@cdot65/prisma-airs-cli 5.3.0 → 5.5.0

package/README.md

@@ -25,7 +25,9 @@
 - **Unified automation output** — resource reads support `pretty`, `table`, `markdown`, `csv`, `json`, and `yaml`, with pipe-safe stdout; environment deliverables use HTML or Markdown
 - **Complete pagination** — consistent `--limit`, `--offset`, and `--all` traversal with a configurable safety cap
 - **`airs doctor`** — one-command diagnostics for environment, credentials, and API connectivity
-- **`airs config`** — manage `~/.prisma-airs/config.json` from the CLI (`list`, `get`, `set`, `unset`, `path`)
+- **Tenant selection** — `airs tenant create|switch|list|read|delete` selects existing config files without copying secrets or changing read-only mounts
+- **Profile migration** — `airs runtime profiles backup|restore` exports private JSON/YAML, previews cross-tenant restores, remaps topics and explicit DLP dependencies, and verifies restored policies ([guide](https://cdot65.github.io/prisma-airs-cli/runtime/profile-transfer/))
+- **`airs config`** — manage the selected config file from the CLI (`list`, `get`, `set`, `unset`, `path`)
 
 ## Install
 

package/dist/{chunk-7Z76VCB3.js → chunk-NKAVUBKI.js}

@@ -679,8 +679,11 @@ var SdkModelSecurityService = class {
   }
   async listScans(opts) {
     const sdkOpts = {};
-    if (opts?.evalOutcome) sdkOpts.eval_outcome = opts.evalOutcome;
-    if (opts?.sourceType) sdkOpts.source_type = opts.sourceType;
+    if (opts?.evalOutcome) sdkOpts.eval_outcomes = [opts.evalOutcome];
+    if (opts?.sourceType) sdkOpts.source_types = [opts.sourceType];
+    if (opts?.modelVersionUuid) sdkOpts.model_version_uuid = opts.modelVersionUuid;
+    if (opts?.startTime) sdkOpts.start_time = opts.startTime;
+    if (opts?.endTime) sdkOpts.end_time = opts.endTime;
     if (opts?.scanOrigin) sdkOpts.scan_origin = opts.scanOrigin;
     if (opts?.search) sdkOpts.search = opts.search;
     if (opts?.skip !== void 0) sdkOpts.skip = opts.skip;
@@ -694,6 +697,9 @@ var SdkModelSecurityService = class {
   }
   async listAllScans(opts = {}) {
     const rows = await this.client.scans.listAll({
+      model_version_uuid: opts.modelVersionUuid,
+      start_time: opts.startTime,
+      end_time: opts.endTime,
       eval_outcomes: opts.evalOutcome === void 0 ? void 0 : [opts.evalOutcome],
       source_types: opts.sourceType === void 0 ? void 0 : [opts.sourceType],
       search_query: opts.search,
@@ -793,6 +799,8 @@ var SdkModelSecurityService = class {
     const sdkOpts = {};
     if (opts?.search) sdkOpts.search = opts.search;
     if (opts?.searchQuery) sdkOpts.search_query = opts.searchQuery;
+    if (opts?.startTime) sdkOpts.start_time = opts.startTime;
+    if (opts?.endTime) sdkOpts.end_time = opts.endTime;
     if (opts?.sortField) sdkOpts.sort_field = opts.sortField;
     if (opts?.sortOrder) sdkOpts.sort_order = opts.sortOrder;
     if (opts?.skip !== void 0) sdkOpts.skip = opts.skip;
@@ -806,6 +814,8 @@ var SdkModelSecurityService = class {
   }
   async listAllModels(opts = {}) {
     const rows = await this.client.models.listAllModels({
+      start_time: opts.startTime,
+      end_time: opts.endTime,
       search: opts.search,
       search_query: opts.searchQuery,
       sort_field: opts.sortField,
@@ -1444,7 +1454,7 @@ var SdkRedTeamService = class {
     }));
   }
   async waitForCompletion(jobId, onProgress, intervalMs = 5e3) {
-    const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+    const delay = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
     while (true) {
       const job = await this.getScan(jobId);
       onProgress?.(job);
