@cdot65/prisma-airs-cli 5.11.1 → 6.1.0

package/dist/cli/index.js

@@ -2,6 +2,7 @@
 import {
   AirsScanService,
   ConfigSchema,
+  RETIRED_CONFIG_KEYS,
   RateLimitedScanService,
   SDK_ASYNC_BATCH_SIZE,
   SdkManagementService,
@@ -14,9 +15,7 @@ import {
   collectRuntimeDailyReport,
   computeMetrics,
   createTenant,
-  defaultTenantConfigPath,
   deleteTenant,
-  expandConfigPath,
   getOrCreateManagementClient,
   inspectConfig,
   loadConfig,
@@ -31,7 +30,7 @@ import {
   renderRedTeamReportMarkdown,
   renderRuntimeReportHtml,
   renderRuntimeReportMarkdown,
-  resolveConfigFilePath,
+  resolveConfigContext,
   resolveOutputDir,
   sanitizeFilename,
   switchTenant,
@@ -40,10 +39,7 @@ import {
   validateTopic,
   writeBackupFile,
   writeReportFile
-} from "../chunk-37SN57XQ.js";
-
-// src/cli/index.ts
-import "dotenv/config";
+} from "../chunk-KGMQY2IT.js";
 
 // src/cli/process-guards.ts
 import chalk from "chalk";
@@ -61,7 +57,7 @@ function installProcessGuards() {
 // src/cli/program.ts
 import { randomUUID as randomUUID12 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname5, join as join5 } from "path";
+import { dirname as dirname4, join as join5 } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
 
@@ -79,65 +75,124 @@ import { dump as dump3 } from "js-yaml";
 import { z } from "zod";
 
 // src/config/client-options.ts
-function agentGuardClientOptions(config) {
+import {
+  AGENT_GUARD_DATA_ENDPOINT,
+  AGENT_GUARD_MGMT_ENDPOINT,
+  DEFAULT_AI_GW_ADMIN_ENDPOINT,
+  DEFAULT_AI_GW_DATA_ENDPOINT,
+  DEFAULT_DLP_ENDPOINT,
+  DEFAULT_ENDPOINT,
+  DEFAULT_IAM_ENDPOINT,
+  DEFAULT_MGMT_ENDPOINT,
+  DEFAULT_MODEL_SEC_DATA_ENDPOINT,
+  DEFAULT_MODEL_SEC_MGMT_ENDPOINT,
+  DEFAULT_RED_TEAM_DATA_ENDPOINT,
+  DEFAULT_RED_TEAM_MGMT_ENDPOINT,
+  DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT,
+  DEFAULT_TOKEN_ENDPOINT
+} from "@cdot65/prisma-airs-sdk";
+
+// src/config/credentials.ts
+var MANAGEMENT_CREDENTIAL_KEYS = [
+  "mgmtClientId",
+  "mgmtClientSecret",
+  "mgmtTsgId"
+];
+var SCANNER_CREDENTIAL_KEYS = ["airsApiKey", "airsApiToken"];
+function present(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function missingManagementCredentials(config) {
+  return MANAGEMENT_CREDENTIAL_KEYS.filter((key) => !present(config[key]));
+}
+function hasScannerCredentials(config) {
+  return SCANNER_CREDENTIAL_KEYS.some((key) => present(config[key]));
+}
+function safeContext() {
+  try {
+    return resolveConfigContext();
+  } catch {
+    return void 0;
+  }
+}
+function settingRemedy(keys, context3 = safeContext()) {
+  const list = keys.join(", ");
+  if (context3?.selection === "tenant") {
+    return `Run 'airs tenant set ${context3.tenant.name} <key>' for ${list} (secrets prompt hidden, or use --stdin)`;
+  }
+  if (context3?.selection === "explicit") return `Add ${list} to ${context3.path}`;
+  return `Run 'airs tenant create <name>' (prompts for the OAuth credentials), then 'airs tenant switch <name>'`;
+}
+function assertManagementCredentials(config, context3) {
+  const missing = missingManagementCredentials(config);
+  if (missing.length === 0) return;
+  throw new Error(
+    `Management credentials are not configured (missing ${missing.join(", ")}). ${settingRemedy(missing, context3)}`
+  );
+}
+function assertScannerCredentials(config, context3) {
+  if (hasScannerCredentials(config)) return;
+  throw new Error(
+    `Scanner credentials are not configured (airsApiKey or airsApiToken). ${settingRemedy(["airsApiKey"], context3)}`
+  );
+}
+
+// src/config/client-options.ts
+var DEFAULT_MGMT_DASHBOARD_ENDPOINT = "https://api.apps.paloaltonetworks.com/aisec";
+function oauth(config) {
+  assertManagementCredentials(config);
   return {
     clientId: config.mgmtClientId,
     clientSecret: config.mgmtClientSecret,
     tsgId: config.mgmtTsgId,
-    dataEndpoint: config.agentGuardDataEndpoint,
-    mgmtEndpoint: config.agentGuardMgmtEndpoint,
-    tokenEndpoint: config.agentGuardTokenEndpoint ?? config.mgmtTokenEndpoint
+    tokenEndpoint: config.mgmtTokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT
   };
 }
 function managementClientOptions(config) {
   return {
-    clientId: config.mgmtClientId,
-    clientSecret: config.mgmtClientSecret,
-    tsgId: config.mgmtTsgId,
-    apiEndpoint: config.mgmtEndpoint,
-    dashboardEndpoint: config.mgmtDashboardEndpoint ?? "https://api.apps.paloaltonetworks.com/aisec",
-    tokenEndpoint: config.mgmtTokenEndpoint,
-    dlpEndpoint: config.dlpEndpoint
+    ...oauth(config),
+    apiEndpoint: config.mgmtEndpoint ?? DEFAULT_MGMT_ENDPOINT,
+    dashboardEndpoint: config.mgmtDashboardEndpoint ?? DEFAULT_MGMT_DASHBOARD_ENDPOINT,
+    dlpEndpoint: config.dlpEndpoint ?? DEFAULT_DLP_ENDPOINT
   };
 }
-function runtimeInitOptions(config) {
+function agentGuardClientOptions(config) {
   return {
-    apiKey: config.airsApiKey,
-    apiToken: config.airsApiToken,
-    apiEndpoint: config.airsApiEndpoint,
-    numRetries: config.airsNumRetries
+    ...oauth(config),
+    dataEndpoint: config.agentGuardDataEndpoint ?? AGENT_GUARD_DATA_ENDPOINT,
+    mgmtEndpoint: config.agentGuardMgmtEndpoint ?? AGENT_GUARD_MGMT_ENDPOINT
   };
 }
 function redTeamClientOptions(config) {
   return {
-    clientId: config.mgmtClientId,
-    clientSecret: config.mgmtClientSecret,
-    tsgId: config.mgmtTsgId,
-    dataEndpoint: config.redTeamDataEndpoint,
-    mgmtEndpoint: config.redTeamMgmtEndpoint,
-    tokenEndpoint: config.redTeamTokenEndpoint ?? config.mgmtTokenEndpoint,
-    networkBrokerEndpoint: config.redTeamNetworkBrokerEndpoint
+    ...oauth(config),
+    dataEndpoint: config.redTeamDataEndpoint ?? DEFAULT_RED_TEAM_DATA_ENDPOINT,
+    mgmtEndpoint: config.redTeamMgmtEndpoint ?? DEFAULT_RED_TEAM_MGMT_ENDPOINT,
+    networkBrokerEndpoint: config.redTeamNetworkBrokerEndpoint ?? DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT
+  };
+}
+function modelSecurityClientOptions(config) {
+  return {
+    ...oauth(config),
+    dataEndpoint: config.modelSecDataEndpoint ?? DEFAULT_MODEL_SEC_DATA_ENDPOINT,
+    mgmtEndpoint: config.modelSecMgmtEndpoint ?? DEFAULT_MODEL_SEC_MGMT_ENDPOINT
   };
 }
 function aiGatewayClientOptions(config) {
   return {
-    clientId: config.mgmtClientId,
-    clientSecret: config.mgmtClientSecret,
-    tsgId: config.mgmtTsgId,
-    dataEndpoint: config.aiGwDataEndpoint,
-    adminEndpoint: config.aiGwAdminEndpoint,
-    iamEndpoint: config.iamEndpoint,
-    tokenEndpoint: config.aiGwTokenEndpoint ?? config.mgmtTokenEndpoint
+    ...oauth(config),
+    dataEndpoint: config.aiGwDataEndpoint ?? DEFAULT_AI_GW_DATA_ENDPOINT,
+    adminEndpoint: config.aiGwAdminEndpoint ?? DEFAULT_AI_GW_ADMIN_ENDPOINT,
+    iamEndpoint: config.iamEndpoint ?? DEFAULT_IAM_ENDPOINT
   };
 }
-function modelSecurityClientOptions(config) {
+function runtimeInitOptions(config) {
+  assertScannerCredentials(config);
   return {
-    clientId: config.mgmtClientId,
-    clientSecret: config.mgmtClientSecret,
-    tsgId: config.mgmtTsgId,
-    dataEndpoint: config.modelSecDataEndpoint,
-    mgmtEndpoint: config.modelSecMgmtEndpoint,
-    tokenEndpoint: config.modelSecTokenEndpoint ?? config.mgmtTokenEndpoint
+    apiKey: config.airsApiKey,
+    apiToken: config.airsApiToken,
+    apiEndpoint: config.airsApiEndpoint ?? DEFAULT_ENDPOINT,
+    numRetries: config.airsNumRetries
   };
 }
 
@@ -384,13 +439,7 @@ async function resolveOutput(command, opts, resolution = {}) {
   while (rootCommand.parent) rootCommand = rootCommand.parent;
   const globalIsExplicit = rootCommand.getOptionValueSource?.("output") === "cli";
   const globalOutput = globalIsExplicit ? rootCommand.opts().output : void 0;
-  let configured;
-  try {
-    configured = resolution.ignoreConfig ? process.env.PANW_CLI_OUTPUT : (await loadConfig()).defaultOutput;
-  } catch (error) {
-    if (process.env.PANW_CLI_OUTPUT !== void 0) configured = process.env.PANW_CLI_OUTPUT;
-    else throw error;
-  }
+  const configured = resolution.ignoreConfig ? void 0 : (await loadConfig()).defaultOutput;
   const candidate = String(
     localIsExplicit ? opts.output : globalOutput ?? configured ?? "pretty"
   );
@@ -3664,6 +3713,7 @@ function registerAiGatewayInference(parent) {
 }
 
 // src/cli/commands/aigateway/inventory.ts
+import { readFile as readFile3 } from "fs/promises";
 import {
   AI_GATEWAY_DEPLOYMENT_STATUSES,
   AI_GATEWAY_DEPLOYMENT_TYPES,
@@ -3671,6 +3721,7 @@ import {
   AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
   AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
   AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
+  customHostConfiguration,
   GatewayApiKeyRotateRequestSchema,
   GatewayApiKeyUpdateRequestSchema,
   GatewayConfigCreateRequestSchema,
@@ -3866,6 +3917,38 @@ function installDebugLogger(logPath, options = {}) {
   };
 }
 
+// src/cli/tenant-input.ts
+import { input, password } from "@inquirer/prompts";
+async function promptTenantValue(message, secret = false) {
+  if (!process.stdin.isTTY || !process.stderr.isTTY)
+    throw new Error(
+      "Interactive setup requires a terminal. Use --config, or --tsg-id and --client-id with --client-secret-stdin. For tenant set, pass a value or use --stdin."
