@cdot65/prisma-airs-sdk 0.6.7 → 0.6.9

package/README.md

@@ -24,7 +24,7 @@ Requires Node.js 18+. Zero external HTTP dependencies (native `fetch` + `crypto`
 | Service                 | Client                | Auth    | Capabilities                                               |
 | ----------------------- | --------------------- | ------- | ---------------------------------------------------------- |
 | **AI Runtime Security** | `Scanner`             | API Key | Sync/async content scanning, prompt injection detection    |
-| **Management**          | `ManagementClient`    | OAuth2  | Security profiles and custom topics CRUD                   |
+| **Management**          | `ManagementClient`    | OAuth2  | Profiles, topics, API keys, apps, DLP, deployment, logs    |
 | **Model Security**      | `ModelSecurityClient` | OAuth2  | ML model scanning, security groups, rule management        |
 | **AI Red Teaming**      | `RedTeamClient`       | OAuth2  | Automated red team scans, reports, targets, custom attacks |
 
@@ -53,28 +53,20 @@ console.log(result.action); // "allow" | "block"
 
 ### Management — Configuration CRUD (OAuth2)
 
-CRUD operations for all three Prisma AIRS services use OAuth2:
-
 ```ts
 import { ManagementClient } from '@cdot65/prisma-airs-sdk';
 
 const client = new ManagementClient(); // reads PANW_MGMT_* env vars
 
-// Security Profiles
-const profiles = await client.profiles.list();
-const created = await client.profiles.create({
-  profile_name: 'my-profile',
-  active: true,
-  policy: {
-    /* ... */
-  },
-});
-
-// Custom Topics
-const topic = await client.topics.create({
-  topic_name: 'pii-detector',
-  examples: ['SSN: 123-45-6789'],
-});
+// 8 sub-clients available:
+client.profiles; // AI security profile CRUD
+client.topics; // Custom detection topic CRUD
+client.apiKeys; // API key lifecycle (create, list, regenerate, delete)
+client.customerApps; // Customer application management
+client.dlpProfiles; // DLP data profile listing
+client.deploymentProfiles; // Deployment profile listing
+client.scanLogs; // Scan activity log queries
+client.oauth; // OAuth token management (get/invalidate)
 ```
 
 ### Model Security — ML Model Scanning (OAuth2)
@@ -84,6 +76,7 @@ import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
 
 const client = new ModelSecurityClient(); // falls back to PANW_MGMT_* env vars
 
+// 3 sub-clients: scans, securityGroups, securityRules
 const scans = await client.scans.list({ limit: 10 });
 const groups = await client.securityGroups.list();
 const rules = await client.securityRules.list();
@@ -96,6 +89,7 @@ import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
 
 const client = new RedTeamClient(); // falls back to PANW_MGMT_* env vars
 
+// 5 sub-clients: scans, reports, customAttackReports, targets, customAttacks
 const scans = await client.scans.list({ limit: 5 });
 const targets = await client.targets.list();
 const categories = await client.scans.getCategories();
@@ -118,15 +112,6 @@ export PANW_MGMT_CLIENT_SECRET=your-client-secret
 export PANW_MGMT_TSG_ID=1234567890
 ```
 
-## Scanner Methods
-
-| Method                                | Description                                |
-| ------------------------------------- | ------------------------------------------ |
-| `syncScan(aiProfile, content, opts?)` | Synchronous inline scan                    |
-| `asyncScan(scanObjects)`              | Batch async scan (up to 5)                 |
-| `queryByScanIds(scanIds)`             | Get results by scan IDs (up to 5)          |
-| `queryByReportIds(reportIds)`         | Get threat reports by report IDs (up to 5) |
-
 ## Error Handling
 
