@cdot65/prisma-airs-cli 5.11.1 → 6.1.0

package/README.md

@@ -24,10 +24,9 @@
 - **Model Security** — ML model supply chain scanning with security groups, rules, and violation tracking
 - **Unified automation output** — resource reads support `pretty`, `table`, `markdown`, `csv`, `json`, and `yaml`, with pipe-safe stdout; environment deliverables use HTML or Markdown
 - **Complete pagination** — consistent `--limit`, `--offset`, and `--all` traversal with a configurable safety cap
-- **`airs doctor`** — one-command diagnostics for environment, credentials, and API connectivity
-- **Tenant configuration** — `airs tenant create|set|switch|list|read|delete` supports guided setup with hidden secret prompts, individual setting updates, and existing-file registration without changing read-only mounts
+- **`airs doctor`** — one-command diagnostics for the selected tenant, its credentials, and API connectivity
+- **Tenant configuration** — `airs tenant create|switch|set|unset|get|list|read|path|delete` is the only configuration surface: guided setup with hidden secret prompts, individual setting updates, and existing-file registration without changing read-only mounts
 - **Profile migration** — `airs runtime profiles backup|restore` exports private JSON/YAML, previews cross-tenant restores, remaps topics and explicit DLP dependencies, and verifies restored policies ([guide](https://cdot65.github.io/prisma-airs-cli/runtime/profile-transfer/))
-- **`airs config`** — manage the selected config file from the CLI (`list`, `get`, `set`, `unset`, `path`)
 
 ## Install
 
@@ -41,8 +40,9 @@ Requires **Node.js 20.17+, 22.13+, or 24+** (exact engine range: `^20.17.0 || ^2
 ## Quick Start
 
 ```bash
-# Configure credentials
-cp .env.example .env   # add your API keys
+# Configure credentials (prompts for TSG ID, client ID, and a hidden secret)
+airs tenant create dev
+airs tenant switch dev
 
 # Check your setup
 airs doctor
@@ -101,13 +101,13 @@ Resource read commands share one contract (environment report files have their o
 - JSON/YAML lists are bare arrays of complete normalized records; detail reads are complete objects.
 - Table, Markdown, and CSV are stable human-oriented projections. CSV uses RFC 4180 quoting.
 - Data is written to stdout; status, paging hints, warnings, and errors are written to stderr.
-- Output precedence is command `--output`, global `--output`, `defaultOutput`/`PANW_CLI_OUTPUT`, then `pretty`.
+- Output precedence is command `--output`, global `--output`, `defaultOutput`, then `pretty`.
 - Paginated lists use `--limit`, `--offset`, and `--all`. Complete traversal is capped at 10,000 records by default; change it with `--max`, or use `--max 0` for no cap.
 - Profile and topic lists return only the latest revision by default. Use `--all-versions` or `--revision` when historical revisions are needed.
 
 ```bash
 airs --output json runtime profiles list --all | jq '.[].profileName'
-PANW_CLI_OUTPUT=yaml airs runtime topics get "My Topic"
+airs --output yaml runtime topics get "My Topic"
 airs model-security scans list --all --max 25000 --output csv > scans.csv
 ```
 
@@ -125,7 +125,7 @@ The full guides, complete CLI reference, configuration, and architecture live on
 
 ## Configuration
 
-Credentials come from environment variables or `~/.prisma-airs/config.json`. At minimum: `PANW_AI_SEC_API_KEY` (scanning) and `PANW_MGMT_CLIENT_ID` / `PANW_MGMT_CLIENT_SECRET` / `PANW_MGMT_TSG_ID` (management). Set `defaultOutput` in the config file or `PANW_CLI_OUTPUT` in the environment to choose a default read format. See [`.env.example`](.env.example) and the [configuration guide](https://cdot65.github.io/prisma-airs-cli/getting-started/configuration/) for the full list.
+Configuration lives only in tenant files managed by `airs tenant`; environment variables are not read. Every management-plane product (Management, DLP, Red Team, Model Security, AgentGuard, AI Gateway) authenticates with the tenant's single SCM OAuth credential set (`mgmtClientId`, `mgmtClientSecret`, `mgmtTsgId`); scanning adds `airsApiKey`. Set `defaultOutput` with `airs tenant set <name> defaultOutput json` to choose a default read format. See the [configuration guide](https://cdot65.github.io/prisma-airs-cli/getting-started/configuration/) for the full list.
