@dataparade/cli 0.0.2 → 0.0.4

package/README.md

@@ -86,6 +86,30 @@ node dist/bin/cli.js scan path/to/your/project
 
 ---
 
+## Upload to dashboard
+
+After a scan, the CLI **auto-uploads** `dataflow.json` when `DATAPARADE_WORKSPACE_API_KEY` is set (from **Workspace → Access keys**). This creates an **import preview draft** in the web app — not a finished assessment. Open the printed URL to review and edit before creating the diagram.
+
+- Opt out: `--skip-auto-upload` or `DATAPARADE_SKIP_AUTO_UPLOAD=true`
+- Without a workspace key, the scan still succeeds; the CLI suggests running `upload` later
+- Upload alone does **not** consume scan quota (platform AI scans still use preflight/complete as before)
+
+```bash
+# Upload an existing file
+node dist/bin/cli.js upload ./dataflow.json --project-name "My service"
+```
+
+Environment:
+
+| Variable | Purpose |
+|----------|---------|
+| `DATAPARADE_WORKSPACE_API_KEY` | Auth for upload (same key as platform AI) |
+| `DATAPARADE_API_BASE_URL` | Backend API (default: production AWS) |
+| `DATAPARADE_APP_URL` | Frontend base for preview links (default: production app) |
+| `DATAPARADE_SKIP_AUTO_UPLOAD` | Skip post-scan upload when `true`/`1` |
+
+---
+
 ## Output: `dataflow.json`
 
 By default (no `--output` flag), the CLI writes `./dataflow.json` in the current working directory.
@@ -112,6 +136,7 @@ The CLI emits **all** Engineering, Privacy, and Security property keys (from the
 - Database: `connection_encryption`, `backup_frequency`, `audit_logging_enabled`, etc. when patterns match.
 - Auth: `mfa_required`, `authentication_method`, `sso_integration` from auth middleware patterns.
 - Routes: `request_validation`, `api_type`, `https_enforced` for route patterns.
+- Data flow edges (graph mapping): `engineering.protocol` is set to `rest` or `graphql` for `api_call` flows when the endpoint, method, or source code indicates HTTP REST vs GraphQL (see `infer-data-flow-protocol.ts`). Pattern rules in `property.patterns.yaml` also set `api_type` to `graphql` for `/graphql` URLs and paths.
 
 **Terraform / IaC (`.tf` / `.tfvars`):**
 

package/dist/package.json

@@ -0,0 +1,85 @@
+{
+    "name": "@dataparade/cli",
+    "version": "0.0.4",
+    "description": "dataPARADE CLI — scan codebases for privacy and security data flows",
+    "publishConfig": {
+        "access": "public",
+        "registry": "https://registry.npmjs.org/"
+    },
+    "license": "GPL-3.0-or-later",
+    "author": "DataParade",
+    "homepage": "https://github.com/DataParade-io/dataparade-cli#readme",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/DataParade-io/dataparade-cli.git"
+    },
+    "bugs": {
+        "url": "https://github.com/DataParade-io/dataparade-cli/issues"
+    },
+    "engines": {
+        "node": ">=20"
+    },
+    "keywords": [
+        "dataparade",
+        "privacy",
+        "data-flow",
+        "security",
+        "cli",
+        "scanner"
+    ],
+    "private": false,
+    "main": "dist/src/index.js",
+    "types": "dist/src/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/src/index.d.ts",
+            "default": "./dist/src/index.js"
+        },
+        "./ai-providers": {
+            "types": "./dist/src/ai-enrichment/providers/index.d.ts",
+            "default": "./dist/src/ai-enrichment/providers/index.js"
+        }
+    },
+    "bin": {
+        "@dataparade/cli": "dist/bin/cli.js"
+    },
+    "scripts": {
+        "generate:terraform-provider-hints": "node scripts/generate-terraform-provider-hints.mjs",
+        "generate:aws-terraform-hints": "node scripts/generate-aws-terraform-hints.mjs",
+        "generate:azure-terraform-hints": "node scripts/generate-terraform-provider-hints.mjs --azure-only",
+        "generate:kubernetes-terraform-hints": "node scripts/generate-terraform-provider-hints.mjs --kubernetes-only",
+        "build": "pnpm exec tsc -p tsconfig.json",
+        "prepublishOnly": "pnpm run build && pnpm run test",
+        "lint": "eslint \"src/**/*.ts\" \"tests/**/*.ts\"",
+        "pretest": "pnpm run build",
+        "test": "jest",
+        "scan": "node dist/bin/cli.js scan",
+        "eval:models": "pnpm exec node dist/src/evals/run-model-matrix.js"
+    },
+    "dependencies": {
+        "@sentry/node": "^10.38.0",
+        "commander": "^12.1.0",
+        "dotenv": "^16.4.7",
+        "langsmith": "^0.3.14",
+        "typescript": "^5.7.3",
+        "yaml": "^2.8.2",
+        "zod": "^4.3.5"
+    },
+    "devDependencies": {
+        "@eslint/js": "^9.18.0",
+        "@types/jest": "^29.5.14",
+        "@types/node": "^22.0.0",
+        "eslint": "^9.18.0",
+        "globals": "^15.14.0",
+        "jest": "^29.7.0",
+        "ts-jest": "^29.2.5",
+        "typescript-eslint": "^8.20.0"
+    },
+    "files": [
+        "dist",
+        "patterns",
+        "LICENSE",
+        "README.md",
+        "package.json"
+    ]
+}

