@cdot65/prisma-airs-cli 3.0.1 → 3.2.0

package/dist/cli/index.js

@@ -3,6 +3,7 @@ import {
   AirsScanService,
   ConfigSchema,
   RateLimitedScanService,
+  SDK_ASYNC_BATCH_SIZE,
   SdkManagementService,
   SdkModelSecurityService,
   SdkPromptSetService,
@@ -19,7 +20,7 @@ import {
   sanitizeFilename,
   validateTopic,
   writeBackupFile
-} from "../chunk-JXHYQFEK.js";
+} from "../chunk-TTBN7YHC.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -40,7 +41,7 @@ function installProcessGuards() {
 // src/cli/program.ts
 import { readFileSync as readFileSync4 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
 
@@ -1032,6 +1033,171 @@ function renderLabelValues(key, values) {
   }
   console.log();
 }
+function renderModelList(models, format = "pretty") {
+  if (models.length === 0) {
+    ui.emptyList("models");
+    return;
+  }
+  if (format !== "pretty") {
+    const rows = models.map((m) => ({
+      id: m.uuid,
+      name: m.name,
+      outcome: m.latestVersionOutcome ?? "",
+      formats: (m.latestVersionFormats ?? []).join(", "),
+      scanned: m.latestVersionScanTime ?? ""
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "id", label: "ID" },
+          { key: "name", label: "Name" },
+          { key: "outcome", label: "Outcome" },
+          { key: "formats", label: "Formats" },
+          { key: "scanned", label: "Last Scan" }
+        ],
+        format
+      )
+    );
+    return;
+  }
+  ui.section("Models:");
+  for (const m of models) {
+    ui.dim(m.uuid);
+    const outcome = m.latestVersionOutcome ? stateColor(m.latestVersionOutcome)(m.latestVersionOutcome) : chalk6.dim("unscanned");
+    const formats = m.latestVersionFormats && m.latestVersionFormats.length > 0 ? chalk6.dim(` [${m.latestVersionFormats.join(", ")}]`) : "";
+    console.log(`    ${m.name}  ${outcome}${formats}`);
+    console.log();
+  }
+}
+function renderModelDetail(model, format = "pretty") {
+  if (format !== "pretty") {
+    console.log(format === "json" ? JSON.stringify(model, null, 2) : yamlDump2(model));
+    return;
+  }
+  ui.section("Model Detail:");
+  const pairs = [
+    ["UUID", model.uuid],
+    ["Name", model.name],
+    ["Created", model.createdAt],
+    ["Updated", model.updatedAt]
+  ];
+  if (model.latestVersionUuid != null) pairs.push(["Latest Version", model.latestVersionUuid]);
+  if (model.latestVersionRevision != null)
+    pairs.push(["Latest Revision", model.latestVersionRevision]);
+  if (model.latestVersionOutcome != null)
+    pairs.push([
+      "Latest Outcome",
+      stateColor(model.latestVersionOutcome)(model.latestVersionOutcome)
+    ]);
+  if (model.latestVersionFormats?.length)
+    pairs.push(["Formats", model.latestVersionFormats.join(", ")]);
+  if (model.latestVersionSourceTypes?.length)
+    pairs.push(["Source Types", model.latestVersionSourceTypes.join(", ")]);
+  if (model.latestVersionScanTime != null) pairs.push(["Last Scan", model.latestVersionScanTime]);
+  ui.keyValue(pairs);
+  console.log();
+}
+function renderModelVersionList(versions, format = "pretty") {
+  if (versions.length === 0) {
+    ui.emptyList("versions");
+    return;
+  }
+  if (format !== "pretty") {
+    const rows = versions.map((v) => ({
+      id: v.uuid,
+      revision: v.revision,
+      files: v.fileCount ?? "",
+      outcome: v.lastEvalOutcome ?? "",
+      scanned: v.latestScanTime ?? ""
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "id", label: "ID" },
+          { key: "revision", label: "Revision" },
+          { key: "files", label: "Files" },
+          { key: "outcome", label: "Outcome" },
+          { key: "scanned", label: "Last Scan" }
+        ],
+        format
+      )
+    );
+    return;
+  }
+  ui.section("Model Versions:");
+  for (const v of versions) {
+    ui.dim(v.uuid);
+    const outcome = v.lastEvalOutcome ? stateColor(v.lastEvalOutcome)(v.lastEvalOutcome) : chalk6.dim("unscanned");
+    const files = v.fileCount != null ? `  files: ${v.fileCount}` : "";
+    console.log(`    ${v.revision}  ${outcome}${files}`);
+    console.log();
+  }
+}
+function renderModelVersionDetail(version, format = "pretty") {
+  if (format !== "pretty") {
+    console.log(format === "json" ? JSON.stringify(version, null, 2) : yamlDump2(version));
+    return;
+  }
+  ui.section("Model Version Detail:");
+  const pairs = [
+    ["UUID", version.uuid],
+    ["Model", version.modelUuid],
+    ["Revision", version.revision],
+    ["Created", version.createdAt],
+    ["Updated", version.updatedAt]
+  ];
+  if (version.fileCount != null) pairs.push(["File Count", version.fileCount]);
+  if (version.license != null) pairs.push(["License", version.license]);
+  if (version.modelFormats?.length) pairs.push(["Formats", version.modelFormats.join(", ")]);
+  if (version.sourceTypes?.length) pairs.push(["Source Types", version.sourceTypes.join(", ")]);
+  if (version.hfModelName != null) pairs.push(["HF Model", version.hfModelName]);
+  if (version.hfOrganization != null) pairs.push(["HF Organization", version.hfOrganization]);
+  if (version.lastEvalOutcome != null)
+    pairs.push(["Last Outcome", stateColor(version.lastEvalOutcome)(version.lastEvalOutcome)]);
+  if (version.latestScanTime != null) pairs.push(["Last Scan", version.latestScanTime]);
+  ui.keyValue(pairs);
+  if (version.lastEvalSummary) {
+    ui.section("Last Eval Summary:");
+    ui.keyValue([
+      ["Passed", version.lastEvalSummary.rulesPassed],
+      ["Failed", version.lastEvalSummary.rulesFailed],
+      ["Total", version.lastEvalSummary.totalRules]
+    ]);
+  }
+  console.log();
+}
+function renderModelFileList(files, format = "pretty") {
+  if (files.length === 0) {
+    ui.emptyList("files");
+    return;
+  }
+  if (format !== "pretty") {
+    const rows = files.map((f) => ({
+      id: f.uuid,
+      path: f.path,
+      type: f.type,
+      formats: f.formats.join(", "),
+      result: f.result
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "id", label: "ID" },
+          { key: "path", label: "Path" },
+          { key: "type", label: "Type" },
+          { key: "formats", label: "Formats" },
+          { key: "result", label: "Result" }
+        ],
+        format
+      )
+    );
+    return;
+  }
+  renderFileList(files);
+}
 
