@cdot65/prisma-airs-cli 3.2.0 → 4.0.0

package/README.md

@@ -10,7 +10,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![Node 20+](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
 
-**Full operational coverage over Palo Alto Prisma AIRS AI security — guardrail refinement, runtime scanning, AI red teaming, and model security.**
+**Full operational coverage over Palo Alto Prisma AIRS AI security — guardrail refinement, runtime scanning, AI red teaming, AI Gateway, and model security.**
 
 > **[Read the full documentation](https://cdot65.github.io/prisma-airs-cli/)** — installation, configuration, architecture, CLI reference, and examples.
 
@@ -19,7 +19,10 @@
 - **Runtime Scanning** — scan prompts and responses against AIRS security profiles, single or bulk with CSV export
 - **Guardrail Optimization** — atomic CLI commands (`create`, `apply`, `eval`, `revert`) for custom topic guardrails, designed for autonomous agent loops (see [`AGENTS.md`](AGENTS.md))
 - **AI Red Teaming** — adversarial scanning with static, dynamic, and custom prompt set attack modes
+- **[AI Gateway](https://cdot65.github.io/prisma-airs-cli/cli/aigateway/workspaces/)** — scoped/admin workspace management and workspace cost telemetry
 - **Model Security** — ML model supply chain scanning with security groups, rules, and violation tracking
+- **Unified automation output** — every read command supports `pretty`, `table`, `markdown`, `csv`, `json`, and `yaml`, with pipe-safe stdout
+- **Complete pagination** — consistent `--limit`, `--offset`, and `--all` traversal with a configurable safety cap
 - **`airs doctor`** — one-command diagnostics for environment, credentials, and API connectivity
 - **`airs config`** — manage `~/.prisma-airs/config.json` from the CLI (`list`, `get`, `set`, `unset`, `path`)
 
@@ -55,11 +58,40 @@ airs runtime topics revert --profile my-profile --name "Explosives"
 airs redteam scan --target <uuid> --name "Full Scan" --type STATIC
 airs redteam report <job-id>
 
+# Red team custom target adapters
+airs redteam adapter list --output json
+
+# AI Gateway workspaces and cost telemetry
+airs aigateway workspace list --all --output json
+airs aigateway telemetry cost --workspace <workspace-slug> --days 30
+
 # Model security
 airs model-security scans create --config scan-config.json
+
+# Pipe-safe read output and complete traversal
+airs runtime profiles list --all --output json | jq '.[].profileName'
+airs runtime topics list --all-versions --output markdown
 ```
 
-Bulk scans preserve one output row per input prompt in input order, including all eight runtime detector flags. Work is processed as sequential logical batches (`--batch-size 25` by default), with SDK requests capped at 20 prompts. Item-level state makes accepted and pending work resumable without duplicating CSV rows, and active jobs are locked against overlapping resumes. Runtime actions are exactly `allow`, `block`, or `failed`; failed or timed-out prompts make the command exit 1. Bulk scanning requires `@cdot65/prisma-airs-sdk` 0.13.2 or later.
+Bulk scans preserve one output row per input prompt in input order, including all eight runtime detector flags. Work is processed as sequential logical batches (`--batch-size 25` by default), with SDK requests capped at 20 prompts. Item-level state makes accepted and pending work resumable without duplicating CSV rows, and active jobs are locked against overlapping resumes. Runtime actions are exactly `allow`, `block`, or `failed`; failed or timed-out prompts make the command exit 1. Version 4 uses `@cdot65/prisma-airs-sdk` 0.18.0 or later.
+
+## Read Output and Pagination
+
+Read commands share one contract:
+
+- Formats: `pretty`, `table`, `markdown`, `csv`, `json`, and `yaml`.
+- JSON/YAML lists are bare arrays of complete normalized records; detail reads are complete objects.
+- Table, Markdown, and CSV are stable human-oriented projections. CSV uses RFC 4180 quoting.
+- Data is written to stdout; status, paging hints, warnings, and errors are written to stderr.
+- Output precedence is command `--output`, global `--output`, `defaultOutput`/`PANW_CLI_OUTPUT`, then `pretty`.