@@ -1816,7 +1826,7 @@ var SdkRuntimeService = class {
         const retryAfterMs = error.retryAfterMs;
         const delayMs = typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs >= 0 ? retryAfterMs : baseDelay * 2 ** (retryAttempt - 1);
         retryOpts?.onRetry?.(retryAttempt, delayMs);
-        await new Promise((resolve) => setTimeout(resolve, delayMs));
+        await new Promise((resolve2) => setTimeout(resolve2, delayMs));
       }
     }
     return {
@@ -1861,7 +1871,7 @@ var SdkRuntimeService = class {
           const retryAfterMs = err.retryAfterMs;
           const delayMs = typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs >= 0 ? retryAfterMs : baseDelay * 2 ** (retryLevel - 1);
           retryOpts?.onRetry?.(retryLevel, delayMs);
-          await new Promise((resolve) => setTimeout(resolve, delayMs));
+          await new Promise((resolve2) => setTimeout(resolve2, delayMs));
           continue;
         }
         throw err;
@@ -1934,7 +1944,7 @@ var SdkRuntimeService = class {
             const retryAfterMs = err.retryAfterMs;
             const delayMs = typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs >= 0 ? retryAfterMs : baseDelay * 2 ** (retryLevel - 1);
             retryOpts?.onRetry?.(retryLevel, delayMs);
-            await new Promise((resolve) => setTimeout(resolve, delayMs));
+            await new Promise((resolve2) => setTimeout(resolve2, delayMs));
             continue;
           }
           throw err;
@@ -1968,7 +1978,7 @@ var SdkRuntimeService = class {
         );
       }
       if (resolved.size < batch.entries.length) {
-        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        await new Promise((resolve2) => setTimeout(resolve2, intervalMs));
       }
     }
     return [...resolved.values()].sort((left, right) => left.index - right.index);
@@ -2016,7 +2026,7 @@ var SdkRuntimeService = class {
             retryLevel++;
             const delayMs = baseDelay * 2 ** (retryLevel - 1);
             retryOpts?.onRetry?.(retryLevel, delayMs);
-            await new Promise((resolve) => setTimeout(resolve, delayMs));
+            await new Promise((resolve2) => setTimeout(resolve2, delayMs));
             sweepCompleted = false;
             break;
           }
@@ -2025,7 +2035,7 @@ var SdkRuntimeService = class {
         this.processQueryResults(results, completed, pending);
         if (b + 5 < pendingIds.length) {
           const batchDelay = retryLevel > 0 ? baseDelay : Math.min(baseDelay, 1e3);
-          await new Promise((resolve) => setTimeout(resolve, batchDelay));
+          await new Promise((resolve2) => setTimeout(resolve2, batchDelay));
         }
       }
       if (sweepCompleted && retryLevel > 0) {
@@ -2033,7 +2043,7 @@ var SdkRuntimeService = class {
       }
       if (pending.size > 0) {
         const sweepDelay = retryLevel > 0 ? baseDelay * 2 ** retryLevel : intervalMs;
-        await new Promise((resolve) => setTimeout(resolve, sweepDelay));
+        await new Promise((resolve2) => setTimeout(resolve2, sweepDelay));
       }
     }
     return scanIds.map((id) => completed.get(id));
@@ -2154,7 +2164,7 @@ var RateLimitedScanService = class {
       const oldest = this.timestamps[0];
       const waitMs = 1e3 - (now - oldest);
       if (waitMs > 0) {
-        await new Promise((resolve) => setTimeout(resolve, waitMs));
+        await new Promise((resolve2) => setTimeout(resolve2, waitMs));
       }
       const after = Date.now();
       this.timestamps = this.timestamps.filter((t) => after - t < 1e3);
@@ -2223,8 +2233,8 @@ function readBackupDir(dirPath, resourceType) {
 
