@cdot65/prisma-airs-cli 4.1.2 → 4.2.0

package/dist/{chunk-W5YDJS7H.js → chunk-LF6JPUA4.js}

@@ -2254,6 +2254,11 @@ var ConfigSchema = z.object({
   aiGwDataEndpoint: z.string().optional(),
   aiGwAdminEndpoint: z.string().optional(),
   aiGwTokenEndpoint: z.string().optional(),
+  // Runtime inference has separate key authentication, never management OAuth.
+  aiGwInferenceEndpoint: z.string().optional(),
+  aiGwInferenceApiKey: z.string().optional(),
+  aiGwInferenceModel: z.string().optional(),
+  aiGwEmbeddingModel: z.string().optional(),
   // Tuning
   scanConcurrency: z.coerce.number().int().min(1).max(20).default(5),
   defaultOutput: z.enum(["pretty", "table", "markdown", "csv", "json", "yaml"]).optional(),
@@ -2288,6 +2293,10 @@ function fromEnv() {
     aiGwDataEndpoint: env.PANW_AI_GW_DATA_ENDPOINT,
     aiGwAdminEndpoint: env.PANW_AI_GW_ADMIN_ENDPOINT,
     aiGwTokenEndpoint: env.PANW_AI_GW_TOKEN_ENDPOINT,
+    aiGwInferenceEndpoint: env.PANW_AI_GW_INFERENCE_ENDPOINT,
+    aiGwInferenceApiKey: env.PANW_AI_GW_INFERENCE_API_KEY,
+    aiGwInferenceModel: env.PANW_AI_GW_INFERENCE_MODEL,
+    aiGwEmbeddingModel: env.PANW_AI_GW_EMBEDDING_MODEL,
     scanConcurrency: env.SCAN_CONCURRENCY,
     defaultOutput: env.PANW_CLI_OUTPUT,
     dataDir: env.DATA_DIR

package/dist/cli/index.js

@@ -20,7 +20,7 @@ import {
   sanitizeFilename,
   validateTopic,
   writeBackupFile
-} from "../chunk-W5YDJS7H.js";
+} from "../chunk-LF6JPUA4.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -2970,6 +2970,168 @@ ${lines.map((l) => `  $ ${l}`).join("\n")}
 `;
 }
 
