@dataparade/cli 0.0.1

package/dist/src/core/pipeline/diagram-layout/types.d.ts

@@ -0,0 +1,2 @@
+import type { DetectedComponent } from "../../types";
+export type ComponentByIdMap = Map<string, DetectedComponent>;

package/dist/src/core/pipeline/diagram-layout/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/core/pipeline/graph-mapping.d.ts

@@ -0,0 +1,6 @@
+import type { ScanResult } from "../types";
+import { type DiagramGraphJsonSchema } from "../schema";
+/**
+ * Build a `DiagramGraphJson` from a validated `ScanResult`.
+ */
+export declare function buildDiagramGraphFromScanResult(scanResult: ScanResult): DiagramGraphJsonSchema;

package/dist/src/core/pipeline/graph-mapping.js

@@ -0,0 +1,308 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildDiagramGraphFromScanResult = buildDiagramGraphFromScanResult;
+const schema_1 = require("../schema");
+const app_section_layout_1 = require("./diagram-layout/app-section-layout");
+const constants_1 = require("./diagram-layout/constants");
+const edge_handles_1 = require("./diagram-layout/edge-handles");
+const managed_provider_layout_1 = require("./diagram-layout/managed-provider-layout");
+const minimal_terraform_layout_1 = require("./diagram-layout/minimal-terraform-layout");
+const section_helpers_1 = require("./diagram-layout/section-helpers");
+const terraform_lane_layout_1 = require("./diagram-layout/terraform-lane-layout");
+const terraform_minimal_services_1 = require("./terraform-minimal-services");
+function stripCodeFromSourceLocation(loc) {
+    if (!loc)
+        return undefined;
+    const { code: _code, ...rest } = loc;
+    return rest;
+}
+function stripCodeFromDetectedFromRef(ref) {
+    return {
+        pattern: ref.pattern,
+        sourceLocation: stripCodeFromSourceLocation(ref.sourceLocation),
+    };
+}
+function stripCodeFromSourceLocationsArray(locs) {
+    if (!locs)
+        return undefined;
+    return locs
+        .map((l) => stripCodeFromSourceLocation(l))
+        .filter((l) => l !== undefined);
+}
+function stripCodeFromSourceLocationsField(value) {
+    if (!value)
+        return value;
+    if (typeof value === "object" && !Array.isArray(value)) {
+        const loc = value;
+        const { code: _code, ...rest } = loc;
+        return rest;
+    }
+    if (Array.isArray(value)) {
+        return value
+            .map((v) => {
+            if (typeof v !== "object" || v === null)
+                return v;
+            const loc = v;
+            const { code: _code, ...rest } = loc;
+            return rest;
+        })
+            .filter((v) => v !== undefined);
+    }
+    return value;
+}
+function mapComponentTypeToNodeType(type) {
+    switch (type) {
+        case "asset":
+            return "asset";
+        case "actor":
+            return "actor";
+        case "third_party":
+            return "third_party_service";
+        default:
+            return type;
+    }
+}
+function createNodePosition(sectionIndex, indexWithinSection) {
+    const row = Math.floor(indexWithinSection / constants_1.NODES_PER_ROW);
+    const col = indexWithinSection % constants_1.NODES_PER_ROW;
+    const sectionXOffset = sectionIndex * constants_1.SECTION_BLOCK_WIDTH;
+    return {
+        x: sectionXOffset + col * constants_1.NODE_HORIZONTAL_SPACING,
+        y: row * constants_1.NODE_VERTICAL_SPACING,
+    };
+}
+function mapComponentToNode(component, sectionIndex, indexWithinSection) {
+    const baseData = {
+        label: component.name,
+        description: component.description,
+        privacy: {},
+        security: {},
+        engineering: {},
+    };
+    baseData.componentType = component.type;
+    if (component.subType) {
+        baseData.componentSubType = component.subType;
+    }
+    if (component.detectedFrom?.length) {
+        baseData.detectedFrom = component.detectedFrom.map((ref) => stripCodeFromDetectedFromRef(ref));
+    }
+    if (component.sourceLocations?.length) {
+        baseData.sourceLocations =
