@cdot65/prisma-airs-cli 3.3.0 → 4.0.0

package/README.md

@@ -21,6 +21,8 @@
 - **AI Red Teaming** — adversarial scanning with static, dynamic, and custom prompt set attack modes
 - **[AI Gateway](https://cdot65.github.io/prisma-airs-cli/cli/aigateway/workspaces/)** — scoped/admin workspace management and workspace cost telemetry
 - **Model Security** — ML model supply chain scanning with security groups, rules, and violation tracking
+- **Unified automation output** — every read command supports `pretty`, `table`, `markdown`, `csv`, `json`, and `yaml`, with pipe-safe stdout
+- **Complete pagination** — consistent `--limit`, `--offset`, and `--all` traversal with a configurable safety cap
 - **`airs doctor`** — one-command diagnostics for environment, credentials, and API connectivity
 - **`airs config`** — manage `~/.prisma-airs/config.json` from the CLI (`list`, `get`, `set`, `unset`, `path`)
 
@@ -65,9 +67,31 @@ airs aigateway telemetry cost --workspace <workspace-slug> --days 30
 
 # Model security
 airs model-security scans create --config scan-config.json
+
+# Pipe-safe read output and complete traversal
+airs runtime profiles list --all --output json | jq '.[].profileName'
+airs runtime topics list --all-versions --output markdown
 ```
 
-Bulk scans preserve one output row per input prompt in input order, including all eight runtime detector flags. Work is processed as sequential logical batches (`--batch-size 25` by default), with SDK requests capped at 20 prompts. Item-level state makes accepted and pending work resumable without duplicating CSV rows, and active jobs are locked against overlapping resumes. Runtime actions are exactly `allow`, `block`, or `failed`; failed or timed-out prompts make the command exit 1. Bulk scanning requires `@cdot65/prisma-airs-sdk` 0.13.2 or later.
+Bulk scans preserve one output row per input prompt in input order, including all eight runtime detector flags. Work is processed as sequential logical batches (`--batch-size 25` by default), with SDK requests capped at 20 prompts. Item-level state makes accepted and pending work resumable without duplicating CSV rows, and active jobs are locked against overlapping resumes. Runtime actions are exactly `allow`, `block`, or `failed`; failed or timed-out prompts make the command exit 1. Version 4 uses `@cdot65/prisma-airs-sdk` 0.18.0 or later.
+
+## Read Output and Pagination
+
+Read commands share one contract:
+
+- Formats: `pretty`, `table`, `markdown`, `csv`, `json`, and `yaml`.
+- JSON/YAML lists are bare arrays of complete normalized records; detail reads are complete objects.
+- Table, Markdown, and CSV are stable human-oriented projections. CSV uses RFC 4180 quoting.
+- Data is written to stdout; status, paging hints, warnings, and errors are written to stderr.
+- Output precedence is command `--output`, global `--output`, `defaultOutput`/`PANW_CLI_OUTPUT`, then `pretty`.
+- Paginated lists use `--limit`, `--offset`, and `--all`. Complete traversal is capped at 10,000 records by default; change it with `--max`, or use `--max 0` for no cap.
+- Profile and topic lists return only the latest revision by default. Use `--all-versions` or `--revision` when historical revisions are needed.
+
+```bash
+airs --output json runtime profiles list --all | jq '.[].profileName'
+PANW_CLI_OUTPUT=yaml airs runtime topics get "My Topic"
+airs model-security scans list --all --max 25000 --output csv > scans.csv
+```
 
 ## Documentation
 
@@ -83,7 +107,7 @@ The full guides, complete CLI reference, configuration, and architecture live on
 
 ## Configuration
 
-Credentials come from environment variables or `~/.prisma-airs/config.json`. At minimum: `PANW_AI_SEC_API_KEY` (scanning) and `PANW_MGMT_CLIENT_ID` / `PANW_MGMT_CLIENT_SECRET` / `PANW_MGMT_TSG_ID` (management). See [`.env.example`](.env.example) and the [configuration guide](https://cdot65.github.io/prisma-airs-cli/getting-started/configuration/) for the full list.
