@dataparade/cli 0.0.1

package/dist/tests/unit/core/parsing-error-handling-nonfatal.spec.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const graph_mapping_1 = require("../../../src/core/pipeline/graph-mapping");
+const orchestrator_1 = require("../../../src/core/pipeline/orchestrator");
+function tempRootForTest() {
+    return path_1.default.join(__dirname, "..", "..", ".tmp", `parsing-nonfatal-${Date.now()}-${Math.random().toString(16).slice(2)}`);
+}
+describe("parsing error handling - non-fatal", () => {
+    it("completes scan with TS parse issues and Python null bytes", async () => {
+        const root = tempRootForTest();
+        try {
+            await promises_1.default.mkdir(root, { recursive: true });
+            await promises_1.default.mkdir(path_1.default.join(root, "src"), { recursive: true });
+            await promises_1.default.writeFile(path_1.default.join(root, "src", "index.ts"), "export {};\n", "utf8");
+            // Intentionally invalid TS syntax to trigger TS parse diagnostics.
+            await promises_1.default.writeFile(path_1.default.join(root, "src", "invalid.ts"), "export const broken = ;\n", "utf8");
+            // Python file with a literal null byte to trigger parser warning.
+            // Use a Buffer to ensure the null byte is present in the file.
+            await promises_1.default.writeFile(path_1.default.join(root, "main.py"), Buffer.from("import os\n\x00\n", "utf8"));
+            const config = (0, orchestrator_1.createDefaultScanConfiguration)({
+                languages: ["typescript", "python"],
+                enableDataFlowDetection: false,
+            });
+            const { scanResult } = await (0, orchestrator_1.scan)(root, config);
+            expect(Array.isArray(scanResult.errors)).toBe(true);
+            expect(scanResult.errors).toHaveLength(0);
+            expect(scanResult.warnings.some((w) => /contains null bytes/i.test(w))).toBe(true);
+            // Ensure graph mapping can be built even when parsing issues exist.
+            const graph = (0, graph_mapping_1.buildDiagramGraphFromScanResult)(scanResult);
+            expect(Array.isArray(graph.nodes)).toBe(true);
+            expect(Array.isArray(graph.edges)).toBe(true);
+        }
+        finally {
+            await promises_1.default.rm(root, { recursive: true, force: true }).catch(() => { });
+        }
+    });
+});

package/dist/tests/unit/core/resolve-path-under-scan-root.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/core/resolve-path-under-scan-root.spec.js

@@ -0,0 +1,54 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const resolve_path_under_scan_root_1 = require("../../../src/core/pipeline/resolve-path-under-scan-root");
+describe("resolvePathUnderScanRoot", () => {
+    it("accepts a relative path under the scan root", () => {
+        const root = path_1.default.resolve("/project/scan");
+        const result = (0, resolve_path_under_scan_root_1.resolvePathUnderScanRoot)(root, "tf/plan.json");
+        expect(result.ok).toBe(true);
+        if (result.ok) {
+            expect(result.resolved).toBe(path_1.default.resolve(root, "tf/plan.json"));
+        }
+    });
+    it("accepts an absolute path under the scan root", () => {
+        const root = path_1.default.resolve("/project/scan");
+        const inner = path_1.default.join(root, "overlay.json");
+        const result = (0, resolve_path_under_scan_root_1.resolvePathUnderScanRoot)(root, inner);
+        expect(result.ok).toBe(true);
+        if (result.ok) {
+            expect(result.resolved).toBe(inner);
+        }
+    });
+    it("rejects paths that escape the scan root", () => {
+        const root = path_1.default.resolve("/project/scan");
+        const result = (0, resolve_path_under_scan_root_1.resolvePathUnderScanRoot)(root, "../../../etc/passwd");
+        expect(result.ok).toBe(false);
+        if (!result.ok) {
+            expect(result.message).toContain("under scan root");
+        }
+    });
+    it("rejects empty paths", () => {
+        const result = (0, resolve_path_under_scan_root_1.resolvePathUnderScanRoot)("/project", "   ");
+        expect(result.ok).toBe(false);
+    });
+    it("rejects absolute paths outside the scan root", () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-scan-root-"));
