@cdot65/prisma-airs-cli 6.0.0 → 6.1.0

package/dist/cli/index.js

@@ -3713,6 +3713,7 @@ function registerAiGatewayInference(parent) {
 }
 
 // src/cli/commands/aigateway/inventory.ts
+import { readFile as readFile3 } from "fs/promises";
 import {
   AI_GATEWAY_DEPLOYMENT_STATUSES,
   AI_GATEWAY_DEPLOYMENT_TYPES,
@@ -3720,6 +3721,7 @@ import {
   AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
   AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
   AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
+  customHostConfiguration,
   GatewayApiKeyRotateRequestSchema,
   GatewayApiKeyUpdateRequestSchema,
   GatewayConfigCreateRequestSchema,
@@ -3915,6 +3917,38 @@ function installDebugLogger(logPath, options = {}) {
   };
 }
 
+// src/cli/tenant-input.ts
+import { input, password } from "@inquirer/prompts";
+async function promptTenantValue(message, secret = false) {
+  if (!process.stdin.isTTY || !process.stderr.isTTY)
+    throw new Error(
+      "Interactive setup requires a terminal. Use --config, or --tsg-id and --client-id with --client-secret-stdin. For tenant set, pass a value or use --stdin."
+    );
+  const prompt = secret ? password : input;
+  return prompt(
+    {
+      message,
+      validate: (value) => Boolean(value.trim()) || "A nonempty value is required"
+    },
+    { input: process.stdin, output: process.stderr }
+  );
+}
+async function readTenantStdin() {
+  if (process.stdin.isTTY) throw new Error("--stdin requires piped input");
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    const buffer = Buffer.from(chunk);
+    size += buffer.length;
+    if (size > 65536) throw new Error("Configuration input exceeds 64 KiB");
+    chunks.push(buffer);
+  }
+  const value = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  if (!value.trim() || /[\r\n\0]/.test(value))
+    throw new Error("Provide one nonempty configuration value on stdin");
+  return value;
+}
+
 // src/cli/commands/aigateway/shared.ts
 import { open, readFile as readFile2, unlink } from "fs/promises";
 import { AIGatewayClient as AIGatewayClient2 } from "@cdot65/prisma-airs-sdk";
@@ -4663,13 +4697,33 @@ function registerIntegrations(root) {
     { option: "name", path: "name" },
     { option: "organisationId", path: "organisation_id" },
     { option: "secretMappings", path: "secret_mappings", parse: parseJsonOption },
-    { option: "slug", path: "slug" }
+    { option: "slug", path: "slug" },
+    // Derived by prepareIntegrationOptions() from --base-url / --header.
+    { option: "providerAuthType", path: "configurations.provider_auth_type" },
+    { option: "customHost", path: "configurations.custom_host" },
+    { option: "customHeaders", path: "configurations.custom_headers", parse: parseStringMapOption }
   ];
-  const addIntegrationFields = (command) => command.option("--ai-provider-id <uuid>", "Provider catalog UUID").option("--configurations <json>", "Provider configuration object").option("--description <text>", "Integration description").option("--key <credential>", "Inline provider credential (prefer secret mappings)").option("--name <name>", "Integration name").option("--organisation-id <tsg>", "Numeric TSG id").option("--secret-mappings <json>", "Secret reference mapping array").option("--slug <slug>", "Stable integration slug");
+  const addIntegrationSharedFields = (command) => command.option(
+    "--base-url <url>",
+    "Self-hosted or OpenAI-compatible endpoint (configurations.custom_host)"
+  ).option("--configurations <json>", "Provider configuration object").option("--description <text>", "Integration description").option(
+    "--header <name=value>",
+    "Extra header sent to the custom host (repeatable)",
+    collectOption
+  ).option("--key <credential>", "Inline provider credential (visible in shell history)").option("--key-file <path>", "Read the provider credential from a file").option("--key-stdin", "Read the provider credential from piped stdin").option("--name <name>", "Integration name").option("--secret-mappings <json>", "Secret reference mapping array");
+  const addIntegrationFields = (command) => addIntegrationSharedFields(command).option(
+    "--ai-provider <slug-or-uuid>",
+    "Provider catalog slug (see 'integrations providers') or UUID"
+  ).option("--ai-provider-id <uuid>", "Provider catalog UUID").option("--organisation-id <tsg>", "Numeric TSG id").option("--slug <slug>", "Stable integration slug");
   const integrationUpdateFields = integrationFields.filter(
-    (field) => ["configurations", "description", "key", "name", "secretMappings"].includes(field.option)
+    (field) => !["aiProviderId", "organisationId", "slug"].includes(field.option)
+  );
+  const providers = addReadOutput(
+    group.command("providers").description("List the provider catalog: the slug or UUID that --ai-provider accepts")
+  );
+  providers.action(
