@dataparade/cli 0.0.1

package/dist/tests/unit/cli/scan-command-e2e-ts-sentry-route-env.spec.js

@@ -0,0 +1,85 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const orchestrator_1 = require("../../../src/core/pipeline/orchestrator");
+describe("cli scan - DP-P0-CLI regression: sentry/route/env", () => {
+    it("detects Sentry third_party, Express route, and API_KEY env_variable", async () => {
+        const fixturesRoot = path_1.default.join(__dirname, "..", "..", "fixtures", "e2e-ts-sentry-route-env");
+        const config = (0, orchestrator_1.createDefaultScanConfiguration)({
+            projectName: "SentryRouteEnvApp",
+        });
+        const { scanResult, findings } = await (0, orchestrator_1.scan)(fixturesRoot, config, undefined);
+        const envFinding = findings.find((f) => f.pattern === "env_variable" && f.properties?.key === "API_KEY");
+        expect(envFinding).toBeDefined();
+        const sentryFinding = findings.find((f) => f.pattern === "external_api_call" &&
+            f.properties?.serviceName === "sentry");
+        expect(sentryFinding).toBeDefined();
+        expect(String(sentryFinding?.properties?.url)).toContain("ingest.sentry.io");
+        const componentsById = new Map(scanResult.components.map((c) => [c.id, c]));
+        const sentryComponent = scanResult.components.find((c) => c.type === "third_party" &&
+            typeof c.properties?.serviceName === "string" &&
+            c.properties.serviceName.toLowerCase() === "sentry");
+        expect(sentryComponent).toBeDefined();
+        const routeComponent = scanResult.components.find((c) => {
+            if (c.type !== "asset" || c.subType !== "api")
+                return false;
+            const pathProp = c.properties?.path;
+            if (typeof pathProp === "string")
+                return pathProp === "/users";
+            if (Array.isArray(pathProp))
+                return pathProp.includes("/users");
+            return c.name === "HTTP API";
+        });
+        expect(routeComponent).toBeDefined();
+        // Property inference coverage (YAML-driven):
+        // express_route → request_validation/connection_encryption/api_type/https_enforced
+        expect(routeComponent?.properties?.request_validation).toBe(true);
+        expect(routeComponent?.properties?.connection_encryption).toBe(true);
+        expect(routeComponent?.properties?.api_type).toBe("rest");
+        expect(routeComponent?.properties?.https_enforced).toBe(true);
+        // Data-flow edges are created based on raw findings.
+        const sentryFlow = scanResult.dataFlows.find((df) => df.type === "api_call" && df.targetComponentId === sentryComponent.id);
+        expect(sentryFlow).toBeDefined();
+        const assetDeclaresUsersPath = (c) => {
+            if (!c || c.type !== "asset")
+                return false;
+            const pathProp = c.properties?.path;
+            if (typeof pathProp === "string")
+                return pathProp === "/users";
+            if (Array.isArray(pathProp))
+                return pathProp.includes("/users");
+            return false;
+        };
+        const routeFlow = scanResult.dataFlows.find((df) => {
+            if (df.type !== "api_call")
+                return false;
+            const source = componentsById.get(df.sourceComponentId);
+            const target = componentsById.get(df.targetComponentId);
+            if (target?.id === routeComponent.id || source?.id === routeComponent.id) {
+                return true;
+            }
+            return assetDeclaresUsersPath(source) || assetDeclaresUsersPath(target);
+        });
+        expect(routeFlow).toBeDefined();
+        // external_api_call → third_party integration properties (YAML-driven)
+        expect(sentryComponent?.properties?.integration_method).toBe("api");
+        expect(sentryComponent?.properties?.authentication_method).toBe("api_key");
+        expect(sentryComponent?.properties?.integration_status).toBe("active");
+        expect(sentryComponent?.properties?.api_type).toBe("rest");
+        expect(sentryComponent?.properties?.sdk_available).toBe(true);
+        expect(sentryComponent?.properties?.https_enforced).toBe(true);
+        // env_variable finding should be present and YAML-driven inference should work.
+        const awsEnvFinding = findings.find((f) => f.pattern === "env_variable" &&
+            f.properties?.key === "AWS_REGION" &&
+            f.properties?.cloud_provider === "AWS");
+        expect(awsEnvFinding).toBeDefined();
+        // Safety: ensure referenced component IDs are valid.
+        for (const df of scanResult.dataFlows) {
+            expect(componentsById.has(df.sourceComponentId)).toBe(true);
+            expect(componentsById.has(df.targetComponentId)).toBe(true);
+        }
+    }, 15000);
+});

package/dist/tests/unit/cli/scan-command-exit-code.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/cli/scan-command-exit-code.spec.js