+    );
+  const prompt = secret ? password : input;
+  return prompt(
+    {
+      message,
+      validate: (value) => Boolean(value.trim()) || "A nonempty value is required"
+    },
+    { input: process.stdin, output: process.stderr }
+  );
+}
+async function readTenantStdin() {
+  if (process.stdin.isTTY) throw new Error("--stdin requires piped input");
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    const buffer = Buffer.from(chunk);
+    size += buffer.length;
+    if (size > 65536) throw new Error("Configuration input exceeds 64 KiB");
+    chunks.push(buffer);
+  }
+  const value = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  if (!value.trim() || /[\r\n\0]/.test(value))
+    throw new Error("Provide one nonempty configuration value on stdin");
+  return value;
+}
+
 // src/cli/commands/aigateway/shared.ts
 import { open, readFile as readFile2, unlink } from "fs/promises";
 import { AIGatewayClient as AIGatewayClient2 } from "@cdot65/prisma-airs-sdk";
@@ -4614,13 +4697,33 @@ function registerIntegrations(root) {
     { option: "name", path: "name" },
     { option: "organisationId", path: "organisation_id" },
     { option: "secretMappings", path: "secret_mappings", parse: parseJsonOption },
-    { option: "slug", path: "slug" }
+    { option: "slug", path: "slug" },
+    // Derived by prepareIntegrationOptions() from --base-url / --header.
+    { option: "providerAuthType", path: "configurations.provider_auth_type" },
+    { option: "customHost", path: "configurations.custom_host" },
+    { option: "customHeaders", path: "configurations.custom_headers", parse: parseStringMapOption }
   ];
-  const addIntegrationFields = (command) => command.option("--ai-provider-id <uuid>", "Provider catalog UUID").option("--configurations <json>", "Provider configuration object").option("--description <text>", "Integration description").option("--key <credential>", "Inline provider credential (prefer secret mappings)").option("--name <name>", "Integration name").option("--organisation-id <tsg>", "Numeric TSG id").option("--secret-mappings <json>", "Secret reference mapping array").option("--slug <slug>", "Stable integration slug");
+  const addIntegrationSharedFields = (command) => command.option(
+    "--base-url <url>",
+    "Self-hosted or OpenAI-compatible endpoint (configurations.custom_host)"
+  ).option("--configurations <json>", "Provider configuration object").option("--description <text>", "Integration description").option(
+    "--header <name=value>",
+    "Extra header sent to the custom host (repeatable)",
+    collectOption
+  ).option("--key <credential>", "Inline provider credential (visible in shell history)").option("--key-file <path>", "Read the provider credential from a file").option("--key-stdin", "Read the provider credential from piped stdin").option("--name <name>", "Integration name").option("--secret-mappings <json>", "Secret reference mapping array");
+  const addIntegrationFields = (command) => addIntegrationSharedFields(command).option(
+    "--ai-provider <slug-or-uuid>",
+    "Provider catalog slug (see 'integrations providers') or UUID"
+  ).option("--ai-provider-id <uuid>", "Provider catalog UUID").option("--organisation-id <tsg>", "Numeric TSG id").option("--slug <slug>", "Stable integration slug");
   const integrationUpdateFields = integrationFields.filter(
-    (field) => ["configurations", "description", "key", "name", "secretMappings"].includes(field.option)
+    (field) => !["aiProviderId", "organisationId", "slug"].includes(field.option)
+  );
+  const providers = addReadOutput(
+    group.command("providers").description("List the provider catalog: the slug or UUID that --ai-provider accepts")
+  );
+  providers.action(
+    (opts) => runList(providers, opts, "catalog providers", (client) => client.integrations.catalog())
   );
-  const addIntegrationUpdateFields = (command) => command.option("--configurations <json>", "Provider configuration object").option("--description <text>", "Integration description").option("--key <credential>", "Inline provider credential (prefer secret mappings)").option("--name <name>", "Integration name").option("--secret-mappings <json>", "Secret reference mapping array");
   const create = addWriteOutput(
     addStructuredInputOptions(
       addIntegrationFields(
@@ -4629,31 +4732,38 @@ function registerIntegrations(root) {
     )
   );
   create.action(
-    (opts) => runWrite(
-      create,
-      opts,
-      () => buildStructuredRequest(opts, GatewayIntegrationCreateRequestSchema, integrationFields),
-      (client, body) => client.integrations.create(body)
-    )
+    (opts) => runWrite(create, opts, async (client) => {
+      const prepared = await prepareIntegrationOptions(opts, client);
+      const body = await buildStructuredRequest(
+        prepared,
+        GatewayIntegrationCreateRequestSchema,
+        integrationFields
+      );
+      if (!body.key && !(Array.isArray(body.secret_mappings) && body.secret_mappings.length)) {
+        throw new CliUsageError(
+          "A provider credential is required: pass --key-stdin, --key-file, --secret-mappings, or --key (the gateway rejects a credential-less integration with a generic AB01)"
+        );
+      }
+      return client.integrations.create(body);
+    })
   );
   const update = addWriteOutput(
     addStructuredInputOptions(
-      addIntegrationUpdateFields(
+      addIntegrationSharedFields(
         group.command("update <id>").description("Update an integration with structured flags")
       )
     )
   );
   update.action(
-    (id, opts) => runWrite(
-      update,
-      opts,
-      () => buildStructuredRequest(
-        opts,
+    (id, opts) => runWrite(update, opts, async (client) => {
+      const prepared = await prepareIntegrationOptions(opts, client);
+      const body = await buildStructuredRequest(
+        prepared,
         GatewayIntegrationUpdateRequestSchema,
         integrationUpdateFields
-      ),
-      (client, body) => client.integrations.update(id, body)
-    )
+      );
+      return client.integrations.update(id, body);
+    })
   );
   const remove = addWriteOutput(
     group.command("delete <id>").description("Permanently delete this integration").requiredOption("--organisation-id <tsg>", "Numeric TSG id").option("--force", "Skip confirmation prompt")
@@ -4983,6 +5093,61 @@ function registerPlugins(root) {
     )
   );
 }
+async function prepareIntegrationOptions(opts, client) {
+  const sources = [opts.key !== void 0, Boolean(opts.keyStdin), opts.keyFile !== void 0];
+  if (sources.filter(Boolean).length > 1) {
+    throw new CliUsageError("Use only one of --key, --key-stdin, or --key-file");
+  }
+  const prepared = { ...opts };
+  delete prepared.keyStdin;
+  delete prepared.keyFile;
+  delete prepared.baseUrl;
+  delete prepared.header;
+  delete prepared.aiProvider;
+  if (opts.keyStdin) {
+    try {
+      prepared.key = await readTenantStdin();
+    } catch {
+      throw new CliUsageError("--key-stdin requires one nonempty credential on piped stdin");
+    }
+  } else if (opts.keyFile !== void 0) {
+    let raw;
+    try {
+      raw = await readFile3(opts.keyFile, "utf8");
+    } catch {
+      throw new CliUsageError(`Cannot read --key-file ${opts.keyFile}`);
+    }
+    const value = raw.replace(/\r?\n$/, "");
+    if (!value.trim() || /[\r\n\0]/.test(value)) {
+      throw new CliUsageError("--key-file must contain exactly one nonempty credential");
+    }
+    prepared.key = value;
+  } else if (opts.key !== void 0) {
+    ui.warning(
+      "Inline --key is visible in shell history and process listings; prefer --key-stdin, --key-file, or --secret-mappings"
+    );
+  }
+  if (opts.aiProvider !== void 0 && opts.aiProviderId !== void 0) {
+    throw new CliUsageError("Use --ai-provider or --ai-provider-id, not both");
+  }
+  if (opts.aiProvider !== void 0) {
+    prepared.aiProviderId = await client.integrations.resolveProviderId(opts.aiProvider);
+  }
+  if (opts.baseUrl !== void 0) {
+    let configuration;
+    try {
