@dataparade/cli 0.0.6 → 0.0.8

package/README.md

@@ -38,10 +38,11 @@ List commands and options: `npx @dataparade/cli --help` and `npx @dataparade/cli
 
 ## Upload to dashboard
 
-After a scan, the CLI **auto-uploads** `dataflow.json` when `DATAPARADE_WORKSPACE_API_KEY` is set (from **Workspace → Access keys**). This creates an **import preview draft** in the web app — not a finished assessment.
+After a scan, the CLI **auto-uploads** `dataflow.json` by default (unless you opt out). This creates an **import preview draft** in the web app — not a finished assessment.
 
+- **With a workspace API key** (`DATAPARADE_WORKSPACE_API_KEY` from **Workspace → Access keys**): prints a dashboard link (`?importDraft=`) for that workspace.
+- **Without a workspace key**: prints a sign-up link (`/preview/cli/<token>`). Create an account to open **Preview & Edit** on your dashboard.
 - Opt out: `--skip-auto-upload` or `DATAPARADE_SKIP_AUTO_UPLOAD=true`
-- Without a workspace key, the scan still succeeds; run `upload` later
 - Upload alone does **not** consume scan quota
 
 ```bash

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@dataparade/cli",
-    "version": "0.0.6",
+    "version": "0.0.8",
     "description": "dataPARADE CLI — scan codebases for privacy and security data flows",
     "publishConfig": {
         "access": "public",
@@ -8,7 +8,7 @@
     },
     "license": "GPL-3.0-or-later",
     "author": "DataParade",
-    "homepage": "https://app.dataparade.com/docs/cli-import-and-zip",
+    "homepage": "https://dataparade.io",
     "repository": {
         "type": "git",
         "url": "git+https://github.com/DataParade-io/dataparade-cli.git"

package/dist/src/ai-enrichment/providers/families/chat-completions-family.js

@@ -103,7 +103,10 @@ class ChatCompletionsFamilyProvider {
         const body = {
             model,
             messages: [
-                { role: "system", content: provider_enrichment_prompts_1.AI_PROVIDER_SYSTEM_PROMPT },
+                {
+                    role: "system",
+                    content: request.systemPrompt ?? provider_enrichment_prompts_1.AI_PROVIDER_SYSTEM_PROMPT,
+                },
                 { role: "user", content: request.prompt },
             ],
             temperature: request.temperature ?? 0.1,

package/dist/src/ai-enrichment/providers/families/generate-content-family.js

@@ -34,7 +34,9 @@ class GenerateContentFamilyProvider {
                 "content-type": "application/json",
             },
             body: JSON.stringify({
-                systemInstruction: { parts: [{ text: provider_enrichment_prompts_1.AI_PROVIDER_SYSTEM_PROMPT }] },
+                systemInstruction: {
+                    parts: [{ text: request.systemPrompt ?? provider_enrichment_prompts_1.AI_PROVIDER_SYSTEM_PROMPT }],
+                },
                 contents: [
                     {
                         role: "user",

package/dist/src/ai-enrichment/providers/families/messages-family.js

@@ -33,7 +33,7 @@ class MessagesFamilyProvider {
                 model,
                 max_tokens: maxTokens,
                 temperature: request.temperature ?? 0.1,
-                system: (0, provider_enrichment_prompts_1.buildAnthropicEnrichmentSystemPrompt)(),
+                system: request.systemPrompt ?? (0, provider_enrichment_prompts_1.buildAnthropicEnrichmentSystemPrompt)(),
                 messages: [{ role: "user", content: request.prompt }],
             }),
         });

package/dist/src/ai-enrichment/providers/families/ollama-generate-family.js

@@ -23,7 +23,7 @@ class OllamaGenerateFamilyProvider {
             },
             body: JSON.stringify({
                 model,
-                prompt: `${provider_enrichment_prompts_1.AI_PROVIDER_SYSTEM_PROMPT}\n\nUser payload:\n${request.prompt}`,
+                prompt: `${request.systemPrompt ?? provider_enrichment_prompts_1.AI_PROVIDER_SYSTEM_PROMPT}\n\nUser payload:\n${request.prompt}`,
                 stream: false,
                 options: {
                     temperature: request.temperature ?? 0.1,

package/dist/src/ai-enrichment/providers/types.d.ts

@@ -6,6 +6,12 @@ export interface AiProviderRequest {
     endpoint?: string;
     temperature?: number;
     maxTokens?: number;
+    /**
+     * Overrides the bundled enrichment system prompt (DP-P0-CLI-3813).
