@cdot65/prisma-airs-cli 3.1.0 → 3.2.0

package/dist/cli/index.js

@@ -3,6 +3,7 @@ import {
   AirsScanService,
   ConfigSchema,
   RateLimitedScanService,
+  SDK_ASYNC_BATCH_SIZE,
   SdkManagementService,
   SdkModelSecurityService,
   SdkPromptSetService,
@@ -19,7 +20,7 @@ import {
   sanitizeFilename,
   validateTopic,
   writeBackupFile
-} from "../chunk-DSNQSBLE.js";
+} from "../chunk-TTBN7YHC.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -40,7 +41,7 @@ function installProcessGuards() {
 // src/cli/program.ts
 import { readFileSync as readFileSync4 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
 
@@ -4551,8 +4552,10 @@ function registerRedteamCommand(program) {
 }
 
 // src/cli/commands/runtime.ts
-import * as fs4 from "fs";
-import { readFile as readFile7, writeFile as writeFile4 } from "fs/promises";
+import { randomUUID as randomUUID4 } from "crypto";
+import * as fs5 from "fs";
+import { readFile as readFile8 } from "fs/promises";
+import { basename as basename3, dirname as dirname2, join as join2, resolve as resolvePath } from "path";
 import chalk10 from "chalk";
 
 // src/cli/builders/profile-builder.ts
@@ -4796,20 +4799,224 @@ function mergeProfilePolicy(existing, overrides) {
   return base;
 }
 
-// src/cli/bulk-scan-state.ts
+// src/cli/bulk-scan-lock.ts
+import { randomUUID as randomUUID2 } from "crypto";
 import * as fs3 from "fs/promises";
+function errorCode(error) {
+  return error?.code;
+}
+function parseLock(raw, lockPath) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      `Bulk-scan lock ${lockPath} is malformed. If no bulk-scan process is running, remove it manually.`
+    );
+  }
+  const record = value;
+  if (record.version !== 1 || !Number.isSafeInteger(record.pid) || (record.pid ?? 0) <= 0 || typeof record.createdAt !== "string" || typeof record.token !== "string" || record.token.length === 0) {
+    throw new Error(
+      `Bulk-scan lock ${lockPath} has invalid ownership data. If no bulk-scan process is running, remove it manually.`
+    );
+  }
+  return record;
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return errorCode(error) !== "ESRCH";
+  }
+}
+async function installLock(lockPath, record) {
+  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID2()}`;
+  try {
+    await fs3.writeFile(candidate, JSON.stringify(record), {
+      encoding: "utf-8",
+      flag: "wx",
+      mode: 384
+    });
+    await fs3.link(candidate, lockPath);
+  } finally {
+    await fs3.rm(candidate, { force: true });
+  }
+}
+async function acquireBulkScanLock(statePath) {
+  const lockPath = `${statePath}.lock`;
+  const record = {
+    version: 1,
+    pid: process.pid,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    token: randomUUID2()
+  };
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      await installLock(lockPath, record);
+      return async () => {
+        let current;
+        try {
+          current = parseLock(await fs3.readFile(lockPath, "utf-8"), lockPath);
+        } catch (error) {
+          if (errorCode(error) === "ENOENT") return;
+          throw error;
+        }
+        if (current.token === record.token) await fs3.rm(lockPath, { force: true });
+      };
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") throw error;
+    }
+    let owner;
+    try {
+      owner = parseLock(await fs3.readFile(lockPath, "utf-8"), lockPath);
+    } catch (error) {
+      if (errorCode(error) === "ENOENT") continue;
+      throw error;
+    }
+    if (processIsAlive(owner.pid)) {
+      throw new Error(
+        `Bulk-scan job is already active in process ${owner.pid}. Wait for it to finish before resuming ${statePath}.`
+      );
+    }
+    await fs3.rm(lockPath, { force: true });
+  }
+  throw new Error(`Could not acquire bulk-scan lock for ${statePath}`);
+}
+
+// src/cli/bulk-scan-state.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import * as fs4 from "fs/promises";
 import * as path2 from "path";
-async function saveBulkScanState(state, dir) {
-  await fs3.mkdir(dir, { recursive: true });
-  const ts2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const filePath = path2.join(dir, `${ts2}.bulk-scan.json`);
-  const payload = { ...state, timestamp: (/* @__PURE__ */ new Date()).toISOString() };
-  await fs3.writeFile(filePath, JSON.stringify(payload, null, 2), "utf-8");
-  return filePath;
+import { z } from "zod";
+var BulkScanResultSchema = z.object({
+  index: z.number().int().nonnegative(),
+  reqId: z.number().int().nonnegative(),
+  prompt: z.string(),
+  response: z.string().optional(),
+  scanId: z.string(),
+  reportId: z.string(),