+            stripCodeFromSourceLocationsArray(component.sourceLocations);
+    }
+    for (const [key, value] of Object.entries(component.properties ?? {})) {
+        if (value === undefined)
+            continue;
+        if (key === "label" || key === "description")
+            continue;
+        if (key === "privacy" || key === "security" || key === "engineering") {
+            continue;
+        }
+        const dataRecord = baseData;
+        if (dataRecord[key] === undefined) {
+            dataRecord[key] = value;
+        }
+    }
+    return {
+        id: component.id,
+        type: mapComponentTypeToNodeType(component.type),
+        position: createNodePosition(sectionIndex, indexWithinSection),
+        data: baseData,
+    };
+}
+function normalizeDataFlowType(type) {
+    return type;
+}
+function normalizeTransformation(transformation) {
+    if (!transformation || transformation.length === 0) {
+        return "none";
+    }
+    const first = transformation[0];
+    const lower = first.toLowerCase();
+    if (lower.includes("anonym"))
+        return "anonymized";
+    if (lower.includes("pseudonym"))
+        return "pseudonymized";
+    if (lower.includes("aggregat"))
+        return "aggregated";
+    if (lower.includes("encrypt"))
+        return "encrypted";
+    if (lower.includes("token"))
+        return "tokenized";
+    if (lower.includes("mask"))
+        return "masked";
+    if (lower.includes("redact"))
+        return "redacted";
+    return "none";
+}
+function buildFlowName(flow, componentsById) {
+    const source = componentsById.get(flow.sourceComponentId);
+    const target = componentsById.get(flow.targetComponentId);
+    const sourceName = source?.name ?? flow.sourceComponentId;
+    const targetName = target?.name ?? flow.targetComponentId;
+    return `${sourceName} → ${targetName} (${flow.type})`;
+}
+function mapDataFlowToEdge(flow, componentsById) {
+    if (!componentsById.has(flow.sourceComponentId) ||
+        !componentsById.has(flow.targetComponentId)) {
+        return undefined;
+    }
+    const name = buildFlowName(flow, componentsById);
+    const engineering = {
+        transferType: normalizeDataFlowType(flow.type),
+        name,
+        description: flow.description,
+        frequency: "unspecified",
+    };
+    if (flow.actions && flow.actions.length > 0) {
+        engineering.actions = flow.actions;
+    }
+    const privacy = {
+        dataCategories: flow.dataCategories ?? [],
+        dataSubjectCategories: flow.dataSubjectCategories,
+        processingPurpose: flow.processingPurpose,
+        crossBorder: false,
+        adequacyDecision: false,
+    };
+    const security = {
+        encryption: "none",
+        transformation: normalizeTransformation(flow.transformation),
+        auditLogging: false,
+        riskLevel: "medium",
+    };
+    if (flow.enrichmentConfidence !== undefined) {
+        security.enrichmentConfidence = flow.enrichmentConfidence;
+    }
+    if (flow.enrichmentNotes) {
+        security.enrichmentNotes = flow.enrichmentNotes;
+    }
+    const properties = {
+        engineering,
+        privacy,
+        security,
+    };
+    const flowEntries = Object.entries(flow);
+    for (const [key, value] of flowEntries) {
+        if (value === undefined)
+            continue;
+        if (key in properties)
+            continue;
+        if (key === "id" || key === "sourceComponentId" || key === "targetComponentId") {
+            continue;
+        }
+        if (key === "type")
+            continue;
+        if (!(key in properties)) {
+            if (key === "sourceLocation" || key === "sourceLocations") {
+                properties[key] = stripCodeFromSourceLocationsField(value);
+            }
+            else {
+                properties[key] = value;
+            }
+        }
+    }
+    const edge = {
+        id: flow.id,
+        source: flow.sourceComponentId,
+        target: flow.targetComponentId,
+        type: "data_flow",
+        data: {
+            label: name,
