@dataparade/cli 0.0.3 → 0.0.5

package/README.md

@@ -86,6 +86,30 @@ node dist/bin/cli.js scan path/to/your/project
 
 ---
 
+## Upload to dashboard
+
+After a scan, the CLI **auto-uploads** `dataflow.json` when `DATAPARADE_WORKSPACE_API_KEY` is set (from **Workspace → Access keys**). This creates an **import preview draft** in the web app — not a finished assessment. Open the printed URL to review and edit before creating the diagram.
+
+- Opt out: `--skip-auto-upload` or `DATAPARADE_SKIP_AUTO_UPLOAD=true`
+- Without a workspace key, the scan still succeeds; the CLI suggests running `upload` later
+- Upload alone does **not** consume scan quota (platform AI scans still use preflight/complete as before)
+
+```bash
+# Upload an existing file
+node dist/bin/cli.js upload ./dataflow.json --project-name "My service"
+```
+
+Environment:
+
+| Variable | Purpose |
+|----------|---------|
+| `DATAPARADE_WORKSPACE_API_KEY` | Auth for upload (same key as platform AI) |
+| `DATAPARADE_API_BASE_URL` | Backend API (default: production AWS) |
+| `DATAPARADE_APP_URL` | Frontend base for preview links (default: production app) |
+| `DATAPARADE_SKIP_AUTO_UPLOAD` | Skip post-scan upload when `true`/`1` |
+
+---
+
 ## Output: `dataflow.json`
 
 By default (no `--output` flag), the CLI writes `./dataflow.json` in the current working directory.

package/dist/package.json

@@ -0,0 +1,85 @@
+{
+    "name": "@dataparade/cli",
+    "version": "0.0.5",
+    "description": "dataPARADE CLI — scan codebases for privacy and security data flows",
+    "publishConfig": {
+        "access": "public",
+        "registry": "https://registry.npmjs.org/"
+    },
+    "license": "GPL-3.0-or-later",
+    "author": "DataParade",
+    "homepage": "https://github.com/DataParade-io/dataparade-cli#readme",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/DataParade-io/dataparade-cli.git"
+    },
+    "bugs": {
+        "url": "https://github.com/DataParade-io/dataparade-cli/issues"
+    },
+    "engines": {
+        "node": ">=20"
+    },
+    "keywords": [
+        "dataparade",
+        "privacy",
+        "data-flow",
+        "security",
+        "cli",
+        "scanner"
+    ],
+    "private": false,
+    "main": "dist/src/index.js",
+    "types": "dist/src/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/src/index.d.ts",
+            "default": "./dist/src/index.js"
+        },
+        "./ai-providers": {
+            "types": "./dist/src/ai-enrichment/providers/index.d.ts",
+            "default": "./dist/src/ai-enrichment/providers/index.js"
+        }
+    },
+    "bin": {
+        "@dataparade/cli": "dist/bin/cli.js"
+    },
+    "scripts": {
+        "generate:terraform-provider-hints": "node scripts/generate-terraform-provider-hints.mjs",
+        "generate:aws-terraform-hints": "node scripts/generate-aws-terraform-hints.mjs",
+        "generate:azure-terraform-hints": "node scripts/generate-terraform-provider-hints.mjs --azure-only",
+        "generate:kubernetes-terraform-hints": "node scripts/generate-terraform-provider-hints.mjs --kubernetes-only",
+        "build": "pnpm exec tsc -p tsconfig.json",
+        "prepublishOnly": "pnpm run build && pnpm run test",
+        "lint": "eslint \"src/**/*.ts\" \"tests/**/*.ts\"",
+        "pretest": "pnpm run build",
+        "test": "jest",
+        "scan": "node dist/bin/cli.js scan",
+        "eval:models": "pnpm exec node dist/src/evals/run-model-matrix.js"
+    },
+    "dependencies": {
+        "@sentry/node": "^10.38.0",
+        "commander": "^12.1.0",
+        "dotenv": "^16.4.7",
+        "langsmith": "^0.3.14",
+        "typescript": "^5.7.3",
+        "yaml": "^2.8.2",
+        "zod": "^4.3.5"
+    },
+    "devDependencies": {
+        "@eslint/js": "^9.18.0",
+        "@types/jest": "^29.5.14",
+        "@types/node": "^22.0.0",
+        "eslint": "^9.18.0",
+        "globals": "^15.14.0",
+        "jest": "^29.7.0",
+        "ts-jest": "^29.2.5",
+        "typescript-eslint": "^8.20.0"
+    },
+    "files": [
+        "dist",
+        "patterns",
+        "LICENSE",
+        "README.md",
+        "package.json"
+    ]
+}