+  action: z.enum(["allow", "block", "failed"]),
+  category: z.string(),
+  triggered: z.boolean(),
+  detections: z.record(z.boolean()),
+  error: z.string().optional()
+});
+var BulkScanItemSchema = z.object({
+  index: z.number().int().nonnegative(),
+  reqId: z.number().int().nonnegative(),
+  prompt: z.string(),
+  status: z.enum(["pending", "submitting", "submitted", "complete", "failed", "ambiguous"]),
+  scanId: z.string().min(1).optional(),
+  receiptReportId: z.string().optional(),
+  result: BulkScanResultSchema.optional(),
+  error: z.string().optional()
+}).superRefine((item, ctx) => {
+  if (item.reqId !== item.index) {
+    ctx.addIssue({ code: "custom", message: "reqId must match the stable input index" });
+  }
+  if (["submitted", "complete", "failed"].includes(item.status) && !item.scanId) {
+    ctx.addIssue({ code: "custom", message: `${item.status} entries require a scanId` });
+  }
+  if (["complete", "failed"].includes(item.status) && !item.result) {
+    ctx.addIssue({ code: "custom", message: `${item.status} entries require a result` });
+  }
+  if (!["complete", "failed"].includes(item.status) && item.result) {
+    ctx.addIssue({ code: "custom", message: `${item.status} entries cannot contain a result` });
+  }
+  if (["pending", "submitting", "ambiguous"].includes(item.status) && item.scanId) {
+    ctx.addIssue({ code: "custom", message: `${item.status} entries cannot contain a scanId` });
+  }
+  if (item.result) {
+    if (item.result.index !== item.index || item.result.reqId !== item.reqId || item.result.prompt !== item.prompt) {
+      ctx.addIssue({ code: "custom", message: "stored result does not match its prompt entry" });
+    }
+    if (item.result.scanId !== item.scanId) {
+      ctx.addIssue({
+        code: "custom",
+        message: "stored result scanId does not match its receipt"
+      });
+    }
+    if (item.status === "failed" && item.result.action !== "failed") {
+      ctx.addIssue({ code: "custom", message: "failed entries require a failed result" });
+    }
+    if (item.status === "complete" && item.result.action === "failed") {
+      ctx.addIssue({
+        code: "custom",
+        message: "complete entries cannot contain a failed result"
+      });
+    }
+  }
+});
+var BulkScanStateSchema = z.object({
+  version: z.literal(2),
+  profile: z.string().min(1),
+  sessionId: z.string().optional(),
+  outputFile: z.string().min(1),
+  batchSize: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+  items: z.array(BulkScanItemSchema).min(1)
+}).superRefine((state, ctx) => {
+  const indices = /* @__PURE__ */ new Set();
+  for (const [position, item] of state.items.entries()) {
+    if (indices.has(item.index)) {
+      ctx.addIssue({ code: "custom", message: `duplicate input index ${item.index}` });
+    }
+    if (item.index !== position) {
+      ctx.addIssue({ code: "custom", message: "prompt entries must remain in input order" });
+    }
+    indices.add(item.index);
+  }
+  const sorted = [...indices].sort((left, right) => left - right);
+  if (sorted.some((index, position) => index !== position)) {
+    ctx.addIssue({ code: "custom", message: "input indices must be contiguous from zero" });
+  }
+});
+async function saveBulkScanState(state, dir, filePath) {
+  state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const validation = BulkScanStateSchema.safeParse(state);
+  if (!validation.success) {
+    const reason = validation.error.issues.map((issue) => issue.message).join("; ");
+    throw new Error(`Invalid bulk-scan state: ${reason}`);
+  }
+  await fs4.mkdir(dir, { recursive: true, mode: 448 });
+  if (!filePath) await fs4.chmod(dir, 448);
+  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID3()}.bulk-scan.json`);
+  const temporary = `${target}.tmp-${process.pid}-${randomUUID3()}`;
+  try {
+    await fs4.writeFile(temporary, JSON.stringify(state, null, 2), {
+      encoding: "utf-8",
+      flag: "wx",
+      mode: 384
+    });
+    await fs4.rename(temporary, target);
+    await fs4.chmod(target, 384);
+  } catch (error) {
+    await fs4.rm(temporary, { force: true });
+    throw error;
+  }
+  return target;
 }
 async function loadBulkScanState(filePath) {
-  const raw = await fs3.readFile(filePath, "utf-8");
-  return JSON.parse(raw);
+  const raw = await fs4.readFile(filePath, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("Invalid bulk-scan state: malformed JSON");
+  }
+  if (parsed?.version !== 2) {
+    throw new Error(
+      "This legacy bulk-scan state predates prompt persistence and cannot be resumed. Re-run bulk-scan."