 // src/config/loader.ts
 import { readFile } from "fs/promises";
-import { homedir } from "os";
-import { join } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 
 // src/config/schema.ts
 import { z } from "zod";
@@ -2251,6 +2261,9 @@ var ConfigSchema = z.object({
   modelSecDataEndpoint: z.string().optional(),
   modelSecMgmtEndpoint: z.string().optional(),
   modelSecTokenEndpoint: z.string().optional(),
+  agentGuardDataEndpoint: z.string().url().optional(),
+  agentGuardMgmtEndpoint: z.string().url().optional(),
+  agentGuardTokenEndpoint: z.string().url().optional(),
   // AI Gateway (endpoints only; creds shared with mgmt*)
   aiGwDataEndpoint: z.string().optional(),
   aiGwAdminEndpoint: z.string().optional(),
@@ -2267,9 +2280,183 @@ var ConfigSchema = z.object({
   dataDir: z.string().default("~/.prisma-airs/runs")
 });
 
+// src/config/tenants.ts
+import { randomUUID } from "crypto";
+import { lstatSync, readFileSync, realpathSync } from "fs";
+import { mkdir, open, rename, unlink } from "fs/promises";
+import { homedir } from "os";
+import { dirname, isAbsolute, join, resolve } from "path";
+import { z as z2 } from "zod";
+var NameSchema = z2.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/).refine((v) => v !== "default");
+var EntrySchema = z2.object({
+  name: NameSchema,
+  configPath: z2.string().refine(isAbsolute),
+  tsgId: z2.string().min(1)
+}).strict();
+var StoreSchema = z2.object({
+  version: z2.literal(1),
+  active: z2.string().nullable(),
+  tenants: z2.array(EntrySchema).max(1e3)
+}).strict().superRefine((value, ctx) => {
+  const names = new Set(value.tenants.map((entry) => entry.name));
+  if (names.size !== value.tenants.length || value.active !== null && !names.has(value.active))
+    ctx.addIssue({ code: z2.ZodIssueCode.custom, message: "Invalid tenant registry identities" });
+});
+function tenantStorePath() {
+  const explicit = process.env.PRISMA_AIRS_TENANTS_PATH;
+  if (explicit) return resolve(expandConfigPath(explicit));
+  const state = process.env.XDG_STATE_HOME;
+  if (state && !isAbsolute(state)) throw new Error("XDG_STATE_HOME must be an absolute path");
+  return join(state || join(homedir(), ".local", "state"), "prisma-airs", "tenants.json");
+}
+function expandConfigPath(path2) {
+  return path2 === "~" ? homedir() : path2.startsWith("~/") ? join(homedir(), path2.slice(2)) : path2;
+}
+function defaultTenantConfigPath() {
+  return join(homedir(), ".prisma-airs", "config.json");
+}
+function missing(error) {
+  return error?.code === "ENOENT";
+}
+function readTenantStore() {
+  const path2 = tenantStorePath();
+  try {
+    const stat = lstatSync(path2);
+    if (!stat.isFile() || stat.size > 1048576) throw new Error();
+    return StoreSchema.parse(JSON.parse(readFileSync(path2, "utf8")));
+  } catch (error) {
+    if (missing(error)) return { version: 1, active: null, tenants: [] };
+    throw new Error(
+      `Cannot read tenant registry at ${path2}; restore a valid registry before proceeding`
+    );
+  }
+}
+function selectedTenant() {
+  const store = readTenantStore();
+  return store.tenants.find((entry) => entry.name === store.active);
+}
+function readTenantConfig(path2, expectedTsgId) {
+  return ConfigSchema.parse(readTenantConfigFile(path2, expectedTsgId));
+}
+function readTenantConfigFile(path2, expectedTsgId) {
+  let config;
+  let parsed;
+  try {
+    const stat = lstatSync(realpathSync(path2));
+    if (!stat.isFile() || stat.size > 1048576) throw new Error();
+    parsed = JSON.parse(readFileSync(path2, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error();
+    config = ConfigSchema.parse(parsed);
+  } catch {
+    throw new Error(`Cannot read a valid tenant config at ${path2}`);
+  }
+  if (expectedTsgId !== void 0 && config.mgmtTsgId !== expectedTsgId)
+    throw new Error(
+      "Tenant config TSG differs from its registered identity; register it under a new name"
+    );
+  return parsed;
+}
+function assertTenantEnvironment() {
+  const conflicts = Object.keys(process.env).filter(
+    (key) => /^PANW_(?:MGMT_|MODEL_SEC_|RED_TEAM_|AGENT_GUARD_|AI_GW_|DLP_|AI_SEC_API_)/.test(key) && Boolean(process.env[key])
+  );
+  if (conflicts.length)
+    throw new Error(
+      `Named tenant selection conflicts with environment overrides: ${conflicts.sort().join(", ")}. Unset them or switch to default.`
+    );
+}
+async function changeStore(change) {
+  const path2 = tenantStorePath();
+  await mkdir(dirname(path2), { recursive: true, mode: 448 });
+  const lockPath = `${path2}.lock`;
+  let lock;
+  try {
+    lock = await open(lockPath, "wx", 384);
+  } catch {
+    throw new Error(
+      `Cannot lock tenant registry at ${lockPath}; another change may be in progress`
+    );
+  }
+  const temp = join(dirname(path2), `.airs-tenants-${randomUUID()}.tmp`);
+  let created = false;
+  try {
+    const store = readTenantStore();
+    change(store);
+    StoreSchema.parse(store);
+    const file = await open(temp, "wx", 384);
+    created = true;
+    try {
+      await file.writeFile(`${JSON.stringify(store, null, 2)}
+`);
