@cdot65/prisma-airs-cli 7.1.4 → 7.2.0

package/dist/cli/index.js

@@ -3562,409 +3562,18 @@ ${lines.map((l) => `  $ ${commandHint(l)}`).join("\n")}
 `;
 }
 
-// src/cli/commands/aigateway/inference.ts
-import { readFile } from "fs/promises";
-import {
-  AIGatewayInferenceClient,
-  ErrorType,
-  GatewayInferenceInputCreateChatCompletionRequestSchema,
-  GatewayInferenceInputCreateEmbeddingRequestSchema,
-  GatewayInferenceInputCreateResponseSchema
-} from "@cdot65/prisma-airs-sdk";
-import { dump as dump4 } from "js-yaml";
-function integer2(raw, flag) {
-  const value = Number(raw);
-  if (!Number.isSafeInteger(value) || value < 1)
-    throw new CliUsageError(`${flag} must be a positive integer`);
-  return value;
-}
-async function inferenceBody(kind, prompt, opts, defaultModel) {
-  if (prompt !== void 0 && opts.file)
-    throw new CliUsageError("Pass a prompt or --file, not both");
-  if (prompt === void 0 && !opts.file) throw new CliUsageError("A prompt or --file is required");
-  let body;
-  if (opts.file) {
-    let value;
-    try {
-      value = JSON.parse(await readFile(opts.file, "utf8"));
-    } catch {
-      throw new CliUsageError("--file must name a readable JSON request file");
-    }
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      throw new CliUsageError("--file must contain a JSON object");
-    body = value;
-  } else {
-    body = kind === "chat" ? { messages: [{ role: "user", content: prompt }] } : { input: prompt };
-  }
-  body = { ...body };
-  const model = opts.model ?? body.model ?? defaultModel;
-  if (typeof model !== "string" || !model.trim())
-    throw new CliUsageError(
-      "Set --model, the request model, or the matching inference model config"
-    );
-  body.model = model;
-  if (opts.stream !== void 0) body.stream = opts.stream;
-  if (opts.maxTokens !== void 0)
-    body[kind === "responses" ? "max_output_tokens" : "max_completion_tokens"] = integer2(
-      opts.maxTokens,
-      "--max-tokens"
-    );
-  if (opts.dimensions !== void 0) body.dimensions = integer2(opts.dimensions, "--dimensions");
-  if (opts.encoding !== void 0) body.encoding_format = opts.encoding;
-  if (kind === "responses" && body.store === void 0) body.store = false;
-  return body;
-}
-function responseText(value) {
-  if (!value || typeof value !== "object") return "";
-  const record = value;
-  if (record.type === "response.output_text.delta" && typeof record.delta === "string")
-    return record.delta;
-  if (Array.isArray(record.choices))
-    return record.choices.map((choice) => choice.message?.content ?? choice.delta?.content ?? "").join("");
-  if (Array.isArray(record.output))
-    return record.output.flatMap((item) => Array.isArray(item.content) ? item.content : []).filter((part) => part.type === "output_text").map((part) => part.text).join("");
-  return "";
-}
-function registerAiGatewayInference(parent) {
-  const group = parent.command("inference").description("Call the gateway runtime (separate API key; no SCM OAuth required)");
-  for (const kind of ["chat", "responses", "embeddings"]) {
-    const command = group.command(`${kind} [prompt]`).description(
-      `${kind === "embeddings" ? "Create embeddings" : "Generate a model response"} through your runtime gateway`
-    ).option("--model <id>", "Provider-prefixed model ID; overrides request file and config").option("--endpoint <url>", "Runtime base URL including /v1; overrides config").option("--file <path>", "JSON request file (mutually exclusive with prompt)").option("--timeout <ms>", "Total deadline including streaming, in milliseconds", "60000").option(
-      "--output <format>",
-      "pretty, json or yaml; streaming json emits one chunk per line (JSONL)"
-    );
-    if (kind === "embeddings")
-      command.option("--dimensions <n>", "Embedding dimensions").option("--encoding <format>", "float or base64");
-    else
-      command.option("--stream", "Stream text (pretty) or validated events (json/JSONL)").option("--max-tokens <n>", "Maximum completion/output tokens");
-    command.action(async (prompt, opts) => {
-      const controller = new AbortController();
-      const interrupt = () => controller.abort(new Error("Inference interrupted"));
-      const outputError = (error) => controller.abort(error);
-      let stream;
-      let failed = false;
-      let failure3;
-      try {
-        const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
-        const config = await loadConfig({ aiGwInferenceEndpoint: opts.endpoint });
-        const body = await inferenceBody(
-          kind,
-          prompt,
-          opts,
-          kind === "embeddings" ? config.aiGwEmbeddingModel : config.aiGwInferenceModel
-        );
-        if (body.stream === true && format === "yaml")
-          throw new CliUsageError("Streaming supports --output pretty or json (JSONL), not yaml");
-        const schema = kind === "chat" ? GatewayInferenceInputCreateChatCompletionRequestSchema : kind === "responses" ? GatewayInferenceInputCreateResponseSchema : GatewayInferenceInputCreateEmbeddingRequestSchema;
-        const parsed = schema.safeParse(body);
-        if (!parsed.success)
-          throw new CliUsageError(
-            `Invalid inference request: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.code}`).join("; ")}`
-          );
-        const client = new AIGatewayInferenceClient({
-          endpoint: config.aiGwInferenceEndpoint,
-          apiKey: config.aiGwInferenceApiKey,
-          timeoutMs: integer2(opts.timeout ?? "60000", "--timeout"),
-          numRetries: 0
-        });
-        process.once("SIGINT", interrupt);
-        process.once("SIGTERM", interrupt);
-        process.stdout.on("error", outputError);
-        const write = (text2) => new Promise((resolve10, reject) => {
-          process.stdout.write(text2, (error) => error ? reject(error) : resolve10());
-        });
-        const requestOptions = { signal: controller.signal };
-        const result = kind === "chat" ? await client.createChatCompletion(
-          GatewayInferenceInputCreateChatCompletionRequestSchema.parse(body),
-          requestOptions
-        ) : kind === "responses" ? await client.createResponse(
-          GatewayInferenceInputCreateResponseSchema.parse(body),
-          requestOptions
-        ) : await client.createEmbedding(
-          GatewayInferenceInputCreateEmbeddingRequestSchema.parse(body),
-          requestOptions
-        );
-        if (Symbol.asyncIterator in result) {
-          stream = result;
-          for await (const event of result) {
-            if (format === "json") await write(`${JSON.stringify(event)}
-`);
-            else {
-              const text2 = responseText(event);
-              if (text2) await write(text2);
-            }
-            if ("type" in event && (event.type === "response.failed" || event.type === "response.incomplete"))
-              throw new Error(`Gateway generation ended with ${event.type}`);
-          }
-          if (format === "pretty") await write("\n");
-        } else {
-          const text2 = format === "yaml" ? dump4(result, { noRefs: true }).trimEnd() : format === "pretty" && kind !== "embeddings" ? responseText(result) : JSON.stringify(result, null, 2);
-          await write(`${text2}
-`);
-          if ("status" in result && (result.status === "failed" || result.status === "incomplete"))
-            throw new Error(`Gateway generation ended with ${result.status}`);
-        }
-      } catch (error) {
-        failed = true;
-        failure3 = error;
-      } finally {
-        await stream?.cancel();