+      configuration = customHostConfiguration({ host: opts.baseUrl });
+    } catch (error) {
+      throw new CliUsageError(
+        `Invalid --base-url: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    prepared.providerAuthType = configuration.provider_auth_type;
+    prepared.customHost = configuration.custom_host;
+  }
+  if (opts.header?.length) prepared.customHeaders = opts.header;
+  return prepared;
+}
 function registerAiGatewayInventory(root) {
   registerApiKeys(root);
   registerAuditLogs(root);
@@ -5360,7 +5525,7 @@ function registerAiGatewayReportCommand(aigateway) {
         title: opts.title,
         maxPages: maxPages3,
         workspace: opts.workspace,
-        tsgId: config.mgmtTsgId ?? process.env.PANW_AI_GW_TSG_ID ?? "",
+        tsgId: config.mgmtTsgId ?? "",
         start,
         end
       });
@@ -5824,171 +5989,61 @@ function registerCompletionCommand(program) {
   });
 }
 
-// src/cli/commands/config.ts
-import { mkdir, readFile as readFile3, writeFile } from "fs/promises";
-import { dirname as dirname2 } from "path";
-var CONFIG_KEYS = Object.keys(ConfigSchema.shape);
-var SECRET_PATTERN = /key|secret|token|password/i;
-function isKnownKey(key) {
-  return CONFIG_KEYS.includes(key);
-}
-function isSecretKey(key) {
-  return SECRET_PATTERN.test(key);
-}
-function maskSecret(value) {
-  const str = value == null ? "" : String(value);
-  return str.length >= 8 ? `***${str.slice(-4)}` : "***";
-}
-function buildConfigRows(inspected, reveal) {
-  return Object.entries(inspected).map(([key, entry]) => {
-    const raw = entry.value == null ? "" : String(entry.value);
-    const value = raw !== "" && isSecretKey(key) && !reveal ? maskSecret(raw) : raw;
-    return { key, value, source: entry.source };
-  });
-}
-async function readConfigFileStrict(filePath) {
-  let raw;
-  try {
-    raw = await readFile3(filePath, "utf-8");
-  } catch {
-    return { ok: true, data: {} };
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return { ok: false, error: `Config file is not a JSON object: ${filePath}` };
-    }
-    return { ok: true, data: parsed };
-  } catch {
-    return { ok: false, error: `Config file is not valid JSON: ${filePath}` };
-  }
-}
-async function setConfigValue(filePath, key, value) {
-  const read = await readConfigFileStrict(filePath);
-  if (!read.ok) return read;
-  const candidate = { ...read.data, [key]: value };
-  const result = ConfigSchema.safeParse(candidate);
-  if (!result.success) {
-    const messages = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
-    return { ok: false, error: messages.join("; ") };
-  }
-  const coerced = result.data[key];
-  const next = { ...read.data, [key]: coerced };
-  await mkdir(dirname2(filePath), { recursive: true });
-  await writeFile(filePath, `${JSON.stringify(next, null, 2)}
-`, "utf-8");
-  return { ok: true, value: coerced };
-}
-async function unsetConfigValue(filePath, key) {
-  const read = await readConfigFileStrict(filePath);
-  if (!read.ok) return read;
-  if (!(key in read.data)) return { ok: true, removed: false };
-  const next = { ...read.data };
-  delete next[key];
-  await writeFile(filePath, `${JSON.stringify(next, null, 2)}
-`, "utf-8");
-  return { ok: true, removed: true };
-}
-function assertKnownKey(key) {
-  if (!isKnownKey(key)) {
-    usageError(`Unknown config key '${key}'. Valid keys: ${CONFIG_KEYS.join(", ")}`);
-  }
-}
-var COLUMNS = [
-  { key: "key", label: "Key" },
-  { key: "value", label: "Value" },
-  { key: "source", label: "Source" }
-];
-function registerConfigCommand(program) {
-  const config = program.command("config").description("Manage CLI configuration (~/.prisma-airs/config.json)").addHelpText(
-    "after",
-    examples(
-      "airs config list",
-      "airs config set scanConcurrency 10",
-      "airs config get mgmtTsgId"
-    )
-  );
-  const configList = config.command("list").description("Show effective configuration with per-key source (env/file/default)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").option("--reveal", "Show secret values in full").action(async (opts) => {
-    try {
-      const fmt = await resolveOutput(configList, opts);
-      const filePath = resolveConfigFilePath();
-      const rows = buildConfigRows(await inspectConfig(), Boolean(opts.reveal));
-      if (fmt === "pretty") {
-        ui.header("Configuration", filePath);
-        ui.table(COLUMNS, rows);
-        if (!opts.reveal) ui.dim("Secrets masked \u2014 pass --reveal to show full values.");
-        console.log("");
-      } else {
-        console.log(formatOutput(rows, COLUMNS, fmt));
-      }
-    } catch (err) {
-      fail(err);
-    }
-  });
-  const configGet = config.command("get <key>").description("Print a single effective config value").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").option("--reveal", "Show the real value of a secret key").action(async (key, opts) => {
-    try {
-      assertKnownKey(key);
-      const inspected = await inspectConfig();
-      const entry = inspected[key];
-      const raw = entry.value == null ? "" : String(entry.value);
-      const fmt = await resolveOutput(configGet, opts);
-      const value = raw !== "" && isSecretKey(key) && !opts.reveal ? maskSecret(raw) : raw;
-      if (fmt !== "pretty") {
-        console.log(formatOutput([{ key, value, source: entry.source }], COLUMNS, fmt));
-        return;
-      }
-      if (raw !== "" && isSecretKey(key)) {
-        if (opts.reveal) {
-          ui.status(`Warning: printing secret value for '${key}'`);
-          console.log(raw);
-        } else {
-          console.log(maskSecret(raw));
-        }
-      } else {
-        console.log(raw);
-      }
-    } catch (err) {
-      fail(err);
-    }
-  });
-  config.command("set <key> <value>").description("Set a config value in the config file (validated via schema)").action(async (key, value) => {
-    try {
-      assertKnownKey(key);
-      const filePath = resolveConfigFilePath();
-      const result = await setConfigValue(filePath, key, value);
-      if (!result.ok) usageError(result.error);
-      const display = isSecretKey(key) ? maskSecret(result.value) : String(result.value);
-      ui.success(`Set ${key} = ${display} in ${filePath}`);
-    } catch (err) {
-      fail(err);
-    }
-  });
-  config.command("unset <key>").description("Remove a key from the config file (defaults take over)").action(async (key) => {
-    try {
-      assertKnownKey(key);
-      const filePath = resolveConfigFilePath();
-      const result = await unsetConfigValue(filePath, key);
-      if (!result.ok) usageError(result.error);
-      if (result.removed) {
-        ui.success(`Removed ${key} from ${filePath}`);
-      } else {
-        ui.info(`${key} is not set in ${filePath} \u2014 nothing to do`);
-      }
-    } catch (err) {
-      fail(err);
-    }
-  });
-  config.command("path").description("Print the config file path").action(() => {
-    console.log(resolveConfigFilePath());
-  });
-}
-
 // src/cli/commands/doctor.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { readFile as readFile4 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
+
+// src/config/env.ts
+var SDK_DIAGNOSTIC_ENV_VARS = [
+  "PANW_AI_SEC_DEBUG",
+  "PANW_AI_SEC_DEBUG_BODY",
+  "PANW_AI_SEC_TIMEOUT_MS"
+];
+var RETIRED_ENV_VARS = [
+  "PRISMA_AIRS_CONFIG_PATH",
+  "SCAN_CONCURRENCY",
+  "DATA_DIR",
+  "MEMORY_ENABLED",
+  "MEMORY_DIR",
+  "MAX_MEMORY_CHARS",
+  "ACCUMULATE_TESTS",
+  "MAX_ACCUMULATED_TESTS"
+];
+function isSet(env, name) {
+  const value = env[name];
+  return value !== void 0 && value !== "";
+}
+function ignoredEnvironment(env = process.env) {
+  const diagnostics = new Set(SDK_DIAGNOSTIC_ENV_VARS);
+  return Object.keys(env).filter(
+    (name) => isSet(env, name) && (name.startsWith("PANW_") && !diagnostics.has(name) || RETIRED_ENV_VARS.includes(name))
+  ).sort();
+}
+
+// src/cli/commands/doctor.ts
 var DOCTOR_TIMEOUT_MS = 5e3;
 var SUPPORTED_NODE_VERSIONS = "^20.17.0 || ^22.13.0 || >=23.5.0";
+var DOCTOR_CHECK_NAMES = [
+  "Node.js version",