package/dist/src/ai-enrichment/agent-orchestrator.d.ts

@@ -18,6 +18,8 @@ export interface AgentOrchestratorOptions {
     skipStructuralHeuristics?: boolean;
     /** Platform-billed LLM via DataParade API proxy. */
     platformProxy?: PlatformProxyProviderConfig;
+    /** Hosted scan in VPC worker: loopback proxy → scan-cli-ai-helper Lambda. */
+    hostedWorkerInferProxyUrl?: string;
 }
 export declare function generateAgenticProposals(input: RunInferencePipelineInput, plan: InferencePlannerResult, candidates: AiInferenceCandidate[], options: AgentOrchestratorOptions): Promise<{
     proposals: Array<{

package/dist/src/ai-enrichment/agent-orchestrator.js

@@ -10,6 +10,7 @@ const third_party_evidence_1 = require("./third-party-evidence");
 const provider_contract_1 = require("./providers/provider-contract");
 const scan_paths_1 = require("./scan-paths");
 const platform_proxy_provider_1 = require("./providers/platform-proxy-provider");
+const hosted_worker_infer_provider_1 = require("./providers/hosted-worker-infer-provider");
 const PROPERTY_AGENT_SLICE_SIZE = 12;
 const TP_AGENT_MAX_ROUNDS = 3;
 const TP_AGENT_MAX_FILES = 8;
@@ -156,11 +157,13 @@ async function generateAgenticProposals(input, plan, candidates, options) {
     const skipStructural = options.skipStructuralHeuristics === true;
     const provider = options.platformProxy
         ? new platform_proxy_provider_1.PlatformProxyProvider(options.platformProxy)
-        : (0, providers_1.createAiProvider)(options.provider, {
-            endpoint: options.endpoint,
-            model: options.model,
-            apiKey: options.apiKey,
-        });
+        : options.hostedWorkerInferProxyUrl?.trim()
+            ? new hosted_worker_infer_provider_1.HostedWorkerInferProvider(options.hostedWorkerInferProxyUrl.trim())
+            : (0, providers_1.createAiProvider)(options.provider, {
+                endpoint: options.endpoint,
+                model: options.model,
+                apiKey: options.apiKey,
+            });
     const generated = [];
     const agenticTrace = [];
     const aggregateUsage = {

package/dist/src/ai-enrichment/providers/hosted-worker-infer-provider.d.ts

@@ -0,0 +1,10 @@
+import type { AiProvider, AiProviderRequest, AiProviderResult } from "./types";
+/**
+ * Sync infer via the scan worker's loopback proxy (VPC → scan-cli-ai-helper Lambda).
+ */
+export declare class HostedWorkerInferProvider implements AiProvider {
+    private readonly inferUrl;
+    readonly id: "openai";
+    constructor(inferUrl: string);
+    infer(request: AiProviderRequest): Promise<AiProviderResult>;
+}

package/dist/src/ai-enrichment/providers/hosted-worker-infer-provider.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostedWorkerInferProvider = void 0;
+/**
+ * Sync infer via the scan worker's loopback proxy (VPC → scan-cli-ai-helper Lambda).
+ */
+class HostedWorkerInferProvider {
+    constructor(inferUrl) {
+        this.inferUrl = inferUrl;
+        this.id = "openai";
+    }
+    async infer(request) {
+        const res = await fetch(this.inferUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                prompt: request.prompt,
+                maxTokens: request.maxTokens,
+                temperature: request.temperature,
+            }),
+        });
+        let body;
+        try {
+            body = (await res.json());
+        }
+        catch {
+            throw new Error(`Hosted scan AI infer failed (${res.status})`);
+        }
+        if (!res.ok) {
+            throw new Error(body.error?.trim() ||
+                `Hosted scan AI infer failed (${res.status})`);
+        }
+        const proposals = (Array.isArray(body.proposals) ? body.proposals : []);
+        const usage = body.usage;
+        return {
+            proposals,
+            usage: usage && typeof usage.totalTokens === "number"
+                ? {
+                    inputTokens: Math.max(0, usage.inputTokens ?? 0),
+                    outputTokens: Math.max(0, usage.outputTokens ?? 0),
+                    totalTokens: Math.max(0, usage.totalTokens),
+                }
+                : undefined,
+        };
+    }
+}
+exports.HostedWorkerInferProvider = HostedWorkerInferProvider;