+// src/cli/commands/aigateway/inference.ts
+import { readFile } from "fs/promises";
+import {
+  AIGatewayInferenceClient,
+  ErrorType,
+  GatewayInferenceInputCreateChatCompletionRequestSchema,
+  GatewayInferenceInputCreateEmbeddingRequestSchema,
+  GatewayInferenceInputCreateResponseSchema
+} from "@cdot65/prisma-airs-sdk";
+import { dump as dump3 } from "js-yaml";
+function integer(raw, flag) {
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < 1)
+    throw new CliUsageError(`${flag} must be a positive integer`);
+  return value;
+}
+async function inferenceBody(kind, prompt, opts, defaultModel) {
+  if (prompt !== void 0 && opts.file)
+    throw new CliUsageError("Pass a prompt or --file, not both");
+  if (prompt === void 0 && !opts.file) throw new CliUsageError("A prompt or --file is required");
+  let body;
+  if (opts.file) {
+    let value;
+    try {
+      value = JSON.parse(await readFile(opts.file, "utf8"));
+    } catch {
+      throw new CliUsageError("--file must name a readable JSON request file");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new CliUsageError("--file must contain a JSON object");
+    body = value;
+  } else {
+    body = kind === "chat" ? { messages: [{ role: "user", content: prompt }] } : { input: prompt };
+  }
+  body = { ...body };
+  const model = opts.model ?? body.model ?? defaultModel;
+  if (typeof model !== "string" || !model.trim())
+    throw new CliUsageError(
+      "Set --model, the request model, or the matching inference model config"
+    );
+  body.model = model;
+  if (opts.stream !== void 0) body.stream = opts.stream;
+  if (opts.maxTokens !== void 0)
+    body[kind === "responses" ? "max_output_tokens" : "max_completion_tokens"] = integer(
+      opts.maxTokens,
+      "--max-tokens"
+    );
+  if (opts.dimensions !== void 0) body.dimensions = integer(opts.dimensions, "--dimensions");
+  if (opts.encoding !== void 0) body.encoding_format = opts.encoding;
+  if (kind === "responses" && body.store === void 0) body.store = false;
+  return body;
+}
+function responseText(value) {
+  if (!value || typeof value !== "object") return "";
+  const record = value;
+  if (record.type === "response.output_text.delta" && typeof record.delta === "string")
+    return record.delta;
+  if (Array.isArray(record.choices))
+    return record.choices.map((choice) => choice.message?.content ?? choice.delta?.content ?? "").join("");
+  if (Array.isArray(record.output))
+    return record.output.flatMap((item) => Array.isArray(item.content) ? item.content : []).filter((part) => part.type === "output_text").map((part) => part.text).join("");
+  return "";
+}
+function registerAiGatewayInference(parent) {
+  const group = parent.command("inference").description("Call the gateway runtime (separate API key; no SCM OAuth required)");
+  for (const kind of ["chat", "responses", "embeddings"]) {
+    const command = group.command(`${kind} [prompt]`).description(
+      `${kind === "embeddings" ? "Create embeddings" : "Generate a model response"} through your runtime gateway`
+    ).option("--model <id>", "Provider-prefixed model ID; overrides request file and config").option("--endpoint <url>", "Runtime base URL including /v1; overrides config").option("--file <path>", "JSON request file (mutually exclusive with prompt)").option("--timeout <ms>", "Total deadline including streaming, in milliseconds", "60000").option(
+      "--output <format>",
+      "pretty, json or yaml; streaming json emits one chunk per line (JSONL)"
+    );
+    if (kind === "embeddings")
+      command.option("--dimensions <n>", "Embedding dimensions").option("--encoding <format>", "float or base64");
+    else
+      command.option("--stream", "Stream text (pretty) or validated events (json/JSONL)").option("--max-tokens <n>", "Maximum completion/output tokens");
+    command.action(async (prompt, opts) => {
+      const controller = new AbortController();
+      const interrupt = () => controller.abort(new Error("Inference interrupted"));
+      const outputError = (error) => controller.abort(error);
+      let stream;
+      let failed = false;
+      let failure;
+      try {
+        const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
+        const config = await loadConfig({ aiGwInferenceEndpoint: opts.endpoint });
+        const body = await inferenceBody(
+          kind,
+          prompt,
+          opts,
+          kind === "embeddings" ? config.aiGwEmbeddingModel : config.aiGwInferenceModel
+        );
+        if (body.stream === true && format === "yaml")
+          throw new CliUsageError("Streaming supports --output pretty or json (JSONL), not yaml");
+        const schema = kind === "chat" ? GatewayInferenceInputCreateChatCompletionRequestSchema : kind === "responses" ? GatewayInferenceInputCreateResponseSchema : GatewayInferenceInputCreateEmbeddingRequestSchema;
+        const parsed = schema.safeParse(body);
+        if (!parsed.success)
+          throw new CliUsageError(
+            `Invalid inference request: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.code}`).join("; ")}`
+          );
+        const client = new AIGatewayInferenceClient({
+          endpoint: config.aiGwInferenceEndpoint,
+          apiKey: config.aiGwInferenceApiKey,
+          timeoutMs: integer(opts.timeout ?? "60000", "--timeout"),
+          numRetries: 0
+        });
+        process.once("SIGINT", interrupt);
+        process.once("SIGTERM", interrupt);
+        process.stdout.on("error", outputError);