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-outside-"));
+        try {
+            const outsideFile = path_1.default.join(outside, "plan.json");
+            fs_1.default.writeFileSync(outsideFile, "{}", "utf8");
+            const result = (0, resolve_path_under_scan_root_1.resolvePathUnderScanRoot)(root, outsideFile);
+            expect(result.ok).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/unit/core/scan-result-language-stats.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/core/scan-result-language-stats.spec.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const orchestrator_1 = require("../../../src/core/pipeline/orchestrator");
+describe("ScanResult.languageStats for Python", () => {
+    it("populates languageStats entry for Python files", async () => {
+        const rootPath = `${__dirname}/../../fixtures/python-parser-basic`;
+        const config = (0, orchestrator_1.createDefaultScanConfiguration)();
+        const { scanResult } = await (0, orchestrator_1.scan)(rootPath, config);
+        expect(scanResult.languageStats).toBeDefined();
+        const pythonStats = scanResult.languageStats?.find((entry) => entry.language === "python");
+        expect(pythonStats).toBeDefined();
+        expect(pythonStats?.filesParsed).toBeGreaterThanOrEqual(1);
+        expect(pythonStats?.functionsIndexed).toBeGreaterThanOrEqual(1);
+    });
+});

package/dist/tests/unit/core/section-discovery-excludes.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/core/section-discovery-excludes.spec.js

@@ -0,0 +1,49 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = __importDefault(require("fs/promises"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const discover_service_sections_1 = require("../../../src/core/sectioning/discover-service-sections");
+describe("core/sectioning/discover-service-sections excludes", () => {
+    it("ignores hidden internal package.json directories", async () => {
+        const root = await promises_1.default.mkdtemp(path_1.default.join(os_1.default.tmpdir(), "dp-sections-hidden-"));
+        try {
+            await promises_1.default.mkdir(path_1.default.join(root, ".internal"), { recursive: true });
+            await promises_1.default.writeFile(path_1.default.join(root, ".internal", "package.json"), JSON.stringify({ name: "internal-tooling" }));
+            await promises_1.default.mkdir(path_1.default.join(root, "service-a"), { recursive: true });
+            await promises_1.default.writeFile(path_1.default.join(root, "service-a", "package.json"), JSON.stringify({ name: "service-a" }));
+            const { sections } = await (0, discover_service_sections_1.discoverServiceSections)(root, {
+                autoInferTerraformStackSectionPathDepth: false,
+            });
+            const sectionIds = sections.map((s) => s.id);
+            expect(sectionIds).toContain("service-a");
+            expect(sectionIds).not.toContain(".internal");
+        }
+        finally {
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        }
+    });
+    it("respects root .gitignore patterns such as test-project-scan/*", async () => {
+        const root = await promises_1.default.mkdtemp(path_1.default.join(os_1.default.tmpdir(), "dp-sections-gitignore-"));
+        try {
+            await promises_1.default.writeFile(path_1.default.join(root, ".gitignore"), "test-project-scan/*\n", "utf8");
+            await promises_1.default.mkdir(path_1.default.join(root, "test-project-scan", "sample-app", "nested"), { recursive: true });
+            await promises_1.default.writeFile(path_1.default.join(root, "test-project-scan", "sample-app", "package.json"), JSON.stringify({ name: "ignored-sample" }));
+            await promises_1.default.writeFile(path_1.default.join(root, "test-project-scan", "sample-app", "nested", "package.json"), JSON.stringify({ name: "ignored-nested" }));
+            await promises_1.default.mkdir(path_1.default.join(root, "service-a"), { recursive: true });
+            await promises_1.default.writeFile(path_1.default.join(root, "service-a", "package.json"), JSON.stringify({ name: "service-a" }));
+            const { sections } = await (0, discover_service_sections_1.discoverServiceSections)(root, {
+                autoInferTerraformStackSectionPathDepth: false,