package/dist/src/cli.js

@@ -40,7 +40,9 @@ exports.run = run;
 require("./config/load-cli-env");
 const path_1 = __importDefault(require("path"));
 const commander_1 = require("commander");
+const package_json_1 = __importDefault(require("../package.json"));
 const json_1 = require("./output/json");
+const upload_env_1 = require("./config/upload-env");
 const types_1 = require("./ai-enrichment/types");
 const inference_scope_1 = require("./config/inference-scope");
 const redact_1 = require("./config/redact");
@@ -112,7 +114,7 @@ function createProgram() {
     program
         .name("dataparade")
         .description("DataParade CLI - scan codebases for data flow components")
-        .version("0.0.0");
+        .version(package_json_1.default.version);
     program
         .command("scan <path>")
         .description("Scan a directory (or a single supported source file) for data flow components")
@@ -143,6 +145,7 @@ function createProgram() {
         .option("--api-key <key>", "(deprecated) alias for --workspace-api-key")
         .option("--byok-provider <provider>", `BYOK LLM provider when using your own API key: ${types_1.AI_PROVIDER_IDS.join("|")}`)
         .option("--byok-model <model>", "BYOK model name (env: SCAN_BYOK_MODEL)")
+        .option("--skip-auto-upload", "Do not upload dataflow.json to the dashboard after scan (env: DATAPARADE_SKIP_AUTO_UPLOAD)")
         .action(async (path, options) => {
         let cliQuotaJobId;
         let platformQuotaApiKey;
@@ -368,16 +371,48 @@ function createProgram() {
             }
             if (diagramGraph) {
                 const dataflowOutputPath = path_1.default.resolve(process.cwd(), options.output ?? "dataflow.json");
+                const resolvedProjectName = config.projectName?.trim() ||
+                    path_1.default.basename(scanEntry.scanRootDir);
                 try {
                     (0, json_1.writeDataflowJson)({
                         scanResult,
                         graph: diagramGraph,
                         outputPath: dataflowOutputPath,
+                        projectName: resolvedProjectName,
                     });
                     // Always print a short message so non-interactive callers and
                     // tests can rely on it.
                     // eslint-disable-next-line no-console
                     console.log(`[scan] dataflow.json written to ${dataflowOutputPath}`);
+                    const skipAutoUpload = Boolean(options.skipAutoUpload) ||
+                        (0, upload_env_1.resolveSkipAutoUpload)(process.env);
+                    if (!skipAutoUpload) {
+                        const uploadApiKey = workspaceApiKey;
+                        if (!uploadApiKey) {
+                            // eslint-disable-next-line no-console
+                            console.log(`[scan] Auto-upload skipped (no workspace API key). Run: dataparade upload ${dataflowOutputPath}`);
+                        }
+                        else {
+                            try {
+                                const { runDataflowUpload } = await Promise.resolve().then(() => __importStar(require("./upload/run-upload")));
+                                const dataflowWrapper = (0, json_1.buildDataflowWrapper)(scanResult, diagramGraph, { projectName: resolvedProjectName });
+                                await runDataflowUpload({
+                                    apiKey: uploadApiKey,
+                                    dataflow: dataflowWrapper,
+                                    projectName: resolvedProjectName,
+                                    scanJobId: cliQuotaJobId,
+                                    logPrefix: "[scan]",
+                                });
+                            }
+                            catch (uploadError) {
+                                const uploadMessage = uploadError instanceof Error
+                                    ? uploadError.message
+                                    : "Unknown upload error.";
+                                // eslint-disable-next-line no-console
+                                console.error(`[scan] Auto-upload failed: ${uploadMessage}`);
+                            }
+                        }
+                    }
                 }
                 catch (dataflowError) {
                     await (0, scan_sentry_1.reportScanCliError)({
@@ -453,6 +488,58 @@ function createProgram() {
             }
         }
     });
+    program
+        .command("upload <file>")
+        .description("Upload a dataflow.json file to the dashboard as an import preview")
+        .option("--project-name <name>", "Assessment name shown in the preview (default: from file metadata if present)")
+        .option("--workspace-api-key <key>", "DataParade workspace API key (env: DATAPARADE_WORKSPACE_API_KEY)")
+        .option("--api-key <key>", "(deprecated) alias for --workspace-api-key")
+        .action(async (file, options) => {
+        const apiKey = options.workspaceApiKey?.trim() ||
+            options.apiKey?.trim() ||
+            (0, scan_env_1.resolveWorkspaceApiKey)(process.env);
+        if (!apiKey) {
+            // eslint-disable-next-line no-console
+            console.error("[upload] error: workspace API key is required (DATAPARADE_WORKSPACE_API_KEY or --workspace-api-key)");
+            process.exitCode = 1;
+            return;
+        }
+        const filePath = path_1.default.resolve(process.cwd(), file || "dataflow.json");
+        let dataflow;
+        try {
+            const { readFileSync } = await Promise.resolve().then(() => __importStar(require("fs")));
+            dataflow = JSON.parse(readFileSync(filePath, "utf8"));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to read dataflow.json";
+            // eslint-disable-next-line no-console
+            console.error(`[upload] error: ${message}`);
+            process.exitCode = 1;
+            return;
+        }
+        let projectName = options.projectName?.trim();
+        if (!projectName && dataflow && typeof dataflow === "object") {
+            const meta = dataflow
+                .metadata;
+            if (typeof meta?.projectName === "string" && meta.projectName.trim()) {
+                projectName = meta.projectName.trim();
+            }
+        }
+        try {
+            const { runDataflowUpload } = await Promise.resolve().then(() => __importStar(require("./upload/run-upload")));
+            await runDataflowUpload({
+                apiKey,
+                dataflow,
+                projectName,
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Upload failed.";
+            // eslint-disable-next-line no-console
+            console.error(`[upload] error: ${message}`);
+            process.exitCode = 1;
+        }
+    });
     program
         .command("config")
         .description("View the effective configuration for the current project")

