@dataparade/cli 0.0.1

package/dist/tests/unit/ingest/file-system.spec.js

@@ -0,0 +1,180 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const file_system_1 = require("../../../src/ingest/file-system");
+describe("ingest/file-system - DP-P0-CLI-101", () => {
+    const fixtureRoot = path_1.default.resolve(__dirname, "../../fixtures/ingest-basic");
+    it("applies default excluded directories and .gitignore rules", async () => {
+        const files = await (0, file_system_1.ingestFileSystem)(fixtureRoot);
+        const paths = files.map((f) => f.path);
+        const excludedDirNames = [
+            "node_modules",
+            ".git",
+            "dist",
+            "build",
+            ".next",
+            "out",
+            "coverage",
+            ".vscode",
+            ".idea",
+        ];
+        for (const p of paths) {
+            for (const dirName of excludedDirNames) {
+                expect(p).not.toContain(`${dirName}/`);
+                expect(p).not.toContain(`/${dirName}`);
+            }
+        }
+        // .gitignore at root should ignore ignored.ts and temp/**
+        expect(paths).not.toContain("ignored.ts");
+        expect(paths.some((p) => p.startsWith("temp/"))).toBe(false);
+        // .gitignore in src should ignore ignored-in-src.ts
+        expect(paths).not.toContain("src/ignored-in-src.ts");
+        // Normal files under non-excluded directories should still be present
+        expect(paths).toContain("src/index.ts");
+        expect(paths).toContain("src/app.jsx");
+        expect(paths).toContain("config/app.yaml");
+        expect(paths).toContain("data/sample.json");
+    });
+    it("maps extensions to FileLanguage and skips unsupported ones", async () => {
+        const files = await (0, file_system_1.ingestFileSystem)(fixtureRoot);
+        const byPath = new Map(files.map((f) => [f.path, f]));
+        expect(byPath.get("src/index.ts")?.language).toBe("typescript");
+        expect(byPath.get("src/app.jsx")?.language).toBe("javascript");
+        expect(byPath.get("config/app.yaml")?.language).toBe("yaml");
+        expect(byPath.get("data/sample.json")?.language).toBe("json");
+        // Python files should be detected as python
+        const pyFile = byPath.get("scripts/example.py");
+        if (pyFile) {
+            expect(pyFile.language).toBe("python");
+        }
+        // Unsupported extension (.md) should not be included
+        expect(byPath.has("README.md")).toBe(false);
+    });
+    it("populates content and size for included files", async () => {
+        const files = await (0, file_system_1.ingestFileSystem)(fixtureRoot);
+        const file = files.find((f) => f.path === "src/index.ts");
+        expect(file).toBeDefined();
+        expect(file?.content.length).toBeGreaterThan(0);
+        expect(file?.size).toBeGreaterThan(0);
+    });
+    it("skips files that exceed maxFileSizeBytes", async () => {
+        const tempRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-cli-ingest-"));
+        const warnings = [];
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "small.ts"), "x", "utf8");
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "big.ts"), "a".repeat(20), "utf8");
+            const files = await (0, file_system_1.ingestFileSystem)(tempRoot, {
+                maxFileSizeBytes: 10,
+                maxFileCount: 100,
+                maxTotalBytes: 10_000,
+                onWarning: (w) => warnings.push(w),
+            });
+            const paths = files.map((f) => f.path);
+            expect(paths).toContain("small.ts");
+            expect(paths).not.toContain("big.ts");
+            expect(warnings.some((w) => w.includes("exceeds max file size"))).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    it("stops ingest when maxFileCount is reached", async () => {
+        const tempRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-cli-ingest-"));
+        const warnings = [];
+        try {
+            for (let i = 0; i < 10; i += 1) {
+                fs_1.default.writeFileSync(path_1.default.join(tempRoot, `f${i}.ts`), `console.log(${i});`, "utf8");
+            }
+            const files = await (0, file_system_1.ingestFileSystem)(tempRoot, {
+                maxFileSizeBytes: 10_000,
+                maxFileCount: 3,
+                maxTotalBytes: 10_000_000,
+                onWarning: (w) => warnings.push(w),
+            });
+            expect(files).toHaveLength(3);
+            expect(warnings.some((w) => w.includes("max file count") && w.includes("Stopped"))).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    it("maps .tf and .tfvars to terraform language", async () => {
+        const tempRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-cli-ingest-tf-"));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "main.tf"), 'resource "null_resource" "x" {}\n', "utf8");
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "prod.auto.tfvars"), 'region = "us-east-1"\n', "utf8");
+            const files = await (0, file_system_1.ingestFileSystem)(tempRoot);
+            const byName = new Map(files.map((f) => [f.name, f]));
+            expect(byName.get("main.tf")?.language).toBe("terraform");
+            expect(byName.get("prod.auto.tfvars")?.language).toBe("terraform");
+        }
+        finally {
+            fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+});
+describe("ingest/file-system - DP-P0-CLI-105", () => {
+    const FIXTURE_ROOT = path_1.default.join(__dirname, "../../fixtures/typescript-basic");
+    it("returns FileInfo[] for TypeScript files with correct metadata", async () => {
+        const files = await (0, file_system_1.ingestFileSystem)(FIXTURE_ROOT);
+        const tsFiles = files.filter((f) => f.language === "typescript");
+        const paths = tsFiles.map((f) => f.path).sort();
+        expect(tsFiles.length).toBeGreaterThanOrEqual(3);
+        expect(paths).toContain("server.ts");
+        expect(paths).toContain("db.ts");
+        expect(paths).toContain("external-api.ts");
+        for (const file of tsFiles) {
+            expect(file.name.endsWith(".ts")).toBe(true);
+            expect(file.size).toBeGreaterThan(0);
+        }
+    });
+    it("applies default excluded directories such as node_modules", async () => {
+        const files = await (0, file_system_1.ingestFileSystem)(FIXTURE_ROOT);
+        const nodeModuleFiles = files.filter((f) => f.path.includes("node_modules/"));
+        expect(nodeModuleFiles).toHaveLength(0);
+    });
+    it("respects .gitignore rules under the fixture root", async () => {
+        const files = await (0, file_system_1.ingestFileSystem)(FIXTURE_ROOT);
+        const ignored = files.find((f) => f.path.endsWith("ignored.ts"));
+        expect(ignored).toBeUndefined();
+    });
+    it("ingests a single file when the path is a supported source file", async () => {
+        const tfPath = path_1.default.resolve(__dirname, "../../fixtures/terraform-basic/main.tf");
+        const files = await (0, file_system_1.ingestFileSystem)(tfPath);
+        expect(files).toHaveLength(1);
+        expect(files[0]?.path).toBe("main.tf");
+        expect(files[0]?.language).toBe("terraform");
+        expect(files[0]?.content).toContain("resource");
+    });
+    it("skips a single .env file path with a security warning", async () => {
+        const tempRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-cli-ingest-env-"));
+        const warnings = [];
+        try {
+            const envPath = path_1.default.join(tempRoot, ".env");
+            fs_1.default.writeFileSync(envPath, "SECRET=x", "utf8");
+            const files = await (0, file_system_1.ingestFileSystem)(envPath, {
+                onWarning: (w) => warnings.push(w),
+            });
+            expect(files).toHaveLength(0);
+            expect(warnings.some((w) => w.includes("excluded for security"))).toBe(true);
+        }
+        finally {
+            fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    it("resolveScanFilesystemEntry maps a file to its parent directory", async () => {
+        const tfPath = path_1.default.resolve(__dirname, "../../fixtures/terraform-basic/main.tf");
+        const dir = path_1.default.dirname(tfPath);
+        const entry = await (0, file_system_1.resolveScanFilesystemEntry)(tfPath);
+        expect(entry.scanRootDir).toBe(dir);
+        expect(entry.ingestTarget).toBe(tfPath);
+        const dirEntry = await (0, file_system_1.resolveScanFilesystemEntry)(dir);
+        expect(dirEntry.scanRootDir).toBe(dir);
+        expect(dirEntry.ingestTarget).toBe(dir);
+    });
+});