+     * Set by the DataParade backend on the Platform AI path so the server owns
+     * the system role. Unset for BYOK, which keeps the CLI-bundled prompt.
+     */
+    systemPrompt?: string;
 }
 export interface AiProviderUsage {
     inputTokens: number;

package/dist/src/cli.js

@@ -130,7 +130,8 @@ function createProgram() {
         .option("--no-terraform-stack-section-auto", "Do not infer terraformStackSectionPathDepth from .tf layout when depth is unset")
         .option("--monorepo-package-section-path-depth <n>", "Workspace package section depth (max 3): primary packages and rollup use N POSIX path segments (e.g. 3 for packages/twenty-apps/hello)")
         .option("--no-monorepo-package-section-auto", "Do not infer monorepoPackageSectionPathDepth from package.json layout when depth is unset")
-        .option("--ai-inference", "Enable post-scan AI inference pipeline")
+        .option("--ai-inference", "Enable post-scan AI inference (default: on; SCAN_AI_INFERENCE=false also disables)")
+        .option("--no-ai-inference", "Disable post-scan AI inference")
         .option("--ai-provider <provider>", `AI provider: ${types_1.AI_PROVIDER_IDS.join("|")}`)
         .option("--ai-model <model>", "Model name for AI inference")
         .option("--ai-endpoint <url>", "Override provider endpoint URL")
@@ -154,6 +155,7 @@ function createProgram() {
         let sentryScanRoot;
         let sentryAiMode;
         let sentryAiProvider;
+        const isInteractive = process.stdout.isTTY;
         const workspaceApiKey = options.workspaceApiKey?.trim() ||
             options.apiKey?.trim() ||
             (0, scan_env_1.resolveWorkspaceApiKey)(process.env);
@@ -181,7 +183,6 @@ function createProgram() {
                 process.exitCode = 2;
                 return;
             }
-            const isInteractive = process.stdout.isTTY;
             const [{ scan, createDefaultScanConfiguration }, { buildDiagramGraphFromScanResult }] = await Promise.all([
                 Promise.resolve().then(() => __importStar(require("./core/pipeline/orchestrator"))),
                 Promise.resolve().then(() => __importStar(require("./core/pipeline/graph-mapping"))),
@@ -265,14 +266,53 @@ function createProgram() {
                 config.cliQuotaJobId = preflight.jobId;
                 if (config.enableAiInference &&
                     preflight.suggestedAiBudgetTokens > 0) {
-                    config.aiBudgetTokens = preflight.suggestedAiBudgetTokens;
+                    // suggestedAiBudgetTokens is a server ceiling (remaining quota /
+                    // per-job cap), not a spend target. Never raise the CLI working
+                    // budget above the configured default (or user override).
+                    config.aiBudgetTokens = Math.min(config.aiBudgetTokens ?? 12_000, preflight.suggestedAiBudgetTokens);
                 }
                 if (preflight.aiDelivery === "platform_proxy") {
                     config.aiMode = "platform";
                 }
                 if (isInteractive) {
                     // eslint-disable-next-line no-console
-                    console.log(`[scan] quota: scans_remaining=${preflight.scansRemaining} ai_tokens_remaining=${preflight.aiTokensRemaining} job_id=${preflight.jobId}`);
+                    console.log(`[scan] quota: scans_remaining=${preflight.scansRemaining} ai_tokens_remaining=${preflight.aiTokensRemaining} job_id=${preflight.jobId} working_budget=${config.aiBudgetTokens ?? 0}`);
+                }
+            }
+            else if (!workspaceApiKey &&
+                !usesByok &&
+                config.enableAiInference) {
+                try {
+                    const { cliAnonymousAiSession } = await Promise.resolve().then(() => __importStar(require("./platform-api/anonymous-ai-session-client")));
+                    const session = await cliAnonymousAiSession({
+                        projectName: config.projectName,
+                    });
+                    cliQuotaJobId = session.jobId;
+                    config.cliQuotaJobId = session.jobId;
+                    config.anonSessionToken = session.sessionToken;
+                    if (session.suggestedAiBudgetTokens > 0) {
+                        // Anon suggested value is the hard per-job ceiling (default 100k).