package/dist/src/config/env.js

@@ -50,6 +50,7 @@ function loadCliConfigEnv(env) {
     const aiToolLoopMaxSearches = parseNumber(env.SCAN_AI_TOOL_LOOP_MAX_SEARCHES);
     const aiThirdPartyDataFlowEnabled = parseBoolean(env.SCAN_AI_THIRD_PARTY_DATA_FLOW);
     const workspaceApiKey = (0, scan_env_1.resolveWorkspaceApiKey)(env);
+    const hostedInferProxyUrl = (0, scan_env_1.resolveHostedInferProxyUrl)(env);
     return {
         excludePaths,
         minimumConfidence,
@@ -71,5 +72,6 @@ function loadCliConfigEnv(env) {
         aiToolLoopMaxSearches,
         aiThirdPartyDataFlowEnabled,
         workspaceApiKey: workspaceApiKey || undefined,
+        hostedInferProxyUrl: hostedInferProxyUrl || undefined,
     };
 }

package/dist/src/config/resolve.js

@@ -283,6 +283,9 @@ function resolveScanConfiguration(options) {
     if (envConfig.workspaceApiKey) {
         overrides.workspaceApiKey = envConfig.workspaceApiKey;
     }
+    if (envConfig.hostedInferProxyUrl) {
+        overrides.hostedInferProxyUrl = envConfig.hostedInferProxyUrl;
+    }
     if (envConfig.aiModel) {
         overrides.aiModel = envConfig.aiModel;
     }