 
 ## License
 

package/dist/{chunk-37SN57XQ.js → chunk-KGMQY2IT.js}

@@ -2239,38 +2239,31 @@ import { join as join2 } from "path";
 // src/config/schema.ts
 import { z } from "zod";
 var ConfigSchema = z.object({
-  // AIRS Scanner (runtime scan API)
+  // AIRS Scanner (runtime scan API) — separate key-based auth
   airsApiKey: z.string().optional(),
   airsApiToken: z.string().optional(),
   airsApiEndpoint: z.string().optional(),
   airsNumRetries: z.coerce.number().int().min(0).max(5).optional(),
-  // AIRS Management (SDK v2 — OAuth2 client credentials)
+  // Shared SCM OAuth2 client credentials
   mgmtClientId: z.string().optional(),
   mgmtClientSecret: z.string().optional(),
   mgmtTsgId: z.string().optional(),
   mgmtEndpoint: z.string().optional(),
   mgmtDashboardEndpoint: z.string().url().optional(),
   mgmtTokenEndpoint: z.string().optional(),
+  // Product base-URL overrides (authentication always comes from mgmt*)
   dlpEndpoint: z.string().optional(),
-  // Red Team (endpoints only; creds shared with mgmt*)
   redTeamDataEndpoint: z.string().optional(),
   redTeamMgmtEndpoint: z.string().optional(),
-  redTeamTokenEndpoint: z.string().optional(),
   redTeamNetworkBrokerEndpoint: z.string().optional(),
-  // Model Security (endpoints only; creds shared with mgmt*)
   modelSecDataEndpoint: z.string().optional(),
   modelSecMgmtEndpoint: z.string().optional(),
-  modelSecTokenEndpoint: z.string().optional(),
   agentGuardDataEndpoint: z.string().url().optional(),
   agentGuardMgmtEndpoint: z.string().url().optional(),
-  agentGuardTokenEndpoint: z.string().url().optional(),
-  // AI Gateway (endpoints only; creds shared with mgmt*)
   aiGwDataEndpoint: z.string().optional(),
   aiGwAdminEndpoint: z.string().optional(),
-  aiGwTokenEndpoint: z.string().optional(),
-  // SCM IAM (workspace scopes); creds shared with mgmt*
   iamEndpoint: z.string().optional(),
-  // Runtime inference has separate key authentication, never management OAuth.
+  // AI Gateway runtime inference authenticates with a workspace key, never SCM OAuth.
   aiGwInferenceEndpoint: z.string().optional(),
   aiGwInferenceApiKey: z.string().optional(),
   aiGwInferenceModel: z.string().optional(),
@@ -2281,6 +2274,13 @@ var ConfigSchema = z.object({
   // Persistence
   dataDir: z.string().default("~/.prisma-airs/runs")
 });
+var CONFIG_KEYS = Object.keys(ConfigSchema.shape);
+var RETIRED_CONFIG_KEYS = [
+  "redTeamTokenEndpoint",
+  "modelSecTokenEndpoint",
+  "agentGuardTokenEndpoint",
+  "aiGwTokenEndpoint"
+];
 
 // src/config/tenants.ts
 import { randomUUID } from "crypto";
@@ -2289,7 +2289,7 @@ import { mkdir, open, rename, unlink } from "fs/promises";
 import { homedir } from "os";
 import { dirname, isAbsolute, join, resolve } from "path";
 import { z as z2 } from "zod";
-var NameSchema = z2.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/).refine((v) => v !== "default");
+var NameSchema = z2.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/);
 var EntrySchema = z2.object({
   name: NameSchema,
   configPath: z2.string().refine(isAbsolute),
@@ -2314,9 +2314,6 @@ function tenantStorePath() {
 function expandConfigPath(path2) {
   return path2 === "~" ? homedir() : path2.startsWith("~/") ? join(homedir(), path2.slice(2)) : path2;
 }
-function defaultTenantConfigPath() {
-  return join(homedir(), ".prisma-airs", "config.json");
-}
 function missing(error) {
   return error?.code === "ENOENT";
 }
@@ -2333,10 +2330,6 @@ function readTenantStore() {
     );
   }
 }
-function selectedTenant() {
-  const store = readTenantStore();
-  return store.tenants.find((entry) => entry.name === store.active);
-}
 function readTenantConfig(path2, expectedTsgId) {
   return ConfigSchema.parse(readTenantConfigFile(path2, expectedTsgId));
 }
@@ -2358,15 +2351,6 @@ function readTenantConfigFile(path2, expectedTsgId) {
     );
   return parsed;
 }
-function assertTenantEnvironment() {
-  const conflicts = Object.keys(process.env).filter(
