@cdot65/prisma-airs-cli 3.2.0 → 3.3.0

package/README.md

@@ -10,7 +10,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![Node 20+](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
 
-**Full operational coverage over Palo Alto Prisma AIRS AI security — guardrail refinement, runtime scanning, AI red teaming, and model security.**
+**Full operational coverage over Palo Alto Prisma AIRS AI security — guardrail refinement, runtime scanning, AI red teaming, AI Gateway, and model security.**
 
 > **[Read the full documentation](https://cdot65.github.io/prisma-airs-cli/)** — installation, configuration, architecture, CLI reference, and examples.
 
@@ -19,6 +19,7 @@
 - **Runtime Scanning** — scan prompts and responses against AIRS security profiles, single or bulk with CSV export
 - **Guardrail Optimization** — atomic CLI commands (`create`, `apply`, `eval`, `revert`) for custom topic guardrails, designed for autonomous agent loops (see [`AGENTS.md`](AGENTS.md))
 - **AI Red Teaming** — adversarial scanning with static, dynamic, and custom prompt set attack modes
+- **[AI Gateway](https://cdot65.github.io/prisma-airs-cli/cli/aigateway/workspaces/)** — scoped/admin workspace management and workspace cost telemetry
 - **Model Security** — ML model supply chain scanning with security groups, rules, and violation tracking
 - **`airs doctor`** — one-command diagnostics for environment, credentials, and API connectivity
 - **`airs config`** — manage `~/.prisma-airs/config.json` from the CLI (`list`, `get`, `set`, `unset`, `path`)
@@ -55,6 +56,13 @@ airs runtime topics revert --profile my-profile --name "Explosives"
 airs redteam scan --target <uuid> --name "Full Scan" --type STATIC
 airs redteam report <job-id>
 