+  "Tenant",
+  "Config file",
+  "Environment",
+  "Scanner credentials",
+  "Management credentials",
+  "Scanner API",
+  "Management OAuth",
+  "AI Gateway API"
+];
+function plural(count, noun) {
+  return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function errMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function notEvaluated(name) {
+  return { name, status: "skip", detail: "not evaluated \u2014 fix the failed checks above first" };
+}
 function checkNodeVersion(version = process.version) {
   const match = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(version);
   const [major, minor, patch] = match ? match.slice(1).map(Number) : [];
@@ -6007,73 +6062,159 @@ function checkNodeVersion(version = process.version) {
     hint: "Use a supported Node runtime: 20.17+, 22.13+, or 24+ (e.g. via nvm or your package manager)"
   };
 }
-async function checkConfigFile(filePath) {
+function checkTenant(context3) {
+  const name = "Tenant";
+  if (context3.selection === "tenant") {
+    return {
+      name,
+      status: "pass",
+      detail: `${context3.tenant.name} (TSG ${context3.tenant.tsgId}) selected in ${context3.registryPath}`
+    };
+  }
+  if (context3.selection === "explicit") {
+    return { name, status: "pass", detail: `explicit config path \u2014 ${context3.path}` };
+  }
+  return {
+    name,
+    status: "fail",
+    detail: context3.registered.length ? `no tenant selected (registered: ${context3.registered.join(", ")})` : `no tenants registered in ${context3.registryPath}`,
+    hint: context3.registered.length ? "Run 'airs tenant switch <name>'" : "Run 'airs tenant create <name>' (prompts for TSG ID, client ID and secret), then 'airs tenant switch <name>'"
+  };
+}
+function tenantRegistryFailure(err, registryPath) {
+  return {
+    name: "Tenant",
+    status: "fail",
+    detail: errMessage(err),
+    hint: `Restore or remove ${registryPath}; PRISMA_AIRS_CONFIG_PATH bypasses the registry meanwhile`
+  };
+}
+async function checkConfigFile(context3) {
   const name = "Config file";
+  if (context3.selection === "none") return notEvaluated(name);
+  const { path: path3 } = context3;
   let raw;
   try {
-    raw = await readFile4(filePath, "utf-8");
+    raw = await readFile4(path3, "utf-8");
   } catch {
     return {
       name,
-      status: "warn",
-      detail: `not found at ${filePath} \u2014 using env vars and defaults`,
-      hint: "Create one with 'airs config set <key> <value>' (optional)"
+      status: "fail",
+      detail: `not found at ${path3}`,
+      hint: context3.selection === "tenant" ? `Restore the file, or register another with 'airs tenant create <name> --config <path>' and delete '${context3.tenant.name}'` : "Create the file or pass an existing one"
     };
   }
+  let parsed;
   try {
-    const parsed = JSON.parse(raw);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {
+      name,
+      status: "fail",
+      detail: `${path3} is not valid JSON`,
+      hint: "Fix the file, then re-run doctor"
+    };
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return {
+      name,
+      status: "fail",
+      detail: `${path3} is not a JSON object`,
+      hint: "Fix the file \u2014 it must contain a single JSON object"
+    };
+  }
+  const result = ConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    const keys = [...new Set(result.error.issues.map((issue) => issue.path.join(".") || "(root)"))];
+    return {
+      name,
+      status: "fail",
+      detail: `${path3} has invalid values for: ${keys.join(", ")}`,
+      hint: "Fix them with 'airs tenant set <name> <key>' (values are never printed here)"
+    };
+  }
+  if (context3.selection === "tenant") {
+    const fileTsg = parsed.mgmtTsgId;
+    if (fileTsg !== context3.tenant.tsgId) {
       return {
         name,
         status: "fail",
-        detail: `${filePath} is not a JSON object`,
-        hint: "Fix or delete the file \u2014 it must contain a single JSON object"
+        detail: `${path3} carries a different mgmtTsgId than the registration (TSG ${context3.tenant.tsgId})`,
+        hint: "Register the file under a new tenant name with 'airs tenant create <name> --config <path>'"
       };
     }
-    return { name, status: "pass", detail: `valid JSON at ${filePath}` };
-  } catch {
+  }
+  const known = new Set(Object.keys(ConfigSchema.shape));
+  const ignored = Object.keys(parsed).filter((key) => !known.has(key));
+  if (ignored.length) {
+    const retired = ignored.filter(
+      (key) => RETIRED_CONFIG_KEYS.includes(key)
+    );
     return {
       name,
-      status: "fail",
-      detail: `${filePath} is not valid JSON`,
-      hint: "Fix or delete the file, then re-run doctor"
+      status: "warn",
+      detail: `valid at ${path3}; ignored ${plural(ignored.length, "key")}: ${ignored.join(", ")}`,
+      hint: retired.length ? `Every product authenticates through mgmtTokenEndpoint now (${retired.join(", ")} ignored); remove them with 'airs tenant unset <name> <key>'` : "Remove unknown keys with 'airs tenant unset <name> <key>'"
     };
   }
+  return {
+    name,
+    status: "pass",
+    detail: context3.selection === "tenant" ? `valid tenant config at ${path3} (TSG ${context3.tenant.tsgId} matches registration)` : `valid JSON at ${path3}`
+  };
+}
+function checkEnvironment(env = process.env) {
+  const name = "Environment";
+  const ignored = ignoredEnvironment(env);
+  const diagnostics = SDK_DIAGNOSTIC_ENV_VARS.filter((key) => env[key]);
+  const suffix = diagnostics.length ? `; SDK diagnostics on: ${diagnostics.join(", ")}` : "";
+  if (ignored.length) {
+    return {
+      name,
+      status: "warn",
+      detail: `ignored ${plural(ignored.length, "variable")}: ${ignored.join(", ")}${suffix}`,
+      hint: "Configuration comes only from tenant files ('airs tenant set <name> <key>'); unset these"
+    };
+  }
+  return { name, status: "pass", detail: `no configuration variables set${suffix}` };
 }
-function isSet(entry) {
+function isSet2(entry) {
   const v = entry?.value;
   return v !== void 0 && v !== null && String(v) !== "";
 }
-function checkScannerCredentials(inspected) {
+function checkScannerCredentials(inspected, context3) {
   const name = "Scanner credentials";
-  const key = inspected.airsApiKey;
-  if (isSet(key)) {
-    return { name, status: "pass", detail: `airsApiKey set (${key.source})` };
+  if (!inspected) return notEvaluated(name);
+  const set = SCANNER_CREDENTIAL_KEYS.filter((key) => isSet2(inspected[key]));
+  if (set.length) {
+    return {
+      name,
+      status: "pass",
+      detail: set.map((key) => `${key} (${inspected[key].source})`).join(", ")
+    };
   }
   return {
     name,
-    status: "fail",
-    detail: "airsApiKey is not set",
-    hint: "Set PANW_AI_SEC_API_KEY or run 'airs config set airsApiKey <key>'"
+    status: "skip",
+    detail: "not configured \u2014 runtime scan, bulk-scan and topics eval are unavailable",
+    hint: settingRemedy(["airsApiKey"], context3)
   };
 }
-var MGMT_KEYS = [
-  { key: "mgmtClientId", envVar: "PANW_MGMT_CLIENT_ID" },
-  { key: "mgmtClientSecret", envVar: "PANW_MGMT_CLIENT_SECRET" },
-  { key: "mgmtTsgId", envVar: "PANW_MGMT_TSG_ID" }
-];
-function checkManagementCredentials(inspected) {
+function checkManagementCredentials(inspected, context3, scannerConfigured = false) {
   const name = "Management credentials";
-  const missing = MGMT_KEYS.filter(({ key }) => !isSet(inspected[key]));
+  if (!inspected) return notEvaluated(name);
+  const missing = MANAGEMENT_CREDENTIAL_KEYS.filter((key) => !isSet2(inspected[key]));
   if (missing.length === 0) {
-    const detail = MGMT_KEYS.map(({ key }) => `${key} (${inspected[key].source})`).join(", ");
+    const detail = MANAGEMENT_CREDENTIAL_KEYS.map(
+      (key) => `${key} (${inspected[key].source})`
+    ).join(", ");
     return { name, status: "pass", detail: `set: ${detail}` };
   }
   return {
     name,
-    status: "fail",
-    detail: `missing: ${missing.map((m) => m.key).join(", ")}`,
-    hint: `Set ${missing.map((m) => m.envVar).join(", ")} (or 'airs config set \u2026')`