-    (key) => /^PANW_(?:MGMT_|MODEL_SEC_|RED_TEAM_|AGENT_GUARD_|AI_GW_|DLP_|AI_SEC_API_)/.test(key) && Boolean(process.env[key])
-  );
-  if (conflicts.length)
-    throw new Error(
-      `Named tenant selection conflicts with environment overrides: ${conflicts.sort().join(", ")}. Unset them or switch to default.`
-    );
-}
 async function changeStore(change) {
   const path2 = tenantStorePath();
   await mkdir(dirname(path2), { recursive: true, mode: 448 });
@@ -2407,7 +2391,7 @@ async function changeStore(change) {
 function validateTenantName(name) {
   if (!NameSchema.safeParse(name).success)
     throw new Error(
-      "Tenant name must be 1\u201364 letters, digits, hyphens or underscores, start with a letter/digit, and not be default"
+      "Tenant name must be 1\u201364 letters, digits, hyphens or underscores and start with a letter/digit"
     );
 }
 async function createTenant(name, configPath) {
@@ -2433,15 +2417,6 @@ async function createTenant(name, configPath) {
 async function switchTenant(name) {
   let selected;
   await changeStore((store) => {
-    if (name === "default") {
-      store.active = null;
-      return;
-    }
-    if (process.env.PRISMA_AIRS_CONFIG_PATH)
-      throw new Error(
-        "Unset PRISMA_AIRS_CONFIG_PATH before switching tenants; it overrides named selection"
-      );
-    assertTenantEnvironment();
     selected = store.tenants.find((entry) => entry.name === name);
     if (!selected) throw new Error("Tenant not found");
     readTenantConfig(selected.configPath, selected.tsgId);
@@ -2450,56 +2425,22 @@ async function switchTenant(name) {
   return selected;
 }
 async function deleteTenant(name) {
+  let selectionCleared = false;
   await changeStore((store) => {
-    if (name === "default") throw new Error("The default tenant cannot be deleted");
-    if (store.active === name)
-      throw new Error("Switch to another tenant or default before deleting the active tenant");
     if (!store.tenants.some((entry) => entry.name === name)) throw new Error("Tenant not found");
     store.tenants = store.tenants.filter((entry) => entry.name !== name);
+    if (store.active === name) {
+      store.active = null;
+      selectionCleared = true;
+    }
   });
+  return { selectionCleared };
 }
 
 // src/config/loader.ts
 function expandHome(p) {
   return p.startsWith("~") ? join2(homedir2(), p.slice(1)) : p;
 }
-function fromEnv() {
-  const env = process.env;
-  return {
-    airsApiKey: env.PANW_AI_SEC_API_KEY,
-    airsApiToken: env.PANW_AI_SEC_API_TOKEN,
-    airsApiEndpoint: env.PANW_AI_SEC_API_ENDPOINT,
-    airsNumRetries: env.PANW_AI_SEC_NUM_RETRIES,
-    mgmtClientId: env.PANW_MGMT_CLIENT_ID,
-    mgmtClientSecret: env.PANW_MGMT_CLIENT_SECRET,
-    mgmtTsgId: env.PANW_MGMT_TSG_ID,
-    mgmtEndpoint: env.PANW_MGMT_ENDPOINT,
-    mgmtDashboardEndpoint: env.PANW_MGMT_DASHBOARD_ENDPOINT,
-    mgmtTokenEndpoint: env.PANW_MGMT_TOKEN_ENDPOINT,
-    dlpEndpoint: env.PANW_DLP_ENDPOINT,
-    redTeamDataEndpoint: env.PANW_RED_TEAM_DATA_ENDPOINT,
-    redTeamMgmtEndpoint: env.PANW_RED_TEAM_MGMT_ENDPOINT,
-    redTeamTokenEndpoint: env.PANW_RED_TEAM_TOKEN_ENDPOINT,
-    redTeamNetworkBrokerEndpoint: env.PANW_RED_TEAM_NETWORK_BROKER_ENDPOINT,
-    modelSecDataEndpoint: env.PANW_MODEL_SEC_DATA_ENDPOINT,
-    modelSecMgmtEndpoint: env.PANW_MODEL_SEC_MGMT_ENDPOINT,
-    modelSecTokenEndpoint: env.PANW_MODEL_SEC_TOKEN_ENDPOINT,
-    agentGuardDataEndpoint: env.PANW_AGENT_GUARD_DATA_ENDPOINT,
-    agentGuardMgmtEndpoint: env.PANW_AGENT_GUARD_MGMT_ENDPOINT,
-    agentGuardTokenEndpoint: env.PANW_AGENT_GUARD_TOKEN_ENDPOINT,
-    aiGwDataEndpoint: env.PANW_AI_GW_DATA_ENDPOINT,
-    aiGwAdminEndpoint: env.PANW_AI_GW_ADMIN_ENDPOINT,
-    aiGwTokenEndpoint: env.PANW_AI_GW_TOKEN_ENDPOINT,
-    iamEndpoint: env.PANW_IAM_ENDPOINT,
-    aiGwInferenceEndpoint: env.PANW_AI_GW_INFERENCE_ENDPOINT,
-    aiGwInferenceApiKey: env.PANW_AI_GW_INFERENCE_API_KEY,
-    aiGwInferenceModel: env.PANW_AI_GW_INFERENCE_MODEL,
-    aiGwEmbeddingModel: env.PANW_AI_GW_EMBEDDING_MODEL,