+                        // Applying it as the working budget caused scans to burn ~100k tokens.
+                        config.aiBudgetTokens = Math.min(config.aiBudgetTokens ?? 12_000, session.suggestedAiBudgetTokens);
+                    }
+                    if (session.aiDelivery === "platform_proxy") {
+                        config.aiMode = "platform";
+                    }
+                    if (isInteractive) {
+                        // eslint-disable-next-line no-console
+                        console.log(`[scan] anonymous platform AI: job_id=${session.jobId} working_budget=${config.aiBudgetTokens ?? 0} server_cap=${session.suggestedAiBudgetTokens} (claim debits actual tokens used)`);
+                    }
+                }
+                catch (anonSessionError) {
+                    const { CliAnonymousIpLimitError } = await Promise.resolve().then(() => __importStar(require("./platform-api/anonymous-ai-session-client")));
+                    const message = anonSessionError instanceof Error
+                        ? anonSessionError.message
+                        : "Anonymous AI session failed.";
+                    // eslint-disable-next-line no-console
+                    console.error(`[scan] ${message}`);
+                    process.exitCode =
+                        anonSessionError instanceof CliAnonymousIpLimitError ? 2 : 1;
+                    return;
                 }
             }
             const configValidation = (0, scan_config_schema_1.validateScanConfiguration)(config);
@@ -310,10 +350,12 @@ function createProgram() {
                 const s = scanResult.aiInferenceSummary;
                 // eslint-disable-next-line no-console
                 console.log(`[scan] llm-inference summary: candidates=${s.candidatesConsidered} proposals=${s.proposalsGenerated} (provider=${s.proposalsGeneratedProvider}) applied=${s.proposalsApplied} (provider=${s.proposalsAppliedProvider}) rejected=${s.proposalsRejected} (${s.aiProvider}/${s.aiModel})`);
-                if (options.aiVerbose) {
-                    // eslint-disable-next-line no-console
-                    console.log(`[scan] ai-usage totals: provider_calls=${s.providerCalls} tokens_in=${s.inputTokens} tokens_out=${s.outputTokens} tokens_total=${s.totalTokens} estimated_cost_usd=${formatUsd(s.estimatedCostUsd)}`);
-                }
+                // Always show real provider token usage (budget_cap is only a ceiling, not cost).
+                // eslint-disable-next-line no-console
+                console.log(`[scan] ai-usage: provider_calls=${s.providerCalls} tokens_in=${s.inputTokens} tokens_out=${s.outputTokens} tokens_total=${s.totalTokens}` +
+                    (typeof s.estimatedCostUsd === "number"
+                        ? ` estimated_cost_usd=${formatUsd(s.estimatedCostUsd)}`
+                        : ""));
                 if (options.aiVerbose && scanResult.aiInferenceProposalDetails) {
                     printAiInferenceVerbose(scanResult.aiInferenceProposalDetails);
                 }
@@ -387,30 +429,23 @@ function createProgram() {
                     const skipAutoUpload = Boolean(options.skipAutoUpload) ||
                         (0, upload_env_1.resolveSkipAutoUpload)(process.env);
                     if (!skipAutoUpload) {
-                        const uploadApiKey = workspaceApiKey;
-                        if (!uploadApiKey) {
-                            // eslint-disable-next-line no-console
-                            console.log(`[scan] Auto-upload skipped (no workspace API key). Run: dataparade upload ${dataflowOutputPath}`);
+                        try {
+                            const { runDataflowUpload } = await Promise.resolve().then(() => __importStar(require("./upload/run-upload")));
+                            const dataflowWrapper = (0, json_1.buildDataflowWrapper)(scanResult, diagramGraph, { projectName: resolvedProjectName });
+                            await runDataflowUpload({
+                                apiKey: workspaceApiKey,
+                                dataflow: dataflowWrapper,
+                                projectName: resolvedProjectName,
+                                scanJobId: cliQuotaJobId,
+                                logPrefix: "[scan]",
+                            });
                         }
-                        else {
-                            try {
-                                const { runDataflowUpload } = await Promise.resolve().then(() => __importStar(require("./upload/run-upload")));
-                                const dataflowWrapper = (0, json_1.buildDataflowWrapper)(scanResult, diagramGraph, { projectName: resolvedProjectName });
-                                await runDataflowUpload({
-                                    apiKey: uploadApiKey,
-                                    dataflow: dataflowWrapper,
-                                    projectName: resolvedProjectName,
-                                    scanJobId: cliQuotaJobId,
-                                    logPrefix: "[scan]",
-                                });
-                            }
-                            catch (uploadError) {
-                                const uploadMessage = uploadError instanceof Error