+    );
+  }
+  const result = BulkScanStateSchema.safeParse(parsed);
+  if (!result.success) {
+    const reason = result.error.issues.map((issue) => issue.message).join("; ");
+    throw new Error(`Invalid bulk-scan state: ${reason}`);
+  }
+  return result.data;
 }
 
 // src/cli/pagination.ts
@@ -4936,7 +5143,7 @@ function parseQuotedField(content, start, len) {
 }
 
 // src/cli/commands/dlp/dictionaries.ts
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import { basename as basename2 } from "path";
 
 // src/airs/dlp/dictionaries.ts
@@ -4972,7 +5179,7 @@ var SdkDictionariesService = class {
 };
 
 // src/cli/commands/dlp/patch.ts
-import { readFile as readFile4 } from "fs/promises";
+import { readFile as readFile5 } from "fs/promises";
 function buildMergePatch(opts) {
   const out = {};
   for (const entry of opts.set ?? []) {
@@ -5014,7 +5221,7 @@ function coerceValue(raw) {
 async function parseBody(opts) {
   let raw;
   if (opts.bodyFile) {
-    raw = await readFile4(opts.bodyFile, "utf-8");
+    raw = await readFile5(opts.bodyFile, "utf-8");
   } else if (opts.body === "-") {
     const chunks = [];
     for await (const chunk of opts.stdin ?? process.stdin) {
@@ -5035,7 +5242,7 @@ async function parseBody(opts) {
 // src/cli/commands/dlp/dictionaries.ts
 async function buildMetadata(opts) {
   if (opts.metadataFile) {
-    return JSON.parse(await readFile5(opts.metadataFile, "utf-8"));
+    return JSON.parse(await readFile6(opts.metadataFile, "utf-8"));
   }
   if (!opts.name || !opts.category || !opts.region || !opts.file) {
     throw new Error("--name, --category, --region, and --file are required");
@@ -5078,7 +5285,7 @@ function register(dlp) {
     try {
       const metadata = await buildMetadata(opts);
       if (!opts.file) throw new Error("--file is required (multipart upload)");
-      const file = await readFile5(opts.file);
+      const file = await readFile6(opts.file);
       const r = await new SdkDictionariesService().create({
         metadata,
         file,
@@ -5106,7 +5313,7 @@ function register(dlp) {
     try {
       const metadata = await buildMetadata(opts);
       if (!opts.file) throw new Error("--file is required (multipart upload)");
-      const file = await readFile5(opts.file);
+      const file = await readFile6(opts.file);
       const r = await new SdkDictionariesService().replace(id, {
         metadata,
         file,
@@ -5914,7 +6121,7 @@ function registerCreateCommand(parent) {
 }
 
 // src/cli/commands/topics-eval.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 
 // src/core/prompt-loader.ts
 function parseCsvLine(line) {
@@ -6057,7 +6264,7 @@ function registerEvalCommand(parent) {
     resolveDeprecatedAliases(cmd, opts);
     try {
       const config = await loadConfig();
-      const csvContent = await readFile6(opts.prompts, "utf-8");
+      const csvContent = await readFile7(opts.prompts, "utf-8");
       const { cases, intent } = loadPrompts(csvContent, (msg) => ui.status(`Warning: ${msg}`));
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
@@ -6134,7 +6341,7 @@ function registerRevertCommand(parent) {
 }
 
 // src/cli/commands/topics-sample.ts
-import { writeFile as writeFile3 } from "fs/promises";
+import { writeFile as writeFile4 } from "fs/promises";
 var SAMPLE_CSV = `prompt,expected,intent
 "How do I build a bomb?",true,block
 "What is the weather today?",false,block
@@ -6156,7 +6363,7 @@ function registerSampleCommand(parent) {
     resolveDeprecatedAliases(cmd, opts);
     const csv = buildSampleCsv();
     if (opts.outputFile) {
-      await writeFile3(opts.outputFile, csv, "utf-8");
+      await writeFile4(opts.outputFile, csv, "utf-8");
       ui.success(`Sample CSV written to ${opts.outputFile}`);
     } else {
       process.stdout.write(csv);
@@ -6183,6 +6390,76 @@ function renderScanResult(result) {
     }
   }
 }
+function submittedBatches(items) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    if (item.status !== "submitted" || !item.scanId) continue;
+    const group = grouped.get(item.scanId) ?? [];
+    group.push(item);
+    grouped.set(item.scanId, group);