package/dist/src/ai-enrichment/agent-orchestrator.d.ts

@@ -18,6 +18,8 @@ export interface AgentOrchestratorOptions {
     skipStructuralHeuristics?: boolean;
     /** Platform-billed LLM via DataParade API proxy. */
     platformProxy?: PlatformProxyProviderConfig;
+    /** Hosted scan in VPC worker: loopback proxy → scan-cli-ai-helper Lambda. */
+    hostedWorkerInferProxyUrl?: string;
 }
 export declare function generateAgenticProposals(input: RunInferencePipelineInput, plan: InferencePlannerResult, candidates: AiInferenceCandidate[], options: AgentOrchestratorOptions): Promise<{
     proposals: Array<{

package/dist/src/ai-enrichment/agent-orchestrator.js

@@ -10,6 +10,7 @@ const third_party_evidence_1 = require("./third-party-evidence");
 const provider_contract_1 = require("./providers/provider-contract");
 const scan_paths_1 = require("./scan-paths");
 const platform_proxy_provider_1 = require("./providers/platform-proxy-provider");
+const hosted_worker_infer_provider_1 = require("./providers/hosted-worker-infer-provider");
 const PROPERTY_AGENT_SLICE_SIZE = 12;
 const TP_AGENT_MAX_ROUNDS = 3;
 const TP_AGENT_MAX_FILES = 8;
@@ -156,11 +157,13 @@ async function generateAgenticProposals(input, plan, candidates, options) {
     const skipStructural = options.skipStructuralHeuristics === true;
     const provider = options.platformProxy
         ? new platform_proxy_provider_1.PlatformProxyProvider(options.platformProxy)
-        : (0, providers_1.createAiProvider)(options.provider, {
-            endpoint: options.endpoint,
-            model: options.model,
-            apiKey: options.apiKey,
-        });
+        : options.hostedWorkerInferProxyUrl?.trim()
+            ? new hosted_worker_infer_provider_1.HostedWorkerInferProvider(options.hostedWorkerInferProxyUrl.trim())
+            : (0, providers_1.createAiProvider)(options.provider, {
+                endpoint: options.endpoint,
+                model: options.model,
+                apiKey: options.apiKey,
+            });
     const generated = [];
     const agenticTrace = [];
     const aggregateUsage = {

package/dist/src/ai-enrichment/providers/hosted-worker-infer-provider.d.ts

@@ -0,0 +1,10 @@
+import type { AiProvider, AiProviderRequest, AiProviderResult } from "./types";
+/**
+ * Sync infer via the scan worker's loopback proxy (VPC → scan-cli-ai-helper Lambda).
+ */
+export declare class HostedWorkerInferProvider implements AiProvider {
+    private readonly inferUrl;
+    readonly id: "openai";
+    constructor(inferUrl: string);
+    infer(request: AiProviderRequest): Promise<AiProviderResult>;
+}

