@cdot65/prisma-airs-cli 2.12.0 → 3.0.1

package/dist/chunk-JXHYQFEK.js

@@ -0,0 +1,1752 @@
+// src/airs/management.ts
+import {
+  ManagementClient
+} from "@cdot65/prisma-airs-sdk";
+var SdkManagementService = class {
+  client;
+  constructor(opts) {
+    this.client = getOrCreateManagementClient(opts);
+  }
+  async createTopic(request) {
+    return this.client.topics.create(request);
+  }
+  async updateTopic(topicId, request) {
+    return this.client.topics.update(topicId, request);
+  }
+  async deleteTopic(topicId) {
+    await this.client.topics.delete(topicId);
+  }
+  async forceDeleteTopic(topicId, updatedBy) {
+    const response = await this.client.topics.forceDelete(topicId, updatedBy);
+    return { message: response.message };
+  }
+  async listTopics() {
+    const response = await this.client.topics.list();
+    return response.custom_topics;
+  }
+  async getTopic(topicId) {
+    const topics = await this.listTopics();
+    const topic = topics.find((t) => t.topic_id === topicId);
+    if (!topic) throw new Error(`Topic ${topicId} not found`);
+    return topic;
+  }
+  async getTopicByName(topicName) {
+    const topics = await this.listTopics();
+    const topic = topics.find((t) => t.topic_name === topicName);
+    if (!topic) throw new Error(`Topic "${topicName}" not found`);
+    return topic;
+  }
+  /**
+   * Sets a single custom topic on a profile's topic-guardrails config.
+   * Delegates to {@link assignTopicsToProfile} for backward compatibility.
+   */
+  async assignTopicToProfile(profileName, topicId, topicName, action) {
+    return this.assignTopicsToProfile(profileName, [{ topicId, topicName, action }]);
+  }
+  /**
+   * Sets one or more custom topics on a profile's topic-guardrails config.
+   * Replaces any existing topics — previous runs' stale topics are cleared.
+   * Groups topics by action; skips empty action groups (AIRS rejects them).
+   *
+   * CRITICAL: Each topic entry MUST include the current `revision` number.
+   * AIRS pins topic content to the revision specified in the profile — omitting
+   * it defaults to revision 0 (original content), not the latest.
+   */
+  async assignTopicsToProfile(profileName, topics, guardrailAction) {
+    const { ai_profiles } = await this.client.profiles.list();
+    const profile = ai_profiles.find((p) => p.profile_name === profileName);
+    if (!profile?.profile_id) {
+      throw new Error(`Profile "${profileName}" not found`);
+    }
+    const allTopics = await this.listTopics();
+    const revisionMap = new Map(allTopics.map((t) => [t.topic_id, t.revision ?? 0]));
+    const policy = JSON.parse(JSON.stringify(profile.policy ?? {}));
+    const aiProfiles = policy["ai-security-profiles"] ?? [
+      { "model-type": "default", "model-configuration": {} }
+    ];
+    const modelConfig = aiProfiles[0]?.["model-configuration"] ?? {};
+    const modelProtection = modelConfig["model-protection"] ?? [];
+    let topicGuardrails = modelProtection.find((mp) => mp.name === "topic-guardrails");
+    if (!topicGuardrails) {
+      topicGuardrails = {
+        action: "block",
+        name: "topic-guardrails",
+        options: [],
+        "topic-list": []
+      };
+      modelProtection.push(topicGuardrails);
+    }
+    topicGuardrails.action = guardrailAction ?? "block";
+    const byAction = /* @__PURE__ */ new Map();
+    for (const t of topics) {
+      const group = byAction.get(t.action) ?? [];
+      group.push({
+        topic_id: t.topicId,
+        topic_name: t.topicName,
+        revision: revisionMap.get(t.topicId) ?? 0
+      });
+      byAction.set(t.action, group);
+    }
+    const topicList = [];
+    for (const [action, group] of byAction) {
+      topicList.push({ action, topic: group });
+    }
+    topicGuardrails["topic-list"] = topicList;
+    modelConfig["model-protection"] = modelProtection;
+    aiProfiles[0]["model-configuration"] = modelConfig;
+    policy["ai-security-profiles"] = aiProfiles;
+    await this.client.profiles.update(profile.profile_id, {
+      profile_name: profile.profile_name,
+      active: profile.active,
+      policy
+    });
+  }
+  async getProfileTopics(profileName) {
+    const { ai_profiles } = await this.client.profiles.list();
+    const profile = ai_profiles.find((p) => p.profile_name === profileName);
+    if (!profile?.profile_id) {
+      throw new Error(`Profile "${profileName}" not found`);
+    }
+    const policy = profile.policy ?? {};
+    const aiProfiles = policy["ai-security-profiles"] ?? [];
+    const modelConfig = aiProfiles[0]?.["model-configuration"] ?? {};
+    const modelProtection = modelConfig["model-protection"] ?? [];
+    const topicGuardrails = modelProtection.find((mp) => mp.name === "topic-guardrails");
+    if (!topicGuardrails) return [];
+    const topicList = topicGuardrails["topic-list"] ?? [];
+    const topicRefs = [];
+    for (const entry of topicList) {
+      for (const t of entry.topic ?? []) {
+        topicRefs.push({
+          topicId: t.topic_id,
+          topicName: t.topic_name,
+          action: entry.action
+        });
+      }
+    }
+    if (topicRefs.length === 0) return [];
+    const allTopics = await this.listTopics();
+    const topicMap = new Map(allTopics.map((t) => [t.topic_id, t]));
+    return topicRefs.map((ref) => {
+      const full = topicMap.get(ref.topicId);
+      return {
+        topicId: ref.topicId,
+        topicName: ref.topicName,
+        action: ref.action,
+        description: full?.description ?? "",
+        examples: full?.examples ?? []
+      };
+    });
+  }
+  // -------------------------------------------------------------------------
+  // Profile CRUD
+  // -------------------------------------------------------------------------
+  normalizeProfile(p) {
+    return {
+      profileId: p.profile_id,
+      profileName: p.profile_name,
+      revision: p.revision,
+      active: p.active,
+      createdBy: p.created_by,
+      updatedBy: p.updated_by,
+      lastModifiedTs: p.last_modified_ts,
+      policy: p.policy
+    };
+  }
+  async getProfile(profileId) {
+    const response = await this.client.profiles.get(profileId);
+    return this.normalizeProfile(response);
+  }
+  async getProfileByName(profileName) {
+    const response = await this.client.profiles.getByName(profileName);
+    return this.normalizeProfile(response);
+  }
+  async listProfiles(opts) {
+    const response = await this.client.profiles.list(opts);
+    return {
+      profiles: (response.ai_profiles ?? []).map(
+        (p) => this.normalizeProfile(p)
+      ),
+      nextOffset: response.next_offset
+    };
+  }
+  async createProfile(request) {
+    const response = await this.client.profiles.create(request);
+    return this.normalizeProfile(response);
+  }
+  async updateProfile(profileId, request) {
+    const response = await this.client.profiles.update(profileId, request);
+    return this.normalizeProfile(response);
+  }
+  async deleteProfile(profileId) {
+    const response = await this.client.profiles.delete(profileId);
+    return { message: response.message };
+  }
+  async forceDeleteProfile(profileId, updatedBy) {
+    const response = await this.client.profiles.forceDelete(profileId, updatedBy);
+    return { message: response.message };
+  }
+  // -------------------------------------------------------------------------
+  // API Keys
+  // -------------------------------------------------------------------------
+  normalizeApiKey(k) {
+    return {
+      id: k.id ?? k.api_key_id ?? "",
+      name: k.name ?? k.api_key_name ?? "",
+      apiKey: k.api_key,
+      last8: k.api_key_last8,
+      createdAt: k.created_at,
