@cdot65/prisma-airs-cli 3.1.0 → 3.3.0

package/dist/index.d.ts

@@ -35,16 +35,60 @@ interface RuntimeScanResult {
     category: string;
     triggered: boolean;
     detections: Record<string, boolean>;
+    error?: string;
+}
+/** Terminal action emitted by the reliable bulk-scan path. */
+type BulkScanAction = RuntimeScanResult['action'] | 'failed';
+/** A prompt paired with its stable position and AIRS request ID. */
+interface IndexedPrompt {
+    index: number;
+    prompt: string;
+}
+/** Correlation data for one prompt accepted in an async AIRS submission. */
+interface BatchEntry extends IndexedPrompt {
+    scanId: string;
+    reqId: number;
+}
+/** Receipt for exactly one SDK async submission (at most twenty prompts). */
+interface SubmittedBatch {
+    scanId: string;
+    reportId?: string;
+    entries: BatchEntry[];
 }
-/** Contract for runtime scanning operations (sync + async). */
+/** A normalized async result with its stable input position and AIRS request ID. */
+interface BulkScanResult extends Omit<RuntimeScanResult, 'action'> {
+    index: number;
+    reqId: number;
+    action: BulkScanAction;
+}
+/** Backwards-compatible contract for the original runtime scanning operations. */
 interface RuntimeService {
     /** Scan a single prompt (and optional response) synchronously. */
     scanPrompt(profileName: string, prompt: string, response?: string): Promise<RuntimeScanResult>;
-    /** Submit prompts for async bulk scanning, returns scan IDs. */
-    submitBulkScan(profileName: string, prompts: string[]): Promise<string[]>;
-    /** Poll async scan results until all complete. */
+    /** @deprecated Use ReliableRuntimeService.submitBatch to preserve per-prompt correlation. */
+    submitBulkScan(profileName: string, prompts: string[], sessionId?: string): Promise<string[]>;
+    /** @deprecated Use ReliableRuntimeService.pollBatch to preserve per-prompt correlation. */
     pollResults(scanIds: string[], intervalMs?: number): Promise<RuntimeScanResult[]>;
 }
+/** Runtime scanning contract with item-correlated, resumable bulk operations. */
+interface ReliableRuntimeService extends RuntimeService {
+    /** Submit one SDK-sized group of indexed prompts for async scanning. */
+    submitBatch(profileName: string, prompts: IndexedPrompt[], sessionId?: string, retryOpts?: {
+        maxRetries?: number;
+        baseDelayMs?: number;
+        maxNoProgressPolls?: number;
+        onRetry?: (attempt: number, delayMs: number) => void;
+        onProgress?: (results: BulkScanResult[]) => void | Promise<void>;
+    }): Promise<SubmittedBatch>;
+    /** Poll one async submission and return one result per prompt, ordered by input index. */
+    pollBatch(batch: SubmittedBatch, intervalMs?: number, retryOpts?: {
+        maxRetries?: number;
+        baseDelayMs?: number;
+        maxNoProgressPolls?: number;
+        onRetry?: (attempt: number, delayMs: number) => void;
+        onProgress?: (results: BulkScanResult[]) => void | Promise<void>;
+    }): Promise<BulkScanResult[]>;
+}
 /** Contract for AIRS prompt scanning operations. */
 interface ScanService {
     /** Scan a single prompt against a security profile. */
@@ -528,6 +572,17 @@ interface RedTeamService {
         logs: RedTeamErrorLog[];
         totalItems?: number;
     }>;
+    listAdapters(opts?: RedTeamAdapterListOptions): Promise<{
+        adapters: RedTeamAdapterListItem[];
+        totalItems?: number;
+    }>;
+    getAdapter(uuid: string): Promise<RedTeamAdapterDetail>;
+    createAdapter(request: RedTeamAdapterCreateRequest, validate?: boolean): Promise<RedTeamAdapterDetail>;
+    /** Read-modify-write: merges overrides onto the current record (upstream PUT is full-replacement). */
+    updateAdapter(uuid: string, overrides: RedTeamAdapterUpdateOverrides, validate?: boolean): Promise<RedTeamAdapterDetail>;
+    deleteAdapter(uuid: string): Promise<void>;
+    /** Run a script end-to-end through the broker channel; returns an execution outcome. */
+    validateAdapter(request: RedTeamAdapterValidateRequest): Promise<RedTeamAdapterValidationResult>;
 }
 /** Normalized security group. */
 interface ModelSecurityGroup {
@@ -1033,6 +1088,83 @@ interface ManagementService {
     }): Promise<DeploymentProfileInfo[]>;
     queryScanLogs(opts: ScanLogQueryOptions): Promise<ScanLogQueryResult>;
 }
+/** An adapter configuration variable. Secrets are masked; key off `isRedacted`, not the value. */
+interface RedTeamAdapterVar {
+    key: string;
+    value?: string | null;
+    type: 'VAR' | 'SECRET';
+    isRedacted?: boolean;
+}
+/** Adapter list row — no script, description, or variables; `get` for the full record. */
+interface RedTeamAdapterListItem {
+    uuid: string;
+    name: string;
+    status: string;
+    createdAt?: string;
+    updatedAt?: string;
+    createdByUserId?: string | null;
+    targetCount?: number | null;
+}
+/** Full adapter record. */
+interface RedTeamAdapterDetail {
+    uuid: string;
+    tsgId?: string;
+    name: string;
+    scriptB64: string;
+    status: string;
+    description?: string | null;
+    networkBrokerChannelUuid?: string | null;
+    variables: RedTeamAdapterVar[];
+    targetCount?: number | null;
+    createdAt?: string | null;
+    updatedAt?: string | null;
+    createdByUserId?: string | null;
+    updatedByUserId?: string | null;
+}
+interface RedTeamAdapterListOptions {
+    limit?: number;
+    offset?: number;
+    search?: string;
+}
+interface RedTeamAdapterCreateRequest {
+    name: string;
+    scriptB64: string;
+    /** Sample prompt used to exercise the adapter during validation. Not stored. */
+    prompt: string;
+    description?: string;
+    /** Optional while DRAFT; required to activate (validate: true). */
+    networkBrokerChannelUuid?: string;
+    variables?: RedTeamAdapterVar[];
+}
+/**
+ * CLI-side overrides for adapter update. The upstream PUT is a full
+ * replacement, so the service merges these onto the current record —
+ * `prompt` is the only always-required field because it is never stored.
+ */
+interface RedTeamAdapterUpdateOverrides {
+    prompt: string;
+    name?: string;
+    scriptB64?: string;
+    description?: string;
+    networkBrokerChannelUuid?: string;
+    /** Replaces the WHOLE variable set when given; omitted keys are deleted upstream. */
+    variables?: RedTeamAdapterVar[];
+}
+interface RedTeamAdapterValidateRequest {
+    scriptB64: string;
+    networkBrokerChannelUuid: string;
+    prompt: string;
+    variables?: RedTeamAdapterVar[];
+    /** Resolve redacted/null variable values from this stored adapter before the run. */
+    adapterUuid?: string;
+}
+/** Execution outcome of a validation run — not an adapter record. */
+interface RedTeamAdapterValidationResult {
+    validated: boolean;
+    stdout?: string | null;
+    stderr?: string | null;
+    traceback?: string | null;
+}
 