package/dist/tests/unit/ingest/gitignore.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/ingest/gitignore.spec.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const file_system_1 = require("../../../src/ingest/file-system");
+describe("ingest/gitignore", () => {
+    it("skips paths matched by test-project-scan/* at any depth", async () => {
+        const tempRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-cli-gitignore-scan-"));
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, ".gitignore"), "test-project-scan/*\n", "utf8");
+            fs_1.default.mkdirSync(path_1.default.join(tempRoot, "test-project-scan", "app", "src"), {
+                recursive: true,
+            });
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "test-project-scan", "app", "src", "index.ts"), "export const x = 1;\n", "utf8");
+            fs_1.default.mkdirSync(path_1.default.join(tempRoot, "included"), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "included", "index.ts"), "export const y = 2;\n", "utf8");
+            const files = await (0, file_system_1.ingestFileSystem)(tempRoot);
+            const paths = files.map((f) => f.path);
+            expect(paths).toContain("included/index.ts");
+            expect(paths.some((p) => p.startsWith("test-project-scan/"))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/unit/observability/scan-sentry.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/observability/scan-sentry.spec.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const mockCaptureException = jest.fn();
+const mockFlush = jest.fn().mockResolvedValue(true);
+const mockWithScope = jest.fn((cb) => {
+    cb({
+        setTag: jest.fn(),
+        setExtra: jest.fn(),
+        setExtras: jest.fn(),
+    });
+});
+const mockInit = jest.fn();
+jest.mock("@sentry/node", () => ({
+    init: mockInit,
+    captureException: mockCaptureException,
+    flush: mockFlush,
+    withScope: mockWithScope,
+}));
+const scan_sentry_1 = require("../../../src/observability/scan-sentry");
+describe("scan-sentry", () => {
+    const originalEnv = process.env;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        (0, scan_sentry_1.resetCliSentryForTests)();
+        process.env = { ...originalEnv };
+        delete process.env.SCAN_SENTRY_ENABLED;
+        delete process.env.SENTRY_DSN;
+        delete process.env.SENTRY_ENVIRONMENT;
+    });
+    afterAll(() => {
+        process.env = originalEnv;
+        (0, scan_sentry_1.resetCliSentryForTests)();
+    });
+    it("reports scan errors with cli tags when enabled", async () => {
+        process.env.SENTRY_DSN = "https://example@sentry.io/1";
+        await (0, scan_sentry_1.reportScanCliError)({
+            error: new Error("scan blew up"),
+            scanRoot: "/tmp/proj",
+            jobId: "job-1",
+            aiMode: "byok",
+            aiProvider: "openai",
+            failurePhase: "scan_pipeline",
+            failureCode: "scan_errors",
+        });
+        expect(mockInit).toHaveBeenCalled();
+        expect(mockCaptureException).toHaveBeenCalledWith(expect.any(Error));
+        expect(mockFlush).toHaveBeenCalled();
+    });
+    it("is a no-op when SCAN_SENTRY_ENABLED=false", async () => {
+        process.env.SCAN_SENTRY_ENABLED = "false";
+        process.env.SENTRY_DSN = "https://example@sentry.io/1";
+        await (0, scan_sentry_1.reportScanCliError)({ error: new Error("ignored") });
+        expect(mockInit).not.toHaveBeenCalled();
+        expect(mockCaptureException).not.toHaveBeenCalled();
+    });
+    it("flushCliSentry does nothing when never initialized", async () => {
+        await (0, scan_sentry_1.flushCliSentry)();
+        expect(mockFlush).not.toHaveBeenCalled();
+    });
+});