-                                    ? uploadError.message
-                                    : "Unknown upload error.";
-                                // eslint-disable-next-line no-console
-                                console.error(`[scan] Auto-upload failed: ${uploadMessage}`);
-                            }
+                        catch (uploadError) {
+                            const uploadMessage = uploadError instanceof Error
+                                ? uploadError.message
+                                : "Unknown upload error.";
+                            // eslint-disable-next-line no-console
+                            console.error(`[scan] Auto-upload failed: ${uploadMessage}`);
                         }
                     }
                 }
@@ -447,26 +482,37 @@ function createProgram() {
                     failureMessage: exitFailed ? "CLI scan did not complete successfully" : undefined,
                 });
                 quotaCompletionReported = true;
+                if (isInteractive) {
+                    // eslint-disable-next-line no-console
+                    console.log("[scan] Scan finished — you can start a new scan now.");
+                }
             }
         }
         catch (err) {
             const message = err instanceof Error ? err.message : "Unknown error during scan.";
             fallbackFailureMessage = message;
-            const { CliScanQuotaExceededError } = await Promise.resolve().then(() => __importStar(require("./platform-api/scan-quota-client")));
+            const { CliScanQuotaExceededError, CliScanAlreadyRunningError } = await Promise.resolve().then(() => __importStar(require("./platform-api/scan-quota-client")));
             const quotaBlocked = err instanceof CliScanQuotaExceededError;
+            const scanInProgress = err instanceof CliScanAlreadyRunningError;
             await (0, scan_sentry_1.reportScanCliError)({
                 error: err,
                 scanRoot: sentryScanRoot,
                 jobId: cliQuotaJobId,
                 aiMode: sentryAiMode,
                 aiProvider: sentryAiProvider,
-                failurePhase: quotaBlocked ? "preflight" : "scan_command",
-                failureCode: quotaBlocked ? "scan_quota_exceeded" : "scan_exception",
+                failurePhase: quotaBlocked || scanInProgress ? "preflight" : "scan_command",
+                failureCode: quotaBlocked
+                    ? "scan_quota_exceeded"
+                    : scanInProgress
+                        ? "scan_already_running"
+                        : "scan_exception",
             });
             // eslint-disable-next-line no-console
             console.error(quotaBlocked
                 ? `[scan] workspace quota: ${message}`
-                : `Scan failed: ${message}`);
+                : scanInProgress
+                    ? `[scan] scan in progress: ${message}`
+                    : `Scan failed: ${message}`);
             process.exitCode = 1;
         }
         finally {
@@ -481,6 +527,10 @@ function createProgram() {
                         failureMessage: fallbackFailureMessage,
                     });
                     quotaCompletionReported = true;
+                    if (isInteractive) {
+                        // eslint-disable-next-line no-console
+                        console.log("[scan] Scan finished — you can start a new scan now.");
+                    }
                 }
                 catch {
                     // Quota report failure must not mask the original scan error.
@@ -498,12 +548,6 @@ function createProgram() {
         const apiKey = options.workspaceApiKey?.trim() ||
             options.apiKey?.trim() ||
             (0, scan_env_1.resolveWorkspaceApiKey)(process.env);
-        if (!apiKey) {
-            // eslint-disable-next-line no-console
-            console.error("[upload] error: workspace API key is required (DATAPARADE_WORKSPACE_API_KEY or --workspace-api-key)");
-            process.exitCode = 1;
-            return;
-        }
         const filePath = path_1.default.resolve(process.cwd(), file || "dataflow.json");
         let dataflow;
         try {

package/dist/src/config/env.js

@@ -22,10 +22,15 @@ function parseBoolean(value) {
     if (value == null)
         return undefined;
     const normalized = value.trim().toLowerCase();
-    if (normalized === "true")
+    if (normalized === "true" || normalized === "1" || normalized === "yes" || normalized === "on") {
         return true;
-    if (normalized === "false")
+    }
+    if (normalized === "false" ||
+        normalized === "0" ||
+        normalized === "no" ||
+        normalized === "off") {
         return false;
+    }
     return undefined;
 }
 function loadCliConfigEnv(env) {

package/dist/src/config/load-cli-env.d.ts

@@ -1 +1,3 @@
+/** @internal Exported for unit tests. */
+export declare function findCliPackageRoot(startDir: string): string | undefined;
 export declare function loadCliDotenv(): void;

package/dist/src/config/load-cli-env.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.findCliPackageRoot = findCliPackageRoot;
 exports.loadCliDotenv = loadCliDotenv;
 /**
  * Loads `cli/.env` when not running under Jest.
