@cdot65/prisma-airs-cli 3.2.0 → 4.0.0

package/dist/cli/index.js

@@ -20,7 +20,7 @@ import {
   sanitizeFilename,
   validateTopic,
   writeBackupFile
-} from "../chunk-TTBN7YHC.js";
+} from "../chunk-W5YDJS7H.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -45,20 +45,221 @@ import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
 
-// src/cli/examples.ts
-function examples(...lines) {
-  return `
-Examples:
-${lines.map((l) => `  $ ${l}`).join("\n")}
-`;
+// src/airs/aigateway.ts
+import {
+  AIGatewayClient
+} from "@cdot65/prisma-airs-sdk";
+function toLimitArray(value) {
+  if (Array.isArray(value)) return value;
+  if (value !== null && typeof value === "object") return [value];
+  return [];
+}
+function normalizeWorkspace(raw) {
+  return {
+    id: raw.id,
+    slug: raw.slug,
+    name: raw.name,
+    icon: raw.icon,
+    description: raw.description,
+    createdAt: raw.created_at,
+    lastUpdatedAt: raw.last_updated_at,
+    isDefault: Boolean(raw.is_default),
+    status: raw.status,
+    scopeName: raw.scope_name
+  };
 }
+function normalizeWorkspaceDetail(raw) {
+  return {
+    ...normalizeWorkspace(raw),
+    defaults: raw.defaults,
+    usageLimits: toLimitArray(raw.usage_limits),
+    rateLimits: toLimitArray(raw.rate_limits),
+    securitySettings: raw.security_settings,
+    dataPlaneSecuritySettings: raw.data_plane_security_settings,
+    settings: raw.settings
+  };
+}
+function aiGatewayGrantHint(err) {
+  const status = err?.status ?? err?.statusCode;
+  if (status !== 403) return void 0;
+  const message = err instanceof Error ? err.message : String(err);
+  const grant = message.includes("AB03") ? "the service account is missing a workspace-scope grant (data plane, /ai_gw/v2)" : "the service account is missing a tenant-root admin grant (admin plane, /ai_gw/admin/v2)";
+  return `${grant}. SCM Access Management edits the existing role row by default \u2014 use "Add Role" so the account ends up with both role rows, not one row moved.`;
+}
+var SdkAiGatewayService = class {
+  client;
+  constructor(opts) {
+    this.client = new AIGatewayClient(opts);
+  }
+  async listWorkspaces(options) {
+    const response = await this.client.workspaces.list(options);
+    return response.data.map(normalizeWorkspace);
+  }
+  async listAllWorkspaces() {
+    const [active, archived] = await Promise.all([
+      this.client.workspaces.list({ plane: "admin" }),
+      this.client.workspaces.list({ plane: "admin", status: "archived" })
+    ]);
+    return [
+      ...active.data,
+      ...archived.data
+    ].map(normalizeWorkspace);
+  }
+  async getWorkspace(workspaceRef, options) {
+    try {
+      const raw = await this.client.workspaces.get(workspaceRef, options);
+      return normalizeWorkspaceDetail(raw);
+    } catch (err) {
+      const status = err.statusCode;
+      if (status !== 404) throw err;
+      const resolved = await this.resolveWorkspaceRef(workspaceRef, [
+        options?.plane ?? "data",
+        "admin"
+      ]);
+      if (resolved === workspaceRef) throw err;
+      const raw = await this.client.workspaces.get(resolved, options);
+      return normalizeWorkspaceDetail(raw);
+    }
+  }
+  async createWorkspace(request) {
+    const body = {
+      name: request.name,
+      scope_name: request.scopeName
+    };
+    if (request.description !== void 0) body.description = request.description;
+    if (request.icon !== void 0) body.icon = request.icon;
+    if (request.defaults !== void 0) body.defaults = request.defaults;
+    if (request.users !== void 0) body.users = request.users;
+    if (request.usageLimits !== void 0) body.usage_limits = request.usageLimits;
+    if (request.rateLimits !== void 0) body.rate_limits = request.rateLimits;
+    const created = await this.client.workspaces.create(body);
+    return this.refetchAfterWrite(created.id, created);
+  }
+  async updateWorkspace(workspaceRef, request) {
+    const ref = await this.resolveWorkspaceRef(workspaceRef, ["admin"]);
+    const body = {};
+    if (request.name !== void 0) body.name = request.name;
+    if (request.description !== void 0) body.description = request.description;
+    if (request.icon !== void 0) body.icon = request.icon;
+    if (request.defaults !== void 0) body.defaults = request.defaults;
+    if (request.usageLimits !== void 0) body.usage_limits = request.usageLimits;
+    if (request.rateLimits !== void 0) body.rate_limits = request.rateLimits;
+    await this.client.workspaces.update(ref, body);
+    return this.getWorkspace(ref, { plane: "admin" });
+  }
+  async deleteWorkspace(workspaceRef) {
+    const ref = await this.resolveWorkspaceRef(workspaceRef, ["admin"]);
+    await this.client.workspaces.delete(ref);
+  }
+  /**
+   * The API accepts only a UUID or slug as a workspace ref — a display name
+   * gets a misleading 400 AB01 ("No update fields provided") on writes.
+   * Match a user-supplied ref against the workspace list so name | slug |
+   * uuid all work. Unmatched refs pass through so the API's own error stands.
+   */
+  async resolveWorkspaceRef(ref, planes) {
+    for (const plane of planes) {
+      let rows;
+      try {
+        rows = await this.listWorkspaces({ plane });
+      } catch {
+        continue;
+      }
+      if (rows.some((w) => w.id === ref || w.slug === ref)) return ref;
+      const byName = rows.filter((w) => w.name === ref);
+      if (byName.length > 1) {
+        throw new Error(
+          `workspace name '${ref}' is ambiguous (${byName.map((w) => w.slug).join(", ")}) \u2014 use a slug or UUID`
+        );
+      }
+      if (byName.length === 1) return byName[0].slug;
+    }
+    return ref;
+  }
+  async getTelemetryCost(opts) {
+    const days = opts.days ?? 7;
+    const workspaceSlug = await this.resolveWorkspaceRef(opts.workspaceSlug, ["data", "admin"]);
+    const raw = await this.client.telemetry.cost({
+      workspaceSlug,
+      days
+    });
+    return {
+      workspaceSlug,
+      days,
+      totalCents: raw.data.total,
+      totalUsd: raw.data.total / 100,
+      avgCents: raw.data.avg,
+      avgUsd: raw.data.avg / 100,
+      quotaExceeded: raw.data.isQuotaExceeded,
+      records: raw.data.records.map((r) => ({
+        date: r.x,
+        costCents: r.y,
+        costUsd: r.y / 100
+      }))
+    };
+  }
+  /** Re-read after a write, falling back to the (partial) write response if the get fails. */
+  async refetchAfterWrite(workspaceRef, writeResponse) {
+    try {
+      return await this.getWorkspace(workspaceRef, { plane: "admin" });
+    } catch {
+      return normalizeWorkspaceDetail(writeResponse);
+    }
+  }
+};
 
-// src/cli/renderer/ui.ts
-import chalk3 from "chalk";
+// src/config/client-options.ts
+function runtimeInitOptions(config) {
+  return {
+    apiKey: config.airsApiKey,
+    apiToken: config.airsApiToken,
+    apiEndpoint: config.airsApiEndpoint,
+    numRetries: config.airsNumRetries
+  };
+}
+function redTeamClientOptions(config) {
+  return {
+    clientId: config.mgmtClientId,
+    clientSecret: config.mgmtClientSecret,
+    tsgId: config.mgmtTsgId,
+    dataEndpoint: config.redTeamDataEndpoint,
+    mgmtEndpoint: config.redTeamMgmtEndpoint,
+    tokenEndpoint: config.redTeamTokenEndpoint ?? config.mgmtTokenEndpoint,
+    networkBrokerEndpoint: config.redTeamNetworkBrokerEndpoint
+  };
+}
+function aiGatewayClientOptions(config) {
+  return {
+    clientId: config.mgmtClientId,
+    clientSecret: config.mgmtClientSecret,
+    tsgId: config.mgmtTsgId,
+    dataEndpoint: config.aiGwDataEndpoint,
+    adminEndpoint: config.aiGwAdminEndpoint,
+    tokenEndpoint: config.aiGwTokenEndpoint ?? config.mgmtTokenEndpoint
+  };
+}
+function modelSecurityClientOptions(config) {
+  return {
+    clientId: config.mgmtClientId,
+    clientSecret: config.mgmtClientSecret,
+    tsgId: config.mgmtTsgId,
+    dataEndpoint: config.modelSecDataEndpoint,
+    mgmtEndpoint: config.modelSecMgmtEndpoint,
+    tokenEndpoint: config.modelSecTokenEndpoint ?? config.mgmtTokenEndpoint
+  };
+}
+
+// src/cli/renderer/aigateway.ts
+import chalk4 from "chalk";
+import { dump as yamlDump } from "js-yaml";
 
 // src/cli/renderer/common.ts
 import chalk2 from "chalk";
+import { dump } from "js-yaml";
+var CliUsageError = class extends Error {
+};
 function fail(err) {
+  if (err instanceof CliUsageError) usageError(err.message);
   const message = err instanceof Error ? err.message : String(err);
   const status = err?.status ?? err?.statusCode;
   console.error(chalk2.red(`
@@ -76,44 +277,81 @@ function usageError(message) {
 `));
   process.exit(2);
 }
-var OUTPUT_FORMATS = ["pretty", "table", "csv", "json", "yaml"];
+var OUTPUT_FORMATS = [
+  "pretty",
+  "table",
+  "markdown",
+  "csv",
+  "json",
+  "yaml"
+];
+async function resolveOutput(command, opts, resolution = {}) {
+  const localIsExplicit = command.getOptionValueSource?.("output") === "cli";
+  const root = command.parent ? command.optsWithGlobals() : command.opts();
+  let configured;
+  try {
+    configured = (await loadConfig()).defaultOutput;
+  } catch (error) {
+    if (process.env.PANW_CLI_OUTPUT !== void 0) configured = process.env.PANW_CLI_OUTPUT;
+    else throw error;
+  }
+  const candidate = String(localIsExplicit ? opts.output : root.output ?? configured ?? "pretty");
+  if (!OUTPUT_FORMATS.includes(candidate))
+    throw new CliUsageError(
+      `Invalid output format '${candidate}'. Expected: ${OUTPUT_FORMATS.join(", ")}`
+    );
+  const format = candidate;
+  const allowed = resolution.allowed ?? OUTPUT_FORMATS;
+  if (!allowed.includes(format))
+    throw new CliUsageError(
+      `Output format '${format}' is not supported here. Expected: ${allowed.join(", ")}`
+    );
+  return format;
+}
+function displayValue(value) {
+  if (value == null) return "";
+  return typeof value === "object" ? JSON.stringify(value) : String(value);
+}
+function csvCell(value) {
+  const text = displayValue(value);
+  return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+function markdownCell(value) {
+  return displayValue(value).replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\r?\n/g, "<br>");
+}
 function formatOutput(rows, columns, format) {
-  if (rows.length === 0) return "";
-  const vals = (row, key) => String(row[key] ?? "");
+  if (rows.length === 0) return format === "json" ? "[]" : "";
+  const projected = rows.map((row) => columns.map((column) => row[column.key]));
   switch (format) {
     case "json":
-      return JSON.stringify(
-        rows.map((r) => {
-          const obj = {};
-          for (const c of columns) obj[c.key] = r[c.key];
-          return obj;
-        }),
-        null,
-        2
-      );
-    case "csv": {
-      const header = columns.map((c) => c.label).join(",");
-      const lines = rows.map(
-        (r) => columns.map((c) => {
-          const v = vals(r, c.key);
-          return v.includes(",") || v.includes('"') ? `"${v.replace(/"/g, '""')}"` : v;
-        }).join(",")
-      );
-      return [header, ...lines].join("\n");
-    }
-    case "yaml": {
-      return rows.map((r) => columns.map((c) => `${c.key}: ${vals(r, c.key)}`).join("\n")).join("\n---\n");
+      return JSON.stringify(rows, null, 2);
+    case "yaml":
+      return dump(rows, { noRefs: true, lineWidth: -1 }).trimEnd();
+    case "csv":
+      return [
+        columns.map((column) => csvCell(column.label)).join(","),
+        ...projected.map((values) => values.map(csvCell).join(","))
+      ].join("\n");
+    case "markdown": {
+      const header = `| ${columns.map((column) => markdownCell(column.label)).join(" | ")} |`;
+      const divider = `| ${columns.map(() => "---").join(" | ")} |`;
+      return [
+        header,
+        divider,
+        ...projected.map((values) => `| ${values.map(markdownCell).join(" | ")} |`)
+      ].join("\n");
     }
     case "table": {
+      const values = projected.map((row) => row.map(displayValue));
       const widths = columns.map(
-        (c) => Math.max(c.label.length, ...rows.map((r) => vals(r, c.key).length))
+        (column, index) => Math.max(column.label.length, ...values.map((row) => row[index].length))
       );
-      const sep = widths.map((w) => "\u2500".repeat(w + 2)).join("\u253C");
-      const header = columns.map((c, i) => ` ${c.label.padEnd(widths[i])} `).join("\u2502");
-      const body = rows.map(
-        (r) => columns.map((c, i) => ` ${vals(r, c.key).padEnd(widths[i])} `).join("\u2502")
+      const separator = widths.map((width) => "\u2500".repeat(width + 2)).join("\u253C");
+      const header = columns.map((column, index) => ` ${column.label.padEnd(widths[index])} `).join("\u2502");
+      const body = values.map(
+        (row) => row.map((value, index) => ` ${value.padEnd(widths[index])} `).join("\u2502")
       );
-      return [header, sep, ...body].join("\n");
+      return [header, separator, ...body].join("\n");
     }
     default:
       return "";
@@ -121,6 +359,7 @@ function formatOutput(rows, columns, format) {
 }
 
 // src/cli/renderer/ui.ts
+import chalk3 from "chalk";
 var INDENT = "  ";
 var quietMode = false;
 function setQuiet(quiet) {
@@ -211,6 +450,187 @@ ${INDENT}${chalk3.bold(label)}
   }
 };
 
+// src/cli/renderer/view.ts
+import { dump as dump2 } from "js-yaml";
+function asRecord(item) {
+  return item;
+}
+function project(view, item) {
+  const source = asRecord(item);
+  return Object.fromEntries(
+    view.columns.map((column) => [column.key, column.get ? column.get(item) : source[column.key]])
+  );
+}
+function renderPageStatus(page) {
+  if (!page) return;
+  if (page.all) ui.status(`Showing all ${page.total ?? page.returned}`);
+  else if (page.total !== void 0)
+    ui.status(
+      `Showing ${page.returned} of ${page.total}${page.next !== void 0 ? ` (next --offset ${page.next})` : ""}`
+    );
+  else if (page.next !== void 0) ui.status(`Showing ${page.returned} (more available)`);
+  else ui.status(`Showing ${page.returned}`);
+}
+function emitList(view, items, format, opts = {}) {
+  if (format === "pretty") {
+    if (items.length === 0) ui.emptyList(view.name);
+    else view.pretty.list(items);
+  } else {
+    const rows = format === "json" || format === "yaml" ? items.map((item) => view.structured?.(item) ?? asRecord(item)) : items.map((item) => project(view, item));
+    const rendered = formatOutput(rows, view.columns, format);
+    if (rendered) console.log(rendered);
+  }
+  renderPageStatus(opts.page);
+}
+function emitDetail(view, item, format) {
+  if (format === "pretty") {
+    view.pretty.detail(item);
+    return;
+  }
+  const structured = view.structured?.(item) ?? asRecord(item);
+  if (format === "json") console.log(JSON.stringify(structured, null, 2));
+  else if (format === "yaml")
+    console.log(dump2(structured, { noRefs: true, lineWidth: -1 }).trimEnd());
+  else {
+    const rows = Object.entries(structured).map(([key, value]) => ({
+      key,
+      value: value != null && typeof value === "object" ? JSON.stringify(value) : value
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "key", label: "Key" },
+          { key: "value", label: "Value" }
+        ],
+        format
+      )
+    );
+  }
+}
+
+// src/cli/renderer/aigateway.ts
+function renderAiGatewayHeader() {
+  ui.header("Prisma AIRS \u2014 AI Gateway", "Gateway workspace operations");
+}
+function statusColor(status) {
+  switch (status.toLowerCase()) {
+    case "active":
+      return chalk4.green;
+    case "archived":
+      return chalk4.yellow;
+    default:
+      return chalk4.dim;
+  }
+}
+function statusLabel(status) {
+  return status ?? "unknown";
+}
+function renderWorkspaceList(workspaces, format = "pretty") {
+  if (workspaces.length === 0) {
+    ui.emptyList("workspaces");
+    return;
+  }
+  if (format !== "pretty") {
+    const rows = workspaces.map((w) => ({
+      id: w.id,
+      slug: w.slug,
+      name: w.name,
+      status: statusLabel(w.status),
+      isDefault: w.isDefault,
+      scopeName: w.scopeName ?? ""
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "id", label: "ID" },
+          { key: "slug", label: "Slug" },
+          { key: "name", label: "Name" },
+          { key: "status", label: "Status" },
+          { key: "isDefault", label: "Default" },
+          { key: "scopeName", label: "Scope" }
+        ],
+        format
+      )
+    );
+    return;
+  }
+  ui.section("AI Gateway Workspaces:");
+  for (const w of workspaces) {
+    ui.dim(w.id);
+    const status = statusColor(statusLabel(w.status))(statusLabel(w.status));
+    const dflt = w.isDefault ? chalk4.cyan("  default") : "";
+    console.log(`    ${w.name}  ${chalk4.dim(w.slug)}  ${status}${dflt}`);
+    if (w.scopeName) console.log(`    ${chalk4.dim(`scope: ${w.scopeName}`)}`);
+    console.log();
+  }
+}
+function renderWorkspaceDetail(workspace, format = "pretty") {
+  if (format !== "pretty") {
+    console.log(format === "json" ? JSON.stringify(workspace, null, 2) : yamlDump(workspace));
+    return;
+  }
+  ui.section("Workspace Detail:");
+  const pairs = [
+    ["ID", workspace.id],
+    ["Slug", workspace.slug],
+    ["Name", workspace.name],
+    ["Status", statusColor(statusLabel(workspace.status))(statusLabel(workspace.status))],
+    ["Default", workspace.isDefault ? "yes" : "no"]
+  ];
+  if (workspace.description != null) pairs.push(["Description", workspace.description]);
+  if (workspace.scopeName != null) pairs.push(["Scope", workspace.scopeName]);
+  if (workspace.createdAt != null) pairs.push(["Created", workspace.createdAt]);
+  if (workspace.lastUpdatedAt != null) pairs.push(["Updated", workspace.lastUpdatedAt]);
+  ui.keyValue(pairs);
+  if (workspace.defaults && Object.keys(workspace.defaults).length > 0) {
+    ui.section("Defaults:");
+    console.log(chalk4.dim(JSON.stringify(workspace.defaults, null, 2)));
+  }
+  if (workspace.usageLimits.length > 0) {
+    ui.section("Usage Limits:");
+    console.log(chalk4.dim(JSON.stringify(workspace.usageLimits, null, 2)));
+  }
+  if (workspace.rateLimits.length > 0) {
+    ui.section("Rate Limits:");
+    console.log(chalk4.dim(JSON.stringify(workspace.rateLimits, null, 2)));
+  }
+  if (workspace.securitySettings && Object.keys(workspace.securitySettings).length > 0) {
+    ui.section("Security Settings:");
+    ui.keyValue(Object.entries(workspace.securitySettings).map(([k, v]) => [k, v]));
+  }
+  console.log();
+}
+function renderCostReport(report, format = "pretty") {
+  if (format !== "pretty") {
+    emitDetail(
+      {
+        name: "cost report",
+        columns: [],
+        pretty: { list() {
+        }, detail() {
+        } }
+      },
+      report,
+      format
+    );
+    return;
+  }
+  const dollars = (cents) => `$${(cents / 100).toFixed(2)}`;
+  ui.section(`Cost \u2014 ${report.workspaceSlug} (last ${report.days}d):`);
+  ui.keyValue([
+    ["Total", dollars(report.totalCents)],
+    ["Daily average", dollars(report.avgCents)]
+  ]);
+  if (report.quotaExceeded) ui.warn("Telemetry quota exceeded \u2014 data may be truncated");
+  if (report.records.length > 0) {
+    ui.section("Per day:");
+    ui.keyValue(report.records.map((r) => [r.date, dollars(r.costCents)]));
+  }
+  console.log();
+}
+
 // src/cli/renderer/backup.ts
 function renderBackupHeader() {
   ui.header("Prisma AIRS \u2014 Backup & Restore");
@@ -252,17 +672,17 @@ function renderRestoreSummary(results) {
 }
 
