@cdot65/prisma-airs-cli 4.3.0 → 4.4.0

package/README.md

@@ -5,7 +5,7 @@
 [![CI](https://github.com/cdot65/prisma-airs-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/cdot65/prisma-airs-cli/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@cdot65/prisma-airs-cli)](https://www.npmjs.com/package/@cdot65/prisma-airs-cli)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
-[![Node 20+](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
+[![Node 20.17+ / 22.13+ / 24+](https://img.shields.io/badge/node-20.17%2B%20%7C%2022.13%2B%20%7C%2024%2B-brightgreen.svg)](https://nodejs.org/)
 
 **Full operational coverage over Palo Alto Prisma AIRS AI security — guardrail refinement, runtime scanning, AI red teaming, AI Gateway, and model security.**
 
@@ -30,7 +30,7 @@ npm install -g @cdot65/prisma-airs-cli
 airs --version
 ```
 
-Requires **Node.js >= 20**. Also available via `pnpm add -g`, `npx`, or as a [Docker image](https://github.com/cdot65/prisma-airs-cli/pkgs/container/prisma-airs-cli). See the [installation guide](https://cdot65.github.io/prisma-airs-cli/getting-started/installation/) for details.
+Requires **Node.js 20.17+, 22.13+, or 24+** (exact engine range: `^20.17.0 || ^22.13.0 || >=23.5.0`). Also available via `pnpm add -g`, `npx`, or as a [Docker image](https://github.com/cdot65/prisma-airs-cli/pkgs/container/prisma-airs-cli). See the [installation guide](https://cdot65.github.io/prisma-airs-cli/getting-started/installation/) for details.
 
 ## Quick Start
 

package/dist/cli/index.js

@@ -4549,6 +4549,12 @@ function registerAiGatewayInventory(root) {
   );
 }
 
+// src/cli/commands/aigateway/telemetry.ts
+import {
+  AI_GW_GROUP_COLUMNS,
+  AI_GW_GROUP_DIMENSIONS
+} from "@cdot65/prisma-airs-sdk";
+
 // src/cli/commands/aigateway/telemetry-filters.ts
 import { AIGatewayChartFiltersSchema as AIGatewayChartFiltersSchema2 } from "@cdot65/prisma-airs-sdk";
 function addChartFilterOptions(command) {
@@ -4648,6 +4654,25 @@ function registerFilteredMetric(telemetry, name, description) {
     await runDetail(command, opts, (client) => client.telemetry[name](options));
   });
 }
+var groupDimensions = [...AI_GW_GROUP_DIMENSIONS, "status_code", "users"];
+function isGroupDimension(value) {
+  return groupDimensions.some((dimension) => dimension === value);
+}
+function isGroupColumn(value) {
+  return AI_GW_GROUP_COLUMNS.some((column) => column === value);
+}
+function groupOptionsFrom(dimension, opts) {
+  const options = { ...windowFrom(opts), ...chartFiltersFrom(opts) };
+  if (opts.columns !== void 0) {
+    if (dimension === "users") throw new CliUsageError("User grouping does not support --columns");
+    const columns = opts.columns.split(",").map((column) => column.trim());
+    if (!columns.every(isGroupColumn)) {
+      throw new CliUsageError(`Invalid --columns: choose from ${AI_GW_GROUP_COLUMNS.join(", ")}`);
+    }
+    options.columns = columns;
+  }
+  return options;
+}
 function registerAiGatewayTelemetryReads(telemetry) {
   const cache = showHelpOnEmpty(telemetry.command("cache").description("Inspect cache telemetry"));
   const cacheSummary = addWindowOptions(cache.command("summary").description("Get cache totals"));
@@ -4675,19 +4700,30 @@ function registerAiGatewayTelemetryReads(telemetry) {
       (opts) => runDetail(command, opts, (client) => client.telemetry[method](windowFrom(opts)))
     );
   }
-  const groupBy = addWindowOptions(
-    telemetry.command("group-by <dimension>").description("Aggregate telemetry by provider, model, status, or another SDK dimension").option("--columns <names>", "Comma-separated aggregate columns")
-  );
-  groupBy.action(
-    (dimension, opts) => runDetail(
-      groupBy,
-      opts,
-      (client) => client.telemetry.groupBy(dimension, {
-        ...windowFrom(opts),
-        ...opts.columns ? { columns: opts.columns.split(",").map((value) => value.trim()) } : {}
-      })
+  const groupBy = addChartFilterOptions(
+    addWindowOptions(