package/dist/src/config/scan-env.d.ts

@@ -3,5 +3,6 @@ export declare function resolveByokApiKey(env: NodeJS.ProcessEnv): string | unde
 export declare function resolveByokProvider(env: NodeJS.ProcessEnv): string | undefined;
 export declare function resolveByokModel(env: NodeJS.ProcessEnv): string | undefined;
 export declare function resolveScanAiInference(env: NodeJS.ProcessEnv): string | undefined;
+export declare function resolveHostedInferProxyUrl(env: NodeJS.ProcessEnv): string | undefined;
 /** Extra provider HTTP / normalization logging (all providers, not OpenAI-only). */
 export declare function isScanAiDebugEnabled(env?: NodeJS.ProcessEnv): boolean;

package/dist/src/config/scan-env.js

@@ -5,6 +5,7 @@ exports.resolveByokApiKey = resolveByokApiKey;
 exports.resolveByokProvider = resolveByokProvider;
 exports.resolveByokModel = resolveByokModel;
 exports.resolveScanAiInference = resolveScanAiInference;
+exports.resolveHostedInferProxyUrl = resolveHostedInferProxyUrl;
 exports.isScanAiDebugEnabled = isScanAiDebugEnabled;
 function resolveWorkspaceApiKey(env) {
     const value = env.DATAPARADE_WORKSPACE_API_KEY?.trim();
@@ -26,6 +27,10 @@ function resolveScanAiInference(env) {
     const value = env.SCAN_AI_INFERENCE?.trim();
     return value || undefined;
 }
+function resolveHostedInferProxyUrl(env) {
+    const value = env.SCAN_HOSTED_INFER_PROXY_URL?.trim();
+    return value || undefined;
+}
 function parseTruthyEnvFlag(value) {
     if (!value)
         return false;

package/dist/src/config/types.d.ts

@@ -55,6 +55,7 @@ export interface CliConfigEnv {
     aiToolLoopMaxSearches?: number;
     aiThirdPartyDataFlowEnabled?: boolean;
     workspaceApiKey?: string;
+    hostedInferProxyUrl?: string;
 }
 export interface CliConfigFlags {
     exclude?: string[];

package/dist/src/config/upload-env.d.ts

@@ -0,0 +1 @@
+export declare function resolveSkipAutoUpload(env: NodeJS.ProcessEnv): boolean;

package/dist/src/config/upload-env.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSkipAutoUpload = resolveSkipAutoUpload;
+const TRUTHY = new Set(["1", "true", "yes", "on"]);
+function resolveSkipAutoUpload(env) {
+    const value = env.DATAPARADE_SKIP_AUTO_UPLOAD?.trim().toLowerCase();
+    if (!value)
+        return false;
+    return TRUTHY.has(value);
+}

package/dist/src/config/validate-scan-ai.d.ts

@@ -1,3 +1,3 @@
 import type { ScanConfiguration } from "../core/types";
 export declare function validateAiInferenceCredentials(config: ScanConfiguration): string[];
-export declare function resolveAiMode(config: ScanConfiguration): "byok" | "platform" | "none";
+export declare function resolveAiMode(config: ScanConfiguration): "byok" | "platform" | "hosted_worker" | "none";

package/dist/src/config/validate-scan-ai.js

@@ -6,6 +6,9 @@ function validateAiInferenceCredentials(config) {
     const errors = [];
     if (!config.enableAiInference)
         return errors;
+    if (config.hostedInferProxyUrl?.trim()) {
+        return errors;
+    }
     const hasByok = Boolean(config.aiProvider?.trim()) &&
         Boolean(config.aiModel?.trim()) &&
         Boolean(config.aiApiKey?.trim());
@@ -25,6 +28,8 @@ function validateAiInferenceCredentials(config) {
 function resolveAiMode(config) {
     if (!config.enableAiInference)
         return "none";
+    if (config.hostedInferProxyUrl?.trim())
+        return "hosted_worker";
     if (config.aiApiKey?.trim())
         return "byok";
     if (config.workspaceApiKey?.trim())

package/dist/src/core/pipeline/ai-orchestrator-options.js

@@ -42,5 +42,10 @@ function buildAgentOrchestratorOptions(config, opts) {
         // the helper succeeds (client sees 503 "Service Unavailable").
         base.providerConcurrency = 1;
     }
+    if (aiMode === "hosted_worker" && config.hostedInferProxyUrl?.trim()) {
+        base.hostedWorkerInferProxyUrl = config.hostedInferProxyUrl.trim();
+        base.apiKey = undefined;
+        base.providerConcurrency = 1;
+    }
     return base;
 }