 // src/cli/renderer/dlp.ts
-import chalk4 from "chalk";
-import { dump as yamlDump } from "js-yaml";
-function statusColor(status) {
+import chalk5 from "chalk";
+import { dump as yamlDump2 } from "js-yaml";
+function statusColor2(status) {
   switch (status) {
     case "active":
-      return chalk4.green(status);
+      return chalk5.green(status);
     case "deleted":
     case "disabled":
-      return chalk4.yellow(status);
+      return chalk5.yellow(status);
     default:
-      return status ? chalk4.dim(status) : chalk4.dim("\u2014");
+      return status ? chalk5.dim(status) : chalk5.dim("\u2014");
   }
 }
 function ts(ms) {
@@ -279,7 +699,7 @@ function emitStructured(payload, fmt) {
     return;
   }
   if (fmt === "yaml") {
-    console.log(yamlDump(payload));
+    console.log(yamlDump2(payload));
     return;
   }
   console.log(JSON.stringify(payload, null, 2));
@@ -293,60 +713,67 @@ function pageMeta(page, returned) {
     returned
   };
 }
-function emitList(page, fmt, header, toRow, columns, prettyLine) {
-  const content = Array.isArray(page?.content) ? page.content : [];
-  const rows = content.map(toRow);
-  if (fmt === "json" || fmt === "yaml") {
-    emitStructured({ items: rows, page: pageMeta(page, content.length) }, fmt);
-    return;
-  }
-  if (content.length === 0) {
-    ui.emptyList(header.toLowerCase());
-    return;
-  }
-  if (fmt === "pretty") {
-    ui.section(`${header}:`);
-    for (const item of content) console.log(prettyLine(item));
-    const meta = pageMeta(page, content.length);
-    console.log();
-    ui.dim(
-      `page=${meta.number} size=${meta.size} returned=${meta.returned} total=${meta.total ?? "?"}`
-    );
-    console.log();
-    return;
-  }
-  console.log(formatOutput(rows, columns, fmt));
+function camelKey(key) {
+  return key.replace(/[_-]([a-z0-9])/g, (_, char) => char.toUpperCase());
 }
-function fieldsToObject(fields) {
-  const obj = {};
-  for (const f of fields) {
-    if (f.value === void 0 || f.value === null || f.value === "") continue;
-    obj[toKey(f.label)] = f.value;
+function camelize(value) {
+  if (Array.isArray(value)) return value.map(camelize);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, child]) => [
+        camelKey(key),
+        camelize(child)
+      ])
+    );
   }
-  return obj;
-}
-function toKey(label) {
-  return label.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return value;
 }
-function emitDetail(_item, fmt, fields, title) {
-  if (fmt === "json" || fmt === "yaml") {
-    emitStructured(fieldsToObject(fields), fmt);
-    return;
-  }
-  if (fmt === "pretty") {
-    ui.section(`${title}:`);
-    const pairs = [];
-    for (const f of fields) {
-      if (f.value === void 0 || f.value === null || f.value === "") continue;
-      pairs.push([f.label, f.value]);
+function emitList2(page, fmt, header, toRow, columns, prettyLine) {
+  const content = Array.isArray(page?.content) ? page.content : [];
+  const meta = pageMeta(page, content.length);
+  const view = {
+    name: header.toLowerCase(),
+    columns: columns.map((column) => ({
+      ...column,
+      get: (item) => toRow(item)[column.key]
+    })),
+    structured: (item) => camelize(item),
+    pretty: {
+      list(items) {
+        ui.section(`${header}:`);
+        for (const item of items) console.log(prettyLine(item));
+        console.log();
+      },
+      detail() {
+      }
     }
-    ui.keyValue(pairs);
-    console.log();
-    return;
-  }
-  const rows = [Object.fromEntries(fields.map((f) => [f.label, f.value ?? ""]))];
-  const columns = fields.map((f) => ({ key: f.label, label: f.label }));
-  console.log(formatOutput(rows, columns, fmt));
+  };
+  const total = typeof meta.total === "number" ? meta.total : void 0;
+  const number = Number(meta.number ?? 0);
+  const size = Number(meta.size ?? content.length);
+  const next = total !== void 0 && (number + 1) * size < total ? (number + 1) * size : void 0;
+  emitList(view, content, fmt, { page: { returned: content.length, total, next } });
+}
+function emitDetail2(item, fmt, fields, title) {
+  const view = {
+    name: title.toLowerCase(),
+    columns: [],
+    structured: (value) => camelize(value),
+    pretty: {
+      list() {
+      },
+      detail() {
+        ui.section(`${title}:`);
+        ui.keyValue(
+          fields.filter(
+            (field) => field.value !== void 0 && field.value !== null && field.value !== ""
+          ).map((field) => [field.label, field.value])
+        );
+        console.log();
+      }
+    }
+  };
+  emitDetail(view, item, fmt);
 }
 function ackObject(verb, item) {
   const out = { action: verb };
@@ -377,7 +804,7 @@ function emitIdAck(verb, id) {
 }
 var dlpFilteringProfiles = {
   renderList(page, fmt) {
-    emitList(
+    emitList2(
       page,
       fmt,
       "Data Filtering Profiles",
@@ -398,16 +825,16 @@ var dlpFilteringProfiles = {
         { key: "version", label: "Version" }
       ],
       (it) => {
-        const dir = it.direction ? chalk4.dim(` dir:${it.direction}`) : "";
-        const sev = it.log_severity ? chalk4.dim(` sev:${it.log_severity}`) : "";
-        const ver = it.version != null ? chalk4.dim(` v${it.version}`) : "";
-        return `  ${chalk4.dim(it.id)}
-    ${it.name}  ${chalk4.cyan(it.type ?? "")}${dir}${sev}${ver}`;
+        const dir = it.direction ? chalk5.dim(` dir:${it.direction}`) : "";
+        const sev = it.log_severity ? chalk5.dim(` sev:${it.log_severity}`) : "";
+        const ver = it.version != null ? chalk5.dim(` v${it.version}`) : "";
+        return `  ${chalk5.dim(it.id)}
+    ${it.name}  ${chalk5.cyan(it.type ?? "")}${dir}${sev}${ver}`;
       }
     );
   },
   renderGet(item, fmt) {
-    emitDetail(
+    emitDetail2(
       item,
       fmt,
       [
@@ -436,7 +863,7 @@ var dlpFilteringProfiles = {
 };
 var dlpPatterns = {
   renderList(page, fmt) {
-    emitList(
+    emitList2(
       page,
       fmt,
       "Data Patterns",
@@ -457,15 +884,15 @@ var dlpPatterns = {
         { key: "version", label: "Version" }
       ],
       (it) => {
-        const tech = it.detection_config?.technique ? chalk4.dim(` ${it.detection_config.technique}`) : "";
-        const ver = it.version != null ? chalk4.dim(` v${it.version}`) : "";
-        return `  ${chalk4.dim(it.id)}
-    ${it.name}  ${chalk4.cyan(it.type ?? "")}  ${statusColor(it.status)}${tech}${ver}`;
+        const tech = it.detection_config?.technique ? chalk5.dim(` ${it.detection_config.technique}`) : "";
+        const ver = it.version != null ? chalk5.dim(` v${it.version}`) : "";
+        return `  ${chalk5.dim(it.id)}
+    ${it.name}  ${chalk5.cyan(it.type ?? "")}  ${statusColor2(it.status)}${tech}${ver}`;
       }
     );
   },
   renderGet(item, fmt) {
-    emitDetail(
+    emitDetail2(
       item,
       fmt,
       [
@@ -504,7 +931,7 @@ var dlpPatterns = {
 };
 var dlpProfiles = {
   renderList(page, fmt) {
-    emitList(
+    emitList2(
       page,
       fmt,
       "Data Profiles",
@@ -525,15 +952,15 @@ var dlpProfiles = {
         { key: "version", label: "Version" }
       ],
       (it) => {
-        const ptype = it.profile_type ? chalk4.dim(` ${it.profile_type}`) : "";
-        const ver = it.version != null ? chalk4.dim(` v${it.version}`) : "";
-        return `  ${chalk4.dim(it.id)}
-    ${it.name}  ${chalk4.cyan(it.type ?? "")}  ${statusColor(it.profile_status)}${ptype}${ver}`;
+        const ptype = it.profile_type ? chalk5.dim(` ${it.profile_type}`) : "";
+        const ver = it.version != null ? chalk5.dim(` v${it.version}`) : "";
+        return `  ${chalk5.dim(it.id)}
+    ${it.name}  ${chalk5.cyan(it.type ?? "")}  ${statusColor2(it.profile_status)}${ptype}${ver}`;
       }
     );
   },
   renderGet(item, fmt) {
-    emitDetail(
+    emitDetail2(
       item,
       fmt,
       [
@@ -561,7 +988,7 @@ var dlpProfiles = {
 };
 var dlpDictionaries = {
   renderList(page, fmt) {
-    emitList(
+    emitList2(
       page,
       fmt,
       "Data Dictionaries",
@@ -582,15 +1009,15 @@ var dlpDictionaries = {
         { key: "version", label: "Version" }
       ],
       (it) => {
-        const kw = Array.isArray(it.keywords) ? chalk4.dim(` ${it.keywords.length} kw`) : "";
-        const ver = it.version != null ? chalk4.dim(` v${it.version}`) : "";
-        return `  ${chalk4.dim(it.id)}
-    ${it.name}  ${chalk4.cyan(it.type ?? "")}  ${statusColor(it.status)}${kw}${ver}`;
+        const kw = Array.isArray(it.keywords) ? chalk5.dim(` ${it.keywords.length} kw`) : "";
+        const ver = it.version != null ? chalk5.dim(` v${it.version}`) : "";
+        return `  ${chalk5.dim(it.id)}
+    ${it.name}  ${chalk5.cyan(it.type ?? "")}  ${statusColor2(it.status)}${kw}${ver}`;
       }
     );
   },
   renderGet(item, fmt) {
-    emitDetail(
+    emitDetail2(
       item,
       fmt,
       [
@@ -627,7 +1054,7 @@ var dlpDictionaries = {
 };
 
 // src/cli/renderer/eval.ts
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 function buildEvalOutput(profile, topic, intent, metrics, results) {
   const fps = results.filter((r) => !r.testCase.expectedTriggered && r.actualTriggered).map((r) => ({ prompt: r.testCase.prompt, expected: false, actual: true }));
   const fns = results.filter((r) => r.testCase.expectedTriggered && !r.actualTriggered).map((r) => ({ prompt: r.testCase.prompt, expected: true, actual: false }));
@@ -651,7 +1078,7 @@ function buildEvalOutput(profile, topic, intent, metrics, results) {
   };
 }
 function renderEvalTerminal(output) {
-  const coverageColor = output.metrics.coverage >= 0.9 ? chalk5.green : output.metrics.coverage >= 0.7 ? chalk5.yellow : chalk5.red;
+  const coverageColor = output.metrics.coverage >= 0.9 ? chalk6.green : output.metrics.coverage >= 0.7 ? chalk6.yellow : chalk6.red;
   ui.header("Eval Results");
   ui.keyValue([
     ["Profile", output.profile],
@@ -684,8 +1111,16 @@ function renderEvalTerminal(output) {
 }
 