+            });
+            const sectionIds = sections.map((s) => s.id);
+            expect(sectionIds).toContain("service-a");
+            expect(sectionIds.some((id) => id.startsWith("test-project-scan"))).toBe(false);
+        }
+        finally {
+            await promises_1.default.rm(root, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/unit/core/section-runtime.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/core/section-runtime.spec.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const section_runtime_1 = require("../../../src/core/sectioning/section-runtime");
+function comp(partial) {
+    return {
+        name: partial.id,
+        type: "asset",
+        confidence: 1,
+        detectedFrom: [],
+        sourceLocations: [],
+        properties: {},
+        ...partial,
+    };
+}
+describe("section-runtime", () => {
+    it("isTerraformDerivedComponent detects terraform_address and patterns", () => {
+        expect((0, section_runtime_1.isTerraformDerivedComponent)(comp({
+            id: "tf1",
+            properties: { terraform_address: "aws_s3_bucket.x" },
+        }))).toBe(true);
+        expect((0, section_runtime_1.isTerraformDerivedComponent)(comp({
+            id: "tf2",
+            detectedFrom: [{ pattern: "terraform_resource" }],
+        }))).toBe(true);
+        expect((0, section_runtime_1.isTerraformDerivedComponent)(comp({
+            id: "app1",
+            detectedFrom: [{ pattern: "express_route" }],
+            sourceLocations: [{ filePath: "api/route.ts", startLine: 1, endLine: 2 }],
+        }))).toBe(false);
+    });
+    it("sectionHasRuntimeCodeComponents ignores terraform-only assets in a module section", () => {
+        const components = [
+            comp({
+                id: "tf_rds",
+                detectedFrom: [{ pattern: "terraform_resource" }],
+                sourceLocations: [
+                    { filePath: "terraform/modules/aurora/main.tf", startLine: 1, endLine: 10 },
+                ],
+                properties: {
+                    section_id: "terraform/modules/aurora",
+                    terraform_address: "module.aurora.aws_rds_cluster.this",
+                },
+            }),
+        ];
+        expect((0, section_runtime_1.sectionHasRuntimeCodeComponents)(components, "terraform/modules/aurora")).toBe(false);
+    });
+    it("sectionQualifiesForSyntheticApplication skips terraform stack module sections", () => {
+        const components = [
+            comp({
+                id: "tf_rds",
+                detectedFrom: [{ pattern: "terraform_resource" }],
+                sourceLocations: [
+                    { filePath: "terraform/modules/aurora/main.tf", startLine: 1, endLine: 5 },
+                ],
+                properties: { section_id: "terraform/modules/aurora" },
+            }),
+        ];
+        expect((0, section_runtime_1.sectionQualifiesForSyntheticApplication)({
+            id: "terraform/modules/aurora",
+            label: "aurora",
+            role: "service",
+            sectionDir: "terraform/modules/aurora",
+            manifestPaths: [],
+        }, components)).toBe(false);
+        expect((0, section_runtime_1.isTerraformStackSection)({ id: "terraform/modules/aurora", sectionDir: "terraform/modules/aurora" })).toBe(true);
+    });
+    it("sectionQualifiesForSyntheticApplication skips discovery-flagged terraform stacks", () => {
+        expect((0, section_runtime_1.sectionQualifiesForSyntheticApplication)({
+            id: "infra/stack",
+            label: "stack",
+            role: "service",
+            sectionDir: "infra/stack",
+            manifestPaths: ["infra/stack/main.tf"],
+            isTerraformStack: true,
+        }, [])).toBe(false);
+        expect((0, section_runtime_1.isTerraformStackSection)({
+            id: "infra/stack",
+            sectionDir: "infra/stack",
+            isTerraformStack: true,
+        })).toBe(true);
+    });
+    it("sectionHasRuntimeCodeComponents detects routes and databases", () => {
+        const components = [
+            comp({
+                id: "c1",
+                detectedFrom: [{ pattern: "express_route" }],
+                sourceLocations: [{ filePath: "packages/api/src/routes.ts", startLine: 1, endLine: 2 }],