-    scanConcurrency: env.SCAN_CONCURRENCY,
-    defaultOutput: env.PANW_CLI_OUTPUT,
-    dataDir: env.DATA_DIR
-  };
-}
 async function fromFile(path2) {
   try {
     const data = await readFile(path2, "utf-8");
@@ -2511,45 +2452,43 @@ async function fromFile(path2) {
 function stripUndefined(obj) {
   return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== void 0 && v !== ""));
 }
-function resolveConfigFilePath(configFilePath) {
-  return resolveConfigSource(configFilePath).path;
+function noTenantSelectedMessage(registered) {
+  return registered.length ? `No tenant selected. Run 'airs tenant switch <name>' (registered: ${registered.join(", ")})` : "No tenant selected. Run 'airs tenant create <name>' and then 'airs tenant switch <name>'";
 }
-function resolveConfigSource(configFilePath) {
-  if (configFilePath) return { path: expandHome(configFilePath) };
-  const envPath = process.env.PRISMA_AIRS_CONFIG_PATH;
-  if (envPath) return { path: expandHome(envPath) };
-  const tenant = selectedTenant();
-  return { path: tenant?.configPath ?? join2(homedir2(), ".prisma-airs", "config.json"), tenant };
+var NoTenantSelectedError = class extends Error {
+  constructor(registered) {
+    super(noTenantSelectedMessage(registered));
+    this.name = "NoTenantSelectedError";
+  }
+};
+function resolveConfigContext(configFilePath) {
+  const registryPath = tenantStorePath();
+  if (configFilePath) {
+    return { path: expandHome(configFilePath), selection: "explicit", registryPath };
+  }
+  const store = readTenantStore();
+  const tenant = store.tenants.find((entry) => entry.name === store.active);
+  if (tenant) return { path: tenant.configPath, selection: "tenant", tenant, registryPath };
+  return { selection: "none", registryPath, registered: store.tenants.map((entry) => entry.name) };
 }
 async function readConfigSource(configFilePath) {
-  const { path: path2, tenant } = resolveConfigSource(configFilePath);
-  if (!tenant) return fromFile(path2);
-  assertTenantEnvironment();
-  return readTenantConfigFile(path2, tenant.tsgId);
+  const context = resolveConfigContext(configFilePath);
+  if (context.selection === "none") throw new NoTenantSelectedError(context.registered);
+  if (context.selection === "explicit") return fromFile(context.path);
+  return readTenantConfigFile(context.path, context.tenant.tsgId);
 }
 async function loadConfig(cliOverrides = {}, configFilePath) {
   const fileConfig = await readConfigSource(configFilePath);
-  const envConfig = fromEnv();
-  const merged = {
-    ...stripUndefined(fileConfig),
-    ...stripUndefined(envConfig),
-    ...stripUndefined(cliOverrides)
-  };
+  const merged = { ...stripUndefined(fileConfig), ...stripUndefined(cliOverrides) };
   const config = ConfigSchema.parse(merged);
-  return {
-    ...config,
-    dataDir: expandHome(config.dataDir)
-  };
+  return { ...config, dataDir: expandHome(config.dataDir) };
 }
 async function inspectConfig(configFilePath) {
   const fileConfig = stripUndefined(await readConfigSource(configFilePath));
-  const envConfig = stripUndefined(fromEnv());
-  const merged = { ...fileConfig, ...envConfig };
-  const config = ConfigSchema.parse(merged);
+  const config = ConfigSchema.parse(fileConfig);
   const entries = {};
   for (const key of Object.keys(ConfigSchema.shape)) {
-    const source2 = key in envConfig ? "env" : key in fileConfig ? "file" : "default";
-    entries[key] = { value: config[key], source: source2 };
+    entries[key] = { value: config[key], source: key in fileConfig ? "file" : "default" };
   }
   return entries;
 }
@@ -4192,9 +4131,8 @@ export {
   readBackupFile,
   readBackupDir,
   ConfigSchema,
+  RETIRED_CONFIG_KEYS,
   tenantStorePath,
-  expandConfigPath,
-  defaultTenantConfigPath,
   readTenantStore,
   readTenantConfig,
   readTenantConfigFile,
@@ -4202,7 +4140,7 @@ export {
   createTenant,
   switchTenant,
   deleteTenant,
-  resolveConfigFilePath,
+  resolveConfigContext,
   loadConfig,
   inspectConfig,
   validateName,