 ```ts
@@ -153,7 +138,7 @@ Full documentation at **[cdot65.github.io/prisma-airs-sdk](https://cdot65.github
 ```bash
 npm install
 npm run build          # tsup (CJS + ESM + .d.ts)
-npm run test           # vitest (617 tests, 99%+ coverage)
+npm run test           # vitest (829 tests, 99%+ coverage)
 npm run lint           # eslint
 npm run typecheck      # tsc --noEmit
 ```

package/dist/index.cjs

@@ -29,8 +29,10 @@ __export(index_exports, {
   Action: () => Action,
   AgentEntrySchema: () => AgentEntrySchema,
   AgentMetaSchema: () => AgentMetaSchema,
+  AgentProtectionItemSchema: () => AgentProtectionItemSchema,
   AgentReportSchema: () => AgentReportSchema,
   AiProfileSchema: () => AiProfileSchema,
+  AiSecurityProfileSchema: () => AiSecurityProfileSchema,
   ApiEndpointType: () => ApiEndpointType,
   ApiKeyCreateRequestSchema: () => ApiKeyCreateRequestSchema,
   ApiKeyDPInfoSchema: () => ApiKeyDPInfoSchema,
@@ -106,6 +108,9 @@ __export(index_exports, {
   DSDetailResultSchema: () => DSDetailResultSchema,
   DSResultMetadataSchema: () => DSResultMetadataSchema,
   DashboardOverviewResponseSchema: () => DashboardOverviewResponseSchema,
+  DataLeakDetectionMemberSchema: () => DataLeakDetectionMemberSchema,
+  DataProtectionSchema: () => DataProtectionSchema,
+  DatabaseSecurityItemSchema: () => DatabaseSecurityItemSchema,
   DatabricksConnectionParamsSchema: () => DatabricksConnectionParamsSchema,
   DateRangeFilter: () => DateRangeFilter,
   DbsEntrySchema: () => DbsEntrySchema,
@@ -119,11 +124,13 @@ __export(index_exports, {
   DeploymentProfilesResponseSchema: () => DeploymentProfilesResponseSchema,
   DetectionServiceName: () => DetectionServiceName,
   DetectionServiceResultSchema: () => DetectionServiceResultSchema,
-  DlpDataProfileSchema: () => DlpDataProfileSchema2,
+  DlpDataProfilePolicySchema: () => DlpDataProfilePolicySchema,
+  DlpDataProfileSchema: () => DlpDataProfileSchema,
   DlpPatternDetectionSchema: () => DlpPatternDetectionSchema,
   DlpProfileListResponseSchema: () => DlpProfileListResponseSchema,
   DlpProfilesClient: () => DlpProfilesClient,
   DlpReportSchema: () => DlpReportSchema,
+  DlpRuleSchema: () => DlpRuleSchema,
   DynamicJobMetadataSchema: () => DynamicJobMetadataSchema,
   DynamicJobReportSchema: () => DynamicJobReportSchema,
   DynamicJobReportStatsSchema: () => DynamicJobReportStatsSchema,
@@ -215,12 +222,15 @@ __export(index_exports, {
   MODEL_SEC_TOKEN_ENDPOINT: () => MODEL_SEC_TOKEN_ENDPOINT,
   MODEL_SEC_TSG_ID: () => MODEL_SEC_TSG_ID,
   MODEL_SEC_VIOLATIONS_PATH: () => MODEL_SEC_VIOLATIONS_PATH,
+  MaliciousCodeProtectionSchema: () => MaliciousCodeProtectionSchema,
   MalwareReportSchema: () => MalwareReportSchema,
   ManagementClient: () => ManagementClient,
   MaskedDataSchema: () => MaskedDataSchema,
   McEntrySchema: () => McEntrySchema,
   McReportSchema: () => McReportSchema,
   MetadataSchema: () => MetadataSchema,
+  ModelConfigurationSchema: () => ModelConfigurationSchema,
+  ModelProtectionItemSchema: () => ModelProtectionItemSchema,
   ModelScanIssueSchema: () => ModelScanIssueSchema,
   ModelScanStatus: () => ModelScanStatus,
   ModelSecurityClient: () => ModelSecurityClient,
@@ -245,6 +255,8 @@ __export(index_exports, {
   PAYLOAD_HASH: () => PAYLOAD_HASH,
   PaginatedScanResultsSchema: () => PaginatedScanResultsSchema,
   PatternDetectionSchema: () => PatternDetectionSchema,
+  PolicyAppProtectionSchema: () => PolicyAppProtectionSchema,
+  PolicyLatencySchema: () => PolicyLatencySchema,
   PolicySchema: () => PolicySchema,
   PolicyType: () => PolicyType,
   PrerequisiteModelSchema: () => PrerequisiteModelSchema,
@@ -387,8 +399,11 @@ __export(index_exports, {
   ToolDetectedSchema: () => ToolDetectedSchema,
   ToolEventMetadataSchema: () => ToolEventMetadataSchema,
   ToolEventSchema: () => ToolEventSchema,
+  TopicArraySchema: () => TopicArraySchema,
+  TopicObjectSchema: () => TopicObjectSchema,
   TopicsClient: () => TopicsClient,
   USER_AGENT: () => USER_AGENT,
+  UrlCategorySchema: () => UrlCategorySchema,
   UrlfEntrySchema: () => UrlfEntrySchema,
   ValidationErrorSchema: () => ValidationErrorSchema,
   Verdict: () => Verdict,
@@ -430,7 +445,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.6.7";
+var SDK_VERSION = "0.6.9";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -1331,41 +1346,90 @@ var ErrorResponseSchema = import_zod15.z.object({
 