package/dist/tests/unit/patterns/scan-exclusions.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/patterns/scan-exclusions.spec.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const scan_exclusions_1 = require("../../../src/patterns/scan-exclusions");
+const file_system_1 = require("../../../src/ingest/file-system");
+describe("patterns/scan-exclusions", () => {
+    it("skips __stories__ and storybook-static directory names", () => {
+        expect((0, scan_exclusions_1.shouldSkipDirectoryName)("__stories__")).toBe(true);
+        expect((0, scan_exclusions_1.shouldSkipDirectoryName)("storybook-static")).toBe(true);
+        expect((0, scan_exclusions_1.shouldSkipDirectoryName)("__tests__")).toBe(true);
+        expect((0, scan_exclusions_1.shouldSkipDirectoryName)("src")).toBe(false);
+    });
+    it("skips .storybook as a hidden directory", () => {
+        expect((0, scan_exclusions_1.shouldSkipDirectoryName)(".storybook")).toBe(true);
+    });
+    it("excludes Storybook story files via default file globs", async () => {
+        const tempRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-cli-stories-"));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(tempRoot, "src"), { recursive: true });
+            fs_1.default.mkdirSync(path_1.default.join(tempRoot, "__stories__"), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "src", "app.ts"), "export {};\n", "utf8");
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "Button.stories.tsx"), "export default {};\n", "utf8");
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "__stories__", "Demo.stories.tsx"), "export default {};\n", "utf8");
+            const files = await (0, file_system_1.ingestFileSystem)(tempRoot, {
+                excludePaths: [...scan_exclusions_1.DEFAULT_EXCLUDED_FILE_GLOBS],
+                maxFileCount: 100,
+            });
+            const paths = files.map((f) => f.path);
+            expect(paths).toContain("src/app.ts");
+            expect(paths).not.toContain("Button.stories.tsx");
+            expect(paths.some((p) => p.includes("__stories__"))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    it("skips __stories__ directories even without explicit file globs", async () => {
+        const tempRoot = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "dp-cli-stories-dir-"));
+        try {
+            fs_1.default.mkdirSync(path_1.default.join(tempRoot, "src"), { recursive: true });
+            fs_1.default.mkdirSync(path_1.default.join(tempRoot, "__stories__"), { recursive: true });
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "src", "app.ts"), "export {};\n", "utf8");
+            fs_1.default.writeFileSync(path_1.default.join(tempRoot, "__stories__", "only-in-stories.ts"), "export {};\n", "utf8");
+            const files = await (0, file_system_1.ingestFileSystem)(tempRoot, { maxFileCount: 100 });
+            const paths = files.map((f) => f.path);
+            expect(paths).toContain("src/app.ts");
+            expect(paths.some((p) => p.includes("__stories__"))).toBe(false);
+        }
+        finally {
+            fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+});