 // src/cli/renderer/redteam.ts
 import chalk7 from "chalk";
@@ -1582,6 +1748,170 @@ function renderRegistryCredentials(creds, format = "pretty") {
   ]);
   console.log();
 }
+function channelStatusColor(status) {
+  switch (status.toUpperCase()) {
+    case "ONLINE":
+      return chalk7.green;
+    case "DRAFT":
+      return chalk7.yellow;
+    case "OFFLINE":
+      return chalk7.red;
+    default:
+      return chalk7.white;
+  }
+}
+function renderChannelList(channels, format = "pretty") {
+  if (channels.length === 0) {
+    ui.emptyList("channels");
+    return;
+  }
+  if (format !== "pretty") {
+    const rows = channels.map((c) => ({
+      id: c.uuid ?? "",
+      name: c.name ?? "",
+      status: c.status ?? "",
+      clients: c.connectedClientsCount ?? "",
+      lastOnline: c.lastOnlineAt ?? ""
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "id", label: "ID" },
+          { key: "name", label: "Name" },
+          { key: "status", label: "Status" },
+          { key: "clients", label: "Clients" },
+          { key: "lastOnline", label: "Last Online" }
+        ],
+        format
+      )
+    );
+    return;
+  }
+  ui.section("Network Broker Channels:");
+  for (const c of channels) {
+    if (c.uuid) ui.dim(c.uuid);
+    const status = c.status ? channelStatusColor(c.status)(c.status) : chalk7.dim("unknown");
+    const clients = c.connectedClientsCount != null ? `  clients: ${c.connectedClientsCount}` : "";
+    console.log(`    ${c.name ?? "(unnamed)"}  ${status}${clients}`);
+    console.log();
+  }
+}
+function renderChannelDetail(channel, format = "pretty") {
+  if (format !== "pretty") {
+    console.log(format === "json" ? JSON.stringify(channel, null, 2) : yamlDump3(channel));
+    return;
+  }
+  ui.section("Channel Detail:");
+  const pairs = [["UUID", channel.uuid]];
+  if (channel.name != null) pairs.push(["Name", channel.name]);
+  if (channel.description != null) pairs.push(["Description", channel.description]);
+  if (channel.status != null)
+    pairs.push(["Status", channelStatusColor(channel.status)(channel.status)]);
+  if (channel.connectedClientsCount != null)
+    pairs.push(["Connected Clients", channel.connectedClientsCount]);
+  if (channel.outdatedClientsCount != null)
+    pairs.push(["Outdated Clients", channel.outdatedClientsCount]);
+  if (channel.lastOnlineAt != null) pairs.push(["Last Online", channel.lastOnlineAt]);
+  if (channel.addedBy != null) pairs.push(["Added By", channel.addedBy]);
+  if (channel.createdAt != null) pairs.push(["Created", channel.createdAt]);
+  if (channel.updatedAt != null) pairs.push(["Updated", channel.updatedAt]);
+  ui.keyValue(pairs);
+  if (channel.features && Object.keys(channel.features).length > 0) {
+    ui.section("Features:");
+    ui.keyValue(Object.entries(channel.features).map(([k, v]) => [k, v]));
+  }
+  console.log();
+}
+function renderChannelStats(stats, format = "pretty") {
+  if (format !== "pretty") {
+    console.log(format === "json" ? JSON.stringify(stats, null, 2) : yamlDump3(stats));
+    return;
+  }
+  ui.section("Network Broker Stats:");
+  const pairs = [];
+  if (stats.onlineChannels != null) pairs.push(["Online Channels", stats.onlineChannels]);
+  if (stats.totalChannels != null) pairs.push(["Total Channels", stats.totalChannels]);
+  if (stats.serverDomain != null) pairs.push(["Server Domain", stats.serverDomain]);
+  if (stats.dockerRegistry != null) pairs.push(["Docker Registry", stats.dockerRegistry]);
+  if (stats.dockerImage != null) pairs.push(["Docker Image", stats.dockerImage]);
+  if (stats.helmChart != null) pairs.push(["Helm Chart", stats.helmChart]);
+  if (stats.clientVersion != null) pairs.push(["Client Version", stats.clientVersion]);
+  ui.keyValue(pairs);
+  console.log();
+}
+function renderLanguages(data, format = "pretty") {
+  if (format !== "pretty") {
+    if (format === "json" || format === "yaml") {
+      console.log(format === "json" ? JSON.stringify(data, null, 2) : yamlDump3(data));
+      return;
+    }
+    console.log(
+      formatOutput(
+        data.languages.map((l) => ({ code: l.code, name: l.name })),
+        [
+          { key: "code", label: "Code" },
+          { key: "name", label: "Name" }
+        ],
+        format
+      )
+    );
+    return;
+  }
+  ui.section("Tenant Languages:");
+  ui.keyValue([
+    ["Multilingual", data.multilingualEnabled ? activeState(true) : activeState(false)],
+    ["Supported Job Types", data.supportedJobTypes.join(", ") || "(none)"]
+  ]);
+  if (data.languages.length === 0) {
+    ui.emptyList("languages");
+    return;
+  }
+  ui.section("Languages:");
+  for (const l of data.languages) {
+    console.log(`    ${chalk7.dim(l.code)}  ${l.name}`);
+  }
+  console.log();
+}
+function renderErrorLogs(logs, format = "pretty") {
+  if (logs.length === 0) {
+    ui.emptyList("error logs");
+    return;
+  }
+  if (format !== "pretty") {
+    const rows = logs.map((l) => ({
+      createdAt: l.createdAt,
+      errorType: l.errorType ?? "",
+      errorSource: l.errorSource ?? "",
+      jobId: l.jobId ?? "",
+      message: l.errorMessage ?? ""
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "createdAt", label: "Created" },
+          { key: "errorType", label: "Type" },
+          { key: "errorSource", label: "Source" },
+          { key: "jobId", label: "Job" },
+          { key: "message", label: "Message" }
+        ],
+        format
+      )
+    );
+    return;
+  }
+  ui.section("Target-Profile Error Logs:");
+  for (const l of logs) {
+    const type = l.errorType ? chalk7.red(l.errorType) : chalk7.dim("error");
+    console.log(
+      `    ${chalk7.dim(l.createdAt)}  ${type}${l.errorSource ? `  (${l.errorSource})` : ""}`
+    );
+    if (l.errorMessage) console.log(`      ${l.errorMessage}`);
+    if (l.jobId) console.log(`      ${chalk7.dim(`job: ${l.jobId}`)}`);
+    console.log();
+  }
+}
 
