@cdot65/prisma-airs-cli 4.2.2 → 4.3.1

package/README.md

@@ -5,7 +5,7 @@
 [![CI](https://github.com/cdot65/prisma-airs-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/cdot65/prisma-airs-cli/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@cdot65/prisma-airs-cli)](https://www.npmjs.com/package/@cdot65/prisma-airs-cli)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
-[![Node 20+](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
+[![Node 20.17+ / 22.13+ / 24+](https://img.shields.io/badge/node-20.17%2B%20%7C%2022.13%2B%20%7C%2024%2B-brightgreen.svg)](https://nodejs.org/)
 
 **Full operational coverage over Palo Alto Prisma AIRS AI security — guardrail refinement, runtime scanning, AI red teaming, AI Gateway, and model security.**
 
@@ -30,7 +30,7 @@ npm install -g @cdot65/prisma-airs-cli
 airs --version
 ```
 
-Requires **Node.js >= 20**. Also available via `pnpm add -g`, `npx`, or as a [Docker image](https://github.com/cdot65/prisma-airs-cli/pkgs/container/prisma-airs-cli). See the [installation guide](https://cdot65.github.io/prisma-airs-cli/getting-started/installation/) for details.
+Requires **Node.js 20.17+, 22.13+, or 24+** (exact engine range: `^20.17.0 || ^22.13.0 || >=23.5.0`). Also available via `pnpm add -g`, `npx`, or as a [Docker image](https://github.com/cdot65/prisma-airs-cli/pkgs/container/prisma-airs-cli). See the [installation guide](https://cdot65.github.io/prisma-airs-cli/getting-started/installation/) for details.
 
 ## Quick Start
 

package/dist/cli/index.js

@@ -54,6 +54,7 @@ import {
 
 // src/airs/aigateway.ts
 import {
+  AIGatewayChartFiltersSchema,
   AIGatewayClient
 } from "@cdot65/prisma-airs-sdk";
 function toLimitArray(value) {
@@ -164,7 +165,7 @@ var SdkAiGatewayService = class {
    * Match a user-supplied ref against the workspace list so name | slug |
    * uuid all work. Unmatched refs pass through so the API's own error stands.
    */
-  async resolveWorkspaceRef(ref, planes) {
+  async resolveWorkspaceRef(ref, planes, requireSlug = false) {
     for (const plane of planes) {
       let rows;
       try {
@@ -172,7 +173,8 @@ var SdkAiGatewayService = class {
       } catch {
         continue;
       }
-      if (rows.some((w) => w.id === ref || w.slug === ref)) return ref;
+      const byRef = rows.find((w) => w.id === ref || w.slug === ref);
+      if (byRef) return requireSlug ? byRef.slug : ref;
       const byName = rows.filter((w) => w.name === ref);
       if (byName.length > 1) {
         throw new Error(
@@ -184,11 +186,15 @@ var SdkAiGatewayService = class {
     return ref;
   }
   async getTelemetryCost(opts) {
-    const days = opts.days ?? 7;
-    const workspaceSlug = await this.resolveWorkspaceRef(opts.workspaceSlug, ["data", "admin"]);
+    const { workspaceSlug: workspaceRef, days = 7, ...rawFilters } = opts;
+    const filters = AIGatewayChartFiltersSchema.parse(rawFilters);
+    if (!Number.isSafeInteger(days) || days <= 0)
+      throw new Error("Expected days to be a positive integer");
+    const workspaceSlug = await this.resolveWorkspaceRef(workspaceRef, ["data", "admin"], true);
     const raw = await this.client.telemetry.cost({
       workspaceSlug,
-      days
+      days,
+      ...filters
     });
     return {
       workspaceSlug,
@@ -4543,6 +4549,52 @@ function registerAiGatewayInventory(root) {
   );
 }
 
+// src/cli/commands/aigateway/telemetry-filters.ts
+import { AIGatewayChartFiltersSchema as AIGatewayChartFiltersSchema2 } from "@cdot65/prisma-airs-sdk";
+function addChartFilterOptions(command) {
+  return command.option("--trace-id <id>", "Filter by one trace ID").option("--metadata <json>", "Filter by string-valued metadata (JSON object)").option("--status-codes <codes>", "Comma-separated HTTP statuses (OR within the list)").option("--api-key-ids <ids>", "Comma-separated service key UUIDs (not secret key values)").option(