package/dist/src/ai-enrichment/providers/hosted-worker-infer-provider.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostedWorkerInferProvider = void 0;
+/**
+ * Sync infer via the scan worker's loopback proxy (VPC → scan-cli-ai-helper Lambda).
+ */
+class HostedWorkerInferProvider {
+    constructor(inferUrl) {
+        this.inferUrl = inferUrl;
+        this.id = "openai";
+    }
+    async infer(request) {
+        const res = await fetch(this.inferUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                prompt: request.prompt,
+                maxTokens: request.maxTokens,
+                temperature: request.temperature,
+            }),
+        });
+        let body;
+        try {
+            body = (await res.json());
+        }
+        catch {
+            throw new Error(`Hosted scan AI infer failed (${res.status})`);
+        }
+        if (!res.ok) {
+            throw new Error(body.error?.trim() ||
+                `Hosted scan AI infer failed (${res.status})`);
+        }
+        const proposals = (Array.isArray(body.proposals) ? body.proposals : []);
+        const usage = body.usage;
+        return {
+            proposals,
+            usage: usage && typeof usage.totalTokens === "number"
+                ? {
+                    inputTokens: Math.max(0, usage.inputTokens ?? 0),
+                    outputTokens: Math.max(0, usage.outputTokens ?? 0),
+                    totalTokens: Math.max(0, usage.totalTokens),
+                }
+                : undefined,
+        };
+    }
+}
+exports.HostedWorkerInferProvider = HostedWorkerInferProvider;

package/dist/src/cli.js

@@ -40,7 +40,9 @@ exports.run = run;
 require("./config/load-cli-env");
 const path_1 = __importDefault(require("path"));
 const commander_1 = require("commander");
+const package_json_1 = __importDefault(require("../package.json"));
 const json_1 = require("./output/json");
+const upload_env_1 = require("./config/upload-env");
 const types_1 = require("./ai-enrichment/types");
 const inference_scope_1 = require("./config/inference-scope");
 const redact_1 = require("./config/redact");
@@ -112,7 +114,7 @@ function createProgram() {
     program
         .name("dataparade")
         .description("DataParade CLI - scan codebases for data flow components")
-        .version("0.0.0");
+        .version(package_json_1.default.version);
     program
         .command("scan <path>")
         .description("Scan a directory (or a single supported source file) for data flow components")
@@ -143,6 +145,7 @@ function createProgram() {
         .option("--api-key <key>", "(deprecated) alias for --workspace-api-key")
         .option("--byok-provider <provider>", `BYOK LLM provider when using your own API key: ${types_1.AI_PROVIDER_IDS.join("|")}`)
         .option("--byok-model <model>", "BYOK model name (env: SCAN_BYOK_MODEL)")
+        .option("--skip-auto-upload", "Do not upload dataflow.json to the dashboard after scan (env: DATAPARADE_SKIP_AUTO_UPLOAD)")
         .action(async (path, options) => {
         let cliQuotaJobId;
         let platformQuotaApiKey;
@@ -378,6 +381,35 @@ function createProgram() {
                     // tests can rely on it.
                     // eslint-disable-next-line no-console
                     console.log(`[scan] dataflow.json written to ${dataflowOutputPath}`);
+                    const skipAutoUpload = Boolean(options.skipAutoUpload) ||
+                        (0, upload_env_1.resolveSkipAutoUpload)(process.env);
+                    if (!skipAutoUpload) {
+                        const uploadApiKey = workspaceApiKey;
+                        if (!uploadApiKey) {
+                            // eslint-disable-next-line no-console
+                            console.log(`[scan] Auto-upload skipped (no workspace API key). Run: dataparade upload ${dataflowOutputPath}`);
+                        }
+                        else {
+                            try {
+                                const { runDataflowUpload } = await Promise.resolve().then(() => __importStar(require("./upload/run-upload")));
+                                const dataflowWrapper = (0, json_1.buildDataflowWrapper)(scanResult, diagramGraph);
+                                await runDataflowUpload({
+                                    apiKey: uploadApiKey,
+                                    dataflow: dataflowWrapper,
+                                    projectName: config.projectName,
+                                    scanJobId: cliQuotaJobId,
+                                    logPrefix: "[scan]",
+                                });
+                            }
+                            catch (uploadError) {
+                                const uploadMessage = uploadError instanceof Error
+                                    ? uploadError.message
+                                    : "Unknown upload error.";
+                                // eslint-disable-next-line no-console
+                                console.error(`[scan] Auto-upload failed: ${uploadMessage}`);
+                            }
+                        }
+                    }
                 }
                 catch (dataflowError) {
                     await (0, scan_sentry_1.reportScanCliError)({
@@ -453,6 +485,58 @@ function createProgram() {
             }
         }
     });
+    program
+        .command("upload <file>")
+        .description("Upload a dataflow.json file to the dashboard as an import preview")
+        .option("--project-name <name>", "Assessment name shown in the preview (default: from file metadata if present)")
+        .option("--workspace-api-key <key>", "DataParade workspace API key (env: DATAPARADE_WORKSPACE_API_KEY)")
+        .option("--api-key <key>", "(deprecated) alias for --workspace-api-key")
+        .action(async (file, options) => {
+        const apiKey = options.workspaceApiKey?.trim() ||
+            options.apiKey?.trim() ||
+            (0, scan_env_1.resolveWorkspaceApiKey)(process.env);
+        if (!apiKey) {
+            // eslint-disable-next-line no-console
+            console.error("[upload] error: workspace API key is required (DATAPARADE_WORKSPACE_API_KEY or --workspace-api-key)");
+            process.exitCode = 1;
+            return;
+        }
+        const filePath = path_1.default.resolve(process.cwd(), file || "dataflow.json");
+        let dataflow;
+        try {
+            const { readFileSync } = await Promise.resolve().then(() => __importStar(require("fs")));
+            dataflow = JSON.parse(readFileSync(filePath, "utf8"));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to read dataflow.json";
+            // eslint-disable-next-line no-console
+            console.error(`[upload] error: ${message}`);
+            process.exitCode = 1;
+            return;
+        }
+        let projectName = options.projectName?.trim();
+        if (!projectName && dataflow && typeof dataflow === "object") {
+            const meta = dataflow
+                .metadata;
+            if (typeof meta?.projectName === "string" && meta.projectName.trim()) {
+                projectName = meta.projectName.trim();
+            }
+        }
+        try {
+            const { runDataflowUpload } = await Promise.resolve().then(() => __importStar(require("./upload/run-upload")));
+            await runDataflowUpload({
+                apiKey,
+                dataflow,
+                projectName,
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Upload failed.";
+            // eslint-disable-next-line no-console
+            console.error(`[upload] error: ${message}`);
+            process.exitCode = 1;
+        }
+    });
     program
         .command("config")
         .description("View the effective configuration for the current project")