+      expiresAt: k.expires_at
+    };
+  }
+  async listApiKeys(opts) {
+    const response = await this.client.apiKeys.list(opts);
+    const raw = response;
+    const keys = raw.api_keys ?? [];
+    return {
+      apiKeys: keys.map((k) => this.normalizeApiKey(k)),
+      nextOffset: raw.next_offset
+    };
+  }
+  async createApiKey(request) {
+    const response = await this.client.apiKeys.create(request);
+    return this.normalizeApiKey(response);
+  }
+  async regenerateApiKey(apiKeyId, request) {
+    const response = await this.client.apiKeys.regenerate(apiKeyId, request);
+    return this.normalizeApiKey(response);
+  }
+  async deleteApiKey(apiKeyName, updatedBy) {
+    const response = await this.client.apiKeys.delete(apiKeyName, updatedBy);
+    return { message: response.message };
+  }
+  // -------------------------------------------------------------------------
+  // Customer Apps
+  // -------------------------------------------------------------------------
+  normalizeCustomerApp(a) {
+    return {
+      id: a.customer_app_id ?? a.id,
+      name: a.app_name ?? a.name ?? "",
+      description: a.description,
+      raw: a
+    };
+  }
+  async listCustomerApps(opts) {
+    const response = await this.client.customerApps.list(opts);
+    const raw = response;
+    const apps = raw.customer_apps ?? [];
+    return {
+      apps: apps.map((a) => this.normalizeCustomerApp(a)),
+      nextOffset: raw.next_offset
+    };
+  }
+  async getCustomerApp(appName) {
+    const response = await this.client.customerApps.get(appName);
+    return this.normalizeCustomerApp(response);
+  }
+  async updateCustomerApp(appId, request) {
+    const response = await this.client.customerApps.update(appId, request);
+    return this.normalizeCustomerApp(response);
+  }
+  async deleteCustomerApp(appName, updatedBy) {
+    const response = await this.client.customerApps.delete(appName, updatedBy);
+    return this.normalizeCustomerApp(response);
+  }
+  async listConsumptionApps(opts) {
+    const response = await this.client.dashboard.applicationsOverview({
+      limit: opts?.limit ?? 100,
+      offset: opts?.offset ?? 0
+    });
+    return (response.items ?? []).filter(
+      (item) => typeof item.id === "string" && typeof item.name === "string"
+    ).map((item) => ({
+      appId: item.id,
+      appName: item.name,
+      cloud: item.cloud ?? void 0,
+      source: item.source ?? void 0
+    }));
+  }
+  async getCustomerAppConsumption(appName, opts) {
+    const dashboardApps = await this.listConsumptionApps({ limit: 100 });
+    const target = dashboardApps.find((a) => a.appName === appName);
+    const appId = target?.appId;
+    if (!appId) {
+      const sample = dashboardApps.slice(0, 5).map((a) => `"${a.appName}"`).join(", ");
+      const more = dashboardApps.length > 5 ? `, ... (${dashboardApps.length} total)` : "";
+      throw new Error(
+        `Dashboard application not found: "${appName}". Available (as shown in SCM AI Applications view): ${sample}${more}. Note: the name to use is the literal value your integration sends in scan metadata.app_name (which may differ from the SCM application name).`
+      );
+    }
+    const timeInterval = opts?.timeInterval ?? 30;
+    const query = { appId, appName, timeInterval };
+    const [overview, breakdown] = await Promise.all([
+      this.client.dashboard.application(query),
+      this.client.dashboard.applicationViolationBreakdown(query)
+    ]);
+    const ts = overview.token_stats ?? {};
+    const ss = overview.session_stats ?? {};
+    const detectors = (breakdown.detection_type_violation_breakdown ?? []).map((entry) => {
+      const vb = entry.violation_breakdown ?? {};
+      return {
+        type: entry.detection_type ?? "unknown",
+        critical: vb.critical ?? 0,
+        high: vb.high ?? 0,
+        medium: vb.medium ?? 0,
+        low: vb.low ?? 0,
+        total: vb.total ?? 0
+      };
+    });
+    return {
+      appId,
+      appName,
+      cloud: overview.cloud ?? void 0,
+      source: overview.source ?? void 0,
+      monitoringSince: overview.created_at ?? void 0,
+      profiles: overview.profiles ?? [],
+      tokens: {
+        dailyAverage: ts.average_daily_tokens ?? void 0,
+        dailyAverageScale: ts.average_daily_tokens_scale ?? void 0,
+        monthlyTotal: ts.monthly_total_tokens ?? void 0,
+        monthlyTotalScale: ts.monthly_total_tokens_scale ?? void 0
+      },
+      sessions: {
+        total: ss.total ?? 0,
+        violating: ss.violating ?? 0
+      },
+      detectors,
+      totalViolating: breakdown.total_violating ?? 0
+    };
+  }
+  // -------------------------------------------------------------------------
+  // Deployment Profiles (read-only)
+  // -------------------------------------------------------------------------
+  async listDeploymentProfiles(opts) {
+    const response = await this.client.deploymentProfiles.list(opts);
+    const raw = response;
+    const profiles = raw.deployment_profiles ?? [];
+    return profiles.map((p) => ({ raw: p }));
+  }
+  // -------------------------------------------------------------------------
+  // Scan Logs
+  // -------------------------------------------------------------------------
+  async queryScanLogs(opts) {
+    const response = await this.client.scanLogs.query({
+      time_interval: opts.timeInterval,
+      time_unit: opts.timeUnit,
+      pageNumber: opts.pageNumber,
+      pageSize: opts.pageSize,
+      filter: opts.filter,
+      page_token: opts.pageToken
+    });
+    const raw = response;
+    const dashboard = raw.scan_result_for_dashboard ?? {};
+    const entries = dashboard.scan_result_entries ?? raw.results ?? [];
+    return {
+      results: entries,
+      pageToken: raw.page_token,
+      raw
+    };
+  }
+};
+var _sharedClient;
+function getOrCreateManagementClient(opts) {
+  if (!_sharedClient) {
+    _sharedClient = new ManagementClient(opts);
+  }
+  return _sharedClient;
+}
+
+// src/airs/modelsecurity.ts
+import { ModelSecurityClient } from "@cdot65/prisma-airs-sdk";
+function normalizeGroup(raw) {
+  return {
+    uuid: raw.uuid,
+    name: raw.name,
+    description: raw.description,
+    sourceType: raw.source_type,
+    state: raw.state,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at
+  };
+}
+function normalizeRuleInstance(raw) {
+  return {
+    uuid: raw.uuid,
+    securityGroupUuid: raw.security_group_uuid,
+    securityRuleUuid: raw.security_rule_uuid,
+    state: raw.state,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at,
+    rule: raw.rule,
+    fieldValues: raw.field_values ?? {}
+  };
+}
+function normalizeRule(raw) {
+  const editableFields = raw.editable_fields ?? [];
+  return {
+    uuid: raw.uuid,
+    name: raw.name,
+    description: raw.description,
+    ruleType: raw.rule_type,
+    compatibleSources: raw.compatible_sources,
+    defaultState: raw.default_state,
+    remediation: raw.remediation,
+    editableFields: editableFields.map(
+      (f) => ({
+        attributeName: f.attribute_name,
+        type: f.type,
+        displayName: f.display_name,
+        displayType: f.display_type,
+        description: f.description,
+        dropdownValues: f.dropdown_values
+      })
+    ),
+    constantValues: raw.constant_values ?? {},
+    defaultValues: raw.default_values ?? {}
+  };
+}
+function normalizeScan(raw) {
+  const summary = raw.eval_summary;
+  return {
+    uuid: raw.uuid,
+    evalOutcome: raw.eval_outcome ?? "",
+    modelUri: raw.model_uri ?? "",
+    scanOrigin: raw.scan_origin ?? "",
+    sourceType: raw.source_type ?? "",
+    securityGroupName: raw.security_group_name ?? "",