+    "--ai-org-models <pairs>",
+    "Comma-separated provider__model pairs, e.g. openai__gpt-5.6-terra"
+  ).option("--total-units-min <n>", "Inclusive minimum total tokens (nonnegative integer)").option("--total-units-max <n>", "Inclusive maximum total tokens (nonnegative integer)").option("--cost-min <cents>", "Inclusive minimum cost in cents (fractional cents allowed)").option("--cost-max <cents>", "Inclusive maximum cost in cents (fractional cents allowed)");
+}
+function csv(value) {
+  const values = value.split(",").map((entry) => entry.trim());
+  if (values.some((entry) => entry.length === 0)) throw new CliUsageError("Empty CSV element");
+  return values;
+}
+function decimal(value) {
+  if (!/^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(value)) {
+    throw new CliUsageError("Expected a decimal number");
+  }
+  return Number(value);
+}
+function chartFiltersFrom(opts) {
+  const filters = {};
+  try {
+    if (opts.traceId !== void 0) filters.traceId = opts.traceId;
+    if (opts.metadata !== void 0) filters.metadata = parseJsonOption(opts.metadata);
+    if (opts.statusCodes !== void 0)
+      filters.statusCodes = csv(opts.statusCodes).map(parseIntegerOption);
+    if (opts.apiKeyIds !== void 0) filters.apiKeyIds = csv(opts.apiKeyIds);
+    if (opts.aiOrgModels !== void 0) filters.aiOrgModels = csv(opts.aiOrgModels);
+    for (const key of ["totalUnitsMin", "totalUnitsMax"]) {
+      if (opts[key] !== void 0) filters[key] = parseIntegerOption(opts[key]);
+    }
+    for (const key of ["costMin", "costMax"]) {
+      if (opts[key] !== void 0) filters[key] = decimal(opts[key]);
+    }
+  } catch {
+    throw new CliUsageError("Invalid chart filters: check JSON, CSV and numeric flag syntax");
+  }
+  const result = AIGatewayChartFiltersSchema2.safeParse(filters);
+  if (!result.success) {
+    throw new CliUsageError(
+      "Invalid chart filters: check status codes, UUIDs, provider__model pairs, string metadata and inclusive nonnegative bounds"
+    );
+  }
+  return result.data;
+}
+
 // src/cli/commands/aigateway/telemetry.ts
 function addWindowOptions(command) {
   return addReadOutput(
@@ -4582,6 +4634,20 @@ function registerMetric(telemetry, name, description, method) {
     (opts) => runDetail(command, opts, (client) => client.telemetry[method](windowFrom(opts)))
   );
 }
+function registerFilteredMetric(telemetry, name, description) {
+  const command = addChartFilterOptions(
+    addWindowOptions(telemetry.command(name).description(description))
+  );
+  command.action(async (opts) => {
+    let options;
+    try {
+      options = { ...windowFrom(opts), ...chartFiltersFrom(opts) };
+    } catch (error) {
+      failAiGateway(error);
+    }
+    await runDetail(command, opts, (client) => client.telemetry[name](options));
+  });
+}
 function registerAiGatewayTelemetryReads(telemetry) {
   const cache = showHelpOnEmpty(telemetry.command("cache").description("Inspect cache telemetry"));
   const cacheSummary = addWindowOptions(cache.command("summary").description("Get cache totals"));
@@ -4622,7 +4688,7 @@ function registerAiGatewayTelemetryReads(telemetry) {
       })
     )
   );
-  registerMetric(telemetry, "latency", "Get latency telemetry", "latency");
+  registerFilteredMetric(telemetry, "latency", "Get latency telemetry");
   const logs = showHelpOnEmpty(telemetry.command("logs").description("Inspect request logs"));
   const logsList = addWindowOptions(
     logs.command("list").description("List request logs").option("--page-size <n>", "Rows per response", "50").option("--status-code <code>", "Filter by HTTP status").option("--trace-id <id>", "Return one trace id")
@@ -4639,9 +4705,9 @@ function registerAiGatewayTelemetryReads(telemetry) {