package/dist/src/config/env.js

@@ -50,6 +50,7 @@ function loadCliConfigEnv(env) {
     const aiToolLoopMaxSearches = parseNumber(env.SCAN_AI_TOOL_LOOP_MAX_SEARCHES);
     const aiThirdPartyDataFlowEnabled = parseBoolean(env.SCAN_AI_THIRD_PARTY_DATA_FLOW);
     const workspaceApiKey = (0, scan_env_1.resolveWorkspaceApiKey)(env);
+    const hostedInferProxyUrl = (0, scan_env_1.resolveHostedInferProxyUrl)(env);
     return {
         excludePaths,
         minimumConfidence,
@@ -71,5 +72,6 @@ function loadCliConfigEnv(env) {
         aiToolLoopMaxSearches,
         aiThirdPartyDataFlowEnabled,
         workspaceApiKey: workspaceApiKey || undefined,
+        hostedInferProxyUrl: hostedInferProxyUrl || undefined,
     };
 }

package/dist/src/config/resolve.js

@@ -283,6 +283,9 @@ function resolveScanConfiguration(options) {
     if (envConfig.workspaceApiKey) {
         overrides.workspaceApiKey = envConfig.workspaceApiKey;
     }
+    if (envConfig.hostedInferProxyUrl) {
+        overrides.hostedInferProxyUrl = envConfig.hostedInferProxyUrl;
+    }
     if (envConfig.aiModel) {
         overrides.aiModel = envConfig.aiModel;
     }

