@cdot65/prisma-airs-cli 7.1.5 → 7.2.0

package/dist/cli/index.js

@@ -3562,443 +3562,52 @@ ${lines.map((l) => `  $ ${commandHint(l)}`).join("\n")}
 `;
 }
 
-// src/cli/commands/aigateway/inference.ts
-import { readFile } from "fs/promises";
+// src/cli/commands/aigateway/admin-guardrails.ts
 import {
-  AIGatewayInferenceClient,
-  ErrorType,
-  GatewayInferenceInputCreateChatCompletionRequestSchema,
-  GatewayInferenceInputCreateEmbeddingRequestSchema,
-  GatewayInferenceInputCreateResponseSchema
+  GatewayAdminGuardrailCreateRequestSchema,
+  GatewayAdminGuardrailMcpMappingRequestSchema,
+  GatewayAdminGuardrailMcpSyncRequestSchema,
+  GatewayGuardrailUpdateRequestSchema
 } from "@cdot65/prisma-airs-sdk";
-import { dump as dump4 } from "js-yaml";
-function integer2(raw, flag) {
-  const value = Number(raw);
-  if (!Number.isSafeInteger(value) || value < 1)
-    throw new CliUsageError(`${flag} must be a positive integer`);
-  return value;
+
+// src/cli/commands/aigateway/shared.ts
+import { open, readFile, unlink } from "fs/promises";
+import { AIGatewayClient as AIGatewayClient2 } from "@cdot65/prisma-airs-sdk";
+import { dump as dump4, load } from "js-yaml";
+async function defaultClientFactory() {
+  const config = await loadConfig();
+  return new AIGatewayClient2(aiGatewayClientOptions(config));
 }
-async function inferenceBody(kind, prompt, opts, defaultModel) {
-  if (prompt !== void 0 && opts.file)
-    throw new CliUsageError("Pass a prompt or --file, not both");
-  if (prompt === void 0 && !opts.file) throw new CliUsageError("A prompt or --file is required");
-  let body;
-  if (opts.file) {
-    let value;
-    try {
-      value = JSON.parse(await readFile(opts.file, "utf8"));
-    } catch {
-      throw new CliUsageError("--file must name a readable JSON request file");
-    }
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      throw new CliUsageError("--file must contain a JSON object");
-    body = value;
-  } else {
-    body = kind === "chat" ? { messages: [{ role: "user", content: prompt }] } : { input: prompt };
-  }
-  body = { ...body };
-  const model = opts.model ?? body.model ?? defaultModel;
-  if (typeof model !== "string" || !model.trim())
-    throw new CliUsageError(
-      "Set --model, the request model, or the matching inference model config"
-    );
-  body.model = model;
-  if (opts.stream !== void 0) body.stream = opts.stream;
-  if (opts.maxTokens !== void 0)
-    body[kind === "responses" ? "max_output_tokens" : "max_completion_tokens"] = integer2(
-      opts.maxTokens,
-      "--max-tokens"
-    );
-  if (opts.dimensions !== void 0) body.dimensions = integer2(opts.dimensions, "--dimensions");
-  if (opts.encoding !== void 0) body.encoding_format = opts.encoding;
-  if (kind === "responses" && body.store === void 0) body.store = false;
-  return body;
+var clientFactory = defaultClientFactory;
+async function createAiGatewayClient() {
+  return clientFactory();
 }
-function responseText(value) {
-  if (!value || typeof value !== "object") return "";
-  const record = value;
-  if (record.type === "response.output_text.delta" && typeof record.delta === "string")
-    return record.delta;
-  if (Array.isArray(record.choices))
-    return record.choices.map((choice) => choice.message?.content ?? choice.delta?.content ?? "").join("");
-  if (Array.isArray(record.output))
-    return record.output.flatMap((item) => Array.isArray(item.content) ? item.content : []).filter((part) => part.type === "output_text").map((part) => part.text).join("");
-  return "";
+function showHelpOnEmpty(command) {
+  return command.action(() => command.outputHelp());
 }
-function registerAiGatewayInference(parent) {
-  const group = parent.command("inference").description("Call the gateway runtime (separate API key; no SCM OAuth required)");
-  for (const kind of ["chat", "responses", "embeddings"]) {
-    const command = group.command(`${kind} [prompt]`).description(
-      `${kind === "embeddings" ? "Create embeddings" : "Generate a model response"} through your runtime gateway`
-    ).option("--model <id>", "Provider-prefixed model ID; overrides request file and config").option("--endpoint <url>", "Runtime base URL including /v1; overrides config").option("--file <path>", "JSON request file (mutually exclusive with prompt)").option("--timeout <ms>", "Total deadline including streaming, in milliseconds", "60000").option(
-      "--output <format>",
-      "pretty, json or yaml; streaming json emits one chunk per line (JSONL)"
-    );
-    if (kind === "embeddings")
-      command.option("--dimensions <n>", "Embedding dimensions").option("--encoding <format>", "float or base64");
-    else
-      command.option("--stream", "Stream text (pretty) or validated events (json/JSONL)").option("--max-tokens <n>", "Maximum completion/output tokens");
-    command.action(async (prompt, opts) => {
-      const controller = new AbortController();
-      const interrupt = () => controller.abort(new Error("Inference interrupted"));
-      const outputError = (error) => controller.abort(error);
-      let stream;
-      let failed = false;
-      let failure3;
-      try {
-        const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
-        const config = await loadConfig({ aiGwInferenceEndpoint: opts.endpoint });
-        const body = await inferenceBody(
-          kind,
-          prompt,
-          opts,
-          kind === "embeddings" ? config.aiGwEmbeddingModel : config.aiGwInferenceModel
-        );
-        if (body.stream === true && format === "yaml")
-          throw new CliUsageError("Streaming supports --output pretty or json (JSONL), not yaml");
-        const schema = kind === "chat" ? GatewayInferenceInputCreateChatCompletionRequestSchema : kind === "responses" ? GatewayInferenceInputCreateResponseSchema : GatewayInferenceInputCreateEmbeddingRequestSchema;
-        const parsed = schema.safeParse(body);
-        if (!parsed.success)
-          throw new CliUsageError(
-            `Invalid inference request: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.code}`).join("; ")}`
-          );
-        const client = new AIGatewayInferenceClient({
-          endpoint: config.aiGwInferenceEndpoint,
-          apiKey: config.aiGwInferenceApiKey,
-          timeoutMs: integer2(opts.timeout ?? "60000", "--timeout"),
