typeof envConfig.aiProviderConcurrency === "number") {
+        overrides.aiProviderConcurrency = Math.max(1, Math.floor(envConfig.aiProviderConcurrency));
+    }
+    if (typeof envConfig.aiMaxCandidatesPerAgent === "number") {
+        overrides.aiMaxCandidatesPerAgent = Math.max(0, Math.floor(envConfig.aiMaxCandidatesPerAgent));
+    }
+    if (envConfig.aiInferenceScope) {
+        overrides.aiInferenceScope = envConfig.aiInferenceScope;
+    }
+    if (typeof envConfig.aiVerbose === "boolean") {
+        overrides.aiVerbose = envConfig.aiVerbose;
+    }
+    if (typeof envConfig.aiToolLoopMaxRounds === "number") {
+        overrides.aiToolLoopMaxRounds = Math.max(1, Math.floor(envConfig.aiToolLoopMaxRounds));
+    }
+    if (typeof envConfig.aiToolLoopMaxFiles === "number") {
+        overrides.aiToolLoopMaxFiles = Math.max(1, Math.floor(envConfig.aiToolLoopMaxFiles));
+    }
+    if (typeof envConfig.aiToolLoopMaxSearches === "number") {
+        overrides.aiToolLoopMaxSearches = Math.max(1, Math.floor(envConfig.aiToolLoopMaxSearches));
+    }
+    if (typeof envConfig.aiThirdPartyDataFlowEnabled === "boolean") {
+        overrides.aiThirdPartyDataFlowEnabled = envConfig.aiThirdPartyDataFlowEnabled;
+    }
+    // 3) Flags (highest precedence)
+    const flagOverrides = normalizeFlags(flags);
+    if (flags.byokProvider?.trim()) {
+        const { provider, warning } = (0, normalize_ai_provider_1.normalizeAiProviderId)(flags.byokProvider);
+        if (warning)
+            warnings.push(warning);
+        if (provider)
+            flagOverrides.aiProvider = provider;
+        else
+            delete flagOverrides.aiProvider;
+    }
+    else if (flags.aiProvider?.trim()) {
+        const { provider, warning } = (0, normalize_ai_provider_1.normalizeAiProviderId)(flags.aiProvider);
+        if (warning)
+            warnings.push(warning);
+        if (provider)
+            flagOverrides.aiProvider = provider;
+        else
+            delete flagOverrides.aiProvider;
+    }
+    if (flags.byokModel?.trim()) {
+        flagOverrides.aiModel = flags.byokModel.trim();
+    }
+    if (flags.workspaceApiKey?.trim()) {
+        flagOverrides.workspaceApiKey = flags.workspaceApiKey.trim();
+    }
+    return {
+        overrides: { ...overrides, ...flagOverrides },
+        warnings,
+    };
+}

package/dist/src/config/scan-env.d.ts

@@ -0,0 +1,7 @@
+export declare function resolveWorkspaceApiKey(env: NodeJS.ProcessEnv): string | undefined;
+export declare function resolveByokApiKey(env: NodeJS.ProcessEnv): string | undefined;
+export declare function resolveByokProvider(env: NodeJS.ProcessEnv): string | undefined;
+export declare function resolveByokModel(env: NodeJS.ProcessEnv): string | undefined;
+export declare function resolveScanAiInference(env: NodeJS.ProcessEnv): string | undefined;
+/** Extra provider HTTP / normalization logging (all providers, not OpenAI-only). */
+export declare function isScanAiDebugEnabled(env?: NodeJS.ProcessEnv): boolean;

package/dist/src/config/scan-env.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveWorkspaceApiKey = resolveWorkspaceApiKey;
+exports.resolveByokApiKey = resolveByokApiKey;
+exports.resolveByokProvider = resolveByokProvider;
+exports.resolveByokModel = resolveByokModel;
+exports.resolveScanAiInference = resolveScanAiInference;
+exports.isScanAiDebugEnabled = isScanAiDebugEnabled;
+function resolveWorkspaceApiKey(env) {
+    const value = env.DATAPARADE_WORKSPACE_API_KEY?.trim();
+    return value || undefined;
+}
+function resolveByokApiKey(env) {
+    const value = env.SCAN_BYOK_API_KEY?.trim();
+    return value || undefined;
+}
+function resolveByokProvider(env) {
+    const value = env.SCAN_BYOK_PROVIDER?.trim();
+    return value || undefined;
+}
+function resolveByokModel(env) {
+    const value = env.SCAN_BYOK_MODEL?.trim();
+    return value || undefined;
+}
+function resolveScanAiInference(env) {
+    const value = env.SCAN_AI_INFERENCE?.trim();
+    return value || undefined;
+}
+function parseTruthyEnvFlag(value) {
+    if (!value)
+        return false;
+    const normalized = value.trim().toLowerCase();
+    return normalized === "true";
+}
+/** Extra provider HTTP / normalization logging (all providers, not OpenAI-only). */
+function isScanAiDebugEnabled(env = process.env) {
+    return parseTruthyEnvFlag(env.SCAN_AI_DEBUG);
+}