package/dist/src/config/scan-env.d.ts

@@ -3,5 +3,6 @@ export declare function resolveByokApiKey(env: NodeJS.ProcessEnv): string | unde
 export declare function resolveByokProvider(env: NodeJS.ProcessEnv): string | undefined;
 export declare function resolveByokModel(env: NodeJS.ProcessEnv): string | undefined;
 export declare function resolveScanAiInference(env: NodeJS.ProcessEnv): string | undefined;
+export declare function resolveHostedInferProxyUrl(env: NodeJS.ProcessEnv): string | undefined;
 /** Extra provider HTTP / normalization logging (all providers, not OpenAI-only). */
 export declare function isScanAiDebugEnabled(env?: NodeJS.ProcessEnv): boolean;

package/dist/src/config/scan-env.js

@@ -5,6 +5,7 @@ exports.resolveByokApiKey = resolveByokApiKey;
 exports.resolveByokProvider = resolveByokProvider;
 exports.resolveByokModel = resolveByokModel;
 exports.resolveScanAiInference = resolveScanAiInference;
+exports.resolveHostedInferProxyUrl = resolveHostedInferProxyUrl;
 exports.isScanAiDebugEnabled = isScanAiDebugEnabled;
 function resolveWorkspaceApiKey(env) {
     const value = env.DATAPARADE_WORKSPACE_API_KEY?.trim();
@@ -26,6 +27,10 @@ function resolveScanAiInference(env) {
     const value = env.SCAN_AI_INFERENCE?.trim();
     return value || undefined;
 }
+function resolveHostedInferProxyUrl(env) {
+    const value = env.SCAN_HOSTED_INFER_PROXY_URL?.trim();
+    return value || undefined;
+}
 function parseTruthyEnvFlag(value) {
     if (!value)
         return false;

package/dist/src/config/types.d.ts

@@ -55,6 +55,7 @@ export interface CliConfigEnv {
     aiToolLoopMaxSearches?: number;
     aiThirdPartyDataFlowEnabled?: boolean;
     workspaceApiKey?: string;
+    hostedInferProxyUrl?: string;
 }
 export interface CliConfigFlags {
     exclude?: string[];

package/dist/src/config/upload-env.d.ts

@@ -0,0 +1 @@
+export declare function resolveSkipAutoUpload(env: NodeJS.ProcessEnv): boolean;

package/dist/src/config/upload-env.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSkipAutoUpload = resolveSkipAutoUpload;
+const TRUTHY = new Set(["1", "true", "yes", "on"]);
+function resolveSkipAutoUpload(env) {
+    const value = env.DATAPARADE_SKIP_AUTO_UPLOAD?.trim().toLowerCase();
+    if (!value)
+        return false;
+    return TRUTHY.has(value);
+}

package/dist/src/config/validate-scan-ai.d.ts

@@ -1,3 +1,3 @@
 import type { ScanConfiguration } from "../core/types";
 export declare function validateAiInferenceCredentials(config: ScanConfiguration): string[];
-export declare function resolveAiMode(config: ScanConfiguration): "byok" | "platform" | "none";
+export declare function resolveAiMode(config: ScanConfiguration): "byok" | "platform" | "hosted_worker" | "none";

package/dist/src/config/validate-scan-ai.js

@@ -6,6 +6,9 @@ function validateAiInferenceCredentials(config) {
     const errors = [];
     if (!config.enableAiInference)
         return errors;
+    if (config.hostedInferProxyUrl?.trim()) {
+        return errors;
+    }
     const hasByok = Boolean(config.aiProvider?.trim()) &&
         Boolean(config.aiModel?.trim()) &&
         Boolean(config.aiApiKey?.trim());
@@ -25,6 +28,8 @@ function validateAiInferenceCredentials(config) {
 function resolveAiMode(config) {
     if (!config.enableAiInference)
         return "none";
+    if (config.hostedInferProxyUrl?.trim())
+        return "hosted_worker";
     if (config.aiApiKey?.trim())
         return "byok";
     if (config.workspaceApiKey?.trim())

package/dist/src/core/pipeline/ai-orchestrator-options.js

@@ -42,5 +42,10 @@ function buildAgentOrchestratorOptions(config, opts) {
         // the helper succeeds (client sees 503 "Service Unavailable").
         base.providerConcurrency = 1;
     }
+    if (aiMode === "hosted_worker" && config.hostedInferProxyUrl?.trim()) {
+        base.hostedWorkerInferProxyUrl = config.hostedInferProxyUrl.trim();
+        base.apiKey = undefined;
+        base.providerConcurrency = 1;
+    }
     return base;
 }

