@cdot65/prisma-airs-cli 3.0.1 → 3.2.0

package/dist/index.d.ts

@@ -35,16 +35,60 @@ interface RuntimeScanResult {
     category: string;
     triggered: boolean;
     detections: Record<string, boolean>;
+    error?: string;
+}
+/** Terminal action emitted by the reliable bulk-scan path. */
+type BulkScanAction = RuntimeScanResult['action'] | 'failed';
+/** A prompt paired with its stable position and AIRS request ID. */
+interface IndexedPrompt {
+    index: number;
+    prompt: string;
 }
-/** Contract for runtime scanning operations (sync + async). */
+/** Correlation data for one prompt accepted in an async AIRS submission. */
+interface BatchEntry extends IndexedPrompt {
+    scanId: string;
+    reqId: number;
+}
+/** Receipt for exactly one SDK async submission (at most twenty prompts). */
+interface SubmittedBatch {
+    scanId: string;
+    reportId?: string;
+    entries: BatchEntry[];
+}
+/** A normalized async result with its stable input position and AIRS request ID. */
+interface BulkScanResult extends Omit<RuntimeScanResult, 'action'> {
+    index: number;
+    reqId: number;
+    action: BulkScanAction;
+}
+/** Backwards-compatible contract for the original runtime scanning operations. */
 interface RuntimeService {
     /** Scan a single prompt (and optional response) synchronously. */
     scanPrompt(profileName: string, prompt: string, response?: string): Promise<RuntimeScanResult>;
-    /** Submit prompts for async bulk scanning, returns scan IDs. */
-    submitBulkScan(profileName: string, prompts: string[]): Promise<string[]>;
-    /** Poll async scan results until all complete. */
+    /** @deprecated Use ReliableRuntimeService.submitBatch to preserve per-prompt correlation. */
+    submitBulkScan(profileName: string, prompts: string[], sessionId?: string): Promise<string[]>;
+    /** @deprecated Use ReliableRuntimeService.pollBatch to preserve per-prompt correlation. */
     pollResults(scanIds: string[], intervalMs?: number): Promise<RuntimeScanResult[]>;
 }
+/** Runtime scanning contract with item-correlated, resumable bulk operations. */
+interface ReliableRuntimeService extends RuntimeService {
+    /** Submit one SDK-sized group of indexed prompts for async scanning. */
+    submitBatch(profileName: string, prompts: IndexedPrompt[], sessionId?: string, retryOpts?: {
+        maxRetries?: number;
+        baseDelayMs?: number;
+        maxNoProgressPolls?: number;
+        onRetry?: (attempt: number, delayMs: number) => void;
+        onProgress?: (results: BulkScanResult[]) => void | Promise<void>;
+    }): Promise<SubmittedBatch>;
+    /** Poll one async submission and return one result per prompt, ordered by input index. */
+    pollBatch(batch: SubmittedBatch, intervalMs?: number, retryOpts?: {
+        maxRetries?: number;
+        baseDelayMs?: number;
+        maxNoProgressPolls?: number;
+        onRetry?: (attempt: number, delayMs: number) => void;
+        onProgress?: (results: BulkScanResult[]) => void | Promise<void>;
+    }): Promise<BulkScanResult[]>;
+}
 /** Contract for AIRS prompt scanning operations. */
 interface ScanService {
     /** Scan a single prompt against a security profile. */
@@ -349,6 +393,71 @@ interface RegistryCredentials {
     token: string;
     expiry: string;
 }
+/** Normalized network broker channel. */
+interface RedTeamChannel {
+    uuid?: string;
+    name?: string | null;
+    description?: string | null;
+    status?: string | null;
+    addedBy?: string | null;
+    createdAt?: string | null;
+    updatedAt?: string | null;
+    lastOnlineAt?: string | null;
+    connectedClientsCount?: number | null;
+    outdatedClientsCount?: number | null;
+    features?: Record<string, boolean> | null;
+}
+/** Filters for listing network broker channels. */
+interface RedTeamChannelListOptions {
+    limit?: number;
+    offset?: number;
+    search?: string;
+    status?: string | string[];
+}
+/** Request to create a network broker channel. */
+interface RedTeamChannelCreateRequest {
+    name: string;
+    description?: string;
+}
+/** Request to update a network broker channel. */
+interface RedTeamChannelUpdateRequest {
+    name?: string;
+    description?: string;
+}
+/** Normalized network broker channel statistics. */
+interface RedTeamChannelStats {
+    serverDomain?: string | null;
+    dockerRegistry?: string | null;