 // src/cli/renderer/modelsecurity.ts
-import chalk6 from "chalk";
-import { dump as yamlDump2 } from "js-yaml";
+import chalk7 from "chalk";
+function resourceView(name, columns, pretty) {
+  return { name, columns, pretty };
+}
+function structuredList(name, items, columns, format, pretty) {
+  emitList(resourceView(name, columns, { list: pretty, detail: () => void 0 }), items, format);
+}
+function structuredDetail(name, item, format, pretty) {
+  emitDetail(resourceView(name, [], { list: () => void 0, detail: pretty }), item, format);
+}
 function renderModelSecurityHeader() {
   ui.header("Prisma AIRS \u2014 Model Security", "ML model supply chain security");
 }
@@ -696,66 +1131,56 @@ function stateColor(state) {
     case "ALLOWING":
     case "PASSED":
     case "SUCCESS":
-      return chalk6.green;
+      return chalk7.green;
     case "BLOCKED":
     case "BLOCKING":
     case "FAILED":
-      return chalk6.red;
+      return chalk7.red;
     case "DISABLED":
-      return chalk6.dim;
+      return chalk7.dim;
     default:
-      return chalk6.yellow;
+      return chalk7.yellow;
   }
 }
 function renderGroupList(groups, format = "pretty") {
-  if (groups.length === 0) {
-    ui.emptyList("security groups");
-    return;
-  }
   if (format !== "pretty") {
-    const rows = groups.map((g) => ({
-      id: g.uuid,
-      name: g.name,
-      state: g.state,
-      sourceType: g.sourceType
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "name", label: "Name" },
-          { key: "state", label: "State" },
-          { key: "sourceType", label: "Source Type" }
-        ],
-        format
-      )
+    structuredList(
+      "security groups",
+      groups,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "name", label: "Name" },
+        { key: "state", label: "State" },
+        { key: "sourceType", label: "Source Type" }
+      ],
+      format,
+      () => void 0
     );
     return;
   }
+  if (groups.length === 0) {
+    ui.emptyList("security groups");
+    return;
+  }
   ui.section("Security Groups:");
   for (const g of groups) {
     ui.dim(g.uuid);
-    const color = g.state === "ACTIVE" ? chalk6.green : chalk6.yellow;
-    console.log(`    ${g.name}  ${color(g.state)}  source: ${chalk6.dim(g.sourceType)}`);
+    const color = g.state === "ACTIVE" ? chalk7.green : chalk7.yellow;
+    console.log(`    ${g.name}  ${color(g.state)}  source: ${chalk7.dim(g.sourceType)}`);
   }
   console.log();
 }
 function renderGroupDetail(group, format = "pretty") {
-  if (format === "json") {
-    console.log(JSON.stringify(group, null, 2));
-    return;
-  }
-  if (format === "yaml") {
-    console.log(yamlDump2(group));
+  if (format !== "pretty") {
+    structuredDetail("security group", group, format, () => void 0);
     return;
   }
   ui.section("Security Group Detail:");
-  const color = group.state === "ACTIVE" ? chalk6.green : chalk6.yellow;
+  const color = group.state === "ACTIVE" ? chalk7.green : chalk7.yellow;
   ui.keyValue([
     ["UUID", group.uuid],
     ["Name", group.name],
-    ["Description", group.description || chalk6.dim("(none)")],
+    ["Description", group.description || chalk7.dim("(none)")],
     ["Source Type", group.sourceType],
     ["State", color(group.state)],
     ["Created", group.createdAt],
@@ -764,45 +1189,46 @@ function renderGroupDetail(group, format = "pretty") {
   console.log();
 }
 function renderRuleList(rules, format = "pretty") {
-  if (rules.length === 0) {
-    ui.emptyList("security rules");
-    return;
-  }
   if (format !== "pretty") {
-    const rows = rules.map((r) => ({
-      id: r.uuid,
-      name: r.name,
-      type: r.ruleType,
-      defaultState: r.defaultState,
-      sources: r.compatibleSources.join(", ")
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "name", label: "Name" },
-          { key: "type", label: "Type" },
-          { key: "defaultState", label: "Default State" },
-          { key: "sources", label: "Sources" }
-        ],
-        format
-      )
+    structuredList(
+      "security rules",
+      rules,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "name", label: "Name" },
+        { key: "ruleType", label: "Type" },
+        { key: "defaultState", label: "Default State" },
+        {
+          key: "compatibleSources",
+          label: "Sources",
+          get: (rule) => rule.compatibleSources.join(", ")
+        }
+      ],
+      format,
+      () => void 0
     );
     return;
   }
+  if (rules.length === 0) {
+    ui.emptyList("security rules");
+    return;
+  }
   ui.section("Security Rules:");
   for (const r of rules) {
     ui.dim(r.uuid);
     console.log(
-      `    ${r.name}  type: ${chalk6.dim(r.ruleType)}  default: ${chalk6.dim(r.defaultState)}`
+      `    ${r.name}  type: ${chalk7.dim(r.ruleType)}  default: ${chalk7.dim(r.defaultState)}`
     );
-    console.log(`    ${chalk6.dim(r.description)}`);
-    console.log(`    Sources: ${r.compatibleSources.map((s) => chalk6.dim(s)).join(", ")}`);
+    console.log(`    ${chalk7.dim(r.description)}`);
+    console.log(`    Sources: ${r.compatibleSources.map((s) => chalk7.dim(s)).join(", ")}`);
   }
   console.log();
 }
-function renderRuleDetail(rule) {
+function renderRuleDetail(rule, format = "pretty") {
+  if (format !== "pretty") {
+    structuredDetail("security rule", rule, format, () => void 0);
+    return;
+  }
   ui.section("Security Rule Detail:");
   ui.keyValue([
     ["UUID", rule.uuid],
@@ -827,13 +1253,27 @@ function renderRuleDetail(rule) {
   if (rule.editableFields.length > 0) {
     ui.section("Editable Fields:");
     for (const f of rule.editableFields) {
-      console.log(`  ${f.displayName} (${chalk6.dim(f.attributeName)}): ${f.displayType}`);
-      if (f.description) console.log(`    ${chalk6.dim(f.description)}`);
+      console.log(`  ${f.displayName} (${chalk7.dim(f.attributeName)}): ${f.displayType}`);
+      if (f.description) console.log(`    ${chalk7.dim(f.description)}`);
     }
   }
   console.log();
 }
-function renderRuleInstanceList(instances) {
+function renderRuleInstanceList(instances, format = "pretty") {
+  if (format !== "pretty") {
+    structuredList(
+      "rule instances",
+      instances,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "securityRuleUuid", label: "Rule ID" },
+        { key: "state", label: "State" }
+      ],
+      format,
+      () => void 0
+    );
+    return;
+  }
   if (instances.length === 0) {
     ui.emptyList("rule instances");
     return;
@@ -846,7 +1286,11 @@ function renderRuleInstanceList(instances) {
   }
   console.log();
 }
-function renderRuleInstanceDetail(instance) {
+function renderRuleInstanceDetail(instance, format = "pretty") {
+  if (format !== "pretty") {
+    structuredDetail("rule instance", instance, format, () => void 0);
+    return;
+  }
   ui.section("Rule Instance Detail:");
   const pairs = [
     ["UUID", instance.uuid],
@@ -871,54 +1315,47 @@ function renderRuleInstanceDetail(instance) {
   console.log();
 }
 function renderMsScanList(scans, format = "pretty") {
-  if (scans.length === 0) {
-    ui.emptyList("scans");
-    return;
-  }
   if (format !== "pretty") {
-    const rows = scans.map((s) => ({
-      id: s.uuid,
-      outcome: s.evalOutcome,
-      origin: s.scanOrigin,
-      modelUri: s.modelUri ?? "",
-      createdAt: s.createdAt,
-      passed: s.evalSummary?.rulesPassed ?? "",
-      failed: s.evalSummary?.rulesFailed ?? ""
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "outcome", label: "Outcome" },
-          { key: "origin", label: "Origin" },
-          { key: "modelUri", label: "Model URI" },
-          { key: "passed", label: "Passed" },
-          { key: "failed", label: "Failed" },
-          { key: "createdAt", label: "Created" }
-        ],
-        format
-      )
+    structuredList(
+      "scans",
+      scans,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "evalOutcome", label: "Outcome" },
+        { key: "scanOrigin", label: "Origin" },
+        { key: "modelUri", label: "Model URI" },
+        { key: "createdAt", label: "Created" }
+      ],
+      format,
+      () => void 0
     );
     return;
   }
+  if (scans.length === 0) {
+    ui.emptyList("scans");
+    return;
+  }
   ui.section("Model Security Scans:");
   for (const s of scans) {
     ui.dim(s.uuid);
     console.log(
-      `    ${stateColor(s.evalOutcome)(s.evalOutcome)}  ${chalk6.dim(s.scanOrigin)}  ${chalk6.dim(s.createdAt)}`
+      `    ${stateColor(s.evalOutcome)(s.evalOutcome)}  ${chalk7.dim(s.scanOrigin)}  ${chalk7.dim(s.createdAt)}`
     );
-    if (s.modelUri) console.log(`    ${chalk6.dim(s.modelUri)}`);
+    if (s.modelUri) console.log(`    ${chalk7.dim(s.modelUri)}`);
     if (s.evalSummary) {
       const { rulesPassed, rulesFailed, totalRules } = s.evalSummary;
       console.log(
-        `    Rules: ${chalk6.green(`${rulesPassed} passed`)}  ${chalk6.red(`${rulesFailed} failed`)}  / ${totalRules} total`
+        `    Rules: ${chalk7.green(`${rulesPassed} passed`)}  ${chalk7.red(`${rulesFailed} failed`)}  / ${totalRules} total`
       );
     }
   }
   console.log();
 }
-function renderMsScanDetail(scan) {
+function renderMsScanDetail(scan, format = "pretty") {
+  if (format !== "pretty") {
+    structuredDetail("scan", scan, format, () => void 0);
+    return;
+  }
   ui.section("Scan Detail:");
   const pairs = [
     ["UUID", scan.uuid],
@@ -934,7 +1371,7 @@ function renderMsScanDetail(scan) {
     const { rulesPassed, rulesFailed, totalRules } = scan.evalSummary;
     pairs.push([
       "Rules",
-      `${chalk6.green(`${rulesPassed} passed`)}  ${chalk6.red(`${rulesFailed} failed`)}  / ${totalRules} total`
+      `${chalk7.green(`${rulesPassed} passed`)}  ${chalk7.red(`${rulesFailed} failed`)}  / ${totalRules} total`
     ]);
   }
   ui.keyValue(pairs);
@@ -944,7 +1381,22 @@ function renderMsScanDetail(scan) {
   }
   console.log();
 }
-function renderEvaluationList(evaluations) {
+function renderEvaluationList(evaluations, format = "pretty") {
+  if (format !== "pretty") {
+    structuredList(
+      "evaluations",
+      evaluations,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "ruleName", label: "Rule" },
+        { key: "result", label: "Result" },
+        { key: "ruleInstanceState", label: "State" }
+      ],
+      format,
+      () => void 0
+    );
+    return;
+  }
   if (evaluations.length === 0) {
     ui.emptyList("evaluations");
     return;
@@ -953,12 +1405,16 @@ function renderEvaluationList(evaluations) {
   for (const e of evaluations) {
     ui.dim(e.uuid);
     console.log(
-      `    ${e.ruleName}  ${stateColor(e.result)(e.result)}  ${chalk6.dim(e.ruleInstanceState)}`
+      `    ${e.ruleName}  ${stateColor(e.result)(e.result)}  ${chalk7.dim(e.ruleInstanceState)}`
     );
   }
   console.log();
 }
-function renderEvaluationDetail(evaluation) {
+function renderEvaluationDetail(evaluation, format = "pretty") {
+  if (format !== "pretty") {
+    structuredDetail("evaluation", evaluation, format, () => void 0);
+    return;
+  }
   ui.section("Evaluation Detail:");
   ui.keyValue([
     ["UUID", evaluation.uuid],
@@ -971,7 +1427,22 @@ function renderEvaluationDetail(evaluation) {
   ]);
   console.log();
 }
-function renderViolationList(violations) {
+function renderViolationList(violations, format = "pretty") {
+  if (format !== "pretty") {
+    structuredList(
+      "violations",
+      violations,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "ruleName", label: "Rule" },
+        { key: "file", label: "File" },
+        { key: "threat", label: "Threat" }
+      ],
+      format,
+      () => void 0
+    );
+    return;
+  }
   if (violations.length === 0) {
     ui.emptyList("violations");
     return;
@@ -979,17 +1450,21 @@ function renderViolationList(violations) {
   ui.section("Violations:");
   for (const v of violations) {
     ui.dim(v.uuid);
-    console.log(`    ${chalk6.red(v.ruleName)}  ${chalk6.dim(v.file)}`);
+    console.log(`    ${chalk7.red(v.ruleName)}  ${chalk7.dim(v.file)}`);
     console.log(`    ${v.description}`);
-    console.log(`    Threat: ${chalk6.dim(v.threat)}`);
+    console.log(`    Threat: ${chalk7.dim(v.threat)}`);
   }
   console.log();
 }
-function renderViolationDetail(violation) {
+function renderViolationDetail(violation, format = "pretty") {
+  if (format !== "pretty") {
+    structuredDetail("violation", violation, format, () => void 0);
+    return;
+  }
   ui.section("Violation Detail:");
   ui.keyValue([
     ["UUID", violation.uuid],
-    ["Rule", chalk6.red(violation.ruleName)],
+    ["Rule", chalk7.red(violation.ruleName)],
     ["Description", violation.ruleDescription],
     ["State", violation.ruleInstanceState],
     ["File", violation.file],
@@ -998,15 +1473,30 @@ function renderViolationDetail(violation) {
   ]);
   console.log();
 }
-function renderFileList(files) {
+function renderFileList(files, format = "pretty") {
+  if (format !== "pretty") {
+    structuredList(
+      "files",
+      files,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "path", label: "Path" },
+        { key: "type", label: "Type" },
+        { key: "result", label: "Result" }
+      ],
+      format,
+      () => void 0
+    );
+    return;
+  }
   if (files.length === 0) {
     ui.emptyList("files");
     return;
   }
   ui.section("Scanned Files:");
   for (const f of files) {
-    const color = f.result === "SUCCESS" ? chalk6.green : f.result === "SKIPPED" ? chalk6.yellow : chalk6.red;
-    const formats = f.formats.length > 0 ? chalk6.dim(` [${f.formats.join(", ")}]`) : "";
+    const color = f.result === "SUCCESS" ? chalk7.green : f.result === "SKIPPED" ? chalk7.yellow : chalk7.red;
+    const formats = f.formats.length > 0 ? chalk7.dim(` [${f.formats.join(", ")}]`) : "";
     console.log(`    ${color(f.result)}  ${f.type}  ${f.path}${formats}`);
   }
   console.log();
@@ -1034,45 +1524,42 @@ function renderLabelValues(key, values) {
   console.log();
 }
 function renderModelList(models, format = "pretty") {
-  if (models.length === 0) {
-    ui.emptyList("models");
-    return;
-  }
   if (format !== "pretty") {
-    const rows = models.map((m) => ({
-      id: m.uuid,
-      name: m.name,
-      outcome: m.latestVersionOutcome ?? "",
-      formats: (m.latestVersionFormats ?? []).join(", "),
-      scanned: m.latestVersionScanTime ?? ""
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "name", label: "Name" },
-          { key: "outcome", label: "Outcome" },
-          { key: "formats", label: "Formats" },
-          { key: "scanned", label: "Last Scan" }
-        ],
-        format
-      )
+    structuredList(
+      "models",
+      models,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "name", label: "Name" },
+        { key: "latestVersionOutcome", label: "Outcome" },
+        {
+          key: "latestVersionFormats",
+          label: "Formats",
+          get: (model) => (model.latestVersionFormats ?? []).join(", ")
+        },
+        { key: "latestVersionScanTime", label: "Last Scan" }
+      ],
+      format,
+      () => void 0
     );
     return;
   }
+  if (models.length === 0) {
+    ui.emptyList("models");
+    return;
+  }
   ui.section("Models:");
   for (const m of models) {
     ui.dim(m.uuid);
-    const outcome = m.latestVersionOutcome ? stateColor(m.latestVersionOutcome)(m.latestVersionOutcome) : chalk6.dim("unscanned");
-    const formats = m.latestVersionFormats && m.latestVersionFormats.length > 0 ? chalk6.dim(` [${m.latestVersionFormats.join(", ")}]`) : "";
+    const outcome = m.latestVersionOutcome ? stateColor(m.latestVersionOutcome)(m.latestVersionOutcome) : chalk7.dim("unscanned");
+    const formats = m.latestVersionFormats && m.latestVersionFormats.length > 0 ? chalk7.dim(` [${m.latestVersionFormats.join(", ")}]`) : "";
     console.log(`    ${m.name}  ${outcome}${formats}`);
     console.log();
   }
 }
 function renderModelDetail(model, format = "pretty") {
   if (format !== "pretty") {
-    console.log(format === "json" ? JSON.stringify(model, null, 2) : yamlDump2(model));
+    structuredDetail("model", model, format, () => void 0);
     return;
   }
   ui.section("Model Detail:");
@@ -1099,37 +1586,30 @@ function renderModelDetail(model, format = "pretty") {
   console.log();
 }
 function renderModelVersionList(versions, format = "pretty") {
-  if (versions.length === 0) {
-    ui.emptyList("versions");
-    return;
-  }
   if (format !== "pretty") {
-    const rows = versions.map((v) => ({
-      id: v.uuid,
-      revision: v.revision,
-      files: v.fileCount ?? "",
-      outcome: v.lastEvalOutcome ?? "",
-      scanned: v.latestScanTime ?? ""
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "revision", label: "Revision" },
-          { key: "files", label: "Files" },
-          { key: "outcome", label: "Outcome" },
-          { key: "scanned", label: "Last Scan" }
-        ],
-        format
-      )
+    structuredList(
+      "versions",
+      versions,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "revision", label: "Revision" },
+        { key: "fileCount", label: "Files" },
+        { key: "lastEvalOutcome", label: "Outcome" },
+        { key: "latestScanTime", label: "Last Scan" }
+      ],
+      format,
+      () => void 0
     );
     return;
   }
+  if (versions.length === 0) {
+    ui.emptyList("versions");
+    return;
+  }
   ui.section("Model Versions:");
   for (const v of versions) {
     ui.dim(v.uuid);
-    const outcome = v.lastEvalOutcome ? stateColor(v.lastEvalOutcome)(v.lastEvalOutcome) : chalk6.dim("unscanned");
+    const outcome = v.lastEvalOutcome ? stateColor(v.lastEvalOutcome)(v.lastEvalOutcome) : chalk7.dim("unscanned");
     const files = v.fileCount != null ? `  files: ${v.fileCount}` : "";
     console.log(`    ${v.revision}  ${outcome}${files}`);
     console.log();
@@ -1137,7 +1617,7 @@ function renderModelVersionList(versions, format = "pretty") {
 }
 function renderModelVersionDetail(version, format = "pretty") {
   if (format !== "pretty") {
-    console.log(format === "json" ? JSON.stringify(version, null, 2) : yamlDump2(version));
+    structuredDetail("model version", version, format, () => void 0);
     return;
   }
   ui.section("Model Version Detail:");
@@ -1169,38 +1649,19 @@ function renderModelVersionDetail(version, format = "pretty") {
   console.log();
 }
 function renderModelFileList(files, format = "pretty") {
-  if (files.length === 0) {
-    ui.emptyList("files");
+  if (format !== "pretty") {
+    renderFileList(files, format);
     return;
   }
-  if (format !== "pretty") {
-    const rows = files.map((f) => ({
-      id: f.uuid,
-      path: f.path,
-      type: f.type,
-      formats: f.formats.join(", "),
-      result: f.result
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "path", label: "Path" },
-          { key: "type", label: "Type" },
-          { key: "formats", label: "Formats" },
-          { key: "result", label: "Result" }
-        ],
-        format
-      )
-    );
+  if (files.length === 0) {
+    ui.emptyList("files");
     return;
   }
   renderFileList(files);
 }
 