+                properties: { section_id: "packages/api" },
+            }),
+        ];
+        expect((0, section_runtime_1.sectionHasRuntimeCodeComponents)(components, "packages/api")).toBe(true);
+        expect((0, section_runtime_1.sectionHasRuntimeCodeComponents)(components, "packages/cli")).toBe(false);
+    });
+    it("sectionQualifiesForSyntheticApplication includes manifest package with classified components", () => {
+        const components = [
+            comp({
+                id: "tp1",
+                type: "third_party",
+                properties: { section_id: "packages/twenty-companion" },
+            }),
+        ];
+        expect((0, section_runtime_1.sectionQualifiesForSyntheticApplication)({
+            id: "packages/twenty-companion",
+            label: "twenty-companion",
+            role: "service",
+            sectionDir: "packages/twenty-companion",
+            manifestPaths: ["packages/twenty-companion/package.json"],
+            isPrimaryMonorepoPackage: true,
+        }, components)).toBe(true);
+    });
+    it("isScaffoldOrTemplatePackageSection uses path layout and shouting-case names only", () => {
+        expect((0, section_runtime_1.isScaffoldOrTemplatePackageSection)({
+            id: "packages/acme-cli/src/constants/template",
+            sectionDir: "packages/acme-cli/src/constants/template",
+            packageName: "TO-BE-GENERATED",
+        })).toBe(true);
+        expect((0, section_runtime_1.isScaffoldOrTemplatePackageSection)({
+            id: "packages/twenty-server",
+            sectionDir: "packages/twenty-server",
+            packageName: "twenty-server",
+        })).toBe(false);
+    });
+    it("sectionQualifiesForSyntheticApplication skips generator template sections", () => {
+        expect((0, section_runtime_1.sectionQualifiesForSyntheticApplication)({
+            id: "packages/acme-cli/src/constants/template",
+            label: "TO-BE-GENERATED",
+            role: "service",
+            sectionDir: "packages/acme-cli/src/constants/template",
+            manifestPaths: ["packages/acme-cli/src/constants/template/package.json"],
+            packageName: "TO-BE-GENERATED",
+        }, [])).toBe(false);
+    });
+    it("shouldInjectUserActorForMainApp skips injected placeholder in terraform module sections", () => {
+        const components = [
+            comp({
+                id: "tf_rds",
+                detectedFrom: [{ pattern: "terraform_resource" }],
+                sourceLocations: [
+                    { filePath: "terraform/modules/aurora/main.tf", startLine: 1, endLine: 5 },
+                ],
+                properties: { section_id: "terraform/modules/aurora" },
+            }),
+        ];
+        expect((0, section_runtime_1.shouldInjectUserActorForMainApp)(comp({
+            id: "main",
+            subType: "application",
+            properties: {
+                isMainApplication: true,
+                sourceContext: "injected_project_placeholder",
+                section_id: "terraform/modules/aurora",
+            },
+        }), components)).toBe(false);
+    });
+    it("shouldInjectUserActorForMainApp skips placeholder tooling mains", () => {
+        const components = [];
+        expect((0, section_runtime_1.shouldInjectUserActorForMainApp)(comp({
+            id: "main",
+            subType: "application",
+            properties: {
+                isMainApplication: true,
+                sourceContext: "injected_project_placeholder",
+                section_id: "packages/twenty-zapier",
+            },
+        }), components)).toBe(false);
+    });
+});

package/dist/tests/unit/core/stable-component-ids.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/core/stable-component-ids.spec.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const stable_component_ids_1 = require("../../../src/core/pipeline/stable-component-ids");
+const scan_result_builders_1 = require("../../helpers/scan-result-builders");
+function idsOf(components) {
+    return [...components].sort((a, b) => a.id.localeCompare(b.id)).map((c) => c.id);
+}
+describe("stable-component-ids", () => {
+    it("stableComponentKey prefers terraform_address then managed tuple then app tuple", () => {