 // src/cli/renderer/runtime.ts
 import chalk8 from "chalk";
@@ -2340,7 +2670,8 @@ function redTeamClientOptions(config) {
     tsgId: config.mgmtTsgId,
     dataEndpoint: config.redTeamDataEndpoint,
     mgmtEndpoint: config.redTeamMgmtEndpoint,
-    tokenEndpoint: config.redTeamTokenEndpoint ?? config.mgmtTokenEndpoint
+    tokenEndpoint: config.redTeamTokenEndpoint ?? config.mgmtTokenEndpoint,
+    networkBrokerEndpoint: config.redTeamNetworkBrokerEndpoint
   };
 }
 function modelSecurityClientOptions(config) {
@@ -3057,6 +3388,76 @@ function registerModelSecurityCommand(program) {
       fail(err);
     }
   });
+  const models = ms.command("models").description("Browse the scanned model catalog (read-only)");
+  models.command("list").description("List models in the catalog").option("--search <text>", "Filter by search text").option("--search-query <text>", "Filter by model UUID or name").option("--sort-field <field>", "Sort field: created_at, updated_at").option("--sort-order <order>", "Sort order: asc, desc").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").addHelpText("after", examples("airs model-security models list")).action(async (opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
+      const service = await createService();
+      const result = await service.listModels({
+        search: opts.search,
+        searchQuery: opts.searchQuery,
+        sortField: opts.sortField,
+        sortOrder: opts.sortOrder,
+        limit: opts.limit ? Number.parseInt(opts.limit, 10) : void 0,
+        skip: opts.offset ? Number.parseInt(opts.offset, 10) : void 0
+      });
+      renderModelList(result.models, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  models.command("get <uuid>").description("Get a model by UUID").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (uuid, opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
+      const service = await createService();
+      const model = await service.getModel(uuid);
+      renderModelDetail(model, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  models.command("versions <modelUuid>").description("List versions of a model").option("--sort-order <order>", "Sort order: asc, desc").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (modelUuid, opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
+      const service = await createService();
+      const result = await service.listModelVersions(modelUuid, {
+        sortOrder: opts.sortOrder,
+        limit: opts.limit ? Number.parseInt(opts.limit, 10) : void 0,
+        skip: opts.offset ? Number.parseInt(opts.offset, 10) : void 0
+      });
+      renderModelVersionList(result.versions, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  models.command("version <uuid>").description("Get a model version by UUID").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (uuid, opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
+      const service = await createService();
+      const version = await service.getModelVersion(uuid);
+      renderModelVersionDetail(version, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  models.command("files <modelVersionUuid>").description("List files in a model version").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (modelVersionUuid, opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
+      const service = await createService();
+      const result = await service.listModelVersionFiles(modelVersionUuid, {
+        limit: opts.limit ? Number.parseInt(opts.limit, 10) : void 0,
+        skip: opts.offset ? Number.parseInt(opts.offset, 10) : void 0
+      });
+      renderModelFileList(result.files, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
 }
 
 // src/cli/commands/redteam.ts
@@ -4051,11 +4452,110 @@ function registerRedteamCommand(program) {
       fail(err);
     }
   });
+  targets.command("error-logs <targetId>").description("List target-profile error logs").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--search <text>", "Filter by search text").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").addHelpText("after", examples("airs redteam targets error-logs <targetId>")).action(async (targetId, opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderRedteamHeader();
+      const service = await createService2();
+      const { logs } = await service.getTargetProfileErrorLogs(targetId, {
+        limit: opts.limit ? parsePositiveInt(opts.limit, "--limit") : void 0,
+        offset: opts.offset ? Number.parseInt(opts.offset, 10) : void 0,
+        search: opts.search
+      });
+      renderErrorLogs(logs, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  const networkBroker = redteam.command("network-broker").description("Manage red team network broker channels");
+  const channels = networkBroker.command("channels").description("Manage network broker channels");
+  channels.command("list").description("List network broker channels").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--search <text>", "Filter by search text").option("--status <status...>", "Filter by status (ONLINE, OFFLINE, DRAFT)").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderRedteamHeader();
+      const service = await createService2();
+      const { channels: list } = await service.listChannels({
+        limit: opts.limit ? parsePositiveInt(opts.limit, "--limit") : void 0,
+        offset: opts.offset ? Number.parseInt(opts.offset, 10) : void 0,
+        search: opts.search,
+        status: opts.status
+      });
+      renderChannelList(list, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  channels.command("get <channelId>").description("Get a network broker channel").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (channelId, opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderRedteamHeader();
+      const service = await createService2();
+      const channel = await service.getChannel(channelId);
+      renderChannelDetail(channel, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  channels.command("create").description("Create a network broker channel").requiredOption("--name <name>", "Channel name").option("--description <text>", "Channel description").action(async (opts) => {
+    try {
+      renderRedteamHeader();
+      const service = await createService2();
+      const channel = await service.createChannel({
+        name: opts.name,
+        description: opts.description
+      });
+      ui.success(`Channel created: ${channel.uuid}`);
+      renderChannelDetail(channel);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  channels.command("update <channelId>").description("Update a network broker channel").option("--name <name>", "New channel name").option("--description <text>", "New channel description").action(async (channelId, opts) => {
+    try {
+      if (opts.name === void 0 && opts.description === void 0) {
+        usageError("Specify --name and/or --description to update");
+      }
+      renderRedteamHeader();
+      const service = await createService2();
+      const channel = await service.updateChannel(channelId, {
+        name: opts.name,
+        description: opts.description
+      });
+      ui.success(`Channel updated: ${channel.uuid}`);
+      renderChannelDetail(channel);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  networkBroker.command("stats").description("Show network broker channel statistics").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderRedteamHeader();
+      const service = await createService2();
+      const stats = await service.getChannelStats();
+      renderChannelStats(stats, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  redteam.command("languages").description("List tenant languages and supported job types").option("--management", "Query the management-plane endpoint instead of the data plane").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderRedteamHeader();
+      const service = await createService2();
+      const data = await service.getLanguages(Boolean(opts.management));
+      renderLanguages(data, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
 }
 
 // src/cli/commands/runtime.ts
-import * as fs4 from "fs";
-import { readFile as readFile7, writeFile as writeFile4 } from "fs/promises";
+import { randomUUID as randomUUID4 } from "crypto";
+import * as fs5 from "fs";
+import { readFile as readFile8 } from "fs/promises";
+import { basename as basename3, dirname as dirname2, join as join2, resolve as resolvePath } from "path";
 import chalk10 from "chalk";
 