 /**
  * Wraps the SDK's ManagementClient to implement our ManagementService interface.
@@ -1257,10 +1389,6 @@ declare class SdkPromptSetService implements PromptSetService {
     createPropertyValue(name: string, value: string): Promise<MutationResponse>;
 }
 
-/**
- * Wraps the SDK's RedTeamClient to implement RedTeamService.
- * Provides scan creation, status polling, report retrieval, and target/category listing.
- */
 declare class SdkRedTeamService implements RedTeamService {
     private client;
     constructor(opts?: RedTeamClientOptions);
@@ -1336,32 +1464,48 @@ declare class SdkRedTeamService implements RedTeamService {
         logs: RedTeamErrorLog[];
         totalItems?: number;
     }>;
+    listAdapters(opts?: RedTeamAdapterListOptions): Promise<{
+        adapters: RedTeamAdapterListItem[];
+        totalItems?: number;
+    }>;
+    getAdapter(uuid: string): Promise<RedTeamAdapterDetail>;
+    createAdapter(request: RedTeamAdapterCreateRequest, validate?: boolean): Promise<RedTeamAdapterDetail>;
+    updateAdapter(uuid: string, overrides: RedTeamAdapterUpdateOverrides, validate?: boolean): Promise<RedTeamAdapterDetail>;
+    deleteAdapter(uuid: string): Promise<void>;
+    validateAdapter(request: RedTeamAdapterValidateRequest): Promise<RedTeamAdapterValidationResult>;
 }
 