+            properties,
+        },
+    };
+    (0, edge_handles_1.applyDirectionalEdgeHandles)(edge, componentsById.get(flow.sourceComponentId), componentsById.get(flow.targetComponentId));
+    return edge;
+}
+/**
+ * Build a `DiagramGraphJson` from a validated `ScanResult`.
+ */
+function buildDiagramGraphFromScanResult(scanResult) {
+    const componentsById = new Map(scanResult.components.map((component) => [component.id, component]));
+    const buckets = new Map();
+    for (const component of scanResult.components) {
+        const sectionId = (0, section_helpers_1.getSectionIdFromComponent)(component);
+        const entry = buckets.get(sectionId) ??
+            ({
+                label: (0, section_helpers_1.getSectionLabelFromComponent)(component),
+                components: [],
+            });
+        entry.components.push(component);
+        buckets.set(sectionId, entry);
+    }
+    const sectionIds = Array.from(buckets.keys());
+    const mixedAppWithTerraform = (0, terraform_minimal_services_1.isMixedAppTerraformScan)(scanResult.components);
+    sectionIds.sort((a, b) => {
+        if (mixedAppWithTerraform) {
+            if (a === "root" && b !== "root")
+                return 1;
+            if (b === "root" && a !== "root")
+                return -1;
+        }
+        else {
+            if (a === "root" && b !== "root")
+                return -1;
+            if (b === "root" && a !== "root")
+                return 1;
+        }
+        const labelA = buckets.get(a)?.label ?? a;
+        const labelB = buckets.get(b)?.label ?? b;
+        const labelCompare = labelA.localeCompare(labelB);
+        if (labelCompare !== 0)
+            return labelCompare;
+        return a.localeCompare(b);
+    });
+    const nodes = [];
+    sectionIds.forEach((sectionId, sectionIndex) => {
+        const bucket = buckets.get(sectionId);
+        if (!bucket)
+            return;
+        const ordered = [...bucket.components].sort((c1, c2) => {
+            const keyA = (0, section_helpers_1.componentSortKey)(c1);
+            const keyB = (0, section_helpers_1.componentSortKey)(c2);
+            if (keyA !== keyB)
+                return keyA.localeCompare(keyB);
+            const nameCompare = (c1.name ?? "").localeCompare(c2.name ?? "");
+            if (nameCompare !== 0)
+                return nameCompare;
+            return c1.type.localeCompare(c2.type);
+        });
+        ordered.forEach((component, indexWithinSection) => {
+            nodes.push(mapComponentToNode(component, sectionIndex, indexWithinSection));
+        });
+    });
+    const edges = [];
+    const useMinimalTfLayout = (0, terraform_minimal_services_1.shouldUseTerraformMinimalServiceDiagramLayout)(scanResult.components);
+    if (useMinimalTfLayout) {
+        (0, minimal_terraform_layout_1.applyTerraformMinimalServiceDiagramLayout)(nodes, componentsById);
+        (0, managed_provider_layout_1.repositionManagedProviderNodes)(nodes, componentsById);
+    }
+    else {
+        (0, terraform_lane_layout_1.applyTerraformLaneLayout)(nodes, componentsById, sectionIds);
+        (0, app_section_layout_1.applyAppSectionStackLayout)(nodes, componentsById, sectionIds);
+        (0, managed_provider_layout_1.repositionManagedProviderNodes)(nodes, componentsById);
+    }
+    for (const flow of scanResult.dataFlows) {
+        const edge = mapDataFlowToEdge(flow, componentsById);
+        if (edge) {
+            edges.push(edge);
+        }
+    }
+    const graph = {
+        nodes,
+        edges,
+        viewport: {
+            x: 0,
+            y: 0,
+            zoom: 1,
+        },
+    };
+    const validation = schema_1.diagramGraphJsonSchema.safeParse(graph);
+    if (!validation.success) {
+        const messages = validation.error.issues
+            .map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`)
+            .join("; ");
+        throw new Error(`Invalid DiagramGraphJson: ${messages}`);
+    }
+    return validation.data;
+}