+Credentials come from environment variables or `~/.prisma-airs/config.json`. At minimum: `PANW_AI_SEC_API_KEY` (scanning) and `PANW_MGMT_CLIENT_ID` / `PANW_MGMT_CLIENT_SECRET` / `PANW_MGMT_TSG_ID` (management). Set `defaultOutput` in the config file or `PANW_CLI_OUTPUT` in the environment to choose a default read format. See [`.env.example`](.env.example) and the [configuration guide](https://cdot65.github.io/prisma-airs-cli/getting-started/configuration/) for the full list.
 
 ## License
 

package/dist/{chunk-2VIUZRPB.js → chunk-W5YDJS7H.js}

@@ -21,7 +21,14 @@ var SdkManagementService = class {
     return { message: response.message };
   }
   async listTopics() {
-    const response = await this.client.topics.list();
+    return this.client.topics.listAll();
+  }
+  async listLatestTopics(opts) {
+    const response = await this.client.topics.list({
+      latestOnly: true,
+      limit: opts?.limit,
+      offset: opts?.offset
+    });
     return response.custom_topics;
   }
   async getTopic(topicId) {
@@ -32,9 +39,9 @@ var SdkManagementService = class {
   }
   async getTopicByName(topicName) {
     const topics = await this.listTopics();
-    const topic = topics.find((t) => t.topic_name === topicName);
-    if (!topic) throw new Error(`Topic "${topicName}" not found`);
-    return topic;
+    const matches = topics.filter((topic) => topic.topic_name === topicName);
+    if (matches.length === 0) throw new Error(`Topic "${topicName}" not found`);
+    return matches.reduce((latest, topic) => topic.revision > latest.revision ? topic : latest);
   }
   /**
    * Sets a single custom topic on a profile's topic-guardrails config.
@@ -53,7 +60,7 @@ var SdkManagementService = class {
    * it defaults to revision 0 (original content), not the latest.
    */
   async assignTopicsToProfile(profileName, topics, guardrailAction) {
-    const { ai_profiles } = await this.client.profiles.list();
+    const ai_profiles = await this.client.profiles.listAll();
     const profile = ai_profiles.find((p) => p.profile_name === profileName);
     if (!profile?.profile_id) {
       throw new Error(`Profile "${profileName}" not found`);
@@ -102,7 +109,7 @@ var SdkManagementService = class {
     });
   }
   async getProfileTopics(profileName) {
-    const { ai_profiles } = await this.client.profiles.list();
+    const ai_profiles = await this.client.profiles.listAll();
     const profile = ai_profiles.find((p) => p.profile_name === profileName);
     if (!profile?.profile_id) {
       throw new Error(`Profile "${profileName}" not found`);
@@ -170,6 +177,12 @@ var SdkManagementService = class {
       nextOffset: response.next_offset
     };
   }
+  async listAllProfiles(opts) {
+    const profiles = await this.client.profiles.listAll(opts);
+    return profiles.map(
+      (profile) => this.normalizeProfile(profile)
+    );
+  }
   async createProfile(request) {
     const response = await this.client.profiles.create(request);
     return this.normalizeProfile(response);
@@ -208,6 +221,11 @@ var SdkManagementService = class {
       nextOffset: raw.next_offset
     };
   }
+  async listAllApiKeys(opts) {
+    return (await this.client.apiKeys.listAll(opts)).map(
+      (key) => this.normalizeApiKey(key)
+    );
+  }
   async createApiKey(request) {
     const response = await this.client.apiKeys.create(request);
     return this.normalizeApiKey(response);
@@ -240,6 +258,11 @@ var SdkManagementService = class {
       nextOffset: raw.next_offset
     };
   }
+  async listAllCustomerApps(opts) {
+    return (await this.client.customerApps.listAll(opts)).map(
+      (app) => this.normalizeCustomerApp(app)
+    );
+  }
   async getCustomerApp(appName) {
     const response = await this.client.customerApps.get(appName);