-        controller.abort();
-        process.removeListener("SIGINT", interrupt);
-        process.removeListener("SIGTERM", interrupt);
-        process.stdout.removeListener("error", outputError);
-      }
-      if (failed && failure3?.code !== "EPIPE") {
-        if (failure3?.errorType === ErrorType.USER_REQUEST_PAYLOAD_ERROR)
-          usageError(failure3 instanceof Error ? failure3.message : "Invalid inference options");
-        fail(failure3);
-      }
-    });
-  }
-}
-
-// src/cli/commands/aigateway/inventory.ts
-import { readFile as readFile3 } from "fs/promises";
-import {
-  AI_GATEWAY_DEPLOYMENT_STATUSES,
-  AI_GATEWAY_DEPLOYMENT_TYPES,
-  AI_GATEWAY_KNOWN_API_KEY_SCOPES,
-  AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
-  AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
-  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
-  customHostConfiguration,
-  GatewayApiKeyRotateRequestSchema,
-  GatewayApiKeyUpdateRequestSchema,
-  GatewayConfigCreateRequestSchema,
-  GatewayConfigUpdateRequestSchema,
-  GatewayDeploymentCreateRequestSchema,
-  GatewayDeploymentUpdateRequestSchema,
-  GatewayGuardrailCreateRequestSchema,
-  GatewayGuardrailUpdateRequestSchema,
-  GatewayIntegrationCreateRequestSchema,
-  GatewayIntegrationModelsBulkUpdateRequestSchema,
-  GatewayIntegrationUpdateRequestSchema,
-  GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
-  GatewayOrganisationAuthSettingsUpdateRequestSchema,
-  GatewayOrganisationUpdateRequestSchema,
-  GatewayPluginCreateRequestSchema,
-  GatewayProviderCreateRequestSchema,
-  GatewayProviderUpdateRequestSchema,
-  GatewayServiceApiKeyCreateRequestSchema,
-  GatewayUserApiKeyCreateRequestSchema,
-  McpIntegrationCapabilitiesBulkUpdateRequestSchema,
-  McpIntegrationCreateRequestSchema,
-  McpIntegrationUpdateRequestSchema,
-  McpIntegrationWorkspacesBulkUpdateRequestSchema,
-  redactAIGatewaySecrets
-} from "@cdot65/prisma-airs-sdk";
-
-// src/cli/debug-logger.ts
-import {
-  appendFileSync,
-  mkdirSync,
-  readdirSync,
-  statSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { dirname, join } from "path";
-var AIRS_DOMAINS = [
-  "api.sase.paloaltonetworks.com",
-  "api.apps.paloaltonetworks.com",
-  "service.api.aisecurity.paloaltonetworks.com",
-  "auth.apps.paloaltonetworks.com",
-  "api.dlp.paloaltonetworks.com"
-];
-function isAirsUrl(url) {
-  try {
-    const parsed = new URL(url);
-    return AIRS_DOMAINS.some((d) => parsed.hostname === d || parsed.hostname.endsWith(`.${d}`));
-  } catch {
-    return false;
-  }
-}
-var MASK = "***";
-var SENSITIVE_KEY_PATTERN = /token|secret|password|passwd|credential|authorization|cookie|api[-_]?key|client[-_]?auth|auth[-_]?code|^key$/i;
-function isSensitiveKey(key) {
-  return SENSITIVE_KEY_PATTERN.test(key);
-}
-function redactHeaders(headers) {
-  const out = {};
-  for (const [k, v] of Object.entries(headers)) {
-    out[k] = isSensitiveKey(k) || /^x-portkey-(config|metadata|forward-headers)$/i.test(k) ? MASK : v;
-  }
-  return out;
-}
-function redactDeep(value) {
-  if (Array.isArray(value)) {
-    return value.map(redactDeep);
-  }
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = isSensitiveKey(k) ? MASK : redactDeep(v);
-    }
-    return out;
-  }
-  return value;
-}
-function redactUrl(url) {
-  try {
-    const parsed = new URL(url);
-    let touched = false;
-    for (const key of parsed.searchParams.keys()) {
-      if (isSensitiveKey(key)) {
-        parsed.searchParams.set(key, MASK);
-        touched = true;
-      }
-    }
-    return touched ? parsed.toString() : url;
-  } catch {
-    return url;
-  }
-}
-function headersToRecord(headers) {
-  if (!headers) return {};
-  if (typeof headers === "object" && "forEach" in headers && typeof headers.forEach === "function") {
-    const out = {};
-    headers.forEach((v, k) => {
-      out[k] = v;
-    });
-    return out;
-  }
-  if (Array.isArray(headers)) {
-    return Object.fromEntries(headers);
-  }
-  return headers;
-}
-function installDebugLogger(logPath, options = {}) {
-  mkdirSync(dirname(logPath), { recursive: true, mode: 448 });
-  writeFileSync(logPath, "", { encoding: "utf8", mode: 384, flag: "wx" });
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = async function debugFetch(input2, init2) {
-    const url = typeof input2 === "string" ? input2 : input2 instanceof URL ? input2.toString() : input2.url;
-    const rawHeaders = headersToRecord(
-      init2?.headers ?? (input2 instanceof Request ? input2.headers : void 0)
-    );
-    const inference = Object.keys(rawHeaders).some(
-      (name) => name.toLowerCase() === "x-portkey-api-key"
-    );
-    if (!isAirsUrl(url) && !inference) {
-      return originalFetch(input2, init2);
-    }
-    const dashboard = options.omitBodies || /\/v1\/mgmt\/(dashboard\/|reports\/scancontent(?:\?|$))/.test(url) || /\/aiag\//.test(new URL(url).pathname);
-    const method = init2?.method ?? (input2 instanceof Request ? input2.method : "GET");
-    const reqHeaders = redactHeaders(rawHeaders);
-    const loggedUrl = redactUrl(url);
-    let reqBody;
-    if (inference || dashboard) reqBody = "[BODY OMITTED]";
-    else if (init2?.body) {
-      try {
-        reqBody = redactDeep(JSON.parse(String(init2.body)));
-      } catch {
-        const contentType = new Headers(rawHeaders).get("content-type") ?? "";
-        reqBody = contentType.includes("application/x-www-form-urlencoded") ? redactDeep(Object.fromEntries(new URLSearchParams(String(init2.body)))) : "[NON-JSON BODY OMITTED]";
-      }
-    }
-    const ts2 = (/* @__PURE__ */ new Date()).toISOString();
-    const startMs = Date.now();
-    let response;
-    let resBody;
-    let error;
-    try {
-      response = await originalFetch(input2, init2);
-    } catch (err) {
-      error = inference ? "Runtime request failed" : "Request failed";
-      const entry2 = JSON.stringify({
-        timestamp: ts2,
-        durationMs: Date.now() - startMs,
-        request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
-        error
-      });
-      appendFileSync(logPath, `${entry2}
-`);
-      throw err;
-    }
-    const durationMs = Date.now() - startMs;
-    const resHeaders = {};
-    response.headers.forEach((v, k) => {
-      resHeaders[k] = v;
-    });
-    if (inference || dashboard || response.headers.get("content-type")?.includes("text/event-stream")) {
-      resBody = "[BODY OMITTED]";
-    } else {
-      const clone = response.clone();
-      try {
-        const text2 = await clone.text();
-        try {
-          resBody = redactDeep(JSON.parse(text2));
-        } catch {
-          resBody = "[NON-JSON BODY OMITTED]";
-        }
-      } catch {
-        resBody = "<unreadable>";
-      }
-    }
-    const entry = JSON.stringify({
-      timestamp: ts2,
-      durationMs,
-      request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
-      response: {
-        status: response.status,
-        statusText: response.statusText,
-        headers: redactHeaders(resHeaders),
-        body: resBody
-      }
-    });
-    appendFileSync(logPath, `${entry}
-`);
-    return response;
-  };
-  return {
-    teardown() {
-      globalThis.fetch = originalFetch;
-    }
-  };
-}
-
-// src/cli/tenant-input.ts
-import { input, password } from "@inquirer/prompts";
-async function promptTenantValue(message, secret = false) {
-  if (!process.stdin.isTTY || !process.stderr.isTTY)
-    throw new Error(
-      "Interactive setup requires a terminal. Use --config, or --tsg-id and --client-id with --client-secret-stdin. For tenant set, pass a value or use --stdin."