+      await file.sync();
+    } finally {
+      await file.close();
+    }
+    await rename(temp, path2);
+    created = false;
+    return store;
+  } finally {
+    if (created) await unlink(temp).catch(() => {
+    });
+    await lock.close();
+    await unlink(lockPath);
+  }
+}
+async function createTenant(name, configPath) {
+  if (!NameSchema.safeParse(name).success)
+    throw new Error(
+      "Tenant name must be 1\u201364 letters, digits, hyphens or underscores, start with a letter/digit, and not be default"
+    );
+  let path2;
+  try {
+    path2 = realpathSync(resolve(expandConfigPath(configPath)));
+  } catch {
+    throw new Error("Tenant config file does not exist or cannot be resolved");
+  }
+  const config = readTenantConfig(path2);
+  if (!config.mgmtTsgId?.trim() || !config.mgmtClientId?.trim() || !config.mgmtClientSecret?.trim())
+    throw new Error("Tenant config requires mgmtTsgId, mgmtClientId and mgmtClientSecret");
+  const entry = { name, configPath: path2, tsgId: config.mgmtTsgId };
+  await changeStore((store) => {
+    if (store.tenants.some((tenant) => tenant.name === name))
+      throw new Error("Tenant name already exists");
+    store.tenants.push(entry);
+    store.tenants.sort((a, b) => a.name.localeCompare(b.name));
+  });
+  return entry;
+}
+async function switchTenant(name) {
+  let selected;
+  await changeStore((store) => {
+    if (name === "default") {
+      store.active = null;
+      return;
+    }
+    if (process.env.PRISMA_AIRS_CONFIG_PATH)
+      throw new Error(
+        "Unset PRISMA_AIRS_CONFIG_PATH before switching tenants; it overrides named selection"
+      );
+    assertTenantEnvironment();
+    selected = store.tenants.find((entry) => entry.name === name);
+    if (!selected) throw new Error("Tenant not found");
+    readTenantConfig(selected.configPath, selected.tsgId);
+    store.active = name;
+  });
+  return selected;
+}
+async function deleteTenant(name) {
+  await changeStore((store) => {
+    if (name === "default") throw new Error("The default tenant cannot be deleted");
+    if (store.active === name)
+      throw new Error("Switch to another tenant or default before deleting the active tenant");
+    if (!store.tenants.some((entry) => entry.name === name)) throw new Error("Tenant not found");
+    store.tenants = store.tenants.filter((entry) => entry.name !== name);
+  });
+}
+
 // src/config/loader.ts
 function expandHome(p) {
-  return p.startsWith("~") ? join(homedir(), p.slice(1)) : p;
+  return p.startsWith("~") ? join2(homedir2(), p.slice(1)) : p;
 }
 function fromEnv() {
   const env = process.env;
@@ -2292,6 +2479,9 @@ function fromEnv() {
     modelSecDataEndpoint: env.PANW_MODEL_SEC_DATA_ENDPOINT,
     modelSecMgmtEndpoint: env.PANW_MODEL_SEC_MGMT_ENDPOINT,
     modelSecTokenEndpoint: env.PANW_MODEL_SEC_TOKEN_ENDPOINT,
+    agentGuardDataEndpoint: env.PANW_AGENT_GUARD_DATA_ENDPOINT,
+    agentGuardMgmtEndpoint: env.PANW_AGENT_GUARD_MGMT_ENDPOINT,
+    agentGuardTokenEndpoint: env.PANW_AGENT_GUARD_TOKEN_ENDPOINT,
     aiGwDataEndpoint: env.PANW_AI_GW_DATA_ENDPOINT,
     aiGwAdminEndpoint: env.PANW_AI_GW_ADMIN_ENDPOINT,
     aiGwTokenEndpoint: env.PANW_AI_GW_TOKEN_ENDPOINT,
@@ -2316,14 +2506,23 @@ function stripUndefined(obj) {
   return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== void 0 && v !== ""));
 }
 function resolveConfigFilePath(configFilePath) {
-  if (configFilePath) return configFilePath;
+  return resolveConfigSource(configFilePath).path;
+}
+function resolveConfigSource(configFilePath) {
+  if (configFilePath) return { path: expandHome(configFilePath) };
   const envPath = process.env.PRISMA_AIRS_CONFIG_PATH;
-  if (envPath) return expandHome(envPath);
-  return join(homedir(), ".prisma-airs", "config.json");
+  if (envPath) return { path: expandHome(envPath) };
+  const tenant = selectedTenant();
+  return { path: tenant?.configPath ?? join2(homedir2(), ".prisma-airs", "config.json"), tenant };
+}
+async function readConfigSource(configFilePath) {
+  const { path: path2, tenant } = resolveConfigSource(configFilePath);
+  if (!tenant) return fromFile(path2);
+  assertTenantEnvironment();
+  return readTenantConfigFile(path2, tenant.tsgId);
 }
 async function loadConfig(cliOverrides = {}, configFilePath) {
-  const filePath = resolveConfigFilePath(configFilePath);
-  const fileConfig = await fromFile(filePath);
+  const fileConfig = await readConfigSource(configFilePath);
   const envConfig = fromEnv();
   const merged = {
     ...stripUndefined(fileConfig),
@@ -2337,8 +2536,7 @@ async function loadConfig(cliOverrides = {}, configFilePath) {
   };
 }
 async function inspectConfig(configFilePath) {
-  const filePath = resolveConfigFilePath(configFilePath);
-  const fileConfig = stripUndefined(await fromFile(filePath));
+  const fileConfig = stripUndefined(await readConfigSource(configFilePath));
   const envConfig = stripUndefined(fromEnv());
   const merged = { ...fileConfig, ...envConfig };
   const config = ConfigSchema.parse(merged);
@@ -2911,12 +3109,12 @@ function renderEnvironmentReportHtml(r) {
 }
 
