@cdot65/prisma-airs-cli 5.5.0 → 5.6.0

package/README.md

@@ -25,7 +25,7 @@
 - **Unified automation output** — resource reads support `pretty`, `table`, `markdown`, `csv`, `json`, and `yaml`, with pipe-safe stdout; environment deliverables use HTML or Markdown
 - **Complete pagination** — consistent `--limit`, `--offset`, and `--all` traversal with a configurable safety cap
 - **`airs doctor`** — one-command diagnostics for environment, credentials, and API connectivity
-- **Tenant selection** — `airs tenant create|switch|list|read|delete` selects existing config files without copying secrets or changing read-only mounts
+- **Tenant configuration** — `airs tenant create|set|switch|list|read|delete` supports guided setup with hidden secret prompts, individual setting updates, and existing-file registration without changing read-only mounts
 - **Profile migration** — `airs runtime profiles backup|restore` exports private JSON/YAML, previews cross-tenant restores, remaps topics and explicit DLP dependencies, and verifies restored policies ([guide](https://cdot65.github.io/prisma-airs-cli/runtime/profile-transfer/))
 - **`airs config`** — manage the selected config file from the CLI (`list`, `get`, `set`, `unset`, `path`)
 

package/dist/{chunk-NKAVUBKI.js → chunk-XQOICLSH.js}

@@ -2402,11 +2402,14 @@ async function changeStore(change) {
     await unlink(lockPath);
   }
 }
-async function createTenant(name, configPath) {
+function validateTenantName(name) {
   if (!NameSchema.safeParse(name).success)
     throw new Error(
       "Tenant name must be 1\u201364 letters, digits, hyphens or underscores, start with a letter/digit, and not be default"
     );
+}
+async function createTenant(name, configPath) {
+  validateTenantName(name);
   let path2;
   try {
     path2 = realpathSync(resolve(expandConfigPath(configPath)));
@@ -4186,10 +4189,13 @@ export {
   readBackupFile,
   readBackupDir,
   ConfigSchema,
+  tenantStorePath,
   expandConfigPath,
   defaultTenantConfigPath,
   readTenantStore,
   readTenantConfig,
+  readTenantConfigFile,
+  validateTenantName,
   createTenant,
   switchTenant,
   deleteTenant,

package/dist/cli/index.js

@@ -23,6 +23,7 @@ import {
   readBackupDir,
   readBackupFile,
   readTenantConfig,
+  readTenantConfigFile,
   readTenantStore,
   renderEnvironmentReportHtml,
   renderEnvironmentReportMarkdown,
@@ -34,10 +35,12 @@ import {
   resolveOutputDir,
   sanitizeFilename,
   switchTenant,
+  tenantStorePath,
+  validateTenantName,
   validateTopic,
   writeBackupFile,
   writeReportFile
-} from "../chunk-NKAVUBKI.js";
+} from "../chunk-XQOICLSH.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -56,9 +59,9 @@ function installProcessGuards() {
 }
 
 // src/cli/program.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname4, join as join4 } from "path";
+import { dirname as dirname5, join as join5 } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
 