-    );
-  const prompt = secret ? password : input;
-  return prompt(
-    {
-      message,
-      validate: (value) => Boolean(value.trim()) || "A nonempty value is required"
-    },
-    { input: process.stdin, output: process.stderr }
-  );
-}
-async function readTenantStdin() {
-  if (process.stdin.isTTY) throw new Error("--stdin requires piped input");
-  const chunks = [];
-  let size = 0;
-  for await (const chunk of process.stdin) {
-    const buffer = Buffer.from(chunk);
-    size += buffer.length;
-    if (size > 65536) throw new Error("Configuration input exceeds 64 KiB");
-    chunks.push(buffer);
-  }
-  const value = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
-  if (!value.trim() || /[\r\n\0]/.test(value))
-    throw new Error("Provide one nonempty configuration value on stdin");
-  return value;
-}
+// src/cli/commands/aigateway/admin-guardrails.ts
+import {
+  GatewayAdminGuardrailCreateRequestSchema,
+  GatewayAdminGuardrailMcpMappingRequestSchema,
+  GatewayAdminGuardrailMcpSyncRequestSchema,
+  GatewayGuardrailUpdateRequestSchema
+} from "@cdot65/prisma-airs-sdk";
 
 // src/cli/commands/aigateway/shared.ts
-import { open, readFile as readFile2, unlink } from "fs/promises";
+import { open, readFile, unlink } from "fs/promises";
 import { AIGatewayClient as AIGatewayClient2 } from "@cdot65/prisma-airs-sdk";
-import { dump as dump5, load } from "js-yaml";
+import { dump as dump4, load } from "js-yaml";
 async function defaultClientFactory() {
   const config = await loadConfig();
   return new AIGatewayClient2(aiGatewayClientOptions(config));
@@ -3988,7 +3597,7 @@ function addWriteOutput(command) {
 async function readGatewayRequest(path3) {
   let parsed;
   try {
-    const text2 = await readFile2(path3, "utf8");
+    const text2 = await readFile(path3, "utf8");
     parsed = path3.endsWith(".yaml") || path3.endsWith(".yml") ? load(text2) : JSON.parse(text2);
   } catch (error) {
     throw new CliUsageError(
@@ -4045,7 +3654,7 @@ function renderGatewayList(items, format, label2) {
     return;
   }
   if (format === "yaml") {
-    console.log(dump5(items, { noRefs: true, lineWidth: -1 }).trimEnd());
+    console.log(dump4(items, { noRefs: true, lineWidth: -1 }).trimEnd());
     return;
   }
   if (items.length === 0) {
@@ -4063,298 +3672,830 @@ function renderGatewayDetail(value, format) {
     return;
   }
   if (format === "yaml") {
-    console.log(dump5(item, { noRefs: true, lineWidth: -1 }).trimEnd());
+    console.log(dump4(item, { noRefs: true, lineWidth: -1 }).trimEnd());
     return;
   }
-  const rows = Object.entries(item).map(([key, raw]) => ({
-    key,
-    value: raw !== null && typeof raw === "object" ? JSON.stringify(raw) : raw
-  }));
-  const rendered = formatOutput(
-    rows,
-    [
-      { key: "key", label: "Field" },
-      { key: "value", label: "Value" }
-    ],
-    format === "pretty" ? "table" : format
-  );
-  if (rendered) console.log(rendered);
+  const rows = Object.entries(item).map(([key, raw]) => ({
+    key,
+    value: raw !== null && typeof raw === "object" ? JSON.stringify(raw) : raw
+  }));
+  const rendered = formatOutput(
+    rows,
+    [
+      { key: "key", label: "Field" },
+      { key: "value", label: "Value" }
+    ],
+    format === "pretty" ? "table" : format
+  );
+  if (rendered) console.log(rendered);
+}
+async function runList(command, opts, label2, load4) {
+  try {
+    const format = await resolveOutput(command, opts);
+    const client = await createAiGatewayClient();
+    renderGatewayList(responseItems(await load4(client)), format, label2);
+  } catch (error) {
+    failAiGateway(error);
+  }
+}
+async function runDetail(command, opts, load4) {
+  try {
+    const format = await resolveOutput(command, opts);
+    const client = await createAiGatewayClient();
+    renderGatewayDetail(await load4(client), format);
+  } catch (error) {
+    failAiGateway(error);
+  }
+}
+async function runWrite(command, opts, prepareOrWrite, preparedWrite) {
+  try {
+    const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
+    const prepared = preparedWrite ? await prepareOrWrite() : void 0;
+    const client = await createAiGatewayClient();
+    const result = preparedWrite ? await preparedWrite(client, prepared) : await prepareOrWrite(client);
+    renderGatewayDetail(result, format);
+  } catch (error) {
+    failAiGateway(error);
+  }
+}
+async function runConfirmedWrite(command, opts, prompt, prepareOrWrite, preparedWrite) {
+  try {
+    const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
+    const prepared = preparedWrite ? await prepareOrWrite() : void 0;
+    const action = prompt.replace(/\?$/, "").replace(/^./, (character) => character.toLowerCase());
+    await confirmOrAbort(prompt, Boolean(opts.force), { action });
+    const client = await createAiGatewayClient();
+    const result = preparedWrite ? await preparedWrite(client, prepared) : await prepareOrWrite(client);
+    renderGatewayDetail(result ?? { success: true }, format);
+  } catch (error) {
+    failAiGateway(error);
+  }
+}
+async function runSecretWrite(command, opts, prepare, write, prompt, settings = {}) {
+  let destinationHandle;
+  let destinationReserved = false;
+  let secretPersisted = false;
+  const cleanupReservedDestination = async () => {
+    if (destinationHandle) await destinationHandle.close().catch(() => void 0);
+    destinationHandle = void 0;
+    if (opts.secretOutput && destinationReserved && !secretPersisted) {
+      await unlink(opts.secretOutput).catch(() => void 0);
+    }
+    destinationReserved = false;
+  };
+  try {
+    const prepared = await prepare();
+    const requiresDestination = settings.requiresDestination?.(prepared) ?? true;
+    if (requiresDestination && !opts.secretOutput && !opts.showSecret) {
+      throw new CliUsageError(
+        "Choose --secret-output <path> (recommended) or --show-secret before requesting a one-time credential"
+      );
+    }
+    const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
+    if (requiresDestination && opts.secretOutput) {
+      destinationHandle = await open(opts.secretOutput, "wx", 384);
+      destinationReserved = true;
+    }
+    if (prompt) {
+      const action = prompt.replace(/\?$/, "").replace(/^./, (character) => character.toLowerCase());
+      await confirmOrAbort(prompt, Boolean(opts.force), {
+        action,
+        onAbort: cleanupReservedDestination
+      });
+    }
+    const client = await createAiGatewayClient();
+    const result = await write(client, prepared);
+    if (requiresDestination && opts.secretOutput && destinationHandle) {
+      await destinationHandle.writeFile(`${JSON.stringify(result, null, 2)}
+`, "utf8");
+      secretPersisted = true;
+      await destinationHandle.close();
+      destinationHandle = void 0;
+      renderGatewayDetail({ saved_to: opts.secretOutput }, format);
+      return;
+    }
+    renderGatewayDetail(
+      requiresDestination ? result : settings.redactResponse?.(result) ?? result,
+      format
+    );
+  } catch (error) {
+    await cleanupReservedDestination();
+    failAiGateway(error);
+  }
+}
+
+// src/cli/commands/aigateway/structured-input.ts
+import {
+  AISecSDKException,
+  buildDottedObject,
+  ErrorType,
+  GatewayJsonObjectSchema,
+  setDottedValue
+} from "@cdot65/prisma-airs-sdk";
+function collectOption(value, previous = []) {
+  return [...previous, value];
+}
+function addStructuredInputOptions(command) {
+  return command.option("--file <path>", "Advanced JSON/YAML request base; named flags override it").option(
+    "--set <path=value>",
+    "Set a typed JSON value at a request path (repeatable)",
+    collectOption
+  ).option(
+    "--set-string <path=value>",
+    "Set a literal string at a request path (repeatable)",
+    collectOption
+  );
+}
+function parseBooleanOption(value) {
+  if (value === true || value === false) return value;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  throw new CliUsageError("Expected true or false");
+}
+function parseIntegerOption(value) {
+  const text2 = String(value);
+  if (!/^-?(0|[1-9]\d*)$/.test(text2)) throw new CliUsageError("Expected an integer");
+  const parsed = Number(text2);
+  if (!Number.isSafeInteger(parsed)) throw new CliUsageError("Expected a safe integer");
+  return parsed;
+}
+function parseDateOption(value) {
+  const parsed = new Date(String(value));
+  if (Number.isNaN(parsed.getTime())) throw new CliUsageError("Expected an ISO-8601 timestamp");
+  return parsed;
+}
+function parseCsvOption(value) {
+  const values = String(value).split(",").map((item) => item.trim()).filter(Boolean);
+  if (values.length === 0) throw new CliUsageError("Expected a non-empty comma-separated list");