     return this.normalizeCustomerApp(response);
@@ -253,11 +276,18 @@ var SdkManagementService = class {
     return this.normalizeCustomerApp(response);
   }
   async listConsumptionApps(opts) {
-    const response = await this.client.dashboard.applicationsOverview({
-      limit: opts?.limit ?? 100,
-      offset: opts?.offset ?? 0
-    });
-    return (response.items ?? []).filter(
+    const limit = opts?.limit ?? 100;
+    let offset = opts?.offset ?? 0;
+    const items = [];
+    for (; ; ) {
+      const response = await this.client.dashboard.applicationsOverview({ limit, offset });
+      const page = response.items ?? [];
+      items.push(...page);
+      const total = response.pagination?.total_items;
+      offset += page.length;
+      if (page.length === 0 || page.length < limit || total != null && offset >= total) break;
+    }
+    return items.filter(
       (item) => typeof item.id === "string" && typeof item.name === "string"
     ).map((item) => ({
       appId: item.id,
@@ -525,6 +555,18 @@ var SdkModelSecurityService = class {
       groups: raw.security_groups.map(normalizeGroup)
     };
   }
+  async listAllGroups(opts = {}) {
+    const rows = await this.client.securityGroups.listAll({
+      source_types: opts.sourceTypes,
+      search_query: opts.searchQuery,
+      sort_field: opts.sortField,
+      sort_dir: opts.sortDir,
+      enabled_rules: opts.enabledRules,
+      limit: opts.limit,
+      max: opts.max
+    });
+    return rows.map((row) => normalizeGroup(row));
+  }
   async getGroup(uuid) {
     const response = await this.client.securityGroups.get(uuid);
     return normalizeGroup(response);
@@ -615,6 +657,15 @@ var SdkModelSecurityService = class {
       rules: raw.rules.map(normalizeRule)
     };
   }
+  async listAllRules(opts = {}) {
+    const rows = await this.client.securityRules.listAll({
+      source_type: opts.sourceType,
+      search_query: opts.searchQuery,
+      limit: opts.limit,
+      max: opts.max
+    });
+    return rows.map((row) => normalizeRule(row));
+  }
   async getRule(uuid) {
     const response = await this.client.securityRules.get(uuid);
     return normalizeRule(response);
@@ -641,6 +692,16 @@ var SdkModelSecurityService = class {
       scans: raw.scans.map(normalizeScan)
     };
   }
+  async listAllScans(opts = {}) {
+    const rows = await this.client.scans.listAll({
+      eval_outcomes: opts.evalOutcome === void 0 ? void 0 : [opts.evalOutcome],
+      source_types: opts.sourceType === void 0 ? void 0 : [opts.sourceType],
+      search_query: opts.search,
+      limit: opts.limit,
+      max: opts.max
+    });
+    return rows.map((row) => normalizeScan(row));
+  }
   async getScan(uuid) {
     const response = await this.client.scans.get(uuid);
     return normalizeScan(response);
@@ -743,6 +804,17 @@ var SdkModelSecurityService = class {
       models: raw.models.map(normalizeModel)
     };
   }
+  async listAllModels(opts = {}) {
+    const rows = await this.client.models.listAllModels({
+      search: opts.search,
+      search_query: opts.searchQuery,
+      sort_field: opts.sortField,
+      sort_order: opts.sortOrder,
+      limit: opts.limit,
+      max: opts.max
+    });
+    return rows.map((row) => normalizeModel(row));
+  }
   async getModel(uuid) {
     const response = await this.client.models.getModel(uuid);
     return normalizeModel(response);
@@ -1168,29 +1240,14 @@ var SdkRedTeamService = class {
     return await this.client.targets.getTargetTemplates();
   }
   async listTargets() {
-    const all = [];
-    let skip = 0;
-    const limit = 100;
-    for (; ; ) {
-      const response = this.client.targets.list({ skip, limit });
-      const body = await response;
-      const data = body.data;