+    (opts) => runList(providers, opts, "catalog providers", (client) => client.integrations.catalog())
   );
-  const addIntegrationUpdateFields = (command) => command.option("--configurations <json>", "Provider configuration object").option("--description <text>", "Integration description").option("--key <credential>", "Inline provider credential (prefer secret mappings)").option("--name <name>", "Integration name").option("--secret-mappings <json>", "Secret reference mapping array");
   const create = addWriteOutput(
     addStructuredInputOptions(
       addIntegrationFields(
@@ -4678,31 +4732,38 @@ function registerIntegrations(root) {
     )
   );
   create.action(
-    (opts) => runWrite(
-      create,
-      opts,
-      () => buildStructuredRequest(opts, GatewayIntegrationCreateRequestSchema, integrationFields),
-      (client, body) => client.integrations.create(body)
-    )
+    (opts) => runWrite(create, opts, async (client) => {
+      const prepared = await prepareIntegrationOptions(opts, client);
+      const body = await buildStructuredRequest(
+        prepared,
+        GatewayIntegrationCreateRequestSchema,
+        integrationFields
+      );
+      if (!body.key && !(Array.isArray(body.secret_mappings) && body.secret_mappings.length)) {
+        throw new CliUsageError(
+          "A provider credential is required: pass --key-stdin, --key-file, --secret-mappings, or --key (the gateway rejects a credential-less integration with a generic AB01)"
+        );
+      }
+      return client.integrations.create(body);
+    })
   );
   const update = addWriteOutput(
     addStructuredInputOptions(
-      addIntegrationUpdateFields(
+      addIntegrationSharedFields(
         group.command("update <id>").description("Update an integration with structured flags")
       )
     )
   );
   update.action(
-    (id, opts) => runWrite(
-      update,
-      opts,
-      () => buildStructuredRequest(
-        opts,
+    (id, opts) => runWrite(update, opts, async (client) => {
+      const prepared = await prepareIntegrationOptions(opts, client);
+      const body = await buildStructuredRequest(
+        prepared,
         GatewayIntegrationUpdateRequestSchema,
         integrationUpdateFields
-      ),
-      (client, body) => client.integrations.update(id, body)
-    )
+      );
+      return client.integrations.update(id, body);
+    })
   );
   const remove = addWriteOutput(
     group.command("delete <id>").description("Permanently delete this integration").requiredOption("--organisation-id <tsg>", "Numeric TSG id").option("--force", "Skip confirmation prompt")
@@ -5032,6 +5093,61 @@ function registerPlugins(root) {
     )
   );
 }
+async function prepareIntegrationOptions(opts, client) {
+  const sources = [opts.key !== void 0, Boolean(opts.keyStdin), opts.keyFile !== void 0];
+  if (sources.filter(Boolean).length > 1) {
+    throw new CliUsageError("Use only one of --key, --key-stdin, or --key-file");
+  }
+  const prepared = { ...opts };
+  delete prepared.keyStdin;
+  delete prepared.keyFile;
+  delete prepared.baseUrl;
+  delete prepared.header;
+  delete prepared.aiProvider;
+  if (opts.keyStdin) {
+    try {
+      prepared.key = await readTenantStdin();
+    } catch {
+      throw new CliUsageError("--key-stdin requires one nonempty credential on piped stdin");
+    }
+  } else if (opts.keyFile !== void 0) {
+    let raw;
+    try {
+      raw = await readFile3(opts.keyFile, "utf8");
+    } catch {
+      throw new CliUsageError(`Cannot read --key-file ${opts.keyFile}`);
+    }
+    const value = raw.replace(/\r?\n$/, "");
+    if (!value.trim() || /[\r\n\0]/.test(value)) {
+      throw new CliUsageError("--key-file must contain exactly one nonempty credential");
+    }
+    prepared.key = value;
+  } else if (opts.key !== void 0) {
+    ui.warning(
+      "Inline --key is visible in shell history and process listings; prefer --key-stdin, --key-file, or --secret-mappings"
+    );
+  }
+  if (opts.aiProvider !== void 0 && opts.aiProviderId !== void 0) {
+    throw new CliUsageError("Use --ai-provider or --ai-provider-id, not both");
+  }
+  if (opts.aiProvider !== void 0) {
+    prepared.aiProviderId = await client.integrations.resolveProviderId(opts.aiProvider);
+  }
+  if (opts.baseUrl !== void 0) {
+    let configuration;
+    try {
+      configuration = customHostConfiguration({ host: opts.baseUrl });
+    } catch (error) {
+      throw new CliUsageError(
+        `Invalid --base-url: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    prepared.providerAuthType = configuration.provider_auth_type;
+    prepared.customHost = configuration.custom_host;
+  }
+  if (opts.header?.length) prepared.customHeaders = opts.header;
+  return prepared;
+}
 function registerAiGatewayInventory(root) {
   registerApiKeys(root);
   registerAuditLogs(root);
@@ -5875,7 +5991,7 @@ function registerCompletionCommand(program) {
 