 // src/models/mgmt-security-profile.ts
 var import_zod16 = require("zod");
-var DlpDataProfileSchema = import_zod16.z.object({
-  profile_name: import_zod16.z.string(),
-  active: import_zod16.z.boolean().optional()
-}).passthrough();
-var DlpSchema = import_zod16.z.object({
-  dlp_status: import_zod16.z.string().optional(),
-  data_profiles: import_zod16.z.array(DlpDataProfileSchema).optional()
-}).passthrough();
-var DataLeakDetectionSchema = import_zod16.z.object({
-  "data-leak-detection-status": import_zod16.z.string().optional(),
-  dlp: DlpSchema.optional()
-}).passthrough();
-var AppProtectionSchema = import_zod16.z.object({
-  "prompt-injection": import_zod16.z.string().optional(),
-  "jailbreak-detection": import_zod16.z.string().optional()
-}).passthrough();
-var ModelProtectionSchema = import_zod16.z.object({
-  "model-denial-of-service": import_zod16.z.string().optional()
-}).passthrough();
-var AgentProtectionSchema = import_zod16.z.object({
-  "malicious-agent-activity": import_zod16.z.string().optional()
-}).passthrough();
-var LatencySchema = import_zod16.z.object({
-  status: import_zod16.z.string().optional(),
-  max_latency_ms: import_zod16.z.number().optional()
+var PolicyLatencySchema = import_zod16.z.object({
+  "inline-timeout-action": import_zod16.z.string().optional(),
+  "max-inline-latency": import_zod16.z.number().optional()
+}).passthrough();
+var DataLeakDetectionMemberSchema = import_zod16.z.object({
+  text: import_zod16.z.string(),
+  id: import_zod16.z.string().optional(),
+  version: import_zod16.z.string().optional()
+}).passthrough();
+var DatabaseSecurityItemSchema = import_zod16.z.object({
+  name: import_zod16.z.string(),
+  action: import_zod16.z.string()
+}).passthrough();
+var DataProtectionSchema = import_zod16.z.object({
+  "data-leak-detection": import_zod16.z.object({
+    member: import_zod16.z.array(DataLeakDetectionMemberSchema).nullable().optional(),
+    action: import_zod16.z.string(),
+    "mask-data-inline": import_zod16.z.boolean().optional()
+  }).passthrough().optional(),
+  "database-security": import_zod16.z.array(DatabaseSecurityItemSchema).nullable().optional()
+}).passthrough();
+var UrlCategorySchema = import_zod16.z.object({
+  member: import_zod16.z.array(import_zod16.z.string()).nullable().optional()
+}).passthrough();
+var MaliciousCodeProtectionSchema = import_zod16.z.object({
+  name: import_zod16.z.string(),
+  action: import_zod16.z.string()
+}).passthrough();
+var PolicyAppProtectionSchema = import_zod16.z.object({
+  "alert-url-category": UrlCategorySchema.optional(),
+  "block-url-category": UrlCategorySchema.optional(),
+  "allow-url-category": UrlCategorySchema.optional(),
+  "default-url-category": UrlCategorySchema.optional(),
+  "url-detected-action": import_zod16.z.string().optional(),