+        const write = (text) => new Promise((resolve2, reject) => {
+          process.stdout.write(text, (error) => error ? reject(error) : resolve2());
+        });
+        const requestOptions = { signal: controller.signal };
+        const result = kind === "chat" ? await client.createChatCompletion(
+          GatewayInferenceInputCreateChatCompletionRequestSchema.parse(body),
+          requestOptions
+        ) : kind === "responses" ? await client.createResponse(
+          GatewayInferenceInputCreateResponseSchema.parse(body),
+          requestOptions
+        ) : await client.createEmbedding(
+          GatewayInferenceInputCreateEmbeddingRequestSchema.parse(body),
+          requestOptions
+        );
+        if (Symbol.asyncIterator in result) {
+          stream = result;
+          for await (const event of result) {
+            if (format === "json") await write(`${JSON.stringify(event)}
+`);
+            else {
+              const text = responseText(event);
+              if (text) await write(text);
+            }
+            if ("type" in event && (event.type === "response.failed" || event.type === "response.incomplete"))
+              throw new Error(`Gateway generation ended with ${event.type}`);
+          }
+          if (format === "pretty") await write("\n");
+        } else {
+          const text = format === "yaml" ? dump3(result, { noRefs: true }).trimEnd() : format === "pretty" && kind !== "embeddings" ? responseText(result) : JSON.stringify(result, null, 2);
+          await write(`${text}
+`);
+          if ("status" in result && (result.status === "failed" || result.status === "incomplete"))
+            throw new Error(`Gateway generation ended with ${result.status}`);
+        }
+      } catch (error) {
+        failed = true;
+        failure = error;
+      } finally {
+        await stream?.cancel();
+        controller.abort();
+        process.removeListener("SIGINT", interrupt);
+        process.removeListener("SIGTERM", interrupt);
+        process.stdout.removeListener("error", outputError);
+      }
+      if (failed && failure?.code !== "EPIPE") {
+        if (failure?.errorType === ErrorType.USER_REQUEST_PAYLOAD_ERROR)
+          usageError(failure instanceof Error ? failure.message : "Invalid inference options");
+        fail(failure);
+      }
+    });
+  }
+}
+
 // src/cli/commands/aigateway/inventory.ts
 import {
   AI_GATEWAY_DEPLOYMENT_STATUSES,
@@ -3036,7 +3198,7 @@ function isSensitiveKey(key) {
 function redactHeaders(headers) {
   const out = {};
   for (const [k, v] of Object.entries(headers)) {
-    out[k] = isSensitiveKey(k) ? MASK : v;
+    out[k] = isSensitiveKey(k) || /^x-portkey-(config|metadata|forward-headers)$/i.test(k) ? MASK : v;
   }
   return out;
 }
@@ -3106,20 +3268,27 @@ function headersToRecord(headers) {
 }
 var KEEP_DEBUG_LOGS = 10;
 function installDebugLogger(logPath) {
-  mkdirSync(dirname(logPath), { recursive: true });
-  writeFileSync(logPath, "", "utf-8");
+  mkdirSync(dirname(logPath), { recursive: true, mode: 448 });
+  writeFileSync(logPath, "", { encoding: "utf8", mode: 384 });
   pruneDebugLogs(dirname(logPath), KEEP_DEBUG_LOGS);
   const originalFetch = globalThis.fetch;
   globalThis.fetch = async function debugFetch(input, init2) {
     const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-    if (!isAirsUrl(url)) {
+    const rawHeaders = headersToRecord(
+      init2?.headers ?? (input instanceof Request ? input.headers : void 0)
+    );
+    const inference = Object.keys(rawHeaders).some(
+      (name) => name.toLowerCase() === "x-portkey-api-key"
+    );
+    if (!isAirsUrl(url) && !inference) {
       return originalFetch(input, init2);
     }
     const method = init2?.method ?? (input instanceof Request ? input.method : "GET");
-    const reqHeaders = redactHeaders(headersToRecord(init2?.headers));
+    const reqHeaders = redactHeaders(rawHeaders);
     const loggedUrl = redactUrl(url);
     let reqBody;
-    if (init2?.body) {
+    if (inference) reqBody = "[BODY OMITTED]";
+    else if (init2?.body) {
       try {
         reqBody = redactDeep(JSON.parse(String(init2.body)));
       } catch {
@@ -3134,7 +3303,7 @@ function installDebugLogger(logPath) {
     try {
       response = await originalFetch(input, init2);
     } catch (err) {
-      error = err instanceof Error ? err.message : String(err);
+      error = inference ? "Runtime request failed" : err instanceof Error ? err.message : String(err);
       const entry2 = JSON.stringify({
         timestamp: ts2,
         durationMs: Date.now() - startMs,
@@ -3150,16 +3319,20 @@ function installDebugLogger(logPath) {
     response.headers.forEach((v, k) => {
       resHeaders[k] = v;
     });
-    const clone = response.clone();
-    try {
-      const text = await clone.text();
+    if (inference || response.headers.get("content-type")?.includes("text/event-stream")) {
+      resBody = "[BODY OMITTED]";
+    } else {
+      const clone = response.clone();
       try {
-        resBody = redactDeep(JSON.parse(text));
+        const text = await clone.text();
+        try {
+          resBody = redactDeep(JSON.parse(text));
+        } catch {
+          resBody = text;
+        }
       } catch {
-        resBody = text;
+        resBody = "<unreadable>";
       }
-    } catch {
-      resBody = "<unreadable>";
     }
     const entry = JSON.stringify({
       timestamp: ts2,
@@ -3184,9 +3357,9 @@ function installDebugLogger(logPath) {
 }
 