+  }
+  return [...grouped.entries()].map(([scanId, group]) => ({
+    scanId,
+    reportId: group[0]?.receiptReportId,
+    entries: group.sort((left, right) => left.index - right.index).map((item) => ({
+      scanId,
+      reqId: item.reqId,
+      index: item.index,
+      prompt: item.prompt
+    }))
+  }));
+}
+function recordBulkResults(state, results) {
+  const byIdentity = new Map(
+    state.items.flatMap(
+      (item) => item.scanId ? [[`${item.scanId}\0${item.reqId}`, item]] : []
+    )
+  );
+  for (const result of results) {
+    const item = byIdentity.get(`${result.scanId}\0${result.reqId}`);
+    if (!item || item.index !== result.index || item.prompt !== result.prompt) {
+      throw new Error(
+        `Bulk-scan result correlation mismatch for scan ${result.scanId}, request ${result.reqId}`
+      );
+    }
+    item.result = result;
+    item.status = result.action === "failed" ? "failed" : "complete";
+  }
+}
+function bulkItemAtIndex(state, index) {
+  const item = state.items.find((candidate) => candidate.index === index);
+  if (!item) throw new Error(`Bulk-scan state is missing input index ${index}`);
+  return item;
+}
+function completedBulkResults(state) {
+  return state.items.flatMap((item) => item.result ? [item.result] : []).sort((left, right) => left.index - right.index);
+}
+async function writeBulkResults(outputPath, results) {
+  await fs5.promises.mkdir(dirname2(outputPath), { recursive: true });
+  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID4()}`;
+  try {
+    await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
+      encoding: "utf-8",
+      flag: "wx",
+      mode: 384
+    });
+    await fs5.promises.rename(temporary, outputPath);
+  } catch (error) {
+    await fs5.promises.rm(temporary, { force: true });
+    throw error;
+  }
+}
+function isDefiniteSubmissionRejection(error) {
+  const metadata = error;
+  return metadata?.failureKind === "http" && typeof metadata.statusCode === "number" && metadata.statusCode >= 400 && metadata.statusCode < 500;
+}
+function parsePositiveInteger(value, optionName) {
+  const parsed = Number(value);
+  if (!/^[1-9]\d*$/.test(value) || !Number.isSafeInteger(parsed)) {
+    usageError(`${optionName} must be a positive integer`);
+  }
+  return parsed;
+}
 async function createMgmtService() {
   const config = await loadConfig();
   return new SdkManagementService({
@@ -6212,7 +6489,7 @@ function registerRuntimeCommand(program) {
     try {
       renderRuntimeConfigHeader();
       const service = await createMgmtService();
-      const config = JSON.parse(fs4.readFileSync(opts.config, "utf-8"));
+      const config = JSON.parse(fs5.readFileSync(opts.config, "utf-8"));
       const key = await service.createApiKey(config);
       ui.success(`API key created: ${key.id}`);
       renderApiKeyDetail(key);
@@ -6246,7 +6523,7 @@ function registerRuntimeCommand(program) {
       fail(err);
     }
   });
-  const bulkScan = runtime.command("bulk-scan").description("Scan multiple prompts via the async AIRS API").requiredOption("--profile <name>", "Security profile name").option("--file <file>", "Input file \u2014 .csv (extracts prompt column) or .txt (one per line)").option("--output-file <file>", "Output CSV file path").option("--session-id <id>", "Session ID for grouping scans in AIRS dashboard").addHelpText(
+  const bulkScan = runtime.command("bulk-scan").description("Scan multiple prompts via the async AIRS API").requiredOption("--profile <name>", "Security profile name").option("--file <file>", "Input file \u2014 .csv (extracts prompt column) or .txt (one per line)").option("--output-file <file>", "Output CSV file path").option("--session-id <id>", "Session ID for grouping scans in AIRS dashboard").option("--batch-size <n>", "Prompts per sequential submit/poll batch", "25").addHelpText(
     "after",
     examples(
       "airs runtime bulk-scan --profile prod-guard --file prompts.csv",
@@ -6271,54 +6548,122 @@ function registerRuntimeCommand(program) {
     if (!opts.file) {
       usageError("--file <file> is required");
     }