+      telemetry.command("group-by <dimension>").description(`Aggregate telemetry by ${groupDimensions.join(", ")}`).option("--columns <names>", "Comma-separated aggregate columns (not supported for users)")
     )
   );
+  groupBy.action(async (dimension, opts) => {
+    let options;
+    try {
+      if (!isGroupDimension(dimension)) {
+        throw new CliUsageError(
+          `Invalid grouping dimension: choose from ${groupDimensions.join(", ")}`
+        );
+      }
+      options = groupOptionsFrom(dimension, opts);
+    } catch (error) {
+      failAiGateway(error);
+    }
+    await runDetail(groupBy, opts, (client) => {
+      if (dimension === "users") return client.telemetry.byUser(options);
+      if (dimension === "status_code") return client.telemetry.byStatusCode(options);
+      if (isGroupDimension(dimension)) return client.telemetry.groupBy(dimension, options);
+      throw new CliUsageError("Invalid grouping dimension");
+    });
+  });
   registerFilteredMetric(telemetry, "latency", "Get latency telemetry");
   const logs = showHelpOnEmpty(telemetry.command("logs").description("Inspect request logs"));
   const logsList = addWindowOptions(
@@ -5220,17 +5256,23 @@ import { randomUUID } from "crypto";
 import { readFile as readFile4 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
 var DOCTOR_TIMEOUT_MS = 5e3;
-var MIN_NODE_MAJOR = 20;
+var SUPPORTED_NODE_VERSIONS = "^20.17.0 || ^22.13.0 || >=23.5.0";
 function checkNodeVersion(version = process.version) {
-  const major = Number.parseInt(version.replace(/^v/, ""), 10);
-  if (Number.isFinite(major) && major >= MIN_NODE_MAJOR) {
-    return { name: "Node.js version", status: "pass", detail: `${version} (>= 20 required)` };
+  const match = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(version);
+  const [major, minor, patch] = match ? match.slice(1).map(Number) : [];
+  const supported = [major, minor, patch].every(Number.isSafeInteger) && (major === 20 && minor >= 17 || major === 22 && minor >= 13 || major === 23 && minor >= 5 || major >= 24);
+  if (supported) {
+    return {
+      name: "Node.js version",
+      status: "pass",
+      detail: `${version} (${SUPPORTED_NODE_VERSIONS} required)`
+    };
   }
   return {
     name: "Node.js version",
     status: "fail",
-    detail: `${version} is below the required Node ${MIN_NODE_MAJOR}`,
-    hint: `Upgrade to Node ${MIN_NODE_MAJOR}+ (e.g. via nvm or your package manager)`
+    detail: `${version} does not satisfy ${SUPPORTED_NODE_VERSIONS}`,
+    hint: "Use a supported Node runtime: 20.17+, 22.13+, or 24+ (e.g. via nvm or your package manager)"
   };
 }
 async function checkConfigFile(filePath) {
@@ -8489,6 +8531,30 @@ function register2(dlp) {
   });
 }
 
+// src/cli/renderer/dlp-generate.ts
+function renderGenerateSummary(summary, output) {
+  if (output === "json") {
+    console.log(JSON.stringify(summary, null, 2));
+    return;
+  }
+  ui.header("DLP Test-File Generation");
+  ui.keyValue([
+    ["Output", summary.out],
+    ["Seed", summary.seed],
+    ["Clean", summary.clean],
+    ["Dirty", summary.dirty],
+    ["Manifest", summary.manifestPath]
+  ]);
+  ui.table(
+    [
+      { key: "format", label: "Format" },
+      { key: "clean", label: "Clean" },
+      { key: "dirty", label: "Dirty" }
+    ],
+    Object.entries(summary.byFormat).map(([format, counts]) => ({ format, ...counts }))
+  );
+}
+
 // src/cli/commands/dlp/generate.ts
 var ALL_FORMATS = ["pdf", "png", "jpeg", "svg", "docx"];
 var OPTIONAL_DEPS_HINT = "DLP generate requires optional dependencies. Install them with: pnpm add sharp pdf-lib docx piexifjs";
@@ -8517,39 +8583,29 @@ function parseTypes(value) {
   return types;
 }
 function register3(parent) {
-  parent.command("generate").description(
+  const command = parent.command("generate").description(
     "Generate clean + dirty DLP test files (synthetic sensitive data) across PDF/PNG/JPEG/SVG/DOCX"