 // src/cli/commands/aigateway/shared.ts
-import { open, readFile, unlink } from "fs/promises";
+import { open, readFile as readFile2, unlink } from "fs/promises";
 import { AIGatewayClient as AIGatewayClient2 } from "@cdot65/prisma-airs-sdk";
-import { dump as dump3, load } from "js-yaml";
+import { dump as dump4, load } from "js-yaml";
 async function defaultClientFactory() {
   const config = await loadConfig();
   return new AIGatewayClient2(aiGatewayClientOptions(config));
@@ -3210,7 +3383,7 @@ function addWriteOutput(command) {
 async function readGatewayRequest(path3) {
   let parsed;
   try {
-    const text = await readFile(path3, "utf8");
+    const text = await readFile2(path3, "utf8");
     parsed = path3.endsWith(".yaml") || path3.endsWith(".yml") ? load(text) : JSON.parse(text);
   } catch (error) {
     throw new CliUsageError(
@@ -3267,7 +3440,7 @@ function renderGatewayList(items, format, label) {
     return;
   }
   if (format === "yaml") {
-    console.log(dump3(items, { noRefs: true, lineWidth: -1 }).trimEnd());
+    console.log(dump4(items, { noRefs: true, lineWidth: -1 }).trimEnd());
     return;
   }
   if (items.length === 0) {
@@ -3285,7 +3458,7 @@ function renderGatewayDetail(value, format) {
     return;
   }
   if (format === "yaml") {
-    console.log(dump3(item, { noRefs: true, lineWidth: -1 }).trimEnd());
+    console.log(dump4(item, { noRefs: true, lineWidth: -1 }).trimEnd());
     return;
   }
   const rows = Object.entries(item).map(([key, raw]) => ({
@@ -3401,7 +3574,7 @@ async function runSecretWrite(command, opts, prepare, write, prompt, settings =
 import {
   AISecSDKException,
   buildDottedObject,
-  ErrorType,
+  ErrorType as ErrorType2,
   GatewayJsonObjectSchema,
   setDottedValue
 } from "@cdot65/prisma-airs-sdk";
@@ -3522,7 +3695,7 @@ function optionName(option) {
 }
 function asUsageError(error, prefix = "Invalid AI Gateway request") {
   if (error instanceof CliUsageError) return error;
-  if (error instanceof AISecSDKException && error.errorType === ErrorType.USER_REQUEST_PAYLOAD_ERROR) {
+  if (error instanceof AISecSDKException && error.errorType === ErrorType2.USER_REQUEST_PAYLOAD_ERROR) {
     return new CliUsageError(`${prefix}: ${error.message}`);
   }
   return new CliUsageError(`${prefix}: ${schemaMessage(error)}`);
@@ -4535,6 +4708,7 @@ function scopeNameLooksUnrelated(name, scopeName) {
 function registerAiGatewayCommand(program) {
   const aigateway = program.command("aigateway").description("Manage and observe Prisma AIRS AI Gateway resources").action(() => aigateway.outputHelp());
   registerAiGatewayInventory(aigateway);
+  registerAiGatewayInference(aigateway);
   const workspace = aigateway.command("workspaces").alias("workspace").description("Manage gateway workspaces").action(() => workspace.outputHelp());
   const workspaceList = workspace.command("list").description("List workspaces (default: active workspaces you are scoped to)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--status <status>", "Filter by lifecycle state: active or archived").option("--all", "Merge active + archived admin-plane reads (whole tenant, both states)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
@@ -4813,7 +4987,7 @@ function registerCompletionCommand(program) {
 }
 