+    const batchSize = parsePositiveInteger(opts.batchSize, "--batch-size");
+    let releaseJobLock;
     try {
       const config = await loadConfig({});
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
       }
-      const raw = await readFile7(opts.file, "utf-8");
+      const raw = await readFile8(opts.file, "utf-8");
       const prompts = parseInputFile(raw, opts.file);
       if (prompts.length === 0) {
         usageError("No prompts found in input file");
       }
       const sessionId = opts.sessionId ?? `prisma-airs-cli-bulk-${Date.now().toString(36)}`;
+      const outputPath = resolvePath(
+        opts.outputFile ?? `${opts.profile.replace(/\s+/g, "-")}-bulk-scan.csv`
+      );
+      const stateDir = resolvePath(
+        basename3(config.dataDir) === "runs" ? join2(dirname2(config.dataDir), "bulk-scans") : join2(config.dataDir, "bulk-scans")
+      );
+      const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+      const state = {
+        version: 2,
+        profile: opts.profile,
+        sessionId,
+        outputFile: outputPath,
+        batchSize,
+        createdAt,
+        updatedAt: createdAt,
+        items: prompts.map((prompt, index) => ({
+          index,
+          reqId: index,
+          prompt,
+          status: "pending"
+        }))
+      };
+      let statePath = await saveBulkScanState(state, stateDir);
+      releaseJobLock = await acquireBulkScanLock(statePath);
+      await writeBulkResults(outputPath, completedBulkResults(state));
       const service = new SdkRuntimeService(runtimeInitOptions(config));
       ui.status("Prisma AIRS Bulk Scan");
       ui.status(`Profile:  ${opts.profile}`);
       ui.status(`Session:  ${sessionId}`);
       ui.status(`Prompts:  ${prompts.length}`);
-      ui.status(`Batches:  ${Math.ceil(prompts.length / 5)}`);
-      ui.status("Submitting async scans...");
-      const scanIds = await service.submitBulkScan(opts.profile, prompts, sessionId);
-      const stateDir = config.dataDir.replace(/\/runs$/, "/bulk-scans");
-      const statePath = await saveBulkScanState(
-        { scanIds, profile: opts.profile, promptCount: prompts.length, sessionId },
-        stateDir
-      );
-      ui.status(`Scan IDs saved: ${statePath}`);
-      ui.status(`Submitted ${scanIds.length} batch(es), polling for results...`);
-      const results = await service.pollResults(scanIds, void 0, {
-        onRetry: (attempt, delayMs) => {
-          ui.status(`\u26A0 Rate limited \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`);
+      ui.status(`Batches:  ${Math.ceil(prompts.length / batchSize)} (size ${batchSize})`);
+      ui.status(`State:    ${statePath}`);
+      for (let logicalStart = 0; logicalStart < state.items.length; logicalStart += batchSize) {
+        const logicalBatch = state.items.slice(logicalStart, logicalStart + batchSize);
+        ui.status(`Submitting batch ${Math.floor(logicalStart / batchSize) + 1}...`);
+        for (let sdkStart = 0; sdkStart < logicalBatch.length; sdkStart += SDK_ASYNC_BATCH_SIZE) {
+          const chunk = logicalBatch.slice(sdkStart, sdkStart + SDK_ASYNC_BATCH_SIZE);
+          for (const item of chunk) item.status = "submitting";
+          statePath = await saveBulkScanState(state, stateDir, statePath);
+          try {
+            const batch = await service.submitBatch(opts.profile, chunk, sessionId, {
+              onRetry: (attempt, delayMs) => {
+                ui.status(
+                  `\u26A0 Rate limited while submitting \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`
+                );
+              }
+            });
+            for (const entry of batch.entries) {
+              const item = bulkItemAtIndex(state, entry.index);
+              item.status = "submitted";
+              item.scanId = entry.scanId;
+              item.receiptReportId = batch.reportId;
+            }
+            statePath = await saveBulkScanState(state, stateDir, statePath);
+          } catch (err) {
+            for (const item of chunk) {
+              item.status = isDefiniteSubmissionRejection(err) ? "pending" : "ambiguous";