+# Red team custom target adapters
+airs redteam adapter list --output json
+
+# AI Gateway workspaces and cost telemetry
+airs aigateway workspace list --all --output json
+airs aigateway telemetry cost --workspace <workspace-slug> --days 30
+
 # Model security
 airs model-security scans create --config scan-config.json
 ```
@@ -69,6 +77,7 @@ The full guides, complete CLI reference, configuration, and architecture live on
 - **[Runtime Security](https://cdot65.github.io/prisma-airs-cli/runtime/overview/)** — scanning, profiles, topics, and DLP management
 - **[Guardrail Optimization](https://cdot65.github.io/prisma-airs-cli/runtime/guardrails/overview/)** — the agent-driven `topics create/apply/eval/revert` loop
 - **[AI Red Teaming](https://cdot65.github.io/prisma-airs-cli/redteam/overview/)** — static, dynamic, and custom adversarial scans
+- **[AI Gateway](https://cdot65.github.io/prisma-airs-cli/cli/aigateway/workspaces/)** — workspace CRUD, two-plane authorization, and cost telemetry
 - **[Model Security](https://cdot65.github.io/prisma-airs-cli/model-security/overview/)** — ML model supply-chain scanning
 - **[CLI Reference](https://cdot65.github.io/prisma-airs-cli/cli/)** — every command, flag, and example
 

package/dist/{chunk-TTBN7YHC.js → chunk-2VIUZRPB.js}

@@ -1012,6 +1012,52 @@ function normalizeTargetDetail(raw) {
     metadata: sanitizeTargetMetadata(raw.target_metadata)
   };
 }
+function normalizeAdapterListItem(raw) {
+  return {
+    uuid: raw.uuid,
+    name: raw.name,
+    status: raw.status,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at,
+    createdByUserId: raw.created_by_user_id,
+    targetCount: raw.target_count
+  };
+}
+function normalizeAdapterVar(raw) {
+  return {
+    key: raw.key,
+    value: raw.value,
+    type: raw.type,
+    isRedacted: raw.is_redacted
+  };
+}
+function normalizeAdapterDetail(raw) {
+  return {
+    uuid: raw.uuid,
+    tsgId: raw.tsg_id,
+    name: raw.name,
+    scriptB64: raw.script_b64,
+    status: raw.status,
+    description: raw.description,
+    networkBrokerChannelUuid: raw.network_broker_channel_uuid,
+    variables: (raw.variables ?? []).map(normalizeAdapterVar),
+    targetCount: raw.target_count,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at,
+    createdByUserId: raw.created_by_user_id,
+    updatedByUserId: raw.updated_by_user_id
+  };
+}
+function preserveVariablesForUpdate(variables) {
+  return variables.map((v) => ({
+    key: v.key,
+    value: v.isRedacted ? null : v.value ?? null,
+    type: v.type
+  }));
+}
+function toWireVariables(variables) {
+  return variables.map((v) => ({ key: v.key, value: v.value, type: v.type }));
+}
 var SdkRedTeamService = class {
   client;
   constructor(opts) {
@@ -1180,7 +1226,12 @@ var SdkRedTeamService = class {
   }
   async createScan(request) {
     let jobMetadata = {};
-    if (request.jobType === "STATIC" && request.categories) {
+    if (request.jobType === "STATIC") {
+      if (!request.categories) {
+        throw new Error(
+          "STATIC scans require categories. Pass categories explicitly or use the CLI default."
+        );
+      }
       jobMetadata = { categories: request.categories };
     } else if (request.jobType === "CUSTOM" && request.customPromptSets) {
       jobMetadata = {
@@ -1408,6 +1459,87 @@ var SdkRedTeamService = class {
       totalItems: pagination?.total_items
     };
   }
+  // -------------------------------------------------------------------------
+  // Custom target adapters (SDK 0.16.0)
+  // -------------------------------------------------------------------------
+  async listAdapters(opts) {
+    const sdkOpts = {};
+    if (opts?.limit != null) sdkOpts.limit = opts.limit;
+    if (opts?.offset != null) sdkOpts.skip = opts.offset;
+    if (opts?.search) sdkOpts.search = opts.search;
+    const raw = await this.client.adapters.list(sdkOpts);
+    const pagination = raw.pagination;
+    return {
+      adapters: (raw.data ?? []).map(normalizeAdapterListItem),
+      totalItems: pagination?.total_items
+    };
+  }
+  async getAdapter(uuid) {
+    const raw = await this.client.adapters.get(uuid);
+    return normalizeAdapterDetail(raw);
+  }
+  async createAdapter(request, validate) {
+    const body = {
+      name: request.name,
+      script_b64: request.scriptB64,
+      prompt: request.prompt
+    };
+    if (request.description !== void 0) body.description = request.description;
+    if (request.networkBrokerChannelUuid !== void 0) {
+      body.network_broker_channel_uuid = request.networkBrokerChannelUuid;
+    }
+    if (request.variables !== void 0) body.variables = toWireVariables(request.variables);
+    const raw = await this.client.adapters.create(
+      // biome-ignore lint/suspicious/noExplicitAny: body is assembled dynamically; SDK validates the shape
+      body,
+      validate === void 0 ? void 0 : { validate }
+    );
+    return normalizeAdapterDetail(raw);
+  }
+  async updateAdapter(uuid, overrides, validate) {
+    const current = await this.getAdapter(uuid);
+    const body = {
+      name: overrides.name ?? current.name,
+      script_b64: overrides.scriptB64 ?? current.scriptB64,
+      prompt: overrides.prompt,
+      variables: overrides.variables ? toWireVariables(overrides.variables) : preserveVariablesForUpdate(current.variables)
+    };
+    const description = overrides.description ?? current.description;
+    if (description != null) body.description = description;
+    const channel = overrides.networkBrokerChannelUuid ?? current.networkBrokerChannelUuid;
+    if (channel != null) body.network_broker_channel_uuid = channel;
+    const raw = await this.client.adapters.update(
+      uuid,
+      // biome-ignore lint/suspicious/noExplicitAny: body is assembled dynamically; SDK validates the shape
+      body,
+      validate === void 0 ? void 0 : { validate }
+    );
+    return normalizeAdapterDetail(raw);
+  }
+  async deleteAdapter(uuid) {
+    await this.client.adapters.delete(uuid);
+  }
+  async validateAdapter(request) {
+    let variables = request.variables ? toWireVariables(request.variables) : void 0;
+    if (variables === void 0 && request.adapterUuid) {
+      const adapter = await this.getAdapter(request.adapterUuid);
+      variables = preserveVariablesForUpdate(adapter.variables);
+    }
+    const body = {
+      script_b64: request.scriptB64,
+      network_broker_channel_uuid: request.networkBrokerChannelUuid,
+      prompt: request.prompt
+    };
+    if (variables !== void 0) body.variables = variables;
+    if (request.adapterUuid !== void 0) body.adapter_uuid = request.adapterUuid;
+    const raw = await this.client.adapters.validate(body);
+    return {
+      validated: raw.validated,
+      stdout: raw.stdout,
+      stderr: raw.stderr,
+      traceback: raw.traceback
+    };
+  }
 };
 
 // src/airs/runtime.ts
@@ -2030,6 +2162,10 @@ var ConfigSchema = z.object({
   modelSecDataEndpoint: z.string().optional(),
   modelSecMgmtEndpoint: z.string().optional(),
   modelSecTokenEndpoint: z.string().optional(),
+  // AI Gateway (endpoints only; creds shared with mgmt*)
+  aiGwDataEndpoint: z.string().optional(),
+  aiGwAdminEndpoint: z.string().optional(),
+  aiGwTokenEndpoint: z.string().optional(),
   // Tuning
   scanConcurrency: z.coerce.number().int().min(1).max(20).default(5),
   // Persistence
@@ -2060,6 +2196,9 @@ function fromEnv() {
     modelSecDataEndpoint: env.PANW_MODEL_SEC_DATA_ENDPOINT,
     modelSecMgmtEndpoint: env.PANW_MODEL_SEC_MGMT_ENDPOINT,
     modelSecTokenEndpoint: env.PANW_MODEL_SEC_TOKEN_ENDPOINT,
+    aiGwDataEndpoint: env.PANW_AI_GW_DATA_ENDPOINT,
+    aiGwAdminEndpoint: env.PANW_AI_GW_ADMIN_ENDPOINT,
+    aiGwTokenEndpoint: env.PANW_AI_GW_TOKEN_ENDPOINT,
     scanConcurrency: env.SCAN_CONCURRENCY,
     dataDir: env.DATA_DIR
   };