package/dist/src/core/pipeline/mixed-app-terraform-scan.d.ts

@@ -0,0 +1,13 @@
+import type { DetectedComponent } from "../types/component";
+import type { ScanResult } from "../types/result";
+/**
+ * Repo has deployable application code outside the Terraform stack (monorepo apps).
+ */
+export declare function isMixedAppTerraformScan(components: DetectedComponent[]): boolean;
+/** In mixed scans, keep app nodes plus Terraform provider hub and module call shells only. */
+export declare function shouldKeepComponentInMixedAppTerraformScan(component: DetectedComponent): boolean;
+/**
+ * When application packages and a Terraform stack coexist, drop per-resource
+ * Terraform nodes (VPC subnets, RDS instances, etc.) and keep provider + module shells.
+ */
+export declare function applyMixedAppTerraformScanResult(scanResult: ScanResult): ScanResult;

package/dist/src/core/pipeline/mixed-app-terraform-scan.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isMixedAppTerraformScan = isMixedAppTerraformScan;
+exports.shouldKeepComponentInMixedAppTerraformScan = shouldKeepComponentInMixedAppTerraformScan;
+exports.applyMixedAppTerraformScanResult = applyMixedAppTerraformScanResult;
+const main_application_selection_1 = require("../../classifier/main-application-selection");
+const sectioning_1 = require("../../classifier/sectioning");
+const component_predicates_1 = require("../terraform/component-predicates");
+const section_runtime_1 = require("../sectioning/section-runtime");
+const terraform_flow_utils_1 = require("./terraform-flow-utils");
+function isDeployableAppAssetOutsideTerraformStack(component) {
+    if (component.type !== "asset" || (0, component_predicates_1.hasTerraformAddress)(component))
+        return false;
+    const sub = component.subType;
+    if (sub !== "api" && sub !== "service" && sub !== "application") {
+        return false;
+    }
+    const sid = (0, sectioning_1.getSectionIdFromProperties)(component.properties);
+    if ((0, section_runtime_1.isTerraformStackSection)({ id: sid, sectionDir: sid })) {
+        return false;
+    }
+    if ((0, component_predicates_1.isRootLikeSectionId)(sid)) {
+        return (0, component_predicates_1.hasNonTerraformAppSignals)(component);
+    }
+    return true;
+}
+/**
+ * Repo has deployable application code outside the Terraform stack (monorepo apps).
+ */
+function isMixedAppTerraformScan(components) {
+    if (!components.some(component_predicates_1.hasTerraformAddress))
+        return false;
+    return components.some(isDeployableAppAssetOutsideTerraformStack);
+}
+/** In mixed scans, keep app nodes plus Terraform provider hub and module call shells only. */
+function shouldKeepComponentInMixedAppTerraformScan(component) {
+    if (!(0, component_predicates_1.hasTerraformAddress)(component))
+        return true;
+    if ((0, component_predicates_1.isTerraformProviderComponent)(component))
+        return true;
+    if ((0, main_application_selection_1.isTerraformModuleCallShellAsset)(component))
+        return true;
+    return false;
+}
+function ensureMixedAppTerraformProviderToModuleShellFlows(components, flows) {
+    const provider = (0, terraform_flow_utils_1.findPrimaryTerraformProvider)(components);
+    const shells = (0, terraform_flow_utils_1.listTerraformModuleShells)(components);
+    if (!provider || shells.length === 0)
+        return flows;
+    const next = [...flows];
+    shells.sort((a, b) => a.id.localeCompare(b.id));
+    const push = (sourceId, targetId) => {
+        if ((0, terraform_flow_utils_1.hasDirectedFlow)(next, sourceId, targetId))
+            return;
+        next.push({
+            id: (0, terraform_flow_utils_1.nextSyntheticFlowId)(next),
+            sourceComponentId: sourceId,
+            targetComponentId: targetId,
+            type: "api_call",
+            confidence: 0.72,
+            description: "mixed_app_terraform_module_shell",
+        });
+    };
+    for (const shell of shells) {
+        push(provider.id, shell.id);
+    }
+    return next;
+}
+/**
+ * When application packages and a Terraform stack coexist, drop per-resource
+ * Terraform nodes (VPC subnets, RDS instances, etc.) and keep provider + module shells.
+ */
+function applyMixedAppTerraformScanResult(scanResult) {
+    if (!isMixedAppTerraformScan(scanResult.components))
+        return scanResult;
+    const components = scanResult.components.filter(shouldKeepComponentInMixedAppTerraformScan);
+    const keptIds = new Set(components.map((c) => c.id));
+    let flows = scanResult.dataFlows.filter((f) => keptIds.has(f.sourceComponentId) && keptIds.has(f.targetComponentId));
+    flows = ensureMixedAppTerraformProviderToModuleShellFlows(components, flows);
+    return { ...scanResult, components, dataFlows: flows };
+}