+- Paginated lists use `--limit`, `--offset`, and `--all`. Complete traversal is capped at 10,000 records by default; change it with `--max`, or use `--max 0` for no cap.
+- Profile and topic lists return only the latest revision by default. Use `--all-versions` or `--revision` when historical revisions are needed.
+
+```bash
+airs --output json runtime profiles list --all | jq '.[].profileName'
+PANW_CLI_OUTPUT=yaml airs runtime topics get "My Topic"
+airs model-security scans list --all --max 25000 --output csv > scans.csv
+```
 
 ## Documentation
 
@@ -69,12 +101,13 @@ The full guides, complete CLI reference, configuration, and architecture live on
 - **[Runtime Security](https://cdot65.github.io/prisma-airs-cli/runtime/overview/)** — scanning, profiles, topics, and DLP management
 - **[Guardrail Optimization](https://cdot65.github.io/prisma-airs-cli/runtime/guardrails/overview/)** — the agent-driven `topics create/apply/eval/revert` loop
 - **[AI Red Teaming](https://cdot65.github.io/prisma-airs-cli/redteam/overview/)** — static, dynamic, and custom adversarial scans
+- **[AI Gateway](https://cdot65.github.io/prisma-airs-cli/cli/aigateway/workspaces/)** — workspace CRUD, two-plane authorization, and cost telemetry
 - **[Model Security](https://cdot65.github.io/prisma-airs-cli/model-security/overview/)** — ML model supply-chain scanning
 - **[CLI Reference](https://cdot65.github.io/prisma-airs-cli/cli/)** — every command, flag, and example
 
 ## Configuration
 
-Credentials come from environment variables or `~/.prisma-airs/config.json`. At minimum: `PANW_AI_SEC_API_KEY` (scanning) and `PANW_MGMT_CLIENT_ID` / `PANW_MGMT_CLIENT_SECRET` / `PANW_MGMT_TSG_ID` (management). See [`.env.example`](.env.example) and the [configuration guide](https://cdot65.github.io/prisma-airs-cli/getting-started/configuration/) for the full list.
+Credentials come from environment variables or `~/.prisma-airs/config.json`. At minimum: `PANW_AI_SEC_API_KEY` (scanning) and `PANW_MGMT_CLIENT_ID` / `PANW_MGMT_CLIENT_SECRET` / `PANW_MGMT_TSG_ID` (management). Set `defaultOutput` in the config file or `PANW_CLI_OUTPUT` in the environment to choose a default read format. See [`.env.example`](.env.example) and the [configuration guide](https://cdot65.github.io/prisma-airs-cli/getting-started/configuration/) for the full list.
 
 ## License
 

package/dist/{chunk-TTBN7YHC.js → chunk-W5YDJS7H.js}

@@ -21,7 +21,14 @@ var SdkManagementService = class {
     return { message: response.message };
   }
   async listTopics() {
-    const response = await this.client.topics.list();
+    return this.client.topics.listAll();
+  }
+  async listLatestTopics(opts) {
+    const response = await this.client.topics.list({
+      latestOnly: true,
+      limit: opts?.limit,
+      offset: opts?.offset
+    });
     return response.custom_topics;
   }
   async getTopic(topicId) {
@@ -32,9 +39,9 @@ var SdkManagementService = class {
   }
   async getTopicByName(topicName) {
     const topics = await this.listTopics();
-    const topic = topics.find((t) => t.topic_name === topicName);
-    if (!topic) throw new Error(`Topic "${topicName}" not found`);
-    return topic;
+    const matches = topics.filter((topic) => topic.topic_name === topicName);
+    if (matches.length === 0) throw new Error(`Topic "${topicName}" not found`);
+    return matches.reduce((latest, topic) => topic.revision > latest.revision ? topic : latest);
   }
   /**
    * Sets a single custom topic on a profile's topic-guardrails config.
@@ -53,7 +60,7 @@ var SdkManagementService = class {
    * it defaults to revision 0 (original content), not the latest.