       })
     )
   );
-  registerMetric(telemetry, "requests", "Get request count", "requests");
+  registerFilteredMetric(telemetry, "requests", "Get request count");
   registerMetric(telemetry, "rescued-retries", "Get rescued retry telemetry", "rescuedRetries");
-  registerMetric(telemetry, "tokens", "Get token usage", "tokens");
+  registerFilteredMetric(telemetry, "tokens", "Get token usage");
   registerMetric(telemetry, "user-trends", "Get user trends", "userTrends");
   registerMetric(telemetry, "users", "Get unique-user count", "users");
 }
@@ -4842,24 +4908,28 @@ function registerAiGatewayCommand(program) {
   workspace.command("delete <ref>", { hidden: true }).description("Deprecated compatibility command for archive").option("--force", "Skip confirmation prompt").action((ref, opts) => archiveWorkspace(ref, opts, true));
   const telemetry = aigateway.command("telemetry").description("AI Gateway runtime telemetry (data plane)").action(() => telemetry.outputHelp());
   registerAiGatewayTelemetryReads(telemetry);
-  const cost = telemetry.command("cost").description(
-    "Total and per-day spend for a workspace (API reports cents; pretty output shows dollars)"
-  ).requiredOption("--workspace <slug>", "Workspace slug (not UUID), e.g. ws-main-a-349e0e").option("--days <n>", "Rolling window in days, counted back from now", "7").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
-    "after",
-    examples(
-      "airs aigateway telemetry cost --workspace ws-main-a-349e0e",
-      "airs aigateway telemetry cost --workspace ws-main-a-349e0e --days 30 --output json"
+  const cost = addChartFilterOptions(
+    telemetry.command("cost").description(
+      "Total and per-day spend for a workspace (API reports cents; pretty output shows dollars)"
+    ).requiredOption("--workspace <ref>", "Workspace slug, UUID, or unique display name").option("--days <n>", "Rolling window in days, counted back from now", "7").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
+      "after",
+      examples(
+        "airs aigateway telemetry cost --workspace ws-main-a-349e0e",
+        "airs aigateway telemetry cost --workspace ws-main-a-349e0e --days 30 --output json"
+      )
     )
   ).action(async (opts) => {
     try {
+      const days = parsePositiveInteger2(opts.days, "--days");
+      const filters = chartFiltersFrom(opts);
       const fmt = await resolveOutput(cost, opts);
       if (fmt === "pretty") renderAiGatewayHeader();
-      const days = Number.parseInt(opts.days, 10);
-      if (!Number.isFinite(days) || days <= 0) {
-        usageError(`Invalid --days '${opts.days}'. Expected a positive integer`);
-      }
       const service = await createService();
-      const report = await service.getTelemetryCost({ workspaceSlug: opts.workspace, days });
+      const report = await service.getTelemetryCost({
+        workspaceSlug: opts.workspace,
+        days,
+        ...filters
+      });
       renderCostReport(report, fmt);
     } catch (err) {
       failWithGrantHint(err);
@@ -5150,17 +5220,23 @@ import { randomUUID } from "crypto";
 import { readFile as readFile4 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
 var DOCTOR_TIMEOUT_MS = 5e3;
-var MIN_NODE_MAJOR = 20;
+var SUPPORTED_NODE_VERSIONS = "^20.17.0 || ^22.13.0 || >=23.5.0";
 function checkNodeVersion(version = process.version) {
-  const major = Number.parseInt(version.replace(/^v/, ""), 10);
-  if (Number.isFinite(major) && major >= MIN_NODE_MAJOR) {
-    return { name: "Node.js version", status: "pass", detail: `${version} (>= 20 required)` };
+  const match = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(version);
+  const [major, minor, patch] = match ? match.slice(1).map(Number) : [];