@@ -16,9 +17,12 @@ const node_path_1 = __importDefault(require("node:path"));
 const dotenv_1 = require("dotenv");
 const CLI_PACKAGE_NAME = "@dataparade/cli";
 const tried = { current: false };
+/** @internal Exported for unit tests. */
 function findCliPackageRoot(startDir) {
     let dir = node_path_1.default.resolve(startDir);
     const { root } = node_path_1.default.parse(dir);
+    /** Fallback when tsc emits package.json under dist/ but no outer root is found. */
+    let distPackageRoot;
     while (dir !== root) {
         const pkgPath = node_path_1.default.join(dir, "package.json");
         if (node_fs_1.default.existsSync(pkgPath)) {
@@ -26,7 +30,12 @@ function findCliPackageRoot(startDir) {
                 const raw = node_fs_1.default.readFileSync(pkgPath, "utf8");
                 const pkg = JSON.parse(raw);
                 if (pkg.name === CLI_PACKAGE_NAME) {
-                    return dir;
+                    if (node_path_1.default.basename(dir) === "dist") {
+                        distPackageRoot = dir;
+                    }
+                    else {
+                        return dir;
+                    }
                 }
             }
             catch {
@@ -35,7 +44,7 @@ function findCliPackageRoot(startDir) {
         }
         dir = node_path_1.default.dirname(dir);
     }
-    return undefined;
+    return distPackageRoot;
 }
 function loadCliDotenv() {
     if (tried.current)

package/dist/src/config/redact.js

@@ -10,5 +10,8 @@ function redactScanConfigurationForDisplay(config) {
     if (config.workspaceApiKey?.trim()) {
         redacted.workspaceApiKey = "<redacted>";
     }
+    if (config.anonSessionToken?.trim()) {
+        redacted.anonSessionToken = "<redacted>";
+    }
     return redacted;
 }

package/dist/src/config/validate-scan-ai.js

@@ -13,15 +13,20 @@ function validateAiInferenceCredentials(config) {
         Boolean(config.aiModel?.trim()) &&
         Boolean(config.aiApiKey?.trim());
     const hasWorkspace = Boolean(config.workspaceApiKey?.trim());
-    if (hasByok && hasWorkspace) {
-        errors.push("ai-inference: set either SCAN_BYOK_* (your LLM provider) or DATAPARADE_WORKSPACE_API_KEY (platform AI), not both");
+    const hasAnonSession = Boolean(config.anonSessionToken?.trim());
+    if (hasByok && (hasWorkspace || hasAnonSession)) {
+        errors.push("ai-inference: set either SCAN_BYOK_* (your LLM provider) or platform AI (DATAPARADE_WORKSPACE_API_KEY or anonymous session), not both");
         return errors;
     }
-    if (!hasByok && !hasWorkspace) {
-        errors.push("ai-inference: LLM inference requires SCAN_BYOK_PROVIDER, SCAN_BYOK_MODEL, and SCAN_BYOK_API_KEY, or DATAPARADE_WORKSPACE_API_KEY for platform AI");
+    if (hasWorkspace && hasAnonSession) {
+        errors.push("ai-inference: set either DATAPARADE_WORKSPACE_API_KEY or an anonymous AI session, not both");
+        return errors;
+    }
+    if (!hasByok && !hasWorkspace && !hasAnonSession) {
+        errors.push("ai-inference: LLM inference requires SCAN_BYOK_PROVIDER, SCAN_BYOK_MODEL, and SCAN_BYOK_API_KEY, DATAPARADE_WORKSPACE_API_KEY for platform AI, or an anonymous platform AI session");
     }
-    if (hasWorkspace && !config.cliQuotaJobId) {
-        errors.push("ai-inference: platform AI requires a quota preflight job id (pass DATAPARADE_WORKSPACE_API_KEY and ensure preflight succeeded)");
+    if ((hasWorkspace || hasAnonSession) && !config.cliQuotaJobId) {