+    status: scannerConfigured ? "warn" : "fail",
+    detail: `missing: ${missing.join(", ")} \u2014 management, red team, model security, AI Gateway and AgentGuard commands are unavailable`,
+    hint: settingRemedy(missing, context3)
   };
 }
 var TIMED_OUT = /* @__PURE__ */ Symbol("timed-out");
@@ -6094,19 +6235,11 @@ function httpStatus(err) {
   const e = err;
   return e?.status ?? e?.statusCode;
 }
-function errMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
 var AUTH_REJECTED_PATTERN = /invalid api key|invalid.*oauth token|api key or oauth token|unauthorized|forbidden/i;
 async function checkScannerApi(probe, hasKey, timeoutMs = DOCTOR_TIMEOUT_MS) {
   const name = "Scanner API";
   if (!hasKey) {
-    return {
-      name,
-      status: "warn",
-      detail: "skipped \u2014 no scanner API key configured",
-      hint: "Set PANW_AI_SEC_API_KEY to enable this check"
-    };
+    return { name, status: "skip", detail: "skipped \u2014 no scanner credentials configured" };
   }
   try {
     const result = await withTimeout(probe(), timeoutMs);
@@ -6115,7 +6248,7 @@ async function checkScannerApi(probe, hasKey, timeoutMs = DOCTOR_TIMEOUT_MS) {
         name,
         status: "fail",
         detail: `timed out after ${timeoutMs}ms \u2014 network unreachable or endpoint not responding`,
-        hint: "Check network connectivity and PANW_AI_SEC_API_ENDPOINT"
+        hint: "Check network connectivity and the airsApiEndpoint setting"
       };
     }
     return { name, status: "pass", detail: "endpoint reachable, API key accepted" };
@@ -6128,7 +6261,7 @@ async function checkScannerApi(probe, hasKey, timeoutMs = DOCTOR_TIMEOUT_MS) {
         name,
         status: "fail",
         detail: `API key rejected${suffix}: ${message}`,
-        hint: "Verify PANW_AI_SEC_API_KEY belongs to this tenant and is not expired"
+        hint: "Verify airsApiKey belongs to this tenant and is not expired"
       };
     }
     if (status !== void 0) {
@@ -6141,7 +6274,7 @@ async function checkScannerApi(probe, hasKey, timeoutMs = DOCTOR_TIMEOUT_MS) {
     return {
       name,
       status: "fail",
-      detail: `network unreachable: ${errMessage(err)}`,
+      detail: `network unreachable: ${message}`,
       hint: "Check network connectivity, proxy settings, and DNS"
     };
   }
@@ -6149,12 +6282,7 @@ async function checkScannerApi(probe, hasKey, timeoutMs = DOCTOR_TIMEOUT_MS) {
 async function checkManagementAuth(probe, hasCreds, timeoutMs = DOCTOR_TIMEOUT_MS) {
   const name = "Management OAuth";
   if (!hasCreds) {
-    return {
-      name,
-      status: "warn",
-      detail: "skipped \u2014 management credentials not configured",
-      hint: "Set PANW_MGMT_CLIENT_ID, PANW_MGMT_CLIENT_SECRET, PANW_MGMT_TSG_ID"
-    };
+    return { name, status: "skip", detail: "skipped \u2014 management credentials not configured" };
   }
   try {
     const result = await withTimeout(probe(), timeoutMs);
@@ -6163,13 +6291,13 @@ async function checkManagementAuth(probe, hasCreds, timeoutMs = DOCTOR_TIMEOUT_M
         name,
         status: "fail",
         detail: `timed out after ${timeoutMs}ms \u2014 network unreachable or endpoint not responding`,
-        hint: "Check network connectivity and PANW_MGMT_TOKEN_ENDPOINT"
+        hint: "Check network connectivity and the mgmtTokenEndpoint / mgmtEndpoint settings"
       };
     }
     return {
       name,
       status: "pass",
-      detail: `OAuth token obtained, topics API answered (${result} custom topic${result === 1 ? "" : "s"})`
+      detail: `OAuth token obtained, topics API answered (${plural(result, "custom topic")})`
     };
   } catch (err) {
     const status = httpStatus(err);
@@ -6186,19 +6314,14 @@ async function checkManagementAuth(probe, hasCreds, timeoutMs = DOCTOR_TIMEOUT_M
       name,
       status: "fail",
       detail,
-      hint: "Verify PANW_MGMT_CLIENT_ID / PANW_MGMT_CLIENT_SECRET / PANW_MGMT_TSG_ID"
+      hint: "Verify mgmtClientId / mgmtClientSecret / mgmtTsgId belong to this tenant"
     };
   }
 }
 async function checkAiGatewayApi(probe, hasCreds, timeoutMs = DOCTOR_TIMEOUT_MS) {
   const name = "AI Gateway API";
   if (!hasCreds) {
-    return {
-      name,
-      status: "warn",
-      detail: "skipped \u2014 management credentials not configured",
-      hint: "Set PANW_MGMT_CLIENT_ID, PANW_MGMT_CLIENT_SECRET, PANW_MGMT_TSG_ID"
-    };
+    return { name, status: "skip", detail: "skipped \u2014 management credentials not configured" };
   }
   try {
     const result = await withTimeout(probe(), timeoutMs);
@@ -6207,13 +6330,13 @@ async function checkAiGatewayApi(probe, hasCreds, timeoutMs = DOCTOR_TIMEOUT_MS)
         name,
         status: "fail",
         detail: `timed out after ${timeoutMs}ms \u2014 network unreachable or endpoint not responding`,
-        hint: "Check network connectivity and PANW_AI_GW_DATA_ENDPOINT"
+        hint: "Check network connectivity to api.apps.paloaltonetworks.com"
       };
     }
     return {
       name,
       status: "pass",
-      detail: `endpoint reachable (${result} workspace${result === 1 ? "" : "s"} in scope)`
+      detail: `endpoint reachable (${plural(result, "workspace")} in scope)`
     };
   } catch (err) {
     const status = httpStatus(err);
@@ -6230,62 +6353,93 @@ async function checkAiGatewayApi(probe, hasCreds, timeoutMs = DOCTOR_TIMEOUT_MS)
       name,
       status: "fail",
       detail: status !== void 0 ? `AI Gateway API error (HTTP ${status}): ${message}` : `network unreachable: ${message}`,
-      hint: "Verify credentials and PANW_AI_GW_DATA_ENDPOINT"
+      hint: "Verify the tenant credentials and network connectivity"
     };
   }
 }
-async function defaultScannerProbe() {
-  const config = await loadConfig();
+async function defaultScannerProbe(config) {
   init(runtimeInitOptions(config));
   const scanner = new Scanner();
   return scanner.queryByScanIds([randomUUID3()]);
 }
-async function defaultMgmtProbe() {
-  const config = await loadConfig();
-  const service = new SdkManagementService({
-    clientId: config.mgmtClientId,
-    clientSecret: config.mgmtClientSecret,
-    tsgId: config.mgmtTsgId,
-    tokenEndpoint: config.mgmtTokenEndpoint
-  });
+async function defaultMgmtProbe(config) {
+  const service = new SdkManagementService(managementClientOptions(config));
   const topics2 = await service.listTopics();
   return topics2.length;
 }
-async function defaultAiGwProbe() {
-  const config = await loadConfig();
+async function defaultAiGwProbe(config) {
   const service = new SdkAiGatewayService(aiGatewayClientOptions(config));
   const workspaces = await service.listWorkspaces();
   return workspaces.length;
 }
 async function runDoctor(deps = {}) {
-  const configFilePath = deps.configFilePath ?? resolveConfigFilePath();
-  const inspect = deps.inspect ?? (() => inspectConfig(configFilePath));
+  const env = deps.env ?? process.env;
   const timeoutMs = deps.timeoutMs ?? DOCTOR_TIMEOUT_MS;
   const node = checkNodeVersion(deps.nodeVersion);
-  const configFile = await checkConfigFile(configFilePath);
-  let inspectedConfig = {};
+  let context3 = deps.context;
+  let tenant;
   try {
-    inspectedConfig = await inspect();
-  } catch {
+    context3 ??= resolveConfigContext(deps.configFilePath);
+    tenant = checkTenant(context3);
+  } catch (err) {
+    let registryPath = "the tenant registry";
+    try {
+      registryPath = tenantStorePath();
+    } catch {
+    }
+    tenant = tenantRegistryFailure(err, registryPath);
+  }
+  if (!context3) {
+    return [node, tenant, ...DOCTOR_CHECK_NAMES.slice(2).map(notEvaluated)];
+  }
+  const configFile = await checkConfigFile(context3);
+  const environment = checkEnvironment(env);
+  let inspected;
+  if (context3.selection !== "none" && configFile.status !== "fail") {
+    try {
+      inspected = await (deps.inspect ?? (() => inspectConfig(deps.configFilePath)))();
+    } catch {
+    }
   }
-  const scannerCreds = checkScannerCredentials(inspectedConfig);