 // src/cli/renderer/redteam.ts
-import chalk7 from "chalk";
+import chalk8 from "chalk";
 import { dump as yamlDump3 } from "js-yaml";
 function renderRedteamHeader() {
   ui.header("Prisma AIRS \u2014 AI Red Team", "Adversarial scan operations");
@@ -1208,37 +1669,37 @@ function renderRedteamHeader() {
 function severityColor(severity) {
   switch (severity.toUpperCase()) {
     case "CRITICAL":
-      return chalk7.red;
+      return chalk8.red;
     case "HIGH":
-      return chalk7.magenta;
+      return chalk8.magenta;
     case "MEDIUM":
-      return chalk7.yellow;
+      return chalk8.yellow;
     case "LOW":
-      return chalk7.cyan;
+      return chalk8.cyan;
     default:
-      return chalk7.dim;
+      return chalk8.dim;
   }
 }
-function statusColor2(status) {
+function statusColor3(status) {
   switch (status) {
     case "COMPLETED":
-      return chalk7.green;
+      return chalk8.green;
     case "RUNNING":
-      return chalk7.blue;
+      return chalk8.blue;
     case "QUEUED":
     case "INIT":
-      return chalk7.yellow;
+      return chalk8.yellow;
     case "FAILED":
     case "ABORTED":
-      return chalk7.red;
+      return chalk8.red;
     case "PARTIALLY_COMPLETE":
-      return chalk7.yellow;
+      return chalk8.yellow;
     default:
-      return chalk7.white;
+      return chalk8.white;
   }
 }
 function activeState(active) {
-  return statusColor2(active ? "COMPLETED" : "FAILED")(active ? "active" : "inactive");
+  return statusColor3(active ? "COMPLETED" : "FAILED")(active ? "active" : "inactive");
 }
 function renderScanStatus(job) {
   ui.section("Scan Status:");
@@ -1248,7 +1709,7 @@ function renderScanStatus(job) {
     ["Type", job.jobType]
   ];
   if (job.targetName) pairs.push(["Target", job.targetName]);
-  pairs.push(["Status", statusColor2(job.status)(job.status)]);
+  pairs.push(["Status", statusColor3(job.status)(job.status)]);
   if (job.total != null && job.completed != null) {
     pairs.push(["Progress", `${job.completed}/${job.total}`]);
   }
@@ -1291,9 +1752,9 @@ function renderScanList(jobs, format = "pretty") {
   for (const job of jobs) {
     ui.dim(job.uuid);
     console.log(
-      `    ${job.name}  ${statusColor2(job.status)(job.status)}  ${job.jobType}${job.score != null ? `  score: ${job.score}` : ""}`
+      `    ${job.name}  ${statusColor3(job.status)(job.status)}  ${job.jobType}${job.score != null ? `  score: ${job.score}` : ""}`
     );
-    if (job.createdAt) console.log(`    ${chalk7.dim(job.createdAt)}`);
+    if (job.createdAt) console.log(`    ${chalk8.dim(job.createdAt)}`);
     console.log();
   }
 }
@@ -1308,7 +1769,7 @@ function renderStaticReport(report) {
     for (const s of report.severityBreakdown) {
       const color = severityColor(s.severity);
       console.log(
-        `    ${color(s.severity.padEnd(10))} ${chalk7.red(`${s.successful} bypassed`)}  ${chalk7.green(`${s.failed} blocked`)}`
+        `    ${color(s.severity.padEnd(10))} ${chalk8.red(`${s.successful} bypassed`)}  ${chalk8.green(`${s.failed} blocked`)}`
       );
     }
   }
@@ -1386,10 +1847,10 @@ function renderAttackList(attacks, options) {
   }
   ui.section("Attacks:");
   for (const a of attacks) {
-    const sev = a.severity ? severityColor(a.severity)(a.severity.padEnd(10)) : chalk7.dim("N/A".padEnd(10));
-    const result = a.successful ? chalk7.red("BYPASSED") : chalk7.green("BLOCKED");
+    const sev = a.severity ? severityColor(a.severity)(a.severity.padEnd(10)) : chalk8.dim("N/A".padEnd(10));
+    const result = a.successful ? chalk8.red("BYPASSED") : chalk8.green("BLOCKED");
     const label = a.subCategoryDisplayName ?? a.subCategory ?? "\u2014";
-    console.log(`    ${sev} ${result}  ${label}${a.category ? chalk7.dim(` [${a.category}]`) : ""}`);
+    console.log(`    ${sev} ${result}  ${label}${a.category ? chalk8.dim(` [${a.category}]`) : ""}`);
   }
   if (options?.footnote) ui.dim(options.footnote);
   console.log();
@@ -1409,11 +1870,11 @@ function renderCustomAttackList(attacks) {
   }
   ui.section("Custom Attacks:");
   for (const a of attacks) {
-    const result = a.threat ? chalk7.red("THREAT") : chalk7.green("SAFE");
+    const result = a.threat ? chalk8.red("THREAT") : chalk8.green("SAFE");
     const prompt = a.promptText.length > 80 ? `${a.promptText.substring(0, 77)}...` : a.promptText;
-    const asrStr = a.asr != null ? chalk7.dim(` ASR: ${a.asr.toFixed(1)}%`) : "";
+    const asrStr = a.asr != null ? chalk8.dim(` ASR: ${a.asr.toFixed(1)}%`) : "";
     console.log(`    ${result}${asrStr}  ${prompt}`);
-    if (a.goal) console.log(`      ${chalk7.dim(a.goal)}`);
+    if (a.goal) console.log(`      ${chalk8.dim(a.goal)}`);
   }
   console.log();
 }
@@ -1460,11 +1921,11 @@ function renderCategories(categories) {
   ui.section("Attack Categories:");
   for (const c of categories) {
     console.log(
-      `  ${chalk7.bold(c.displayName)} ${chalk7.cyan(`(${c.id})`)}${c.description ? chalk7.dim(` \u2014 ${c.description}`) : ""}`
+      `  ${chalk8.bold(c.displayName)} ${chalk8.cyan(`(${c.id})`)}${c.description ? chalk8.dim(` \u2014 ${c.description}`) : ""}`
     );
     for (const sc of c.subCategories) {
       console.log(
-        `    ${chalk7.dim("\u2022")} ${sc.displayName} ${chalk7.cyan(`(${sc.id})`)}${sc.description ? chalk7.dim(` \u2014 ${sc.description}`) : ""}`
+        `    ${chalk8.dim("\u2022")} ${sc.displayName} ${chalk8.cyan(`(${sc.id})`)}${sc.description ? chalk8.dim(` \u2014 ${sc.description}`) : ""}`
       );
     }
     console.log();
@@ -1600,11 +2061,11 @@ function renderPromptList(prompts, format = "pretty") {
   }
   ui.section("Prompts:");
   for (const p of prompts) {
-    const status = p.active ? chalk7.green("active") : chalk7.dim("inactive");
+    const status = p.active ? chalk8.green("active") : chalk8.dim("inactive");
     const text = p.prompt.length > 80 ? `${p.prompt.substring(0, 77)}...` : p.prompt;
-    console.log(`  ${chalk7.dim(p.uuid)}  ${status}`);
+    console.log(`  ${chalk8.dim(p.uuid)}  ${status}`);
     console.log(`    ${text}`);
-    if (p.goal) console.log(`    ${chalk7.dim(`Goal: ${p.goal}`)}`);
+    if (p.goal) console.log(`    ${chalk8.dim(`Goal: ${p.goal}`)}`);
   }
   console.log();
 }
@@ -1621,7 +2082,7 @@ function renderPromptDetail(p, format = "pretty") {
   const pairs = [
     ["UUID", p.uuid],
     ["Set UUID", p.promptSetId],
-    ["Status", p.active ? chalk7.green("active") : chalk7.dim("inactive")],
+    ["Status", p.active ? chalk8.green("active") : chalk8.dim("inactive")],
     ["Prompt", p.prompt]
   ];
   if (p.goal) pairs.push(["Goal", p.goal]);
@@ -1653,7 +2114,7 @@ function renderPropertyNames(names, format = "pretty") {
 function renderAuthValidation(result) {
   ui.section("Auth Validation:");
   const pairs = [
-    ["Validated", result.validated ? chalk7.green("yes") : chalk7.red("no")]
+    ["Validated", result.validated ? chalk8.green("yes") : chalk8.red("no")]
   ];
   if (result.tokenPreview) pairs.push(["Token", result.tokenPreview]);
   if (result.expiresIn != null) pairs.push(["Expires In", `${result.expiresIn}s`]);
@@ -1671,7 +2132,7 @@ function renderTargetTemplates(templates) {
 function renderEulaStatus(status) {
   ui.section("EULA Status:");
   const pairs = [
-    ["Accepted", status.isAccepted ? chalk7.green("yes") : chalk7.red("no")]
+    ["Accepted", status.isAccepted ? chalk8.green("yes") : chalk8.red("no")]
   ];
   if (status.acceptedAt) pairs.push(["Accepted At", status.acceptedAt]);
   if (status.acceptedByUserId) pairs.push(["Accepted By", status.acceptedByUserId]);
@@ -1709,7 +2170,7 @@ function renderInstanceResponse(resp) {
   if (resp.tenantId) pairs.push(["Tenant ID", resp.tenantId]);
   if (resp.appId) pairs.push(["App ID", resp.appId]);
   if (resp.isSuccess != null) {
-    pairs.push(["Success", resp.isSuccess ? chalk7.green("yes") : chalk7.red("no")]);
+    pairs.push(["Success", resp.isSuccess ? chalk8.green("yes") : chalk8.red("no")]);
   }
   ui.keyValue(pairs);
   console.log();
@@ -1751,13 +2212,13 @@ function renderRegistryCredentials(creds, format = "pretty") {
 function channelStatusColor(status) {
   switch (status.toUpperCase()) {
     case "ONLINE":
-      return chalk7.green;
+      return chalk8.green;
     case "DRAFT":
-      return chalk7.yellow;
+      return chalk8.yellow;
     case "OFFLINE":
-      return chalk7.red;
+      return chalk8.red;
     default:
-      return chalk7.white;
+      return chalk8.white;
   }
 }
 function renderChannelList(channels, format = "pretty") {
@@ -1791,7 +2252,7 @@ function renderChannelList(channels, format = "pretty") {
   ui.section("Network Broker Channels:");
   for (const c of channels) {
     if (c.uuid) ui.dim(c.uuid);
-    const status = c.status ? channelStatusColor(c.status)(c.status) : chalk7.dim("unknown");
+    const status = c.status ? channelStatusColor(c.status)(c.status) : chalk8.dim("unknown");
     const clients = c.connectedClientsCount != null ? `  clients: ${c.connectedClientsCount}` : "";
     console.log(`    ${c.name ?? "(unnamed)"}  ${status}${clients}`);
     console.log();
@@ -1869,7 +2330,7 @@ function renderLanguages(data, format = "pretty") {
   }
   ui.section("Languages:");
   for (const l of data.languages) {
-    console.log(`    ${chalk7.dim(l.code)}  ${l.name}`);
+    console.log(`    ${chalk8.dim(l.code)}  ${l.name}`);
   }
   console.log();
 }
@@ -1903,45 +2364,140 @@ function renderErrorLogs(logs, format = "pretty") {
   }
   ui.section("Target-Profile Error Logs:");
   for (const l of logs) {
-    const type = l.errorType ? chalk7.red(l.errorType) : chalk7.dim("error");
+    const type = l.errorType ? chalk8.red(l.errorType) : chalk8.dim("error");
     console.log(
-      `    ${chalk7.dim(l.createdAt)}  ${type}${l.errorSource ? `  (${l.errorSource})` : ""}`
+      `    ${chalk8.dim(l.createdAt)}  ${type}${l.errorSource ? `  (${l.errorSource})` : ""}`
     );
     if (l.errorMessage) console.log(`      ${l.errorMessage}`);
-    if (l.jobId) console.log(`      ${chalk7.dim(`job: ${l.jobId}`)}`);
+    if (l.jobId) console.log(`      ${chalk8.dim(`job: ${l.jobId}`)}`);
+    console.log();
+  }
+}
+function renderAdapterList(adapters, format = "pretty", totalItems) {
+  if (adapters.length === 0) {
+    ui.emptyList("adapters");
+    return;
+  }
+  if (format !== "pretty") {
+    const rows = adapters.map((a) => ({
+      uuid: a.uuid,
+      name: a.name,
+      status: a.status,
+      targets: a.targetCount ?? "",
+      updated: a.updatedAt ?? ""
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "uuid", label: "UUID" },
+          { key: "name", label: "Name" },
+          { key: "status", label: "Status" },
+          { key: "targets", label: "Targets" },
+          { key: "updated", label: "Updated" }
+        ],
+        format
+      )
+    );
+    return;
+  }
+  ui.section("Custom Target Adapters:");
+  for (const a of adapters) {
+    ui.dim(a.uuid);
+    const status = a.status === "ACTIVE" ? chalk8.green(a.status) : chalk8.yellow(a.status);
+    const targets = a.targetCount != null ? `  targets: ${a.targetCount}` : "";
+    console.log(`    ${a.name}  ${status}${targets}`);
     console.log();
   }
+  if (totalItems !== void 0) ui.dim(`${totalItems} total`);
+}
+function renderAdapterDetail(adapter, format = "pretty") {
+  if (format !== "pretty") {
+    console.log(format === "json" ? JSON.stringify(adapter, null, 2) : yamlDump3(adapter));
+    return;
+  }
+  ui.section("Adapter Detail:");
+  const pairs = [
+    ["UUID", adapter.uuid],
+    ["Name", adapter.name],
+    [
+      "Status",
+      adapter.status === "ACTIVE" ? chalk8.green(adapter.status) : chalk8.yellow(adapter.status)
+    ],
+    ["Script", `${adapter.scriptB64.length} base64 chars`]
+  ];
+  if (adapter.description != null) pairs.push(["Description", adapter.description]);
+  if (adapter.networkBrokerChannelUuid != null)
+    pairs.push(["Broker Channel", adapter.networkBrokerChannelUuid]);
+  if (adapter.targetCount != null) pairs.push(["Targets", adapter.targetCount]);
+  if (adapter.createdAt != null) pairs.push(["Created", adapter.createdAt]);
+  if (adapter.updatedAt != null) pairs.push(["Updated", adapter.updatedAt]);
+  ui.keyValue(pairs);
+  if (adapter.variables.length > 0) {
+    ui.section("Variables:");
+    ui.keyValue(
+      adapter.variables.map((v) => [
+        `${v.key} (${v.type})`,
+        v.isRedacted ? chalk8.dim("(redacted)") : v.value ?? ""
+      ])
+    );
+  }
+  console.log();
+}
+function renderAdapterValidation(result, format = "pretty") {
+  if (format !== "pretty") {
+    console.log(format === "json" ? JSON.stringify(result, null, 2) : yamlDump3(result));
+    return;
+  }
+  if (result.validated) {
+    ui.success("Adapter script validated");
+  } else {
+    ui.error("Adapter script validation FAILED");
+  }
+  if (result.stdout) {
+    ui.section("stdout:");
+    console.log(result.stdout);
+  }
+  if (result.stderr) {
+    ui.section("stderr:");
+    console.log(chalk8.red(result.stderr));
+  }
+  if (result.traceback) {
+    ui.section("traceback:");
+    console.log(chalk8.red(result.traceback));
+  }
+  console.log();
 }
 