+    evalSummary: summary ? {
+      rulesFailed: summary.rules_failed ?? 0,
+      rulesPassed: summary.rules_passed ?? 0,
+      totalRules: summary.total_rules ?? 0
+    } : null,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at,
+    labels: raw.labels ?? []
+  };
+}
+function normalizeEvaluation(raw) {
+  return {
+    uuid: raw.uuid,
+    result: raw.result,
+    violationCount: raw.violation_count ?? 0,
+    ruleInstanceUuid: raw.rule_instance_uuid ?? "",
+    ruleName: raw.rule_name,
+    ruleDescription: raw.rule_description ?? "",
+    ruleInstanceState: raw.rule_instance_state ?? ""
+  };
+}
+function normalizeViolation(raw) {
+  return {
+    uuid: raw.uuid,
+    description: raw.description,
+    threat: raw.threat ?? "",
+    threatDescription: raw.threat_description ?? "",
+    file: raw.file ?? "",
+    ruleName: raw.rule_name,
+    ruleDescription: raw.rule_description ?? "",
+    ruleInstanceState: raw.rule_instance_state ?? ""
+  };
+}
+function normalizeFile(raw) {
+  return {
+    uuid: raw.uuid,
+    path: raw.path ?? "",
+    type: raw.type,
+    formats: raw.formats ?? [],
+    result: raw.result
+  };
+}
+var SdkModelSecurityService = class {
+  client;
+  constructor(opts) {
+    this.client = new ModelSecurityClient(opts);
+  }
+  // -----------------------------------------------------------------------
+  // Security Groups
+  // -----------------------------------------------------------------------
+  async listGroups(opts) {
+    const sdkOpts = {};
+    if (opts?.sourceTypes) sdkOpts.source_types = opts.sourceTypes;
+    if (opts?.searchQuery) sdkOpts.search_query = opts.searchQuery;
+    if (opts?.sortField) sdkOpts.sort_field = opts.sortField;
+    if (opts?.sortDir) sdkOpts.sort_dir = opts.sortDir;
+    if (opts?.enabledRules) sdkOpts.enabled_rules = opts.enabledRules;
+    if (opts?.skip !== void 0) sdkOpts.skip = opts.skip;
+    if (opts?.limit !== void 0) sdkOpts.limit = opts.limit;
+    const response = await this.client.securityGroups.list(sdkOpts);
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      groups: raw.security_groups.map(normalizeGroup)
+    };
+  }
+  async getGroup(uuid) {
+    const response = await this.client.securityGroups.get(uuid);
+    return normalizeGroup(response);
+  }
+  async createGroup(request) {
+    const sdkRequest = {
+      name: request.name,
+      source_type: request.sourceType
+    };
+    if (request.description !== void 0) sdkRequest.description = request.description;
+    if (request.ruleConfigurations) sdkRequest.rule_configurations = request.ruleConfigurations;
+    const response = await this.client.securityGroups.create(sdkRequest);
+    return normalizeGroup(response);
+  }
+  async updateGroup(uuid, request) {
+    const response = await this.client.securityGroups.update(uuid, request);
+    return normalizeGroup(response);
+  }
+  async deleteGroup(uuid) {
+    await this.client.securityGroups.delete(uuid);
+  }
+  /**
+   * Delete a group, then verify whether it is actually gone. The API soft/async-deletes
+   * security groups — a successful DELETE does not immediately remove the resource, so a
+   * follow-up `get` may still return it as ACTIVE (see prisma-airs-cli#239). The SDK delete
+   * returns void, so re-reading is the only way to report the real outcome rather than
+   * claiming an unconditional success. Returns `{ confirmed: true }` when the group no longer
+   * resolves, or `{ confirmed: false, state }` when it still does.
+   */
+  async deleteGroupAndVerify(uuid) {
+    await this.deleteGroup(uuid);
+    try {
+      const group = await this.getGroup(uuid);
+      return { confirmed: false, state: group.state };
+    } catch {
+      return { confirmed: true };
+    }
+  }
+  // -----------------------------------------------------------------------
+  // Rule Instances
+  // -----------------------------------------------------------------------
+  async listRuleInstances(groupUuid, opts) {
+    const sdkOpts = {};
+    if (opts?.securityRuleUuid) sdkOpts.security_rule_uuid = opts.securityRuleUuid;
+    if (opts?.state) sdkOpts.state = opts.state;
+    if (opts?.skip !== void 0) sdkOpts.skip = opts.skip;
+    if (opts?.limit !== void 0) sdkOpts.limit = opts.limit;
+    const response = await this.client.securityGroups.listRuleInstances(
+      groupUuid,
+      sdkOpts
+    );
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      ruleInstances: raw.rule_instances.map(normalizeRuleInstance)
+    };
+  }
+  async getRuleInstance(groupUuid, instanceUuid) {
+    const response = await this.client.securityGroups.getRuleInstance(groupUuid, instanceUuid);
+    return normalizeRuleInstance(response);
+  }
+  async updateRuleInstance(groupUuid, instanceUuid, request) {
+    const sdkRequest = {
+      security_group_uuid: groupUuid
+    };
+    if (request.state !== void 0) sdkRequest.state = request.state;
+    if (request.fieldValues !== void 0) sdkRequest.field_values = request.fieldValues;
+    const response = await this.client.securityGroups.updateRuleInstance(
+      groupUuid,
+      instanceUuid,
+      sdkRequest
+    );
+    return normalizeRuleInstance(response);
+  }
+  // -----------------------------------------------------------------------
+  // Security Rules
+  // -----------------------------------------------------------------------
+  async listRules(opts) {
+    const sdkOpts = {};
+    if (opts?.sourceType) sdkOpts.source_type = opts.sourceType;
+    if (opts?.searchQuery) sdkOpts.search_query = opts.searchQuery;
+    if (opts?.skip !== void 0) sdkOpts.skip = opts.skip;
+    if (opts?.limit !== void 0) sdkOpts.limit = opts.limit;
+    const response = await this.client.securityRules.list(sdkOpts);
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      rules: raw.rules.map(normalizeRule)
+    };
+  }
+  async getRule(uuid) {
+    const response = await this.client.securityRules.get(uuid);
+    return normalizeRule(response);
+  }
+  // -----------------------------------------------------------------------
+  // Scans
+  // -----------------------------------------------------------------------
+  async createScan(request) {
+    const response = await this.client.scans.create(request);
+    return normalizeScan(response);
+  }
+  async listScans(opts) {
+    const sdkOpts = {};
+    if (opts?.evalOutcome) sdkOpts.eval_outcome = opts.evalOutcome;
+    if (opts?.sourceType) sdkOpts.source_type = opts.sourceType;
+    if (opts?.scanOrigin) sdkOpts.scan_origin = opts.scanOrigin;
+    if (opts?.search) sdkOpts.search = opts.search;
+    if (opts?.skip !== void 0) sdkOpts.skip = opts.skip;
+    if (opts?.limit !== void 0) sdkOpts.limit = opts.limit;
+    const response = await this.client.scans.list(sdkOpts);
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      scans: raw.scans.map(normalizeScan)
+    };
+  }
+  async getScan(uuid) {
+    const response = await this.client.scans.get(uuid);
+    return normalizeScan(response);
+  }
+  // -----------------------------------------------------------------------
+  // Evaluations
+  // -----------------------------------------------------------------------
+  async getEvaluations(scanUuid, opts) {
+    const response = await this.client.scans.getEvaluations(scanUuid, opts);
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      evaluations: raw.evaluations.map(normalizeEvaluation)
+    };
+  }
+  async getEvaluation(uuid) {
+    const response = await this.client.scans.getEvaluation(uuid);
+    return normalizeEvaluation(response);
+  }
+  // -----------------------------------------------------------------------
+  // Violations
+  // -----------------------------------------------------------------------