+  return values;
+}
+function parseJsonOption(value) {
+  try {
+    return JSON.parse(String(value));
+  } catch {
+    throw new CliUsageError("Expected valid JSON");
+  }
+}
+function repeatableValues(value) {
+  if (Array.isArray(value)) return value.map(String);
+  return [String(value)];
+}
+function splitKeyValue(raw, label2) {
+  const separator = raw.indexOf("=");
+  if (separator <= 0) throw new CliUsageError(`Expected ${label2}=value`);
+  return [raw.slice(0, separator), raw.slice(separator + 1)];
+}
+function parseBooleanBindingsOption(value) {
+  return repeatableValues(value).map((raw) => {
+    const [id, enabled] = splitKeyValue(raw, "id");
+    return { id, enabled: parseBooleanOption(enabled) };
+  });
+}
+function parseModelBindingsOption(value) {
+  return repeatableValues(value).map((raw) => {
+    const [slug, enabled] = splitKeyValue(raw, "slug");
+    return { slug, enabled: parseBooleanOption(enabled) };
+  });
+}
+function parseCapabilityBindingsOption(value) {
+  return repeatableValues(value).map((raw) => {
+    const [identity2, enabled] = splitKeyValue(raw, "type:name");
+    const separator = identity2.indexOf(":");
+    if (separator <= 0 || separator === identity2.length - 1) {
+      throw new CliUsageError("Expected type:name=enabled");
+    }
+    return {
+      type: identity2.slice(0, separator),
+      name: identity2.slice(separator + 1),
+      enabled: parseBooleanOption(enabled)
+    };
+  });
+}
+function parseStringMapOption(value) {
+  const result = {};
+  for (const raw of repeatableValues(value)) {
+    const [key, item] = splitKeyValue(raw, "key");
+    if (["__proto__", "constructor", "prototype"].includes(key)) {
+      throw new CliUsageError(`Unsafe key: ${key}`);
+    }
+    if (Object.hasOwn(result, key)) throw new CliUsageError(`Duplicate key: ${key}`);
+    result[key] = item;
+  }
+  return result;
 }
-async function runList(command, opts, label2, load4) {
+function parseAssignment(raw, forceString) {
+  const separator = raw.indexOf("=");
+  if (separator <= 0) throw new CliUsageError("Expected path=value");
+  const path3 = raw.slice(0, separator);
+  const text2 = raw.slice(separator + 1);
+  if (forceString) return [path3, text2];
   try {
-    const format = await resolveOutput(command, opts);
-    const client = await createAiGatewayClient();
-    renderGatewayList(responseItems(await load4(client)), format, label2);
-  } catch (error) {
-    failAiGateway(error);
+    return [path3, JSON.parse(text2)];
+  } catch {
+    return [path3, text2];
   }
 }
-async function runDetail(command, opts, load4) {
-  try {
-    const format = await resolveOutput(command, opts);
-    const client = await createAiGatewayClient();
-    renderGatewayDetail(await load4(client), format);
-  } catch (error) {
-    failAiGateway(error);
+function schemaMessage(error) {
+  const issues = error?.issues;
+  if (!Array.isArray(issues) || issues.length === 0)
+    return "request body does not match its schema";
+  return issues.map((issue) => {
+    const path3 = issue.path?.length ? issue.path.map(String).join(".") : "<root>";
+    return `${path3}: ${issue.message ?? "invalid value"}`;
+  }).join("; ");
+}
+function optionName(option) {
+  return `--${option.replace(/[A-Z]/g, (character) => `-${character.toLowerCase()}`)}`;
+}
+function asUsageError(error, prefix = "Invalid AI Gateway request") {
+  if (error instanceof CliUsageError) return error;
+  if (error instanceof AISecSDKException && error.errorType === ErrorType.USER_REQUEST_PAYLOAD_ERROR) {
+    return new CliUsageError(`${prefix}: ${error.message}`);
   }
+  return new CliUsageError(`${prefix}: ${schemaMessage(error)}`);
 }
-async function runWrite(command, opts, prepareOrWrite, preparedWrite) {
+async function buildStructuredRequest(options, schema, fields = []) {
   try {
-    const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
-    const prepared = preparedWrite ? await prepareOrWrite() : void 0;
-    const client = await createAiGatewayClient();
-    const result = preparedWrite ? await preparedWrite(client, prepared) : await prepareOrWrite(client);
-    renderGatewayDetail(result, format);
+    let body = {};
+    if (options.file) {
+      body = GatewayJsonObjectSchema.parse(await readGatewayRequest(options.file));
+    }
+    for (const field of fields) {
+      const raw = options[field.option];
+      if (raw === void 0 || Array.isArray(raw) && raw.length === 0) continue;
+      let value;
+      try {
+        value = field.parse ? field.parse(raw) : raw;
+      } catch (error) {
+        if (error instanceof CliUsageError) {
+          throw new CliUsageError(`Invalid ${optionName(field.option)}: ${error.message}`);
+        }
+        throw error;
+      }
+      body = setDottedValue(body, field.path, value);
+    }
+    const assignments = [
+      ...(options.set ?? []).map((raw) => {
+        try {
+          const [path3, value] = parseAssignment(raw, false);
+          return { path: path3, value };
+        } catch (error) {
+          if (error instanceof CliUsageError) {
+            throw new CliUsageError(`Invalid --set '${raw}': ${error.message}`);
+          }
+          throw error;
+        }
+      }),
+      ...(options.setString ?? []).map((raw) => {
+        try {
+          const [path3, value] = parseAssignment(raw, true);
+          return { path: path3, value };
+        } catch (error) {
+          if (error instanceof CliUsageError) {
+            throw new CliUsageError(`Invalid --set-string '${raw}': ${error.message}`);
+          }
+          throw error;
+        }
+      })
+    ];
+    buildDottedObject(assignments);
+    for (const { path: path3, value } of assignments) body = setDottedValue(body, path3, value);
+    return schema.parse(body);
   } catch (error) {
-    failAiGateway(error);
+    throw asUsageError(error);
   }
 }
-async function runConfirmedWrite(command, opts, prompt, prepareOrWrite, preparedWrite) {
+
+// src/cli/commands/aigateway/admin-guardrails.ts
+function paginationInteger(value, flag, minimum, maximum) {
   try {
-    const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
-    const prepared = preparedWrite ? await prepareOrWrite() : void 0;
-    const action = prompt.replace(/\?$/, "").replace(/^./, (character) => character.toLowerCase());
-    await confirmOrAbort(prompt, Boolean(opts.force), { action });
-    const client = await createAiGatewayClient();
-    const result = preparedWrite ? await preparedWrite(client, prepared) : await prepareOrWrite(client);
-    renderGatewayDetail(result ?? { success: true }, format);
+    const parsed = parseIntegerOption(value);
+    if (parsed < minimum || parsed > maximum) {
+      throw new CliUsageError(`${flag} must be an integer from ${minimum} to ${maximum}`);
+    }
+    return parsed;
   } catch (error) {
-    failAiGateway(error);
+    fail(error);
   }
 }
-async function runSecretWrite(command, opts, prepare, write, prompt, settings = {}) {
-  let destinationHandle;
-  let destinationReserved = false;
-  let secretPersisted = false;
-  const cleanupReservedDestination = async () => {
-    if (destinationHandle) await destinationHandle.close().catch(() => void 0);
-    destinationHandle = void 0;
-    if (opts.secretOutput && destinationReserved && !secretPersisted) {
-      await unlink(opts.secretOutput).catch(() => void 0);
-    }
-    destinationReserved = false;
-  };
-  try {
-    const prepared = await prepare();
-    const requiresDestination = settings.requiresDestination?.(prepared) ?? true;
-    if (requiresDestination && !opts.secretOutput && !opts.showSecret) {
-      throw new CliUsageError(
-        "Choose --secret-output <path> (recommended) or --show-secret before requesting a one-time credential"
-      );
-    }
-    const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
-    if (requiresDestination && opts.secretOutput) {
-      destinationHandle = await open(opts.secretOutput, "wx", 384);
-      destinationReserved = true;
-    }
-    if (prompt) {
-      const action = prompt.replace(/\?$/, "").replace(/^./, (character) => character.toLowerCase());
-      await confirmOrAbort(prompt, Boolean(opts.force), {
-        action,
-        onAbort: cleanupReservedDestination
-      });
-    }
-    const client = await createAiGatewayClient();
-    const result = await write(client, prepared);
-    if (requiresDestination && opts.secretOutput && destinationHandle) {
-      await destinationHandle.writeFile(`${JSON.stringify(result, null, 2)}
-`, "utf8");
-      secretPersisted = true;
-      await destinationHandle.close();
-      destinationHandle = void 0;
-      renderGatewayDetail({ saved_to: opts.secretOutput }, format);