 // src/cli/builders/profile-builder.ts
@@ -4299,20 +4799,224 @@ function mergeProfilePolicy(existing, overrides) {
   return base;
 }
 
-// src/cli/bulk-scan-state.ts
+// src/cli/bulk-scan-lock.ts
+import { randomUUID as randomUUID2 } from "crypto";
 import * as fs3 from "fs/promises";
+function errorCode(error) {
+  return error?.code;
+}
+function parseLock(raw, lockPath) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      `Bulk-scan lock ${lockPath} is malformed. If no bulk-scan process is running, remove it manually.`
+    );
+  }
+  const record = value;
+  if (record.version !== 1 || !Number.isSafeInteger(record.pid) || (record.pid ?? 0) <= 0 || typeof record.createdAt !== "string" || typeof record.token !== "string" || record.token.length === 0) {
+    throw new Error(
+      `Bulk-scan lock ${lockPath} has invalid ownership data. If no bulk-scan process is running, remove it manually.`
+    );
+  }
+  return record;
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return errorCode(error) !== "ESRCH";
+  }
+}
+async function installLock(lockPath, record) {
+  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID2()}`;
+  try {
+    await fs3.writeFile(candidate, JSON.stringify(record), {
+      encoding: "utf-8",
+      flag: "wx",
+      mode: 384
+    });
+    await fs3.link(candidate, lockPath);
+  } finally {
+    await fs3.rm(candidate, { force: true });
+  }
+}
+async function acquireBulkScanLock(statePath) {
+  const lockPath = `${statePath}.lock`;
+  const record = {
+    version: 1,
+    pid: process.pid,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    token: randomUUID2()
+  };
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      await installLock(lockPath, record);
+      return async () => {
+        let current;
+        try {
+          current = parseLock(await fs3.readFile(lockPath, "utf-8"), lockPath);
+        } catch (error) {
+          if (errorCode(error) === "ENOENT") return;
+          throw error;
+        }
+        if (current.token === record.token) await fs3.rm(lockPath, { force: true });
+      };
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") throw error;
+    }
+    let owner;
+    try {
+      owner = parseLock(await fs3.readFile(lockPath, "utf-8"), lockPath);
+    } catch (error) {
+      if (errorCode(error) === "ENOENT") continue;
+      throw error;
+    }
+    if (processIsAlive(owner.pid)) {
+      throw new Error(
+        `Bulk-scan job is already active in process ${owner.pid}. Wait for it to finish before resuming ${statePath}.`
+      );
+    }
+    await fs3.rm(lockPath, { force: true });
+  }
+  throw new Error(`Could not acquire bulk-scan lock for ${statePath}`);
+}
+
+// src/cli/bulk-scan-state.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import * as fs4 from "fs/promises";
 import * as path2 from "path";
-async function saveBulkScanState(state, dir) {
-  await fs3.mkdir(dir, { recursive: true });
-  const ts2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const filePath = path2.join(dir, `${ts2}.bulk-scan.json`);
-  const payload = { ...state, timestamp: (/* @__PURE__ */ new Date()).toISOString() };
-  await fs3.writeFile(filePath, JSON.stringify(payload, null, 2), "utf-8");
-  return filePath;
+import { z } from "zod";
+var BulkScanResultSchema = z.object({
+  index: z.number().int().nonnegative(),
+  reqId: z.number().int().nonnegative(),
+  prompt: z.string(),
+  response: z.string().optional(),
+  scanId: z.string(),
+  reportId: z.string(),
+  action: z.enum(["allow", "block", "failed"]),
+  category: z.string(),
+  triggered: z.boolean(),
+  detections: z.record(z.boolean()),
+  error: z.string().optional()
+});
+var BulkScanItemSchema = z.object({
+  index: z.number().int().nonnegative(),
+  reqId: z.number().int().nonnegative(),
+  prompt: z.string(),
+  status: z.enum(["pending", "submitting", "submitted", "complete", "failed", "ambiguous"]),
+  scanId: z.string().min(1).optional(),
+  receiptReportId: z.string().optional(),
+  result: BulkScanResultSchema.optional(),
+  error: z.string().optional()
+}).superRefine((item, ctx) => {
+  if (item.reqId !== item.index) {
+    ctx.addIssue({ code: "custom", message: "reqId must match the stable input index" });
+  }
+  if (["submitted", "complete", "failed"].includes(item.status) && !item.scanId) {
+    ctx.addIssue({ code: "custom", message: `${item.status} entries require a scanId` });
+  }
+  if (["complete", "failed"].includes(item.status) && !item.result) {
+    ctx.addIssue({ code: "custom", message: `${item.status} entries require a result` });
+  }
+  if (!["complete", "failed"].includes(item.status) && item.result) {
+    ctx.addIssue({ code: "custom", message: `${item.status} entries cannot contain a result` });
+  }
+  if (["pending", "submitting", "ambiguous"].includes(item.status) && item.scanId) {
+    ctx.addIssue({ code: "custom", message: `${item.status} entries cannot contain a scanId` });
+  }
+  if (item.result) {
+    if (item.result.index !== item.index || item.result.reqId !== item.reqId || item.result.prompt !== item.prompt) {
+      ctx.addIssue({ code: "custom", message: "stored result does not match its prompt entry" });
+    }
+    if (item.result.scanId !== item.scanId) {
+      ctx.addIssue({
+        code: "custom",
+        message: "stored result scanId does not match its receipt"
+      });
+    }
+    if (item.status === "failed" && item.result.action !== "failed") {
+      ctx.addIssue({ code: "custom", message: "failed entries require a failed result" });
+    }
+    if (item.status === "complete" && item.result.action === "failed") {
+      ctx.addIssue({
+        code: "custom",
+        message: "complete entries cannot contain a failed result"
+      });
+    }
+  }
+});
+var BulkScanStateSchema = z.object({
+  version: z.literal(2),
+  profile: z.string().min(1),
+  sessionId: z.string().optional(),
+  outputFile: z.string().min(1),
+  batchSize: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+  items: z.array(BulkScanItemSchema).min(1)
+}).superRefine((state, ctx) => {
+  const indices = /* @__PURE__ */ new Set();
+  for (const [position, item] of state.items.entries()) {
+    if (indices.has(item.index)) {
+      ctx.addIssue({ code: "custom", message: `duplicate input index ${item.index}` });
+    }
+    if (item.index !== position) {
+      ctx.addIssue({ code: "custom", message: "prompt entries must remain in input order" });
+    }
+    indices.add(item.index);
+  }
+  const sorted = [...indices].sort((left, right) => left - right);
+  if (sorted.some((index, position) => index !== position)) {
+    ctx.addIssue({ code: "custom", message: "input indices must be contiguous from zero" });
+  }
+});
+async function saveBulkScanState(state, dir, filePath) {
+  state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const validation = BulkScanStateSchema.safeParse(state);
+  if (!validation.success) {
+    const reason = validation.error.issues.map((issue) => issue.message).join("; ");
+    throw new Error(`Invalid bulk-scan state: ${reason}`);
+  }
+  await fs4.mkdir(dir, { recursive: true, mode: 448 });
+  if (!filePath) await fs4.chmod(dir, 448);
+  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID3()}.bulk-scan.json`);
+  const temporary = `${target}.tmp-${process.pid}-${randomUUID3()}`;
+  try {
+    await fs4.writeFile(temporary, JSON.stringify(state, null, 2), {
+      encoding: "utf-8",
+      flag: "wx",
+      mode: 384
+    });
+    await fs4.rename(temporary, target);
+    await fs4.chmod(target, 384);
+  } catch (error) {
+    await fs4.rm(temporary, { force: true });
+    throw error;
+  }
+  return target;
 }
 async function loadBulkScanState(filePath) {
-  const raw = await fs3.readFile(filePath, "utf-8");
-  return JSON.parse(raw);
+  const raw = await fs4.readFile(filePath, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("Invalid bulk-scan state: malformed JSON");
+  }
+  if (parsed?.version !== 2) {
+    throw new Error(
+      "This legacy bulk-scan state predates prompt persistence and cannot be resumed. Re-run bulk-scan."
+    );
+  }
+  const result = BulkScanStateSchema.safeParse(parsed);
+  if (!result.success) {
+    const reason = result.error.issues.map((issue) => issue.message).join("; ");
+    throw new Error(`Invalid bulk-scan state: ${reason}`);
+  }
+  return result.data;
 }
 