+    helmChart?: string | null;
+    dockerImage?: string | null;
+    onlineChannels?: number | null;
+    totalChannels?: number | null;
+    clientVersion?: string | null;
+}
+/** Normalized tenant language configuration. */
+interface RedTeamLanguages {
+    multilingualEnabled: boolean;
+    supportedJobTypes: string[];
+    languages: Array<{
+        code: string;
+        name: string;
+    }>;
+}
+/** Normalized target-profile error log entry. */
+interface RedTeamErrorLog {
+    createdAt: string;
+    updatedAt: string;
+    jobId?: string | null;
+    targetId?: string | null;
+    targetVersion?: number | null;
+    attackId?: string | null;
+    errorType?: string | null;
+    errorSource?: string | null;
+    errorMessage?: string | null;
+    targetObject?: Record<string, unknown> | null;
+    extraInfo?: Record<string, unknown> | null;
+    version?: number;
+}
 /** Contract for AI Red Team scan operations. */
 interface RedTeamService {
     /** Get EULA content. */
@@ -439,6 +548,30 @@ interface RedTeamService {
     getCategories(): Promise<RedTeamCategory[]>;
     /** Poll until scan completes. Calls onProgress for status updates. */
     waitForCompletion(jobId: string, onProgress?: (job: RedTeamJob) => void, intervalMs?: number): Promise<RedTeamJob>;
+    /** List network broker channels. */
+    listChannels(opts?: RedTeamChannelListOptions): Promise<{
+        channels: RedTeamChannel[];
+        totalItems?: number;
+    }>;
+    /** Get a network broker channel by ID. */
+    getChannel(channelId: string): Promise<RedTeamChannel>;
+    /** Create a network broker channel. */
+    createChannel(request: RedTeamChannelCreateRequest): Promise<RedTeamChannel>;
+    /** Update a network broker channel. */
+    updateChannel(channelId: string, request: RedTeamChannelUpdateRequest): Promise<RedTeamChannel>;
+    /** Get network broker channel statistics. */
+    getChannelStats(): Promise<RedTeamChannelStats>;
+    /** List tenant languages (data plane, or management plane when `management`). */
+    getLanguages(management?: boolean): Promise<RedTeamLanguages>;
+    /** List target-profile error logs. */
+    getTargetProfileErrorLogs(targetId: string, opts?: {
+        limit?: number;
+        offset?: number;
+        search?: string;
+    }): Promise<{
+        logs: RedTeamErrorLog[];
+        totalItems?: number;
+    }>;
 }
 /** Normalized security group. */
 interface ModelSecurityGroup {
@@ -606,6 +739,63 @@ interface ModelSecurityPyPIAuth {
     url: string;
     expiresAt: string;
 }
+/** Normalized model catalog entry. */
+interface ModelSecurityModel {
+    uuid: string;
+    tsgId: string;
+    name: string;
+    createdAt: string;
+    updatedAt: string;
+    latestVersionUuid?: string | null;
+    latestVersionFingerprint?: string | null;
+    latestVersionRevision?: string | null;
+    latestVersionHfCommitSha?: string | null;
+    latestVersionOutcome?: string | null;
+    latestVersionFormats?: string[] | null;
+    latestVersionSourceTypes?: string[] | null;
+    latestVersionScanTime?: string | null;
+}
+/** Filter options for listing models. */
+interface ModelSecurityModelListOptions {
+    search?: string;
+    searchQuery?: string;
+    sortField?: string;
+    sortOrder?: string;
+    skip?: number;
+    limit?: number;
+}
+/** Normalized model version. */
+interface ModelSecurityModelVersion {
+    uuid: string;
+    tsgId: string;
+    modelUuid: string;
+    revision: string;
+    createdAt: string;
+    updatedAt: string;
+    fingerprint?: string | null;
+    fileCount?: number | null;
+    license?: string | null;
+    latestScanTime?: string | null;
+    hfCommitSha?: string | null;
+    hfCommitTitle?: string | null;
+    hfCommitAuthors?: string[] | null;
+    hfModelName?: string | null;
+    hfOrganization?: string | null;
+    modelFormats?: string[] | null;
+    sourceTypes?: string[] | null;
+    lastEvalOutcome?: string | null;
+    lastEvalSummary?: {
+        rulesFailed: number;
+        rulesPassed: number;
+        totalRules: number;
+    } | null;
+}
+/** Filter options for listing model versions. */
+interface ModelSecurityModelVersionListOptions {
+    sortOrder?: string;
+    skip?: number;
+    limit?: number;
+}
 /** Contract for Model Security operations. */
 interface ModelSecurityService {