package/dist/src/core/schema/scan-config.schema.d.ts

@@ -51,10 +51,12 @@ export declare const scanConfigurationSchema: z.ZodObject<{
     aiMode: z.ZodOptional<z.ZodEnum<{
         byok: "byok";
         platform: "platform";
+        hosted_worker: "hosted_worker";
         none: "none";
     }>>;
     platformApiBaseUrl: z.ZodOptional<z.ZodString>;
     cliQuotaJobId: z.ZodOptional<z.ZodString>;
+    hostedInferProxyUrl: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare function parseScanConfiguration(input: unknown): ScanConfiguration;
 export declare function validateScanConfiguration(input: unknown): {

package/dist/src/core/schema/scan-config.schema.js

@@ -45,9 +45,10 @@ exports.scanConfigurationSchema = zod_1.z.object({
     aiInferenceScope: zod_1.z.enum(["default", "third_party_only"]).optional(),
     aiVerbose: zod_1.z.boolean().optional(),
     workspaceApiKey: zod_1.z.string().min(1).optional(),
-    aiMode: zod_1.z.enum(["byok", "platform", "none"]).optional(),
+    aiMode: zod_1.z.enum(["byok", "platform", "hosted_worker", "none"]).optional(),
     platformApiBaseUrl: zod_1.z.string().min(1).optional(),
     cliQuotaJobId: zod_1.z.string().min(1).optional(),
+    hostedInferProxyUrl: zod_1.z.string().min(1).optional(),
 });
 function parseScanConfiguration(input) {
     return exports.scanConfigurationSchema.parse(input);

package/dist/src/core/types/config.d.ts

@@ -49,9 +49,11 @@ export interface ScanConfiguration {
     /** DataParade workspace API key (quota + platform LLM proxy). */
     workspaceApiKey?: string;
     /** How LLM inference is billed: byok (direct provider) or platform (API proxy). */
-    aiMode?: "byok" | "platform" | "none";
+    aiMode?: "byok" | "platform" | "hosted_worker" | "none";
     /** Base URL for platform API (preflight / infer / complete). */
     platformApiBaseUrl?: string;
     /** CLI quota job id from preflight (platform mode). */
     cliQuotaJobId?: string;
+    /** Loopback infer URL when hosted scan runs inside VPC scan worker. */
+    hostedInferProxyUrl?: string;
 }

package/dist/src/observability/scan-sentry.d.ts

@@ -1,4 +1,4 @@
-export type ScanCliAiMode = "byok" | "platform" | "none";
+export type ScanCliAiMode = "byok" | "platform" | "hosted_worker" | "none";
 export type ReportScanCliErrorInput = {
     error: unknown;
     scanRoot?: string;

package/dist/src/output/json.d.ts

@@ -10,6 +10,8 @@ export interface BuildDataflowWrapperOptions {
      * dataflow.json schema version.
      */
     schemaVersion?: string;
+    /** Assessment / project name shown in the dashboard import preview. */
+    projectName?: string;
 }
 /**
  * Assemble the top-level `dataflow.json` wrapper object from a scan result and graph.
@@ -35,6 +37,8 @@ export interface WriteDataflowJsonOptions {
      * Optional schema version to pass through to `buildDataflowWrapper`.
      */
     schemaVersion?: string;
+    /** Assessment / project name stored in wrapper metadata for upload and preview. */
+    projectName?: string;
 }
 /**
  * Validate and write a `dataflow.json` wrapper to disk.