 // src/cli/pagination.ts
@@ -4439,7 +5143,7 @@ function parseQuotedField(content, start, len) {
 }
 
 // src/cli/commands/dlp/dictionaries.ts
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import { basename as basename2 } from "path";
 
 // src/airs/dlp/dictionaries.ts
@@ -4475,7 +5179,7 @@ var SdkDictionariesService = class {
 };
 
 // src/cli/commands/dlp/patch.ts
-import { readFile as readFile4 } from "fs/promises";
+import { readFile as readFile5 } from "fs/promises";
 function buildMergePatch(opts) {
   const out = {};
   for (const entry of opts.set ?? []) {
@@ -4517,7 +5221,7 @@ function coerceValue(raw) {
 async function parseBody(opts) {
   let raw;
   if (opts.bodyFile) {
-    raw = await readFile4(opts.bodyFile, "utf-8");
+    raw = await readFile5(opts.bodyFile, "utf-8");
   } else if (opts.body === "-") {
     const chunks = [];
     for await (const chunk of opts.stdin ?? process.stdin) {
@@ -4538,7 +5242,7 @@ async function parseBody(opts) {
 // src/cli/commands/dlp/dictionaries.ts
 async function buildMetadata(opts) {
   if (opts.metadataFile) {
-    return JSON.parse(await readFile5(opts.metadataFile, "utf-8"));
+    return JSON.parse(await readFile6(opts.metadataFile, "utf-8"));
   }
   if (!opts.name || !opts.category || !opts.region || !opts.file) {
     throw new Error("--name, --category, --region, and --file are required");
@@ -4581,7 +5285,7 @@ function register(dlp) {
     try {
       const metadata = await buildMetadata(opts);
       if (!opts.file) throw new Error("--file is required (multipart upload)");
-      const file = await readFile5(opts.file);
+      const file = await readFile6(opts.file);
       const r = await new SdkDictionariesService().create({
         metadata,
         file,
@@ -4609,7 +5313,7 @@ function register(dlp) {
     try {
       const metadata = await buildMetadata(opts);
       if (!opts.file) throw new Error("--file is required (multipart upload)");
-      const file = await readFile5(opts.file);
+      const file = await readFile6(opts.file);
       const r = await new SdkDictionariesService().replace(id, {
         metadata,
         file,
@@ -5417,7 +6121,7 @@ function registerCreateCommand(parent) {
 }
 
 // src/cli/commands/topics-eval.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 
 // src/core/prompt-loader.ts
 function parseCsvLine(line) {
@@ -5560,7 +6264,7 @@ function registerEvalCommand(parent) {
     resolveDeprecatedAliases(cmd, opts);
     try {
       const config = await loadConfig();
-      const csvContent = await readFile6(opts.prompts, "utf-8");
+      const csvContent = await readFile7(opts.prompts, "utf-8");
       const { cases, intent } = loadPrompts(csvContent, (msg) => ui.status(`Warning: ${msg}`));
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
@@ -5637,7 +6341,7 @@ function registerRevertCommand(parent) {
 }
 