     listGroups(opts?: ModelSecurityGroupListOptions): Promise<{
@@ -671,6 +861,23 @@ interface ModelSecurityService {
         values: string[];
     }>;
     getPyPIAuth(): Promise<ModelSecurityPyPIAuth>;
+    listModels(opts?: ModelSecurityModelListOptions): Promise<{
+        totalItems: number;
+        models: ModelSecurityModel[];
+    }>;
+    getModel(uuid: string): Promise<ModelSecurityModel>;
+    listModelVersions(modelUuid: string, opts?: ModelSecurityModelVersionListOptions): Promise<{
+        totalItems: number;
+        versions: ModelSecurityModelVersion[];
+    }>;
+    getModelVersion(uuid: string): Promise<ModelSecurityModelVersion>;
+    listModelVersionFiles(modelVersionUuid: string, opts?: {
+        skip?: number;
+        limit?: number;
+    }): Promise<{
+        totalItems: number;
+        files: ModelSecurityFile[];
+    }>;
 }
 /** Normalized security profile. */
 interface SecurityProfileInfo {
@@ -1016,6 +1223,23 @@ declare class SdkModelSecurityService implements ModelSecurityService {
         values: string[];
     }>;
     getPyPIAuth(): Promise<ModelSecurityPyPIAuth>;
+    listModels(opts?: ModelSecurityModelListOptions): Promise<{
+        totalItems: number;
+        models: ModelSecurityModel[];
+    }>;
+    getModel(uuid: string): Promise<ModelSecurityModel>;
+    listModelVersions(modelUuid: string, opts?: ModelSecurityModelVersionListOptions): Promise<{
+        totalItems: number;
+        versions: ModelSecurityModelVersion[];
+    }>;
+    getModelVersion(uuid: string): Promise<ModelSecurityModelVersion>;
+    listModelVersionFiles(modelVersionUuid: string, opts?: {
+        skip?: number;
+        limit?: number;
+    }): Promise<{
+        totalItems: number;
+        files: ModelSecurityFile[];
+    }>;
 }
 
 /**
@@ -1139,32 +1363,56 @@ declare class SdkRedTeamService implements RedTeamService {
     }): Promise<RedTeamCustomAttack[]>;
     getCategories(): Promise<RedTeamCategory[]>;
     waitForCompletion(jobId: string, onProgress?: (job: RedTeamJob) => void, intervalMs?: number): Promise<RedTeamJob>;
+    listChannels(opts?: RedTeamChannelListOptions): Promise<{
+        channels: RedTeamChannel[];
+        totalItems?: number;
+    }>;
+    getChannel(channelId: string): Promise<RedTeamChannel>;
+    createChannel(request: RedTeamChannelCreateRequest): Promise<RedTeamChannel>;
+    updateChannel(channelId: string, request: RedTeamChannelUpdateRequest): Promise<RedTeamChannel>;
+    getChannelStats(): Promise<RedTeamChannelStats>;
+    getLanguages(management?: boolean): Promise<RedTeamLanguages>;
+    getTargetProfileErrorLogs(targetId: string, opts?: {
+        limit?: number;
+        offset?: number;
+        search?: string;
+    }): Promise<{
+        logs: RedTeamErrorLog[];
+        totalItems?: number;
+    }>;
 }
 
+/** Maximum async request objects accepted by the installed AIRS SDK. */
+declare const SDK_ASYNC_BATCH_SIZE = 20;
 interface PollRetryOptions {
     /** Max retries per rate-limit error before giving up. Default: 5. */
     maxRetries?: number;
     /** Base delay in ms for exponential backoff. Default: 10000. */
     baseDelayMs?: number;
+    /** Stop after this many consecutive successful polls resolve no new prompts. Default: 120. */
+    maxNoProgressPolls?: number;
     /** Called on each retry with (attempt, delayMs). */
     onRetry?: (attempt: number, delayMs: number) => void;
+    /** Called whenever newly terminal prompt results are resolved. */
+    onProgress?: (results: BulkScanResult[]) => void | Promise<void>;
 }
-declare class SdkRuntimeService implements RuntimeService {
+declare class SdkRuntimeService implements ReliableRuntimeService {
     private scanner;
     constructor(opts: InitOptions);
     scanPrompt(profileName: string, prompt: string, response?: string): Promise<RuntimeScanResult>;
+    submitBatch(profileName: string, prompts: IndexedPrompt[], sessionId?: string, retryOpts?: PollRetryOptions): Promise<SubmittedBatch>;
+    pollBatch(batch: SubmittedBatch, intervalMs?: number, retryOpts?: PollRetryOptions): Promise<BulkScanResult[]>;
+    /** @deprecated Use submitBatch to preserve per-prompt request correlation. */
     submitBulkScan(profileName: string, prompts: string[], sessionId?: string): Promise<string[]>;
     /**
-     * Poll async scan results until all complete or fail.