@@ -0,0 +1,131 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+jest.mock("../../../src/core/pipeline/orchestrator", () => ({
+    createDefaultScanConfiguration: jest.fn((overrides) => ({
+        ...overrides,
+        projectName: overrides?.projectName,
+        excludePaths: overrides?.excludePaths,
+        exclude: overrides?.exclude,
+        minimumConfidence: overrides?.minimumConfidence ?? 0,
+        enableAPIDetection: overrides?.enableAPIDetection ?? true,
+        enableDatabaseDetection: overrides?.enableDatabaseDetection ?? true,
+        enableDataFlowDetection: overrides?.enableDataFlowDetection ?? true,
+        languages: overrides?.languages,
+        deepAnalysis: overrides?.deepAnalysis ?? false,
+    })),
+    scan: jest.fn(async () => ({
+        scanResult: {
+            components: [],
+            dataFlows: [],
+            filesScanned: 0,
+            filesSkipped: 0,
+            totalLines: 0,
+            scanDurationMs: 0,
+            warnings: [],
+            errors: ["mock-error"],
+            languageStats: undefined,
+        },
+        files: [],
+        findings: [],
+    })),
+}));
+jest.mock("../../../src/core/pipeline/graph-mapping", () => ({
+    buildDiagramGraphFromScanResult: jest.fn(() => ({
+        nodes: [],
+        edges: [],
+        viewport: { x: 0, y: 0, zoom: 1 },
+    })),
+}));
+jest.mock("../../../src/output/json", () => ({
+    writeDataflowJson: jest.fn(async () => { }),
+}));
+describe("cli scan command - exit codes", () => {
+    const fixturesRoot = path_1.default.join(__dirname, "..", "..", "fixtures", "typescript-basic");
+    function tmpOutputPath() {
+        return path_1.default.join(os_1.default.tmpdir(), `dataparade-exit-${Date.now()}.json`);
+    }
+    afterEach(() => {
+        process.exitCode = undefined;
+    });
+    it("sets exitCode=1 when scanResult.errors is non-empty", async () => {
+        const { run } = require("../../../src/cli");
+        const orchestrator = require("../../../src/core/pipeline/orchestrator");
+        const graphMapping = require("../../../src/core/pipeline/graph-mapping");
+        const outputJson = require("../../../src/output/json");
+        // Reset before running.
+        process.exitCode = undefined;
+        orchestrator.scan.mockResolvedValueOnce({
+            scanResult: {
+                components: [],
+                dataFlows: [],
+                filesScanned: 0,
+                filesSkipped: 0,
+                totalLines: 0,
+                scanDurationMs: 0,
+                warnings: [],
+                errors: ["mock-error"],
+                languageStats: undefined,
+            },
+        });
+        graphMapping.buildDiagramGraphFromScanResult.mockImplementationOnce(() => ({
+            nodes: [],
+            edges: [],
+            viewport: { x: 0, y: 0, zoom: 1 },
+        }));
+        outputJson.writeDataflowJson.mockClear();
+        await run([
+            "node",
+            "cli",
+            "scan",
+            fixturesRoot,
+            "--output",
+            tmpOutputPath(),
+        ]);
+        expect(process.exitCode).toBe(1);
+        expect(outputJson.writeDataflowJson).toHaveBeenCalled();
+    });
+    it("sets exitCode=1 when diagram graph building fails", async () => {
+        const { run } = require("../../../src/cli");
+        const orchestrator = require("../../../src/core/pipeline/orchestrator");
+        const graphMapping = require("../../../src/core/pipeline/graph-mapping");
+        const outputJson = require("../../../src/output/json");
+        process.exitCode = undefined;
+        orchestrator.scan.mockResolvedValueOnce({
+            scanResult: {
+                components: [],
+                dataFlows: [],
+                filesScanned: 0,
+                filesSkipped: 0,
+                totalLines: 0,
+                scanDurationMs: 0,
+                warnings: [],
+                errors: [],
+                languageStats: undefined,
+            },
+        });
+        graphMapping.buildDiagramGraphFromScanResult.mockImplementationOnce(() => {
+            throw new Error("boom");
+        });
+        outputJson.writeDataflowJson.mockClear();
+        const outputPath = tmpOutputPath();
+        if (fs_1.default.existsSync(outputPath))
+            fs_1.default.unlinkSync(outputPath);
+        await run([
+            "node",
+            "cli",
+            "scan",
+            fixturesRoot,
+            "--output",
+            outputPath,
+        ]);
+        expect(process.exitCode).toBe(1);
+        expect(outputJson.writeDataflowJson).not.toHaveBeenCalled();
+        expect(fs_1.default.existsSync(outputPath)).toBe(false);
+    });
+});