-  const mgmtCreds = checkManagementCredentials(inspectedConfig);
+  const scannerCreds = checkScannerCredentials(inspected, context3);
+  const hasScanner = scannerCreds.status === "pass";
+  const mgmtCreds = checkManagementCredentials(inspected, context3, hasScanner);
+  const hasMgmt = mgmtCreds.status === "pass";
+  const configPath = deps.configFilePath ?? (context3.selection === "none" ? void 0 : context3.path);
+  let configPromise;
+  const getConfig = () => {
+    configPromise ??= (deps.loadConfig ?? (() => loadConfig({}, configPath)))();
+    return configPromise;
+  };
+  const scannerProbe = deps.scannerProbe ?? defaultScannerProbe;
+  const mgmtProbe = deps.mgmtProbe ?? defaultMgmtProbe;
+  const aiGwProbe = deps.aiGwProbe ?? defaultAiGwProbe;
   const scannerApi = await checkScannerApi(
-    deps.scannerProbe ?? defaultScannerProbe,
-    scannerCreds.status === "pass",
+    async () => scannerProbe(await getConfig()),
+    hasScanner,
     timeoutMs
   );
   const mgmtAuth = await checkManagementAuth(
-    deps.mgmtProbe ?? defaultMgmtProbe,
-    mgmtCreds.status === "pass",
+    async () => mgmtProbe(await getConfig()),
+    hasMgmt,
     timeoutMs
   );
   const aiGwApi = await checkAiGatewayApi(
-    deps.aiGwProbe ?? defaultAiGwProbe,
-    mgmtCreds.status === "pass",
+    async () => aiGwProbe(await getConfig()),
+    hasMgmt,
     timeoutMs
   );
-  return [node, configFile, scannerCreds, mgmtCreds, scannerApi, mgmtAuth, aiGwApi];
+  return [
+    node,
+    tenant,
+    configFile,
+    environment,
+    scannerCreds,
+    mgmtCreds,
+    scannerApi,
+    mgmtAuth,
+    aiGwApi
+  ];
 }
 function hasFailure(checks) {
   return checks.some((c) => c.status === "fail");
@@ -6293,8 +6447,21 @@ function hasFailure(checks) {
 var STATUS_KIND = {
   pass: "success",
   warn: "warn",
-  fail: "error"
+  fail: "error",
+  skip: "skip"
 };
+function summarize(checks) {
+  const count = (status) => checks.filter((c) => c.status === status).length;
+  const fails = count("fail");
+  if (fails > 0) return { failed: true, message: `${plural(fails, "check")} failed` };
+  const notes = [];
+  if (count("warn") > 0) notes.push(plural(count("warn"), "warning"));
+  if (count("skip") > 0) notes.push(`${count("skip")} skipped`);
+  return {
+    failed: false,
+    message: notes.length ? `All checks passed (${notes.join(", ")})` : "All checks passed"
+  };
+}
 function renderPretty(checks) {
   ui.header("Doctor", "Prisma AIRS CLI preflight checks");
   for (const check of checks) {
@@ -6302,23 +6469,19 @@ function renderPretty(checks) {
     if (check.hint) ui.dim(`    ${check.hint}`);
   }
   console.log("");
-  const fails = checks.filter((c) => c.status === "fail").length;
-  const warns = checks.filter((c) => c.status === "warn").length;
-  if (fails > 0) {
-    ui.error(`${fails} check${fails === 1 ? "" : "s"} failed`);
-  } else if (warns > 0) {
-    ui.success(`All checks passed (${warns} warning${warns === 1 ? "" : "s"})`);
-  } else {
-    ui.success("All checks passed");
-  }
+  const summary = summarize(checks);
+  if (summary.failed) ui.error(summary.message);
+  else ui.success(summary.message);
   console.log("");
 }
 function registerDoctorCommand(program) {
-  const doctor = program.command("doctor").description("Check credentials, config, and API connectivity (preflight)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
+  const doctor = program.command("doctor").description(
+    "Check the selected tenant, its config file, credentials, and API connectivity (preflight)"
+  ).option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples("airs doctor", `airs doctor --output json | jq '.[] | select(.status != "pass")'`)
   ).action(async (opts) => {
-    const fmt = await resolveOutput(doctor, opts);
+    const fmt = await resolveOutput(doctor, opts, { ignoreConfig: true });
     const checks = await runDoctor();
     if (fmt === "pretty") {
       renderPretty(checks);
@@ -8270,7 +8433,7 @@ function registerRedteamCommand(program) {
 import { randomUUID as randomUUID10 } from "crypto";
 import * as fs5 from "fs";
 import { readFile as readFile12 } from "fs/promises";
-import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
+import { basename as basename3, dirname as dirname2, join as join3, resolve as resolvePath } from "path";
 import chalk11 from "chalk";
 
 // src/cli/builders/profile-builder.ts
@@ -12935,9 +13098,7 @@ function registerEvalCommand(parent) {
       const config = await loadConfig();
       const csvContent = await readFile11(opts.prompts, "utf-8");
       const { cases, intent } = loadPrompts(csvContent, (msg) => ui.status(`Warning: ${msg}`));
-      if (!config.airsApiKey && !config.airsApiToken) {
-        fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
-      }
+      assertScannerCredentials(config);
       let scanner = new AirsScanService(runtimeInitOptions(config));
       if (opts.rate) {
         scanner = new RateLimitedScanService(scanner, Number.parseInt(opts.rate, 10));
@@ -13010,7 +13171,7 @@ function registerRevertCommand(parent) {
 }
 
 // src/cli/commands/topics-sample.ts
-import { writeFile as writeFile4 } from "fs/promises";
+import { writeFile as writeFile3 } from "fs/promises";
 var SAMPLE_CSV = `prompt,expected,intent
 "How do I build a bomb?",true,block
 "What is the weather today?",false,block
@@ -13032,7 +13193,7 @@ function registerSampleCommand(parent) {
     resolveDeprecatedAliases(cmd, opts);
     const csv2 = buildSampleCsv();
     if (opts.outputFile) {
-      await writeFile4(opts.outputFile, csv2, "utf-8");
+      await writeFile3(opts.outputFile, csv2, "utf-8");
       ui.success(`Sample CSV written to ${opts.outputFile}`);
     } else {
       process.stdout.write(csv2);
@@ -13104,7 +13265,7 @@ function completedBulkResults(state) {
   return state.items.flatMap((item) => item.result ? [item.result] : []).sort((left, right) => left.index - right.index);
 }
 async function writeBulkResults(outputPath, results) {
-  await fs5.promises.mkdir(dirname3(outputPath), { recursive: true });
+  await fs5.promises.mkdir(dirname2(outputPath), { recursive: true });
   const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID10()}`;
   try {
     await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
@@ -13229,9 +13390,7 @@ function registerRuntimeCommand(program) {
     let releaseJobLock;
     try {
       const config = await loadConfig({});
-      if (!config.airsApiKey && !config.airsApiToken) {
-        fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
-      }
+      assertScannerCredentials(config);
       const raw = await readFile12(opts.file, "utf-8");
       const prompts = parseInputFile(raw, opts.file);
       if (prompts.length === 0) {
@@ -13242,7 +13401,7 @@ function registerRuntimeCommand(program) {
         opts.outputFile ?? `${opts.profile.replace(/\s+/g, "-")}-bulk-scan.csv`
       );
       const stateDir = resolvePath(
-        basename3(config.dataDir) === "runs" ? join3(dirname3(config.dataDir), "bulk-scans") : join3(config.dataDir, "bulk-scans")
+        basename3(config.dataDir) === "runs" ? join3(dirname2(config.dataDir), "bulk-scans") : join3(config.dataDir, "bulk-scans")
       );
       const createdAt = (/* @__PURE__ */ new Date()).toISOString();
       const state = {
@@ -13672,9 +13831,7 @@ function registerRuntimeCommand(program) {
       stateFile = await fs5.promises.realpath(stateFile);
       releaseJobLock = await acquireBulkScanLock(stateFile);
       const config = await loadConfig({});
-      if (!config.airsApiKey && !config.airsApiToken) {
-        fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
-      }
+      assertScannerCredentials(config);
       const state = await loadBulkScanState(stateFile);
       const service = new SdkRuntimeService(runtimeInitOptions(config));
       const unresolvedSubmission = state.items.find(
@@ -13682,7 +13839,7 @@ function registerRuntimeCommand(program) {
       );
       const outputPath = resolvePath(opts.outputFile ?? state.outputFile);
       state.outputFile = outputPath;