package/dist/tests/unit/pipeline/ai-orchestrator-options.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/pipeline/ai-orchestrator-options.spec.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ai_orchestrator_options_1 = require("../../../src/core/pipeline/ai-orchestrator-options");
+describe("buildAgentOrchestratorOptions", () => {
+    it("forces providerConcurrency=1 for platform-billed scans", () => {
+        const config = {
+            enableAiInference: true,
+            workspaceApiKey: "dp_test_key",
+            cliQuotaJobId: "job-1",
+            aiProviderConcurrency: 4,
+        };
+        const options = (0, ai_orchestrator_options_1.buildAgentOrchestratorOptions)(config, {
+            llmEnabled: true,
+            skipStructuralHeuristics: false,
+        });
+        expect(options.platformProxy).toBeDefined();
+        expect(options.providerConcurrency).toBe(1);
+    });
+});

package/dist/tests/unit/platform-api/dataparade-api-base-url.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/platform-api/dataparade-api-base-url.spec.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const dataparade_api_base_url_1 = require("../../../src/platform-api/dataparade-api-base-url");
+describe("getDataparadeApiBaseUrl", () => {
+    it("defaults to production AWS API when unset", () => {
+        expect((0, dataparade_api_base_url_1.getDataparadeApiBaseUrl)({})).toBe(dataparade_api_base_url_1.DEFAULT_DATAPARADE_API_BASE_URL);
+    });
+    it("prefers DATAPARADE_API_BASE_URL over legacy DATAPARADE_API_URL", () => {
+        expect((0, dataparade_api_base_url_1.getDataparadeApiBaseUrl)({
+            DATAPARADE_API_BASE_URL: "http://localhost:3000/",
+            DATAPARADE_API_URL: "https://other.example.com",
+        })).toBe("http://localhost:3000");
+    });
+    it("strips trailing slash", () => {
+        expect((0, dataparade_api_base_url_1.getDataparadeApiBaseUrl)({
+            DATAPARADE_API_URL: "https://api.example.com/",
+        })).toBe("https://api.example.com");
+    });
+});

package/dist/tests/unit/platform-api/estimate-scan-footprint.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/platform-api/estimate-scan-footprint.spec.js