+  const supported = [major, minor, patch].every(Number.isSafeInteger) && (major === 20 && minor >= 17 || major === 22 && minor >= 13 || major === 23 && minor >= 5 || major >= 24);
+  if (supported) {
+    return {
+      name: "Node.js version",
+      status: "pass",
+      detail: `${version} (${SUPPORTED_NODE_VERSIONS} required)`
+    };
   }
   return {
     name: "Node.js version",
     status: "fail",
-    detail: `${version} is below the required Node ${MIN_NODE_MAJOR}`,
-    hint: `Upgrade to Node ${MIN_NODE_MAJOR}+ (e.g. via nvm or your package manager)`
+    detail: `${version} does not satisfy ${SUPPORTED_NODE_VERSIONS}`,
+    hint: "Use a supported Node runtime: 20.17+, 22.13+, or 24+ (e.g. via nvm or your package manager)"
   };
 }
 async function checkConfigFile(filePath) {
@@ -6594,9 +6670,9 @@ function registerRedteamCommand(program) {
     try {
       renderRedteamHeader();
       const service = await createPromptSetService();
-      const csv = await service.downloadTemplate(uuid);
+      const csv2 = await service.downloadTemplate(uuid);
       const outPath = opts.outputFile || `${uuid}-template.csv`;
-      fs2.writeFileSync(outPath, csv, "utf-8");
+      fs2.writeFileSync(outPath, csv2, "utf-8");
       ui.success(`Template saved to ${outPath}`);
     } catch (err) {
       fail(err);
@@ -8419,6 +8495,30 @@ function register2(dlp) {
   });
 }
 
+// src/cli/renderer/dlp-generate.ts
+function renderGenerateSummary(summary, output) {
+  if (output === "json") {
+    console.log(JSON.stringify(summary, null, 2));
+    return;
+  }
+  ui.header("DLP Test-File Generation");
+  ui.keyValue([
+    ["Output", summary.out],
+    ["Seed", summary.seed],
+    ["Clean", summary.clean],
+    ["Dirty", summary.dirty],
+    ["Manifest", summary.manifestPath]
+  ]);
+  ui.table(
+    [
+      { key: "format", label: "Format" },
+      { key: "clean", label: "Clean" },
+      { key: "dirty", label: "Dirty" }
+    ],
+    Object.entries(summary.byFormat).map(([format, counts]) => ({ format, ...counts }))
+  );
+}
+
 // src/cli/commands/dlp/generate.ts
 var ALL_FORMATS = ["pdf", "png", "jpeg", "svg", "docx"];
 var OPTIONAL_DEPS_HINT = "DLP generate requires optional dependencies. Install them with: pnpm add sharp pdf-lib docx piexifjs";
@@ -8447,39 +8547,29 @@ function parseTypes(value) {
   return types;
 }
 function register3(parent) {
-  parent.command("generate").description(
+  const command = parent.command("generate").description(
     "Generate clean + dirty DLP test files (synthetic sensitive data) across PDF/PNG/JPEG/SVG/DOCX"
-  ).option("--types <list>", "Comma list: pdf,png,jpeg,svg,docx (or all)", "all").option("--count <n>", "Clean files per type", "1").option("--out <dir>", "Output base directory", "./temp").option("--techniques <list>", "all or comma list of technique ids", "all").option("--seed <n>", "Seed for reproducible payloads").option("--output <format>", "Summary format: pretty or json", "pretty").action(async (opts) => {
+  ).option("--types <list>", "Comma list: pdf,png,jpeg,svg,docx (or all)", "all").option("--count <n>", "Clean files per type", "1").option("--out <dir>", "Output base directory", "./temp").option("--techniques <list>", "all or comma list of technique ids", "all").option("--seed <n>", "Safe integer seed for reproducible payloads").option("--output <format>", "Summary format: pretty or json", "pretty").action(async (opts) => {
     let types;
     try {
       types = parseTypes(opts.types);
     } catch (err) {
       usageError(err instanceof Error ? err.message : String(err));
     }
-    const count = Number.parseInt(opts.count, 10);
-    if (!Number.isInteger(count) || count < 1) {
-      usageError("--count must be a positive integer");
+    const count = Number(opts.count);