 // src/cli/renderer/runtime.ts
-import chalk8 from "chalk";
+import chalk9 from "chalk";
 function renderScanProgress(job) {
   if (job.total != null && job.completed != null && job.total > 0) {
     const pct = Math.round(job.completed / job.total * 100);
     const bar = "\u2588".repeat(Math.round(pct / 5)) + "\u2591".repeat(20 - Math.round(pct / 5));
     process.stdout.write(
-      `\r  ${statusColor3(job.status)(job.status)} ${bar} ${pct}% (${job.completed}/${job.total})`
+      `\r  ${statusColor4(job.status)(job.status)} ${bar} ${pct}% (${job.completed}/${job.total})`
     );
   } else {
-    process.stdout.write(`\r  ${statusColor3(job.status)(job.status)}...`);
+    process.stdout.write(`\r  ${statusColor4(job.status)(job.status)}...`);
   }
 }
-function statusColor3(status) {
+function statusColor4(status) {
   switch (status) {
     case "COMPLETED":
-      return chalk8.green;
+      return chalk9.green;
     case "RUNNING":
-      return chalk8.blue;
+      return chalk9.blue;
     case "QUEUED":
     case "INIT":
-      return chalk8.yellow;
+      return chalk9.yellow;
     case "FAILED":
     case "ABORTED":
-      return chalk8.red;
+      return chalk9.red;
     case "PARTIALLY_COMPLETE":
-      return chalk8.yellow;
+      return chalk9.yellow;
     default:
-      return chalk8.white;
+      return chalk9.white;
   }
 }
 function renderRuntimeConfigHeader() {
@@ -1971,8 +2527,8 @@ function renderProfileList(profiles, format = "pretty") {
   ui.section("Security Profiles:");
   for (const p of profiles) {
     ui.dim(p.profileId);
-    const status = p.active ? chalk8.green("active") : chalk8.yellow("inactive");
-    const rev = p.revision != null ? chalk8.dim(` rev:${p.revision}`) : "";
+    const status = p.active ? chalk9.green("active") : chalk9.yellow("inactive");
+    const rev = p.revision != null ? chalk9.dim(` rev:${p.revision}`) : "";
     console.log(`    ${p.profileName}  ${status}${rev}`);
   }
   console.log();
@@ -1982,7 +2538,7 @@ function renderProfileDetail(profile) {
   const pairs = [
     ["ID", profile.profileId],
     ["Name", profile.profileName],
-    ["Status", profile.active ? chalk8.green("active") : chalk8.yellow("inactive")]
+    ["Status", profile.active ? chalk9.green("active") : chalk9.yellow("inactive")]
   ];
   if (profile.revision != null) pairs.push(["Revision", profile.revision]);
   if (profile.createdBy) pairs.push(["Created", profile.createdBy]);
@@ -2086,8 +2642,8 @@ function renderTopicList(topics, format = "pretty") {
   ui.section("Custom Topics:");
   for (const t of topics) {
     ui.dim(String(t.topic_id));
-    const rev = t.revision != null ? chalk8.dim(` rev:${t.revision}`) : "";
-    const desc = t.description ? chalk8.dim(` \u2014 ${t.description.slice(0, 80)}`) : "";
+    const rev = t.revision != null ? chalk9.dim(` rev:${t.revision}`) : "";
+    const desc = t.description ? chalk9.dim(` \u2014 ${t.description.slice(0, 80)}`) : "";
     console.log(`    ${t.topic_name}${rev}${desc}`);
   }
   console.log();
@@ -2145,8 +2701,8 @@ function renderApiKeyList(keys, format = "pretty") {
   ui.section("API Keys:");
   for (const k of keys) {
     ui.dim(k.id);
-    const last8 = k.last8 ? chalk8.dim(` key: \u2026${k.last8}`) : "";
-    const expires = k.expiresAt ? chalk8.dim(` expires: ${k.expiresAt}`) : "";
+    const last8 = k.last8 ? chalk9.dim(` key: \u2026${k.last8}`) : "";
+    const expires = k.expiresAt ? chalk9.dim(` expires: ${k.expiresAt}`) : "";
     console.log(`    ${k.name}${last8}${expires}`);
   }
   console.log();
@@ -2191,7 +2747,7 @@ function renderCustomerAppList(apps, format = "pretty") {
   ui.section("Customer Apps:");
   for (const a of apps) {
     if (a.id) ui.dim(a.id);
-    const desc = a.description ? chalk8.dim(` \u2014 ${a.description.slice(0, 80)}`) : "";
+    const desc = a.description ? chalk9.dim(` \u2014 ${a.description.slice(0, 80)}`) : "";
     console.log(`    ${a.name}${desc}`);
   }
   console.log();
@@ -2315,9 +2871,9 @@ function renderDeploymentProfileList(profiles, format = "pretty") {
     const name = p.raw.dp_name ?? p.raw.profile_name ?? p.raw.name ?? "unknown";
     const status = p.raw.status;
     const authCode = p.raw.auth_code;
-    const statusColor4 = status === "active" ? chalk8.green : chalk8.dim;
+    const statusColor5 = status === "active" ? chalk9.green : chalk9.dim;
     console.log(
-      `    ${name}${status ? `  ${statusColor4(status)}` : ""}${authCode ? `  ${chalk8.dim(authCode)}` : ""}`
+      `    ${name}${status ? `  ${statusColor5(status)}` : ""}${authCode ? `  ${chalk9.dim(authCode)}` : ""}`
     );
   }
   console.log();
@@ -2350,24 +2906,260 @@ function renderScanLogList(results, pageToken, format = "pretty") {
     );
     return;
   }
-  ui.section(`Scan Logs (${results.length} results):`);
-  for (const r of results) {
-    const action = r.action ?? r.verdict;
-    const app = r.app_name;
-    const profile = r.profile_name;
-    const ts2 = r.received_ts ?? r.timestamp;
-    const scanId = r.scan_id;
-    const actionColor = action === "block" ? chalk8.red : chalk8.green;
-    if (scanId) ui.dim(scanId);
-    console.log(
-      `    ${ts2 ? chalk8.dim(ts2) : ""}  ${action ? actionColor(action) : ""}  ${profile ? `[${profile}]` : ""}  ${app ?? ""}`
-    );
+  ui.section(`Scan Logs (${results.length} results):`);
+  for (const r of results) {
+    const action = r.action ?? r.verdict;
+    const app = r.app_name;
+    const profile = r.profile_name;
+    const ts2 = r.received_ts ?? r.timestamp;
+    const scanId = r.scan_id;
+    const actionColor = action === "block" ? chalk9.red : chalk9.green;
+    if (scanId) ui.dim(scanId);
+    console.log(
+      `    ${ts2 ? chalk9.dim(ts2) : ""}  ${action ? actionColor(action) : ""}  ${profile ? `[${profile}]` : ""}  ${app ?? ""}`
+    );
+  }
+  if (pageToken) {
+    console.log();
+    ui.dim(`Page token: ${pageToken}`);
+  }
+  console.log();
+}
+
+// src/cli/confirm.ts
+async function confirmOrAbort(message, force, options = {}) {
+  if (force) return;
+  const interactive = options.isTTY ?? process.stdout.isTTY === true;
+  if (!interactive) {
+    usageError(
+      `refusing to ${options.action ?? "proceed"} without --force in non-interactive mode`
+    );
+  }
+  const prompt = options.promptFn ?? (await import("@inquirer/prompts")).confirm;
+  const confirmed = await prompt({ message, default: false });
+  if (!confirmed) {
+    ui.info("Aborted");
+    process.exit(0);
+  }
+}
+
+// src/cli/examples.ts
+function examples(...lines) {
+  return `
+Examples:
+${lines.map((l) => `  $ ${l}`).join("\n")}
+`;
+}
+
+// src/cli/commands/aigateway.ts
+async function createService() {
+  const config = await loadConfig();
+  return new SdkAiGatewayService(aiGatewayClientOptions(config));
+}
+function failWithGrantHint(err) {
+  const hint = aiGatewayGrantHint(err);
+  if (hint) ui.warn(`403: ${hint}`);
+  fail(err);
+}
+function parsePlane(value) {
+  if (value === void 0) return void 0;
+  if (value !== "data" && value !== "admin") {
+    usageError(`Invalid --plane '${value}'. Valid planes: data, admin`);
+  }
+  return value;
+}
+function parseStatus(value) {
+  if (value === void 0) return void 0;
+  if (value !== "active" && value !== "archived") {
+    usageError(`Invalid --status '${value}'. Valid statuses: active, archived`);
+  }
+  return value;
+}
+function parseJsonFlag(raw, flag) {
+  if (raw === void 0) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`${flag} must be valid JSON`);
+  }
+}
+function buildWorkspaceWriteRequest(opts) {
+  const out = {};
+  for (const key of ["name", "description", "icon"]) {
+    if (opts[key] !== void 0) out[key] = opts[key];
+  }
+  const defaults = parseJsonFlag(opts.defaults, "--defaults");
+  const metadata = parseJsonFlag(opts.metadata, "--metadata");
+  if (defaults !== void 0 || metadata !== void 0) {
+    out.defaults = {
+      ...typeof defaults === "object" && defaults !== null ? defaults : {},
+      ...metadata !== void 0 ? { metadata } : {}
+    };
   }
-  if (pageToken) {
-    console.log();
-    ui.dim(`Page token: ${pageToken}`);
+  if (opts.users !== void 0) {
+    out.users = opts.users.split(",").map((u) => u.trim()).filter(Boolean);
   }
-  console.log();
+  const usage = parseJsonFlag(opts.usageLimits, "--usage-limits");
+  if (usage !== void 0) out.usageLimits = usage;
+  const rate = parseJsonFlag(opts.rateLimits, "--rate-limits");
+  if (rate !== void 0) out.rateLimits = rate;
+  return out;
+}
+function scopeNameLooksUnrelated(name, scopeName) {
+  const nameToken = name.toLowerCase().replace(/[^a-z0-9]/g, "");
+  if (nameToken.length < 4) return false;
+  return !scopeName.toLowerCase().replace(/[^a-z0-9]/g, "").includes(nameToken);
+}
+function registerAiGatewayCommand(program) {
+  const aigateway = program.command("aigateway").description("AI Gateway operations");
+  const workspace = aigateway.command("workspace").description("Manage AI Gateway workspaces");
+  workspace.command("list").description("List workspaces (default: active workspaces you are scoped to)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--status <status>", "Filter by lifecycle state: active or archived").option("--all", "Merge active + archived admin-plane reads (whole tenant, both states)").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").addHelpText(
+    "after",
+    examples(
+      "airs aigateway workspace list",
+      "airs aigateway workspace list --plane admin",
+      "airs aigateway workspace list --plane admin --status archived",
+      "airs aigateway workspace list --all --output json"
+    )
+  ).action(async (opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderAiGatewayHeader();
+      const plane = parsePlane(opts.plane);
+      const status = parseStatus(opts.status);
+      if (opts.all && (plane !== void 0 || status !== void 0)) {
+        usageError("--all already merges admin-plane active + archived; drop --plane/--status");
+      }
+      const service = await createService();
+      const workspaces = opts.all ? await service.listAllWorkspaces() : await service.listWorkspaces(
+        plane !== void 0 || status !== void 0 ? { plane, status } : void 0
+      );
+      renderWorkspaceList(workspaces, fmt);
+      if (fmt === "pretty" && !opts.all && plane !== "admin") {
+        ui.status(
+          "Data-plane list shows only active workspaces you are scoped to \u2014 use --plane admin or --all for the whole tenant."
+        );
+      }
+    } catch (err) {
+      failWithGrantHint(err);
+    }
+  });
+  workspace.command("get <ref>").description("Get one workspace by UUID or slug (includes settings blocks)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--output <format>", "Output format: pretty, json, yaml", "pretty").addHelpText(
+    "after",
+    examples(
+      "airs aigateway workspace get ws-main-a-349e0e",
+      "airs aigateway workspace get 16f7e90d-382a-4e78-b577-1b01eb5f8297 --plane admin --output json"
+    )
+  ).action(async (ref, opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderAiGatewayHeader();
+      const plane = parsePlane(opts.plane);
+      const service = await createService();
+      const workspace2 = await service.getWorkspace(
+        ref,
+        plane !== void 0 ? { plane } : void 0
+      );
+      renderWorkspaceDetail(workspace2, fmt);
+    } catch (err) {
+      failWithGrantHint(err);
+    }
+  });
+  workspace.command("create").description("Create a workspace (admin plane)").requiredOption("--name <name>", "Display name").requiredOption(
+    "--scope-name <scope>",
+    "SCM role scope granting data-plane access (e.g. ws_production_bx7qw0) \u2014 not derived from --name"
+  ).option("--description <text>", "Workspace description").option("--icon <icon>", "Workspace icon").option("--metadata <json>", "Sugar for defaults.metadata (flat string map)").option("--defaults <json>", "Workspace defaults object").option("--users <ids>", "Comma-separated user ids to seed the workspace with").option("--usage-limits <json>", "Usage-limit policies \u2014 a JSON ARRAY of policy objects").option("--rate-limits <json>", "Rate-limit policies \u2014 a JSON ARRAY of policy objects").option("--output <format>", "Output format: pretty, json, yaml", "pretty").addHelpText(
+    "after",
+    examples(
+      "airs aigateway workspace create --name Production --scope-name ws_production_bx7qw0",
+      `airs aigateway workspace create --name Production --scope-name ws_production_bx7qw0 --metadata '{"env":"production"}' --rate-limits '[{"type":"requests","unit":"rpm","value":100}]'`
+    )
+  ).action(async (opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderAiGatewayHeader();
+      if (scopeNameLooksUnrelated(opts.name, opts.scopeName)) {
+        ui.warn(
+          `--scope-name '${opts.scopeName}' shares no token with --name '${opts.name}'. A workspace created with a scope nobody holds will not appear in data-plane lists.`
+        );
+      }
+      const service = await createService();
+      const workspace2 = await service.createWorkspace({
+        ...buildWorkspaceWriteRequest(opts),
+        name: opts.name,
+        scopeName: opts.scopeName
+      });
+      ui.success(`Workspace created: ${workspace2.id}`);
+      renderWorkspaceDetail(workspace2, fmt);
+    } catch (err) {
+      failWithGrantHint(err);
+    }
+  });
+  workspace.command("update <ref>").description("Update a workspace (admin plane, partial patch)").option("--name <name>", "New display name").option("--description <text>", "New description").option("--icon <icon>", "New icon").option("--metadata <json>", "Sugar for defaults.metadata (flat string map)").option("--defaults <json>", "Workspace defaults object").option("--usage-limits <json>", "Usage-limit policies \u2014 a JSON ARRAY of policy objects").option("--rate-limits <json>", "Rate-limit policies \u2014 a JSON ARRAY of policy objects").option("--output <format>", "Output format: pretty, json, yaml", "pretty").addHelpText(
+    "after",
+    examples(
+      `airs aigateway workspace update ws-produc-985697 --description 'Production workloads, us-east'`
+    )
+  ).action(async (ref, opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderAiGatewayHeader();
+      const request = buildWorkspaceWriteRequest(opts);
+      if (Object.keys(request).length === 0) {
+        usageError(
+          "Specify at least one of --name --description --icon --metadata --defaults --usage-limits --rate-limits"
+        );
+      }
+      const service = await createService();
+      const workspace2 = await service.updateWorkspace(ref, request);
+      ui.success(`Workspace updated: ${workspace2.id}`);
+      renderWorkspaceDetail(workspace2, fmt);
+    } catch (err) {
+      failWithGrantHint(err);
+    }
+  });
+  workspace.command("delete <ref>").description("Archive a workspace (soft delete \u2014 there is no hard delete)").option("--force", "Skip confirmation prompt").addHelpText("after", examples("airs aigateway workspace delete ws-produc-985697 --force")).action(async (ref, opts) => {
+    try {
+      renderAiGatewayHeader();
+      await confirmOrAbort(
+        `Archive workspace ${ref}? (soft delete \u2014 the row remains under --status archived)`,
+        Boolean(opts.force),
+        { action: `archive workspace ${ref}` }
+      );
+      const service = await createService();
+      await service.deleteWorkspace(ref);
+      ui.success(`Workspace archived: ${ref}`);
+      ui.status(
+        "This is a soft delete \u2014 the workspace remains visible via `workspace list --plane admin --status archived`. A `get` on it now answers 404; that is expected."
+      );
+    } catch (err) {
+      failWithGrantHint(err);
+    }
+  });
+  const telemetry = aigateway.command("telemetry").description("AI Gateway runtime telemetry (data plane)");
+  const cost = telemetry.command("cost").description(
+    "Total and per-day spend for a workspace (API reports cents; pretty output shows dollars)"
+  ).requiredOption("--workspace <slug>", "Workspace slug (not UUID), e.g. ws-main-a-349e0e").option("--days <n>", "Rolling window in days, counted back from now", "7").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
+    "after",
+    examples(
+      "airs aigateway telemetry cost --workspace ws-main-a-349e0e",
+      "airs aigateway telemetry cost --workspace ws-main-a-349e0e --days 30 --output json"
+    )
+  ).action(async (opts) => {
+    try {
+      const fmt = await resolveOutput(cost, opts);
+      if (fmt === "pretty") renderAiGatewayHeader();
+      const days = Number.parseInt(opts.days, 10);
+      if (!Number.isFinite(days) || days <= 0) {
+        usageError(`Invalid --days '${opts.days}'. Expected a positive integer`);
+      }
+      const service = await createService();
+      const report = await service.getTelemetryCost({ workspaceSlug: opts.workspace, days });
+      renderCostReport(report, fmt);
+    } catch (err) {
+      failWithGrantHint(err);
+    }
+  });
 }
 