@@ -0,0 +1,50 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const estimate_scan_footprint_1 = require("../../../src/platform-api/estimate-scan-footprint");
+describe("estimateScanFootprint", () => {
+    it("counts files and bytes under scan root", async () => {
+        const root = await fs.promises.mkdtemp(path.join(os.tmpdir(), "dp-footprint-"));
+        await fs.promises.writeFile(path.join(root, "a.ts"), "hello");
+        await fs.promises.mkdir(path.join(root, "node_modules"), { recursive: true });
+        await fs.promises.writeFile(path.join(root, "node_modules", "skip.js"), "ignored");
+        const footprint = await (0, estimate_scan_footprint_1.estimateScanFootprint)(root);
+        expect(footprint.fileCount).toBeGreaterThanOrEqual(1);
+        expect(footprint.bytesIngested).toBeGreaterThanOrEqual(5);
+    });
+});

package/dist/tests/unit/tracing/langsmith-tracing.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/tracing/langsmith-tracing.spec.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const langsmith_tracing_1 = require("../../../src/tracing/langsmith-tracing");
+describe("tracing/langsmith-tracing", () => {
+    const originalEnv = process.env;
+    beforeEach(() => {
+        process.env = { ...originalEnv };
+        delete process.env.LANGSMITH_API_KEY;
+        delete process.env.LANGCHAIN_API_KEY;
+        delete process.env.LANGCHAIN_TRACING_V2;
+        delete process.env.LANGSMITH_TRACING;
+    });
+    afterAll(() => {
+        process.env = originalEnv;
+    });
+    it("isLangSmithTracingEnabled requires key and tracing flag", () => {
+        expect((0, langsmith_tracing_1.isLangSmithTracingEnabled)()).toBe(false);
+        process.env.LANGSMITH_API_KEY = "test-key";
+        expect((0, langsmith_tracing_1.isLangSmithTracingEnabled)()).toBe(false);
+        process.env.LANGCHAIN_TRACING_V2 = "true";
+        expect((0, langsmith_tracing_1.isLangSmithTracingEnabled)()).toBe(true);
+    });
+    it("buildLangSmithScanTraceSummary omits full component payloads", () => {
+        const result = {
+            files: [],
+            findings: [{ pattern: "x", name: "n", confidence: 1, properties: {} }],
+            scanResult: {
+                components: [
+                    {
+                        id: "cmp_1",
+                        name: "Payments API",
+                        type: "asset",
+                        confidence: 0.9,
+                        detectedFrom: [],
+                        sourceLocations: [],
+                        properties: { section_id: "packages/server" },
+                    },
+                ],
+                dataFlows: [],
+                filesScanned: 42,
+                filesSkipped: 1,
+                totalLines: 100,
+                scanDurationMs: 500,
+                warnings: ["w1"],
+                errors: [],
+                aiInferenceSummary: {
+                    ran: true,
+                    candidatesConsidered: 3,
+                    proposalsGenerated: 2,
+                    proposalsApplied: 1,
+                    proposalsRejected: 1,
+                    proposalsGeneratedHeuristic: 1,
+                    proposalsAppliedHeuristic: 1,
+                    proposalsGeneratedProvider: 1,
+                    proposalsAppliedProvider: 0,
+                    providerCalls: 1,
+                    inputTokens: 10,
+                    outputTokens: 5,
+                    totalTokens: 15,
+                    aiProvider: "mock",
+                    aiModel: "heuristic",
+                },
+            },
+        };
+        const summary = (0, langsmith_tracing_1.buildLangSmithScanTraceSummary)(result);
+        expect(summary.filesScanned).toBe(42);
+        expect(summary.componentCount).toBe(1);
+        expect(summary.findingCount).toBe(1);
+        expect(summary.sectionIds).toEqual(["packages/server"]);
+        expect(summary).not.toHaveProperty("components");
+        expect(summary.aiInference.proposalsGenerated).toBe(2);
+    });
+    it("buildLangSmithInferencePipelineTraceSummary summarizes pipeline output", () => {
+        const summary = (0, langsmith_tracing_1.buildLangSmithInferencePipelineTraceSummary)({
+            candidates: [{ id: "c1" }],
+            plan: { queues: [], droppedCandidates: [] },
+            proposals: [{ id: "p1", proposal: {} }],
+            mergeResult: {
+                components: [],
+                dataFlows: [],
+                appliedProposalIds: ["p1"],
+                rejectedProposalIds: [],
+                provenanceByTarget: {},
+            },
+            usageSummary: {
+                providerCalls: 2,
+                inputTokens: 100,
+                outputTokens: 50,
+                totalTokens: 150,
+            },
+        });
+        expect(summary.candidateCount).toBe(1);
+        expect(summary.proposalCount).toBe(1);
+        expect(summary.appliedProposalCount).toBe(1);
+        expect(summary.usageSummary).toEqual(expect.objectContaining({ providerCalls: 2, totalTokens: 150 }));
+    });
+    it("buildLangSmithAiInferenceTraceSummary copies summary counters", () => {
+        const summary = (0, langsmith_tracing_1.buildLangSmithAiInferenceTraceSummary)({
+            ran: true,
+            candidatesConsidered: 5,
+            proposalsGenerated: 4,
+            proposalsApplied: 2,
+            proposalsRejected: 2,
+            proposalsGeneratedHeuristic: 2,
+            proposalsAppliedHeuristic: 1,
+            proposalsGeneratedProvider: 2,
+            proposalsAppliedProvider: 1,
+            providerCalls: 2,
+            inputTokens: 20,
+            outputTokens: 10,
+            totalTokens: 30,
+            aiProvider: "openai",
+            aiModel: "gpt-4",
+        });
+        expect(summary.proposalsGenerated).toBe(4);
+        expect(summary.aiProvider).toBe("openai");
+    });
+});