package/dist/src/output/json.js

@@ -15,11 +15,13 @@ const dataflow_wrapper_schema_1 = require("../core/schema/dataflow-wrapper.schem
  */
 function buildDataflowWrapper(scanResult, graph, options = {}) {
     const schemaVersion = options.schemaVersion ?? "1.0";
+    const projectName = options.projectName?.trim();
     const metadata = {
         componentsCount: scanResult.components.length,
         dataFlowsCount: scanResult.dataFlows.length,
         filesScanned: scanResult.filesScanned,
         scanDurationMs: scanResult.scanDurationMs,
+        ...(projectName ? { projectName } : {}),
     };
     if (scanResult.aiInferenceSummary) {
         metadata.aiInference =
@@ -47,8 +49,11 @@ function buildDataflowWrapper(scanResult, graph, options = {}) {
  * can emit a non-zero exit code.
  */
 function writeDataflowJson(options) {
-    const { scanResult, graph, outputPath, schemaVersion } = options;
-    const wrapper = buildDataflowWrapper(scanResult, graph, { schemaVersion });
+    const { scanResult, graph, outputPath, schemaVersion, projectName } = options;
+    const wrapper = buildDataflowWrapper(scanResult, graph, {
+        schemaVersion,
+        projectName,
+    });
     const validation = (0, dataflow_wrapper_schema_1.validateDataflowJson)(wrapper);
     if (!validation.ok) {
         const messages = validation.errors.join("; ");

package/dist/src/platform-api/dataparade-app-base-url.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Default DataParade web app (frontend Lambda URL). Used when the CLI prints
+ * dashboard preview links. Override with DATAPARADE_APP_URL for local dev.
+ */
+export declare const DEFAULT_DATAPARADE_APP_URL = "https://tse3dlzv73va5vycctveedw27i0xwncj.lambda-url.us-east-1.on.aws";
+/** Resolve web app origin (no trailing slash). */
+export declare function getDataparadeAppBaseUrl(env?: NodeJS.ProcessEnv): string;

package/dist/src/platform-api/dataparade-app-base-url.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_DATAPARADE_APP_URL = void 0;
+exports.getDataparadeAppBaseUrl = getDataparadeAppBaseUrl;
+/**
+ * Default DataParade web app (frontend Lambda URL). Used when the CLI prints
+ * dashboard preview links. Override with DATAPARADE_APP_URL for local dev.
+ */
+exports.DEFAULT_DATAPARADE_APP_URL = "https://tse3dlzv73va5vycctveedw27i0xwncj.lambda-url.us-east-1.on.aws";
+/** Resolve web app origin (no trailing slash). */
+function getDataparadeAppBaseUrl(env = process.env) {
+    const base = env.DATAPARADE_APP_URL?.trim() || exports.DEFAULT_DATAPARADE_APP_URL;
+    return base.replace(/\/$/, "");
+}

package/dist/src/platform-api/upload-client.d.ts

@@ -0,0 +1,3 @@
+import type { CliUploadPreviewInput, CliUploadPreviewResponse } from "./upload.types";
+export type { CliUploadPreviewInput, CliUploadPreviewResponse } from "./upload.types";
+export declare function cliUploadPreview(input: CliUploadPreviewInput): Promise<CliUploadPreviewResponse>;

package/dist/src/platform-api/upload-client.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cliUploadPreview = cliUploadPreview;
+const dataparade_api_base_url_1 = require("./dataparade-api-base-url");
+function buildHeaders(apiKey) {
+    return {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json",
+    };
+}
+async function cliUploadPreview(input) {
+    const res = await fetch(`${(0, dataparade_api_base_url_1.getDataparadeApiBaseUrl)()}/api/scans/cli/upload`, {
+        method: "POST",
+        headers: buildHeaders(input.apiKey),
+        body: JSON.stringify({
+            dataflow: input.dataflow,
+            projectName: input.projectName,
+            scanJobId: input.scanJobId,
+        }),
+    });
+    if (!res.ok) {
+        let message = `Upload failed (${res.status})`;
+        try {
+            const body = (await res.json());
+            if (typeof body.message === "string")
+                message = body.message;
+            else if (Array.isArray(body.message))
+                message = body.message.join(", ");
+            else if (typeof body.error === "string")
+                message = body.error;
+        }
+        catch {
+            // ignore
+        }
+        throw new Error(message);
+    }
+    return (await res.json());
+}

package/dist/src/platform-api/upload.types.d.ts

@@ -0,0 +1,10 @@
+export type CliUploadPreviewInput = {
+    apiKey: string;
+    dataflow: unknown;
+    projectName?: string;
+    scanJobId?: string;
+};
+export type CliUploadPreviewResponse = {
+    draftId: string;
+    projectName?: string | null;
+};

package/dist/src/platform-api/upload.types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/upload/build-preview-url.d.ts

@@ -0,0 +1 @@
+export declare function buildImportPreviewUrl(draftId: string): string;