+              item.error = err instanceof Error ? err.message : String(err);
+            }
+            await saveBulkScanState(state, stateDir, statePath);
+            throw err;
+          }
+        }
+        ui.status(`Scan IDs saved: ${statePath}`);
+        for (const batch of submittedBatches(logicalBatch)) {
+          const batchResults = await service.pollBatch(batch, void 0, {
+            onRetry: (attempt, delayMs) => {
+              ui.status(`\u26A0 Rate limited \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`);
+            },
+            onProgress: async (results2) => {
+              recordBulkResults(state, results2);
+              statePath = await saveBulkScanState(state, stateDir, statePath);
+              await writeBulkResults(outputPath, completedBulkResults(state));
+            }
+          });
+          recordBulkResults(state, batchResults);
+          statePath = await saveBulkScanState(state, stateDir, statePath);
+          await writeBulkResults(outputPath, completedBulkResults(state));
         }
-      });
-      for (let i = 0; i < results.length && i < prompts.length; i++) {
-        results[i].prompt = prompts[i];
       }
-      const outputPath = opts.outputFile ?? `${opts.profile.replace(/\s+/g, "-")}-bulk-scan.csv`;
-      const csv = SdkRuntimeService.formatResultsCsv(results);
-      await writeFile4(outputPath, csv, "utf-8");
+      const results = completedBulkResults(state);
+      await writeBulkResults(outputPath, results);
       const blocked = results.filter((r) => r.action === "block").length;
       const allowed = results.filter((r) => r.action === "allow").length;
+      const failed = results.filter((r) => r.action === "failed").length;
       ui.header("Bulk Scan Complete");
       ui.keyValue([
         ["Total", results.length],
         ["Blocked", chalk10.red(String(blocked))],
         ["Allowed", chalk10.green(String(allowed))],
+        ["Failed", chalk10.red(String(failed))],
         ["Output", chalk10.cyan(outputPath)]
       ]);
+      if (failed > 0) {
+        ui.error(`${failed} prompt(s) failed; successful results were preserved.`);
+        process.exitCode = 1;
+      }
     } catch (err) {
+      await releaseJobLock?.();
+      releaseJobLock = void 0;
       fail(err);
+    } finally {
+      await releaseJobLock?.();
     }
   });
   const customerApps = runtime.command("customer-apps").description("Manage AIRS customer apps");
@@ -6349,7 +6694,7 @@ function registerRuntimeCommand(program) {
     try {
       renderRuntimeConfigHeader();
       const service = await createMgmtService();
-      const config = JSON.parse(fs4.readFileSync(opts.config, "utf-8"));
+      const config = JSON.parse(fs5.readFileSync(opts.config, "utf-8"));
       const app = await service.updateCustomerApp(appId, config);
       ui.success(`Customer app updated: ${app.name}`);
       renderCustomerAppDetail(app);
@@ -6485,7 +6830,7 @@ function registerRuntimeCommand(program) {
       renderRuntimeConfigHeader();
       let profile;
       if (opts.config) {
-        const config = JSON.parse(fs4.readFileSync(opts.config, "utf-8"));
+        const config = JSON.parse(fs5.readFileSync(opts.config, "utf-8"));
         profile = await service.createProfile(config);
       } else {
         const request = buildProfileRequest({
@@ -6545,7 +6890,7 @@ function registerRuntimeCommand(program) {
       const profileId = resolved.profileId;
       let profile;
       if (opts.config) {
-        const config = JSON.parse(fs4.readFileSync(opts.config, "utf-8"));
+        const config = JSON.parse(fs5.readFileSync(opts.config, "utf-8"));
         profile = await service.updateProfile(profileId, config);
       } else {
         const current = resolved;
@@ -6626,37 +6971,111 @@ function registerRuntimeCommand(program) {
   });
   resumePoll.action(async (stateFile, opts) => {
     resolveDeprecatedAliases(resumePoll, opts);
+    let releaseJobLock;
     try {
+      stateFile = await fs5.promises.realpath(stateFile);
+      releaseJobLock = await acquireBulkScanLock(stateFile);
       const config = await loadConfig({});