-          numRetries: 0
-        });
-        process.once("SIGINT", interrupt);
-        process.once("SIGTERM", interrupt);
-        process.stdout.on("error", outputError);
-        const write = (text2) => new Promise((resolve10, reject) => {
-          process.stdout.write(text2, (error) => error ? reject(error) : resolve10());
-        });
-        const requestOptions = { signal: controller.signal };
-        const result = kind === "chat" ? await client.createChatCompletion(
-          GatewayInferenceInputCreateChatCompletionRequestSchema.parse(body),
-          requestOptions
-        ) : kind === "responses" ? await client.createResponse(
-          GatewayInferenceInputCreateResponseSchema.parse(body),
-          requestOptions
-        ) : await client.createEmbedding(
-          GatewayInferenceInputCreateEmbeddingRequestSchema.parse(body),
-          requestOptions
-        );
-        if (Symbol.asyncIterator in result) {
-          stream = result;
-          for await (const event of result) {
-            if (format === "json") await write(`${JSON.stringify(event)}
-`);
-            else {
-              const text2 = responseText(event);
-              if (text2) await write(text2);
-            }
-            if ("type" in event && (event.type === "response.failed" || event.type === "response.incomplete"))
-              throw new Error(`Gateway generation ended with ${event.type}`);
-          }
-          if (format === "pretty") await write("\n");
-        } else {
-          const text2 = format === "yaml" ? dump4(result, { noRefs: true }).trimEnd() : format === "pretty" && kind !== "embeddings" ? responseText(result) : JSON.stringify(result, null, 2);
-          await write(`${text2}
-`);
-          if ("status" in result && (result.status === "failed" || result.status === "incomplete"))
-            throw new Error(`Gateway generation ended with ${result.status}`);
-        }
-      } catch (error) {
-        failed = true;
-        failure3 = error;
-      } finally {
-        await stream?.cancel();
-        controller.abort();
-        process.removeListener("SIGINT", interrupt);
-        process.removeListener("SIGTERM", interrupt);
-        process.stdout.removeListener("error", outputError);
-      }
-      if (failed && failure3?.code !== "EPIPE") {
-        if (failure3?.errorType === ErrorType.USER_REQUEST_PAYLOAD_ERROR)
-          usageError(failure3 instanceof Error ? failure3.message : "Invalid inference options");
-        fail(failure3);
-      }
-    });
-  }
+function addReadOutput(command) {
+  return command.option(
+    "--output <format>",
+    "Output format: pretty, table, markdown, csv, json, yaml"
+  );
 }
-
-// src/cli/commands/aigateway/inventory.ts
-import { readFile as readFile3 } from "fs/promises";
-import {
-  AI_GATEWAY_DEPLOYMENT_STATUSES,
-  AI_GATEWAY_DEPLOYMENT_TYPES,
-  AI_GATEWAY_KNOWN_API_KEY_SCOPES,
-  AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
-  AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
-  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
-  customHostConfiguration,
-  GatewayApiKeyRotateRequestSchema,
-  GatewayApiKeyUpdateRequestSchema,
-  GatewayConfigCreateRequestSchema,
-  GatewayConfigUpdateRequestSchema,
-  GatewayDeploymentCreateRequestSchema,
-  GatewayDeploymentUpdateRequestSchema,
-  GatewayGuardrailCreateRequestSchema,
-  GatewayGuardrailUpdateRequestSchema,
-  GatewayIntegrationCreateRequestSchema,
-  GatewayIntegrationModelsBulkUpdateRequestSchema,
-  GatewayIntegrationUpdateRequestSchema,
-  GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
-  GatewayOrganisationAuthSettingsUpdateRequestSchema,
-  GatewayOrganisationUpdateRequestSchema,
-  GatewayPluginCreateRequestSchema,
-  GatewayProviderCreateRequestSchema,
-  GatewayProviderUpdateRequestSchema,
-  GatewayServiceApiKeyCreateRequestSchema,
-  GatewayUserApiKeyCreateRequestSchema,
-  McpIntegrationCapabilitiesBulkUpdateRequestSchema,
-  McpIntegrationCreateRequestSchema,
-  McpIntegrationUpdateRequestSchema,
-  McpIntegrationWorkspacesBulkUpdateRequestSchema,
-  redactAIGatewaySecrets
-} from "@cdot65/prisma-airs-sdk";
-
-// src/cli/debug-logger.ts
-import {
-  appendFileSync,
-  mkdirSync,
-  readdirSync,
-  statSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { dirname, join } from "path";
-var AIRS_DOMAINS = [
-  "api.sase.paloaltonetworks.com",
-  "api.apps.paloaltonetworks.com",
-  "service.api.aisecurity.paloaltonetworks.com",
-  "auth.apps.paloaltonetworks.com",
-  "api.dlp.paloaltonetworks.com"
-];
-function isAirsUrl(url) {
+function addWriteOutput(command) {
+  return command.option("--output <format>", "Output format: pretty, json, yaml");
+}
+async function readGatewayRequest(path3) {
+  let parsed;
   try {
-    const parsed = new URL(url);
-    return AIRS_DOMAINS.some((d) => parsed.hostname === d || parsed.hostname.endsWith(`.${d}`));
-  } catch {
-    return false;
+    const text2 = await readFile(path3, "utf8");
+    parsed = path3.endsWith(".yaml") || path3.endsWith(".yml") ? load(text2) : JSON.parse(text2);
+  } catch (error) {
+    throw new CliUsageError(
+      `Unable to parse --file '${path3}' as JSON or YAML: ${error instanceof Error ? error.message : String(error)}`
+    );
   }
-}
-var MASK = "***";
-var SENSITIVE_KEY_PATTERN = /token|secret|password|passwd|credential|authorization|cookie|api[-_]?key|client[-_]?auth|auth[-_]?code|^key$/i;
-function isSensitiveKey(key) {
-  return SENSITIVE_KEY_PATTERN.test(key);
-}
-function redactHeaders(headers) {
-  const out = {};
-  for (const [k, v] of Object.entries(headers)) {
-    out[k] = isSensitiveKey(k) || /^x-portkey-(config|metadata|forward-headers)$/i.test(k) ? MASK : v;
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new CliUsageError(`--file '${path3}' must contain an object`);
   }
-  return out;
-}
-function redactDeep(value) {
-  if (Array.isArray(value)) {
-    return value.map(redactDeep);
-  }
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = isSensitiveKey(k) ? MASK : redactDeep(v);
-    }
-    return out;
-  }
-  return value;
-}
-function redactUrl(url) {
-  try {
-    const parsed = new URL(url);
-    let touched = false;
-    for (const key of parsed.searchParams.keys()) {
-      if (isSensitiveKey(key)) {
-        parsed.searchParams.set(key, MASK);