+/** Maximum async request objects accepted by the installed AIRS SDK. */
+declare const SDK_ASYNC_BATCH_SIZE = 20;
 interface PollRetryOptions {
     /** Max retries per rate-limit error before giving up. Default: 5. */
     maxRetries?: number;
     /** Base delay in ms for exponential backoff. Default: 10000. */
     baseDelayMs?: number;
+    /** Stop after this many consecutive successful polls resolve no new prompts. Default: 120. */
+    maxNoProgressPolls?: number;
     /** Called on each retry with (attempt, delayMs). */
     onRetry?: (attempt: number, delayMs: number) => void;
+    /** Called whenever newly terminal prompt results are resolved. */
+    onProgress?: (results: BulkScanResult[]) => void | Promise<void>;
 }
-declare class SdkRuntimeService implements RuntimeService {
+declare class SdkRuntimeService implements ReliableRuntimeService {
     private scanner;
     constructor(opts: InitOptions);
     scanPrompt(profileName: string, prompt: string, response?: string): Promise<RuntimeScanResult>;
+    submitBatch(profileName: string, prompts: IndexedPrompt[], sessionId?: string, retryOpts?: PollRetryOptions): Promise<SubmittedBatch>;
+    pollBatch(batch: SubmittedBatch, intervalMs?: number, retryOpts?: PollRetryOptions): Promise<BulkScanResult[]>;
+    /** @deprecated Use submitBatch to preserve per-prompt request correlation. */
     submitBulkScan(profileName: string, prompts: string[], sessionId?: string): Promise<string[]>;
     /**
-     * Poll async scan results until all complete or fail.
-     *
-     * Note: The async query API (`queryByScanIds`) does not return `prompt`,
-     * `response`, `triggered`, or `detections` fields. These are set to
-     * defaults (`''`, `undefined`, `false`, `{}`) in the returned results.
-     * Use `scanPrompt()` (sync API) when these fields are needed.
+     * Compatibility poller for callers that retained only batch scan IDs.
+     * Nested detection data is preserved, but prompt text and per-request fan-out
+     * cannot be reconstructed from scan IDs alone.
+     * @deprecated Use pollBatch to preserve `(scan_id, req_id)` correlation and prompt text.
      */
     pollResults(scanIds: string[], intervalMs?: number, retryOpts?: PollRetryOptions): Promise<RuntimeScanResult[]>;
     private processQueryResults;
-    static formatResultsCsv(results: RuntimeScanResult[]): string;
+    static formatResultsCsv(results: Array<RuntimeScanResult | BulkScanResult>): string;
 }
 
 /** Scans prompts against AIRS security profiles via the Prisma AIRS SDK. */
@@ -1431,6 +1575,9 @@ declare const ConfigSchema: z.ZodObject<{
     modelSecDataEndpoint: z.ZodOptional<z.ZodString>;
     modelSecMgmtEndpoint: z.ZodOptional<z.ZodString>;
     modelSecTokenEndpoint: z.ZodOptional<z.ZodString>;
+    aiGwDataEndpoint: z.ZodOptional<z.ZodString>;
+    aiGwAdminEndpoint: z.ZodOptional<z.ZodString>;
+    aiGwTokenEndpoint: z.ZodOptional<z.ZodString>;
     scanConcurrency: z.ZodDefault<z.ZodNumber>;
     dataDir: z.ZodDefault<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
@@ -1453,6 +1600,9 @@ declare const ConfigSchema: z.ZodObject<{
     modelSecDataEndpoint?: string | undefined;
     modelSecMgmtEndpoint?: string | undefined;
     modelSecTokenEndpoint?: string | undefined;
+    aiGwDataEndpoint?: string | undefined;
+    aiGwAdminEndpoint?: string | undefined;
+    aiGwTokenEndpoint?: string | undefined;
 }, {
     airsApiKey?: string | undefined;
     airsApiToken?: string | undefined;
@@ -1471,6 +1621,9 @@ declare const ConfigSchema: z.ZodObject<{
     modelSecDataEndpoint?: string | undefined;
     modelSecMgmtEndpoint?: string | undefined;
     modelSecTokenEndpoint?: string | undefined;
+    aiGwDataEndpoint?: string | undefined;
+    aiGwAdminEndpoint?: string | undefined;
+    aiGwTokenEndpoint?: string | undefined;
     scanConcurrency?: number | undefined;
     dataDir?: string | undefined;
 }>;
@@ -1595,4 +1748,4 @@ declare function computeMetrics(results: TestResult[]): EfficacyMetrics;
 /** Compute per-category error breakdown from test results. Sorted by error rate descending. */
 declare function computeCategoryBreakdown(results: TestResult[]): CategoryBreakdown[];
 