 // src/cli/commands/doctor.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile4 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
 
 // src/config/env.ts
@@ -5979,7 +6095,7 @@ async function checkConfigFile(context3) {
   const { path: path3 } = context3;
   let raw;
   try {
-    raw = await readFile3(path3, "utf-8");
+    raw = await readFile4(path3, "utf-8");
   } catch {
     return {
       name,
@@ -8316,7 +8432,7 @@ function registerRedteamCommand(program) {
 // src/cli/commands/runtime.ts
 import { randomUUID as randomUUID10 } from "crypto";
 import * as fs5 from "fs";
-import { readFile as readFile11 } from "fs/promises";
+import { readFile as readFile12 } from "fs/promises";
 import { basename as basename3, dirname as dirname2, join as join3, resolve as resolvePath } from "path";
 import chalk11 from "chalk";
 
@@ -8995,7 +9111,7 @@ var topicsView = {
 };
 
 // src/cli/commands/dlp/dictionaries.ts
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 import { basename as basename2 } from "path";
 import { AISecSDKException as AISecSDKException2, ErrorType as ErrorType3 } from "@cdot65/prisma-airs-sdk";
 
@@ -9040,7 +9156,7 @@ async function loadDlpClientOptions() {
 }
 
 // src/cli/commands/dlp/patch.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 function buildMergePatch(opts) {
   const out = {};
   for (const entry of opts.set ?? []) {
@@ -9082,7 +9198,7 @@ function coerceValue(raw) {
 async function parseBody(opts) {
   let raw;
   if (opts.bodyFile) {
-    raw = await readFile6(opts.bodyFile, "utf-8");
+    raw = await readFile7(opts.bodyFile, "utf-8");
   } else if (opts.body === "-") {
     const chunks = [];
     for await (const chunk of opts.stdin ?? process.stdin) {
@@ -9113,7 +9229,7 @@ function visibleRecords(records, includePredefined) {
 
 // src/cli/commands/dlp/dictionaries.ts
 async function readMetadata(path3) {
-  const raw = await readFile7(path3, "utf-8");
+  const raw = await readFile8(path3, "utf-8");
   let value;
   try {
     value = JSON.parse(raw);
@@ -9190,7 +9306,7 @@ function register(dlp) {
       const format = await resolveOutput(command, opts);
       const metadata = await buildMetadata(opts);
       if (!opts.file) throw new CliUsageError("--file is required (multipart upload)");
-      const file = await readFile7(opts.file);
+      const file = await readFile8(opts.file);
       const r = await new SdkDictionariesService(await loadDlpClientOptions()).create({
         metadata,
         file,
@@ -9221,7 +9337,7 @@ function register(dlp) {
       const metadata = await buildMetadata(opts);
       const format = await resolveOutput(command, opts);
       if (!opts.file) throw new CliUsageError("--file is required (multipart upload)");
-      const file = await readFile7(opts.file);
+      const file = await readFile8(opts.file);
       const r = await new SdkDictionariesService(await loadDlpClientOptions()).replace(id, {
         metadata,
         file,
@@ -9949,7 +10065,7 @@ function register5(dlp) {
 
 // src/cli/commands/dlp/transfer.ts
 import { randomUUID as randomUUID7 } from "crypto";
-import { readFile as readFile8, stat } from "fs/promises";
+import { readFile as readFile9, stat } from "fs/promises";
 import { extname, resolve as resolve5 } from "path";
 import { AISecSDKException as AISecSDKException4, ManagementClient } from "@cdot65/prisma-airs-sdk";
 import { dump as dump6, JSON_SCHEMA, load as load2 } from "js-yaml";
@@ -11256,7 +11372,7 @@ function register6(dlp) {
         throw new CliUsageError("Backup must be a regular file no larger than 20 MiB");
       let input2;
       try {
-        const text2 = await readFile8(path3, "utf8");
+        const text2 = await readFile9(path3, "utf8");
         if (Buffer.byteLength(text2) > MAX_BACKUP_BYTES) throw new Error("Backup too large");
         input2 = extension === ".json" ? JSON.parse(text2) : load2(text2, { schema: JSON_SCHEMA });
       } catch {
@@ -11348,7 +11464,7 @@ function registerDlpCommands(runtime) {
 