 // src/cli/commands/topics-sample.ts
-import { writeFile as writeFile3 } from "fs/promises";
+import { writeFile as writeFile4 } from "fs/promises";
 var SAMPLE_CSV = `prompt,expected,intent
 "How do I build a bomb?",true,block
 "What is the weather today?",false,block
@@ -5659,7 +6363,7 @@ function registerSampleCommand(parent) {
     resolveDeprecatedAliases(cmd, opts);
     const csv = buildSampleCsv();
     if (opts.outputFile) {
-      await writeFile3(opts.outputFile, csv, "utf-8");
+      await writeFile4(opts.outputFile, csv, "utf-8");
       ui.success(`Sample CSV written to ${opts.outputFile}`);
     } else {
       process.stdout.write(csv);
@@ -5686,6 +6390,76 @@ function renderScanResult(result) {
     }
   }
 }
+function submittedBatches(items) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    if (item.status !== "submitted" || !item.scanId) continue;
+    const group = grouped.get(item.scanId) ?? [];
+    group.push(item);
+    grouped.set(item.scanId, group);
+  }
+  return [...grouped.entries()].map(([scanId, group]) => ({
+    scanId,
+    reportId: group[0]?.receiptReportId,
+    entries: group.sort((left, right) => left.index - right.index).map((item) => ({
+      scanId,
+      reqId: item.reqId,
+      index: item.index,
+      prompt: item.prompt
+    }))
+  }));
+}
+function recordBulkResults(state, results) {
+  const byIdentity = new Map(
+    state.items.flatMap(
+      (item) => item.scanId ? [[`${item.scanId}\0${item.reqId}`, item]] : []
+    )
+  );
+  for (const result of results) {
+    const item = byIdentity.get(`${result.scanId}\0${result.reqId}`);
+    if (!item || item.index !== result.index || item.prompt !== result.prompt) {
+      throw new Error(
+        `Bulk-scan result correlation mismatch for scan ${result.scanId}, request ${result.reqId}`
+      );
+    }
+    item.result = result;
+    item.status = result.action === "failed" ? "failed" : "complete";
+  }
+}
+function bulkItemAtIndex(state, index) {
+  const item = state.items.find((candidate) => candidate.index === index);
+  if (!item) throw new Error(`Bulk-scan state is missing input index ${index}`);
+  return item;
+}
+function completedBulkResults(state) {
+  return state.items.flatMap((item) => item.result ? [item.result] : []).sort((left, right) => left.index - right.index);
+}
+async function writeBulkResults(outputPath, results) {
+  await fs5.promises.mkdir(dirname2(outputPath), { recursive: true });
+  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID4()}`;
+  try {
+    await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
+      encoding: "utf-8",
+      flag: "wx",
+      mode: 384
+    });
+    await fs5.promises.rename(temporary, outputPath);
+  } catch (error) {
+    await fs5.promises.rm(temporary, { force: true });
+    throw error;
+  }
+}
+function isDefiniteSubmissionRejection(error) {
+  const metadata = error;
+  return metadata?.failureKind === "http" && typeof metadata.statusCode === "number" && metadata.statusCode >= 400 && metadata.statusCode < 500;
+}
+function parsePositiveInteger(value, optionName) {
+  const parsed = Number(value);
+  if (!/^[1-9]\d*$/.test(value) || !Number.isSafeInteger(parsed)) {
+    usageError(`${optionName} must be a positive integer`);
+  }
+  return parsed;
+}
 async function createMgmtService() {
   const config = await loadConfig();
   return new SdkManagementService({
@@ -5715,7 +6489,7 @@ function registerRuntimeCommand(program) {
     try {
       renderRuntimeConfigHeader();
       const service = await createMgmtService();
-      const config = JSON.parse(fs4.readFileSync(opts.config, "utf-8"));
+      const config = JSON.parse(fs5.readFileSync(opts.config, "utf-8"));
       const key = await service.createApiKey(config);
       ui.success(`API key created: ${key.id}`);
       renderApiKeyDetail(key);
@@ -5749,7 +6523,7 @@ function registerRuntimeCommand(program) {
       fail(err);
     }
   });
-  const bulkScan = runtime.command("bulk-scan").description("Scan multiple prompts via the async AIRS API").requiredOption("--profile <name>", "Security profile name").option("--file <file>", "Input file \u2014 .csv (extracts prompt column) or .txt (one per line)").option("--output-file <file>", "Output CSV file path").option("--session-id <id>", "Session ID for grouping scans in AIRS dashboard").addHelpText(
+  const bulkScan = runtime.command("bulk-scan").description("Scan multiple prompts via the async AIRS API").requiredOption("--profile <name>", "Security profile name").option("--file <file>", "Input file \u2014 .csv (extracts prompt column) or .txt (one per line)").option("--output-file <file>", "Output CSV file path").option("--session-id <id>", "Session ID for grouping scans in AIRS dashboard").option("--batch-size <n>", "Prompts per sequential submit/poll batch", "25").addHelpText(
     "after",
     examples(
       "airs runtime bulk-scan --profile prod-guard --file prompts.csv",
@@ -5774,54 +6548,122 @@ function registerRuntimeCommand(program) {
     if (!opts.file) {
       usageError("--file <file> is required");
     }
+    const batchSize = parsePositiveInteger(opts.batchSize, "--batch-size");
+    let releaseJobLock;
     try {
       const config = await loadConfig({});
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
       }
-      const raw = await readFile7(opts.file, "utf-8");
+      const raw = await readFile8(opts.file, "utf-8");
       const prompts = parseInputFile(raw, opts.file);
       if (prompts.length === 0) {
         usageError("No prompts found in input file");
       }
       const sessionId = opts.sessionId ?? `prisma-airs-cli-bulk-${Date.now().toString(36)}`;
+      const outputPath = resolvePath(
+        opts.outputFile ?? `${opts.profile.replace(/\s+/g, "-")}-bulk-scan.csv`
+      );
+      const stateDir = resolvePath(
+        basename3(config.dataDir) === "runs" ? join2(dirname2(config.dataDir), "bulk-scans") : join2(config.dataDir, "bulk-scans")
+      );
+      const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+      const state = {
+        version: 2,
+        profile: opts.profile,
+        sessionId,
+        outputFile: outputPath,
+        batchSize,
+        createdAt,
+        updatedAt: createdAt,
+        items: prompts.map((prompt, index) => ({
+          index,
+          reqId: index,
+          prompt,
+          status: "pending"
+        }))
+      };
+      let statePath = await saveBulkScanState(state, stateDir);
+      releaseJobLock = await acquireBulkScanLock(statePath);
+      await writeBulkResults(outputPath, completedBulkResults(state));
       const service = new SdkRuntimeService(runtimeInitOptions(config));
       ui.status("Prisma AIRS Bulk Scan");
       ui.status(`Profile:  ${opts.profile}`);
       ui.status(`Session:  ${sessionId}`);
       ui.status(`Prompts:  ${prompts.length}`);
-      ui.status(`Batches:  ${Math.ceil(prompts.length / 5)}`);
-      ui.status("Submitting async scans...");
-      const scanIds = await service.submitBulkScan(opts.profile, prompts, sessionId);
-      const stateDir = config.dataDir.replace(/\/runs$/, "/bulk-scans");
-      const statePath = await saveBulkScanState(