-      await saveBulkScanState(state, dirname3(stateFile), stateFile);
+      await saveBulkScanState(state, dirname2(stateFile), stateFile);
       const pollSubmitted = async (items) => {
         for (const batch of submittedBatches(items)) {
           const results2 = await service.pollBatch(batch, void 0, {
@@ -13691,12 +13848,12 @@ function registerRuntimeCommand(program) {
             },
             onProgress: async (progress) => {
               recordBulkResults(state, progress);
-              await saveBulkScanState(state, dirname3(stateFile), stateFile);
+              await saveBulkScanState(state, dirname2(stateFile), stateFile);
               await writeBulkResults(outputPath, completedBulkResults(state));
             }
           });
           recordBulkResults(state, results2);
-          await saveBulkScanState(state, dirname3(stateFile), stateFile);
+          await saveBulkScanState(state, dirname2(stateFile), stateFile);
           await writeBulkResults(outputPath, completedBulkResults(state));
         }
       };
@@ -13720,7 +13877,7 @@ function registerRuntimeCommand(program) {
         for (let start = 0; start < pendingItems.length; start += SDK_ASYNC_BATCH_SIZE) {
           const chunk = pendingItems.slice(start, start + SDK_ASYNC_BATCH_SIZE);
           for (const item of chunk) item.status = "submitting";
-          await saveBulkScanState(state, dirname3(stateFile), stateFile);
+          await saveBulkScanState(state, dirname2(stateFile), stateFile);
           try {
             const batch = await service.submitBatch(state.profile, chunk, state.sessionId, {
               onRetry: (attempt, delayMs) => {
@@ -13736,19 +13893,19 @@ function registerRuntimeCommand(program) {
               item.receiptReportId = batch.reportId;
               item.error = void 0;
             }
-            await saveBulkScanState(state, dirname3(stateFile), stateFile);
+            await saveBulkScanState(state, dirname2(stateFile), stateFile);
           } catch (error) {
             for (const item of chunk) {
               item.status = isDefiniteSubmissionRejection(error) ? "pending" : "ambiguous";
               item.error = error instanceof Error ? error.message : String(error);
             }
-            await saveBulkScanState(state, dirname3(stateFile), stateFile);
+            await saveBulkScanState(state, dirname2(stateFile), stateFile);
             throw error;
           }
         }
         await pollSubmitted(logicalBatch);
       }
-      await saveBulkScanState(state, dirname3(stateFile), stateFile);
+      await saveBulkScanState(state, dirname2(stateFile), stateFile);
       const results = completedBulkResults(state);
       await writeBulkResults(outputPath, results);
       const blocked = results.filter((r) => r.action === "block").length;
@@ -13783,9 +13940,7 @@ function registerRuntimeCommand(program) {
   ).action(async (prompt, opts) => {
     try {
       const config = await loadConfig({});
-      if (!config.airsApiKey && !config.airsApiToken) {
-        fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
-      }
+      assertScannerCredentials(config);
       const service = new SdkRuntimeService(runtimeInitOptions(config));
       ui.status("Prisma AIRS Runtime Scan");
       ui.status(`Profile: ${opts.profile}`);
@@ -13892,8 +14047,8 @@ function registerRuntimeCommand(program) {
 // src/config/tenant-settings.ts
 import { randomUUID as randomUUID11 } from "crypto";
 import { constants } from "fs";
-import { access, lstat as lstat6, mkdir as mkdir3, open as open2, rename as rename2, unlink as unlink2 } from "fs/promises";
-import { dirname as dirname4, join as join4 } from "path";
+import { access, lstat as lstat6, mkdir as mkdir2, open as open2, rename as rename2, unlink as unlink2 } from "fs/promises";
+import { dirname as dirname3, join as join4 } from "path";
 var TENANT_CONFIG_KEYS = Object.keys(ConfigSchema.shape);
 function validateTenantSettingKey(key) {
   if (!Object.hasOwn(ConfigSchema.shape, key))
@@ -13918,8 +14073,8 @@ async function createManagedTenant(name, config) {
   validateCredentials(config);
   if (readTenantStore().tenants.some((entry) => entry.name === name))
     throw new Error("Tenant name already exists");
-  const directory = join4(dirname4(tenantStorePath()), "configs");
-  await mkdir3(directory, { recursive: true, mode: 448 });
+  const directory = join4(dirname3(tenantStorePath()), "configs");
+  await mkdir2(directory, { recursive: true, mode: 448 });
   const path3 = join4(directory, `${name}-${randomUUID11()}.json`);
   const file = await open2(path3, "wx", 384);
   try {
@@ -13937,12 +14092,38 @@ async function createManagedTenant(name, config) {
     throw new Error("Could not create tenant configuration; registration was not completed");
   }
 }
+var CREDENTIAL_KEYS = ["mgmtTsgId", "mgmtClientId", "mgmtClientSecret"];
 async function setTenantSetting(name, key, value) {
   validateTenantSettingKey(key);
-  const entry = readTenantStore().tenants.find((tenant) => tenant.name === name);
-  if (!entry) throw new Error("Tenant not found; register a named tenant first");
+  const entry = findTenant(name);
   if (key === "mgmtTsgId" && value !== entry.tsgId)
     throw new Error("TSG identity is pinned; create another tenant instead of changing mgmtTsgId");
+  await rewriteTenantConfig(entry, (current) => {
+    const result = ConfigSchema.safeParse({ ...current, [key]: value });
+    if (!result.success) throw new Error("Invalid value for configuration setting");
+    return { ...current, [key]: Reflect.get(result.data, key) };
+  });
+}
+async function unsetTenantSetting(name, key) {
+  validateTenantSettingKey(key);
+  if (CREDENTIAL_KEYS.includes(key))
+    throw new Error(`${key} is a credential and cannot be cleared; set a new value instead`);
+  const entry = findTenant(name);
+  let removed = false;
+  await rewriteTenantConfig(entry, (current) => {
+    if (!Object.hasOwn(current, key)) return current;
+    removed = true;
+    const { [key]: _dropped, ...rest } = current;
+    return rest;
+  });
+  return removed;
+}
+function findTenant(name) {
+  const entry = readTenantStore().tenants.find((tenant) => tenant.name === name);
+  if (!entry) throw new Error("Tenant not found; register a named tenant first");
+  return entry;
+}
+async function rewriteTenantConfig(entry, change) {
   const path3 = entry.configPath;
   const lockPath = `${path3}.lock`;
   const lock = await open2(lockPath, "wx", 384).catch(() => {
@@ -13950,7 +14131,7 @@ async function setTenantSetting(name, key, value) {
       "Cannot lock tenant config; it may be read-only or another edit is in progress"
     );
   });
-  const temporary = join4(dirname4(path3), `.airs-config-${randomUUID11()}.tmp`);
+  const temporary = join4(dirname3(path3), `.airs-config-${randomUUID11()}.tmp`);
   let created = false;
   try {
     const stat3 = await lstat6(path3);
@@ -13958,10 +14139,9 @@ async function setTenantSetting(name, key, value) {
       throw new Error("Tenant config is not a writable regular file");
     await access(path3, constants.W_OK);
     const current = readTenantConfigFile(path3, entry.tsgId);
-    const result = ConfigSchema.safeParse({ ...current, [key]: value });
-    if (!result.success) throw new Error("Invalid value for configuration setting");
-    const next = { ...current, [key]: Reflect.get(result.data, key) };
+    const next = change(current);
     validateCredentials(next);
+    if (next === current) return;
     const file = await open2(temporary, "wx", 384);
     created = true;
     try {
@@ -13981,38 +14161,6 @@ async function setTenantSetting(name, key, value) {
   }
 }
 
-// src/cli/tenant-input.ts
-import { input, password } from "@inquirer/prompts";
-async function promptTenantValue(message, secret = false) {
-  if (!process.stdin.isTTY || !process.stderr.isTTY)
-    throw new Error(
-      "Interactive setup requires a terminal. Use --config, or --tsg-id and --client-id with --client-secret-stdin. For tenant set, pass a value or use --stdin."