+        errors.push("ai-inference: platform AI requires a quota/session job id (preflight or anonymous-session must succeed)");
     }
     return errors;
 }
@@ -32,7 +37,8 @@ function resolveAiMode(config) {
         return "hosted_worker";
     if (config.aiApiKey?.trim())
         return "byok";
-    if (config.workspaceApiKey?.trim())
+    if (config.workspaceApiKey?.trim() || config.anonSessionToken?.trim()) {
         return "platform";
+    }
     return "none";
 }

package/dist/src/core/pipeline/ai-orchestrator-options.js

@@ -8,7 +8,9 @@ function buildAgentOrchestratorOptions(config, opts) {
     const platformProvider = process.env.SCAN_WORKER_LLM_PROVIDER?.trim() ||
         "openai";
     const platformModel = process.env.SCAN_WORKER_LLM_MODEL?.trim() ||
-        config.aiModel?.trim() ||
+        (config.aiModel?.trim() && config.aiModel.trim() !== "heuristic"
+            ? config.aiModel.trim()
+            : undefined) ||
         "gpt-4o-mini";
     const base = {
         provider: aiMode === "platform"
@@ -29,11 +31,13 @@ function buildAgentOrchestratorOptions(config, opts) {
         skipStructuralHeuristics: opts.skipStructuralHeuristics,
     };
     if (aiMode === "platform" &&
-        config.workspaceApiKey?.trim() &&
-        config.cliQuotaJobId?.trim()) {
+        config.cliQuotaJobId?.trim() &&
+        (config.workspaceApiKey?.trim() || config.anonSessionToken?.trim())) {
         base.platformProxy = {
             apiBaseUrl: config.platformApiBaseUrl ?? (0, dataparade_api_base_url_1.getDataparadeApiBaseUrl)(),
-            workspaceApiKey: config.workspaceApiKey.trim(),
+            workspaceApiKey: (config.workspaceApiKey?.trim() ||
+                config.anonSessionToken?.trim() ||
+                ""),
             jobId: config.cliQuotaJobId.trim(),
         };
         base.apiKey = undefined;

package/dist/src/core/pipeline/orchestrator.js

@@ -27,7 +27,7 @@ function createDefaultScanConfiguration(overrides = {}) {
         languages: undefined,
         minimumConfidence: 0.5,
         deepAnalysis: false,
-        enableAiInference: false,
+        enableAiInference: true,
         aiProvider: "mock",
         aiModel: "heuristic",
         aiEndpoint: undefined,

package/dist/src/core/schema/scan-config.schema.d.ts

@@ -48,6 +48,7 @@ export declare const scanConfigurationSchema: z.ZodObject<{
     }>>;
     aiVerbose: z.ZodOptional<z.ZodBoolean>;
     workspaceApiKey: z.ZodOptional<z.ZodString>;
+    anonSessionToken: z.ZodOptional<z.ZodString>;
     aiMode: z.ZodOptional<z.ZodEnum<{
         byok: "byok";
         platform: "platform";

package/dist/src/core/schema/scan-config.schema.js

@@ -45,6 +45,7 @@ exports.scanConfigurationSchema = zod_1.z.object({
     aiInferenceScope: zod_1.z.enum(["default", "third_party_only"]).optional(),
     aiVerbose: zod_1.z.boolean().optional(),
     workspaceApiKey: zod_1.z.string().min(1).optional(),
+    anonSessionToken: zod_1.z.string().min(1).optional(),
     aiMode: zod_1.z.enum(["byok", "platform", "hosted_worker", "none"]).optional(),
     platformApiBaseUrl: zod_1.z.string().min(1).optional(),
     cliQuotaJobId: zod_1.z.string().min(1).optional(),

package/dist/src/core/types/config.d.ts

@@ -48,6 +48,11 @@ export interface ScanConfiguration {
     aiThirdPartyDataFlowEnabled?: boolean;
     /** DataParade workspace API key (quota + platform LLM proxy). */
     workspaceApiKey?: string;
+    /**
+     * Anonymous platform AI session token (`dp_anon_…`) from
+     * POST /api/scans/cli/ai/anonymous-session. Mutually exclusive with workspaceApiKey.