@@ -3684,19 +3687,19 @@ function installDebugLogger(logPath, options = {}) {
   mkdirSync(dirname(logPath), { recursive: true, mode: 448 });
   writeFileSync(logPath, "", { encoding: "utf8", mode: 384, flag: "wx" });
   const originalFetch = globalThis.fetch;
-  globalThis.fetch = async function debugFetch(input, init2) {
-    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+  globalThis.fetch = async function debugFetch(input2, init2) {
+    const url = typeof input2 === "string" ? input2 : input2 instanceof URL ? input2.toString() : input2.url;
     const rawHeaders = headersToRecord(
-      init2?.headers ?? (input instanceof Request ? input.headers : void 0)
+      init2?.headers ?? (input2 instanceof Request ? input2.headers : void 0)
     );
     const inference = Object.keys(rawHeaders).some(
       (name) => name.toLowerCase() === "x-portkey-api-key"
     );
     if (!isAirsUrl(url) && !inference) {
-      return originalFetch(input, init2);
+      return originalFetch(input2, init2);
     }
     const dashboard = options.omitBodies || /\/v1\/mgmt\/(dashboard\/|reports\/scancontent(?:\?|$))/.test(url) || /\/aiag\//.test(new URL(url).pathname);
-    const method = init2?.method ?? (input instanceof Request ? input.method : "GET");
+    const method = init2?.method ?? (input2 instanceof Request ? input2.method : "GET");
     const reqHeaders = redactHeaders(rawHeaders);
     const loggedUrl = redactUrl(url);
     let reqBody;
@@ -3715,7 +3718,7 @@ function installDebugLogger(logPath, options = {}) {
     let resBody;
     let error;
     try {
-      response = await originalFetch(input, init2);
+      response = await originalFetch(input2, init2);
     } catch (err) {
       error = inference ? "Runtime request failed" : "Request failed";
       const entry2 = JSON.stringify({
@@ -6955,8 +6958,8 @@ function buildDefaultCategories(categories) {
     ])
   );
 }
-function parseAttackGoals(input) {
-  const trimmed = input.trim();
+function parseAttackGoals(input2) {
+  const trimmed = input2.trim();
   const raw = trimmed.startsWith("[") ? trimmed : fs2.readFileSync(trimmed, "utf-8");
   let parsed;
   try {
@@ -6978,10 +6981,10 @@ function sliceClientSide(items, opts) {
   const limit = opts.limit !== void 0 ? Number.parseInt(String(opts.limit), 10) : void 0;
   return items.slice(offset, limit === void 0 ? void 0 : offset + limit);
 }
-function parsePositiveInt(input, flag) {
-  const n = Number.parseInt(input, 10);
+function parsePositiveInt(input2, flag) {
+  const n = Number.parseInt(input2, 10);
   if (!Number.isFinite(n) || n <= 0) {
-    throw new Error(`${flag}: expected a positive integer, got "${input}"`);
+    throw new Error(`${flag}: expected a positive integer, got "${input2}"`);
   }
   return n;
 }
@@ -7067,10 +7070,10 @@ function resolveScriptB64(opts) {
   }
   throw new Error("one of --script-file or --script-b64 is required");
 }
-function parseAdapterVariables(input) {
+function parseAdapterVariables(input2) {
   let parsed;
   try {
-    parsed = JSON.parse(input);
+    parsed = JSON.parse(input2);
   } catch (err) {
     throw new Error(`--variables: invalid JSON (${err instanceof Error ? err.message : err})`);
   }
@@ -9732,8 +9735,8 @@ async function dataProfiles(api, maxPages2) {
   }
   throw new Error("DLP inventory is incomplete; increase --max-pages");
 }
-async function planRuntimeProfilesRestore(api, input, destinationTsgId, options = {}) {
-  const backup = RuntimeProfilesBackupSchema.parse(input);
+async function planRuntimeProfilesRestore(api, input2, destinationTsgId, options = {}) {
+  const backup = RuntimeProfilesBackupSchema.parse(input2);
   if (!destinationTsgId) throw new Error("Destination TSG ID is required");
   const maxPages2 = options.maxPages ?? 100;
   pagesLimit(maxPages2);
@@ -10109,15 +10112,15 @@ function registerProfileTransferCommands(profiles2) {
       const info = await stat(path3);
       if (!info.isFile() || info.size > MAX_BACKUP_BYTES)
         throw new CliUsageError("Backup must be a regular file no larger than 20 MiB");
-      let input;
+      let input2;
       try {
         const text2 = await readFile9(path3, "utf8");
         if (Buffer.byteLength(text2) > MAX_BACKUP_BYTES) throw new Error("Backup too large");
-        input = extension === ".json" ? JSON.parse(text2) : load2(text2, { schema: JSON_SCHEMA });
+        input2 = extension === ".json" ? JSON.parse(text2) : load2(text2, { schema: JSON_SCHEMA });
       } catch {
         throw new CliUsageError("Backup is not valid JSON/YAML; contents are not logged");
       }
-      const data = RuntimeProfilesBackupSchema.parse(input);
+      const data = RuntimeProfilesBackupSchema.parse(input2);
       const format = await resolveOutput(restore, opts);
       const { api, tsgId } = await context();
       if (opts.expectTsg && opts.expectTsg !== tsgId)
@@ -10608,26 +10611,26 @@ function registerRuntimeReportCommand(runtime) {
 }
 