    */
   async assignTopicsToProfile(profileName, topics, guardrailAction) {
-    const { ai_profiles } = await this.client.profiles.list();
+    const ai_profiles = await this.client.profiles.listAll();
     const profile = ai_profiles.find((p) => p.profile_name === profileName);
     if (!profile?.profile_id) {
       throw new Error(`Profile "${profileName}" not found`);
@@ -102,7 +109,7 @@ var SdkManagementService = class {
     });
   }
   async getProfileTopics(profileName) {
-    const { ai_profiles } = await this.client.profiles.list();
+    const ai_profiles = await this.client.profiles.listAll();
     const profile = ai_profiles.find((p) => p.profile_name === profileName);
     if (!profile?.profile_id) {
       throw new Error(`Profile "${profileName}" not found`);
@@ -170,6 +177,12 @@ var SdkManagementService = class {
       nextOffset: response.next_offset
     };
   }
+  async listAllProfiles(opts) {
+    const profiles = await this.client.profiles.listAll(opts);
+    return profiles.map(
+      (profile) => this.normalizeProfile(profile)
+    );
+  }
   async createProfile(request) {
     const response = await this.client.profiles.create(request);
     return this.normalizeProfile(response);
@@ -208,6 +221,11 @@ var SdkManagementService = class {
       nextOffset: raw.next_offset
     };
   }
+  async listAllApiKeys(opts) {
+    return (await this.client.apiKeys.listAll(opts)).map(
+      (key) => this.normalizeApiKey(key)
+    );
+  }
   async createApiKey(request) {
     const response = await this.client.apiKeys.create(request);
     return this.normalizeApiKey(response);
@@ -240,6 +258,11 @@ var SdkManagementService = class {
       nextOffset: raw.next_offset
     };
   }
+  async listAllCustomerApps(opts) {
+    return (await this.client.customerApps.listAll(opts)).map(
+      (app) => this.normalizeCustomerApp(app)
+    );
+  }
   async getCustomerApp(appName) {
     const response = await this.client.customerApps.get(appName);
     return this.normalizeCustomerApp(response);
@@ -253,11 +276,18 @@ var SdkManagementService = class {
     return this.normalizeCustomerApp(response);
   }
   async listConsumptionApps(opts) {
-    const response = await this.client.dashboard.applicationsOverview({
-      limit: opts?.limit ?? 100,
-      offset: opts?.offset ?? 0
-    });
-    return (response.items ?? []).filter(
+    const limit = opts?.limit ?? 100;
+    let offset = opts?.offset ?? 0;
+    const items = [];
+    for (; ; ) {
+      const response = await this.client.dashboard.applicationsOverview({ limit, offset });
+      const page = response.items ?? [];
+      items.push(...page);
+      const total = response.pagination?.total_items;
+      offset += page.length;
+      if (page.length === 0 || page.length < limit || total != null && offset >= total) break;
+    }
+    return items.filter(
       (item) => typeof item.id === "string" && typeof item.name === "string"
     ).map((item) => ({
       appId: item.id,
@@ -525,6 +555,18 @@ var SdkModelSecurityService = class {
       groups: raw.security_groups.map(normalizeGroup)
     };
   }
+  async listAllGroups(opts = {}) {
+    const rows = await this.client.securityGroups.listAll({
+      source_types: opts.sourceTypes,
+      search_query: opts.searchQuery,
+      sort_field: opts.sortField,
+      sort_dir: opts.sortDir,
+      enabled_rules: opts.enabledRules,
+      limit: opts.limit,
+      max: opts.max
+    });
+    return rows.map((row) => normalizeGroup(row));
+  }
   async getGroup(uuid) {
     const response = await this.client.securityGroups.get(uuid);
     return normalizeGroup(response);
@@ -615,6 +657,15 @@ var SdkModelSecurityService = class {
       rules: raw.rules.map(normalizeRule)
     };
   }
+  async listAllRules(opts = {}) {
+    const rows = await this.client.securityRules.listAll({
+      source_type: opts.sourceType,
+      search_query: opts.searchQuery,
+      limit: opts.limit,
+      max: opts.max
+    });
+    return rows.map((row) => normalizeRule(row));
+  }
   async getRule(uuid) {
     const response = await this.client.securityRules.get(uuid);
     return normalizeRule(response);
@@ -641,6 +692,16 @@ var SdkModelSecurityService = class {