+  async getViolations(scanUuid, opts) {
+    const response = await this.client.scans.getViolations(scanUuid, opts);
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      violations: raw.violations.map(normalizeViolation)
+    };
+  }
+  async getViolation(uuid) {
+    const response = await this.client.scans.getViolation(uuid);
+    return normalizeViolation(response);
+  }
+  // -----------------------------------------------------------------------
+  // Files
+  // -----------------------------------------------------------------------
+  async getFiles(scanUuid, opts) {
+    const response = await this.client.scans.getFiles(scanUuid, opts);
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      files: raw.files.map(normalizeFile)
+    };
+  }
+  // -----------------------------------------------------------------------
+  // Labels
+  // -----------------------------------------------------------------------
+  async addLabels(scanUuid, labels) {
+    await this.client.scans.addLabels(scanUuid, { labels });
+  }
+  async setLabels(scanUuid, labels) {
+    await this.client.scans.setLabels(scanUuid, { labels });
+  }
+  async deleteLabels(scanUuid, keys) {
+    await this.client.scans.deleteLabels(scanUuid, keys);
+  }
+  async getLabelKeys(opts) {
+    const response = await this.client.scans.getLabelKeys(opts);
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      keys: raw.keys
+    };
+  }
+  async getLabelValues(key, opts) {
+    const response = await this.client.scans.getLabelValues(key, opts);
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      values: raw.values
+    };
+  }
+  // -----------------------------------------------------------------------
+  // PyPI Auth
+  // -----------------------------------------------------------------------
+  async getPyPIAuth() {
+    const response = await this.client.getPyPIAuth();
+    const raw = response;
+    return {
+      url: raw.url,
+      expiresAt: raw.expires_at
+    };
+  }
+};
+
+// src/airs/promptsets.ts
+import { RedTeamClient } from "@cdot65/prisma-airs-sdk";
+function normalizePromptSet(raw) {
+  return {
+    uuid: raw.uuid,
+    name: raw.name,
+    active: raw.active,
+    archive: raw.archive,
+    description: raw.description,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at
+  };
+}
+function normalizePrompt(raw) {
+  return {
+    uuid: raw.uuid,
+    prompt: raw.prompt,
+    goal: raw.goal,
+    active: raw.active,
+    promptSetId: raw.prompt_set_id
+  };
+}
+var SdkPromptSetService = class {
+  client;
+  constructor(opts) {
+    this.client = new RedTeamClient(opts);
+  }
+  async createPromptSet(name, description) {
+    const response = await this.client.customAttacks.createPromptSet({
+      name,
+      ...description ? { description } : {}
+    });
+    return { uuid: response.uuid, name: response.name };
+  }
+  async addPrompt(promptSetId, prompt, goal) {
+    const response = await this.client.customAttacks.createPrompt({
+      prompt,
+      prompt_set_id: promptSetId,
+      ...goal ? { goal } : {}
+    });
+    return { uuid: response.uuid, prompt: response.prompt };
+  }
+  async listPromptSets() {
+    const response = await this.client.customAttacks.listPromptSets();
+    return (response.data ?? []).map((ps) => ({
+      uuid: ps.uuid,
+      name: ps.name,
+      active: ps.active
+    }));
+  }
+  async getPromptSet(uuid) {
+    const response = await this.client.customAttacks.getPromptSet(uuid);
+    return normalizePromptSet(response);
+  }
+  async updatePromptSet(uuid, request) {
+    const response = await this.client.customAttacks.updatePromptSet(uuid, request);
+    return normalizePromptSet(response);
+  }
+  async archivePromptSet(uuid, archive) {
+    await this.client.customAttacks.archivePromptSet(uuid, { archive });
+  }
+  async getPromptSetVersionInfo(uuid) {
+    const response = await this.client.customAttacks.getPromptSetVersionInfo(uuid);
+    const raw = response;
+    return {
+      uuid: raw.uuid,
+      version: raw.version,
+      stats: raw.stats
+    };
+  }
+  /**
+   * Fetch a prompt set and its version info in one call, degrading gracefully when the
+   * version-info endpoint is unavailable. The upstream `/version-info` route currently
+   * returns 500 for every prompt set (see prisma-airs-cli#117); without this, a 500 there
+   * would abort the whole `prompt-sets get` command even though the set itself fetched fine.
+   * The set is always returned; `versionInfo` is `undefined` when that lookup fails.
+   */
+  async getPromptSetWithVersionInfo(uuid) {
+    const set = await this.getPromptSet(uuid);
+    let versionInfo;
+    try {
+      versionInfo = await this.getPromptSetVersionInfo(uuid);
+    } catch {
+      versionInfo = void 0;
+    }
+    return { set, versionInfo };
+  }
+  async downloadTemplate(uuid) {
+    return this.client.customAttacks.downloadTemplate(uuid);
+  }
+  async uploadPromptsCsv(uuid, file) {
+    const response = await this.client.customAttacks.uploadPromptsCsv(uuid, file);
+    return response;
+  }
+  async listPrompts(setUuid, opts) {
+    const response = await this.client.customAttacks.listPrompts(setUuid, opts);
+    return response.data.map(normalizePrompt);
+  }
+  async getPrompt(setUuid, promptUuid) {
+    const response = await this.client.customAttacks.getPrompt(setUuid, promptUuid);
+    return normalizePrompt(response);
+  }
+  async updatePrompt(setUuid, promptUuid, request) {
+    const response = await this.client.customAttacks.updatePrompt(
+      setUuid,
+      promptUuid,
+      request
+    );
+    return normalizePrompt(response);
+  }
+  async deletePrompt(setUuid, promptUuid) {
+    await this.client.customAttacks.deletePrompt(setUuid, promptUuid);
+  }
+  async getPropertyNames() {
+    const response = await this.client.customAttacks.getPropertyNames();
+    const raw = response;
+    return raw.data ?? [];
+  }
+  async createPropertyName(name) {
+    const response = await this.client.customAttacks.createPropertyName({ name });
+    return response;
+  }
+  async getPropertyValues(name) {
+    const response = await this.client.customAttacks.getPropertyValues(name);
+    const raw = response;
+    return { name: raw.name ?? name, values: raw.values ?? [] };
+  }
+  async createPropertyValue(name, value) {
+    const response = await this.client.customAttacks.createPropertyValue({
+      property_name: name,
+      property_value: value
+    });
+    return response;
+  }
+};
+
+// src/airs/redteam.ts
+import { RedTeamClient as RedTeamClient2 } from "@cdot65/prisma-airs-sdk";
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["COMPLETED", "PARTIALLY_COMPLETE", "FAILED", "ABORTED"]);
+var DEFAULT_DYNAMIC_BREADTH = 6;
+var DEFAULT_DYNAMIC_DEPTH = 10;
+function normalizeJob(raw) {
+  const target = raw.target;
+  return {
+    uuid: raw.uuid,
+    name: raw.name,
+    status: raw.status,
+    jobType: raw.job_type,
+    targetId: raw.target_id,
+    targetName: target?.name,
+    score: raw.score,
+    asr: raw.asr,
+    total: raw.total,
+    completed: raw.completed,
+    createdAt: raw.created_at
+  };
+}
+var REPORT_SUMMARY_TOKENS = {
+  "{{CRITICAL_RISK}}": "critical risk",
+  "{{HIGH_RISK}}": "high risk",
+  "{{MEDIUM_RISK}}": "medium risk",
+  "{{LOW_RISK}}": "low risk",
+  "{{INFORMATIONAL_RISK}}": "informational risk"
+};
+function interpolateReportSummary(summary) {
+  if (summary == null || summary === "") return summary;
+  let out = summary;
+  for (const [token, replacement] of Object.entries(REPORT_SUMMARY_TOKENS)) {
+    if (out.includes(token)) out = out.split(token).join(replacement);