 // src/cli/commands/config.ts
-import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
+import { mkdir, readFile as readFile3, writeFile } from "fs/promises";
 import { dirname as dirname2 } from "path";
 var CONFIG_KEYS = Object.keys(ConfigSchema.shape);
 var SECRET_PATTERN = /key|secret|token|password/i;
@@ -4837,7 +5011,7 @@ function buildConfigRows(inspected, reveal) {
 async function readConfigFileStrict(filePath) {
   let raw;
   try {
-    raw = await readFile2(filePath, "utf-8");
+    raw = await readFile3(filePath, "utf-8");
   } catch {
     return { ok: true, data: {} };
   }
@@ -4973,7 +5147,7 @@ function registerConfigCommand(program) {
 
 // src/cli/commands/doctor.ts
 import { randomUUID } from "crypto";
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile4 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
 var DOCTOR_TIMEOUT_MS = 5e3;
 var MIN_NODE_MAJOR = 20;
@@ -4993,7 +5167,7 @@ async function checkConfigFile(filePath) {
   const name = "Config file";
   let raw;
   try {
-    raw = await readFile3(filePath, "utf-8");
+    raw = await readFile4(filePath, "utf-8");
   } catch {
     return {
       name,
@@ -7155,7 +7329,7 @@ function registerRedteamCommand(program) {
 // src/cli/commands/runtime.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import * as fs5 from "fs";
-import { readFile as readFile9 } from "fs/promises";
+import { readFile as readFile10 } from "fs/promises";
 import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
 import chalk11 from "chalk";
 
@@ -7834,7 +8008,7 @@ var topicsView = {
 };
 
 // src/cli/commands/dlp/dictionaries.ts
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 import { basename as basename2 } from "path";
 
 // src/airs/dlp/dictionaries.ts
@@ -7873,7 +8047,7 @@ var SdkDictionariesService = class {
 };
 
 // src/cli/commands/dlp/patch.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 function buildMergePatch(opts) {
   const out = {};
   for (const entry of opts.set ?? []) {
@@ -7915,7 +8089,7 @@ function coerceValue(raw) {
 async function parseBody(opts) {
   let raw;
   if (opts.bodyFile) {
-    raw = await readFile6(opts.bodyFile, "utf-8");
+    raw = await readFile7(opts.bodyFile, "utf-8");
   } else if (opts.body === "-") {
     const chunks = [];
     for await (const chunk of opts.stdin ?? process.stdin) {
@@ -7936,7 +8110,7 @@ async function parseBody(opts) {
 // src/cli/commands/dlp/dictionaries.ts
 async function buildMetadata(opts) {
   if (opts.metadataFile) {
-    return JSON.parse(await readFile7(opts.metadataFile, "utf-8"));
+    return JSON.parse(await readFile8(opts.metadataFile, "utf-8"));
   }
   if (!opts.name || !opts.category || !opts.region || !opts.file) {
     throw new Error("--name, --category, --region, and --file are required");
@@ -7981,7 +8155,7 @@ function register(dlp) {
     try {
       const metadata = await buildMetadata(opts);
       if (!opts.file) throw new Error("--file is required (multipart upload)");
-      const file = await readFile7(opts.file);
+      const file = await readFile8(opts.file);
       const r = await new SdkDictionariesService().create({
         metadata,
         file,
@@ -8009,7 +8183,7 @@ function register(dlp) {
     try {
       const metadata = await buildMetadata(opts);
       if (!opts.file) throw new Error("--file is required (multipart upload)");
-      const file = await readFile7(opts.file);
+      const file = await readFile8(opts.file);
       const r = await new SdkDictionariesService().replace(id, {
         metadata,
         file,
@@ -8492,7 +8666,10 @@ function writeFlags2(cmd) {
 }
 async function resolveWriteBody2(opts) {
   if (opts.body || opts.bodyFile) {
-    const body = await parseBody({ body: opts.body, bodyFile: opts.bodyFile });
+    const body = await parseBody({
+      body: opts.body,
+      bodyFile: opts.bodyFile
+    });
     if (!body) throw new Error("--body or --body-file was empty");
     return body;
   }
@@ -8500,7 +8677,7 @@ async function resolveWriteBody2(opts) {
 }
 function register5(dlp) {
   const group = dlp.command("profiles").description(
-    'DLP data profiles. DELETE is not exposed by the DLP API. To remove a profile, patch with profile_status: "deleted".'
+    "DLP data profiles. No supported DELETE; status-based retirement is not live-verified."
   );
   const listCmd = listFlags3(group.command("list").description("List data profiles"));
   listCmd.action(async (opts) => {
@@ -8569,14 +8746,13 @@ function register5(dlp) {
       usageError(err instanceof Error ? err.message : String(err));
     }
   });
-  group.command("delete <id>").description("Not supported \u2014 prints the patch idiom and exits 2").action((id) => {
+  group.command("delete <id>").description("Not supported \u2014 explains the cleanup limitation and exits 2").action((id) => {
     usageError(
       `This DLP API has no DELETE for data profiles.
-  To soft-delete, fetch the profile to get its name + profile_type, then patch:
-
-    airs runtime dlp profiles get ${id} --output json
-    airs runtime dlp profiles patch ${id} --set profile_status='"deleted"' \\
-      --set name='"<existing-name>"' --set profile_type='"<existing-type>"'`
+  Status-based retirement is not live-verified: the latest owned-fixture
+  PATCH/PUT returned HTTP 500; an advertised DELETE returned HTTP 501.
+  No API request was sent by this command. Do not assume the profile was removed.
+  Inspect current state with: airs runtime dlp profiles get ${id} --output json`
     );
   });
 }
@@ -8829,7 +9005,7 @@ function registerCreateCommand(parent) {
 }
 