-        touched = true;
-      }
-    }
-    return touched ? parsed.toString() : url;
-  } catch {
-    return url;
-  }
-}
-function headersToRecord(headers) {
-  if (!headers) return {};
-  if (typeof headers === "object" && "forEach" in headers && typeof headers.forEach === "function") {
-    const out = {};
-    headers.forEach((v, k) => {
-      out[k] = v;
-    });
-    return out;
-  }
-  if (Array.isArray(headers)) {
-    return Object.fromEntries(headers);
-  }
-  return headers;
-}
-function installDebugLogger(logPath, options = {}) {
-  mkdirSync(dirname(logPath), { recursive: true, mode: 448 });
-  writeFileSync(logPath, "", { encoding: "utf8", mode: 384, flag: "wx" });
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = async function debugFetch(input2, init2) {
-    const url = typeof input2 === "string" ? input2 : input2 instanceof URL ? input2.toString() : input2.url;
-    const rawHeaders = headersToRecord(
-      init2?.headers ?? (input2 instanceof Request ? input2.headers : void 0)
-    );
-    const inference = Object.keys(rawHeaders).some(
-      (name) => name.toLowerCase() === "x-portkey-api-key"
-    );
-    if (!isAirsUrl(url) && !inference) {
-      return originalFetch(input2, init2);
-    }
-    const dashboard = options.omitBodies || /\/v1\/mgmt\/(dashboard\/|reports\/scancontent(?:\?|$))/.test(url) || /\/aiag\//.test(new URL(url).pathname);
-    const method = init2?.method ?? (input2 instanceof Request ? input2.method : "GET");
-    const reqHeaders = redactHeaders(rawHeaders);
-    const loggedUrl = redactUrl(url);
-    let reqBody;
-    if (inference || dashboard) reqBody = "[BODY OMITTED]";
-    else if (init2?.body) {
-      try {
-        reqBody = redactDeep(JSON.parse(String(init2.body)));
-      } catch {
-        const contentType = new Headers(rawHeaders).get("content-type") ?? "";
-        reqBody = contentType.includes("application/x-www-form-urlencoded") ? redactDeep(Object.fromEntries(new URLSearchParams(String(init2.body)))) : "[NON-JSON BODY OMITTED]";
-      }
-    }
-    const ts2 = (/* @__PURE__ */ new Date()).toISOString();
-    const startMs = Date.now();
-    let response;
-    let resBody;
-    let error;
-    try {
-      response = await originalFetch(input2, init2);
-    } catch (err) {
-      error = inference ? "Runtime request failed" : "Request failed";
-      const entry2 = JSON.stringify({
-        timestamp: ts2,
-        durationMs: Date.now() - startMs,
-        request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
-        error
-      });
-      appendFileSync(logPath, `${entry2}
-`);
-      throw err;
-    }
-    const durationMs = Date.now() - startMs;
-    const resHeaders = {};
-    response.headers.forEach((v, k) => {
-      resHeaders[k] = v;
-    });
-    if (inference || dashboard || response.headers.get("content-type")?.includes("text/event-stream")) {
-      resBody = "[BODY OMITTED]";
-    } else {
-      const clone = response.clone();
-      try {
-        const text2 = await clone.text();
-        try {
-          resBody = redactDeep(JSON.parse(text2));
-        } catch {
-          resBody = "[NON-JSON BODY OMITTED]";
-        }
-      } catch {
-        resBody = "<unreadable>";
-      }
-    }
-    const entry = JSON.stringify({
-      timestamp: ts2,
-      durationMs,
-      request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
-      response: {
-        status: response.status,
-        statusText: response.statusText,
-        headers: redactHeaders(resHeaders),
-        body: resBody
-      }
-    });
-    appendFileSync(logPath, `${entry}
-`);
-    return response;
-  };
-  return {
-    teardown() {
-      globalThis.fetch = originalFetch;
-    }
-  };
-}
-
-// src/cli/tenant-input.ts
-import { input, password } from "@inquirer/prompts";
-async function promptTenantValue(message, secret = false) {
-  if (!process.stdin.isTTY || !process.stderr.isTTY)
-    throw new Error(
-      "Interactive setup requires a terminal. Use --config, or --tsg-id and --client-id with --client-secret-stdin. For tenant set, pass a value or use --stdin."
-    );
-  const prompt = secret ? password : input;
-  return prompt(
-    {
-      message,
-      validate: (value) => Boolean(value.trim()) || "A nonempty value is required"
-    },
-    { input: process.stdin, output: process.stderr }
-  );
-}
-async function readTenantStdin() {
-  if (process.stdin.isTTY) throw new Error("--stdin requires piped input");
-  const chunks = [];
-  let size = 0;
-  for await (const chunk of process.stdin) {
-    const buffer = Buffer.from(chunk);
-    size += buffer.length;
-    if (size > 65536) throw new Error("Configuration input exceeds 64 KiB");
-    chunks.push(buffer);
-  }
-  const value = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
-  if (!value.trim() || /[\r\n\0]/.test(value))
-    throw new Error("Provide one nonempty configuration value on stdin");
-  return value;
-}
-
-// src/cli/commands/aigateway/shared.ts
-import { open, readFile as readFile2, unlink } from "fs/promises";
-import { AIGatewayClient as AIGatewayClient2 } from "@cdot65/prisma-airs-sdk";
-import { dump as dump5, load } from "js-yaml";
-async function defaultClientFactory() {
-  const config = await loadConfig();
-  return new AIGatewayClient2(aiGatewayClientOptions(config));
-}
-var clientFactory = defaultClientFactory;
-async function createAiGatewayClient() {
-  return clientFactory();
-}
-function showHelpOnEmpty(command) {
-  return command.action(() => command.outputHelp());
-}
-function addReadOutput(command) {
-  return command.option(
-    "--output <format>",
-    "Output format: pretty, table, markdown, csv, json, yaml"
-  );
-}
-function addWriteOutput(command) {
-  return command.option("--output <format>", "Output format: pretty, json, yaml");
-}
-async function readGatewayRequest(path3) {
-  let parsed;
-  try {
-    const text2 = await readFile2(path3, "utf8");
-    parsed = path3.endsWith(".yaml") || path3.endsWith(".yml") ? load(text2) : JSON.parse(text2);
-  } catch (error) {
-    throw new CliUsageError(
-      `Unable to parse --file '${path3}' as JSON or YAML: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new CliUsageError(`--file '${path3}' must contain an object`);
-  }
-  return parsed;
+  return parsed;
 }