package/dist/src/config/third-party-detection-config.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared third-party detection config loader.
+ * Reads patterns/third-party.patterns.yaml (known HTTP clients and services).
+ * Used by analyzers to detect external_api_call findings.
+ */
+import { type PatternId } from "../core/types/detection";
+export interface ThirdPartyHttpClientConfig {
+    clientId: string;
+    patternId: PatternId;
+    callRegexes: RegExp[];
+    confidence: number;
+}
+export interface ThirdPartyServiceConfig {
+    serviceName: string;
+    patternId: PatternId;
+    importFragments: string[];
+    confidence: number;
+    urlHostPatterns: string[];
+}
+export interface ThirdPartyDetectionConfig {
+    httpClients: ThirdPartyHttpClientConfig[];
+    services: ThirdPartyServiceConfig[];
+}
+export declare function clearThirdPartyDetectionConfigCache(): void;
+export declare function loadThirdPartyDetectionConfig(): ThirdPartyDetectionConfig;

package/dist/src/config/third-party-detection-config.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * Shared third-party detection config loader.
+ * Reads patterns/third-party.patterns.yaml (known HTTP clients and services).
+ * Used by analyzers to detect external_api_call findings.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearThirdPartyDetectionConfigCache = clearThirdPartyDetectionConfigCache;
+exports.loadThirdPartyDetectionConfig = loadThirdPartyDetectionConfig;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const yaml_1 = __importDefault(require("yaml"));
+const detection_1 = require("../core/types/detection");
+const DEFAULT_CONFIDENCE = 0.8;
+function getConfigPath() {
+    const parts = __dirname.split(path_1.default.sep);
+    const distIndex = parts.lastIndexOf("dist");
+    const cliRoot = distIndex !== -1
+        ? parts.slice(0, distIndex).join(path_1.default.sep)
+        : path_1.default.resolve(__dirname, "..", "..");
+    return path_1.default.join(cliRoot, "patterns", "third-party.patterns.yaml");
+}
+function compileRegex(pattern) {
+    try {
+        return new RegExp(pattern);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`third-party-detection regex '${pattern}' invalid: ${msg}`);
+    }
+}
+function compileRegexList(patterns) {
+    if (!patterns || patterns.length === 0)
+        return [];
+    return patterns.map((p) => compileRegex(p));
+}
+function validatePatternId(rawValue, context) {
+    const id = String(rawValue);
+    if (!detection_1.PATTERN_IDS.includes(id)) {
+        throw new Error(`Invalid patternId '${rawValue}' in ${context}`);
+    }
+    return id;
+}
+let cached;
+function clearThirdPartyDetectionConfigCache() {
+    cached = undefined;
+}
+function loadThirdPartyDetectionConfig() {
+    if (cached)
+        return cached;
+    const configPath = getConfigPath();
+    let raw;
+    try {
+        raw = fs_1.default.readFileSync(configPath, "utf8");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Third-party detection config is required but could not be read from '${configPath}': ${message}`);
+    }
+    const parsed = yaml_1.default.parse(raw);
+    if (!parsed || typeof parsed !== "object") {
+        throw new Error(`Third-party detection config at '${configPath}' did not parse to an object.`);
+    }
+    const httpClients = [];
+    if (Array.isArray(parsed.http_clients)) {
+        for (const hc of parsed.http_clients) {
+            const patternId = validatePatternId(hc.patternId, `third-party-detection.http_clients['${hc.clientId}']`);
+            httpClients.push({
+                clientId: hc.clientId,
+                patternId,
+                callRegexes: compileRegexList(hc.regexes),
+                confidence: hc.confidence ?? DEFAULT_CONFIDENCE,
+            });
+        }
+    }
+    const services = [];
+    if (Array.isArray(parsed.services)) {
+        for (const svc of parsed.services) {
+            const patternId = validatePatternId(svc.patternId, `third-party-detection.services['${svc.serviceName}']`);
+            const urlHostPatterns = Array.isArray(svc.url_host_patterns)
+                ? svc.url_host_patterns.filter((p) => typeof p === "string")
+                : [];
+            services.push({
+                serviceName: svc.serviceName,
+                patternId,
+                importFragments: svc.importFragments ?? [],
+                confidence: svc.confidence ?? DEFAULT_CONFIDENCE,
+                urlHostPatterns,
+            });
+        }
+    }
+    cached = { httpClients, services };
+    return cached;
+}