package/dist/src/core/pipeline/orchestrator-result.d.ts

@@ -0,0 +1,6 @@
+import type { FileInfo, RawFinding, ScanResult } from "../types";
+export interface OrchestratorScanResult {
+    scanResult: ScanResult;
+    files: FileInfo[];
+    findings: RawFinding[];
+}

package/dist/src/core/pipeline/orchestrator-result.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/core/pipeline/orchestrator.d.ts

@@ -0,0 +1,26 @@
+import type { ScanConfiguration, ScanProgress } from "../types";
+import type { OrchestratorScanResult } from "./orchestrator-result";
+export type { OrchestratorScanResult } from "./orchestrator-result";
+/**
+ * Construct a complete `ScanConfiguration` from a set of overrides.
+ *
+ * This is the single place where default scan behaviour is defined. Callers
+ * (CLI, tests, future SDKs) should always go through this helper rather than
+ * hand-rolling configuration objects so that new fields pick up sensible
+ * defaults automatically.
+ *
+ * By default, co-located tests, Playwright config, and Storybook artifacts are not
+ * scanned (`DEFAULT_EXCLUDED_FILE_GLOBS` and directory skips in `patterns/scan-exclusions.ts`).
+ */
+export declare function createDefaultScanConfiguration(overrides?: Partial<ScanConfiguration>): ScanConfiguration;
+/**
+ * Run the full structural scan pipeline for a given project root.
+ *
+ * This is the primary entrypoint for code that wants to scan a project:
+ * the CLI, tests, and any future programmatic consumers should call `scan`
+ * rather than reaching into individual ingest/analyzer/classifier modules.
+ *
+ * When LangSmith tracing is enabled (see `tracing/langsmith-tracing.ts`), the
+ * full run is recorded as a root trace; AI inference is a nested trace.
+ */
+export declare function scan(rootPath: string, config: ScanConfiguration, onProgress?: (progress: ScanProgress) => void): Promise<OrchestratorScanResult>;