       scans: raw.scans.map(normalizeScan)
     };
   }
+  async listAllScans(opts = {}) {
+    const rows = await this.client.scans.listAll({
+      eval_outcomes: opts.evalOutcome === void 0 ? void 0 : [opts.evalOutcome],
+      source_types: opts.sourceType === void 0 ? void 0 : [opts.sourceType],
+      search_query: opts.search,
+      limit: opts.limit,
+      max: opts.max
+    });
+    return rows.map((row) => normalizeScan(row));
+  }
   async getScan(uuid) {
     const response = await this.client.scans.get(uuid);
     return normalizeScan(response);
@@ -743,6 +804,17 @@ var SdkModelSecurityService = class {
       models: raw.models.map(normalizeModel)
     };
   }
+  async listAllModels(opts = {}) {
+    const rows = await this.client.models.listAllModels({
+      search: opts.search,
+      search_query: opts.searchQuery,
+      sort_field: opts.sortField,
+      sort_order: opts.sortOrder,
+      limit: opts.limit,
+      max: opts.max
+    });
+    return rows.map((row) => normalizeModel(row));
+  }
   async getModel(uuid) {
     const response = await this.client.models.getModel(uuid);
     return normalizeModel(response);
@@ -1012,6 +1084,52 @@ function normalizeTargetDetail(raw) {
     metadata: sanitizeTargetMetadata(raw.target_metadata)
   };
 }
+function normalizeAdapterListItem(raw) {
+  return {
+    uuid: raw.uuid,
+    name: raw.name,
+    status: raw.status,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at,
+    createdByUserId: raw.created_by_user_id,
+    targetCount: raw.target_count
+  };
+}
+function normalizeAdapterVar(raw) {
+  return {
+    key: raw.key,
+    value: raw.value,
+    type: raw.type,
+    isRedacted: raw.is_redacted
+  };
+}
+function normalizeAdapterDetail(raw) {
+  return {
+    uuid: raw.uuid,
+    tsgId: raw.tsg_id,
+    name: raw.name,
+    scriptB64: raw.script_b64,
+    status: raw.status,
+    description: raw.description,
+    networkBrokerChannelUuid: raw.network_broker_channel_uuid,
+    variables: (raw.variables ?? []).map(normalizeAdapterVar),
+    targetCount: raw.target_count,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at,
+    createdByUserId: raw.created_by_user_id,
+    updatedByUserId: raw.updated_by_user_id
+  };
+}
+function preserveVariablesForUpdate(variables) {
+  return variables.map((v) => ({
+    key: v.key,
+    value: v.isRedacted ? null : v.value ?? null,
+    type: v.type
+  }));
+}
+function toWireVariables(variables) {
+  return variables.map((v) => ({ key: v.key, value: v.value, type: v.type }));
+}
 var SdkRedTeamService = class {
   client;
   constructor(opts) {
@@ -1122,29 +1240,14 @@ var SdkRedTeamService = class {
     return await this.client.targets.getTargetTemplates();
   }
   async listTargets() {
-    const all = [];
-    let skip = 0;
-    const limit = 100;
-    for (; ; ) {
-      const response = this.client.targets.list({ skip, limit });
-      const body = await response;
-      const data = body.data;
-      for (const t of data) {
-        all.push({
-          uuid: t.uuid,
-          name: t.name,
-          status: t.status,
-          targetType: t.target_type,
-          active: t.active
-        });
-      }
-      const pagination = body.pagination;
-      if (!pagination || all.length >= (pagination.total ?? data.length) || data.length < limit) {
-        break;
-      }
-      skip += limit;
-    }
-    return all;
+    const targets = await this.client.targets.listAll({ limit: 100 });
+    return targets.map((target) => ({
+      uuid: target.uuid,
+      name: target.name,
+      status: String(target.status ?? ""),
+      targetType: target.target_type == null ? void 0 : String(target.target_type),
+      active: target.active
+    }));
   }
   async getTarget(uuid) {
     const response = await this.client.targets.get(uuid);
@@ -1180,7 +1283,12 @@ var SdkRedTeamService = class {
   }
   async createScan(request) {
     let jobMetadata = {};
-    if (request.jobType === "STATIC" && request.categories) {
+    if (request.jobType === "STATIC") {
+      if (!request.categories) {
+        throw new Error(
+          "STATIC scans require categories. Pass categories explicitly or use the CLI default."