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
       }
       const state = await loadBulkScanState(stateFile);
       const service = new SdkRuntimeService(runtimeInitOptions(config));
+      const unresolvedSubmission = state.items.find(
+        (item) => item.status === "submitting" || item.status === "ambiguous"
+      );
+      const outputPath = resolvePath(opts.outputFile ?? state.outputFile);
+      state.outputFile = outputPath;
+      await saveBulkScanState(state, dirname2(stateFile), stateFile);
+      const pollSubmitted = async (items) => {
+        for (const batch of submittedBatches(items)) {
+          const results2 = await service.pollBatch(batch, void 0, {
+            onRetry: (attempt, delayMs) => {
+              ui.status(`\u26A0 Rate limited \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`);
+            },
+            onProgress: async (progress) => {
+              recordBulkResults(state, progress);
+              await saveBulkScanState(state, dirname2(stateFile), stateFile);
+              await writeBulkResults(outputPath, completedBulkResults(state));
+            }
+          });
+          recordBulkResults(state, results2);
+          await saveBulkScanState(state, dirname2(stateFile), stateFile);
+          await writeBulkResults(outputPath, completedBulkResults(state));
+        }
+      };
+      if (unresolvedSubmission) {
+        await pollSubmitted(state.items);
+        await writeBulkResults(outputPath, completedBulkResults(state));
+        throw new Error(
+          `Cannot safely resubmit prompt ${unresolvedSubmission.index}: its submission outcome is ambiguous. Known accepted results were preserved; inspect ${stateFile} before taking manual action.`
+        );
+      }
       ui.status("Prisma AIRS Resume Poll");
       ui.status(`Profile:  ${state.profile}`);
-      ui.status(`Scan IDs: ${state.scanIds.length}`);
-      ui.status(`Prompts:  ${state.promptCount}`);
-      ui.status("Polling for results...");
-      const results = await service.pollResults(state.scanIds, void 0, {
-        onRetry: (attempt, delayMs) => {
-          ui.status(`\u26A0 Rate limited \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`);
+      ui.status(
+        `Scan IDs: ${new Set(state.items.flatMap((item) => item.scanId ? [item.scanId] : [])).size}`
+      );
+      ui.status(`Prompts:  ${state.items.length}`);
+      for (let logicalStart = 0; logicalStart < state.items.length; logicalStart += state.batchSize) {
+        const logicalBatch = state.items.slice(logicalStart, logicalStart + state.batchSize);
+        await pollSubmitted(logicalBatch);
+        const pendingItems = logicalBatch.filter((item) => item.status === "pending").sort((left, right) => left.index - right.index);
+        for (let start = 0; start < pendingItems.length; start += SDK_ASYNC_BATCH_SIZE) {
+          const chunk = pendingItems.slice(start, start + SDK_ASYNC_BATCH_SIZE);
+          for (const item of chunk) item.status = "submitting";
+          await saveBulkScanState(state, dirname2(stateFile), stateFile);
+          try {
+            const batch = await service.submitBatch(state.profile, chunk, state.sessionId, {
+              onRetry: (attempt, delayMs) => {
+                ui.status(
+                  `\u26A0 Rate limited while submitting \u2014 retry ${attempt} in ${(delayMs / 1e3).toFixed(0)}s...`
+                );
+              }
+            });
+            for (const entry of batch.entries) {
+              const item = bulkItemAtIndex(state, entry.index);
+              item.status = "submitted";
+              item.scanId = entry.scanId;
+              item.receiptReportId = batch.reportId;
+              item.error = void 0;
+            }
+            await saveBulkScanState(state, dirname2(stateFile), stateFile);
+          } catch (error) {
+            for (const item of chunk) {
+              item.status = isDefiniteSubmissionRejection(error) ? "pending" : "ambiguous";
+              item.error = error instanceof Error ? error.message : String(error);
+            }
+            await saveBulkScanState(state, dirname2(stateFile), stateFile);