package/dist/tests/unit/cli/scan-quota-flow.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/cli/scan-quota-flow.spec.js

@@ -0,0 +1,76 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const cli_1 = require("../../../src/cli");
+function jsonResponse(body, status = 200) {
+    return {
+        ok: status >= 200 && status < 300,
+        status,
+        statusText: status === 200 ? "OK" : "Error",
+        json: async () => body,
+    };
+}
+describe("scan quota flow", () => {
+    let tempRoot;
+    let fetchMock;
+    beforeEach(() => {
+        tempRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-scan-quota-"));
+        fetchMock = jest.fn();
+        global.fetch = fetchMock;
+        process.exitCode = 0;
+    });
+    afterEach(() => {
+        fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
+        delete process.env.DATAPARADE_WORKSPACE_API_KEY;
+        process.exitCode = 0;
+    });
+    it("skips quota API when workspace key is present but AI is disabled", async () => {
+        process.env.DATAPARADE_WORKSPACE_API_KEY = "dp_live_test";
+        await (0, cli_1.run)(["node", "cli", "scan", tempRoot]);
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+    it("prints workspace quota message when preflight is quota-blocked", async () => {
+        process.env.DATAPARADE_WORKSPACE_API_KEY = "dp_live_test";
+        const errorSpy = jest.spyOn(console, "error").mockImplementation(() => { });
+        fetchMock.mockResolvedValueOnce(jsonResponse({
+            code: "scan_quota_exceeded",
+            message: "No scan slots remaining in this workspace.",
+            scansRemaining: 0,
+            aiTokensRemaining: 1000,
+        }, 403));
+        await (0, cli_1.run)(["node", "cli", "scan", tempRoot, "--ai-inference"]);
+        expect(errorSpy).toHaveBeenCalledWith("[scan] workspace quota: No scan slots remaining in this workspace.");
+        errorSpy.mockRestore();
+    });
+    it("reports failed completion when preflight succeeds but config validation fails", async () => {
+        process.env.DATAPARADE_WORKSPACE_API_KEY = "dp_live_test";
+        fetchMock
+            .mockResolvedValueOnce(jsonResponse({
+            allowed: true,
+            jobId: "job-123",
+            scansRemaining: 2,
+            aiTokensRemaining: 1000,
+            suggestedAiBudgetTokens: 100,
+            aiDelivery: "platform_proxy",
+        }))
+            .mockResolvedValueOnce(jsonResponse({ ok: true }));
+        await (0, cli_1.run)([
+            "node",
+            "cli",
+            "scan",
+            tempRoot,
+            "--ai-inference",
+            "--ai-temperature",
+            "not-a-number",
+        ]);
+        expect(fetchMock).toHaveBeenCalledTimes(2);
+        expect(String(fetchMock.mock.calls[0][0])).toContain("/api/scans/cli/preflight");
+        expect(String(fetchMock.mock.calls[1][0])).toContain("/api/scans/cli/job-123/complete");
+        expect(JSON.parse(String(fetchMock.mock.calls[1][1]?.body))).toEqual(expect.objectContaining({ status: "failed", failureCode: "scan_failed" }));
+    });
+});