+        );
+      }
       jobMetadata = { categories: request.categories };
     } else if (request.jobType === "CUSTOM" && request.customPromptSets) {
       jobMetadata = {
@@ -1211,11 +1319,22 @@ var SdkRedTeamService = class {
     if (opts?.jobType) sdkOpts.job_type = opts.jobType;
     if (opts?.targetId) sdkOpts.target_id = opts.targetId;
     if (opts?.limit) sdkOpts.limit = opts.limit;
+    if (opts?.offset !== void 0) sdkOpts.skip = opts.offset;
     const response = await this.client.scans.list(sdkOpts);
     return response.data.map(
       normalizeJob
     );
   }
+  async listAllScans(opts) {
+    const sdkOpts = {};
+    if (opts?.status) sdkOpts.status = opts.status;
+    if (opts?.jobType) sdkOpts.job_type = opts.jobType;
+    if (opts?.targetId) sdkOpts.target_id = opts.targetId;
+    if (opts?.limit) sdkOpts.limit = opts.limit;
+    if (opts?.max !== void 0) sdkOpts.max = opts.max;
+    const rows = await this.client.scans.listAll(sdkOpts);
+    return rows.map((row) => normalizeJob(row));
+  }
   async abortScan(jobId) {
     await this.client.scans.abort(jobId);
   }
@@ -1351,6 +1470,18 @@ var SdkRedTeamService = class {
       totalItems: pagination?.total_items
     };
   }
+  async listAllChannels(opts = {}) {
+    const limit = opts.limit ?? 100;
+    const cap = opts.max === 0 ? Number.POSITIVE_INFINITY : opts.max ?? 1e4;
+    const rows = [];
+    for (let offset = 0; rows.length < cap; offset += limit) {
+      const page = await this.listChannels({ ...opts, limit, offset });
+      rows.push(...page.channels.slice(0, cap - rows.length));
+      if (page.channels.length < limit || rows.length >= (page.totalItems ?? Number.POSITIVE_INFINITY))
+        break;
+    }
+    return rows;
+  }
   async getChannel(channelId) {
     const raw = await this.client.networkBroker.getChannel(channelId);
     return normalizeChannel(raw);
@@ -1408,6 +1539,95 @@ var SdkRedTeamService = class {
       totalItems: pagination?.total_items
     };
   }
+  // -------------------------------------------------------------------------
+  // Custom target adapters (SDK 0.16.0)
+  // -------------------------------------------------------------------------
+  async listAdapters(opts) {
+    const sdkOpts = {};
+    if (opts?.limit != null) sdkOpts.limit = opts.limit;
+    if (opts?.offset != null) sdkOpts.skip = opts.offset;
+    if (opts?.search) sdkOpts.search = opts.search;
+    const raw = await this.client.adapters.list(sdkOpts);
+    const pagination = raw.pagination;
+    return {
+      adapters: (raw.data ?? []).map(normalizeAdapterListItem),
+      totalItems: pagination?.total_items
+    };
+  }
+  async listAllAdapters(opts = {}) {
+    const sdkOpts = {};
+    if (opts.limit != null) sdkOpts.limit = opts.limit;
+    if (opts.search) sdkOpts.search = opts.search;
+    if (opts.max !== void 0) sdkOpts.max = opts.max;
+    const rows = await this.client.adapters.listAll(sdkOpts);
+    return rows.map((row) => normalizeAdapterListItem(row));
+  }
+  async getAdapter(uuid) {
+    const raw = await this.client.adapters.get(uuid);
+    return normalizeAdapterDetail(raw);
+  }
+  async createAdapter(request, validate) {
+    const body = {
+      name: request.name,
+      script_b64: request.scriptB64,
+      prompt: request.prompt
+    };
+    if (request.description !== void 0) body.description = request.description;
+    if (request.networkBrokerChannelUuid !== void 0) {
+      body.network_broker_channel_uuid = request.networkBrokerChannelUuid;