 // src/cli/commands/topics-apply.ts
-async function applyTopicToProfile(mgmt, input) {
+async function applyTopicToProfile(mgmt, input2) {
   const allTopics = await mgmt.listTopics();
-  const match = allTopics.find((t) => t.topic_name === input.topicName);
+  const match = allTopics.find((t) => t.topic_name === input2.topicName);
   if (!match || !match.topic_id) {
-    throw new Error(`Topic "${input.topicName}" not found. Create it first with "topics create".`);
+    throw new Error(`Topic "${input2.topicName}" not found. Create it first with "topics create".`);
   }
-  const existing = await mgmt.getProfileTopics(input.profileName);
-  const merged = existing.filter((t) => t.topicName !== input.topicName).map((t) => ({ topicId: t.topicId, topicName: t.topicName, action: t.action }));
+  const existing = await mgmt.getProfileTopics(input2.profileName);
+  const merged = existing.filter((t) => t.topicName !== input2.topicName).map((t) => ({ topicId: t.topicId, topicName: t.topicName, action: t.action }));
   merged.push({
     topicId: match.topic_id,
     topicName: match.topic_name,
-    action: input.intent
+    action: input2.intent
   });
-  const guardrailAction = input.intent === "block" ? "allow" : "block";
-  await mgmt.assignTopicsToProfile(input.profileName, merged, guardrailAction);
+  const guardrailAction = input2.intent === "block" ? "allow" : "block";
+  await mgmt.assignTopicsToProfile(input2.profileName, merged, guardrailAction);
   return {
     topicId: match.topic_id,
     topicName: match.topic_name,
-    profileName: input.profileName,
-    intent: input.intent
+    profileName: input2.profileName,
+    intent: input2.intent
   };
 }
 function registerApplyCommand(parent) {
@@ -10672,21 +10675,21 @@ function registerApplyCommand(parent) {
 }
 
 // src/cli/commands/topics-create.ts
-async function createOrUpdateTopic(mgmt, input) {
-  const topic = { name: input.name, description: input.description, examples: input.examples };
+async function createOrUpdateTopic(mgmt, input2) {
+  const topic = { name: input2.name, description: input2.description, examples: input2.examples };
   const errors = validateTopic(topic);
   if (errors.length > 0) {
     throw new Error(errors.map((e) => `${e.field}: ${e.message}`).join("; "));
   }
   const existing = await mgmt.listTopics();
-  const match = existing.find((t) => t.topic_name === input.name);
+  const match = existing.find((t) => t.topic_name === input2.name);
   const request = {
-    topic_name: input.name,
-    description: input.description,
-    examples: input.examples
+    topic_name: input2.name,
+    description: input2.description,
+    examples: input2.examples
   };
   if (match && !match.topic_id) {
-    throw new Error(`Existing topic '${input.name}' has no topic_id`);
+    throw new Error(`Existing topic '${input2.name}' has no topic_id`);
   }
   const result = match ? await mgmt.updateTopic(match.topic_id, request) : await mgmt.createTopic(request);
   if (!result.topic_id) {
@@ -11843,7 +11846,139 @@ function registerRuntimeCommand(program) {
   registerDlpCommands(runtime);
 }
 