package/dist/tests/unit/config/property-detection-config.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/config/property-detection-config.spec.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const property_detection_config_1 = require("../../../src/config/property-detection-config");
+describe("property-detection-config - inference_rules validation", () => {
+    it("throws when inference_rules.set assigns an unsupported property key", () => {
+        const invalidYaml = `
+regexes: {}
+inference_rules:
+  env_variable:
+    - when:
+        always: true
+      set:
+        not_a_supported_property: true
+`;
+        (0, property_detection_config_1.clearPropertyDetectionConfigCache)();
+        const original = fs_1.default.readFileSync.bind(fs_1.default);
+        const spy = jest
+            .spyOn(fs_1.default, "readFileSync")
+            .mockImplementation((filePath, encoding) => {
+            const p = String(filePath);
+            if (p.endsWith(path_1.default.join("patterns", "property.patterns.yaml"))) {
+                return invalidYaml;
+            }
+            return original(filePath, encoding);
+        });
+        try {
+            expect(() => (0, property_detection_config_1.loadPropertyDetectionConfig)()).toThrow(/unknown\/unsupported property key/);
+        }
+        finally {
+            spy.mockRestore();
+        }
+    });
+});

package/dist/tests/unit/config/redact.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/config/redact.spec.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const redact_1 = require("../../../src/config/redact");
+const orchestrator_1 = require("../../../src/core/pipeline/orchestrator");
+describe("redactScanConfigurationForDisplay", () => {
+    it("redacts aiApiKey when present", () => {
+        const config = (0, orchestrator_1.createDefaultScanConfiguration)({
+            aiApiKey: "sk-secret-key-12345",
+        });
+        const redacted = (0, redact_1.redactScanConfigurationForDisplay)(config);
+        expect(redacted.aiApiKey).toBe("<redacted>");
+        expect(JSON.stringify(redacted)).not.toContain("sk-secret-key-12345");
+    });
+    it("leaves config unchanged when aiApiKey is absent", () => {
+        const config = (0, orchestrator_1.createDefaultScanConfiguration)();
+        const redacted = (0, redact_1.redactScanConfigurationForDisplay)(config);
+        expect(redacted.aiApiKey).toBeUndefined();
+    });
+});

package/dist/tests/unit/config/resolve-config.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/config/resolve-config.spec.js