 function failAiGateway(error) {
   const hint = aiGatewayGrantHint(error);
@@ -4045,7 +3654,7 @@ function renderGatewayList(items, format, label2) {
     return;
   }
   if (format === "yaml") {
-    console.log(dump5(items, { noRefs: true, lineWidth: -1 }).trimEnd());
+    console.log(dump4(items, { noRefs: true, lineWidth: -1 }).trimEnd());
     return;
   }
   if (items.length === 0) {
@@ -4063,7 +3672,7 @@ function renderGatewayDetail(value, format) {
     return;
   }
   if (format === "yaml") {
-    console.log(dump5(item, { noRefs: true, lineWidth: -1 }).trimEnd());
+    console.log(dump4(item, { noRefs: true, lineWidth: -1 }).trimEnd());
     return;
   }
   const rows = Object.entries(item).map(([key, raw]) => ({
@@ -4179,7 +3788,7 @@ async function runSecretWrite(command, opts, prepare, write, prompt, settings =
 import {
   AISecSDKException,
   buildDottedObject,
-  ErrorType as ErrorType2,
+  ErrorType,
   GatewayJsonObjectSchema,
   setDottedValue
 } from "@cdot65/prisma-airs-sdk";
@@ -4242,119 +3851,651 @@ function parseBooleanBindingsOption(value) {
     return { id, enabled: parseBooleanOption(enabled) };
   });
 }
-function parseModelBindingsOption(value) {
-  return repeatableValues(value).map((raw) => {
-    const [slug, enabled] = splitKeyValue(raw, "slug");
-    return { slug, enabled: parseBooleanOption(enabled) };
-  });
+function parseModelBindingsOption(value) {
+  return repeatableValues(value).map((raw) => {
+    const [slug, enabled] = splitKeyValue(raw, "slug");
+    return { slug, enabled: parseBooleanOption(enabled) };
+  });
+}
+function parseCapabilityBindingsOption(value) {
+  return repeatableValues(value).map((raw) => {
+    const [identity2, enabled] = splitKeyValue(raw, "type:name");
+    const separator = identity2.indexOf(":");
+    if (separator <= 0 || separator === identity2.length - 1) {
+      throw new CliUsageError("Expected type:name=enabled");
+    }
+    return {
+      type: identity2.slice(0, separator),
+      name: identity2.slice(separator + 1),
+      enabled: parseBooleanOption(enabled)
+    };
+  });
+}
+function parseStringMapOption(value) {
+  const result = {};
+  for (const raw of repeatableValues(value)) {
+    const [key, item] = splitKeyValue(raw, "key");
+    if (["__proto__", "constructor", "prototype"].includes(key)) {
+      throw new CliUsageError(`Unsafe key: ${key}`);
+    }
+    if (Object.hasOwn(result, key)) throw new CliUsageError(`Duplicate key: ${key}`);
+    result[key] = item;
+  }
+  return result;
+}
+function parseAssignment(raw, forceString) {
+  const separator = raw.indexOf("=");
+  if (separator <= 0) throw new CliUsageError("Expected path=value");
+  const path3 = raw.slice(0, separator);
+  const text2 = raw.slice(separator + 1);
+  if (forceString) return [path3, text2];
+  try {
+    return [path3, JSON.parse(text2)];
+  } catch {
+    return [path3, text2];
+  }
+}
+function schemaMessage(error) {
+  const issues = error?.issues;
+  if (!Array.isArray(issues) || issues.length === 0)
+    return "request body does not match its schema";
+  return issues.map((issue) => {
+    const path3 = issue.path?.length ? issue.path.map(String).join(".") : "<root>";
+    return `${path3}: ${issue.message ?? "invalid value"}`;
+  }).join("; ");
+}
+function optionName(option) {
+  return `--${option.replace(/[A-Z]/g, (character) => `-${character.toLowerCase()}`)}`;
+}
+function asUsageError(error, prefix = "Invalid AI Gateway request") {
+  if (error instanceof CliUsageError) return error;
+  if (error instanceof AISecSDKException && error.errorType === ErrorType.USER_REQUEST_PAYLOAD_ERROR) {
+    return new CliUsageError(`${prefix}: ${error.message}`);
+  }
+  return new CliUsageError(`${prefix}: ${schemaMessage(error)}`);
+}
+async function buildStructuredRequest(options, schema, fields = []) {
+  try {
+    let body = {};
+    if (options.file) {
+      body = GatewayJsonObjectSchema.parse(await readGatewayRequest(options.file));
+    }
+    for (const field of fields) {
+      const raw = options[field.option];
+      if (raw === void 0 || Array.isArray(raw) && raw.length === 0) continue;
+      let value;
+      try {
+        value = field.parse ? field.parse(raw) : raw;
+      } catch (error) {
+        if (error instanceof CliUsageError) {
+          throw new CliUsageError(`Invalid ${optionName(field.option)}: ${error.message}`);
+        }
+        throw error;
+      }
+      body = setDottedValue(body, field.path, value);
+    }
+    const assignments = [
+      ...(options.set ?? []).map((raw) => {
+        try {
+          const [path3, value] = parseAssignment(raw, false);
+          return { path: path3, value };
+        } catch (error) {
+          if (error instanceof CliUsageError) {
+            throw new CliUsageError(`Invalid --set '${raw}': ${error.message}`);
+          }
+          throw error;
+        }
+      }),
+      ...(options.setString ?? []).map((raw) => {
+        try {
+          const [path3, value] = parseAssignment(raw, true);
+          return { path: path3, value };
+        } catch (error) {
+          if (error instanceof CliUsageError) {
+            throw new CliUsageError(`Invalid --set-string '${raw}': ${error.message}`);
+          }
+          throw error;
+        }
+      })
+    ];
+    buildDottedObject(assignments);
+    for (const { path: path3, value } of assignments) body = setDottedValue(body, path3, value);
+    return schema.parse(body);
+  } catch (error) {
+    throw asUsageError(error);
+  }
+}
+
+// src/cli/commands/aigateway/admin-guardrails.ts
+function paginationInteger(value, flag, minimum, maximum) {
+  try {
+    const parsed = parseIntegerOption(value);
+    if (parsed < minimum || parsed > maximum) {
+      throw new CliUsageError(`${flag} must be an integer from ${minimum} to ${maximum}`);
+    }
+    return parsed;
+  } catch (error) {
+    fail(error);
+  }
+}
+function registerAdminGuardrails(root) {
+  const group = showHelpOnEmpty(
+    root.command("admin-guardrails").description(
+      "Manage organisation guardrails on the admin plane (mutations specification-tested)"
+    )
+  );
+  const list = addReadOutput(
+    group.command("list").alias("ls").description(
+      "List organisation guardrails; optional workspace filtering may be denied by policy"