 // src/reports/io.ts
-import { randomUUID } from "crypto";
-import { link, open, unlink } from "fs/promises";
-import { dirname, join as join2 } from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+import { link, open as open2, unlink as unlink2 } from "fs/promises";
+import { dirname as dirname2, join as join3 } from "path";
 async function writeReportFile(path2, content) {
-  const temporary = join2(dirname(path2), `.airs-report-${randomUUID()}.tmp`);
-  const file = await open(temporary, "wx", 384);
+  const temporary = join3(dirname2(path2), `.airs-report-${randomUUID2()}.tmp`);
+  const file = await open2(temporary, "wx", 384);
   try {
     await file.writeFile(content, "utf8");
     await file.sync();
@@ -2924,7 +3122,7 @@ async function writeReportFile(path2, content) {
     await link(temporary, path2);
   } finally {
     await file.close();
-    await unlink(temporary);
+    await unlink2(temporary);
   }
 }
 
@@ -3988,6 +4186,13 @@ export {
   readBackupFile,
   readBackupDir,
   ConfigSchema,
+  expandConfigPath,
+  defaultTenantConfigPath,
+  readTenantStore,
+  readTenantConfig,
+  createTenant,
+  switchTenant,
+  deleteTenant,
   resolveConfigFilePath,
   loadConfig,
   inspectConfig,