+  }
+  return out;
+}
+function sanitizeTargetMetadata(metadata) {
+  if (!metadata) return metadata;
+  if (metadata.multi_turn === false && "multi_turn_error_message" in metadata) {
+    const { multi_turn_error_message: _drop, ...rest } = metadata;
+    return rest;
+  }
+  return metadata;
+}
+function normalizeTargetDetail(raw) {
+  return {
+    uuid: raw.uuid,
+    name: raw.name,
+    status: raw.status,
+    targetType: raw.target_type,
+    active: raw.active,
+    connectionType: raw.connection_type,
+    apiEndpointType: raw.api_endpoint_type,
+    responseMode: raw.response_mode,
+    authType: raw.auth_type,
+    authConfig: raw.auth_config,
+    networkBrokerChannelUuid: raw.network_broker_channel_uuid,
+    sessionSupported: raw.session_supported,
+    extraInfo: raw.extra_info,
+    description: raw.description,
+    connectionParams: raw.connection_params,
+    background: raw.target_background,
+    additionalContext: raw.additional_context,
+    metadata: sanitizeTargetMetadata(raw.target_metadata)
+  };
+}
+var SdkRedTeamService = class {
+  client;
+  constructor(opts) {
+    this.client = new RedTeamClient2(opts);
+  }
+  async getEulaContent() {
+    const response = await this.client.eula.getContent();
+    return { content: response.content };
+  }
+  async getEulaStatus() {
+    const raw = await this.client.eula.getStatus();
+    return {
+      isAccepted: raw.is_accepted,
+      acceptedAt: raw.accepted_at,
+      acceptedByUserId: raw.accepted_by_user_id
+    };
+  }
+  async acceptEula(eulaContent) {
+    const raw = await this.client.eula.accept({
+      eula_content: eulaContent,
+      accepted_at: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return {
+      isAccepted: raw.is_accepted,
+      acceptedAt: raw.accepted_at,
+      acceptedByUserId: raw.accepted_by_user_id
+    };
+  }
+  async createInstance(request) {
+    const raw = await this.client.instances.createInstance({
+      tsg_id: request.tsgId,
+      tenant_id: request.tenantId,
+      app_id: request.appId,
+      region: request.region
+    });
+    return {
+      tsgId: raw.tsg_id,
+      tenantId: raw.tenant_id,
+      appId: raw.app_id,
+      isSuccess: raw.is_success
+    };
+  }
+  async getInstance(tenantId) {
+    const raw = await this.client.instances.getInstance(tenantId);
+    return {
+      tsgId: raw.tsg_id,
+      tenantId: raw.tenant_id,
+      appId: raw.app_id,
+      region: raw.region
+    };
+  }
+  async updateInstance(tenantId, request) {
+    const raw = await this.client.instances.updateInstance(tenantId, {
+      tsg_id: request.tsgId,
+      tenant_id: request.tenantId,
+      app_id: request.appId,
+      region: request.region
+    });
+    return {
+      tsgId: raw.tsg_id,
+      tenantId: raw.tenant_id,
+      appId: raw.app_id,
+      isSuccess: raw.is_success
+    };
+  }
+  async deleteInstance(tenantId) {
+    const raw = await this.client.instances.deleteInstance(tenantId);
+    return {
+      tsgId: raw.tsg_id,
+      tenantId: raw.tenant_id,
+      appId: raw.app_id,
+      isSuccess: raw.is_success
+    };
+  }
+  async createDevices(tenantId, request) {
+    return await this.client.instances.createDevices(tenantId, request);
+  }
+  async updateDevices(tenantId, request) {
+    return await this.client.instances.updateDevices(tenantId, request);
+  }
+  async deleteDevices(tenantId, serialNumbers) {
+    return await this.client.instances.deleteDevices(tenantId, serialNumbers);
+  }
+  async getRegistryCredentials() {
+    const raw = await this.client.instances.getRegistryCredentials();
+    return {
+      token: raw.token,
+      expiry: raw.expiry
+    };
+  }
+  async validateTargetAuth(request) {
+    const sdkRequest = {
+      auth_type: request.authType,
+      auth_config: request.authConfig
+    };
+    if (request.targetId) sdkRequest.target_id = request.targetId;
+    const raw = await this.client.targets.validateAuth(sdkRequest);
+    return {
+      validated: raw.validated,
+      tokenPreview: raw.token_preview,
+      expiresIn: raw.expires_in
+    };
+  }
+  async getTargetMetadata() {
+    return await this.client.targets.getTargetMetadata();
+  }
+  async getTargetTemplates() {
+    return await this.client.targets.getTargetTemplates();
+  }
+  async listTargets() {
+    const all = [];
+    let skip = 0;
+    const limit = 100;
+    for (; ; ) {
+      const response = this.client.targets.list({ skip, limit });
+      const body = await response;
+      const data = body.data;
+      for (const t of data) {
+        all.push({
+          uuid: t.uuid,
+          name: t.name,
+          status: t.status,
+          targetType: t.target_type,
+          active: t.active
+        });
+      }
+      const pagination = body.pagination;
+      if (!pagination || all.length >= (pagination.total ?? data.length) || data.length < limit) {
+        break;
+      }
+      skip += limit;
+    }
+    return all;
+  }
+  async getTarget(uuid) {
+    const response = await this.client.targets.get(uuid);
+    return normalizeTargetDetail(response);
+  }
+  async createTarget(request, opts) {
+    const response = await this.client.targets.create(request, opts);
+    return normalizeTargetDetail(response);
+  }
+  async updateTarget(uuid, request, opts) {
+    const response = await this.client.targets.update(uuid, request, opts);
+    return normalizeTargetDetail(response);
+  }
+  async deleteTarget(uuid) {
+    await this.client.targets.delete(uuid);
+  }
+  async probeTarget(request) {
+    const response = await this.client.targets.probe(request);
+    const raw = response;
+    const meta = raw.target_metadata;
+    if (meta && typeof meta === "object") {
+      raw.target_metadata = sanitizeTargetMetadata(meta);
+    }
+    return raw;
+  }
+  async getTargetProfile(uuid) {
+    const response = await this.client.targets.getProfile(uuid);
+    return response;
+  }
+  async updateTargetProfile(uuid, request) {
+    const response = await this.client.targets.updateProfile(uuid, request);
+    return response;
+  }
+  async createScan(request) {
+    let jobMetadata = {};
+    if (request.jobType === "STATIC" && request.categories) {
+      jobMetadata = { categories: request.categories };
+    } else if (request.jobType === "CUSTOM" && request.customPromptSets) {
+      jobMetadata = {
+        custom_prompt_sets: request.customPromptSets
+      };
+    } else if (request.jobType === "DYNAMIC") {
+      jobMetadata = {
+        stream_breadth: request.streamBreadth ?? DEFAULT_DYNAMIC_BREADTH,
+        stream_depth: request.streamDepth ?? DEFAULT_DYNAMIC_DEPTH,
+        ...request.attackGoals?.length ? { attack_goals: request.attackGoals } : {}
+      };
+    }
+    const response = await this.client.scans.create({
+      name: request.name,
+      target: { uuid: request.targetUuid },
+      job_type: request.jobType,
+      job_metadata: jobMetadata
+    });
+    return normalizeJob(response);
+  }
+  async getScan(jobId) {
+    const response = await this.client.scans.get(jobId);
+    return normalizeJob(response);
+  }
+  async listScans(opts) {
+    const sdkOpts = {};
+    if (opts?.status) sdkOpts.status = opts.status;
+    if (opts?.jobType) sdkOpts.job_type = opts.jobType;
+    if (opts?.targetId) sdkOpts.target_id = opts.targetId;
+    if (opts?.limit) sdkOpts.limit = opts.limit;
+    const response = await this.client.scans.list(sdkOpts);
+    return response.data.map(
+      normalizeJob
+    );
+  }
+  async abortScan(jobId) {
+    await this.client.scans.abort(jobId);
+  }
+  async getStaticReport(jobId) {
+    const raw = await this.client.reports.getStaticReport(jobId);