+    }
+    if (request.variables !== void 0) body.variables = toWireVariables(request.variables);
+    const raw = await this.client.adapters.create(
+      // biome-ignore lint/suspicious/noExplicitAny: body is assembled dynamically; SDK validates the shape
+      body,
+      validate === void 0 ? void 0 : { validate }
+    );
+    return normalizeAdapterDetail(raw);
+  }
+  async updateAdapter(uuid, overrides, validate) {
+    const current = await this.getAdapter(uuid);
+    const body = {
+      name: overrides.name ?? current.name,
+      script_b64: overrides.scriptB64 ?? current.scriptB64,
+      prompt: overrides.prompt,
+      variables: overrides.variables ? toWireVariables(overrides.variables) : preserveVariablesForUpdate(current.variables)
+    };
+    const description = overrides.description ?? current.description;
+    if (description != null) body.description = description;
+    const channel = overrides.networkBrokerChannelUuid ?? current.networkBrokerChannelUuid;
+    if (channel != null) body.network_broker_channel_uuid = channel;
+    const raw = await this.client.adapters.update(
+      uuid,
+      // biome-ignore lint/suspicious/noExplicitAny: body is assembled dynamically; SDK validates the shape
+      body,
+      validate === void 0 ? void 0 : { validate }
+    );
+    return normalizeAdapterDetail(raw);
+  }
+  async deleteAdapter(uuid) {
+    await this.client.adapters.delete(uuid);
+  }
+  async validateAdapter(request) {
+    let variables = request.variables ? toWireVariables(request.variables) : void 0;
+    if (variables === void 0 && request.adapterUuid) {
+      const adapter = await this.getAdapter(request.adapterUuid);
+      variables = preserveVariablesForUpdate(adapter.variables);
+    }
+    const body = {
+      script_b64: request.scriptB64,
+      network_broker_channel_uuid: request.networkBrokerChannelUuid,
+      prompt: request.prompt
+    };
+    if (variables !== void 0) body.variables = variables;
+    if (request.adapterUuid !== void 0) body.adapter_uuid = request.adapterUuid;
+    const raw = await this.client.adapters.validate(body);
+    return {
+      validated: raw.validated,
+      stdout: raw.stdout,
+      stderr: raw.stderr,
+      traceback: raw.traceback
+    };
+  }
 };
 
 // src/airs/runtime.ts
@@ -2030,8 +2250,13 @@ var ConfigSchema = z.object({
   modelSecDataEndpoint: z.string().optional(),
   modelSecMgmtEndpoint: z.string().optional(),
   modelSecTokenEndpoint: z.string().optional(),
+  // AI Gateway (endpoints only; creds shared with mgmt*)
+  aiGwDataEndpoint: z.string().optional(),
+  aiGwAdminEndpoint: z.string().optional(),
+  aiGwTokenEndpoint: z.string().optional(),
   // Tuning
   scanConcurrency: z.coerce.number().int().min(1).max(20).default(5),
+  defaultOutput: z.enum(["pretty", "table", "markdown", "csv", "json", "yaml"]).optional(),
   // Persistence
   dataDir: z.string().default("~/.prisma-airs/runs")
 });
@@ -2060,7 +2285,11 @@ function fromEnv() {
     modelSecDataEndpoint: env.PANW_MODEL_SEC_DATA_ENDPOINT,
     modelSecMgmtEndpoint: env.PANW_MODEL_SEC_MGMT_ENDPOINT,
     modelSecTokenEndpoint: env.PANW_MODEL_SEC_TOKEN_ENDPOINT,
+    aiGwDataEndpoint: env.PANW_AI_GW_DATA_ENDPOINT,
+    aiGwAdminEndpoint: env.PANW_AI_GW_ADMIN_ENDPOINT,
+    aiGwTokenEndpoint: env.PANW_AI_GW_TOKEN_ENDPOINT,
     scanConcurrency: env.SCAN_CONCURRENCY,
+    defaultOutput: env.PANW_CLI_OUTPUT,
     dataDir: env.DATA_DIR
   };
 }