+    ).option("--workspace <uuid>", "Optional workspace UUID filter").option(
+      "--page-size <number>",
+      "Page size, 1\u20131000",
+      (value) => paginationInteger(value, "--page-size", 1, 1e3)
+    ).option(
+      "--current-page <number>",
+      "Zero-based page number",
+      (value) => paginationInteger(value, "--current-page", 0, Number.MAX_SAFE_INTEGER)
+    )
+  );
+  list.action(
+    (opts) => runList(
+      list,
+      opts,
+      "Admin guardrails",
+      (c) => c.adminGuardrails.list({
+        workspaceId: opts.workspace,
+        pageSize: opts.pageSize,
+        currentPage: opts.currentPage
+      })
+    )
+  );
+  const get = addReadOutput(
+    group.command("get <id>").description("Read an admin guardrail by UUID")
+  );
+  get.action((id, opts) => runDetail(get, opts, (c) => c.adminGuardrails.get(id)));
+  const fields = [
+    { option: "name", path: "name" },
+    { option: "checks", path: "checks", parse: parseJsonOption },
+    { option: "actions", path: "actions", parse: parseJsonOption }
+  ];
+  const common = (cmd) => addWriteOutput(
+    addStructuredInputOptions(
+      cmd.option("--name <name>", "Guardrail name").option("--checks <json>", "Checks array").option("--actions <json>", "Actions object")
+    )
+  );
+  const create = common(
+    group.command("create").description("Create an admin guardrail (specification-tested; no workspace fallback)")
+  ).option("--target <target>", "llm or mcp_tools").option("--workspace <uuid>", "Optional workspace UUID").option("--organisation <uuid>", "Optional organisation UUID, not the numeric TSG");
+  create.action(
+    (opts) => runWrite(
+      create,
+      opts,
+      () => buildStructuredRequest(opts, GatewayAdminGuardrailCreateRequestSchema, [
+        ...fields,
+        { option: "target", path: "target" },
+        { option: "workspace", path: "workspace_id" },
+        { option: "organisation", path: "organisation_id" }
+      ]),
+      (c, body) => c.adminGuardrails.create(body)
+    )
+  );
+  const update = common(
+    group.command("update <id>").description("Update an admin guardrail (specification-tested)")
+  );
+  update.action(
+    (id, opts) => runWrite(
+      update,
+      opts,
+      () => buildStructuredRequest(opts, GatewayGuardrailUpdateRequestSchema, fields),
+      (c, body) => c.adminGuardrails.update(id, body)
+    )
+  );
+  const remove = addWriteOutput(
+    group.command("delete <id>").alias("rm").description("Permanently delete an admin guardrail").option("--force", "Skip confirmation prompt")
+  );
+  remove.action(
+    (id, opts) => runConfirmedWrite(
+      remove,
+      opts,
+      `Permanently delete admin guardrail ${id}?`,
+      (c) => c.adminGuardrails.delete(id)
+    )
+  );
+  const mappings = showHelpOnEmpty(
+    group.command("mcp-servers").description("Manage admin guardrail MCP mappings; does not sign in to MCP")
+  );
+  const mappingsList = addReadOutput(
+    mappings.command("list <guardrail-id>").alias("ls").description("List MCP mappings")
+  );
+  mappingsList.action(
+    (id, opts) => runList(mappingsList, opts, "MCP mappings", (c) => c.adminGuardrails.getMcpServers(id))
+  );
+  const sync = addWriteOutput(
+    addStructuredInputOptions(
+      mappings.command("sync <guardrail-id>").description("Replace all mappings (specification-tested)").option("--force", "Skip replacement confirmation")
+    )
+  );
+  sync.action(
+    (id, opts) => runConfirmedWrite(
+      sync,
+      opts,
+      `Replace all MCP mappings on admin guardrail ${id}?`,
+      () => buildStructuredRequest(opts, GatewayAdminGuardrailMcpSyncRequestSchema),
+      (c, body) => c.adminGuardrails.syncMcpServers(id, body)
+    )
+  );
+  const upsert = addWriteOutput(
+    addStructuredInputOptions(
+      mappings.command("upsert <guardrail-id> <server-id>").description("Set one mapping (specification-tested)")
+    )
+  );
+  upsert.action(
+    (id, serverId, opts) => runWrite(
+      upsert,
+      opts,
+      () => buildStructuredRequest(opts, GatewayAdminGuardrailMcpMappingRequestSchema),
+      (c, body) => c.adminGuardrails.upsertMcpServer(id, serverId, body)
+    )
+  );
+}
+
+// src/cli/commands/aigateway/inference.ts
+import { readFile as readFile2 } from "fs/promises";
+import {
+  AIGatewayInferenceClient,
+  ErrorType as ErrorType2,
+  GatewayInferenceInputCreateChatCompletionRequestSchema,
+  GatewayInferenceInputCreateEmbeddingRequestSchema,
+  GatewayInferenceInputCreateResponseSchema
+} from "@cdot65/prisma-airs-sdk";
+import { dump as dump5 } from "js-yaml";
+function integer2(raw, flag) {
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < 1)
+    throw new CliUsageError(`${flag} must be a positive integer`);
+  return value;
+}
+async function inferenceBody(kind, prompt, opts, defaultModel) {
+  if (prompt !== void 0 && opts.file)
+    throw new CliUsageError("Pass a prompt or --file, not both");
+  if (prompt === void 0 && !opts.file) throw new CliUsageError("A prompt or --file is required");
+  let body;
+  if (opts.file) {
+    let value;
+    try {
+      value = JSON.parse(await readFile2(opts.file, "utf8"));
+    } catch {
+      throw new CliUsageError("--file must name a readable JSON request file");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new CliUsageError("--file must contain a JSON object");
+    body = value;
+  } else {
+    body = kind === "chat" ? { messages: [{ role: "user", content: prompt }] } : { input: prompt };
+  }
+  body = { ...body };
+  const model = opts.model ?? body.model ?? defaultModel;
+  if (typeof model !== "string" || !model.trim())
+    throw new CliUsageError(
+      "Set --model, the request model, or the matching inference model config"
+    );
+  body.model = model;
+  if (opts.stream !== void 0) body.stream = opts.stream;
+  if (opts.maxTokens !== void 0)
+    body[kind === "responses" ? "max_output_tokens" : "max_completion_tokens"] = integer2(
+      opts.maxTokens,
+      "--max-tokens"
+    );
+  if (opts.dimensions !== void 0) body.dimensions = integer2(opts.dimensions, "--dimensions");
+  if (opts.encoding !== void 0) body.encoding_format = opts.encoding;
+  if (kind === "responses" && body.store === void 0) body.store = false;
+  return body;
+}
+function responseText(value) {
+  if (!value || typeof value !== "object") return "";