+    const severityReport = raw.severity_report;
+    const stats = severityReport?.stats ?? [];
+    const securityReport = raw.security_report;
+    const subCategories = securityReport?.sub_categories ?? [];
+    return {
+      score: raw.score,
+      asr: raw.asr,
+      severityBreakdown: stats.map((s) => ({
+        severity: s.severity,
+        successful: s.successful ?? 0,
+        failed: s.failed ?? 0
+      })),
+      reportSummary: interpolateReportSummary(raw.report_summary),
+      categories: subCategories.map((sc) => {
+        const successful = sc.successful ?? 0;
+        const failed = sc.failed ?? 0;
+        const total = sc.total ?? successful + failed;
+        return {
+          id: sc.id,
+          displayName: sc.display_name,
+          asr: total > 0 ? successful / total * 100 : 0,
+          successful,
+          failed,
+          total
+        };
+      })
+    };
+  }
+  async getDynamicReport(jobId) {
+    const raw = await this.client.reports.getDynamicReport(jobId);
+    return {
+      score: raw.score,
+      asr: raw.asr,
+      totalGoals: raw.total_goals,
+      goalsAchieved: raw.goals_achieved,
+      totalStreams: raw.total_streams,
+      totalThreats: raw.total_threats,
+      reportSummary: interpolateReportSummary(raw.report_summary)
+    };
+  }
+  async getCustomReport(jobId) {
+    const raw = await this.client.customAttackReports.getReport(jobId);
+    const reports = raw.custom_attack_reports ?? [];
+    return {
+      totalPrompts: raw.total_prompts,
+      totalAttacks: raw.total_attacks,
+      totalThreats: raw.total_threats,
+      failedAttacks: raw.failed_attacks,
+      score: raw.score,
+      asr: raw.asr,
+      promptSets: reports.map((r) => ({
+        promptSetId: r.prompt_set_id,
+        promptSetName: r.prompt_set_name,
+        totalPrompts: r.total_prompts,
+        totalAttacks: r.total_attacks,
+        totalThreats: r.total_threats,
+        threatRate: r.threat_rate
+      }))
+    };
+  }
+  async listAttacks(jobId, opts) {
+    const response = await this.client.reports.listAttacks(jobId, opts);
+    const data = response.data ?? [];
+    const pagination = response.pagination;
+    return {
+      attacks: data.map((a) => ({
+        id: a.uuid,
+        name: a.attack_name,
+        severity: a.severity,
+        category: a.category,
+        subCategory: a.sub_category,
+        subCategoryDisplayName: a.sub_category_display_name,
+        successful: a.threat ?? false
+      })),
+      totalItems: pagination?.total_items
+    };
+  }
+  async listCustomAttacks(jobId, opts) {
+    const response = await this.client.customAttackReports.listCustomAttacks(jobId, opts);
+    return response.data.map(
+      (a) => ({
+        promptId: a.prompt_id,
+        promptText: a.prompt_text,
+        goal: a.goal,
+        threat: a.threat ?? false,
+        asr: a.asr,
+        promptSetName: a.prompt_set_name
+      })
+    );
+  }
+  async getCategories() {
+    const response = await this.client.scans.getCategories();
+    return response.map((c) => ({
+      id: c.id,
+      displayName: c.display_name,
+      description: c.description,
+      subCategories: (c.sub_categories ?? []).map((sc) => ({
+        id: sc.id,
+        displayName: sc.display_name,
+        description: sc.description
+      }))
+    }));
+  }
+  async waitForCompletion(jobId, onProgress, intervalMs = 5e3) {
+    const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+    while (true) {
+      const job = await this.getScan(jobId);
+      onProgress?.(job);
+      if (job.status === "FAILED") {
+        throw new Error(`Scan ${jobId} failed`);
+      }
+      if (TERMINAL_STATUSES.has(job.status)) {
+        return job;
+      }
+      await delay(intervalMs);
+    }
+  }
+};
+
+// src/airs/runtime.ts
+import { Content, init, Scanner } from "@cdot65/prisma-airs-sdk";
+var BATCH_SIZE = 5;
+var DEFAULT_POLL_INTERVAL_MS = 5e3;
+var DEFAULT_MAX_RETRIES = 5;
+var DEFAULT_BASE_DELAY_MS = 1e4;
+function isRateLimitError(err) {
+  if (err instanceof Error) {
+    const msg = err.message.toLowerCase();
+    return msg.includes("rate limit") || msg.includes("rate_limit") || msg.includes("429");
+  }
+  return false;
+}
+var SdkRuntimeService = class {
+  scanner;
+  constructor(opts) {
+    init(opts);
+    this.scanner = new Scanner();
+  }
+  async scanPrompt(profileName, prompt, response) {
+    const contentOpts = { prompt };
+    if (response) contentOpts.response = response;
+    const content = new Content(contentOpts);
+    const res = await this.scanner.syncScan({ profile_name: profileName }, content, void 0);
+    const detected = res.prompt_detected ?? {};
+    const triggered = !!(detected.topic_violation || detected.injection || detected.toxic_content || detected.dlp || detected.url_cats || detected.malicious_code);
+    return {
+      prompt,
+      response,
+      scanId: res.scan_id ?? "",
+      reportId: res.report_id ?? "",
+      action: res.action === "block" ? "block" : "allow",
+      category: res.category ?? "unknown",
+      triggered,
+      detections: detected
+    };
+  }
+  async submitBulkScan(profileName, prompts, sessionId) {
+    const scanIds = [];
+    for (let i = 0; i < prompts.length; i += BATCH_SIZE) {
+      const batch = prompts.slice(i, i + BATCH_SIZE);
+      const scanObjects = batch.map((prompt, idx) => ({
+        req_id: i + idx,
+        scan_req: {
+          ai_profile: { profile_name: profileName },
+          contents: [{ prompt }],
+          ...sessionId ? { session_id: sessionId } : {}
+        }
+      }));
+      const res = await this.scanner.asyncScan(scanObjects);
+      scanIds.push(res.scan_id);
+    }
+    return scanIds;
+  }
+  /**
+   * Poll async scan results until all complete or fail.
+   *
+   * Note: The async query API (`queryByScanIds`) does not return `prompt`,
+   * `response`, `triggered`, or `detections` fields. These are set to
+   * defaults (`''`, `undefined`, `false`, `{}`) in the returned results.
+   * Use `scanPrompt()` (sync API) when these fields are needed.
+   */
+  async pollResults(scanIds, intervalMs = DEFAULT_POLL_INTERVAL_MS, retryOpts) {
+    const maxRetries = retryOpts?.maxRetries ?? DEFAULT_MAX_RETRIES;
+    const baseDelay = retryOpts?.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+    const completed = /* @__PURE__ */ new Map();
+    const pending = new Set(scanIds);
+    let retryLevel = 0;
+    while (pending.size > 0) {
+      const pendingIds = [...pending];
+      let sweepCompleted = true;
+      for (let b = 0; b < pendingIds.length; b += 5) {
+        const batch = pendingIds.slice(b, b + 5);
+        let results;
+        try {
+          results = await this.scanner.queryByScanIds(batch);
+        } catch (err) {
+          if (isRateLimitError(err) && retryLevel < maxRetries) {
+            retryLevel++;
+            const delayMs = baseDelay * 2 ** (retryLevel - 1);
+            retryOpts?.onRetry?.(retryLevel, delayMs);
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+            sweepCompleted = false;
+            break;
+          }
+          throw err;
+        }
+        this.processQueryResults(results, completed, pending);
+        if (b + 5 < pendingIds.length) {
+          const batchDelay = retryLevel > 0 ? baseDelay : Math.min(baseDelay, 1e3);
+          await new Promise((resolve) => setTimeout(resolve, batchDelay));
+        }
+      }
+      if (sweepCompleted && retryLevel > 0) {
+        retryLevel = Math.max(0, retryLevel - 1);
+      }
+      if (pending.size > 0) {
+        const sweepDelay = retryLevel > 0 ? baseDelay * 2 ** retryLevel : intervalMs;