 // src/cli/commands/topics-eval.ts
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 
 // src/core/prompt-loader.ts
 function parseCsvLine(line) {
@@ -8972,7 +9148,7 @@ function registerEvalCommand(parent) {
     resolveDeprecatedAliases(cmd, opts);
     try {
       const config = await loadConfig();
-      const csvContent = await readFile8(opts.prompts, "utf-8");
+      const csvContent = await readFile9(opts.prompts, "utf-8");
       const { cases, intent } = loadPrompts(csvContent, (msg) => ui.status(`Warning: ${msg}`));
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
@@ -9274,7 +9450,7 @@ function registerRuntimeCommand(program) {
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
       }
-      const raw = await readFile9(opts.file, "utf-8");
+      const raw = await readFile10(opts.file, "utf-8");
       const prompts = parseInputFile(raw, opts.file);
       if (prompts.length === 0) {
         usageError("No prompts found in input file");

package/dist/index.d.ts

@@ -1657,6 +1657,10 @@ declare const ConfigSchema: z.ZodObject<{
     aiGwDataEndpoint: z.ZodOptional<z.ZodString>;
     aiGwAdminEndpoint: z.ZodOptional<z.ZodString>;
     aiGwTokenEndpoint: z.ZodOptional<z.ZodString>;
+    aiGwInferenceEndpoint: z.ZodOptional<z.ZodString>;
+    aiGwInferenceApiKey: z.ZodOptional<z.ZodString>;
+    aiGwInferenceModel: z.ZodOptional<z.ZodString>;
+    aiGwEmbeddingModel: z.ZodOptional<z.ZodString>;
     scanConcurrency: z.ZodDefault<z.ZodNumber>;
     defaultOutput: z.ZodOptional<z.ZodEnum<["pretty", "table", "markdown", "csv", "json", "yaml"]>>;
     dataDir: z.ZodDefault<z.ZodString>;
@@ -1683,6 +1687,10 @@ declare const ConfigSchema: z.ZodObject<{
     aiGwDataEndpoint?: string | undefined;
     aiGwAdminEndpoint?: string | undefined;
     aiGwTokenEndpoint?: string | undefined;
+    aiGwInferenceEndpoint?: string | undefined;
+    aiGwInferenceApiKey?: string | undefined;
+    aiGwInferenceModel?: string | undefined;
+    aiGwEmbeddingModel?: string | undefined;
     defaultOutput?: "json" | "yaml" | "pretty" | "table" | "markdown" | "csv" | undefined;
 }, {
     airsApiKey?: string | undefined;
@@ -1705,6 +1713,10 @@ declare const ConfigSchema: z.ZodObject<{
     aiGwDataEndpoint?: string | undefined;
     aiGwAdminEndpoint?: string | undefined;
     aiGwTokenEndpoint?: string | undefined;
+    aiGwInferenceEndpoint?: string | undefined;
+    aiGwInferenceApiKey?: string | undefined;
+    aiGwInferenceModel?: string | undefined;
+    aiGwEmbeddingModel?: string | undefined;
     scanConcurrency?: number | undefined;
     defaultOutput?: "json" | "yaml" | "pretty" | "table" | "markdown" | "csv" | undefined;
     dataDir?: string | undefined;

package/dist/index.js

@@ -18,7 +18,7 @@ import {
   validateName,
   validateTopic,
   writeBackupFile
-} from "./chunk-W5YDJS7H.js";
+} from "./chunk-LF6JPUA4.js";
 export {
   AirsScanService,
   SDK_ASYNC_BATCH_SIZE,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "4.1.2",
+  "version": "4.2.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",
@@ -57,7 +57,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@cdot65/prisma-airs-sdk": "0.20.0",
+    "@cdot65/prisma-airs-sdk": "0.21.0",
     "@inquirer/prompts": "^8.3.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",