-export { AirsScanService, type AnalysisReport, type BackupEnvelope, type BackupFormat, type BackupResult, type CategoryBreakdown, type CustomTopic, type EfficacyMetrics, type IterationResult, type ModelSecurityEvaluation, type ModelSecurityFile, type ModelSecurityFileListOptions, type ModelSecurityGroup, type ModelSecurityGroupCreateRequest, type ModelSecurityGroupListOptions, type ModelSecurityGroupUpdateRequest, type ModelSecurityLabel, type ModelSecurityPyPIAuth, type ModelSecurityRule, type ModelSecurityRuleEditableField, type ModelSecurityRuleInstance, type ModelSecurityRuleInstanceListOptions, type ModelSecurityRuleInstanceUpdateRequest, type ModelSecurityRuleListOptions, type ModelSecurityScan, type ModelSecurityScanListOptions, type ModelSecurityService, type ModelSecurityViolation, type MutationResponse, type ProfileTopic, type PromptDetail, type PromptSetDetail, type PromptSetService, type PromptSetVersionInfo, type PropertyValueList, type RedTeamAttack, type RedTeamCategory, type RedTeamCustomAttack, type RedTeamCustomReport, type RedTeamJob, type RedTeamService, type RedTeamStaticReport, type RedTeamTarget, type RedTeamTargetCreateRequest, type RedTeamTargetDetail, type RedTeamTargetUpdateRequest, type ResourceType, type RestoreResult, type RunState, type RuntimeScanResult, type RuntimeService, SdkManagementService, SdkModelSecurityService, SdkPromptSetService, SdkRedTeamService, SdkRuntimeService, type TargetOperationOptions, type TestCase, type TestResult, type UserInput, type ValidationError, computeCategoryBreakdown, computeMetrics, loadConfig, readBackupDir, readBackupFile, resolveOutputDir, sanitizeFilename, validateDescription, validateExamples, validateName, validateTopic, writeBackupFile };
+export { AirsScanService, type AnalysisReport, type BackupEnvelope, type BackupFormat, type BackupResult, type BatchEntry, type BulkScanAction, type BulkScanResult, type CategoryBreakdown, type CustomTopic, type EfficacyMetrics, type IndexedPrompt, type IterationResult, type ModelSecurityEvaluation, type ModelSecurityFile, type ModelSecurityFileListOptions, type ModelSecurityGroup, type ModelSecurityGroupCreateRequest, type ModelSecurityGroupListOptions, type ModelSecurityGroupUpdateRequest, type ModelSecurityLabel, type ModelSecurityPyPIAuth, type ModelSecurityRule, type ModelSecurityRuleEditableField, type ModelSecurityRuleInstance, type ModelSecurityRuleInstanceListOptions, type ModelSecurityRuleInstanceUpdateRequest, type ModelSecurityRuleListOptions, type ModelSecurityScan, type ModelSecurityScanListOptions, type ModelSecurityService, type ModelSecurityViolation, type MutationResponse, type PollRetryOptions, type ProfileTopic, type PromptDetail, type PromptSetDetail, type PromptSetService, type PromptSetVersionInfo, type PropertyValueList, type RedTeamAttack, type RedTeamCategory, type RedTeamCustomAttack, type RedTeamCustomReport, type RedTeamJob, type RedTeamService, type RedTeamStaticReport, type RedTeamTarget, type RedTeamTargetCreateRequest, type RedTeamTargetDetail, type RedTeamTargetUpdateRequest, type ReliableRuntimeService, type ResourceType, type RestoreResult, type RunState, type RuntimeScanResult, type RuntimeService, SDK_ASYNC_BATCH_SIZE, SdkManagementService, SdkModelSecurityService, SdkPromptSetService, SdkRedTeamService, SdkRuntimeService, type SubmittedBatch, type TargetOperationOptions, type TestCase, type TestResult, type UserInput, type ValidationError, computeCategoryBreakdown, computeMetrics, loadConfig, readBackupDir, readBackupFile, resolveOutputDir, sanitizeFilename, validateDescription, validateExamples, validateName, validateTopic, writeBackupFile };

package/dist/index.js

@@ -1,5 +1,6 @@
 import {
   AirsScanService,
+  SDK_ASYNC_BATCH_SIZE,
   SdkManagementService,
   SdkModelSecurityService,
   SdkPromptSetService,
@@ -17,9 +18,10 @@ import {
   validateName,
   validateTopic,
   writeBackupFile
-} from "./chunk-DSNQSBLE.js";
+} from "./chunk-2VIUZRPB.js";
 export {
   AirsScanService,
+  SDK_ASYNC_BATCH_SIZE,
   SdkManagementService,
   SdkModelSecurityService,
   SdkPromptSetService,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "3.1.0",
+  "version": "3.3.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",
@@ -44,7 +44,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@cdot65/prisma-airs-sdk": "^0.13.0",
+    "@cdot65/prisma-airs-sdk": "^0.17.0",
     "@inquirer/prompts": "^8.3.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",