-      return;
+function registerAdminGuardrails(root) {
+  const group = showHelpOnEmpty(
+    root.command("admin-guardrails").description(
+      "Manage organisation guardrails on the admin plane (mutations specification-tested)"
+    )
+  );
+  const list = addReadOutput(
+    group.command("list").alias("ls").description(
+      "List organisation guardrails; optional workspace filtering may be denied by policy"
+    ).option("--workspace <uuid>", "Optional workspace UUID filter").option(
+      "--page-size <number>",
+      "Page size, 1\u20131000",
+      (value) => paginationInteger(value, "--page-size", 1, 1e3)
+    ).option(
+      "--current-page <number>",
+      "Zero-based page number",
+      (value) => paginationInteger(value, "--current-page", 0, Number.MAX_SAFE_INTEGER)
+    )
+  );
+  list.action(
+    (opts) => runList(
+      list,
+      opts,
+      "Admin guardrails",
+      (c) => c.adminGuardrails.list({
+        workspaceId: opts.workspace,
+        pageSize: opts.pageSize,
+        currentPage: opts.currentPage
+      })
+    )
+  );
+  const get = addReadOutput(
+    group.command("get <id>").description("Read an admin guardrail by UUID")
+  );
+  get.action((id, opts) => runDetail(get, opts, (c) => c.adminGuardrails.get(id)));
+  const fields = [
+    { option: "name", path: "name" },
+    { option: "checks", path: "checks", parse: parseJsonOption },
+    { option: "actions", path: "actions", parse: parseJsonOption }
+  ];
+  const common = (cmd) => addWriteOutput(
+    addStructuredInputOptions(
+      cmd.option("--name <name>", "Guardrail name").option("--checks <json>", "Checks array").option("--actions <json>", "Actions object")
+    )
+  );
+  const create = common(
+    group.command("create").description("Create an admin guardrail (specification-tested; no workspace fallback)")
+  ).option("--target <target>", "llm or mcp_tools").option("--workspace <uuid>", "Optional workspace UUID").option("--organisation <uuid>", "Optional organisation UUID, not the numeric TSG");
+  create.action(
+    (opts) => runWrite(
+      create,
+      opts,
+      () => buildStructuredRequest(opts, GatewayAdminGuardrailCreateRequestSchema, [
+        ...fields,
+        { option: "target", path: "target" },
+        { option: "workspace", path: "workspace_id" },
+        { option: "organisation", path: "organisation_id" }
+      ]),
+      (c, body) => c.adminGuardrails.create(body)
+    )
+  );
+  const update = common(
+    group.command("update <id>").description("Update an admin guardrail (specification-tested)")
+  );
+  update.action(
+    (id, opts) => runWrite(
+      update,
+      opts,
+      () => buildStructuredRequest(opts, GatewayGuardrailUpdateRequestSchema, fields),
+      (c, body) => c.adminGuardrails.update(id, body)
+    )
+  );
+  const remove = addWriteOutput(
+    group.command("delete <id>").alias("rm").description("Permanently delete an admin guardrail").option("--force", "Skip confirmation prompt")
+  );
+  remove.action(
+    (id, opts) => runConfirmedWrite(
+      remove,
+      opts,
+      `Permanently delete admin guardrail ${id}?`,
+      (c) => c.adminGuardrails.delete(id)
+    )
+  );
+  const mappings = showHelpOnEmpty(
+    group.command("mcp-servers").description("Manage admin guardrail MCP mappings; does not sign in to MCP")
+  );
+  const mappingsList = addReadOutput(
+    mappings.command("list <guardrail-id>").alias("ls").description("List MCP mappings")
+  );
+  mappingsList.action(
+    (id, opts) => runList(mappingsList, opts, "MCP mappings", (c) => c.adminGuardrails.getMcpServers(id))
+  );
+  const sync = addWriteOutput(
+    addStructuredInputOptions(
+      mappings.command("sync <guardrail-id>").description("Replace all mappings (specification-tested)").option("--force", "Skip replacement confirmation")
+    )
+  );
+  sync.action(
+    (id, opts) => runConfirmedWrite(
+      sync,
+      opts,
+      `Replace all MCP mappings on admin guardrail ${id}?`,
+      () => buildStructuredRequest(opts, GatewayAdminGuardrailMcpSyncRequestSchema),
+      (c, body) => c.adminGuardrails.syncMcpServers(id, body)
+    )
+  );
+  const upsert = addWriteOutput(
+    addStructuredInputOptions(
+      mappings.command("upsert <guardrail-id> <server-id>").description("Set one mapping (specification-tested)")
+    )
+  );
+  upsert.action(
+    (id, serverId, opts) => runWrite(
+      upsert,
+      opts,
+      () => buildStructuredRequest(opts, GatewayAdminGuardrailMcpMappingRequestSchema),
+      (c, body) => c.adminGuardrails.upsertMcpServer(id, serverId, body)
+    )
+  );
+}
+
+// src/cli/commands/aigateway/inference.ts
+import { readFile as readFile2 } from "fs/promises";
+import {
+  AIGatewayInferenceClient,
+  ErrorType as ErrorType2,
+  GatewayInferenceInputCreateChatCompletionRequestSchema,
+  GatewayInferenceInputCreateEmbeddingRequestSchema,
+  GatewayInferenceInputCreateResponseSchema
+} from "@cdot65/prisma-airs-sdk";
+import { dump as dump5 } from "js-yaml";
+function integer2(raw, flag) {
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < 1)
+    throw new CliUsageError(`${flag} must be a positive integer`);
+  return value;
+}
+async function inferenceBody(kind, prompt, opts, defaultModel) {
+  if (prompt !== void 0 && opts.file)
+    throw new CliUsageError("Pass a prompt or --file, not both");
+  if (prompt === void 0 && !opts.file) throw new CliUsageError("A prompt or --file is required");
+  let body;
+  if (opts.file) {
+    let value;
+    try {
+      value = JSON.parse(await readFile2(opts.file, "utf8"));
+    } catch {
+      throw new CliUsageError("--file must name a readable JSON request file");
     }
-    renderGatewayDetail(
-      requiresDestination ? result : settings.redactResponse?.(result) ?? result,
-      format
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new CliUsageError("--file must contain a JSON object");
+    body = value;
+  } else {
+    body = kind === "chat" ? { messages: [{ role: "user", content: prompt }] } : { input: prompt };
+  }
+  body = { ...body };
+  const model = opts.model ?? body.model ?? defaultModel;
+  if (typeof model !== "string" || !model.trim())
+    throw new CliUsageError(
+      "Set --model, the request model, or the matching inference model config"
     );
-  } catch (error) {
-    await cleanupReservedDestination();
-    failAiGateway(error);
+  body.model = model;
+  if (opts.stream !== void 0) body.stream = opts.stream;
+  if (opts.maxTokens !== void 0)
+    body[kind === "responses" ? "max_output_tokens" : "max_completion_tokens"] = integer2(
+      opts.maxTokens,
+      "--max-tokens"
+    );
+  if (opts.dimensions !== void 0) body.dimensions = integer2(opts.dimensions, "--dimensions");
+  if (opts.encoding !== void 0) body.encoding_format = opts.encoding;
+  if (kind === "responses" && body.store === void 0) body.store = false;
+  return body;
+}
+function responseText(value) {
+  if (!value || typeof value !== "object") return "";
+  const record = value;
+  if (record.type === "response.output_text.delta" && typeof record.delta === "string")
+    return record.delta;
+  if (Array.isArray(record.choices))
+    return record.choices.map((choice) => choice.message?.content ?? choice.delta?.content ?? "").join("");
+  if (Array.isArray(record.output))
+    return record.output.flatMap((item) => Array.isArray(item.content) ? item.content : []).filter((part) => part.type === "output_text").map((part) => part.text).join("");
+  return "";
+}
+function registerAiGatewayInference(parent) {
+  const group = parent.command("inference").description("Call the gateway runtime (separate API key; no SCM OAuth required)");
+  for (const kind of ["chat", "responses", "embeddings"]) {
+    const command = group.command(`${kind} [prompt]`).description(
+      `${kind === "embeddings" ? "Create embeddings" : "Generate a model response"} through your runtime gateway`
+    ).option("--model <id>", "Provider-prefixed model ID; overrides request file and config").option("--endpoint <url>", "Runtime base URL including /v1; overrides config").option("--file <path>", "JSON request file (mutually exclusive with prompt)").option("--timeout <ms>", "Total deadline including streaming, in milliseconds", "60000").option(
+      "--output <format>",
+      "pretty, json or yaml; streaming json emits one chunk per line (JSONL)"
+    );
+    if (kind === "embeddings")
+      command.option("--dimensions <n>", "Embedding dimensions").option("--encoding <format>", "float or base64");
+    else
+      command.option("--stream", "Stream text (pretty) or validated events (json/JSONL)").option("--max-tokens <n>", "Maximum completion/output tokens");