 // src/cli/commands/completion.ts
@@ -2559,13 +3351,6 @@ function assertKnownKey(key) {
     usageError(`Unknown config key '${key}'. Valid keys: ${CONFIG_KEYS.join(", ")}`);
   }
 }
-var LIST_FORMATS = ["pretty", "json", "yaml"];
-function parseListFormat(value) {
-  if (!LIST_FORMATS.includes(value)) {
-    usageError(`Invalid --output '${value}'. Valid formats: ${LIST_FORMATS.join(", ")}`);
-  }
-  return value;
-}
 var COLUMNS = [
   { key: "key", label: "Key" },
   { key: "value", label: "Value" },
@@ -2580,9 +3365,9 @@ function registerConfigCommand(program) {
       "airs config get mgmtTsgId"
     )
   );
-  config.command("list").description("Show effective configuration with per-key source (env/file/default)").option("--output <format>", "Output format: pretty, json, or yaml", "pretty").option("--reveal", "Show secret values in full").action(async (opts) => {
+  const configList = config.command("list").description("Show effective configuration with per-key source (env/file/default)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").option("--reveal", "Show secret values in full").action(async (opts) => {
     try {
-      const fmt = parseListFormat(opts.output);
+      const fmt = await resolveOutput(configList, opts);
       const filePath = resolveConfigFilePath();
       const rows = buildConfigRows(await inspectConfig(), Boolean(opts.reveal));
       if (fmt === "pretty") {
@@ -2597,12 +3382,18 @@ function registerConfigCommand(program) {
       fail(err);
     }
   });
-  config.command("get <key>").description("Print a single effective config value").option("--reveal", "Show the real value of a secret key").action(async (key, opts) => {
+  const configGet = config.command("get <key>").description("Print a single effective config value").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").option("--reveal", "Show the real value of a secret key").action(async (key, opts) => {
     try {
       assertKnownKey(key);
       const inspected = await inspectConfig();
       const entry = inspected[key];
       const raw = entry.value == null ? "" : String(entry.value);
+      const fmt = await resolveOutput(configGet, opts);
+      const value = raw !== "" && isSecretKey(key) && !opts.reveal ? maskSecret(raw) : raw;
+      if (fmt !== "pretty") {
+        console.log(formatOutput([{ key, value, source: entry.source }], COLUMNS, fmt));
+        return;
+      }
       if (raw !== "" && isSecretKey(key)) {
         if (opts.reveal) {
           ui.status(`Warning: printing secret value for '${key}'`);
@@ -2653,39 +3444,6 @@ function registerConfigCommand(program) {
 import { randomUUID } from "crypto";
 import { readFile as readFile2 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
-
-// src/config/client-options.ts
-function runtimeInitOptions(config) {
-  return {
-    apiKey: config.airsApiKey,
-    apiToken: config.airsApiToken,
-    apiEndpoint: config.airsApiEndpoint,
-    numRetries: config.airsNumRetries
-  };
-}
-function redTeamClientOptions(config) {
-  return {
-    clientId: config.mgmtClientId,
-    clientSecret: config.mgmtClientSecret,
-    tsgId: config.mgmtTsgId,
-    dataEndpoint: config.redTeamDataEndpoint,
-    mgmtEndpoint: config.redTeamMgmtEndpoint,
-    tokenEndpoint: config.redTeamTokenEndpoint ?? config.mgmtTokenEndpoint,
-    networkBrokerEndpoint: config.redTeamNetworkBrokerEndpoint
-  };
-}
-function modelSecurityClientOptions(config) {
-  return {
-    clientId: config.mgmtClientId,
-    clientSecret: config.mgmtClientSecret,
-    tsgId: config.mgmtTsgId,
-    dataEndpoint: config.modelSecDataEndpoint,
-    mgmtEndpoint: config.modelSecMgmtEndpoint,
-    tokenEndpoint: config.modelSecTokenEndpoint ?? config.mgmtTokenEndpoint
-  };
-}
-
-// src/cli/commands/doctor.ts
 var DOCTOR_TIMEOUT_MS = 5e3;
 var MIN_NODE_MAJOR = 20;
 function checkNodeVersion(version = process.version) {
@@ -2883,6 +3641,50 @@ async function checkManagementAuth(probe, hasCreds, timeoutMs = DOCTOR_TIMEOUT_M
     };
   }
 }
+async function checkAiGatewayApi(probe, hasCreds, timeoutMs = DOCTOR_TIMEOUT_MS) {
+  const name = "AI Gateway API";
+  if (!hasCreds) {
+    return {
+      name,
+      status: "warn",
+      detail: "skipped \u2014 management credentials not configured",
+      hint: "Set PANW_MGMT_CLIENT_ID, PANW_MGMT_CLIENT_SECRET, PANW_MGMT_TSG_ID"
+    };
+  }
+  try {
+    const result = await withTimeout(probe(), timeoutMs);
+    if (result === TIMED_OUT) {
+      return {
+        name,
+        status: "fail",
+        detail: `timed out after ${timeoutMs}ms \u2014 network unreachable or endpoint not responding`,
+        hint: "Check network connectivity and PANW_AI_GW_DATA_ENDPOINT"
+      };
+    }
+    return {
+      name,
+      status: "pass",
+      detail: `endpoint reachable (${result} workspace${result === 1 ? "" : "s"} in scope)`
+    };
+  } catch (err) {
+    const status = httpStatus(err);
+    const message = errMessage(err);
+    if (status === 403) {
+      return {
+        name,
+        status: "warn",
+        detail: `endpoint reachable, but access denied (HTTP 403): ${message}`,
+        hint: aiGatewayGrantHint(err)
+      };
+    }
+    return {
+      name,
+      status: "fail",
+      detail: status !== void 0 ? `AI Gateway API error (HTTP ${status}): ${message}` : `network unreachable: ${message}`,
+      hint: "Verify credentials and PANW_AI_GW_DATA_ENDPOINT"
+    };
+  }
+}
 async function defaultScannerProbe() {
   const config = await loadConfig();
   init(runtimeInitOptions(config));
@@ -2900,6 +3702,12 @@ async function defaultMgmtProbe() {
   const topics = await service.listTopics();
   return topics.length;
 }
+async function defaultAiGwProbe() {
+  const config = await loadConfig();
+  const service = new SdkAiGatewayService(aiGatewayClientOptions(config));
+  const workspaces = await service.listWorkspaces();
+  return workspaces.length;
+}
 async function runDoctor(deps = {}) {
   const configFilePath = deps.configFilePath ?? resolveConfigFilePath();
   const inspect = deps.inspect ?? (() => inspectConfig(configFilePath));
@@ -2923,7 +3731,12 @@ async function runDoctor(deps = {}) {
     mgmtCreds.status === "pass",
     timeoutMs
   );
-  return [node, configFile, scannerCreds, mgmtCreds, scannerApi, mgmtAuth];
+  const aiGwApi = await checkAiGatewayApi(
+    deps.aiGwProbe ?? defaultAiGwProbe,
+    mgmtCreds.status === "pass",
+    timeoutMs
+  );
+  return [node, configFile, scannerCreds, mgmtCreds, scannerApi, mgmtAuth, aiGwApi];
 }
 function hasFailure(checks) {
   return checks.some((c) => c.status === "fail");
@@ -2933,20 +3746,6 @@ var STATUS_KIND = {
   warn: "warn",
   fail: "error"
 };
-var DOCTOR_FORMATS = ["pretty", "json", "yaml"];
-function parseDoctorFormat(value) {
-  if (!DOCTOR_FORMATS.includes(value)) {
-    usageError(`Invalid --output '${value}'. Valid formats: ${DOCTOR_FORMATS.join(", ")}`);
-  }
-  return value;
-}
-function toYaml(checks) {
-  return checks.map((c) => {
-    const lines = [`name: ${c.name}`, `status: ${c.status}`, `detail: ${c.detail}`];
-    if (c.hint) lines.push(`hint: ${c.hint}`);
-    return lines.join("\n");
-  }).join("\n---\n");
-}
 function renderPretty(checks) {
   ui.header("Doctor", "Prisma AIRS CLI preflight checks");
   for (const check of checks) {
@@ -2966,18 +3765,27 @@ function renderPretty(checks) {
   console.log("");
 }
 function registerDoctorCommand(program) {
-  program.command("doctor").description("Check credentials, config, and API connectivity (preflight)").option("--output <format>", "Output format: pretty, json, or yaml", "pretty").addHelpText(
+  const doctor = program.command("doctor").description("Check credentials, config, and API connectivity (preflight)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples("airs doctor", `airs doctor --output json | jq '.[] | select(.status != "pass")'`)
   ).action(async (opts) => {
-    const fmt = parseDoctorFormat(opts.output);
+    const fmt = await resolveOutput(doctor, opts);
     const checks = await runDoctor();
-    if (fmt === "json") {
-      console.log(JSON.stringify(checks, null, 2));
-    } else if (fmt === "yaml") {
-      console.log(toYaml(checks));
-    } else {
+    if (fmt === "pretty") {
       renderPretty(checks);
+    } else {
+      console.log(
+        formatOutput(
+          checks.map((check) => ({ ...check })),
+          [
+            { key: "name", label: "Name" },
+            { key: "status", label: "Status" },
+            { key: "detail", label: "Detail" },
+            { key: "hint", label: "Hint" }
+          ],
+          fmt
+        )
+      );
     }
     process.exit(hasFailure(checks) ? 1 : 0);
   });
@@ -3005,7 +3813,7 @@ function run(bin, args, label) {
     });
   });
 }
-async function createService() {
+async function createService2() {
   const config = await loadConfig();
   return new SdkModelSecurityService(modelSecurityClientOptions(config));
 }
@@ -3016,16 +3824,18 @@ function registerModelSecurityCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderModelSecurityHeader();
-      const service = await createService();
-      const result = await service.listGroups({
+      const service = await createService2();
+      const listOptions = {
         sourceTypes: opts.sourceTypes ? opts.sourceTypes.split(",").map((s) => s.trim()) : void 0,
         searchQuery: opts.search,
         sortField: opts.sortField,
         sortDir: opts.sortDir,
         enabledRules: opts.enabledRules ? opts.enabledRules.split(",").map((s) => s.trim()) : void 0,
-        limit: Number.parseInt(opts.limit, 10)
-      });
-      renderGroupList(result.groups, fmt);
+        limit: Number.parseInt(opts.limit, 10),
+        skip: Number(opts.offset ?? 0)
+      };
+      const rows = opts.all ? await service.listAllGroups({ ...listOptions, max: Number(opts.max) }) : (await service.listGroups(listOptions)).groups;
+      renderGroupList(rows, fmt);
     } catch (err) {
       fail(err);
     }
@@ -3034,7 +3844,7 @@ function registerModelSecurityCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const group = await service.getGroup(uuid);
       renderGroupDetail(group, fmt);
     } catch (err) {
@@ -3044,7 +3854,7 @@ function registerModelSecurityCommand(program) {
   groups.command("create").description("Create a security group").requiredOption("--config <path>", "JSON file with group configuration").action(async (opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const config = JSON.parse(fs.readFileSync(opts.config, "utf-8"));
       const group = await service.createGroup({
         name: config.name,
@@ -3061,7 +3871,7 @@ function registerModelSecurityCommand(program) {
   groups.command("update <uuid>").description("Update a security group").option("--name <name>", "New name").option("--description <desc>", "New description").action(async (uuid, opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const request = {};
       if (opts.name) request.name = opts.name;
       if (opts.description) request.description = opts.description;
@@ -3075,7 +3885,7 @@ function registerModelSecurityCommand(program) {
   groups.command("delete <uuid>").description("Delete a security group").action(async (uuid) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const { confirmed, state } = await service.deleteGroupAndVerify(uuid);
       if (confirmed) {
         ui.success(`Group ${uuid} deleted.`);
@@ -3105,7 +3915,7 @@ function registerModelSecurityCommand(program) {
       if (!useUv && !hasBin("python3")) {
         fail(new Error("Neither uv nor python3 found on PATH. Install one first."));
       }
-      const service = await createService();
+      const service = await createService2();
       const auth = await service.getPyPIAuth();
       const pkg = `model-security-client[${extras}]`;
       const steps = useUv ? [
@@ -3149,7 +3959,7 @@ function registerModelSecurityCommand(program) {
   labels.command("add <scanUuid>").description("Add labels to a scan").requiredOption("--labels <json>", "JSON array of {key, value} labels").action(async (scanUuid, opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const parsed = JSON.parse(opts.labels);
       await service.addLabels(scanUuid, parsed);
       ui.success("Labels added.");
@@ -3160,7 +3970,7 @@ function registerModelSecurityCommand(program) {
   labels.command("set <scanUuid>").description("Replace all labels on a scan").requiredOption("--labels <json>", "JSON array of {key, value} labels").action(async (scanUuid, opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const parsed = JSON.parse(opts.labels);
       await service.setLabels(scanUuid, parsed);
       ui.success("Labels set.");
@@ -3171,7 +3981,7 @@ function registerModelSecurityCommand(program) {
   labels.command("delete <scanUuid>").description("Delete labels from a scan by key").requiredOption("--keys <keys>", "Comma-separated label keys to delete").action(async (scanUuid, opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const keys = opts.keys.split(",").map((k) => k.trim());
       await service.deleteLabels(scanUuid, keys);
       ui.success("Labels deleted.");
@@ -3182,7 +3992,7 @@ function registerModelSecurityCommand(program) {
   labels.command("keys").description("List available label keys").option("--limit <n>", "Max results", "20").action(async (opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const result = await service.getLabelKeys({
         limit: Number.parseInt(opts.limit, 10)
       });
@@ -3194,7 +4004,7 @@ function registerModelSecurityCommand(program) {
   labels.command("values <key>").description("List values for a label key").option("--limit <n>", "Max results", "20").action(async (key, opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const result = await service.getLabelValues(key, {
         limit: Number.parseInt(opts.limit, 10)
       });
@@ -3206,7 +4016,7 @@ function registerModelSecurityCommand(program) {
   ms.command("pypi-auth").description("Get PyPI authentication URL for Google Artifact Registry").action(async () => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const auth = await service.getPyPIAuth();
       ui.section("PyPI Authentication");
       ui.keyValue([
@@ -3220,24 +4030,26 @@ function registerModelSecurityCommand(program) {
   const ruleInstances = ms.command("rule-instances").description("Manage rule instances in groups");
   ruleInstances.command("list <groupUuid>").description("List rule instances in a security group").option("--security-rule-uuid <uuid>", "Filter by security rule UUID").option("--state <state>", "Filter by state (DISABLED, ALLOWING, BLOCKING)").option("--limit <n>", "Max results", "20").action(async (groupUuid, opts) => {
     try {
-      renderModelSecurityHeader();
-      const service = await createService();
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
+      const service = await createService2();
       const result = await service.listRuleInstances(groupUuid, {
         securityRuleUuid: opts.securityRuleUuid,
         state: opts.state,
         limit: Number.parseInt(opts.limit, 10)
       });
-      renderRuleInstanceList(result.ruleInstances);
+      renderRuleInstanceList(result.ruleInstances, fmt);
     } catch (err) {
       fail(err);
     }
   });
-  ruleInstances.command("get <groupUuid> <instanceUuid>").description("Get rule instance details").action(async (groupUuid, instanceUuid) => {
+  ruleInstances.command("get <groupUuid> <instanceUuid>").description("Get rule instance details").action(async (groupUuid, instanceUuid, opts) => {
     try {
-      renderModelSecurityHeader();
-      const service = await createService();
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
+      const service = await createService2();
       const instance = await service.getRuleInstance(groupUuid, instanceUuid);
-      renderRuleInstanceDetail(instance);
+      renderRuleInstanceDetail(instance, fmt);
     } catch (err) {
       fail(err);
     }
@@ -3245,7 +4057,7 @@ function registerModelSecurityCommand(program) {
   ruleInstances.command("update <groupUuid> <instanceUuid>").description("Update a rule instance").requiredOption("--config <path>", "JSON file with rule instance updates").action(async (groupUuid, instanceUuid, opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const config = JSON.parse(fs.readFileSync(opts.config, "utf-8"));
       const instance = await service.updateRuleInstance(groupUuid, instanceUuid, {
         state: config.state,
@@ -3262,23 +4074,26 @@ function registerModelSecurityCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderModelSecurityHeader();
-      const service = await createService();
-      const result = await service.listRules({
+      const service = await createService2();
+      const listOptions = {
         sourceType: opts.sourceType,
         searchQuery: opts.search,
-        limit: Number.parseInt(opts.limit, 10)
-      });
-      renderRuleList(result.rules, fmt);
+        limit: Number.parseInt(opts.limit, 10),
+        skip: Number(opts.offset ?? 0)
+      };
+      const rows = opts.all ? await service.listAllRules({ ...listOptions, max: Number(opts.max) }) : (await service.listRules(listOptions)).rules;
+      renderRuleList(rows, fmt);
     } catch (err) {
       fail(err);
     }
   });
-  rules.command("get <uuid>").description("Get security rule details").action(async (uuid) => {
+  rules.command("get <uuid>").description("Get security rule details").action(async (uuid, opts) => {
     try {
-      renderModelSecurityHeader();
-      const service = await createService();
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
+      const service = await createService2();
       const rule = await service.getRule(uuid);
-      renderRuleDetail(rule);
+      renderRuleDetail(rule, fmt);
     } catch (err) {
       fail(err);
     }
@@ -3295,25 +4110,28 @@ function registerModelSecurityCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderModelSecurityHeader();
-      const service = await createService();
-      const result = await service.listScans({
+      const service = await createService2();
+      const listOptions = {
         evalOutcome: opts.evalOutcome,
         sourceType: opts.sourceType,
         scanOrigin: opts.scanOrigin,
         search: opts.search,
-        limit: Number.parseInt(opts.limit, 10)
-      });
-      renderMsScanList(result.scans, fmt);
+        limit: Number.parseInt(opts.limit, 10),
+        skip: Number(opts.offset ?? 0)
+      };
+      const rows = opts.all ? await service.listAllScans({ ...listOptions, max: Number(opts.max) }) : (await service.listScans(listOptions)).scans;
+      renderMsScanList(rows, fmt);
     } catch (err) {
       fail(err);
     }
   });
-  scans.command("get <uuid>").description("Get scan details").action(async (uuid) => {
+  scans.command("get <uuid>").description("Get scan details").action(async (uuid, opts) => {
     try {
-      renderModelSecurityHeader();
-      const service = await createService();
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
+      const service = await createService2();
       const scan = await service.getScan(uuid);
-      renderMsScanDetail(scan);
+      renderMsScanDetail(scan, fmt);
     } catch (err) {
       fail(err);
     }
@@ -3321,7 +4139,7 @@ function registerModelSecurityCommand(program) {
   scans.command("create").description("Create a model security scan").requiredOption("--config <path>", "JSON file with scan configuration").action(async (opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const config = JSON.parse(fs.readFileSync(opts.config, "utf-8"));
       const scan = await service.createScan(config);
       ui.success(`Scan created: ${scan.uuid}`);
@@ -3333,7 +4151,7 @@ function registerModelSecurityCommand(program) {
   scans.command("evaluations <scanUuid>").description("List rule evaluations for a scan").option("--limit <n>", "Max results", "20").action(async (scanUuid, opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const result = await service.getEvaluations(scanUuid, {
         limit: Number.parseInt(opts.limit, 10)
       });
@@ -3345,7 +4163,7 @@ function registerModelSecurityCommand(program) {
   scans.command("evaluation <uuid>").description("Get evaluation details").action(async (uuid) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const evaluation = await service.getEvaluation(uuid);
       renderEvaluationDetail(evaluation);
     } catch (err) {
@@ -3355,7 +4173,7 @@ function registerModelSecurityCommand(program) {
   scans.command("violations <scanUuid>").description("List violations for a scan").option("--limit <n>", "Max results", "20").action(async (scanUuid, opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const result = await service.getViolations(scanUuid, {
         limit: Number.parseInt(opts.limit, 10)
       });
@@ -3367,7 +4185,7 @@ function registerModelSecurityCommand(program) {
   scans.command("violation <uuid>").description("Get violation details").action(async (uuid) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const violation = await service.getViolation(uuid);
       renderViolationDetail(violation);
     } catch (err) {
@@ -3377,7 +4195,7 @@ function registerModelSecurityCommand(program) {
   scans.command("files <scanUuid>").description("List scanned files").option("--type <type>", "Filter by file type").option("--result <result>", "Filter by result").option("--limit <n>", "Max results", "20").action(async (scanUuid, opts) => {
     try {
       renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const result = await service.getFiles(scanUuid, {
         type: opts.type,
         result: opts.result,
@@ -3393,16 +4211,17 @@ function registerModelSecurityCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderModelSecurityHeader();
-      const service = await createService();
-      const result = await service.listModels({
+      const service = await createService2();
+      const listOptions = {
         search: opts.search,
         searchQuery: opts.searchQuery,
         sortField: opts.sortField,
         sortOrder: opts.sortOrder,
         limit: opts.limit ? Number.parseInt(opts.limit, 10) : void 0,
         skip: opts.offset ? Number.parseInt(opts.offset, 10) : void 0
-      });
-      renderModelList(result.models, fmt);
+      };
+      const rows = opts.all ? await service.listAllModels({ ...listOptions, max: Number(opts.max) }) : (await service.listModels(listOptions)).models;
+      renderModelList(rows, fmt);
     } catch (err) {
       fail(err);
     }
@@ -3411,7 +4230,7 @@ function registerModelSecurityCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const model = await service.getModel(uuid);
       renderModelDetail(model, fmt);
     } catch (err) {
@@ -3422,7 +4241,7 @@ function registerModelSecurityCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const result = await service.listModelVersions(modelUuid, {
         sortOrder: opts.sortOrder,
         limit: opts.limit ? Number.parseInt(opts.limit, 10) : void 0,
@@ -3437,7 +4256,7 @@ function registerModelSecurityCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const version = await service.getModelVersion(uuid);
       renderModelVersionDetail(version, fmt);
     } catch (err) {
@@ -3448,7 +4267,7 @@ function registerModelSecurityCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderModelSecurityHeader();
-      const service = await createService();
+      const service = await createService2();
       const result = await service.listModelVersionFiles(modelVersionUuid, {
         limit: opts.limit ? Number.parseInt(opts.limit, 10) : void 0,
         skip: opts.offset ? Number.parseInt(opts.offset, 10) : void 0
@@ -3464,25 +4283,8 @@ function registerModelSecurityCommand(program) {
 import * as fs2 from "fs";
 import * as path from "path";
 
-// src/cli/confirm.ts
-async function confirmOrAbort(message, force, options = {}) {
-  if (force) return;
-  const interactive = options.isTTY ?? process.stdout.isTTY === true;
-  if (!interactive) {
-    usageError(
-      `refusing to ${options.action ?? "proceed"} without --force in non-interactive mode`
-    );
-  }
-  const prompt = options.promptFn ?? (await import("@inquirer/prompts")).confirm;
-  const confirmed = await prompt({ message, default: false });
-  if (!confirmed) {
-    ui.info("Aborted");
-    process.exit(0);
-  }
-}
-
 // src/cli/deprecated-flags.ts
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 import { Option } from "commander";
 var ALIASES = /* @__PURE__ */ new WeakMap();
 function registerDeprecatedAlias(cmd, alias) {
@@ -3497,7 +4299,7 @@ function resolveDeprecatedAliases(cmd, opts) {
     const oldValue = opts[alias.oldKey];
     if (oldValue === void 0) continue;
     console.error(
-      chalk9.yellow(
+      chalk10.yellow(
         `  \u26A0 ${alias.oldFlag.split(" ")[0]} is deprecated and will be removed in v4 \u2014 use ${alias.canonicalFlag}`
       )
     );
@@ -3681,7 +4483,7 @@ async function restoreTargets(opts) {
 }
 