package/package.json

@@ -0,0 +1,84 @@
+{
+  "name": "@dataparade/cli",
+  "version": "0.0.1",
+  "description": "dataPARADE CLI — scan codebases for privacy and security data flows",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "license": "GPL-3.0-or-later",
+  "author": "DataParade",
+  "homepage": "https://github.com/DataParade-io/dataparade-cli#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DataParade-io/dataparade-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/DataParade-io/dataparade-cli/issues"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "dataparade",
+    "privacy",
+    "data-flow",
+    "security",
+    "cli",
+    "scanner"
+  ],
+  "private": false,
+  "main": "dist/src/index.js",
+  "types": "dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    },
+    "./ai-providers": {
+      "types": "./dist/src/ai-enrichment/providers/index.d.ts",
+      "default": "./dist/src/ai-enrichment/providers/index.js"
+    }
+  },
+  "bin": {
+    "@dataparade/cli": "dist/bin/cli.js"
+  },
+  "scripts": {
+    "generate:terraform-provider-hints": "node scripts/generate-terraform-provider-hints.mjs",
+    "generate:aws-terraform-hints": "node scripts/generate-aws-terraform-hints.mjs",
+    "generate:azure-terraform-hints": "node scripts/generate-terraform-provider-hints.mjs --azure-only",
+    "generate:kubernetes-terraform-hints": "node scripts/generate-terraform-provider-hints.mjs --kubernetes-only",
+    "build": "pnpm exec tsc -p tsconfig.json",
+    "prepublishOnly": "pnpm run build && pnpm run test",
+    "lint": "eslint \"src/**/*.ts\" \"tests/**/*.ts\"",
+    "pretest": "pnpm run build",
+    "test": "jest",
+    "scan": "node dist/bin/cli.js scan",
+    "eval:models": "pnpm exec node dist/src/evals/run-model-matrix.js"
+  },
+  "dependencies": {
+    "@sentry/node": "^10.38.0",
+    "dotenv": "^16.4.7",
+    "langsmith": "^0.3.14",
+    "commander": "^12.1.0",
+    "yaml": "^2.8.2",
+    "zod": "^4.3.5"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.18.0",
+    "@types/jest": "^29.5.14",
+    "@types/node": "^22.0.0",
+    "eslint": "^9.18.0",
+    "globals": "^15.14.0",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.2.5",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.20.0"
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md",
+    "package.json"
+  ]
+}