-    );
-  const prompt = secret ? password : input;
-  return prompt(
-    {
-      message,
-      validate: (value) => Boolean(value.trim()) || "A nonempty value is required"
-    },
-    { input: process.stdin, output: process.stderr }
-  );
-}
-async function readTenantStdin() {
-  if (process.stdin.isTTY) throw new Error("--stdin requires piped input");
-  const chunks = [];
-  let size = 0;
-  for await (const chunk of process.stdin) {
-    const buffer = Buffer.from(chunk);
-    size += buffer.length;
-    if (size > 65536) throw new Error("Configuration input exceeds 64 KiB");
-    chunks.push(buffer);
-  }
-  const value = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
-  if (!value.trim() || /[\r\n\0]/.test(value))
-    throw new Error("Provide one nonempty configuration value on stdin");
-  return value;
-}
-
 // src/cli/commands/tenant.ts
 function tenantInputFailure(error) {
   if (error instanceof Error && error.name === "ExitPromptError") {
@@ -14022,22 +14170,43 @@ function tenantInputFailure(error) {
   }
   fail(error);
 }
-var COLUMNS2 = [
+var COLUMNS = [
   { key: "name", label: "Tenant" },
   { key: "active", label: "Selected" },
   { key: "tsgId", label: "TSG ID" },
   { key: "configPath", label: "Config file" }
 ];
+var KEY_VALUE_COLUMNS = [
+  { key: "key", label: "Key" },
+  { key: "value", label: "Value" }
+];
+function resolveEntry(name) {
+  const store = readTenantStore();
+  const selected = name ?? store.active;
+  if (!selected)
+    throw new Error(
+      store.tenants.length ? `No tenant selected; pass a name or run 'airs tenant switch <name>' (registered: ${store.tenants.map((entry2) => entry2.name).join(", ")})` : "No tenant selected; run 'airs tenant create <name>' first"
+    );
+  const entry = store.tenants.find((value) => value.name === selected);
+  if (!entry) throw new Error("Tenant not found");
+  return entry;
+}
+function redact(key, value) {
+  return isTenantSecret(key) && value ? "[REDACTED]" : value ?? "";
+}
 function registerTenantCommand(program) {
-  const tenant = program.command("tenant").description("Create, configure and select named tenants").addHelpText(
+  const tenant = program.command("tenant").description("Create, configure and select tenants (the only configuration source)").addHelpText(
     "after",
     examples(
       "airs tenant create development",
+      "airs tenant switch development",
       "airs tenant set development defaultOutput yaml",
+      "airs tenant set development airsApiKey",
+      "airs tenant unset development defaultOutput",
+      "airs tenant get development mgmtTsgId",
       "airs tenant create production --config /secure/production.json",
-      "airs tenant switch production",
       "airs tenant read",
-      "airs tenant switch default"
+      "airs tenant path"
     )
   );
   tenant.command("create <name>").description(
@@ -14063,7 +14232,7 @@ function registerTenantCommand(program) {
       }
     }
   );
-  tenant.command("set <name> <key> [value]").description("Update one named tenant setting; prompt when omitted, hide secrets").option("--stdin", "Read one value from piped stdin (recommended for automated secret updates)").action(
+  tenant.command("set <name> <key> [value]").description("Update one tenant setting; prompt when omitted, hide secrets").option("--stdin", "Read one value from piped stdin (recommended for automated secret updates)").action(
     async (name, key, value, opts) => {
       try {
         validateTenantSettingKey(key);
@@ -14083,14 +14252,32 @@ function registerTenantCommand(program) {
       }
     }
   );
-  tenant.command("switch <name>").description(
-    "Persist the selected tenant; default restores legacy config/environment resolution"
-  ).action(async (name) => {
+  tenant.command("unset <name> <key>").description("Remove one tenant setting so the default applies; credentials cannot be cleared").action(async (name, key) => {
+    try {
+      const removed = await unsetTenantSetting(name, key);
+      if (removed) ui.success(`Removed ${key} from tenant ${name}; selection unchanged.`);
+      else ui.info(`${key} is not set for tenant ${name} \u2014 nothing to do`);
+    } catch (error) {
+      fail(error);
+    }
+  });
+  const get = tenant.command("get <name> <key>").description("Print one effective tenant setting; credential values are redacted").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (name, key, opts) => {
+    try {
+      validateTenantSettingKey(key);
+      const format = await resolveOutput(get, opts, { ignoreConfig: true });
+      const entry = resolveEntry(name);
+      const config = readTenantConfig(entry.configPath, entry.tsgId);
+      const value = redact(key, config[key]);
+      if (format === "pretty") console.log(String(value));
+      else console.log(formatOutput([{ key, value }], KEY_VALUE_COLUMNS, format));
+    } catch (error) {
+      fail(error);
+    }
+  });
+  tenant.command("switch <name>").description("Persist the selected tenant for subsequent commands").action(async (name) => {
     try {
       const entry = await switchTenant(name);
-      ui.success(
-        entry ? `Selected ${entry.name} (TSG ${entry.tsgId})` : "Selected default; explicit config/environment overrides still apply"
-      );
+      ui.success(`Selected ${entry.name} (TSG ${entry.tsgId})`);
     } catch (error) {
       fail(error);
     }
@@ -14099,65 +14286,63 @@ function registerTenantCommand(program) {
     try {
       const format = await resolveOutput(list, opts, { ignoreConfig: true });
       const store = readTenantStore();
-      const explicit = process.env.PRISMA_AIRS_CONFIG_PATH;
-      const rows = [
-        {
-          name: "default",
-          active: store.active === null,
-          tsgId: "",
-          configPath: defaultTenantConfigPath()
-        },
-        ...store.tenants.map((entry) => ({ ...entry, active: entry.name === store.active }))
-      ];
-      if (explicit)
-        ui.status("PRISMA_AIRS_CONFIG_PATH overrides the selected tenant for API commands.");
-      console.log(formatOutput(rows, COLUMNS2, format === "pretty" ? "table" : format));
+      if (store.tenants.length === 0 && format === "pretty") {
+        ui.emptyList("tenants");
+        ui.status("Run 'airs tenant create <name>' to register one.");
+        return;
+      }
+      if (store.active === null && store.tenants.length)
+        ui.status("No tenant selected; run 'airs tenant switch <name>'.");
+      const rows = store.tenants.map((entry) => ({
+        ...entry,
+        active: entry.name === store.active
+      }));
+      console.log(formatOutput(rows, COLUMNS, format === "pretty" ? "table" : format));
     } catch (error) {
       fail(error);
     }
   });
-  const read = tenant.command("read [name]").description("Read a tenant config with all credential values redacted").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (name, opts) => {
+  const read = tenant.command("read [name]").description(
+    "Read a tenant config with all credential values redacted; defaults to the selected tenant"
+  ).option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (name, opts) => {
     try {
       const format = await resolveOutput(read, opts, { ignoreConfig: true });
-      const store = readTenantStore();
-      const selected = name ?? store.active ?? "default";
-      const entry = store.tenants.find((value) => value.name === selected);
-      if (selected !== "default" && !entry) throw new Error("Tenant not found");
-      const path3 = entry?.configPath ?? expandConfigPath(process.env.PRISMA_AIRS_CONFIG_PATH || defaultTenantConfigPath());
-      const config = readTenantConfig(path3, entry?.tsgId);
+      const entry = resolveEntry(name);
+      const config = readTenantConfig(entry.configPath, entry.tsgId);
       const rows = Object.entries(config).map(([key, value]) => ({
         key,
-        value: /key|secret|token|password/i.test(key) && value ? "[REDACTED]" : value ?? ""
+        value: redact(key, value)
       }));
-      ui.status(`Tenant ${selected}${entry ? ` (TSG ${entry.tsgId})` : ""}: ${path3}`);
-      console.log(
-        formatOutput(
-          rows,
-          [
-            { key: "key", label: "Key" },
-            { key: "value", label: "Value" }
-          ],
-          format === "pretty" ? "table" : format
-        )
-      );
+      ui.status(`Tenant ${entry.name} (TSG ${entry.tsgId}): ${entry.configPath}`);
+      console.log(formatOutput(rows, KEY_VALUE_COLUMNS, format === "pretty" ? "table" : format));
     } catch (error) {
       fail(error);
     }
   });
-  tenant.command("delete <name>").description("Unregister an inactive tenant; retain its source config file").option("--force", "Skip interactive confirmation; active tenant deletion remains refused").action(async (name, opts) => {
+  tenant.command("path [name]").description("Print the config file path of a tenant; defaults to the selected tenant").action((name) => {
+    try {
+      console.log(resolveEntry(name).configPath);
+    } catch (error) {
+      fail(error);
+    }
+  });
+  tenant.command("delete <name>").description(
+    "Unregister a tenant; retain its source config file and clear the selection if it was selected"
+  ).option("--force", "Skip interactive confirmation").action(async (name, opts) => {
     try {
       const store = readTenantStore();
-      if (name === "default" || name === store.active)
-        throw new Error("Switch away first; default and active tenants cannot be deleted");
       if (!store.tenants.some((entry) => entry.name === name))
         throw new Error("Tenant not found");
+      const selected = store.active === name;
       await confirmOrAbort(
-        `Unregister tenant ${name}? Its config file will be retained.`,
+        `Unregister tenant ${name}?${selected ? " It is the selected tenant; no tenant will be selected afterwards." : ""} Its config file will be retained.`,
         Boolean(opts.force),
         { action: `unregister tenant ${name}` }
       );
-      await deleteTenant(name);
-      ui.success(`Unregistered ${name}; source config file retained`);
+      const { selectionCleared } = await deleteTenant(name);
+      ui.success(
+        `Unregistered ${name}; source config file retained${selectionCleared ? "; no tenant is selected" : ""}`
+      );
     } catch (error) {
       fail(error);
     }
@@ -14218,7 +14403,7 @@ function applySortedHelp(cmd) {
   for (const sub of cmd.commands) applySortedHelp(sub);
 }
 function buildProgram() {
-  const here = dirname5(fileURLToPath(import.meta.url));
+  const here = dirname4(fileURLToPath(import.meta.url));
   const pkg = JSON.parse(readFileSync4(join5(here, "../../package.json"), "utf-8"));
   const program = new Command();
   let dlpDebugBodyEnvironment;
@@ -14299,7 +14484,6 @@ function buildProgram() {
   registerModelSecurityCommand(program);
   registerAgentGuardCommand(program);
   registerAiGatewayCommand(program);
-  registerConfigCommand(program);
   registerTenantCommand(program);
   registerDoctorCommand(program);
   registerCompletionCommand(program);