 // src/cli/commands/redteam.ts
-async function createService2() {
+async function createService3() {
   const config = await loadConfig();
   return new SdkRedTeamService(redTeamClientOptions(config));
 }
@@ -3689,6 +4491,14 @@ async function createPromptSetService() {
   const config = await loadConfig();
   return new SdkPromptSetService(redTeamClientOptions(config));
 }
+function buildDefaultCategories(categories) {
+  return Object.fromEntries(
+    categories.map((category) => [
+      category.id,
+      category.subCategories.map((subCategory) => subCategory.id).filter((id) => id !== "MULTI_TURN")
+    ])
+  );
+}
 function parseAttackGoals(input) {
   const trimmed = input.trim();
   const raw = trimmed.startsWith("[") ? trimmed : fs2.readFileSync(trimmed, "utf-8");
@@ -3704,8 +4514,12 @@ function parseAttackGoals(input) {
   return parsed;
 }
 function sliceClientSide(items, opts) {
-  const offset = opts.offset !== void 0 ? Number.parseInt(opts.offset, 10) : 0;
-  const limit = opts.limit !== void 0 ? Number.parseInt(opts.limit, 10) : void 0;
+  if (opts.all) {
+    const max = opts.max === void 0 ? 1e4 : Number(opts.max);
+    return max === 0 ? items : items.slice(0, max);
+  }
+  const offset = opts.offset !== void 0 ? Number.parseInt(String(opts.offset), 10) : 0;
+  const limit = opts.limit !== void 0 ? Number.parseInt(String(opts.limit), 10) : void 0;
   return items.slice(offset, limit === void 0 ? void 0 : offset + limit);
 }
 function parsePositiveInt(input, flag) {
@@ -3721,8 +4535,11 @@ var VALID_TARGET_PROVIDERS = [
   "DATABRICKS",
   "BEDROCK",
   "REST",
-  "STREAMING"
+  "STREAMING",
+  "WEBSOCKET",
+  "CUSTOM_TARGET_ADAPTER"
 ];
+var REST_PROVIDERS = /* @__PURE__ */ new Set(["REST", "STREAMING", "WEBSOCKET", "HUGGING_FACE"]);
 function buildTargetScaffold(provider, templates) {
   const key = provider.toUpperCase();
   if (!VALID_TARGET_PROVIDERS.includes(key)) {
@@ -3730,21 +4547,92 @@ function buildTargetScaffold(provider, templates) {
       `Unknown provider "${provider}". Valid providers: ${VALID_TARGET_PROVIDERS.join(", ")}`
     );
   }
+  if (key === "CUSTOM_TARGET_ADAPTER") {
+    return {
+      name: "",
+      target_type: "AGENT",
+      connection_type: "CUSTOM_TARGET_ADAPTER",
+      api_endpoint_type: "NETWORK_BROKER",
+      network_broker_channel_uuid: "<channel-uuid>",
+      adapter_uuid: "<adapter-uuid>",
+      // adapter_variable_overrides is an ARRAY of {key, value, type} objects.
+      adapter_variable_overrides: [],
+      target_background: { use_case: "" },
+      additional_context: {}
+    };
+  }
+  if (REST_PROVIDERS.has(key)) {
+    const tpl = templates[key] ?? {};
+    return {
+      name: "",
+      target_type: "APPLICATION",
+      connection_type: "CUSTOM",
+      api_endpoint_type: "PUBLIC",
+      response_mode: key === "STREAMING" ? "STREAMING" : key === "WEBSOCKET" ? "WEBSOCKET" : "REST",
+      auth_type: "HEADERS",
+      auth_config: {
+        auth_header: { Authorization: "Bearer <token>" }
+      },
+      connection_params: {
+        api_endpoint: tpl.url ?? "",
+        request_headers: { "Content-Type": "application/json" },
+        request_json: tpl.request_json ?? { messages: [{ role: "user", content: "{INPUT}" }] },
+        response_json: tpl.response_json ?? { choices: [{ message: { content: "{RESPONSE}" } }] },
+        response_key: "choices.0.message.content"
+      },
+      target_background: {},
+      additional_context: {}
+    };
+  }
   return {
     name: "",
     target_type: "APPLICATION",
-    connection_params: templates[key] ?? {},
+    connection_type: key,
+    api_endpoint_type: "PUBLIC",
+    response_mode: "REST",
+    auth_type: "HEADERS",
+    auth_config: {
+      auth_header: { Authorization: "Bearer <token>" }
+    },
+    connection_params: {
+      target_connection_config: templates[key] ?? {}
+    },
     target_background: {},
-    additional_context: {},
-    target_metadata: {}
+    additional_context: {}
   };
 }
+function resolveScriptB64(opts) {
+  if (opts.scriptFile !== void 0 && opts.scriptB64 !== void 0) {
+    throw new Error("--script-file and --script-b64 are mutually exclusive");
+  }
+  if (opts.scriptB64 !== void 0) return opts.scriptB64;
+  if (opts.scriptFile !== void 0) {
+    return Buffer.from(fs2.readFileSync(opts.scriptFile, "utf-8")).toString("base64");
+  }
+  throw new Error("one of --script-file or --script-b64 is required");
+}
+function parseAdapterVariables(input) {
+  let parsed;
+  try {
+    parsed = JSON.parse(input);
+  } catch (err) {
+    throw new Error(`--variables: invalid JSON (${err instanceof Error ? err.message : err})`);
+  }
+  if (!Array.isArray(parsed) || !parsed.every(
+    (v) => v !== null && typeof v === "object" && typeof v.key === "string" && (v.type === "VAR" || v.type === "SECRET")
+  )) {
+    throw new Error(
+      '--variables: expected a JSON array of { "key": string, "value"?: string|null, "type": "VAR"|"SECRET" }'
+    );
+  }
+  return parsed;
+}
 function registerRedteamCommand(program) {
   const redteam = program.command("redteam").description("AI Red Team scan operations");
   redteam.command("abort <jobId>").description("Abort a running scan").action(async (jobId) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       await service.abortScan(jobId);
       ui.success(`Scan ${jobId} aborted.`);
     } catch (err) {
@@ -3754,7 +4642,7 @@ function registerRedteamCommand(program) {
   redteam.command("categories").description("List available attack categories").action(async () => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const categories = await service.getCategories();
       renderCategories(categories);
     } catch (err) {
@@ -3765,7 +4653,7 @@ function registerRedteamCommand(program) {
   eula.command("status").description("Check EULA acceptance status").action(async () => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const status = await service.getEulaStatus();
       renderEulaStatus(status);
     } catch (err) {
@@ -3775,7 +4663,7 @@ function registerRedteamCommand(program) {
   eula.command("content").description("Display EULA content").action(async () => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const content = await service.getEulaContent();
       renderEulaContent(content);
     } catch (err) {
@@ -3793,7 +4681,7 @@ function registerRedteamCommand(program) {
     resolveDeprecatedAliases(eulaAccept, opts);
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const content = await service.getEulaContent();
       if (!opts.force) {
         renderEulaContent(content);
@@ -3811,7 +4699,7 @@ function registerRedteamCommand(program) {
   instances.command("create").description("Create an instance").requiredOption("--tsg-id <id>", "TSG ID").requiredOption("--tenant-id <id>", "Tenant ID").requiredOption("--app-id <id>", "App ID").requiredOption("--region <region>", "Region").action(async (opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const result = await service.createInstance({
         tsgId: opts.tsgId,
         tenantId: opts.tenantId,
@@ -3827,7 +4715,7 @@ function registerRedteamCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const result = await service.getInstance(tenantId);
       renderInstanceDetail(result, fmt);
     } catch (err) {
@@ -3837,7 +4725,7 @@ function registerRedteamCommand(program) {
   instances.command("update <tenantId>").description("Update an instance").requiredOption("--tsg-id <id>", "TSG ID").requiredOption("--app-id <id>", "App ID").requiredOption("--region <region>", "Region").action(async (tenantId, opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const result = await service.updateInstance(tenantId, {
         tsgId: opts.tsgId,
         tenantId,
@@ -3852,7 +4740,7 @@ function registerRedteamCommand(program) {
   instances.command("delete <tenantId>").description("Delete an instance").action(async (tenantId) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const result = await service.deleteInstance(tenantId);
       renderInstanceResponse(result);
       ui.success(`Instance ${tenantId} deleted.`);
@@ -3864,7 +4752,7 @@ function registerRedteamCommand(program) {
   devices.command("create <tenantId>").description("Create devices for an instance").requiredOption("--config <path>", "JSON file with device request").action(async (tenantId, opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const config = JSON.parse(fs2.readFileSync(opts.config, "utf-8"));
       const result = await service.createDevices(tenantId, config);
       ui.success("Devices created:");
@@ -3876,7 +4764,7 @@ function registerRedteamCommand(program) {
   devices.command("update <tenantId>").description("Update devices for an instance (PATCH)").requiredOption("--config <path>", "JSON file with device request").action(async (tenantId, opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const config = JSON.parse(fs2.readFileSync(opts.config, "utf-8"));
       const result = await service.updateDevices(tenantId, config);
       ui.success("Devices updated:");
@@ -3888,7 +4776,7 @@ function registerRedteamCommand(program) {
   devices.command("delete <tenantId>").description("Delete devices by serial numbers").requiredOption("--serial-numbers <list>", "Comma-separated serial numbers").action(async (tenantId, opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const result = await service.deleteDevices(tenantId, opts.serialNumbers);
       ui.success("Devices deleted:");
       console.log(JSON.stringify(result, null, 2));
@@ -3900,7 +4788,7 @@ function registerRedteamCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const creds = await service.getRegistryCredentials();
       renderRegistryCredentials(creds, fmt);
     } catch (err) {
@@ -3911,13 +4799,15 @@ function registerRedteamCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
-      const service = await createService2();
-      const scans = await service.listScans({
+      const service = await createService3();
+      const listOptions = {
         status: opts.status,
         jobType: opts.type,
         targetId: opts.target,
-        limit: Number.parseInt(opts.limit, 10)
-      });
+        limit: Number.parseInt(opts.limit, 10),
+        offset: Number(opts.offset ?? 0)
+      };
+      const scans = opts.all ? await service.listAllScans({ ...listOptions, max: Number(opts.max) }) : await service.listScans(listOptions);
       renderScanList(scans, fmt);
     } catch (err) {
       fail(err);
@@ -4124,7 +5014,7 @@ function registerRedteamCommand(program) {
   redteam.command("report <jobId>").description("View scan report").option("--attacks", "Include attack list", false).option("--severity <level>", "Filter attacks by severity").option("--limit <n>", "Max attacks to show", "20").action(async (jobId, opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const job = await service.getScan(jobId);
       renderScanStatus(job);
       if (job.jobType === "CUSTOM") {
@@ -4184,7 +5074,18 @@ function registerRedteamCommand(program) {
     const customPromptSets = opts.promptSets ? opts.promptSets.split(",").map((s) => s.trim()) : void 0;
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
+      if (opts.type === "STATIC" && !categories) {
+        const defaultCategories = buildDefaultCategories(await service.getCategories());
+        const categoryCount = Object.values(defaultCategories).reduce(
+          (total, subCategories) => total + subCategories.length,
+          0
+        );
+        categories = defaultCategories;
+        ui.status(
+          `No --categories given \u2014 defaulting to all ${categoryCount} categories (MULTI_TURN excluded). Pass --categories to narrow the scan.`
+        );
+      }
       ui.status(`Creating ${opts.type} scan "${opts.name}"...`);
       const job = await service.createScan({
         name: opts.name,
@@ -4218,7 +5119,7 @@ function registerRedteamCommand(program) {
   redteam.command("status <jobId>").description("Check scan status").action(async (jobId) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const job = await service.getScan(jobId);
       renderScanStatus(job);
     } catch (err) {
@@ -4237,7 +5138,7 @@ function registerRedteamCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const list = await service.listTargets();
       renderTargetList(sliceClientSide(list, opts), fmt);
     } catch (err) {
@@ -4248,7 +5149,7 @@ function registerRedteamCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const target = await service.getTarget(uuid);
       renderTargetDetail(target, fmt);
     } catch (err) {
@@ -4258,7 +5159,7 @@ function registerRedteamCommand(program) {
   targets.command("create").description("Create a new red team target").requiredOption("--config <path>", "JSON file with target configuration").option("--validate", "Validate target connection before saving").action(async (opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const config = JSON.parse(fs2.readFileSync(opts.config, "utf-8"));
       const target = await service.createTarget(
         config,
@@ -4273,7 +5174,7 @@ function registerRedteamCommand(program) {
   targets.command("update <uuid>").description("Update a red team target").requiredOption("--config <path>", "JSON file with target updates").option("--validate", "Validate target connection before saving").action(async (uuid, opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const config = JSON.parse(fs2.readFileSync(opts.config, "utf-8"));
       const target = await service.updateTarget(
         uuid,
@@ -4292,7 +5193,7 @@ function registerRedteamCommand(program) {
         action: `delete target ${uuid}`
       });
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       await service.deleteTarget(uuid);
       ui.success(`Target ${uuid} deleted.`);
     } catch (err) {
@@ -4302,7 +5203,7 @@ function registerRedteamCommand(program) {
   targets.command("probe").description("Test target connection without saving").requiredOption("--config <path>", "JSON file with connection params").action(async (opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const config = JSON.parse(fs2.readFileSync(opts.config, "utf-8"));
       const result = await service.probeTarget(config);
       ui.dim("Probe result:");
@@ -4314,7 +5215,7 @@ function registerRedteamCommand(program) {
   targets.command("profile <uuid>").description("View target profile").action(async (uuid) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const profile = await service.getTargetProfile(uuid);
       ui.dim("Target Profile:");
       console.log(JSON.stringify(profile, null, 2));
@@ -4325,7 +5226,7 @@ function registerRedteamCommand(program) {
   targets.command("update-profile <uuid>").description("Update target profile").requiredOption("--config <path>", "JSON file with profile updates").action(async (uuid, opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const config = JSON.parse(fs2.readFileSync(opts.config, "utf-8"));
       const result = await service.updateTargetProfile(uuid, config);
       ui.success("Profile updated:");
@@ -4337,7 +5238,7 @@ function registerRedteamCommand(program) {
   targets.command("validate-auth").description("Validate target auth credentials").requiredOption("--auth-type <type>", "Auth type: HEADERS, BASIC_AUTH, OAUTH2").requiredOption("--config <path>", "JSON file with auth_config").option("--target-id <uuid>", "Existing target UUID").action(async (opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const authConfig = JSON.parse(fs2.readFileSync(opts.config, "utf-8"));
       const result = await service.validateTargetAuth({
         authType: opts.authType,
@@ -4351,7 +5252,7 @@ function registerRedteamCommand(program) {
   });
   targets.command("metadata").description("Get target field metadata").action(async () => {
     try {
-      const service = await createService2();
+      const service = await createService3();
       const metadata = await service.getTargetMetadata();
       console.log(JSON.stringify(metadata, null, 2));
     } catch (err) {
@@ -4383,7 +5284,7 @@ function registerRedteamCommand(program) {
     }
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const templates = await service.getTargetTemplates();
       const scaffold = buildTargetScaffold(provider, templates);
       fs2.writeFileSync(outputPath, `${JSON.stringify(scaffold, null, 2)}
@@ -4402,19 +5303,25 @@ function registerRedteamCommand(program) {
   targets.command("templates").description("Get provider-specific target templates").action(async () => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const templates = await service.getTargetTemplates();
       renderTargetTemplates(templates);
     } catch (err) {
       fail(err);
     }
   });
-  const targetsBackup = targets.command("backup").description("Backup red team targets to local JSON/YAML files").option("--output-dir <path>", "Output directory").option("--output <format>", "Output format: json or yaml", "json").option("--name <targetName>", "Backup a single target by name");
+  const targetsBackup = targets.command("backup").description("Backup red team targets to local JSON/YAML files").option("--output-dir <path>", "Output directory").option("--file-format <format>", "Backup file format: json or yaml", "json").option("--name <targetName>", "Backup a single target by name");
+  registerDeprecatedAlias(targetsBackup, {
+    oldFlag: "--output <format>",
+    oldKey: "output",
+    canonicalFlag: "--file-format",
+    canonicalKey: "fileFormat"
+  });
   registerDeprecatedAlias(targetsBackup, {
     oldFlag: "--format <format>",
     oldKey: "format",
-    canonicalFlag: "--output",
-    canonicalKey: "output"
+    canonicalFlag: "--file-format",
+    canonicalKey: "fileFormat"
   });
   targetsBackup.action(async (opts) => {
     resolveDeprecatedAliases(targetsBackup, opts);
@@ -4423,7 +5330,7 @@ function registerRedteamCommand(program) {
       const outputDir = resolveOutputDir(opts.outputDir, "targets");
       const results = await backupTargets({
         outputDir,
-        format: opts.output ?? "json",
+        format: opts.fileFormat ?? "json",
         name: opts.name
       });
       renderBackupSummary(results, outputDir);
@@ -4456,7 +5363,7 @@ function registerRedteamCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const { logs } = await service.getTargetProfileErrorLogs(targetId, {
         limit: opts.limit ? parsePositiveInt(opts.limit, "--limit") : void 0,
         offset: opts.offset ? Number.parseInt(opts.offset, 10) : void 0,
@@ -4467,19 +5374,182 @@ function registerRedteamCommand(program) {
       fail(err);
     }
   });
+  const adapter = redteam.command("adapter").description("Manage custom target adapters (scripted targets run via the network broker)");
+  async function assertChannelOnline(service, channelUuid) {
+    let status;
+    try {
+      status = (await service.getChannel(channelUuid)).status;
+    } catch {
+      return;
+    }
+    if (status && status !== "ONLINE") {
+      fail(
+        new Error(
+          `network broker channel ${channelUuid} is ${status} \u2014 adapter validation requires an ONLINE channel (network broker v1.4.0+). Check 'airs redteam network-broker channels list'.`
+        )
+      );
+    }
+  }
+  adapter.command("list").description("List custom target adapters").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--search <text>", "Filter by search text").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderRedteamHeader();
+      const service = await createService3();
+      const listOptions = {
+        limit: opts.limit ? parsePositiveInt(opts.limit, "--limit") : void 0,
+        offset: opts.offset ? Number.parseInt(opts.offset, 10) : void 0,
+        search: opts.search
+      };
+      const result = opts.all ? { adapters: await service.listAllAdapters({ ...listOptions, max: Number(opts.max) }) } : await service.listAdapters(listOptions);
+      const { adapters, totalItems } = result;
+      renderAdapterList(adapters, fmt, totalItems);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  adapter.command("get <uuid>").description("Get a custom target adapter").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (uuid, opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderRedteamHeader();
+      const service = await createService3();
+      renderAdapterDetail(await service.getAdapter(uuid), fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  adapter.command("create").description("Create a custom target adapter").requiredOption("--name <name>", "Adapter name").requiredOption(
+    "--prompt <text>",
+    "Sample prompt used to exercise the adapter during validation (not stored)"
+  ).option("--script-file <path>", "Path to the adapter script (encoded to base64 for you)").option("--script-b64 <b64>", "Adapter script, already base64-encoded").option("--description <text>", "Adapter description").option("--channel <uuid>", "Network broker channel UUID (required to activate)").option("--variables <json>", "JSON array of { key, value, type: VAR|SECRET }").option("--draft", "Save as DRAFT without running the validation script").option("--output <format>", "Output format: pretty, json, yaml", "pretty").addHelpText(
+    "after",
+    examples(
+      `airs redteam adapter create --name my-adapter --script-file ./adapter.py --channel 550e8400-... --prompt 'Hello' --variables '[{"key":"endpoint","value":"http://agent.svc:8080","type":"VAR"}]'`,
+      "airs redteam adapter create --name my-adapter --script-file ./adapter.py --prompt Hello --draft"
+    )
+  ).action(async (opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderRedteamHeader();
+      const scriptB64 = resolveScriptB64(opts);
+      const variables = opts.variables ? parseAdapterVariables(opts.variables) : void 0;
+      const service = await createService3();
+      if (!opts.draft && opts.channel) await assertChannelOnline(service, opts.channel);
+      const created = await service.createAdapter(
+        {
+          name: opts.name,
+          scriptB64,
+          prompt: opts.prompt,
+          description: opts.description,
+          networkBrokerChannelUuid: opts.channel,
+          variables
+        },
+        opts.draft ? false : void 0
+      );
+      ui.success(`Adapter created: ${created.uuid}`);
+      renderAdapterDetail(created, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  adapter.command("update <uuid>").description(
+    "Update a custom target adapter (read-modify-write; variables preserved unless --variables)"
+  ).requiredOption(
+    "--prompt <text>",
+    "Sample validation prompt \u2014 required on every update because upstream never stores it"
+  ).option("--name <name>", "New adapter name").option("--script-file <path>", "New adapter script file (encoded to base64 for you)").option("--script-b64 <b64>", "New adapter script, already base64-encoded").option("--description <text>", "New description").option("--channel <uuid>", "New network broker channel UUID").option(
+    "--variables <json>",
+    "REPLACES the whole variable set \u2014 omitted keys are deleted upstream. Omit this flag to preserve stored variables."
+  ).option("--draft", "Save as DRAFT without re-running the validation script").option("--output <format>", "Output format: pretty, json, yaml", "pretty").addHelpText(
+    "after",
+    examples(
+      `airs redteam adapter update 550e8400-... --description 'new description' --prompt 'Hello'`
+    )
+  ).action(async (uuid, opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderRedteamHeader();
+      const scriptB64 = opts.scriptFile !== void 0 || opts.scriptB64 !== void 0 ? resolveScriptB64(opts) : void 0;
+      const variables = opts.variables ? parseAdapterVariables(opts.variables) : void 0;
+      const service = await createService3();
+      if (!opts.draft && opts.channel) await assertChannelOnline(service, opts.channel);
+      const updated = await service.updateAdapter(
+        uuid,
+        {
+          prompt: opts.prompt,
+          name: opts.name,
+          scriptB64,
+          description: opts.description,
+          networkBrokerChannelUuid: opts.channel,
+          variables
+        },
+        opts.draft ? false : void 0
+      );
+      ui.success(`Adapter updated: ${updated.uuid}`);
+      renderAdapterDetail(updated, fmt);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  adapter.command("delete <uuid>").description("Delete a custom target adapter").option("--force", "Skip confirmation prompt").action(async (uuid, opts) => {
+    try {
+      renderRedteamHeader();
+      await confirmOrAbort(`Delete adapter ${uuid}?`, Boolean(opts.force), {
+        action: `delete adapter ${uuid}`
+      });
+      const service = await createService3();
+      await service.deleteAdapter(uuid);
+      ui.success(`Adapter ${uuid} deleted.`);
+    } catch (err) {
+      fail(err);
+    }
+  });
+  adapter.command("validate").description("Run an adapter script end-to-end through the broker channel without saving").requiredOption("--channel <uuid>", "Network broker channel UUID (must be ONLINE)").requiredOption("--prompt <text>", "Sample prompt to send through the adapter").option("--script-file <path>", "Path to the adapter script (encoded to base64 for you)").option("--script-b64 <b64>", "Adapter script, already base64-encoded").option(
+    "--variables <json>",
+    "JSON array of { key, value, type } \u2014 the FULL set the script needs"
+  ).option(
+    "--adapter <uuid>",
+    "Existing adapter: resolves redacted/null variable values from its stored secrets (and supplies its variable set when --variables is omitted)"
+  ).option("--output <format>", "Output format: pretty, json, yaml", "pretty").addHelpText(
+    "after",
+    examples(
+      `airs redteam adapter validate --script-file ./adapter.py --channel 550e8400-... --prompt 'Hello' --variables '[{"key":"endpoint","value":"http://agent.svc:8080","type":"VAR"}]'`,
+      `airs redteam adapter validate --script-file ./adapter.py --channel 550e8400-... --prompt 'Hello' --adapter 660e8400-...`
+    )
+  ).action(async (opts) => {
+    try {
+      const fmt = opts.output;
+      if (fmt === "pretty") renderRedteamHeader();
+      const scriptB64 = resolveScriptB64(opts);
+      const variables = opts.variables ? parseAdapterVariables(opts.variables) : void 0;
+      const service = await createService3();
+      await assertChannelOnline(service, opts.channel);
+      const result = await service.validateAdapter({
+        scriptB64,
+        networkBrokerChannelUuid: opts.channel,
+        prompt: opts.prompt,
+        variables,
+        adapterUuid: opts.adapter
+      });
+      renderAdapterValidation(result, fmt);
+      if (!result.validated) process.exitCode = 1;
+    } catch (err) {
+      fail(err);
+    }
+  });
   const networkBroker = redteam.command("network-broker").description("Manage red team network broker channels");
   const channels = networkBroker.command("channels").description("Manage network broker channels");
   channels.command("list").description("List network broker channels").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--search <text>", "Filter by search text").option("--status <status...>", "Filter by status (ONLINE, OFFLINE, DRAFT)").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
-      const service = await createService2();
-      const { channels: list } = await service.listChannels({
+      const service = await createService3();
+      const listOptions = {
         limit: opts.limit ? parsePositiveInt(opts.limit, "--limit") : void 0,
         offset: opts.offset ? Number.parseInt(opts.offset, 10) : void 0,
         search: opts.search,
         status: opts.status
-      });
+      };
+      const list = opts.all ? await service.listAllChannels({ ...listOptions, max: Number(opts.max) }) : (await service.listChannels(listOptions)).channels;
       renderChannelList(list, fmt);
     } catch (err) {
       fail(err);
@@ -4489,7 +5559,7 @@ function registerRedteamCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const channel = await service.getChannel(channelId);
       renderChannelDetail(channel, fmt);
     } catch (err) {
@@ -4499,7 +5569,7 @@ function registerRedteamCommand(program) {
   channels.command("create").description("Create a network broker channel").requiredOption("--name <name>", "Channel name").option("--description <text>", "Channel description").action(async (opts) => {
     try {
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const channel = await service.createChannel({
         name: opts.name,
         description: opts.description
@@ -4516,7 +5586,7 @@ function registerRedteamCommand(program) {
         usageError("Specify --name and/or --description to update");
       }
       renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const channel = await service.updateChannel(channelId, {
         name: opts.name,
         description: opts.description
@@ -4531,7 +5601,7 @@ function registerRedteamCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const stats = await service.getChannelStats();
       renderChannelStats(stats, fmt);
     } catch (err) {
@@ -4542,7 +5612,7 @@ function registerRedteamCommand(program) {
     try {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
-      const service = await createService2();
+      const service = await createService3();
       const data = await service.getLanguages(Boolean(opts.management));
       renderLanguages(data, fmt);
     } catch (err) {
@@ -4556,7 +5626,7 @@ import { randomUUID as randomUUID4 } from "crypto";
 import * as fs5 from "fs";
 import { readFile as readFile8 } from "fs/promises";
 import { basename as basename3, dirname as dirname2, join as join2, resolve as resolvePath } from "path";
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 
 // src/cli/builders/profile-builder.ts
 function parseList(value) {
@@ -5021,6 +6091,31 @@ async function loadBulkScanState(filePath) {
 