-  ).option("--types <list>", "Comma list: pdf,png,jpeg,svg,docx (or all)", "all").option("--count <n>", "Clean files per type", "1").option("--out <dir>", "Output base directory", "./temp").option("--techniques <list>", "all or comma list of technique ids", "all").option("--seed <n>", "Seed for reproducible payloads").option("--output <format>", "Summary format: pretty or json", "pretty").action(async (opts) => {
+  ).option("--types <list>", "Comma list: pdf,png,jpeg,svg,docx (or all)", "all").option("--count <n>", "Clean files per type", "1").option("--out <dir>", "Output base directory", "./temp").option("--techniques <list>", "all or comma list of technique ids", "all").option("--seed <n>", "Safe integer seed for reproducible payloads").option("--output <format>", "Summary format: pretty or json", "pretty").action(async (opts) => {
     let types;
     try {
       types = parseTypes(opts.types);
     } catch (err) {
       usageError(err instanceof Error ? err.message : String(err));
     }
-    const count = Number.parseInt(opts.count, 10);
-    if (!Number.isInteger(count) || count < 1) {
-      usageError("--count must be a positive integer");
+    const count = Number(opts.count);
+    if (!/^\d+$/.test(opts.count) || !Number.isSafeInteger(count) || count < 1) {
+      usageError("--count must be a positive safe integer");
     }
     const techniques = opts.techniques === "all" ? "all" : opts.techniques.split(",").map((t) => t.trim());
-    const seed = opts.seed === void 0 ? void 0 : Number.parseInt(opts.seed, 10);
+    const seed = opts.seed === void 0 ? void 0 : Number(opts.seed);
+    if (seed !== void 0 && (!/^-?\d+$/.test(opts.seed) || !Number.isSafeInteger(seed))) {
+      usageError("--seed must be a safe integer");
+    }
     try {
+      const output = await resolveOutput(command, opts, { allowed: ["pretty", "json"] });
       const generateCorpus = await loadGenerateCorpus();
       const summary = await generateCorpus({ types, count, out: opts.out, techniques, seed });
-      if (opts.output === "json") {
-        console.log(JSON.stringify(summary, null, 2));
-        return;
-      }
-      ui.header("DLP Test-File Generation");
-      ui.keyValue([
-        ["Output", summary.out],
-        ["Seed", summary.seed],
-        ["Clean", summary.clean],
-        ["Dirty", summary.dirty],
-        ["Manifest", summary.manifestPath]
-      ]);
-      for (const [fmt, counts] of Object.entries(summary.byFormat)) {
-        ui.dim(`${fmt.padEnd(5)} clean=${counts.clean} dirty=${counts.dirty}`);
-      }
+      renderGenerateSummary(summary, output);
     } catch (err) {
       fail(err);
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "4.3.0",
+  "version": "4.4.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",
@@ -14,11 +14,13 @@
   },
   "scripts": {
     "build": "tsup",
-    "prepublishOnly": "pnpm run build",
+    "prepublishOnly": "pnpm audit:prod && pnpm run build",
     "dev": "tsx src/cli/index.ts",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "test:release": "node --test .github/scripts/*.test.mjs",
+    "audit:prod": "pnpm audit --prod --audit-level low",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "test:e2e:aigateway": "vitest run --config vitest.e2e.config.ts tests/e2e/aigateway-cli.e2e.spec.ts",
     "lint": "biome check --config-path config .",
@@ -49,7 +51,7 @@
     "local:unlink": "pnpm uninstall --global @cdot65/prisma-airs-cli"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": "^20.17.0 || ^22.13.0 || >=23.5.0"
   },
   "repository": {
     "type": "git",
@@ -57,13 +59,13 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@cdot65/prisma-airs-sdk": "0.24.0",
+    "@cdot65/prisma-airs-sdk": "0.25.0",
     "@inquirer/prompts": "^8.3.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "dotenv": "^17.3.1",
-    "js-yaml": "^4.1.1",
-    "nanoid": "^5.0.0",
+    "js-yaml": "^4.3.2",
+    "nanoid": "^5.1.16",
     "p-limit": "^6.0.0",
     "zod": "^3.24.0"
   },
@@ -84,6 +86,6 @@
     "docx": "^9.6.1",
     "pdf-lib": "^1.17.1",
     "piexifjs": "^1.0.6",
-    "sharp": "^0.34.5"
+    "sharp": "^0.35.4"
   }
 }