+// src/config/tenant-settings.ts
+import { randomUUID as randomUUID10 } from "crypto";
+import { constants } from "fs";
+import { access, lstat as lstat6, mkdir as mkdir3, open as open2, rename as rename2, unlink as unlink2 } from "fs/promises";
+import { dirname as dirname4, join as join4 } from "path";
+var TENANT_CONFIG_KEYS = Object.keys(ConfigSchema.shape);
+function validateTenantSettingKey(key) {
+  if (!Object.hasOwn(ConfigSchema.shape, key))
+    throw new Error(`Unknown configuration key. Supported keys: ${TENANT_CONFIG_KEYS.join(", ")}`);
+}
+function isTenantSecret(key) {
+  return /(?:key|secret|token|password)$/i.test(key);
+}
+function validateCredentials(config) {
+  for (const key of ["mgmtTsgId", "mgmtClientId", "mgmtClientSecret"]) {
+    if (typeof config[key] !== "string" || !config[key].trim())
+      throw new Error(
+        "Tenant config requires nonempty mgmtTsgId, mgmtClientId and mgmtClientSecret"
+      );
+  }
+}
+async function createManagedTenant(name, config) {
+  validateTenantName(name);
+  for (const key of Object.keys(config)) validateTenantSettingKey(key);
+  const parsed = ConfigSchema.safeParse(config);
+  if (!parsed.success) throw new Error("Invalid tenant configuration");
+  validateCredentials(config);
+  if (readTenantStore().tenants.some((entry) => entry.name === name))
+    throw new Error("Tenant name already exists");
+  const directory = join4(dirname4(tenantStorePath()), "configs");
+  await mkdir3(directory, { recursive: true, mode: 448 });
+  const path3 = join4(directory, `${name}-${randomUUID10()}.json`);
+  const file = await open2(path3, "wx", 384);
+  try {
+    const data = Object.fromEntries(
+      Object.keys(config).map((key) => [key, Reflect.get(parsed.data, key)])
+    );
+    await file.writeFile(`${JSON.stringify(data, null, 2)}
+`);
+    await file.sync();
+    await file.close();
+    return await createTenant(name, path3);
+  } catch {
+    await file.close();
+    await unlink2(path3);
+    throw new Error("Could not create tenant configuration; registration was not completed");
+  }
+}
+async function setTenantSetting(name, key, value) {
+  validateTenantSettingKey(key);
+  const entry = readTenantStore().tenants.find((tenant) => tenant.name === name);
+  if (!entry) throw new Error("Tenant not found; register a named tenant first");
+  if (key === "mgmtTsgId" && value !== entry.tsgId)
+    throw new Error("TSG identity is pinned; create another tenant instead of changing mgmtTsgId");
+  const path3 = entry.configPath;
+  const lockPath = `${path3}.lock`;
+  const lock = await open2(lockPath, "wx", 384).catch(() => {
+    throw new Error(
+      "Cannot lock tenant config; it may be read-only or another edit is in progress"
+    );
+  });
+  const temporary = join4(dirname4(path3), `.airs-config-${randomUUID10()}.tmp`);
+  let created = false;
+  try {
+    const stat2 = await lstat6(path3);
+    if (!stat2.isFile() || (stat2.mode & 146) === 0)
+      throw new Error("Tenant config is not a writable regular file");
+    await access(path3, constants.W_OK);
+    const current = readTenantConfigFile(path3, entry.tsgId);
+    const result = ConfigSchema.safeParse({ ...current, [key]: value });
+    if (!result.success) throw new Error("Invalid value for configuration setting");
+    const next = { ...current, [key]: Reflect.get(result.data, key) };
+    validateCredentials(next);
+    const file = await open2(temporary, "wx", 384);
+    created = true;
+    try {
+      await file.writeFile(`${JSON.stringify(next, null, 2)}
+`);
+      await file.sync();
+    } finally {
+      await file.close();
+    }
+    await rename2(temporary, path3);
+    created = false;
+  } finally {
+    if (created) await unlink2(temporary).catch(() => {
+    });
+    await lock.close();
+    await unlink2(lockPath);
+  }
+}
+
+// src/cli/tenant-input.ts
+import { input, password } from "@inquirer/prompts";
+async function promptTenantValue(message, secret = false) {
+  if (!process.stdin.isTTY || !process.stderr.isTTY)
+    throw new Error(
+      "Interactive setup requires a terminal. Use --config, or --tsg-id and --client-id with --client-secret-stdin. For tenant set, pass a value or use --stdin."
+    );
+  const prompt = secret ? password : input;
+  return prompt(
+    {
+      message,
+      validate: (value) => Boolean(value.trim()) || "A nonempty value is required"
+    },
+    { input: process.stdin, output: process.stderr }
+  );
+}
+async function readTenantStdin() {
+  if (process.stdin.isTTY) throw new Error("--stdin requires piped input");
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    const buffer = Buffer.from(chunk);
+    size += buffer.length;
+    if (size > 65536) throw new Error("Configuration input exceeds 64 KiB");
+    chunks.push(buffer);
+  }
+  const value = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  if (!value.trim() || /[\r\n\0]/.test(value))
+    throw new Error("Provide one nonempty configuration value on stdin");
+  return value;
+}
+
 // src/cli/commands/tenant.ts
+function tenantInputFailure(error) {
+  if (error instanceof Error && error.name === "ExitPromptError") {
+    ui.status("Cancelled; no configuration saved.");
+    process.exitCode = 130;
+    return;
+  }
+  fail(error);
+}
 var COLUMNS2 = [
   { key: "name", label: "Tenant" },
   { key: "active", label: "Selected" },
@@ -11851,25 +11986,60 @@ var COLUMNS2 = [