+        expect((0, stable_component_ids_1.stableComponentKey)((0, scan_result_builders_1.testAsset)("x", "RDS", {
+            terraform_address: "module.db.aws_db_instance.main",
+            section_id: "terraform",
+        }))).toBe("tf:module.db.aws_db_instance.main");
+        expect((0, stable_component_ids_1.stableComponentKey)((0, scan_result_builders_1.testAsset)("x", "S3", {
+            managed_by_provider: "cmp_aws",
+            managed_service_key: "s3",
+            section_id: "root",
+        }))).toBe("managed:cmp_aws|s3|root");
+        expect((0, stable_component_ids_1.stableComponentKey)((0, scan_result_builders_1.testAsset)("x", "API", { section_id: "reedy" }, "api"))).toBe("app:reedy|asset|api||api");
+    });
+    it("assigns identical cmp_* ids for the same logical components in different insertion order", () => {
+        const apiA = (0, scan_result_builders_1.testAsset)("cmp_99", "API", { section_id: "reedy", isSectionApiNode: true }, "api");
+        const providerA = {
+            id: "tp_aws",
+            name: "AWS",
+            type: "third_party",
+            subType: "cloud_provider",
+            confidence: 0.9,
+            detectedFrom: [],
+            sourceLocations: [],
+            properties: {
+                terraform_address: "provider.aws",
+                section_id: "terraform",
+            },
+        };
+        const modA = (0, scan_result_builders_1.testAsset)("cmp_50", "Module · db", {
+            terraform_address: "module.db",
+            section_id: "terraform",
+        });
+        const order1 = [apiA, providerA, modA];
+        const order2 = [modA, providerA, apiA];
+        const out1 = (0, stable_component_ids_1.assignStableComponentIds)(order1, []);
+        const out2 = (0, stable_component_ids_1.assignStableComponentIds)(order2, []);
+        expect(idsOf(out1.components)).toEqual(idsOf(out2.components));
+        expect(out1.components.find((c) => c.properties.terraform_address === "provider.aws")?.id).toBe(out2.components.find((c) => c.properties.terraform_address === "provider.aws")?.id);
+        expect(out1.components.find((c) => c.subType === "api")?.id).toBe(out2.components.find((c) => c.subType === "api")?.id);
+    });
+    it("adding a TF-only component does not change ids of unchanged app components", () => {
+        const api = (0, scan_result_builders_1.testAsset)("cmp_z", "API", { section_id: "root", isSectionApiNode: true }, "api");
+        const provider = {
+            id: "cmp_aws",
+            name: "AWS",
+            type: "third_party",
+            subType: "cloud_provider",
+            confidence: 0.9,
+            detectedFrom: [],
+            sourceLocations: [],
+            properties: { terraform_address: "provider.aws", section_id: "terraform" },
+        };
+        const mod = (0, scan_result_builders_1.testAsset)("cmp_mod", "Module · db", {
+            terraform_address: "module.db",
+            section_id: "terraform",
+        });
+        const base = (0, stable_component_ids_1.assignStableComponentIds)([api, provider, mod], []);
+        const apiIdBefore = base.components.find((c) => c.subType === "api")?.id;
+        const innerRds = (0, scan_result_builders_1.testAsset)("cmp_rds", "RDS", {
+            section_id: "terraform",
+            terraform_address: "module.db.aws_db_instance.main",
+            resource_type: "aws_db_instance",
+        });
+        const withExtra = (0, stable_component_ids_1.assignStableComponentIds)([api, provider, mod, innerRds], []);
+        expect(withExtra.components.find((c) => c.subType === "api")?.id).toBe(apiIdBefore);
+        expect(withExtra.components.find((c) => c.properties.terraform_address === "module.db.aws_db_instance.main")?.id).toMatch(/^cmp_\d+$/);
+        expect(withExtra.components.some((c) => c.id === "cmp_rds")).toBe(false);
+    });
+    it("rewrites dataFlows and managed_by_provider references", () => {
+        const provider = {
+            id: "cmp_old_aws",
+            name: "AWS",
+            type: "third_party",
+            subType: "cloud_provider",
+            confidence: 0.9,
+            detectedFrom: [],
+            sourceLocations: [],
+            properties: { terraform_address: "provider.aws", section_id: "root" },
+        };