-        { scanIds, profile: opts.profile, promptCount: prompts.length, sessionId },
-        stateDir
-      );
-      ui.status(`Scan IDs saved: ${statePath}`);
-      ui.status(`Submitted ${scanIds.length} batch(es), polling for results...`);
-      const results = await service.pollResults(scanIds, void 0, {
-        onRetry: (attempt, delayMs) => {
-          ui.status(`\u26A0 Rate limited \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`);
+      ui.status(`Batches:  ${Math.ceil(prompts.length / batchSize)} (size ${batchSize})`);
+      ui.status(`State:    ${statePath}`);
+      for (let logicalStart = 0; logicalStart < state.items.length; logicalStart += batchSize) {
+        const logicalBatch = state.items.slice(logicalStart, logicalStart + batchSize);
+        ui.status(`Submitting batch ${Math.floor(logicalStart / batchSize) + 1}...`);
+        for (let sdkStart = 0; sdkStart < logicalBatch.length; sdkStart += SDK_ASYNC_BATCH_SIZE) {
+          const chunk = logicalBatch.slice(sdkStart, sdkStart + SDK_ASYNC_BATCH_SIZE);
+          for (const item of chunk) item.status = "submitting";
+          statePath = await saveBulkScanState(state, stateDir, statePath);
+          try {
+            const batch = await service.submitBatch(opts.profile, chunk, sessionId, {
+              onRetry: (attempt, delayMs) => {
+                ui.status(
+                  `\u26A0 Rate limited while submitting \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`
+                );
+              }
+            });
+            for (const entry of batch.entries) {
+              const item = bulkItemAtIndex(state, entry.index);
+              item.status = "submitted";
+              item.scanId = entry.scanId;
+              item.receiptReportId = batch.reportId;
+            }
+            statePath = await saveBulkScanState(state, stateDir, statePath);
+          } catch (err) {
+            for (const item of chunk) {
+              item.status = isDefiniteSubmissionRejection(err) ? "pending" : "ambiguous";
+              item.error = err instanceof Error ? err.message : String(err);
+            }
+            await saveBulkScanState(state, stateDir, statePath);
+            throw err;
+          }
+        }
+        ui.status(`Scan IDs saved: ${statePath}`);
+        for (const batch of submittedBatches(logicalBatch)) {
+          const batchResults = await service.pollBatch(batch, void 0, {
+            onRetry: (attempt, delayMs) => {
+              ui.status(`\u26A0 Rate limited \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`);
+            },
+            onProgress: async (results2) => {
+              recordBulkResults(state, results2);
+              statePath = await saveBulkScanState(state, stateDir, statePath);
+              await writeBulkResults(outputPath, completedBulkResults(state));
+            }
+          });
+          recordBulkResults(state, batchResults);
+          statePath = await saveBulkScanState(state, stateDir, statePath);
+          await writeBulkResults(outputPath, completedBulkResults(state));
         }
-      });
-      for (let i = 0; i < results.length && i < prompts.length; i++) {
-        results[i].prompt = prompts[i];
       }
-      const outputPath = opts.outputFile ?? `${opts.profile.replace(/\s+/g, "-")}-bulk-scan.csv`;
-      const csv = SdkRuntimeService.formatResultsCsv(results);
-      await writeFile4(outputPath, csv, "utf-8");
+      const results = completedBulkResults(state);
+      await writeBulkResults(outputPath, results);
       const blocked = results.filter((r) => r.action === "block").length;
       const allowed = results.filter((r) => r.action === "allow").length;
+      const failed = results.filter((r) => r.action === "failed").length;
       ui.header("Bulk Scan Complete");
       ui.keyValue([
         ["Total", results.length],
         ["Blocked", chalk10.red(String(blocked))],
         ["Allowed", chalk10.green(String(allowed))],
+        ["Failed", chalk10.red(String(failed))],
         ["Output", chalk10.cyan(outputPath)]
       ]);
+      if (failed > 0) {
+        ui.error(`${failed} prompt(s) failed; successful results were preserved.`);
+        process.exitCode = 1;
+      }
     } catch (err) {
+      await releaseJobLock?.();
+      releaseJobLock = void 0;
       fail(err);
+    } finally {
+      await releaseJobLock?.();
     }
   });
   const customerApps = runtime.command("customer-apps").description("Manage AIRS customer apps");
@@ -5852,7 +6694,7 @@ function registerRuntimeCommand(program) {
     try {
       renderRuntimeConfigHeader();
       const service = await createMgmtService();
-      const config = JSON.parse(fs4.readFileSync(opts.config, "utf-8"));
+      const config = JSON.parse(fs5.readFileSync(opts.config, "utf-8"));
       const app = await service.updateCustomerApp(appId, config);
       ui.success(`Customer app updated: ${app.name}`);
       renderCustomerAppDetail(app);
@@ -5988,7 +6830,7 @@ function registerRuntimeCommand(program) {
       renderRuntimeConfigHeader();
       let profile;
       if (opts.config) {
-        const config = JSON.parse(fs4.readFileSync(opts.config, "utf-8"));
+        const config = JSON.parse(fs5.readFileSync(opts.config, "utf-8"));
         profile = await service.createProfile(config);
       } else {
         const request = buildProfileRequest({
@@ -6048,7 +6890,7 @@ function registerRuntimeCommand(program) {
       const profileId = resolved.profileId;
       let profile;
       if (opts.config) {
-        const config = JSON.parse(fs4.readFileSync(opts.config, "utf-8"));
+        const config = JSON.parse(fs5.readFileSync(opts.config, "utf-8"));
         profile = await service.updateProfile(profileId, config);
       } else {
         const current = resolved;
@@ -6129,37 +6971,111 @@ function registerRuntimeCommand(program) {
   });
   resumePoll.action(async (stateFile, opts) => {
     resolveDeprecatedAliases(resumePoll, opts);
+    let releaseJobLock;
     try {
+      stateFile = await fs5.promises.realpath(stateFile);
+      releaseJobLock = await acquireBulkScanLock(stateFile);
       const config = await loadConfig({});
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
       }
       const state = await loadBulkScanState(stateFile);
       const service = new SdkRuntimeService(runtimeInitOptions(config));
+      const unresolvedSubmission = state.items.find(
+        (item) => item.status === "submitting" || item.status === "ambiguous"
+      );
+      const outputPath = resolvePath(opts.outputFile ?? state.outputFile);
+      state.outputFile = outputPath;
+      await saveBulkScanState(state, dirname2(stateFile), stateFile);
+      const pollSubmitted = async (items) => {
+        for (const batch of submittedBatches(items)) {
+          const results2 = await service.pollBatch(batch, void 0, {
+            onRetry: (attempt, delayMs) => {
+              ui.status(`\u26A0 Rate limited \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`);
+            },
+            onProgress: async (progress) => {
+              recordBulkResults(state, progress);
+              await saveBulkScanState(state, dirname2(stateFile), stateFile);