+    command.action(async (prompt, opts) => {
+      const controller = new AbortController();
+      const interrupt = () => controller.abort(new Error("Inference interrupted"));
+      const outputError = (error) => controller.abort(error);
+      let stream;
+      let failed = false;
+      let failure3;
+      try {
+        const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
+        const config = await loadConfig({ aiGwInferenceEndpoint: opts.endpoint });
+        const body = await inferenceBody(
+          kind,
+          prompt,
+          opts,
+          kind === "embeddings" ? config.aiGwEmbeddingModel : config.aiGwInferenceModel
+        );
+        if (body.stream === true && format === "yaml")
+          throw new CliUsageError("Streaming supports --output pretty or json (JSONL), not yaml");
+        const schema = kind === "chat" ? GatewayInferenceInputCreateChatCompletionRequestSchema : kind === "responses" ? GatewayInferenceInputCreateResponseSchema : GatewayInferenceInputCreateEmbeddingRequestSchema;
+        const parsed = schema.safeParse(body);
+        if (!parsed.success)
+          throw new CliUsageError(
+            `Invalid inference request: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.code}`).join("; ")}`
+          );
+        const client = new AIGatewayInferenceClient({
+          endpoint: config.aiGwInferenceEndpoint,
+          apiKey: config.aiGwInferenceApiKey,
+          timeoutMs: integer2(opts.timeout ?? "60000", "--timeout"),
+          numRetries: 0
+        });
+        process.once("SIGINT", interrupt);
+        process.once("SIGTERM", interrupt);
+        process.stdout.on("error", outputError);
+        const write = (text2) => new Promise((resolve10, reject) => {
+          process.stdout.write(text2, (error) => error ? reject(error) : resolve10());
+        });
+        const requestOptions = { signal: controller.signal };
+        const result = kind === "chat" ? await client.createChatCompletion(
+          GatewayInferenceInputCreateChatCompletionRequestSchema.parse(body),
+          requestOptions
+        ) : kind === "responses" ? await client.createResponse(
+          GatewayInferenceInputCreateResponseSchema.parse(body),
+          requestOptions
+        ) : await client.createEmbedding(
+          GatewayInferenceInputCreateEmbeddingRequestSchema.parse(body),
+          requestOptions
+        );
+        if (Symbol.asyncIterator in result) {
+          stream = result;
+          for await (const event of result) {
+            if (format === "json") await write(`${JSON.stringify(event)}
+`);
+            else {
+              const text2 = responseText(event);
+              if (text2) await write(text2);
+            }
+            if ("type" in event && (event.type === "response.failed" || event.type === "response.incomplete"))
+              throw new Error(`Gateway generation ended with ${event.type}`);
+          }
+          if (format === "pretty") await write("\n");
+        } else {
+          const text2 = format === "yaml" ? dump5(result, { noRefs: true }).trimEnd() : format === "pretty" && kind !== "embeddings" ? responseText(result) : JSON.stringify(result, null, 2);
+          await write(`${text2}
+`);
+          if ("status" in result && (result.status === "failed" || result.status === "incomplete"))
+            throw new Error(`Gateway generation ended with ${result.status}`);
+        }
+      } catch (error) {
+        failed = true;
+        failure3 = error;
+      } finally {
+        await stream?.cancel();
+        controller.abort();
+        process.removeListener("SIGINT", interrupt);
+        process.removeListener("SIGTERM", interrupt);
+        process.stdout.removeListener("error", outputError);
+      }
+      if (failed && failure3?.code !== "EPIPE") {
+        if (failure3?.errorType === ErrorType2.USER_REQUEST_PAYLOAD_ERROR)
+          usageError(failure3 instanceof Error ? failure3.message : "Invalid inference options");
+        fail(failure3);
+      }
+    });
   }
 }
 
-// src/cli/commands/aigateway/structured-input.ts
+// src/cli/commands/aigateway/inventory.ts
+import { readFile as readFile3 } from "fs/promises";
 import {
-  AISecSDKException,
-  buildDottedObject,
-  ErrorType as ErrorType2,
-  GatewayJsonObjectSchema,
-  setDottedValue
+  AI_GATEWAY_DEPLOYMENT_STATUSES,
+  AI_GATEWAY_DEPLOYMENT_TYPES,
+  AI_GATEWAY_KNOWN_API_KEY_SCOPES,
+  AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
+  AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
+  customHostConfiguration,
+  GatewayApiKeyRotateRequestSchema,
+  GatewayApiKeyUpdateRequestSchema,
+  GatewayConfigCreateRequestSchema,
+  GatewayConfigUpdateRequestSchema,
+  GatewayDeploymentCreateRequestSchema,
+  GatewayDeploymentUpdateRequestSchema,
+  GatewayGuardrailCreateRequestSchema,
+  GatewayGuardrailUpdateRequestSchema as GatewayGuardrailUpdateRequestSchema2,
+  GatewayIntegrationCreateRequestSchema,
+  GatewayIntegrationModelsBulkUpdateRequestSchema,
+  GatewayIntegrationUpdateRequestSchema,
+  GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
+  GatewayOrganisationAuthSettingsUpdateRequestSchema,
+  GatewayOrganisationUpdateRequestSchema,
+  GatewayPluginCreateRequestSchema,
+  GatewayProviderCreateRequestSchema,
+  GatewayProviderUpdateRequestSchema,
+  GatewayServiceApiKeyCreateRequestSchema,
+  GatewayUserApiKeyCreateRequestSchema,
+  McpIntegrationCapabilitiesBulkUpdateRequestSchema,
+  McpIntegrationCreateRequestSchema,
+  McpIntegrationUpdateRequestSchema,
+  McpIntegrationWorkspacesBulkUpdateRequestSchema,
+  redactAIGatewaySecrets
 } from "@cdot65/prisma-airs-sdk";
-function collectOption(value, previous = []) {
-  return [...previous, value];
-}
-function addStructuredInputOptions(command) {
-  return command.option("--file <path>", "Advanced JSON/YAML request base; named flags override it").option(
-    "--set <path=value>",
-    "Set a typed JSON value at a request path (repeatable)",
-    collectOption
-  ).option(
-    "--set-string <path=value>",
-    "Set a literal string at a request path (repeatable)",
-    collectOption
-  );
-}
-function parseBooleanOption(value) {
-  if (value === true || value === false) return value;
-  if (value === "true") return true;
-  if (value === "false") return false;
-  throw new CliUsageError("Expected true or false");
-}
-function parseIntegerOption(value) {
-  const text2 = String(value);
-  if (!/^-?(0|[1-9]\d*)$/.test(text2)) throw new CliUsageError("Expected an integer");
-  const parsed = Number(text2);
-  if (!Number.isSafeInteger(parsed)) throw new CliUsageError("Expected a safe integer");
-  return parsed;
-}
-function parseDateOption(value) {
-  const parsed = new Date(String(value));
-  if (Number.isNaN(parsed.getTime())) throw new CliUsageError("Expected an ISO-8601 timestamp");
-  return parsed;
-}
-function parseCsvOption(value) {
-  const values = String(value).split(",").map((item) => item.trim()).filter(Boolean);
-  if (values.length === 0) throw new CliUsageError("Expected a non-empty comma-separated list");
-  return values;
-}
-function parseJsonOption(value) {
+
+// src/cli/debug-logger.ts
+import {
+  appendFileSync,
+  mkdirSync,
+  readdirSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { dirname, join } from "path";
+var AIRS_DOMAINS = [
+  "api.sase.paloaltonetworks.com",
+  "api.apps.paloaltonetworks.com",
+  "service.api.aisecurity.paloaltonetworks.com",
+  "auth.apps.paloaltonetworks.com",
+  "api.dlp.paloaltonetworks.com"
+];
+function isAirsUrl(url) {
   try {
-    return JSON.parse(String(value));
+    const parsed = new URL(url);
+    return AIRS_DOMAINS.some((d) => parsed.hostname === d || parsed.hostname.endsWith(`.${d}`));
   } catch {
-    throw new CliUsageError("Expected valid JSON");
+    return false;
   }
 }
-function repeatableValues(value) {
-  if (Array.isArray(value)) return value.map(String);
-  return [String(value)];
-}
-function splitKeyValue(raw, label2) {
-  const separator = raw.indexOf("=");
-  if (separator <= 0) throw new CliUsageError(`Expected ${label2}=value`);
-  return [raw.slice(0, separator), raw.slice(separator + 1)];
-}
-function parseBooleanBindingsOption(value) {
-  return repeatableValues(value).map((raw) => {
-    const [id, enabled] = splitKeyValue(raw, "id");
-    return { id, enabled: parseBooleanOption(enabled) };
-  });
-}
-function parseModelBindingsOption(value) {
-  return repeatableValues(value).map((raw) => {
-    const [slug, enabled] = splitKeyValue(raw, "slug");
-    return { slug, enabled: parseBooleanOption(enabled) };
-  });
-}
-function parseCapabilityBindingsOption(value) {
-  return repeatableValues(value).map((raw) => {