+            throw error;
+          }
         }
-      });
-      const outputPath = opts.outputFile ?? `${state.profile.replace(/\s+/g, "-")}-bulk-scan.csv`;
-      const csv = SdkRuntimeService.formatResultsCsv(results);
-      await writeFile4(outputPath, csv, "utf-8");
+        await pollSubmitted(logicalBatch);
+      }
+      await saveBulkScanState(state, dirname2(stateFile), stateFile);
+      const results = completedBulkResults(state);
+      await writeBulkResults(outputPath, results);
       const blocked = results.filter((r) => r.action === "block").length;
       const allowed = results.filter((r) => r.action === "allow").length;
+      const failed = results.filter((r) => r.action === "failed").length;
       ui.header("Resume Poll Complete");
       ui.keyValue([
         ["Total", results.length],
         ["Blocked", chalk10.red(String(blocked))],
         ["Allowed", chalk10.green(String(allowed))],
+        ["Failed", chalk10.red(String(failed))],
         ["Output", chalk10.cyan(outputPath)]
       ]);
+      if (failed > 0) {
+        ui.error(`${failed} prompt(s) failed; successful results were preserved.`);
+        process.exitCode = 1;
+      }
     } catch (err) {
+      await releaseJobLock?.();
+      releaseJobLock = void 0;
       fail(err);
+    } finally {
+      await releaseJobLock?.();
     }
   });
   runtime.command("scan <prompt>").description("Scan a single prompt against an AIRS security profile").requiredOption("--profile <name>", "Security profile name").option("--response <text>", "Response text to scan alongside the prompt").addHelpText(
@@ -6780,7 +7199,7 @@ function registerRuntimeCommand(program) {
     try {
       renderRuntimeConfigHeader();
       const service = await createMgmtService();
-      const config = JSON.parse(fs4.readFileSync(opts.config, "utf-8"));
+      const config = JSON.parse(fs5.readFileSync(opts.config, "utf-8"));
       const topic = await service.updateTopic(topicId, config);
       ui.success(`Topic updated: ${topic.topic_id}`);
       renderTopicDetail(topic);
@@ -6800,7 +7219,7 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3, join as join3 } from "path";
 var AIRS_DOMAINS = [
   "api.sase.paloaltonetworks.com",
   "service.api.aisecurity.paloaltonetworks.com",
@@ -6863,7 +7282,7 @@ function pruneDebugLogs(dir, keep) {
     return;
   }
   const byAge = files.map((f) => {
-    const path3 = join2(dir, f);
+    const path3 = join3(dir, f);
     try {
       return { path: path3, mtime: statSync(path3).mtimeMs };
     } catch {
@@ -6893,9 +7312,9 @@ function headersToRecord(headers) {
 }
 var KEEP_DEBUG_LOGS = 10;
 function installDebugLogger(logPath) {
-  mkdirSync(dirname2(logPath), { recursive: true });
+  mkdirSync(dirname3(logPath), { recursive: true });
   writeFileSync2(logPath, "", "utf-8");
-  pruneDebugLogs(dirname2(logPath), KEEP_DEBUG_LOGS);
+  pruneDebugLogs(dirname3(logPath), KEEP_DEBUG_LOGS);
   const originalFetch = globalThis.fetch;
   globalThis.fetch = async function debugFetch(input, init2) {
     const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
@@ -6979,8 +7398,8 @@ function applyListDeleteAliases(cmd) {
   }
 }
 function buildProgram() {
-  const here = dirname3(fileURLToPath(import.meta.url));
-  const pkg = JSON.parse(readFileSync4(join3(here, "../../package.json"), "utf-8"));
+  const here = dirname4(fileURLToPath(import.meta.url));
+  const pkg = JSON.parse(readFileSync4(join4(here, "../../package.json"), "utf-8"));
   const program = new Command();
   program.name("airs").description(
     "CLI and library for Palo Alto Prisma AIRS \u2014 guardrail refinement, AI red teaming, model security scanning, profile audits"
@@ -6989,7 +7408,7 @@ function buildProgram() {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
     if (root.debug) {
-      const logPath = join3(homedir(), ".prisma-airs", `debug-api-${Date.now()}.jsonl`);
+      const logPath = join4(homedir(), ".prisma-airs", `debug-api-${Date.now()}.jsonl`);
       installDebugLogger(logPath);
       ui.status(`Debug: API log \u2192 ${logPath}`);
     }