+  const record = value;
+  if (record.type === "response.output_text.delta" && typeof record.delta === "string")
+    return record.delta;
+  if (Array.isArray(record.choices))
+    return record.choices.map((choice) => choice.message?.content ?? choice.delta?.content ?? "").join("");
+  if (Array.isArray(record.output))
+    return record.output.flatMap((item) => Array.isArray(item.content) ? item.content : []).filter((part) => part.type === "output_text").map((part) => part.text).join("");
+  return "";
+}
+function registerAiGatewayInference(parent) {
+  const group = parent.command("inference").description("Call the gateway runtime (separate API key; no SCM OAuth required)");
+  for (const kind of ["chat", "responses", "embeddings"]) {
+    const command = group.command(`${kind} [prompt]`).description(
+      `${kind === "embeddings" ? "Create embeddings" : "Generate a model response"} through your runtime gateway`
+    ).option("--model <id>", "Provider-prefixed model ID; overrides request file and config").option("--endpoint <url>", "Runtime base URL including /v1; overrides config").option("--file <path>", "JSON request file (mutually exclusive with prompt)").option("--timeout <ms>", "Total deadline including streaming, in milliseconds", "60000").option(
+      "--output <format>",
+      "pretty, json or yaml; streaming json emits one chunk per line (JSONL)"
+    );
+    if (kind === "embeddings")
+      command.option("--dimensions <n>", "Embedding dimensions").option("--encoding <format>", "float or base64");
+    else
+      command.option("--stream", "Stream text (pretty) or validated events (json/JSONL)").option("--max-tokens <n>", "Maximum completion/output tokens");
+    command.action(async (prompt, opts) => {
+      const controller = new AbortController();
+      const interrupt = () => controller.abort(new Error("Inference interrupted"));
+      const outputError = (error) => controller.abort(error);
+      let stream;
+      let failed = false;
+      let failure3;
+      try {
+        const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
+        const config = await loadConfig({ aiGwInferenceEndpoint: opts.endpoint });
+        const body = await inferenceBody(
+          kind,
+          prompt,
+          opts,
+          kind === "embeddings" ? config.aiGwEmbeddingModel : config.aiGwInferenceModel
+        );
+        if (body.stream === true && format === "yaml")
+          throw new CliUsageError("Streaming supports --output pretty or json (JSONL), not yaml");
+        const schema = kind === "chat" ? GatewayInferenceInputCreateChatCompletionRequestSchema : kind === "responses" ? GatewayInferenceInputCreateResponseSchema : GatewayInferenceInputCreateEmbeddingRequestSchema;
+        const parsed = schema.safeParse(body);
+        if (!parsed.success)
+          throw new CliUsageError(
+            `Invalid inference request: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.code}`).join("; ")}`
+          );
+        const client = new AIGatewayInferenceClient({
+          endpoint: config.aiGwInferenceEndpoint,
+          apiKey: config.aiGwInferenceApiKey,
+          timeoutMs: integer2(opts.timeout ?? "60000", "--timeout"),
+          numRetries: 0
+        });
+        process.once("SIGINT", interrupt);
+        process.once("SIGTERM", interrupt);
+        process.stdout.on("error", outputError);
+        const write = (text2) => new Promise((resolve10, reject) => {
+          process.stdout.write(text2, (error) => error ? reject(error) : resolve10());
+        });
+        const requestOptions = { signal: controller.signal };
+        const result = kind === "chat" ? await client.createChatCompletion(
+          GatewayInferenceInputCreateChatCompletionRequestSchema.parse(body),
+          requestOptions
+        ) : kind === "responses" ? await client.createResponse(
+          GatewayInferenceInputCreateResponseSchema.parse(body),
+          requestOptions
+        ) : await client.createEmbedding(
+          GatewayInferenceInputCreateEmbeddingRequestSchema.parse(body),
+          requestOptions
+        );
+        if (Symbol.asyncIterator in result) {
+          stream = result;
+          for await (const event of result) {
+            if (format === "json") await write(`${JSON.stringify(event)}
+`);
+            else {
+              const text2 = responseText(event);
+              if (text2) await write(text2);
+            }
+            if ("type" in event && (event.type === "response.failed" || event.type === "response.incomplete"))
+              throw new Error(`Gateway generation ended with ${event.type}`);
+          }
+          if (format === "pretty") await write("\n");
+        } else {
+          const text2 = format === "yaml" ? dump5(result, { noRefs: true }).trimEnd() : format === "pretty" && kind !== "embeddings" ? responseText(result) : JSON.stringify(result, null, 2);
+          await write(`${text2}
+`);
+          if ("status" in result && (result.status === "failed" || result.status === "incomplete"))
+            throw new Error(`Gateway generation ended with ${result.status}`);
+        }
+      } catch (error) {
+        failed = true;
+        failure3 = error;
+      } finally {
+        await stream?.cancel();
+        controller.abort();
+        process.removeListener("SIGINT", interrupt);
+        process.removeListener("SIGTERM", interrupt);
+        process.stdout.removeListener("error", outputError);
+      }
+      if (failed && failure3?.code !== "EPIPE") {
+        if (failure3?.errorType === ErrorType2.USER_REQUEST_PAYLOAD_ERROR)
+          usageError(failure3 instanceof Error ? failure3.message : "Invalid inference options");
+        fail(failure3);
+      }
+    });
+  }
+}
+
+// src/cli/commands/aigateway/inventory.ts
+import { readFile as readFile3 } from "fs/promises";
+import {
+  AI_GATEWAY_DEPLOYMENT_STATUSES,
+  AI_GATEWAY_DEPLOYMENT_TYPES,
+  AI_GATEWAY_KNOWN_API_KEY_SCOPES,
+  AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
+  AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
+  customHostConfiguration,
+  GatewayApiKeyRotateRequestSchema,
+  GatewayApiKeyUpdateRequestSchema,
+  GatewayConfigCreateRequestSchema,
+  GatewayConfigUpdateRequestSchema,
+  GatewayDeploymentCreateRequestSchema,
+  GatewayDeploymentUpdateRequestSchema,