+        const managed = (0, scan_result_builders_1.testAsset)("cmp_old_s3", "S3", {
+            terraform_address: "aws_s3_bucket.x",
+            managed_by_provider: "cmp_old_aws",
+            managed_service_key: "s3",
+            section_id: "root",
+        });
+        const flows = [
+            {
+                id: "flow_1",
+                sourceComponentId: "cmp_old_aws",
+                targetComponentId: "cmp_old_s3",
+                type: "file_transfer",
+                confidence: 0.8,
+            },
+        ];
+        const out = (0, stable_component_ids_1.assignStableComponentIds)([managed, provider], flows);
+        const newProviderId = out.components.find((c) => c.properties.terraform_address === "provider.aws")?.id;
+        const newManagedId = out.components.find((c) => c.properties.managed_service_key === "s3")?.id;
+        expect(newProviderId).toMatch(/^cmp_\d+$/);
+        expect(newManagedId).toMatch(/^cmp_\d+$/);
+        expect(out.components.find((c) => c.properties.managed_service_key === "s3")?.properties
+            .managed_by_provider).toBe(newProviderId);
+        expect(out.dataFlows[0]?.sourceComponentId).toBe(newProviderId);
+        expect(out.dataFlows[0]?.targetComponentId).toBe(newManagedId);
+    });
+});

package/dist/tests/unit/core/structural-scan.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/core/structural-scan.spec.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const orchestrator_1 = require("../../../src/core/pipeline/orchestrator");
+const structural_scan_1 = require("../../../src/core/pipeline/structural-scan");
+describe("core/pipeline/structural-scan - DP-P0-CLI-303", () => {
+    it("populates ScanResult.dataFlows for a simple TS/JS fixture project", async () => {
+        const fixturesRoot = path_1.default.join(__dirname, "..", "..", "fixtures", "typescript-basic");
+        const { scanResult } = await (0, structural_scan_1.runStructuralScan)(fixturesRoot);
+        expect(scanResult.components.length).toBeGreaterThan(0);
+        expect(scanResult.dataFlows.length).toBeGreaterThan(0);
+        for (const flow of scanResult.dataFlows) {
+            expect(typeof flow.sourceComponentId).toBe("string");
+            expect(flow.sourceComponentId).not.toHaveLength(0);
+            expect(typeof flow.targetComponentId).toBe("string");
+            expect(flow.targetComponentId).not.toHaveLength(0);
+            expect([
+                "api_call",
+                "database_query",
+                "message_queue",
+                "file_transfer",
+                "webhook",
+                "rpc",
+            ]).toContain(flow.type);
+        }
+    });
+    it("DP-P0-CLI-304: detects structural flows by category for typescript-basic fixture", async () => {
+        const fixturesRoot = path_1.default.join(__dirname, "..", "..", "fixtures", "typescript-basic");
+        const { scanResult, findings } = await (0, structural_scan_1.runStructuralScan)(fixturesRoot);
+        const componentsById = new Map(scanResult.components.map((component) => [component.id, component]));
+        const databaseFlows = scanResult.dataFlows.filter((flow) => flow.type === "database_query");
+        const apiOrWebhookFlows = scanResult.dataFlows.filter((flow) => flow.type === "api_call" || flow.type === "webhook");
+        const thirdPartyFlows = apiOrWebhookFlows.filter((flow) => {
+            const target = componentsById.get(flow.targetComponentId);
+            return target?.type === "third_party";
+        });
+        const serviceToServiceFlows = scanResult.dataFlows.filter((flow) => {
+            const source = componentsById.get(flow.sourceComponentId);
+            const target = componentsById.get(flow.targetComponentId);
+            return source?.type === "asset" && target?.type === "asset";
+        });
+        // Assert counts per category for the typescript-basic fixture.
+        expect(databaseFlows.length).toBe(1);
+        expect(thirdPartyFlows.length).toBe(1);
+        // Merged HTTP API hub plus per-section API synthesis: express_route wiring can use
+        // the section API node, and detectDataFlows adds a synthetic main → section-API edge.
+        expect(serviceToServiceFlows.length).toBe(2);
+        // DB interaction: asset → database asset.