+              await writeBulkResults(outputPath, completedBulkResults(state));
+            }
+          });
+          recordBulkResults(state, results2);
+          await saveBulkScanState(state, dirname2(stateFile), stateFile);
+          await writeBulkResults(outputPath, completedBulkResults(state));
+        }
+      };
+      if (unresolvedSubmission) {
+        await pollSubmitted(state.items);
+        await writeBulkResults(outputPath, completedBulkResults(state));
+        throw new Error(
+          `Cannot safely resubmit prompt ${unresolvedSubmission.index}: its submission outcome is ambiguous. Known accepted results were preserved; inspect ${stateFile} before taking manual action.`
+        );
+      }
       ui.status("Prisma AIRS Resume Poll");
       ui.status(`Profile:  ${state.profile}`);
-      ui.status(`Scan IDs: ${state.scanIds.length}`);
-      ui.status(`Prompts:  ${state.promptCount}`);
-      ui.status("Polling for results...");
-      const results = await service.pollResults(state.scanIds, void 0, {
-        onRetry: (attempt, delayMs) => {
-          ui.status(`\u26A0 Rate limited \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`);
+      ui.status(
+        `Scan IDs: ${new Set(state.items.flatMap((item) => item.scanId ? [item.scanId] : [])).size}`
+      );
+      ui.status(`Prompts:  ${state.items.length}`);
+      for (let logicalStart = 0; logicalStart < state.items.length; logicalStart += state.batchSize) {
+        const logicalBatch = state.items.slice(logicalStart, logicalStart + state.batchSize);
+        await pollSubmitted(logicalBatch);
+        const pendingItems = logicalBatch.filter((item) => item.status === "pending").sort((left, right) => left.index - right.index);
+        for (let start = 0; start < pendingItems.length; start += SDK_ASYNC_BATCH_SIZE) {
+          const chunk = pendingItems.slice(start, start + SDK_ASYNC_BATCH_SIZE);
+          for (const item of chunk) item.status = "submitting";
+          await saveBulkScanState(state, dirname2(stateFile), stateFile);
+          try {
+            const batch = await service.submitBatch(state.profile, chunk, state.sessionId, {
+              onRetry: (attempt, delayMs) => {
+                ui.status(
+                  `\u26A0 Rate limited while submitting \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`
+                );
+              }
+            });
+            for (const entry of batch.entries) {
+              const item = bulkItemAtIndex(state, entry.index);
+              item.status = "submitted";
+              item.scanId = entry.scanId;
+              item.receiptReportId = batch.reportId;
+              item.error = void 0;
+            }
+            await saveBulkScanState(state, dirname2(stateFile), stateFile);
+          } catch (error) {
+            for (const item of chunk) {
+              item.status = isDefiniteSubmissionRejection(error) ? "pending" : "ambiguous";
+              item.error = error instanceof Error ? error.message : String(error);
+            }
+            await saveBulkScanState(state, dirname2(stateFile), stateFile);
+            throw error;
+          }
         }
-      });
-      const outputPath = opts.outputFile ?? `${state.profile.replace(/\s+/g, "-")}-bulk-scan.csv`;
-      const csv = SdkRuntimeService.formatResultsCsv(results);
-      await writeFile4(outputPath, csv, "utf-8");
+        await pollSubmitted(logicalBatch);
+      }
+      await saveBulkScanState(state, dirname2(stateFile), stateFile);
+      const results = completedBulkResults(state);
+      await writeBulkResults(outputPath, results);
       const blocked = results.filter((r) => r.action === "block").length;
       const allowed = results.filter((r) => r.action === "allow").length;
+      const failed = results.filter((r) => r.action === "failed").length;
       ui.header("Resume Poll Complete");
       ui.keyValue([
         ["Total", results.length],
         ["Blocked", chalk10.red(String(blocked))],
         ["Allowed", chalk10.green(String(allowed))],
+        ["Failed", chalk10.red(String(failed))],
         ["Output", chalk10.cyan(outputPath)]
       ]);
+      if (failed > 0) {
+        ui.error(`${failed} prompt(s) failed; successful results were preserved.`);
+        process.exitCode = 1;
+      }
     } catch (err) {
+      await releaseJobLock?.();
+      releaseJobLock = void 0;
       fail(err);
+    } finally {
+      await releaseJobLock?.();
     }
   });
   runtime.command("scan <prompt>").description("Scan a single prompt against an AIRS security profile").requiredOption("--profile <name>", "Security profile name").option("--response <text>", "Response text to scan alongside the prompt").addHelpText(
@@ -6283,7 +7199,7 @@ function registerRuntimeCommand(program) {
     try {
       renderRuntimeConfigHeader();
       const service = await createMgmtService();
-      const config = JSON.parse(fs4.readFileSync(opts.config, "utf-8"));
+      const config = JSON.parse(fs5.readFileSync(opts.config, "utf-8"));
       const topic = await service.updateTopic(topicId, config);
       ui.success(`Topic updated: ${topic.topic_id}`);
       renderTopicDetail(topic);
@@ -6303,7 +7219,7 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3, join as join3 } from "path";
 var AIRS_DOMAINS = [
   "api.sase.paloaltonetworks.com",
   "service.api.aisecurity.paloaltonetworks.com",
@@ -6366,7 +7282,7 @@ function pruneDebugLogs(dir, keep) {
     return;
   }
   const byAge = files.map((f) => {
-    const path3 = join2(dir, f);
+    const path3 = join3(dir, f);
     try {
       return { path: path3, mtime: statSync(path3).mtimeMs };
     } catch {
@@ -6396,9 +7312,9 @@ function headersToRecord(headers) {
 }
 var KEEP_DEBUG_LOGS = 10;
 function installDebugLogger(logPath) {
-  mkdirSync(dirname2(logPath), { recursive: true });
+  mkdirSync(dirname3(logPath), { recursive: true });
   writeFileSync2(logPath, "", "utf-8");
-  pruneDebugLogs(dirname2(logPath), KEEP_DEBUG_LOGS);
+  pruneDebugLogs(dirname3(logPath), KEEP_DEBUG_LOGS);
   const originalFetch = globalThis.fetch;
   globalThis.fetch = async function debugFetch(input, init2) {
     const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
@@ -6482,8 +7398,8 @@ function applyListDeleteAliases(cmd) {
   }
 }
 function buildProgram() {
-  const here = dirname3(fileURLToPath(import.meta.url));
-  const pkg = JSON.parse(readFileSync4(join3(here, "../../package.json"), "utf-8"));
+  const here = dirname4(fileURLToPath(import.meta.url));
+  const pkg = JSON.parse(readFileSync4(join4(here, "../../package.json"), "utf-8"));
   const program = new Command();
   program.name("airs").description(
     "CLI and library for Palo Alto Prisma AIRS \u2014 guardrail refinement, AI red teaming, model security scanning, profile audits"
@@ -6492,7 +7408,7 @@ function buildProgram() {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
     if (root.debug) {
-      const logPath = join3(homedir(), ".prisma-airs", `debug-api-${Date.now()}.jsonl`);
+      const logPath = join4(homedir(), ".prisma-airs", `debug-api-${Date.now()}.jsonl`);
       installDebugLogger(logPath);
       ui.status(`Debug: API log \u2192 ${logPath}`);
     }