+  GatewayGuardrailCreateRequestSchema,
+  GatewayGuardrailUpdateRequestSchema as GatewayGuardrailUpdateRequestSchema2,
+  GatewayIntegrationCreateRequestSchema,
+  GatewayIntegrationModelsBulkUpdateRequestSchema,
+  GatewayIntegrationUpdateRequestSchema,
+  GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
+  GatewayOrganisationAuthSettingsUpdateRequestSchema,
+  GatewayOrganisationUpdateRequestSchema,
+  GatewayPluginCreateRequestSchema,
+  GatewayProviderCreateRequestSchema,
+  GatewayProviderUpdateRequestSchema,
+  GatewayServiceApiKeyCreateRequestSchema,
+  GatewayUserApiKeyCreateRequestSchema,
+  McpIntegrationCapabilitiesBulkUpdateRequestSchema,
+  McpIntegrationCreateRequestSchema,
+  McpIntegrationUpdateRequestSchema,
+  McpIntegrationWorkspacesBulkUpdateRequestSchema,
+  redactAIGatewaySecrets
+} from "@cdot65/prisma-airs-sdk";
+
+// src/cli/debug-logger.ts
+import {
+  appendFileSync,
+  mkdirSync,
+  readdirSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { dirname, join } from "path";
+var AIRS_DOMAINS = [
+  "api.sase.paloaltonetworks.com",
+  "api.apps.paloaltonetworks.com",
+  "service.api.aisecurity.paloaltonetworks.com",
+  "auth.apps.paloaltonetworks.com",
+  "api.dlp.paloaltonetworks.com"
+];
+function isAirsUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return AIRS_DOMAINS.some((d) => parsed.hostname === d || parsed.hostname.endsWith(`.${d}`));
+  } catch {
+    return false;
+  }
+}
+var MASK = "***";
+var SENSITIVE_KEY_PATTERN = /token|secret|password|passwd|credential|authorization|cookie|api[-_]?key|client[-_]?auth|auth[-_]?code|^key$/i;
+function isSensitiveKey(key) {
+  return SENSITIVE_KEY_PATTERN.test(key);
 }
-function parseCapabilityBindingsOption(value) {
-  return repeatableValues(value).map((raw) => {
-    const [identity2, enabled] = splitKeyValue(raw, "type:name");
-    const separator = identity2.indexOf(":");
-    if (separator <= 0 || separator === identity2.length - 1) {
-      throw new CliUsageError("Expected type:name=enabled");
-    }
-    return {
-      type: identity2.slice(0, separator),
-      name: identity2.slice(separator + 1),
-      enabled: parseBooleanOption(enabled)
-    };
-  });
+function redactHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    out[k] = isSensitiveKey(k) || /^x-portkey-(config|metadata|forward-headers)$/i.test(k) ? MASK : v;
+  }
+  return out;
 }
-function parseStringMapOption(value) {
-  const result = {};
-  for (const raw of repeatableValues(value)) {
-    const [key, item] = splitKeyValue(raw, "key");
-    if (["__proto__", "constructor", "prototype"].includes(key)) {
-      throw new CliUsageError(`Unsafe key: ${key}`);
+function redactDeep(value) {
+  if (Array.isArray(value)) {
+    return value.map(redactDeep);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = isSensitiveKey(k) ? MASK : redactDeep(v);
     }
-    if (Object.hasOwn(result, key)) throw new CliUsageError(`Duplicate key: ${key}`);
-    result[key] = item;
+    return out;
   }
-  return result;
+  return value;
 }
-function parseAssignment(raw, forceString) {
-  const separator = raw.indexOf("=");
-  if (separator <= 0) throw new CliUsageError("Expected path=value");
-  const path3 = raw.slice(0, separator);
-  const text2 = raw.slice(separator + 1);
-  if (forceString) return [path3, text2];
+function redactUrl(url) {
   try {
-    return [path3, JSON.parse(text2)];
+    const parsed = new URL(url);
+    let touched = false;
+    for (const key of parsed.searchParams.keys()) {
+      if (isSensitiveKey(key)) {
+        parsed.searchParams.set(key, MASK);
+        touched = true;
+      }
+    }
+    return touched ? parsed.toString() : url;
   } catch {
-    return [path3, text2];
+    return url;
   }
 }
-function schemaMessage(error) {
-  const issues = error?.issues;
-  if (!Array.isArray(issues) || issues.length === 0)
-    return "request body does not match its schema";
-  return issues.map((issue) => {
-    const path3 = issue.path?.length ? issue.path.map(String).join(".") : "<root>";
-    return `${path3}: ${issue.message ?? "invalid value"}`;
-  }).join("; ");
-}
-function optionName(option) {
-  return `--${option.replace(/[A-Z]/g, (character) => `-${character.toLowerCase()}`)}`;
-}
-function asUsageError(error, prefix = "Invalid AI Gateway request") {
-  if (error instanceof CliUsageError) return error;
-  if (error instanceof AISecSDKException && error.errorType === ErrorType2.USER_REQUEST_PAYLOAD_ERROR) {
-    return new CliUsageError(`${prefix}: ${error.message}`);
+function headersToRecord(headers) {
+  if (!headers) return {};
+  if (typeof headers === "object" && "forEach" in headers && typeof headers.forEach === "function") {
+    const out = {};
+    headers.forEach((v, k) => {
+      out[k] = v;
+    });
+    return out;
   }
-  return new CliUsageError(`${prefix}: ${schemaMessage(error)}`);
+  if (Array.isArray(headers)) {
+    return Object.fromEntries(headers);
+  }
+  return headers;
 }
-async function buildStructuredRequest(options, schema, fields = []) {
-  try {
-    let body = {};
-    if (options.file) {
-      body = GatewayJsonObjectSchema.parse(await readGatewayRequest(options.file));
+function installDebugLogger(logPath, options = {}) {
+  mkdirSync(dirname(logPath), { recursive: true, mode: 448 });
+  writeFileSync(logPath, "", { encoding: "utf8", mode: 384, flag: "wx" });
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async function debugFetch(input2, init2) {
+    const url = typeof input2 === "string" ? input2 : input2 instanceof URL ? input2.toString() : input2.url;
+    const rawHeaders = headersToRecord(
+      init2?.headers ?? (input2 instanceof Request ? input2.headers : void 0)
+    );
+    const inference = Object.keys(rawHeaders).some(
+      (name) => name.toLowerCase() === "x-portkey-api-key"
+    );
+    if (!isAirsUrl(url) && !inference) {
+      return originalFetch(input2, init2);
     }
-    for (const field of fields) {
-      const raw = options[field.option];
-      if (raw === void 0 || Array.isArray(raw) && raw.length === 0) continue;
-      let value;
+    const dashboard = options.omitBodies || /\/v1\/mgmt\/(dashboard\/|reports\/scancontent(?:\?|$))/.test(url) || /\/aiag\//.test(new URL(url).pathname);
+    const method = init2?.method ?? (input2 instanceof Request ? input2.method : "GET");