@@ -0,0 +1,172 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const resolve_1 = require("../../../src/config/resolve");
+describe("resolveScanConfiguration", () => {
+    const cwd = path_1.default.join(__dirname, "..", "..", "..");
+    it("returns empty overrides when no config file, env, or flags are present", () => {
+        const { overrides, warnings } = (0, resolve_1.resolveScanConfiguration)({
+            cwd,
+            flags: {},
+        });
+        expect(warnings).toEqual([]);
+        expect(overrides).toEqual({});
+    });
+    it("normalizes minimumConfidence from flags", () => {
+        const { overrides } = (0, resolve_1.resolveScanConfiguration)({
+            cwd,
+            flags: { minimumConfidence: 2 },
+        });
+        expect(overrides.minimumConfidence).toBe(1);
+    });
+    it("applies exclude patterns from flags", () => {
+        const { overrides } = (0, resolve_1.resolveScanConfiguration)({
+            cwd,
+            flags: { exclude: ["node_modules", "dist"] },
+        });
+        expect(overrides.excludePaths).toEqual(["node_modules", "dist"]);
+    });
+    it("maps terraform CLI flags to ScanConfiguration fields", () => {
+        const { overrides } = (0, resolve_1.resolveScanConfiguration)({
+            cwd,
+            flags: {
+                terraformJson: " ./out.json ",
+                terraformPlan: "tfplan",
+            },
+        });
+        expect(overrides.terraformJsonPath).toBe("./out.json");
+        expect(overrides.terraformPlanPath).toBe("tfplan");
+    });
+    it("accepts python language from flags", () => {
+        const { overrides } = (0, resolve_1.resolveScanConfiguration)({
+            cwd,
+            flags: { language: ["python"] },
+        });
+        expect(overrides.languages).toEqual(["python"]);
+    });
+    it("accepts python language from dataparade.config.json", () => {
+        const tempCwd = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-cli-config-"));
+        const configPath = path_1.default.join(tempCwd, "dataparade.config.json");
+        try {
+            fs_1.default.writeFileSync(configPath, JSON.stringify({ languages: ["python"] }), "utf8");
+            const { overrides } = (0, resolve_1.resolveScanConfiguration)({
+                cwd: tempCwd,
+                flags: {},
+            });
+            expect(overrides.languages).toEqual(["python"]);
+        }
+        finally {
+            fs_1.default.rmSync(tempCwd, { recursive: true, force: true });
+        }
+    });
+    it("reads terraformStackSectionPathDepth from dataparade.config.json", () => {
+        const tempCwd = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-cli-tfsec-"));
+        const configPath = path_1.default.join(tempCwd, "dataparade.config.json");
+        try {
+            fs_1.default.writeFileSync(configPath, JSON.stringify({ terraformStackSectionPathDepth: 3 }), "utf8");
+            const { overrides } = (0, resolve_1.resolveScanConfiguration)({
+                cwd: tempCwd,
+                flags: {},
+            });
+            expect(overrides.terraformStackSectionPathDepth).toBe(3);
+        }
+        finally {
+            fs_1.default.rmSync(tempCwd, { recursive: true, force: true });
+        }
+    });
+    it("reads aiProviderConcurrency from SCAN_AI_PROVIDER_CONCURRENCY", () => {
+        const previous = process.env.SCAN_AI_PROVIDER_CONCURRENCY;
+        process.env.SCAN_AI_PROVIDER_CONCURRENCY = "2";
+        try {
+            const { overrides } = (0, resolve_1.resolveScanConfiguration)({
+                cwd,
+                flags: {},
+            });
+            expect(overrides.aiProviderConcurrency).toBe(2);
+        }
+        finally {
+            if (previous === undefined) {
+                delete process.env.SCAN_AI_PROVIDER_CONCURRENCY;
+            }
+            else {
+                process.env.SCAN_AI_PROVIDER_CONCURRENCY = previous;
+            }
+        }
+    });
+    it("does not auto-enable AI when BYOK envs are set without SCAN_AI_INFERENCE", () => {
+        const prevProvider = process.env.SCAN_BYOK_PROVIDER;
+        const prevModel = process.env.SCAN_BYOK_MODEL;
+        const prevKey = process.env.SCAN_BYOK_API_KEY;
+        const prevInference = process.env.SCAN_AI_INFERENCE;
+        process.env.SCAN_BYOK_PROVIDER = "openai";
+        process.env.SCAN_BYOK_MODEL = "gpt-4o-mini";
+        process.env.SCAN_BYOK_API_KEY = "sk-test";
+        delete process.env.SCAN_AI_INFERENCE;
+        try {
+            const { overrides } = (0, resolve_1.resolveScanConfiguration)({ cwd, flags: {} });
+            expect(overrides.enableAiInference).toBeUndefined();
+        }
+        finally {
+            if (prevProvider === undefined)
+                delete process.env.SCAN_BYOK_PROVIDER;
+            else
+                process.env.SCAN_BYOK_PROVIDER = prevProvider;
+            if (prevModel === undefined)
+                delete process.env.SCAN_BYOK_MODEL;
+            else
+                process.env.SCAN_BYOK_MODEL = prevModel;
+            if (prevKey === undefined)
+                delete process.env.SCAN_BYOK_API_KEY;
+            else
+                process.env.SCAN_BYOK_API_KEY = prevKey;
+            if (prevInference === undefined)
+                delete process.env.SCAN_AI_INFERENCE;
+            else
+                process.env.SCAN_AI_INFERENCE = prevInference;
+        }
+    });
+    it("warns and drops invalid SCAN_BYOK_PROVIDER", () => {
+        const previous = process.env.SCAN_BYOK_PROVIDER;
+        process.env.SCAN_BYOK_PROVIDER = "open-ai";
+        try {
+            const { overrides, warnings } = (0, resolve_1.resolveScanConfiguration)({
+                cwd,
+                flags: {},
+            });
+            expect(overrides.aiProvider).toBeUndefined();
+            expect(warnings.some((w) => w.includes("Unknown SCAN_BYOK_PROVIDER"))).toBe(true);
+        }
+        finally {
+            if (previous === undefined) {
+                delete process.env.SCAN_BYOK_PROVIDER;
+            }
+            else {
+                process.env.SCAN_BYOK_PROVIDER = previous;
+            }
+        }
+    });
+    it("reads third-party data-flow toggle from SCAN_AI_THIRD_PARTY_DATA_FLOW", () => {
+        const previous = process.env.SCAN_AI_THIRD_PARTY_DATA_FLOW;
+        process.env.SCAN_AI_THIRD_PARTY_DATA_FLOW = "false";
+        try {
+            const { overrides } = (0, resolve_1.resolveScanConfiguration)({
+                cwd,
+                flags: {},
+            });
+            expect(overrides.aiThirdPartyDataFlowEnabled).toBe(false);
+        }
+        finally {
+            if (previous === undefined) {
+                delete process.env.SCAN_AI_THIRD_PARTY_DATA_FLOW;
+            }
+            else {
+                process.env.SCAN_AI_THIRD_PARTY_DATA_FLOW = previous;
+            }
+        }
+    });
+});