+        const dbFlow = databaseFlows[0];
+        const dbSource = componentsById.get(dbFlow.sourceComponentId);
+        const dbTarget = componentsById.get(dbFlow.targetComponentId);
+        expect(dbSource?.type).toBe("asset");
+        expect(dbTarget?.type).toBe("asset");
+        expect(dbTarget?.subType).toBe("database");
+        // External service call: asset → third_party (Stripe).
+        const tpFlow = thirdPartyFlows[0];
+        const tpSource = componentsById.get(tpFlow.sourceComponentId);
+        const tpTarget = componentsById.get(tpFlow.targetComponentId);
+        expect(tpSource?.type).toBe("asset");
+        expect(tpTarget?.type).toBe("third_party");
+        expect(tpFlow.endpoint).toBe("https://api.stripe.com/v1/customers");
+        const dbS2s = serviceToServiceFlows.find((f) => f.id === dbFlow.id);
+        expect(dbS2s).toBeDefined();
+        const mainToSectionApi = serviceToServiceFlows.find((f) => f.targetScopeReason === "main-to-section-api" &&
+            (componentsById.get(f.targetComponentId)?.properties?.isSectionApiNode === true ||
+                componentsById.get(f.targetComponentId)?.properties?.isSectionApiNode === "true"));
+        expect(mainToSectionApi).toBeDefined();
+        expect(mainToSectionApi?.targetScope).toBe("local");
+    });
+    it("rejects terraformJsonPath outside scan root", async () => {
+        const fixturesRoot = path_1.default.join(__dirname, "..", "..", "fixtures", "typescript-basic");
+        const outside = path_1.default.join(fixturesRoot, "..", "terraform-show-extra-bucket.json");
+        const warnings = [];
+        const config = (0, orchestrator_1.createDefaultScanConfiguration)({
+            terraformJsonPath: outside,
+        });
+        await (0, structural_scan_1.runStructuralScanPhase)(fixturesRoot, config, (w) => warnings.push(w));
+        expect(warnings.some((w) => w.includes("terraform-json: path must be under scan root"))).toBe(true);
+    });
+});

package/dist/tests/unit/core/terraform-json-overlay.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/core/terraform-json-overlay.spec.js

@@ -0,0 +1,36 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const orchestrator_1 = require("../../../src/core/pipeline/orchestrator");
+const json_1 = require("../../../src/output/json");
+const graph_mapping_1 = require("../../../src/core/pipeline/graph-mapping");
+describe("terraform JSON overlay in scan pipeline", () => {
+    it("merges extra plan resources and sets terraformScanSummary + metadata.terraform", async () => {
+        const fixturesRoot = path_1.default.join(__dirname, "..", "..", "fixtures", "terraform-basic");
+        const jsonFixture = path_1.default.join(__dirname, "..", "..", "fixtures", "terraform-show-extra-bucket.json");
+        const overlayInRoot = path_1.default.join(fixturesRoot, "show-overlay.json");
+        fs_1.default.copyFileSync(jsonFixture, overlayInRoot);
+        try {
+            const config = (0, orchestrator_1.createDefaultScanConfiguration)({
+                terraformJsonPath: "show-overlay.json",
+            });
+            const { scanResult } = await (0, orchestrator_1.scan)(fixturesRoot, config);
+            expect(scanResult.terraformScanSummary).toBeDefined();
+            expect(scanResult.terraformScanSummary?.mode).toBe("json_overlay");
+            expect(scanResult.terraformScanSummary?.jsonFindingsMerged).toBeGreaterThanOrEqual(1);
+            const extraBucket = scanResult.components.some((c) => c.name.includes("only_in_plan") ||
+                c.properties?.terraform_address?.includes("only_in_plan"));
+            expect(extraBucket).toBe(true);
+            const graph = (0, graph_mapping_1.buildDiagramGraphFromScanResult)(scanResult);
+            const wrapper = (0, json_1.buildDataflowWrapper)(scanResult, graph);
+            expect(wrapper.metadata?.terraform).toEqual(scanResult.terraformScanSummary);
+        }
+        finally {
+            fs_1.default.unlinkSync(overlayInRoot);
+        }
+    });
+});

package/dist/tests/unit/core/terraform-minimal-services.spec.d.ts

@@ -0,0 +1 @@
+export {};