+        await new Promise((resolve) => setTimeout(resolve, sweepDelay));
+      }
+    }
+    return scanIds.map((id) => completed.get(id));
+  }
+  processQueryResults(results, completed, pending) {
+    for (const r of results) {
+      const id = r.scan_id ?? "";
+      const status = (r.status ?? "").toLowerCase();
+      if ((status === "complete" || status === "completed") && r.result) {
+        const result = r.result;
+        completed.set(id, {
+          prompt: "",
+          // not available from async API
+          response: void 0,
+          // not available from async API
+          scanId: result.scan_id ?? id,
+          reportId: result.report_id ?? "",
+          action: result.action === "block" ? "block" : "allow",
+          category: result.category ?? "unknown",
+          triggered: false,
+          // not available from async API — always false
+          detections: {}
+          // not available from async API
+        });
+        pending.delete(id);
+      } else if (status === "failed") {
+        completed.set(id, {
+          prompt: "",
+          // not available from async API
+          response: void 0,
+          // not available from async API
+          scanId: id,
+          reportId: "",
+          action: "allow",
+          // safe default for failed scans
+          category: "error",
+          triggered: false,
+          // not available from async API — always false
+          detections: {}
+          // not available from async API
+        });
+        pending.delete(id);
+      }
+    }
+  }
+  static formatResultsCsv(results) {
+    const header = "prompt,action,category,triggered,scan_id,report_id";
+    const rows = results.map((r) => {
+      const escaped = r.prompt.replace(/"/g, '""');
+      return `"${escaped}","${r.action}","${r.category}","${r.triggered}","${r.scanId}","${r.reportId}"`;
+    });
+    return [header, ...rows].join("\n");
+  }
+};
+
+// src/airs/scanner.ts
+import * as fs from "fs/promises";
+import { Content as Content2, init as init2, Scanner as Scanner2 } from "@cdot65/prisma-airs-sdk";
+import pLimit from "p-limit";
+var AirsScanService = class {
+  scanner;
+  constructor(opts) {
+    init2(opts);
+    this.scanner = new Scanner2();
+  }
+  /** Scan a single prompt synchronously and return the normalized result. */
+  async scan(profileName, prompt, sessionId) {
+    const content = new Content2({ prompt });
+    const response = await this.scanner.syncScan(
+      { profile_name: profileName },
+      content,
+      sessionId ? { sessionId } : void 0
+    );
+    const action = response.action === "block" ? "block" : "allow";
+    const detected = response.prompt_detected;
+    const triggered = detected?.topic_violation === true;
+    const category = response.category ?? void 0;
+    return {
+      scanId: response.scan_id ?? "",
+      reportId: response.report_id ?? "",
+      action,
+      triggered,
+      category,
+      raw: response
+    };
+  }
+  /** Scan multiple prompts concurrently (default 5) and return results in order. */
+  async scanBatch(profileName, prompts, concurrency = 5, sessionId) {
+    const limit = pLimit(concurrency);
+    return Promise.all(
+      prompts.map((prompt) => limit(() => this.scan(profileName, prompt, sessionId)))
+    );
+  }
+};
+var RateLimitedScanService = class {
+  constructor(inner, maxPerSecond) {
+    this.inner = inner;
+    this.maxPerSecond = maxPerSecond;
+  }
+  timestamps = [];
+  async acquireToken() {
+    const now = Date.now();
+    this.timestamps = this.timestamps.filter((t) => now - t < 1e3);
+    if (this.timestamps.length >= this.maxPerSecond) {
+      const oldest = this.timestamps[0];
+      const waitMs = 1e3 - (now - oldest);
+      if (waitMs > 0) {
+        await new Promise((resolve) => setTimeout(resolve, waitMs));
+      }
+      const after = Date.now();
+      this.timestamps = this.timestamps.filter((t) => after - t < 1e3);
+    }
+    this.timestamps.push(Date.now());
+  }
+  async scan(profileName, prompt, sessionId) {
+    await this.acquireToken();
+    return this.inner.scan(profileName, prompt, sessionId);
+  }
+  async scanBatch(profileName, prompts, concurrency, sessionId) {
+    const limit = pLimit(concurrency ?? 5);
+    return Promise.all(
+      prompts.map((prompt) => limit(() => this.scan(profileName, prompt, sessionId)))
+    );
+  }
+};
+
+// src/backup/io.ts
+import fs2 from "fs";
+import path from "path";
+import yaml from "js-yaml";
+function sanitizeFilename(name) {
+  if (!name) return "unnamed";
+  const sanitized = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+  return sanitized || "unnamed";
+}
+function resolveOutputDir(userDir, defaultSubdir) {
+  if (userDir) return path.resolve(userDir);
+  return path.resolve("./airs-backup", defaultSubdir);
+}
+function writeBackupFile(dir, filename, envelope, format) {
+  fs2.mkdirSync(dir, { recursive: true });
+  const ext = format === "yaml" ? "yaml" : "json";
+  const filePath = path.join(dir, `${filename}.${ext}`);
+  const content = format === "yaml" ? yaml.dump(envelope, { lineWidth: -1, noRefs: true }) : `${JSON.stringify(envelope, null, 2)}
+`;
+  fs2.writeFileSync(filePath, content, "utf-8");
+}
+function readBackupFile(filePath) {
+  const ext = path.extname(filePath).toLowerCase();
+  if (ext !== ".json" && ext !== ".yaml" && ext !== ".yml") {
+    throw new Error(`Unsupported file format: ${ext} (expected .json, .yaml, or .yml)`);
+  }
+  const raw = fs2.readFileSync(filePath, "utf-8");
+  const parsed = ext === ".json" ? JSON.parse(raw) : yaml.load(raw);
+  if (!parsed || typeof parsed !== "object" || !("version" in parsed) || !("data" in parsed)) {
+    throw new Error(`Invalid backup file: ${filePath} (missing version or data)`);
+  }
+  return parsed;
+}
+function readBackupDir(dirPath, resourceType) {
+  const files = fs2.readdirSync(dirPath).filter((f) => /\.(json|ya?ml)$/i.test(f)).map((f) => path.join(dirPath, f));
+  const envelopes = [];
+  for (const filePath of files) {
+    try {
+      const envelope = readBackupFile(filePath);
+      if (envelope.resourceType === resourceType) {
+        envelopes.push(envelope);
+      }
+    } catch {
+    }
+  }
+  return envelopes;
+}
+
+// src/config/loader.ts
+import { readFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+
+// src/config/schema.ts
+import { z } from "zod";
+var ConfigSchema = z.object({
+  // AIRS Scanner (runtime scan API)
+  airsApiKey: z.string().optional(),
+  airsApiToken: z.string().optional(),
+  airsApiEndpoint: z.string().optional(),
+  airsNumRetries: z.coerce.number().int().min(0).max(5).optional(),
+  // AIRS Management (SDK v2 — OAuth2 client credentials)
+  mgmtClientId: z.string().optional(),
+  mgmtClientSecret: z.string().optional(),
+  mgmtTsgId: z.string().optional(),
+  mgmtEndpoint: z.string().optional(),
+  mgmtTokenEndpoint: z.string().optional(),
+  dlpEndpoint: z.string().optional(),
+  // Red Team (endpoints only; creds shared with mgmt*)
+  redTeamDataEndpoint: z.string().optional(),
+  redTeamMgmtEndpoint: z.string().optional(),
+  redTeamTokenEndpoint: z.string().optional(),
+  // Model Security (endpoints only; creds shared with mgmt*)
+  modelSecDataEndpoint: z.string().optional(),
+  modelSecMgmtEndpoint: z.string().optional(),
+  modelSecTokenEndpoint: z.string().optional(),
+  // Tuning
+  scanConcurrency: z.coerce.number().int().min(1).max(20).default(5),
+  // Persistence
+  dataDir: z.string().default("~/.prisma-airs/runs")
+});
+
+// src/config/loader.ts
+function expandHome(p) {
+  return p.startsWith("~") ? join(homedir(), p.slice(1)) : p;
+}
+function fromEnv() {