+     */
+    anonSessionToken?: string;
     /** How LLM inference is billed: byok (direct provider) or platform (API proxy). */
     aiMode?: "byok" | "platform" | "hosted_worker" | "none";
     /** Base URL for platform API (preflight / infer / complete). */

package/dist/src/platform-api/anonymous-ai-session-client.d.ts

@@ -0,0 +1,14 @@
+export type AnonymousAiSessionResponse = {
+    sessionToken: string;
+    jobId: string;
+    suggestedAiBudgetTokens: number;
+    expiresAt: string;
+    aiDelivery: "platform_proxy" | "none";
+};
+export declare class CliAnonymousIpLimitError extends Error {
+    readonly status = 429;
+    constructor(message: string);
+}
+export declare function cliAnonymousAiSession(input?: {
+    projectName?: string;
+}): Promise<AnonymousAiSessionResponse>;

package/dist/src/platform-api/anonymous-ai-session-client.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliAnonymousIpLimitError = void 0;
+exports.cliAnonymousAiSession = cliAnonymousAiSession;
+const dataparade_api_base_url_1 = require("./dataparade-api-base-url");
+class CliAnonymousIpLimitError extends Error {
+    constructor(message) {
+        super(message);
+        this.status = 429;
+        this.name = "CliAnonymousIpLimitError";
+    }
+}
+exports.CliAnonymousIpLimitError = CliAnonymousIpLimitError;
+async function cliAnonymousAiSession(input) {
+    const res = await fetch(`${(0, dataparade_api_base_url_1.getDataparadeApiBaseUrl)()}/api/scans/cli/ai/anonymous-session`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            projectName: input?.projectName,
+        }),
+    });
+    if (!res.ok) {
+        let message = `Anonymous AI session failed (${res.status})`;
+        try {
+            const body = (await res.json());
+            if (typeof body.message === "string")
+                message = body.message;
+            else if (Array.isArray(body.message))
+                message = body.message.join(", ");
+        }
+        catch {
+            // ignore
+        }
+        if (res.status === 429) {
+            throw new CliAnonymousIpLimitError(message);
+        }
+        throw new Error(message);
+    }
+    return (await res.json());
+}

package/dist/src/platform-api/read-cli-api-error-message.d.ts

@@ -0,0 +1,18 @@
+type NestedApiError = {
+    code?: string;
+    message?: string;
+};
+export type CliApiErrorBody = {
+    code?: string;
+    message?: string | string[] | NestedApiError;
+    statusCode?: number;
+};
+export declare function parseCliApiErrorBody(body: unknown): {
+    code?: string;
+    message?: string;
+};
+export declare function readCliApiErrorMessage(body: unknown, fallback: string): {
+    code?: string;
+    message: string;
+};
+export {};

package/dist/src/platform-api/read-cli-api-error-message.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCliApiErrorBody = parseCliApiErrorBody;
+exports.readCliApiErrorMessage = readCliApiErrorMessage;
+function parseCliApiErrorBody(body) {
+    if (!body || typeof body !== "object") {
+        return {};
+    }
+    const parsed = body;
+    if (typeof parsed.message === "string") {
+        return { code: parsed.code, message: parsed.message };
+    }
+    if (Array.isArray(parsed.message)) {
+        return { code: parsed.code, message: parsed.message.join(", ") };
+    }
+    if (parsed.message && typeof parsed.message === "object") {
+        const nested = parsed.message;
+        return {
+            code: nested.code ?? parsed.code,
+            message: typeof nested.message === "string" ? nested.message : undefined,
+        };
+    }
+    return { code: parsed.code };
+}
+function readCliApiErrorMessage(body, fallback) {
+    const parsed = parseCliApiErrorBody(body);
+    return {
+        code: parsed.code,
+        message: parsed.message ?? fallback,
+    };
+}

package/dist/src/platform-api/scan-quota-client.d.ts

@@ -3,6 +3,11 @@ export declare class CliScanQuotaExceededError extends Error {
     readonly code: "scan_quota_exceeded";
     constructor(message: string);
 }
+/** Thrown when preflight is rejected with HTTP 409 scan_already_running. */
+export declare class CliScanAlreadyRunningError extends Error {
+    readonly code: "scan_already_running";
+    constructor(message: string);
+}
 export type CliScanPreflightResponse = {
     allowed: boolean;
     jobId: string;