+    const reqHeaders = redactHeaders(rawHeaders);
+    const loggedUrl = redactUrl(url);
+    let reqBody;
+    if (inference || dashboard) reqBody = "[BODY OMITTED]";
+    else if (init2?.body) {
       try {
-        value = field.parse ? field.parse(raw) : raw;
-      } catch (error) {
-        if (error instanceof CliUsageError) {
-          throw new CliUsageError(`Invalid ${optionName(field.option)}: ${error.message}`);
-        }
-        throw error;
+        reqBody = redactDeep(JSON.parse(String(init2.body)));
+      } catch {
+        const contentType = new Headers(rawHeaders).get("content-type") ?? "";
+        reqBody = contentType.includes("application/x-www-form-urlencoded") ? redactDeep(Object.fromEntries(new URLSearchParams(String(init2.body)))) : "[NON-JSON BODY OMITTED]";
       }
-      body = setDottedValue(body, field.path, value);
     }
-    const assignments = [
-      ...(options.set ?? []).map((raw) => {
-        try {
-          const [path3, value] = parseAssignment(raw, false);
-          return { path: path3, value };
-        } catch (error) {
-          if (error instanceof CliUsageError) {
-            throw new CliUsageError(`Invalid --set '${raw}': ${error.message}`);
-          }
-          throw error;
-        }
-      }),
-      ...(options.setString ?? []).map((raw) => {
+    const ts2 = (/* @__PURE__ */ new Date()).toISOString();
+    const startMs = Date.now();
+    let response;
+    let resBody;
+    let error;
+    try {
+      response = await originalFetch(input2, init2);
+    } catch (err) {
+      error = inference ? "Runtime request failed" : "Request failed";
+      const entry2 = JSON.stringify({
+        timestamp: ts2,
+        durationMs: Date.now() - startMs,
+        request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
+        error
+      });
+      appendFileSync(logPath, `${entry2}
+`);
+      throw err;
+    }
+    const durationMs = Date.now() - startMs;
+    const resHeaders = {};
+    response.headers.forEach((v, k) => {
+      resHeaders[k] = v;
+    });
+    if (inference || dashboard || response.headers.get("content-type")?.includes("text/event-stream")) {
+      resBody = "[BODY OMITTED]";
+    } else {
+      const clone = response.clone();
+      try {
+        const text2 = await clone.text();
         try {
-          const [path3, value] = parseAssignment(raw, true);
-          return { path: path3, value };
-        } catch (error) {
-          if (error instanceof CliUsageError) {
-            throw new CliUsageError(`Invalid --set-string '${raw}': ${error.message}`);
-          }
-          throw error;
+          resBody = redactDeep(JSON.parse(text2));
+        } catch {
+          resBody = "[NON-JSON BODY OMITTED]";
         }
-      })
-    ];
-    buildDottedObject(assignments);
-    for (const { path: path3, value } of assignments) body = setDottedValue(body, path3, value);
-    return schema.parse(body);
-  } catch (error) {
-    throw asUsageError(error);
+      } catch {
+        resBody = "<unreadable>";
+      }
+    }
+    const entry = JSON.stringify({
+      timestamp: ts2,
+      durationMs,
+      request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
+      response: {
+        status: response.status,
+        statusText: response.statusText,
+        headers: redactHeaders(resHeaders),
+        body: resBody
+      }
+    });
+    appendFileSync(logPath, `${entry}
+`);
+    return response;
+  };
+  return {
+    teardown() {
+      globalThis.fetch = originalFetch;
+    }
+  };
+}
+
+// src/cli/tenant-input.ts
+import { input, password } from "@inquirer/prompts";
+async function promptTenantValue(message, secret = false) {
+  if (!process.stdin.isTTY || !process.stderr.isTTY)
+    throw new Error(
+      "Interactive setup requires a terminal. Use --config, or --tsg-id and --client-id with --client-secret-stdin. For tenant set, pass a value or use --stdin."
+    );
+  const prompt = secret ? password : input;
+  return prompt(
+    {
+      message,
+      validate: (value) => Boolean(value.trim()) || "A nonempty value is required"
+    },
+    { input: process.stdin, output: process.stderr }
+  );
+}
+async function readTenantStdin() {
+  if (process.stdin.isTTY) throw new Error("--stdin requires piped input");
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    const buffer = Buffer.from(chunk);
+    size += buffer.length;
+    if (size > 65536) throw new Error("Configuration input exceeds 64 KiB");
+    chunks.push(buffer);
   }
+  const value = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  if (!value.trim() || /[\r\n\0]/.test(value))
+    throw new Error("Provide one nonempty configuration value on stdin");
+  return value;
 }
 
 // src/cli/commands/aigateway/inventory.ts
@@ -5202,7 +5343,7 @@ function registerAiGatewayInventory(root) {
       createSchema: GatewayGuardrailCreateRequestSchema,
       updateFields: guardrailUpdateFields,
       updateOptions: addGuardrailUpdateFields,
-      updateSchema: GatewayGuardrailUpdateRequestSchema
+      updateSchema: GatewayGuardrailUpdateRequestSchema2
     },
     {
       create: (client, body) => client.guardrails.create(body),
@@ -5634,6 +5775,7 @@ function scopeNameLooksUnrelated(name, scopeName) {
 function registerAiGatewayCommand(program) {
   const aigateway = program.command("aigateway").description("Manage and observe Prisma AIRS AI Gateway resources").action(() => aigateway.outputHelp());
   registerAiGatewayInventory(aigateway);
+  registerAdminGuardrails(aigateway);
   registerAiGatewayReportCommand(aigateway);
   registerAiGatewayInference(aigateway);
   const workspace = aigateway.command("workspaces").alias("workspace").description("Manage gateway workspaces").action(() => workspace.outputHelp());

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "7.1.5",
-  "description": "CLI and library for Palo Alto Prisma AIRS \u2014 guardrail refinement, AI red teaming, model security scanning, profile audits",
+  "version": "7.2.0",
+  "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -59,7 +59,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@cdot65/prisma-airs-sdk": "0.33.0",
+    "@cdot65/prisma-airs-sdk": "0.34.0",
     "@inquirer/prompts": "^8.3.0",
     "@typesafe-ai/sdk": "0.6.0",
     "chalk": "^5.6.2",