+  const env = process.env;
+  return {
+    airsApiKey: env.PANW_AI_SEC_API_KEY,
+    airsApiToken: env.PANW_AI_SEC_API_TOKEN,
+    airsApiEndpoint: env.PANW_AI_SEC_API_ENDPOINT,
+    airsNumRetries: env.PANW_AI_SEC_NUM_RETRIES,
+    mgmtClientId: env.PANW_MGMT_CLIENT_ID,
+    mgmtClientSecret: env.PANW_MGMT_CLIENT_SECRET,
+    mgmtTsgId: env.PANW_MGMT_TSG_ID,
+    mgmtEndpoint: env.PANW_MGMT_ENDPOINT,
+    mgmtTokenEndpoint: env.PANW_MGMT_TOKEN_ENDPOINT,
+    dlpEndpoint: env.PANW_DLP_ENDPOINT,
+    redTeamDataEndpoint: env.PANW_RED_TEAM_DATA_ENDPOINT,
+    redTeamMgmtEndpoint: env.PANW_RED_TEAM_MGMT_ENDPOINT,
+    redTeamTokenEndpoint: env.PANW_RED_TEAM_TOKEN_ENDPOINT,
+    modelSecDataEndpoint: env.PANW_MODEL_SEC_DATA_ENDPOINT,
+    modelSecMgmtEndpoint: env.PANW_MODEL_SEC_MGMT_ENDPOINT,
+    modelSecTokenEndpoint: env.PANW_MODEL_SEC_TOKEN_ENDPOINT,
+    scanConcurrency: env.SCAN_CONCURRENCY,
+    dataDir: env.DATA_DIR
+  };
+}
+async function fromFile(path2) {
+  try {
+    const data = await readFile(path2, "utf-8");
+    return JSON.parse(data);
+  } catch {
+    return {};
+  }
+}
+function stripUndefined(obj) {
+  return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== void 0 && v !== ""));
+}
+function resolveConfigFilePath(configFilePath) {
+  if (configFilePath) return configFilePath;
+  const envPath = process.env.PRISMA_AIRS_CONFIG_PATH;
+  if (envPath) return expandHome(envPath);
+  return join(homedir(), ".prisma-airs", "config.json");
+}
+async function loadConfig(cliOverrides = {}, configFilePath) {
+  const filePath = resolveConfigFilePath(configFilePath);
+  const fileConfig = await fromFile(filePath);
+  const envConfig = fromEnv();
+  const merged = {
+    ...stripUndefined(fileConfig),
+    ...stripUndefined(envConfig),
+    ...stripUndefined(cliOverrides)
+  };
+  const config = ConfigSchema.parse(merged);
+  return {
+    ...config,
+    dataDir: expandHome(config.dataDir)
+  };
+}
+async function inspectConfig(configFilePath) {
+  const filePath = resolveConfigFilePath(configFilePath);
+  const fileConfig = stripUndefined(await fromFile(filePath));
+  const envConfig = stripUndefined(fromEnv());
+  const merged = { ...fileConfig, ...envConfig };
+  const config = ConfigSchema.parse(merged);
+  const entries = {};
+  for (const key of Object.keys(ConfigSchema.shape)) {
+    const source = key in envConfig ? "env" : key in fileConfig ? "file" : "default";
+    entries[key] = { value: config[key], source };
+  }
+  return entries;
+}
+
+// src/core/constraints.ts
+var MAX_NAME_LENGTH = 100;
+var MAX_DESCRIPTION_LENGTH = 250;
+var MAX_EXAMPLE_LENGTH = 250;
+var MAX_EXAMPLES = 5;
+var MIN_EXAMPLES = 2;
+var MAX_COMBINED_LENGTH = 1e3;
+function byteLen(s) {
+  return Buffer.byteLength(s, "utf8");
+}
+function validateName(name) {
+  const errors = [];
+  if (!name || name.length === 0) {
+    errors.push({ field: "name", message: "Name is required" });
+  } else if (byteLen(name) > MAX_NAME_LENGTH) {
+    errors.push({ field: "name", message: `Name must be at most ${MAX_NAME_LENGTH} bytes` });
+  }
+  return errors;
+}
+function validateDescription(description) {
+  const errors = [];
+  if (!description || description.length === 0) {
+    errors.push({ field: "description", message: "Description is required" });
+  } else if (byteLen(description) > MAX_DESCRIPTION_LENGTH) {
+    errors.push({
+      field: "description",
+      message: `Description must be at most ${MAX_DESCRIPTION_LENGTH} bytes`
+    });
+  }
+  return errors;
+}
+function validateExample(example, index) {
+  const errors = [];
+  if (!example || example.length === 0) {
+    errors.push({ field: `examples[${index}]`, message: `Example ${index} is required` });
+  } else if (byteLen(example) > MAX_EXAMPLE_LENGTH) {
+    errors.push({
+      field: `examples[${index}]`,
+      message: `Example ${index} must be at most ${MAX_EXAMPLE_LENGTH} bytes`
+    });
+  }
+  return errors;
+}
+function validateExamples(examples) {
+  const errors = [];
+  if (examples.length < MIN_EXAMPLES) {
+    errors.push({
+      field: "examples",
+      message: `At least ${MIN_EXAMPLES} examples required`
+    });
+  }
+  if (examples.length > MAX_EXAMPLES) {
+    errors.push({
+      field: "examples",
+      message: `At most ${MAX_EXAMPLES} examples allowed`
+    });
+  }
+  for (let i = 0; i < examples.length; i++) {
+    errors.push(...validateExample(examples[i], i));
+  }
+  return errors;
+}
+function validateTopic(topic) {
+  const errors = [];
+  errors.push(...validateName(topic.name));
+  errors.push(...validateDescription(topic.description));
+  errors.push(...validateExamples(topic.examples));
+  const combined = byteLen(topic.name) + byteLen(topic.description) + topic.examples.reduce((sum, ex) => sum + byteLen(ex), 0);
+  if (combined > MAX_COMBINED_LENGTH) {
+    errors.push({
+      field: "topic",
+      message: `Combined length (${combined}) exceeds ${MAX_COMBINED_LENGTH} bytes`
+    });
+  }
+  return errors;
+}
+
+// src/core/metrics.ts
+function computeMetrics(results) {
+  let truePositives = 0;
+  let trueNegatives = 0;
+  let falsePositives = 0;
+  let falseNegatives = 0;
+  let regressionCount = 0;
+  for (const r of results) {
+    if (r.testCase.expectedTriggered && r.actualTriggered) truePositives++;
+    else if (!r.testCase.expectedTriggered && !r.actualTriggered) trueNegatives++;
+    else if (!r.testCase.expectedTriggered && r.actualTriggered) falsePositives++;
+    else if (r.testCase.expectedTriggered && !r.actualTriggered) falseNegatives++;
+    if (r.testCase.source === "regression" && !r.correct) regressionCount++;
+  }
+  const totalPositives = truePositives + falseNegatives;
+  const totalNegatives = trueNegatives + falsePositives;
+  const total = results.length;
+  const truePositiveRate = totalPositives > 0 ? truePositives / totalPositives : 0;
+  const trueNegativeRate = totalNegatives > 0 ? trueNegatives / totalNegatives : 0;
+  const accuracy = total > 0 ? (truePositives + trueNegatives) / total : 0;
+  const coverage = Math.min(truePositiveRate, trueNegativeRate);
+  const precision = truePositives + falsePositives > 0 ? truePositives / (truePositives + falsePositives) : 0;
+  const recall = truePositiveRate;
+  const f1Score = precision + recall > 0 ? 2 * precision * recall / (precision + recall) : 0;
+  return {
+    truePositives,
+    trueNegatives,
+    falsePositives,
+    falseNegatives,
+    truePositiveRate,
+    trueNegativeRate,
+    accuracy,
+    coverage,
+    f1Score,
+    regressionCount
+  };
+}
+function computeCategoryBreakdown(results) {
+  const map = /* @__PURE__ */ new Map();
+  for (const r of results) {
+    const cat = r.testCase.category;
+    const entry = map.get(cat) ?? { total: 0, fp: 0, fn: 0 };
+    entry.total++;
+    if (!r.testCase.expectedTriggered && r.actualTriggered) entry.fp++;
+    if (r.testCase.expectedTriggered && !r.actualTriggered) entry.fn++;
+    map.set(cat, entry);
+  }
+  return [...map.entries()].map(([category, { total, fp, fn }]) => ({
+    category,
+    total,
+    fp,
+    fn,
+    errorRate: total > 0 ? (fp + fn) / total : 0
+  })).sort((a, b) => b.errorRate - a.errorRate);
+}
+
+export {
+  SdkManagementService,
+  getOrCreateManagementClient,
+  SdkModelSecurityService,
+  SdkPromptSetService,
+  SdkRedTeamService,
+  SdkRuntimeService,
+  AirsScanService,
+  RateLimitedScanService,
+  sanitizeFilename,
+  resolveOutputDir,
+  writeBackupFile,
+  readBackupFile,
+  readBackupDir,
+  ConfigSchema,
+  resolveConfigFilePath,
+  loadConfig,
+  inspectConfig,
+  validateName,
+  validateDescription,
+  validateExamples,
+  validateTopic,
+  computeMetrics,
+  computeCategoryBreakdown
+};