package/dist/src/core/pipeline/orchestrator.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDefaultScanConfiguration = createDefaultScanConfiguration;
+exports.scan = scan;
+const scan_exclusions_1 = require("../../patterns/scan-exclusions");
+const langsmith_tracing_1 = require("../../tracing/langsmith-tracing");
+const scan_pipeline_1 = require("./scan-pipeline");
+/**
+ * Construct a complete `ScanConfiguration` from a set of overrides.
+ *
+ * This is the single place where default scan behaviour is defined. Callers
+ * (CLI, tests, future SDKs) should always go through this helper rather than
+ * hand-rolling configuration objects so that new fields pick up sensible
+ * defaults automatically.
+ *
+ * By default, co-located tests, Playwright config, and Storybook artifacts are not
+ * scanned (`DEFAULT_EXCLUDED_FILE_GLOBS` and directory skips in `patterns/scan-exclusions.ts`).
+ */
+function createDefaultScanConfiguration(overrides = {}) {
+    const { excludePaths: userExcludePaths, ...restOverrides } = overrides;
+    const base = {
+        projectName: undefined,
+        excludePaths: [],
+        enableAPIDetection: true,
+        enableDatabaseDetection: true,
+        enableDataFlowDetection: true,
+        languages: undefined,
+        minimumConfidence: 0.5,
+        deepAnalysis: false,
+        enableAiInference: false,
+        aiProvider: "mock",
+        aiModel: "heuristic",
+        aiEndpoint: undefined,
+        aiApiKey: undefined,
+        aiTemperature: 0.1,
+        aiMaxTokens: 1024,
+        aiMaxModelCalls: 12,
+        aiBudgetTokens: 12000,
+        aiProviderConcurrency: 4,
+        aiMaxCandidatesPerAgent: 25,
+        aiInferenceScope: "default",
+        aiVerbose: false,
+        aiToolLoopMaxRounds: 3,
+        aiToolLoopMaxFiles: 8,
+        aiToolLoopMaxSearches: 6,
+        aiThirdPartyDataFlowEnabled: false,
+        /** Infer Terraform stack section depth from `.tf` layout when depth is unset. */
+        autoInferTerraformStackSectionPathDepth: true,
+        /** Default workspace package depth (`packages/*`). Override via flag or config. */
+        monorepoPackageSectionPathDepth: 2,
+        autoInferMonorepoPackageSectionPathDepth: true,
+    };
+    return {
+        ...base,
+        ...restOverrides,
+        excludePaths: [
+            ...scan_exclusions_1.DEFAULT_EXCLUDED_FILE_GLOBS,
+            ...(userExcludePaths ?? []),
+        ],
+    };
+}
+/**
+ * Run the full structural scan pipeline for a given project root.
+ *
+ * This is the primary entrypoint for code that wants to scan a project:
+ * the CLI, tests, and any future programmatic consumers should call `scan`
+ * rather than reaching into individual ingest/analyzer/classifier modules.
+ *
+ * When LangSmith tracing is enabled (see `tracing/langsmith-tracing.ts`), the
+ * full run is recorded as a root trace; AI inference is a nested trace.
+ */
+async function scan(rootPath, config, onProgress) {
+    return (0, langsmith_tracing_1.traceDataparadeScan)({
+        rootPath: rootPath.toString(),
+        projectName: config.projectName,
+        enableAiInference: config.enableAiInference,
+        run: () => (0, scan_pipeline_1.runScanPipeline)(rootPath, config, onProgress),
+    });
+}

package/dist/src/core/pipeline/resolve-path-under-scan-root.d.ts

@@ -0,0 +1,7 @@
+export declare function resolvePathUnderScanRoot(scanRootDir: string, userPath: string): {
+    ok: true;
+    resolved: string;
+} | {
+    ok: false;
+    message: string;
+};

package/dist/src/core/pipeline/resolve-path-under-scan-root.js

@@ -0,0 +1,55 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePathUnderScanRoot = resolvePathUnderScanRoot;
+const path = __importStar(require("path"));
+function resolvePathUnderScanRoot(scanRootDir, userPath) {
+    const trimmed = userPath.trim();
+    if (!trimmed) {
+        return { ok: false, message: "path is empty" };
+    }
+    const scanRoot = path.resolve(scanRootDir);
+    const abs = path.isAbsolute(trimmed)
+        ? path.normalize(trimmed)
+        : path.resolve(scanRoot, trimmed);
+    const prefix = `${scanRoot}${path.sep}`;
+    if (abs !== scanRoot && !abs.startsWith(prefix)) {
+        return {
+            ok: false,
+            message: `path must be under scan root: ${userPath}`,
+        };
+    }
+    return { ok: true, resolved: abs };
+}

package/dist/src/core/pipeline/scan-pipeline.d.ts

@@ -0,0 +1,6 @@
+import type { ScanConfiguration, ScanProgress } from "../types";
+import type { OrchestratorScanResult } from "./orchestrator-result";
+/**
+ * Internal scan implementation (ingest → classify → flows → optional AI → validate).
+ */
+export declare function runScanPipeline(rootPath: string, config: ScanConfiguration, onProgress?: (progress: ScanProgress) => void): Promise<OrchestratorScanResult>;