+    if (!/^\d+$/.test(opts.count) || !Number.isSafeInteger(count) || count < 1) {
+      usageError("--count must be a positive safe integer");
     }
     const techniques = opts.techniques === "all" ? "all" : opts.techniques.split(",").map((t) => t.trim());
-    const seed = opts.seed === void 0 ? void 0 : Number.parseInt(opts.seed, 10);
+    const seed = opts.seed === void 0 ? void 0 : Number(opts.seed);
+    if (seed !== void 0 && (!/^-?\d+$/.test(opts.seed) || !Number.isSafeInteger(seed))) {
+      usageError("--seed must be a safe integer");
+    }
     try {
+      const output = await resolveOutput(command, opts, { allowed: ["pretty", "json"] });
       const generateCorpus = await loadGenerateCorpus();
       const summary = await generateCorpus({ types, count, out: opts.out, techniques, seed });
-      if (opts.output === "json") {
-        console.log(JSON.stringify(summary, null, 2));
-        return;
-      }
-      ui.header("DLP Test-File Generation");
-      ui.keyValue([
-        ["Output", summary.out],
-        ["Seed", summary.seed],
-        ["Clean", summary.clean],
-        ["Dirty", summary.dirty],
-        ["Manifest", summary.manifestPath]
-      ]);
-      for (const [fmt, counts] of Object.entries(summary.byFormat)) {
-        ui.dim(`${fmt.padEnd(5)} clean=${counts.clean} dirty=${counts.dirty}`);
-      }
+      renderGenerateSummary(summary, output);
     } catch (err) {
       fail(err);
     }
@@ -9047,8 +9137,8 @@ function parseCsvLine(line) {
   }
   return fields;
 }
-function loadPrompts(csv, onWarning) {
-  const lines = csv.split(/\r?\n/);
+function loadPrompts(csv2, onWarning) {
+  const lines = csv2.split(/\r?\n/);
   const nonEmpty = lines.filter((l) => l.trim() !== "");
   if (nonEmpty.length === 0) {
     throw new Error("CSV is empty");
@@ -9245,12 +9335,12 @@ function registerSampleCommand(parent) {
   });
   cmd.action(async (opts) => {
     resolveDeprecatedAliases(cmd, opts);
-    const csv = buildSampleCsv();
+    const csv2 = buildSampleCsv();
     if (opts.outputFile) {
-      await writeFile4(opts.outputFile, csv, "utf-8");
+      await writeFile4(opts.outputFile, csv2, "utf-8");
       ui.success(`Sample CSV written to ${opts.outputFile}`);
     } else {
-      process.stdout.write(csv);
+      process.stdout.write(csv2);
     }
   });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "4.2.2",
+  "version": "4.3.1",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",
@@ -14,11 +14,13 @@
   },
   "scripts": {
     "build": "tsup",
-    "prepublishOnly": "pnpm run build",
+    "prepublishOnly": "pnpm audit:prod && pnpm run build",
     "dev": "tsx src/cli/index.ts",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "test:release": "node --test .github/scripts/*.test.mjs",
+    "audit:prod": "pnpm audit --prod --audit-level low",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "test:e2e:aigateway": "vitest run --config vitest.e2e.config.ts tests/e2e/aigateway-cli.e2e.spec.ts",
     "lint": "biome check --config-path config .",
@@ -49,7 +51,7 @@
     "local:unlink": "pnpm uninstall --global @cdot65/prisma-airs-cli"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": "^20.17.0 || ^22.13.0 || >=23.5.0"
   },
   "repository": {
     "type": "git",
@@ -57,13 +59,13 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@cdot65/prisma-airs-sdk": "0.23.0",
+    "@cdot65/prisma-airs-sdk": "0.24.0",
     "@inquirer/prompts": "^8.3.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "dotenv": "^17.3.1",
-    "js-yaml": "^4.1.1",
-    "nanoid": "^5.0.0",
+    "js-yaml": "^4.3.2",
+    "nanoid": "^5.1.16",
     "p-limit": "^6.0.0",
     "zod": "^3.24.0"
   },
@@ -84,6 +86,6 @@
     "docx": "^9.6.1",
     "pdf-lib": "^1.17.1",
     "piexifjs": "^1.0.6",
-    "sharp": "^0.34.5"
+    "sharp": "^0.35.4"
   }
 }