+  "malicious-code-protection": MaliciousCodeProtectionSchema.optional()
+}).passthrough();
+var TopicObjectSchema = import_zod16.z.object({
+  topic_name: import_zod16.z.string(),
+  topic_id: import_zod16.z.string(),
+  revision: import_zod16.z.number()
+}).passthrough();
+var TopicArraySchema = import_zod16.z.object({
+  action: import_zod16.z.string(),
+  topic: import_zod16.z.array(TopicObjectSchema)
+}).passthrough();
+var ModelProtectionItemSchema = import_zod16.z.object({
+  name: import_zod16.z.string(),
+  action: import_zod16.z.string(),
+  "topic-list": import_zod16.z.array(TopicArraySchema).optional()
+}).passthrough();
+var AgentProtectionItemSchema = import_zod16.z.object({
+  name: import_zod16.z.string(),
+  action: import_zod16.z.string()
+}).passthrough();
+var DlpRuleSchema = import_zod16.z.object({
+  action: import_zod16.z.string().optional()
+}).passthrough();
+var DlpDataProfilePolicySchema = import_zod16.z.object({
+  name: import_zod16.z.string(),
+  uuid: import_zod16.z.string(),
+  id: import_zod16.z.string().optional(),
+  version: import_zod16.z.string().optional(),
+  rule1: DlpRuleSchema.optional(),
+  rule2: DlpRuleSchema.optional(),
+  "log-severity": import_zod16.z.string().optional(),
+  "non-file-based": import_zod16.z.string().optional(),
+  "file-based": import_zod16.z.string().optional()
 }).passthrough();
 var ModelConfigurationSchema = import_zod16.z.object({
-  latency: LatencySchema.optional()
+  "mask-data-in-storage": import_zod16.z.boolean().optional(),
+  latency: PolicyLatencySchema.optional(),
+  "data-protection": DataProtectionSchema.optional(),
+  "app-protection": PolicyAppProtectionSchema.optional(),
+  "model-protection": import_zod16.z.array(ModelProtectionItemSchema).optional(),
+  "agent-protection": import_zod16.z.array(AgentProtectionItemSchema).optional()
+}).passthrough();
+var AiSecurityProfileSchema = import_zod16.z.object({
+  "model-type": import_zod16.z.string().optional(),
+  "content-type": import_zod16.z.string().optional(),
+  "model-configuration": ModelConfigurationSchema.optional()
 }).passthrough();
 var PolicySchema = import_zod16.z.object({
-  "data-leak-detection": DataLeakDetectionSchema.optional(),
-  "app-protection": AppProtectionSchema.optional(),
-  "model-protection": ModelProtectionSchema.optional(),
-  "agent-protection": AgentProtectionSchema.optional(),
-  "model-configuration": ModelConfigurationSchema.optional()
+  "ai-security-profiles": import_zod16.z.array(AiSecurityProfileSchema).optional(),
+  "dlp-data-profiles": import_zod16.z.array(DlpDataProfilePolicySchema).optional()
 }).passthrough();
 var SecurityProfileSchema = import_zod16.z.object({
   profile_id: import_zod16.z.string().optional(),
@@ -1555,7 +1619,7 @@ var DeploymentProfilesResponseSchema = import_zod20.z.object({
 