-     *
-     * Note: The async query API (`queryByScanIds`) does not return `prompt`,
-     * `response`, `triggered`, or `detections` fields. These are set to
-     * defaults (`''`, `undefined`, `false`, `{}`) in the returned results.
-     * Use `scanPrompt()` (sync API) when these fields are needed.
+     * Compatibility poller for callers that retained only batch scan IDs.
+     * Nested detection data is preserved, but prompt text and per-request fan-out
+     * cannot be reconstructed from scan IDs alone.
+     * @deprecated Use pollBatch to preserve `(scan_id, req_id)` correlation and prompt text.
      */
     pollResults(scanIds: string[], intervalMs?: number, retryOpts?: PollRetryOptions): Promise<RuntimeScanResult[]>;
     private processQueryResults;
-    static formatResultsCsv(results: RuntimeScanResult[]): string;
+    static formatResultsCsv(results: Array<RuntimeScanResult | BulkScanResult>): string;
 }
 
 /** Scans prompts against AIRS security profiles via the Prisma AIRS SDK. */
@@ -1230,6 +1478,7 @@ declare const ConfigSchema: z.ZodObject<{
     redTeamDataEndpoint: z.ZodOptional<z.ZodString>;
     redTeamMgmtEndpoint: z.ZodOptional<z.ZodString>;
     redTeamTokenEndpoint: z.ZodOptional<z.ZodString>;
+    redTeamNetworkBrokerEndpoint: z.ZodOptional<z.ZodString>;
     modelSecDataEndpoint: z.ZodOptional<z.ZodString>;
     modelSecMgmtEndpoint: z.ZodOptional<z.ZodString>;
     modelSecTokenEndpoint: z.ZodOptional<z.ZodString>;
@@ -1251,6 +1500,7 @@ declare const ConfigSchema: z.ZodObject<{
     redTeamDataEndpoint?: string | undefined;
     redTeamMgmtEndpoint?: string | undefined;
     redTeamTokenEndpoint?: string | undefined;
+    redTeamNetworkBrokerEndpoint?: string | undefined;
     modelSecDataEndpoint?: string | undefined;
     modelSecMgmtEndpoint?: string | undefined;
     modelSecTokenEndpoint?: string | undefined;
@@ -1268,6 +1518,7 @@ declare const ConfigSchema: z.ZodObject<{
     redTeamDataEndpoint?: string | undefined;
     redTeamMgmtEndpoint?: string | undefined;
     redTeamTokenEndpoint?: string | undefined;
+    redTeamNetworkBrokerEndpoint?: string | undefined;
     modelSecDataEndpoint?: string | undefined;
     modelSecMgmtEndpoint?: string | undefined;
     modelSecTokenEndpoint?: string | undefined;
@@ -1395,4 +1646,4 @@ declare function computeMetrics(results: TestResult[]): EfficacyMetrics;
 /** Compute per-category error breakdown from test results. Sorted by error rate descending. */
 declare function computeCategoryBreakdown(results: TestResult[]): CategoryBreakdown[];
 
-export { AirsScanService, type AnalysisReport, type BackupEnvelope, type BackupFormat, type BackupResult, type CategoryBreakdown, type CustomTopic, type EfficacyMetrics, type IterationResult, type ModelSecurityEvaluation, type ModelSecurityFile, type ModelSecurityFileListOptions, type ModelSecurityGroup, type ModelSecurityGroupCreateRequest, type ModelSecurityGroupListOptions, type ModelSecurityGroupUpdateRequest, type ModelSecurityLabel, type ModelSecurityPyPIAuth, type ModelSecurityRule, type ModelSecurityRuleEditableField, type ModelSecurityRuleInstance, type ModelSecurityRuleInstanceListOptions, type ModelSecurityRuleInstanceUpdateRequest, type ModelSecurityRuleListOptions, type ModelSecurityScan, type ModelSecurityScanListOptions, type ModelSecurityService, type ModelSecurityViolation, type MutationResponse, type ProfileTopic, type PromptDetail, type PromptSetDetail, type PromptSetService, type PromptSetVersionInfo, type PropertyValueList, type