package/dist/src/core/pipeline/graph-mapping.js

@@ -10,6 +10,7 @@ const minimal_terraform_layout_1 = require("./diagram-layout/minimal-terraform-l
 const section_helpers_1 = require("./diagram-layout/section-helpers");
 const terraform_lane_layout_1 = require("./diagram-layout/terraform-lane-layout");
 const terraform_minimal_services_1 = require("./terraform-minimal-services");
+const infer_data_flow_protocol_1 = require("./infer-data-flow-protocol");
 function stripCodeFromSourceLocation(loc) {
     if (!loc)
         return undefined;
@@ -157,6 +158,10 @@ function mapDataFlowToEdge(flow, componentsById) {
     if (flow.actions && flow.actions.length > 0) {
         engineering.actions = flow.actions;
     }
+    const protocol = (0, infer_data_flow_protocol_1.inferDataFlowProtocol)(flow);
+    if (protocol) {
+        engineering.protocol = protocol;
+    }
     const privacy = {
         dataCategories: flow.dataCategories ?? [],
         dataSubjectCategories: flow.dataSubjectCategories,

package/dist/src/core/pipeline/infer-data-flow-protocol.d.ts

@@ -0,0 +1,7 @@
+import type { DetectedDataFlow } from "../types/data-flow";
+export type InferredDataFlowProtocol = "rest" | "graphql";
+/**
+ * Infer engineering.protocol for a scanned data flow (rest | graphql).
+ * Returns undefined when the flow type is not HTTP/API-shaped or there is no signal.
+ */
+export declare function inferDataFlowProtocol(flow: DetectedDataFlow): InferredDataFlowProtocol | undefined;

package/dist/src/core/pipeline/infer-data-flow-protocol.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inferDataFlowProtocol = inferDataFlowProtocol;
+const GRAPHQL_SIGNAL = /\bgraphql\b|\/graphql\b/i;
+function textSuggestsGraphql(text) {
+    return GRAPHQL_SIGNAL.test(text);
+}
+function flowCodeSuggestsGraphql(flow) {
+    const locations = [
+        flow.sourceLocation,
+        ...(flow.sourceLocations ?? []),
+    ].filter((loc) => loc != null);
+    for (const loc of locations) {
+        if (typeof loc.code === "string" && textSuggestsGraphql(loc.code)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Infer engineering.protocol for a scanned data flow (rest | graphql).
+ * Returns undefined when the flow type is not HTTP/API-shaped or there is no signal.
+ */
+function inferDataFlowProtocol(flow) {
+    const endpoint = flow.endpoint?.trim() ?? "";
+    if (endpoint && textSuggestsGraphql(endpoint)) {
+        return "graphql";
+    }
+    if (flowCodeSuggestsGraphql(flow)) {
+        return "graphql";
+    }
+    if (flow.type !== "api_call") {
+        return undefined;
+    }
+    if (endpoint || flow.method?.trim()) {
+        return "rest";
+    }
+    return undefined;
+}

package/dist/src/core/schema/scan-config.schema.d.ts

@@ -51,10 +51,12 @@ export declare const scanConfigurationSchema: z.ZodObject<{
     aiMode: z.ZodOptional<z.ZodEnum<{
         byok: "byok";
         platform: "platform";
+        hosted_worker: "hosted_worker";
         none: "none";
     }>>;
     platformApiBaseUrl: z.ZodOptional<z.ZodString>;
     cliQuotaJobId: z.ZodOptional<z.ZodString>;
+    hostedInferProxyUrl: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare function parseScanConfiguration(input: unknown): ScanConfiguration;
 export declare function validateScanConfiguration(input: unknown): {

package/dist/src/core/schema/scan-config.schema.js

@@ -45,9 +45,10 @@ exports.scanConfigurationSchema = zod_1.z.object({
     aiInferenceScope: zod_1.z.enum(["default", "third_party_only"]).optional(),
     aiVerbose: zod_1.z.boolean().optional(),
     workspaceApiKey: zod_1.z.string().min(1).optional(),
-    aiMode: zod_1.z.enum(["byok", "platform", "none"]).optional(),
+    aiMode: zod_1.z.enum(["byok", "platform", "hosted_worker", "none"]).optional(),
     platformApiBaseUrl: zod_1.z.string().min(1).optional(),
     cliQuotaJobId: zod_1.z.string().min(1).optional(),
+    hostedInferProxyUrl: zod_1.z.string().min(1).optional(),
 });
 function parseScanConfiguration(input) {
     return exports.scanConfigurationSchema.parse(input);