 // src/models/mgmt-dlp-profile.ts
 var import_zod21 = require("zod");
-var DlpDataProfileSchema2 = import_zod21.z.object({
+var DlpDataProfileSchema = import_zod21.z.object({
   name: import_zod21.z.string(),
   uuid: import_zod21.z.string(),
   id: import_zod21.z.string().optional(),
@@ -1567,7 +1631,7 @@ var DlpDataProfileSchema2 = import_zod21.z.object({
   "file-based": import_zod21.z.string().optional()
 }).passthrough();
 var DlpProfileListResponseSchema = import_zod21.z.object({
-  dlp_profiles: import_zod21.z.array(DlpDataProfileSchema2).optional()
+  dlp_profiles: import_zod21.z.array(DlpDataProfileSchema).optional()
 }).passthrough();
 
 // src/models/mgmt-scan-log.ts
@@ -3385,6 +3449,40 @@ var ProfilesClient = class {
     });
     return res.data;
   }
+  /**
+   * Get a security profile by UUID.
+   * Fetches all profiles and filters — no dedicated API endpoint exists.
+   * @param profileId - UUID of the profile to retrieve.
+   * @returns The matching security profile.
+   */
+  async get(profileId) {
+    const { ai_profiles } = await this.list();
+    const profile = ai_profiles.find((p) => p.profile_id === profileId);
+    if (!profile) {
+      throw new AISecSDKException(
+        `Profile not found: ${profileId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    return profile;
+  }
+  /**
+   * Get a security profile by name.
+   * Returns the highest-revision match (latest version).
+   * @param profileName - Name of the profile to retrieve.
+   * @returns The matching security profile with the highest revision.
+   */
+  async getByName(profileName) {
+    const { ai_profiles } = await this.list();
+    const matches = ai_profiles.filter((p) => p.profile_name === profileName);
+    if (matches.length === 0) {
+      throw new AISecSDKException(
+        `Profile not found: ${profileName}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    return matches.reduce((best, p) => (p.revision ?? 0) > (best.revision ?? 0) ? p : best);
+  }
   /**
    * Update an existing security profile.
    * @param profileId - UUID of the profile to update.
@@ -5924,8 +6022,10 @@ var RedTeamClient = class {
   Action,
   AgentEntrySchema,
   AgentMetaSchema,
+  AgentProtectionItemSchema,
   AgentReportSchema,
   AiProfileSchema,
+  AiSecurityProfileSchema,
   ApiEndpointType,
   ApiKeyCreateRequestSchema,
   ApiKeyDPInfoSchema,
@@ -6001,6 +6101,9 @@ var RedTeamClient = class {
   DSDetailResultSchema,
   DSResultMetadataSchema,
   DashboardOverviewResponseSchema,
+  DataLeakDetectionMemberSchema,
+  DataProtectionSchema,
+  DatabaseSecurityItemSchema,
   DatabricksConnectionParamsSchema,
   DateRangeFilter,
   DbsEntrySchema,
@@ -6014,11 +6117,13 @@ var RedTeamClient = class {
   DeploymentProfilesResponseSchema,
   DetectionServiceName,
   DetectionServiceResultSchema,
+  DlpDataProfilePolicySchema,
   DlpDataProfileSchema,
   DlpPatternDetectionSchema,
   DlpProfileListResponseSchema,
   DlpProfilesClient,
   DlpReportSchema,
+  DlpRuleSchema,
   DynamicJobMetadataSchema,
   DynamicJobReportSchema,
   DynamicJobReportStatsSchema,
@@ -6110,12 +6215,15 @@ var RedTeamClient = class {
   MODEL_SEC_TOKEN_ENDPOINT,
   MODEL_SEC_TSG_ID,
   MODEL_SEC_VIOLATIONS_PATH,
+  MaliciousCodeProtectionSchema,
   MalwareReportSchema,
   ManagementClient,
   MaskedDataSchema,
   McEntrySchema,
   McReportSchema,
   MetadataSchema,
+  ModelConfigurationSchema,
+  ModelProtectionItemSchema,
   ModelScanIssueSchema,
   ModelScanStatus,
   ModelSecurityClient,
@@ -6140,6 +6248,8 @@ var RedTeamClient = class {
   PAYLOAD_HASH,
   PaginatedScanResultsSchema,
   PatternDetectionSchema,
+  PolicyAppProtectionSchema,
+  PolicyLatencySchema,
   PolicySchema,
   PolicyType,
   PrerequisiteModelSchema,
@@ -6282,8 +6392,11 @@ var RedTeamClient = class {
   ToolDetectedSchema,
   ToolEventMetadataSchema,
   ToolEventSchema,
+  TopicArraySchema,
+  TopicObjectSchema,
   TopicsClient,
   USER_AGENT,
+  UrlCategorySchema,
   UrlfEntrySchema,
   ValidationErrorSchema,
   Verdict,