RedTeamAttack, type RedTeamCategory, type RedTeamCustomAttack, type RedTeamCustomReport, type RedTeamJob, type RedTeamService, type RedTeamStaticReport, type RedTeamTarget, type RedTeamTargetCreateRequest, type RedTeamTargetDetail, type RedTeamTargetUpdateRequest, type ResourceType, type RestoreResult, type RunState, type RuntimeScanResult, type RuntimeService, SdkManagementService, SdkModelSecurityService, SdkPromptSetService, SdkRedTeamService, SdkRuntimeService, type TargetOperationOptions, type TestCase, type TestResult, type UserInput, type ValidationError, computeCategoryBreakdown, computeMetrics, loadConfig, readBackupDir, readBackupFile, resolveOutputDir, sanitizeFilename, validateDescription, validateExamples, validateName, validateTopic, writeBackupFile };
+export { AirsScanService, type AnalysisReport, type BackupEnvelope, type BackupFormat, type BackupResult, type BatchEntry, type BulkScanAction, type BulkScanResult, type CategoryBreakdown, type CustomTopic, type EfficacyMetrics, type IndexedPrompt, type IterationResult, type ModelSecurityEvaluation, type ModelSecurityFile, type ModelSecurityFileListOptions, type ModelSecurityGroup, type ModelSecurityGroupCreateRequest, type ModelSecurityGroupListOptions, type ModelSecurityGroupUpdateRequest, type ModelSecurityLabel, type ModelSecurityPyPIAuth, type ModelSecurityRule, type ModelSecurityRuleEditableField, type ModelSecurityRuleInstance, type ModelSecurityRuleInstanceListOptions, type ModelSecurityRuleInstanceUpdateRequest, type ModelSecurityRuleListOptions, type ModelSecurityScan, type ModelSecurityScanListOptions, type ModelSecurityService, type ModelSecurityViolation, type MutationResponse, type PollRetryOptions, type ProfileTopic, type PromptDetail, type PromptSetDetail, type PromptSetService, type PromptSetVersionInfo, type PropertyValueList, type RedTeamAttack, type RedTeamCategory, type RedTeamCustomAttack, type RedTeamCustomReport, type RedTeamJob, type RedTeamService, type RedTeamStaticReport, type RedTeamTarget, type RedTeamTargetCreateRequest, type RedTeamTargetDetail, type RedTeamTargetUpdateRequest, type ReliableRuntimeService, type ResourceType, type RestoreResult, type RunState, type RuntimeScanResult, type RuntimeService, SDK_ASYNC_BATCH_SIZE, SdkManagementService, SdkModelSecurityService, SdkPromptSetService, SdkRedTeamService, SdkRuntimeService, type SubmittedBatch, type TargetOperationOptions, type TestCase, type TestResult, type UserInput, type ValidationError, computeCategoryBreakdown, computeMetrics, loadConfig, readBackupDir, readBackupFile, resolveOutputDir, sanitizeFilename, validateDescription, validateExamples, validateName, validateTopic, writeBackupFile };

package/dist/index.js

@@ -1,5 +1,6 @@
 import {
   AirsScanService,
+  SDK_ASYNC_BATCH_SIZE,
   SdkManagementService,
   SdkModelSecurityService,
   SdkPromptSetService,
@@ -17,9 +18,10 @@ import {
   validateName,
   validateTopic,
   writeBackupFile
-} from "./chunk-JXHYQFEK.js";
+} from "./chunk-TTBN7YHC.js";
 export {
   AirsScanService,
+  SDK_ASYNC_BATCH_SIZE,
   SdkManagementService,
   SdkModelSecurityService,
   SdkPromptSetService,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "3.0.1",
+  "version": "3.2.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",
@@ -44,7 +44,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@cdot65/prisma-airs-sdk": "^0.12.0",
+    "@cdot65/prisma-airs-sdk": "^0.13.2",
     "@inquirer/prompts": "^8.3.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",