   { key: "configPath", label: "Config file" }
 ];
 function registerTenantCommand(program) {
-  const tenant = program.command("tenant").description("Select named tenant config files without changing their contents").addHelpText(
+  const tenant = program.command("tenant").description("Create, configure and select named tenants").addHelpText(
     "after",
     examples(
+      "airs tenant create development",
+      "airs tenant set development defaultOutput yaml",
       "airs tenant create production --config /secure/production.json",
       "airs tenant switch production",
       "airs tenant read",
       "airs tenant switch default"
     )
   );
-  tenant.command("create <name>").description("Register an existing JSON config file by reference; does not activate it").requiredOption("--config <path>", "Existing Prisma AIRS JSON config file").action(async (name, opts) => {
-    try {
-      const entry = await createTenant(name, opts.config);
-      ui.success(
-        `Registered ${entry.name} (TSG ${entry.tsgId}); config file unchanged. Use airs tenant switch ${entry.name}.`
-      );
-    } catch (error) {
-      fail(error);
+  tenant.command("create <name>").description(
+    "Create a config with guided prompts, or register an existing JSON file; does not activate it"
+  ).option("--config <path>", "Existing Prisma AIRS JSON config file (no copying or editing)").option("--tsg-id <id>", "Tenant service group ID for a new config").option("--client-id <id>", "OAuth client ID for a new config").option("--client-secret-stdin", "Read the new config OAuth secret from piped stdin").action(
+    async (name, opts) => {
+      try {
+        validateTenantName(name);
+        if (opts.config && (opts.tsgId !== void 0 || opts.clientId !== void 0 || opts.clientSecretStdin))
+          throw new Error("--config cannot be combined with new-config options");
+        if (!opts.config && readTenantStore().tenants.some((entry2) => entry2.name === name))
+          throw new Error("Tenant name already exists");
+        const entry = opts.config ? await createTenant(name, opts.config) : await createManagedTenant(name, {
+          mgmtTsgId: opts.tsgId ?? await promptTenantValue("Tenant service group ID (mgmtTsgId):"),
+          mgmtClientId: opts.clientId ?? await promptTenantValue("OAuth client ID (mgmtClientId):"),
+          mgmtClientSecret: opts.clientSecretStdin ? await readTenantStdin() : await promptTenantValue("OAuth client secret (mgmtClientSecret):", true)
+        });
+        ui.success(
+          `Registered ${entry.name} (TSG ${entry.tsgId}); ${opts.config ? "config file unchanged" : "private config created"}. Use airs tenant switch ${entry.name}.`
+        );
+      } catch (error) {
+        tenantInputFailure(error);
+      }
     }
-  });
+  );
+  tenant.command("set <name> <key> [value]").description("Update one named tenant setting; prompt when omitted, hide secrets").option("--stdin", "Read one value from piped stdin (recommended for automated secret updates)").action(
+    async (name, key, value, opts) => {
+      try {
+        validateTenantSettingKey(key);
+        if (!readTenantStore().tenants.some((entry) => entry.name === name))
+          throw new Error("Tenant not found; register a named tenant first");
+        if (opts.stdin && value !== void 0)
+          throw new Error("Use a value or --stdin, not both");
+        if (isTenantSecret(key) && value !== void 0)
+          throw new Error(
+            "Do not pass credentials as arguments. Omit the value for a hidden prompt, or use --stdin."
+          );
+        const setting = opts.stdin ? await readTenantStdin() : value ?? await promptTenantValue(`${key}:`, isTenantSecret(key));
+        await setTenantSetting(name, key, setting);
+        ui.success(`Updated ${key} for tenant ${name}; selection unchanged.`);
+      } catch (error) {
+        tenantInputFailure(error);
+      }
+    }
+  );
   tenant.command("switch <name>").description(
     "Persist the selected tenant; default restores legacy config/environment resolution"
   ).action(async (name) => {
@@ -12005,8 +12175,8 @@ function applySortedHelp(cmd) {
   for (const sub of cmd.commands) applySortedHelp(sub);
 }
 function buildProgram() {
-  const here = dirname4(fileURLToPath(import.meta.url));
-  const pkg = JSON.parse(readFileSync4(join4(here, "../../package.json"), "utf-8"));
+  const here = dirname5(fileURLToPath(import.meta.url));
+  const pkg = JSON.parse(readFileSync4(join5(here, "../../package.json"), "utf-8"));
   const program = new Command();
   program.name("airs").description(
     "CLI and library for Palo Alto Prisma AIRS \u2014 guardrail refinement, AI red teaming, model security scanning, profile audits"
@@ -12035,9 +12205,9 @@ function buildProgram() {
       }
     }
     if (root.debug) {
-      const logPath = join4(
+      const logPath = join5(
         process.cwd(),
-        `debug-api-${Date.now()}-${randomUUID10().slice(0, 8)}.jsonl`
+        `debug-api-${Date.now()}-${randomUUID11().slice(0, 8)}.jsonl`
       );
       try {
         let ancestor = actionCommand;

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   validateTopic,
   writeBackupFile,
   writeReportFile
-} from "./chunk-NKAVUBKI.js";
+} from "./chunk-XQOICLSH.js";
 export {
   AirsScanService,
   SDK_ASYNC_BATCH_SIZE,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",