-    const [identity2, enabled] = splitKeyValue(raw, "type:name");
-    const separator = identity2.indexOf(":");
-    if (separator <= 0 || separator === identity2.length - 1) {
-      throw new CliUsageError("Expected type:name=enabled");
-    }
-    return {
-      type: identity2.slice(0, separator),
-      name: identity2.slice(separator + 1),
-      enabled: parseBooleanOption(enabled)
-    };
-  });
+var MASK = "***";
+var SENSITIVE_KEY_PATTERN = /token|secret|password|passwd|credential|authorization|cookie|api[-_]?key|client[-_]?auth|auth[-_]?code|^key$/i;
+function isSensitiveKey(key) {
+  return SENSITIVE_KEY_PATTERN.test(key);
 }
-function parseStringMapOption(value) {
-  const result = {};
-  for (const raw of repeatableValues(value)) {
-    const [key, item] = splitKeyValue(raw, "key");
-    if (["__proto__", "constructor", "prototype"].includes(key)) {
-      throw new CliUsageError(`Unsafe key: ${key}`);
+function redactHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    out[k] = isSensitiveKey(k) || /^x-portkey-(config|metadata|forward-headers)$/i.test(k) ? MASK : v;
+  }
+  return out;
+}
+function redactDeep(value) {
+  if (Array.isArray(value)) {
+    return value.map(redactDeep);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = isSensitiveKey(k) ? MASK : redactDeep(v);
     }
-    if (Object.hasOwn(result, key)) throw new CliUsageError(`Duplicate key: ${key}`);
-    result[key] = item;
+    return out;
   }
-  return result;
+  return value;
 }
-function parseAssignment(raw, forceString) {
-  const separator = raw.indexOf("=");
-  if (separator <= 0) throw new CliUsageError("Expected path=value");
-  const path3 = raw.slice(0, separator);
-  const text2 = raw.slice(separator + 1);
-  if (forceString) return [path3, text2];
+function redactUrl(url) {
   try {
-    return [path3, JSON.parse(text2)];
+    const parsed = new URL(url);
+    let touched = false;
+    for (const key of parsed.searchParams.keys()) {
+      if (isSensitiveKey(key)) {
+        parsed.searchParams.set(key, MASK);
+        touched = true;
+      }
+    }
+    return touched ? parsed.toString() : url;
   } catch {
-    return [path3, text2];
+    return url;
   }
 }
-function schemaMessage(error) {
-  const issues = error?.issues;
-  if (!Array.isArray(issues) || issues.length === 0)
-    return "request body does not match its schema";
-  return issues.map((issue) => {
-    const path3 = issue.path?.length ? issue.path.map(String).join(".") : "<root>";
-    return `${path3}: ${issue.message ?? "invalid value"}`;
-  }).join("; ");
-}
-function optionName(option) {
-  return `--${option.replace(/[A-Z]/g, (character) => `-${character.toLowerCase()}`)}`;
-}
-function asUsageError(error, prefix = "Invalid AI Gateway request") {
-  if (error instanceof CliUsageError) return error;
-  if (error instanceof AISecSDKException && error.errorType === ErrorType2.USER_REQUEST_PAYLOAD_ERROR) {
-    return new CliUsageError(`${prefix}: ${error.message}`);
+function headersToRecord(headers) {
+  if (!headers) return {};
+  if (typeof headers === "object" && "forEach" in headers && typeof headers.forEach === "function") {
+    const out = {};
+    headers.forEach((v, k) => {
+      out[k] = v;
+    });
+    return out;
   }
-  return new CliUsageError(`${prefix}: ${schemaMessage(error)}`);
+  if (Array.isArray(headers)) {
+    return Object.fromEntries(headers);
+  }
+  return headers;
 }
-async function buildStructuredRequest(options, schema, fields = []) {
-  try {
-    let body = {};
-    if (options.file) {
-      body = GatewayJsonObjectSchema.parse(await readGatewayRequest(options.file));
+function installDebugLogger(logPath, options = {}) {
+  mkdirSync(dirname(logPath), { recursive: true, mode: 448 });
+  writeFileSync(logPath, "", { encoding: "utf8", mode: 384, flag: "wx" });
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async function debugFetch(input2, init2) {
+    const url = typeof input2 === "string" ? input2 : input2 instanceof URL ? input2.toString() : input2.url;
+    const rawHeaders = headersToRecord(
+      init2?.headers ?? (input2 instanceof Request ? input2.headers : void 0)
+    );
+    const inference = Object.keys(rawHeaders).some(
+      (name) => name.toLowerCase() === "x-portkey-api-key"
+    );
+    if (!isAirsUrl(url) && !inference) {
+      return originalFetch(input2, init2);
     }
-    for (const field of fields) {
-      const raw = options[field.option];
-      if (raw === void 0 || Array.isArray(raw) && raw.length === 0) continue;
-      let value;
+    const dashboard = options.omitBodies || /\/v1\/mgmt\/(dashboard\/|reports\/scancontent(?:\?|$))/.test(url) || /\/aiag\//.test(new URL(url).pathname);
+    const method = init2?.method ?? (input2 instanceof Request ? input2.method : "GET");
+    const reqHeaders = redactHeaders(rawHeaders);
+    const loggedUrl = redactUrl(url);
+    let reqBody;
+    if (inference || dashboard) reqBody = "[BODY OMITTED]";
+    else if (init2?.body) {
       try {
-        value = field.parse ? field.parse(raw) : raw;
-      } catch (error) {
-        if (error instanceof CliUsageError) {
-          throw new CliUsageError(`Invalid ${optionName(field.option)}: ${error.message}`);
-        }
-        throw error;
+        reqBody = redactDeep(JSON.parse(String(init2.body)));
+      } catch {
+        const contentType = new Headers(rawHeaders).get("content-type") ?? "";
+        reqBody = contentType.includes("application/x-www-form-urlencoded") ? redactDeep(Object.fromEntries(new URLSearchParams(String(init2.body)))) : "[NON-JSON BODY OMITTED]";
       }
-      body = setDottedValue(body, field.path, value);
     }
-    const assignments = [
-      ...(options.set ?? []).map((raw) => {
-        try {
-          const [path3, value] = parseAssignment(raw, false);
-          return { path: path3, value };
-        } catch (error) {
-          if (error instanceof CliUsageError) {
-            throw new CliUsageError(`Invalid --set '${raw}': ${error.message}`);
-          }
-          throw error;
-        }
-      }),
-      ...(options.setString ?? []).map((raw) => {
+    const ts2 = (/* @__PURE__ */ new Date()).toISOString();
+    const startMs = Date.now();
+    let response;
+    let resBody;
+    let error;
+    try {
+      response = await originalFetch(input2, init2);
+    } catch (err) {
+      error = inference ? "Runtime request failed" : "Request failed";
+      const entry2 = JSON.stringify({
+        timestamp: ts2,
+        durationMs: Date.now() - startMs,
+        request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
+        error
+      });
+      appendFileSync(logPath, `${entry2}
+`);
+      throw err;
+    }
+    const durationMs = Date.now() - startMs;
+    const resHeaders = {};
+    response.headers.forEach((v, k) => {
+      resHeaders[k] = v;
+    });
+    if (inference || dashboard || response.headers.get("content-type")?.includes("text/event-stream")) {
+      resBody = "[BODY OMITTED]";
+    } else {
+      const clone = response.clone();
+      try {
+        const text2 = await clone.text();
         try {
-          const [path3, value] = parseAssignment(raw, true);
-          return { path: path3, value };
-        } catch (error) {
-          if (error instanceof CliUsageError) {
-            throw new CliUsageError(`Invalid --set-string '${raw}': ${error.message}`);
-          }
-          throw error;
+          resBody = redactDeep(JSON.parse(text2));
+        } catch {
+          resBody = "[NON-JSON BODY OMITTED]";
         }
-      })
-    ];
-    buildDottedObject(assignments);
-    for (const { path: path3, value } of assignments) body = setDottedValue(body, path3, value);
-    return schema.parse(body);
-  } catch (error) {
-    throw asUsageError(error);
+      } catch {
+        resBody = "<unreadable>";
+      }
+    }
+    const entry = JSON.stringify({
+      timestamp: ts2,
+      durationMs,
+      request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
+      response: {
+        status: response.status,
+        statusText: response.statusText,
+        headers: redactHeaders(resHeaders),
+        body: resBody
+      }
+    });
+    appendFileSync(logPath, `${entry}
+`);
+    return response;
+  };
+  return {
+    teardown() {
+      globalThis.fetch = originalFetch;
+    }
+  };
+}
+
+// src/cli/tenant-input.ts
+import { input, password } from "@inquirer/prompts";
+async function promptTenantValue(message, secret = false) {
+  if (!process.stdin.isTTY || !process.stderr.isTTY)
+    throw new Error(
+      "Interactive setup requires a terminal. Use --config, or --tsg-id and --client-id with --client-secret-stdin. For tenant set, pass a value or use --stdin."