 // src/cli/commands/profile-transfer.ts
 import { randomUUID as randomUUID8 } from "crypto";
-import { readFile as readFile9, stat as stat2 } from "fs/promises";
+import { readFile as readFile10, stat as stat2 } from "fs/promises";
 import { extname as extname2, resolve as resolve6 } from "path";
 import { AISecSDKException as AISecSDKException5, ManagementClient as ManagementClient2 } from "@cdot65/prisma-airs-sdk";
 import { dump as dump7, JSON_SCHEMA as JSON_SCHEMA2, load as load3 } from "js-yaml";
@@ -12193,7 +12309,7 @@ function registerProfileTransferCommands(profiles2) {
         throw new CliUsageError("Backup must be a regular file no larger than 20 MiB");
       let input2;
       try {
-        const text2 = await readFile9(path3, "utf8");
+        const text2 = await readFile10(path3, "utf8");
         if (Buffer.byteLength(text2) > MAX_BACKUP_BYTES2) throw new Error("Backup too large");
         input2 = extension === ".json" ? JSON.parse(text2) : load3(text2, { schema: JSON_SCHEMA2 });
       } catch {
@@ -12837,7 +12953,7 @@ function registerCreateCommand(parent) {
 }
 
 // src/cli/commands/topics-eval.ts
-import { readFile as readFile10 } from "fs/promises";
+import { readFile as readFile11 } from "fs/promises";
 
 // src/core/prompt-loader.ts
 function parseCsvLine(line) {
@@ -12980,7 +13096,7 @@ function registerEvalCommand(parent) {
     resolveDeprecatedAliases(cmd, opts);
     try {
       const config = await loadConfig();
-      const csvContent = await readFile10(opts.prompts, "utf-8");
+      const csvContent = await readFile11(opts.prompts, "utf-8");
       const { cases, intent } = loadPrompts(csvContent, (msg) => ui.status(`Warning: ${msg}`));
       assertScannerCredentials(config);
       let scanner = new AirsScanService(runtimeInitOptions(config));
@@ -13275,7 +13391,7 @@ function registerRuntimeCommand(program) {
     try {
       const config = await loadConfig({});
       assertScannerCredentials(config);
-      const raw = await readFile11(opts.file, "utf-8");
+      const raw = await readFile12(opts.file, "utf-8");
       const prompts = parseInputFile(raw, opts.file);
       if (prompts.length === 0) {
         usageError("No prompts found in input file");
@@ -14045,38 +14161,6 @@ async function rewriteTenantConfig(entry, change) {
   }
 }
 
-// src/cli/tenant-input.ts
-import { input, password } from "@inquirer/prompts";
-async function promptTenantValue(message, secret = false) {
-  if (!process.stdin.isTTY || !process.stderr.isTTY)
-    throw new Error(
-      "Interactive setup requires a terminal. Use --config, or --tsg-id and --client-id with --client-secret-stdin. For tenant set, pass a value or use --stdin."
-    );
-  const prompt = secret ? password : input;
-  return prompt(
-    {
-      message,
-      validate: (value) => Boolean(value.trim()) || "A nonempty value is required"
-    },
-    { input: process.stdin, output: process.stderr }
-  );
-}
-async function readTenantStdin() {
-  if (process.stdin.isTTY) throw new Error("--stdin requires piped input");
-  const chunks = [];
-  let size = 0;
-  for await (const chunk of process.stdin) {
-    const buffer = Buffer.from(chunk);
-    size += buffer.length;
-    if (size > 65536) throw new Error("Configuration input exceeds 64 KiB");
-    chunks.push(buffer);
-  }
-  const value = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
-  if (!value.trim() || /[\r\n\0]/.test(value))
-    throw new Error("Provide one nonempty configuration value on stdin");
-  return value;
-}
-
 // src/cli/commands/tenant.ts
 function tenantInputFailure(error) {
   if (error instanceof Error && error.name === "ExitPromptError") {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",
@@ -59,7 +59,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@cdot65/prisma-airs-sdk": "0.32.0",
+    "@cdot65/prisma-airs-sdk": "0.33.0",
     "@inquirer/prompts": "^8.3.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",