package/dist/src/config/types.d.ts

@@ -0,0 +1,106 @@
+import type { ScanConfiguration } from "../core/types";
+import type { FileLanguage } from "../core/types";
+import type { AiInferenceScope, AiProviderId } from "../ai-enrichment/types";
+export interface CliConfigFile {
+    projectName?: string;
+    excludePaths?: string[];
+    enableAPIDetection?: boolean;
+    enableDatabaseDetection?: boolean;
+    enableDataFlowDetection?: boolean;
+    languages?: FileLanguage[];
+    minimumConfidence?: number;
+    deepAnalysis?: boolean;
+    terraformJsonPath?: string;
+    terraformPlanPath?: string;
+    terraformStackSectionPathDepth?: number;
+    autoInferTerraformStackSectionPathDepth?: boolean;
+    monorepoPackageSectionPathDepth?: number;
+    autoInferMonorepoPackageSectionPathDepth?: boolean;
+    enableAiInference?: boolean;
+    aiProvider?: AiProviderId;
+    aiModel?: string;
+    aiEndpoint?: string;
+    aiTemperature?: number;
+    aiMaxTokens?: number;
+    aiMaxModelCalls?: number;
+    aiBudgetTokens?: number;
+    aiProviderConcurrency?: number;
+    aiMaxCandidatesPerAgent?: number;
+    aiInferenceScope?: AiInferenceScope;
+    aiVerbose?: boolean;
+    aiToolLoopMaxRounds?: number;
+    aiToolLoopMaxFiles?: number;
+    aiToolLoopMaxSearches?: number;
+    aiThirdPartyDataFlowEnabled?: boolean;
+    workspaceApiKey?: string;
+}
+export interface CliConfigEnv {
+    excludePaths?: string[];
+    minimumConfidence?: number;
+    aiModel?: string;
+    aiApiKey?: string;
+    aiProvider?: AiProviderId;
+    aiEndpoint?: string;
+    aiTemperature?: number;
+    aiMaxTokens?: number;
+    aiMaxModelCalls?: number;
+    aiBudgetTokens?: number;
+    aiProviderConcurrency?: number;
+    aiMaxCandidatesPerAgent?: number;
+    aiInferenceScope?: AiInferenceScope;
+    enableAiInference?: boolean;
+    aiVerbose?: boolean;
+    aiToolLoopMaxRounds?: number;
+    aiToolLoopMaxFiles?: number;
+    aiToolLoopMaxSearches?: number;
+    aiThirdPartyDataFlowEnabled?: boolean;
+    workspaceApiKey?: string;
+}
+export interface CliConfigFlags {
+    exclude?: string[];
+    minimumConfidence?: number;
+    language?: string[];
+    deepAnalysis?: boolean;
+    projectName?: string;
+    terraformJson?: string;
+    terraformPlan?: string;
+    terraformStackSectionPathDepth?: number;
+    noTerraformStackSectionAuto?: boolean;
+    monorepoPackageSectionPathDepth?: number;
+    noMonorepoPackageSectionAuto?: boolean;
+    aiInference?: boolean;
+    aiProvider?: AiProviderId;
+    aiModel?: string;
+    aiEndpoint?: string;
+    aiTemperature?: number;
+    aiMaxTokens?: number;
+    aiMaxModelCalls?: number;
+    aiBudgetTokens?: number;
+    aiProviderConcurrency?: number;
+    aiMaxCandidatesPerAgent?: number;
+    aiInferenceScope?: AiInferenceScope;
+    aiVerbose?: boolean;
+    workspaceApiKey?: string;
+    byokProvider?: AiProviderId;
+    byokModel?: string;
+    aiToolLoopMaxRounds?: number;
+    aiToolLoopMaxFiles?: number;
+    aiToolLoopMaxSearches?: number;
+    aiThirdPartyDataFlowEnabled?: boolean;
+}
+export interface ResolveConfigOptions {
+    cwd: string;
+    flags: CliConfigFlags;
+}
+export interface ResolvedScanConfiguration {
+    /**
+     * Partial override values that will be merged into the
+     * orchestrator's createDefaultScanConfiguration().
+     */
+    overrides: Partial<ScanConfiguration>;
+    /**
+     * Non-fatal issues discovered while reading config file or env.
+     * These can be surfaced to the user as warnings.
+     */
+    warnings: string[];
+}

package/dist/src/config/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/config/validate-scan-ai.d.ts

@@ -0,0 +1,3 @@
+import type { ScanConfiguration } from "../core/types";
+export declare function validateAiInferenceCredentials(config: ScanConfiguration): string[];
+export declare function resolveAiMode(config: ScanConfiguration): "byok" | "platform" | "none";