package/dist/src/core/types/config.d.ts

@@ -49,9 +49,11 @@ export interface ScanConfiguration {
     /** DataParade workspace API key (quota + platform LLM proxy). */
     workspaceApiKey?: string;
     /** How LLM inference is billed: byok (direct provider) or platform (API proxy). */
-    aiMode?: "byok" | "platform" | "none";
+    aiMode?: "byok" | "platform" | "hosted_worker" | "none";
     /** Base URL for platform API (preflight / infer / complete). */
     platformApiBaseUrl?: string;
     /** CLI quota job id from preflight (platform mode). */
     cliQuotaJobId?: string;
+    /** Loopback infer URL when hosted scan runs inside VPC scan worker. */
+    hostedInferProxyUrl?: string;
 }

package/dist/src/observability/scan-sentry.d.ts

@@ -1,4 +1,4 @@
-export type ScanCliAiMode = "byok" | "platform" | "none";
+export type ScanCliAiMode = "byok" | "platform" | "hosted_worker" | "none";
 export type ReportScanCliErrorInput = {
     error: unknown;
     scanRoot?: string;

package/dist/src/platform-api/dataparade-app-base-url.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Default DataParade web app (frontend Lambda URL). Used when the CLI prints
+ * dashboard preview links. Override with DATAPARADE_APP_URL for local dev.
+ */
+export declare const DEFAULT_DATAPARADE_APP_URL = "https://tse3dlzv73va5vycctveedw27i0xwncj.lambda-url.us-east-1.on.aws";
+/** Resolve web app origin (no trailing slash). */
+export declare function getDataparadeAppBaseUrl(env?: NodeJS.ProcessEnv): string;

package/dist/src/platform-api/dataparade-app-base-url.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_DATAPARADE_APP_URL = void 0;
+exports.getDataparadeAppBaseUrl = getDataparadeAppBaseUrl;
+/**
+ * Default DataParade web app (frontend Lambda URL). Used when the CLI prints
+ * dashboard preview links. Override with DATAPARADE_APP_URL for local dev.
+ */
+exports.DEFAULT_DATAPARADE_APP_URL = "https://tse3dlzv73va5vycctveedw27i0xwncj.lambda-url.us-east-1.on.aws";
+/** Resolve web app origin (no trailing slash). */
+function getDataparadeAppBaseUrl(env = process.env) {
+    const base = env.DATAPARADE_APP_URL?.trim() || exports.DEFAULT_DATAPARADE_APP_URL;
+    return base.replace(/\/$/, "");
+}

package/dist/src/platform-api/upload-client.d.ts

@@ -0,0 +1,3 @@
+import type { CliUploadPreviewInput, CliUploadPreviewResponse } from "./upload.types";
+export type { CliUploadPreviewInput, CliUploadPreviewResponse } from "./upload.types";
+export declare function cliUploadPreview(input: CliUploadPreviewInput): Promise<CliUploadPreviewResponse>;

package/dist/src/platform-api/upload-client.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cliUploadPreview = cliUploadPreview;
+const dataparade_api_base_url_1 = require("./dataparade-api-base-url");
+function buildHeaders(apiKey) {
+    return {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json",
+    };
+}
+async function cliUploadPreview(input) {
+    const res = await fetch(`${(0, dataparade_api_base_url_1.getDataparadeApiBaseUrl)()}/api/scans/cli/upload`, {
+        method: "POST",
+        headers: buildHeaders(input.apiKey),
+        body: JSON.stringify({
+            dataflow: input.dataflow,
+            projectName: input.projectName,
+            scanJobId: input.scanJobId,
+        }),
+    });
+    if (!res.ok) {
+        let message = `Upload failed (${res.status})`;
+        try {
+            const body = (await res.json());
+            if (typeof body.message === "string")
+                message = body.message;
+            else if (Array.isArray(body.message))
+                message = body.message.join(", ");
+            else if (typeof body.error === "string")
+                message = body.error;
+        }
+        catch {
+            // ignore
+        }
+        throw new Error(message);
+    }
+    return (await res.json());
+}