package/dist/tests/unit/config/scan-env-debug.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/config/scan-env-debug.spec.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const scan_env_1 = require("../../../src/config/scan-env");
+describe("isScanAiDebugEnabled", () => {
+    it("accepts SCAN_AI_DEBUG", () => {
+        expect((0, scan_env_1.isScanAiDebugEnabled)({ SCAN_AI_DEBUG: "true" })).toBe(true);
+    });
+    it("ignores legacy DATAPARADE_AI_DEBUG", () => {
+        expect((0, scan_env_1.isScanAiDebugEnabled)({ DATAPARADE_AI_DEBUG: "1" })).toBe(false);
+    });
+    it("uses SCAN_AI_DEBUG only when legacy is also present", () => {
+        expect((0, scan_env_1.isScanAiDebugEnabled)({
+            SCAN_AI_DEBUG: "false",
+            DATAPARADE_AI_DEBUG: "true",
+        })).toBe(false);
+    });
+});

package/dist/tests/unit/config/validate-scan-ai.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/config/validate-scan-ai.spec.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const validate_scan_ai_1 = require("../../../src/config/validate-scan-ai");
+function baseConfig(overrides = {}) {
+    return {
+        enableAPIDetection: true,
+        enableDatabaseDetection: true,
+        enableDataFlowDetection: true,
+        minimumConfidence: 0.5,
+        ...overrides,
+    };
+}
+describe("validate-scan-ai", () => {
+    it("requires BYOK trio or workspace key when AI inference is on", () => {
+        const errors = (0, validate_scan_ai_1.validateAiInferenceCredentials)(baseConfig({ enableAiInference: true }));
+        expect(errors.length).toBeGreaterThan(0);
+    });
+    it("accepts full BYOK trio", () => {
+        const errors = (0, validate_scan_ai_1.validateAiInferenceCredentials)(baseConfig({
+            enableAiInference: true,
+            aiProvider: "openai",
+            aiModel: "gpt-4o-mini",
+            aiApiKey: "sk-test",
+        }));
+        expect(errors).toEqual([]);
+        expect((0, validate_scan_ai_1.resolveAiMode)(baseConfig({
+            enableAiInference: true,
+            aiProvider: "openai",
+            aiModel: "gpt-4o-mini",
+            aiApiKey: "sk-test",
+        }))).toBe("byok");
+    });
+    it("accepts workspace key with job id for platform mode", () => {
+        const config = baseConfig({
+            enableAiInference: true,
+            workspaceApiKey: "dp_live_abc",
+            cliQuotaJobId: "job-1",
+        });
+        expect((0, validate_scan_ai_1.validateAiInferenceCredentials)(config)).toEqual([]);
+        expect((0, validate_scan_ai_1.resolveAiMode)(config)).toBe("platform");
+    });
+    it("allows workspace key with AI disabled", () => {
+        const errors = (0, validate_scan_ai_1.validateAiInferenceCredentials)(baseConfig({
+            enableAiInference: false,
+            workspaceApiKey: "dp_live_abc",
+        }));
+        expect(errors).toEqual([]);
+        expect((0, validate_scan_ai_1.resolveAiMode)(baseConfig({
+            enableAiInference: false,
+            workspaceApiKey: "dp_live_abc",
+        }))).toBe("none");
+    });
+});

package/dist/tests/unit/core/classifier-phase-regressions.spec.d.ts

@@ -0,0 +1 @@
+export {};