-      for (const t of data) {
-        all.push({
-          uuid: t.uuid,
-          name: t.name,
-          status: t.status,
-          targetType: t.target_type,
-          active: t.active
-        });
-      }
-      const pagination = body.pagination;
-      if (!pagination || all.length >= (pagination.total ?? data.length) || data.length < limit) {
-        break;
-      }
-      skip += limit;
-    }
-    return all;
+    const targets = await this.client.targets.listAll({ limit: 100 });
+    return targets.map((target) => ({
+      uuid: target.uuid,
+      name: target.name,
+      status: String(target.status ?? ""),
+      targetType: target.target_type == null ? void 0 : String(target.target_type),
+      active: target.active
+    }));
   }
   async getTarget(uuid) {
     const response = await this.client.targets.get(uuid);
@@ -1262,11 +1319,22 @@ var SdkRedTeamService = class {
     if (opts?.jobType) sdkOpts.job_type = opts.jobType;
     if (opts?.targetId) sdkOpts.target_id = opts.targetId;
     if (opts?.limit) sdkOpts.limit = opts.limit;
+    if (opts?.offset !== void 0) sdkOpts.skip = opts.offset;
     const response = await this.client.scans.list(sdkOpts);
     return response.data.map(
       normalizeJob
     );
   }
+  async listAllScans(opts) {
+    const sdkOpts = {};
+    if (opts?.status) sdkOpts.status = opts.status;
+    if (opts?.jobType) sdkOpts.job_type = opts.jobType;
+    if (opts?.targetId) sdkOpts.target_id = opts.targetId;
+    if (opts?.limit) sdkOpts.limit = opts.limit;
+    if (opts?.max !== void 0) sdkOpts.max = opts.max;
+    const rows = await this.client.scans.listAll(sdkOpts);
+    return rows.map((row) => normalizeJob(row));
+  }
   async abortScan(jobId) {
     await this.client.scans.abort(jobId);
   }
@@ -1402,6 +1470,18 @@ var SdkRedTeamService = class {
       totalItems: pagination?.total_items
     };
   }
+  async listAllChannels(opts = {}) {
+    const limit = opts.limit ?? 100;
+    const cap = opts.max === 0 ? Number.POSITIVE_INFINITY : opts.max ?? 1e4;
+    const rows = [];
+    for (let offset = 0; rows.length < cap; offset += limit) {
+      const page = await this.listChannels({ ...opts, limit, offset });
+      rows.push(...page.channels.slice(0, cap - rows.length));
+      if (page.channels.length < limit || rows.length >= (page.totalItems ?? Number.POSITIVE_INFINITY))
+        break;
+    }
+    return rows;
+  }
   async getChannel(channelId) {
     const raw = await this.client.networkBroker.getChannel(channelId);
     return normalizeChannel(raw);
@@ -1474,6 +1554,14 @@ var SdkRedTeamService = class {
       totalItems: pagination?.total_items
     };
   }
+  async listAllAdapters(opts = {}) {
+    const sdkOpts = {};
+    if (opts.limit != null) sdkOpts.limit = opts.limit;
+    if (opts.search) sdkOpts.search = opts.search;
+    if (opts.max !== void 0) sdkOpts.max = opts.max;
+    const rows = await this.client.adapters.listAll(sdkOpts);
+    return rows.map((row) => normalizeAdapterListItem(row));
+  }
   async getAdapter(uuid) {
     const raw = await this.client.adapters.get(uuid);
     return normalizeAdapterDetail(raw);
@@ -2168,6 +2256,7 @@ var ConfigSchema = z.object({
   aiGwTokenEndpoint: z.string().optional(),
   // Tuning
   scanConcurrency: z.coerce.number().int().min(1).max(20).default(5),
+  defaultOutput: z.enum(["pretty", "table", "markdown", "csv", "json", "yaml"]).optional(),
   // Persistence
   dataDir: z.string().default("~/.prisma-airs/runs")
 });
@@ -2200,6 +2289,7 @@ function fromEnv() {
     aiGwAdminEndpoint: env.PANW_AI_GW_ADMIN_ENDPOINT,
     aiGwTokenEndpoint: env.PANW_AI_GW_TOKEN_ENDPOINT,
     scanConcurrency: env.SCAN_CONCURRENCY,
+    defaultOutput: env.PANW_CLI_OUTPUT,
     dataDir: env.DATA_DIR
   };
 }