+    );
+  const prompt = secret ? password : input;
+  return prompt(
+    {
+      message,
+      validate: (value) => Boolean(value.trim()) || "A nonempty value is required"
+    },
+    { input: process.stdin, output: process.stderr }
+  );
+}
+async function readTenantStdin() {
+  if (process.stdin.isTTY) throw new Error("--stdin requires piped input");
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    const buffer = Buffer.from(chunk);
+    size += buffer.length;
+    if (size > 65536) throw new Error("Configuration input exceeds 64 KiB");
+    chunks.push(buffer);
   }
+  const value = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  if (!value.trim() || /[\r\n\0]/.test(value))
+    throw new Error("Provide one nonempty configuration value on stdin");
+  return value;
 }
 
 // src/cli/commands/aigateway/inventory.ts
@@ -5202,7 +5343,7 @@ function registerAiGatewayInventory(root) {
       createSchema: GatewayGuardrailCreateRequestSchema,
       updateFields: guardrailUpdateFields,
       updateOptions: addGuardrailUpdateFields,
-      updateSchema: GatewayGuardrailUpdateRequestSchema
+      updateSchema: GatewayGuardrailUpdateRequestSchema2
     },
     {
       create: (client, body) => client.guardrails.create(body),
@@ -5634,6 +5775,7 @@ function scopeNameLooksUnrelated(name, scopeName) {
 function registerAiGatewayCommand(program) {
   const aigateway = program.command("aigateway").description("Manage and observe Prisma AIRS AI Gateway resources").action(() => aigateway.outputHelp());
   registerAiGatewayInventory(aigateway);
+  registerAdminGuardrails(aigateway);
   registerAiGatewayReportCommand(aigateway);
   registerAiGatewayInference(aigateway);
   const workspace = aigateway.command("workspaces").alias("workspace").description("Manage gateway workspaces").action(() => workspace.outputHelp());
@@ -6419,6 +6561,7 @@ import pLimit2 from "p-limit";
 
 // src/redteam/judge/providers.ts
 import { createHash as createHash2 } from "crypto";
+import { TypeSafeClient } from "@typesafe-ai/sdk";
 var ProviderError = class extends Error {
   constructor(message) {
     super(message);
@@ -6455,7 +6598,7 @@ function typesafeEndpoint(baseUrl, path3) {
   return `${url.toString().replace(/\/+$/, "")}${path3}`;
 }
 var TypeSafeHttpProvider = class {
-  name = "typesafe-http";
+  name = "typesafe-sdk";
   model;
   url;
   apiKey;
@@ -6473,33 +6616,41 @@ var TypeSafeHttpProvider = class {
     this.sleep = options.sleep ?? defaultSleep;
   }
   async judge(request) {
-    const body = JSON.stringify({
-      state: request.state,
-      model: this.model,
-      questions: request.questions
+    let received;
+    const client = new TypeSafeClient({
+      apiKey: this.apiKey,
+      baseURL: this.url.slice(0, -"/v1/systemone".length),
+      timeout: this.timeoutMs,
+      retry: { maxRetries: 0 },
+      // One retry owner: the adapter below.
+      logLevel: "off",
+      // Do not allow SDK environment settings to log scan text.
+      fetch: async (input2, init2) => {
+        received = await this.fetch(input2, { ...init2, redirect: "error" });
+        return received;
+      }
     });
     for (let attempt = 0; ; attempt += 1) {
       const started = performance.now();
       let response;
       try {
-        response = await this.fetch(this.url, {
-          method: "POST",
-          redirect: "error",
-          headers: {
-            Authorization: `Bearer ${this.apiKey}`,
-            "Content-Type": "application/json",
-            Accept: "application/json"
-          },
-          body,
-          signal: AbortSignal.timeout(this.timeoutMs)
-        });
+        received = void 0;
+        response = await client.systemOne({
+          state: request.state,
+          model: this.model,
+          questions: request.questions
+        }).asResponse();
       } catch (error) {
-        if (attempt >= this.maxRetries)
-          throw new ProviderError(
-            `TypeSafe API connection failed: ${error instanceof Error ? error.name : "Error"}`
-          );
-        await this.sleep(retryDelayMs(attempt, null));
-        continue;
+        if (received && !received.ok) {
+          response = received;
+        } else {
+          if (attempt >= this.maxRetries)
+            throw new ProviderError(
+              `TypeSafe API connection failed: ${error instanceof Error ? error.name : "Error"}`
+            );
+          await this.sleep(retryDelayMs(attempt, null));
+          continue;
+        }
       }
       if (response.ok) {
         let decoded;
@@ -6847,6 +6998,13 @@ function renderSummary(results) {
     "| Category | Judged | Judge ASR | AIRS ASR | Agreement |",
     "|---|---|---|---|---|"
   ];
+  if (results.provider === "replay")
+    lines.splice(
+      2,
+      0,
+      "REPLAY ONLY: reused recorded answers; no new Jev evaluation or credential check was performed.",
+      ""
+    );
   for (const [name, block] of Object.entries(results.by_category))
     lines.push(
       `| ${name} | ${block.judged} | ${pct(block.asr)} | ${pct(block.agreement.airs_asr_from_threat_flags)} | ${pct(block.agreement.agreement_rate)} |`
@@ -8047,6 +8205,7 @@ async function backupTargets(opts) {
 import { lstat as lstat3, mkdir, readFile as readFile5 } from "fs/promises";
 import { join as join2, resolve as resolve3 } from "path";
 import { RedTeamClient } from "@cdot65/prisma-airs-sdk";
+import { Option as Option2 } from "commander";
 var JUDGE_PROVIDER_ERROR_EXIT_CODE = 4;
 var JUDGE_OUTPUT_FILES = ["results.json", "judgments.json", "summary.md"];
 function probability(raw, flag) {
@@ -8098,7 +8257,7 @@ function safeContext2() {
 function registerRedTeamJudgeCommand(redteam) {
   const command = redteam.command("judge [scanFile]").description(
     "Judge red-team attack outputs with TypeSafe Jev and compute an independent attack success rate"
-  ).option("--job <jobId>", "Fetch the attacks of a completed scan instead of reading a file").requiredOption("--out <dir>", "Directory for results.json, judgments.json and summary.md").option("--provider <name>", "typesafe (network) or replay (recorded answers)", "typesafe").option("--replay <file>", "Recorded judgments file for --provider replay").option("--record <file>", "Write raw provider answers here for later replay").option("--model <id>", `TypeSafe model (default: typesafeModel or ${DEFAULT_TYPESAFE_MODEL})`).option(
+  ).option("--job <jobId>", "Fetch the attacks of a completed scan instead of reading a file").requiredOption("--out <dir>", "Directory for results.json, judgments.json and summary.md").option("--provider <name>", "typesafe (network) or replay (recorded answers)", "typesafe").option("--replay <file>", "Recorded judgments file for --provider replay").option("--record <file>", "Write raw provider answers here for later replay").addOption(new Option2("--harness-credentials").hideHelp()).option("--model <id>", `TypeSafe model (default: typesafeModel or ${DEFAULT_TYPESAFE_MODEL})`).option(
     "--base-url <url>",
     `TypeSafe API base URL (default: typesafeBaseUrl or ${DEFAULT_TYPESAFE_BASE_URL})`
   ).option(
@@ -8144,7 +8303,7 @@ async function runJudge(command, scanFile, opts) {
   const maxRetries = opts.maxRetries === "0" ? 0 : integer3(opts.maxRetries, "--max-retries", 10);
   const timeoutMs = integer3(opts.timeout, "--timeout");
   if (!opts.out.trim()) throw new CliUsageError("--out cannot be empty");
-  const needsConfig = opts.job !== void 0 || opts.provider === "typesafe" && !opts.dryRun;
+  const needsConfig = opts.job !== void 0 || opts.provider === "typesafe" && !opts.dryRun && !opts.harnessCredentials;
   const config = needsConfig ? await loadConfig() : await loadConfig().catch(() => void 0);
   const format = await resolveOutput(command, opts, {
     allowed: ["pretty", "json"],
@@ -8183,8 +8342,8 @@ async function runJudge(command, scanFile, opts) {
     );
   }
   const { units, notes } = normalized;
-  const model = opts.model ?? config?.typesafeModel ?? DEFAULT_TYPESAFE_MODEL;
-  const baseUrl = opts.baseUrl ?? config?.typesafeBaseUrl ?? DEFAULT_TYPESAFE_BASE_URL;
+  const model = opts.model ?? (opts.harnessCredentials ? process.env.TYPESAFE_DEFAULT_MODEL : config?.typesafeModel) ?? DEFAULT_TYPESAFE_MODEL;
+  const baseUrl = opts.baseUrl ?? (opts.harnessCredentials ? process.env.TYPESAFE_BASE_URL : config?.typesafeBaseUrl) ?? DEFAULT_TYPESAFE_BASE_URL;
   if (opts.dryRun) {
     const first = units.find((unit) => !unit.is_error);
     const payload = {
@@ -8204,10 +8363,10 @@ async function runJudge(command, scanFile, opts) {
       throw new CliUsageError("--replay must contain a JSON object");
     provider = new ReplayProvider(recorded);
   } else {
-    const apiKey = config?.typesafeApiKey;
+    const apiKey = opts.harnessCredentials ? process.env.TYPESAFE_API_KEY : config?.typesafeApiKey;
     if (typeof apiKey !== "string" || !apiKey.trim())
       throw new Error(
-        `TypeSafe API key is not configured (typesafeApiKey). ${settingRemedy(["typesafeApiKey"], safeContext2())}`
+        opts.harnessCredentials ? "No TypeSafe key reached the judge from its AIRS environment. Check airs env typesafe status, or save a key with airs env typesafe set. No live judgment was performed; replay was not substituted." : `TypeSafe API key is not configured (typesafeApiKey). ${settingRemedy(["typesafeApiKey"], safeContext2())}`
       );
     provider = new TypeSafeHttpProvider({ apiKey, model, baseUrl, maxRetries, timeoutMs });
   }