 // src/cli/pagination.ts
 var DEFAULT_PAGE_SIZE = 50;
+var DEFAULT_OFFSET_LIMIT = 100;
+var DEFAULT_MAX_ITEMS = 1e4;
+function registerListFlags(command, options) {
+  const defaultLimit = options.dialect === "offset" ? DEFAULT_OFFSET_LIMIT : DEFAULT_PAGE_SIZE;
+  return command.option("--limit <n>", `Items per page (default: ${defaultLimit})`, Number, defaultLimit).option("--offset <n>", "Item offset (default: 0)", Number, 0).option("--all", "Walk all pages").option("--max <n>", "Maximum items with --all; 0 removes the cap", Number, DEFAULT_MAX_ITEMS);
+}
+function integerFlag(name, value, minimum) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < minimum) {
+    const qualifier = minimum === 1 ? "a positive integer" : "a non-negative integer";
+    throw new CliUsageError(`${name} must be ${qualifier}`);
+  }
+  return parsed;
+}
+function resolveListParams(command, opts, options) {
+  const defaultLimit = options.dialect === "offset" ? DEFAULT_OFFSET_LIMIT : DEFAULT_PAGE_SIZE;
+  const limit = integerFlag("--limit", opts.limit ?? defaultLimit, 1);
+  const offset = integerFlag("--offset", opts.offset ?? 0, 0);
+  const max = integerFlag("--max", opts.max ?? DEFAULT_MAX_ITEMS, 0);
+  const all = Boolean(opts.all);
+  if (all && command.getOptionValueSource?.("offset") === "cli") {
+    throw new CliUsageError("--all cannot be combined with --offset");
+  }
+  return { limit, offset, all, max };
+}
 function registerPageAliases(cmd, opts) {
   registerDeprecatedAlias(cmd, {
     oldFlag: `${opts.sizeFlag} <n>`,
@@ -5142,6 +6237,71 @@ function parseQuotedField(content, start, len) {
   return { value, nextIndex: i };
 }
 
+// src/cli/renderer/views/runtime.ts
+var profilesView = {
+  name: "profiles",
+  columns: [
+    { key: "profileId", label: "ID" },
+    { key: "profileName", label: "Name" },
+    { key: "active", label: "Active" },
+    { key: "revision", label: "Revision" }
+  ],
+  pretty: {
+    list: (items) => renderProfileList(items, "pretty"),
+    detail: renderProfileDetail
+  }
+};
+var apiKeysView = {
+  name: "API keys",
+  columns: [
+    { key: "id", label: "ID" },
+    { key: "name", label: "Name" },
+    { key: "last8", label: "Last 8" },
+    { key: "expiresAt", label: "Expires" }
+  ],
+  pretty: {
+    list: (items) => renderApiKeyList(items, "pretty"),
+    detail: renderApiKeyDetail
+  }
+};
+var customerAppsView = {
+  name: "customer apps",
+  columns: [
+    { key: "id", label: "ID" },
+    { key: "name", label: "Name" },
+    { key: "description", label: "Description" }
+  ],
+  pretty: {
+    list: (items) => renderCustomerAppList(items, "pretty"),
+    detail: renderCustomerAppDetail
+  }
+};
+var topicsView = {
+  name: "topics",
+  columns: [
+    { key: "topic_id", label: "ID" },
+    { key: "topic_name", label: "Name" },
+    { key: "revision", label: "Revision" },
+    { key: "description", label: "Description" }
+  ],
+  structured: (topic) => ({
+    topicId: topic.topic_id,
+    topicName: topic.topic_name,
+    revision: topic.revision,
+    active: topic.active,
+    description: topic.description,
+    examples: topic.examples,
+    createdBy: topic.created_by,
+    updatedBy: topic.updated_by,
+    lastModifiedTs: topic.last_modified_ts,
+    createdTs: topic.created_ts
+  }),
+  pretty: {
+    list: (items) => renderTopicList(items, "pretty"),
+    detail: renderTopicDetail
+  }
+};
+
 // src/cli/commands/dlp/dictionaries.ts
 import { readFile as readFile6 } from "fs/promises";
 import { basename as basename2 } from "path";
@@ -5155,6 +6315,9 @@ var SdkDictionariesService = class {
   async list(params) {
     return this.client.list(params);
   }
+  async listAll(params) {
+    return this.client.listAll(params);
+  }
   async create(params) {
     return this.client.create(params);
   }
@@ -5262,20 +6425,22 @@ function register(dlp) {
     "--offset <n>",
     "Starting offset \u2014 rounds down to a page boundary",
     (v) => Number.parseInt(v, 10)
-  ).option("--sort <field,dir>", "(repeatable)", (v, p = []) => [...p, v]).option("--keywords", "Include keyword list in response").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format", "pretty");
+  ).option("--sort <field,dir>", "(repeatable)", (v, p = []) => [...p, v]).option("--keywords", "Include keyword list in response").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml");
   registerPageAliases(listCmd, { sizeFlag: "--size", sizeKey: "size" });
   listCmd.action(async (opts) => {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const includeKeywords = opts.keywords || opts.includeKeywords;
+      const svc = new SdkDictionariesService();
+      const params = {
+        size,
+        sort: opts.sort,
+        keywords: includeKeywords ? true : void 0
+      };
+      const all = opts.all ? await svc.listAll({ ...params, max: Number(opts.max) }) : void 0;
       dlpDictionaries.renderList(
-        await new SdkDictionariesService().list({
-          page,
-          size,
-          sort: opts.sort,
-          keywords: includeKeywords ? true : void 0
-        }),
-        opts.output
+        all ? { content: all, totalElements: all.length } : await svc.list({ ...params, page }),
+        await resolveOutput(listCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -5296,12 +6461,12 @@ function register(dlp) {
       usageError(err instanceof Error ? err.message : String(err));
     }
   });
-  group.command("get <id>").option("--keywords", "").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format", "pretty").action(async (id, opts) => {
+  const getCmd = group.command("get <id>").option("--keywords", "").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (id, opts) => {
     try {
       const includeKeywords = opts.keywords || opts.includeKeywords;
       dlpDictionaries.renderGet(
         await new SdkDictionariesService().get(id, { includeKeywords }),
-        opts.output
+        await resolveOutput(getCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -5362,6 +6527,9 @@ var SdkDataFilteringProfilesService = class {
   async list(params) {
     return this.client.list(params);
   }
+  async listAll(params) {
+    return this.client.listAll(params);
+  }
   async get(id) {
     return this.client.get(id);
   }
@@ -5495,7 +6663,7 @@ function listFlags(cmd) {
     "--offset <n>",
     "Starting offset \u2014 rounds down to a page boundary",
     (v) => Number.parseInt(v, 10)
-  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format", "pretty");
+  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml");
   registerPageAliases(cmd, { sizeFlag: "--size", sizeKey: "size" });
   return cmd;
 }
@@ -5516,16 +6684,17 @@ function register2(dlp) {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataFilteringProfilesService();
-      const r = await svc.list({ page, size, sort: opts.sort });
-      dlpFilteringProfiles.renderList(r, opts.output);
+      const all = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
+      const r = all ? { content: all, totalElements: all.length } : await svc.list({ page, size, sort: opts.sort });
+      dlpFilteringProfiles.renderList(r, await resolveOutput(listCmd, opts));
     } catch (err) {
       fail(err);
     }
   });
-  group.command("get <id>").description("Get a filtering profile by id").option("--output <fmt>", "Output format", "pretty").action(async (id, opts) => {
+  const getCmd = group.command("get <id>").description("Get a filtering profile by id").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (id, opts) => {
     try {
       const svc = new SdkDataFilteringProfilesService();
-      dlpFilteringProfiles.renderGet(await svc.get(id), opts.output);
+      dlpFilteringProfiles.renderGet(await svc.get(id), await resolveOutput(getCmd, opts));
     } catch (err) {
       fail(err);
     }
@@ -5621,6 +6790,9 @@ var SdkDataPatternsService = class {
   async list(params) {
     return this.client.list(params);
   }
+  async listAll(params) {
+    return this.client.listAll(params);
+  }
   async create(body) {
     return this.client.create(body);
   }
@@ -5644,7 +6816,7 @@ function listFlags2(cmd) {
     "--offset <n>",
     "Starting offset \u2014 rounds down to a page boundary",
     (v) => Number.parseInt(v, 10)
-  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format", "pretty");
+  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml");
   registerPageAliases(cmd, { sizeFlag: "--size", sizeKey: "size" });
   return cmd;
 }
@@ -5666,9 +6838,10 @@ function register4(dlp) {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataPatternsService();
+      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
       dlpPatterns.renderList(
-        await svc.list({ page, size, sort: opts.sort }),
-        opts.output
+        result ? { content: result, totalElements: result.length } : await svc.list({ page, size, sort: opts.sort }),
+        await resolveOutput(listCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -5686,11 +6859,11 @@ function register4(dlp) {
       usageError(err instanceof Error ? err.message : String(err));
     }
   });
-  group.command("get <id>").description("Get a data pattern by id").option("--output <fmt>", "Output format", "pretty").action(async (id, opts) => {
+  const getCmd = group.command("get <id>").description("Get a data pattern by id").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (id, opts) => {
     try {
       dlpPatterns.renderGet(
         await new SdkDataPatternsService().get(id),
-        opts.output
+        await resolveOutput(getCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -5746,6 +6919,9 @@ var SdkDataProfilesService = class {
   async list(params) {
     return this.client.list(params);
   }
+  async listAll(params) {
+    return this.client.listAll(params);
+  }
   async create(body) {
     return this.client.create(body);
   }
@@ -5766,7 +6942,7 @@ function listFlags3(cmd) {
     "--offset <n>",
     "Starting offset \u2014 rounds down to a page boundary",
     (v) => Number.parseInt(v, 10)
-  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format", "pretty");
+  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml");
   registerPageAliases(cmd, { sizeFlag: "--size", sizeKey: "size" });
   return cmd;
 }
@@ -5800,9 +6976,10 @@ function register5(dlp) {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataProfilesService();
+      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
       dlpProfiles.renderList(
-        await svc.list({ page, size, sort: opts.sort }),
-        opts.output
+        result ? { content: result, totalElements: result.length } : await svc.list({ page, size, sort: opts.sort }),
+        await resolveOutput(listCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -5820,11 +6997,11 @@ function register5(dlp) {
       usageError(err instanceof Error ? err.message : String(err));
     }
   });
-  group.command("get <id>").description("Get a data profile by id").option("--output <fmt>", "Output format", "pretty").action(async (id, opts) => {
+  const getCmd = group.command("get <id>").description("Get a data profile by id").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (id, opts) => {
     try {
       dlpProfiles.renderGet(
         await new SdkDataProfilesService().get(id),
-        opts.output
+        await resolveOutput(getCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -6373,14 +7550,14 @@ function registerSampleCommand(parent) {
 
 // src/cli/commands/runtime.ts
 function renderScanResult(result) {
-  const actionColor = result.action === "block" ? chalk10.red : chalk10.green;
+  const actionColor = result.action === "block" ? chalk11.red : chalk11.green;
   ui.header("Scan Result");
   ui.keyValue([
     ["Action", actionColor(result.action.toUpperCase())],
     ["Category", result.category],
-    ["Triggered", result.triggered ? chalk10.red("yes") : chalk10.green("no")],
-    ["Scan ID", chalk10.dim(result.scanId)],
-    ["Report ID", chalk10.dim(result.reportId)]
+    ["Triggered", result.triggered ? chalk11.red("yes") : chalk11.green("no")],
+    ["Scan ID", chalk11.dim(result.scanId)],
+    ["Report ID", chalk11.dim(result.reportId)]
   ]);
   const flags = Object.entries(result.detections).filter(([, v]) => v);
   if (flags.length > 0) {
@@ -6472,15 +7649,26 @@ async function createMgmtService() {
 function registerRuntimeCommand(program) {
   const runtime = program.command("runtime").description("Runtime prompt scanning against AIRS profiles");
   const apiKeys = runtime.command("api-keys").description("Manage AIRS API keys");
-  apiKeys.command("list").description("List API keys").option("--limit <n>", "Max results", "100").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+  const apiKeysList = registerListFlags(apiKeys.command("list"), { dialect: "offset" }).description("List API keys").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(apiKeysList, opts);
+      const page = resolveListParams(apiKeysList, opts, { dialect: "offset" });
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
+      if (page.all) {
+        const items = await service.listAllApiKeys({ limit: page.limit, max: page.max });
+        emitList(apiKeysView, items, fmt, {
+          page: { returned: items.length, total: items.length, all: true }
+        });
+        return;
+      }
       const result = await service.listApiKeys({
-        limit: Number.parseInt(opts.limit, 10)
+        limit: page.limit,
+        offset: page.offset
+      });
+      emitList(apiKeysView, result.apiKeys, fmt, {
+        page: { returned: result.apiKeys.length, next: result.nextOffset }
       });
-      renderApiKeyList(result.apiKeys, fmt);
     } catch (err) {
       fail(err);
     }
@@ -6649,10 +7837,10 @@ function registerRuntimeCommand(program) {
       ui.header("Bulk Scan Complete");
       ui.keyValue([
         ["Total", results.length],
-        ["Blocked", chalk10.red(String(blocked))],
-        ["Allowed", chalk10.green(String(allowed))],
-        ["Failed", chalk10.red(String(failed))],
-        ["Output", chalk10.cyan(outputPath)]
+        ["Blocked", chalk11.red(String(blocked))],
+        ["Allowed", chalk11.green(String(allowed))],
+        ["Failed", chalk11.red(String(failed))],
+        ["Output", chalk11.cyan(outputPath)]
       ]);
       if (failed > 0) {
         ui.error(`${failed} prompt(s) failed; successful results were preserved.`);
@@ -6667,25 +7855,37 @@ function registerRuntimeCommand(program) {
     }
   });
   const customerApps = runtime.command("customer-apps").description("Manage AIRS customer apps");
-  customerApps.command("list").description("List customer apps").option("--limit <n>", "Max results", "100").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+  const customerAppsList = registerListFlags(customerApps.command("list"), { dialect: "offset" }).description("List customer apps").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(customerAppsList, opts);
+      const page = resolveListParams(customerAppsList, opts, { dialect: "offset" });
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
+      if (page.all) {
+        const items = await service.listAllCustomerApps({ limit: page.limit, max: page.max });
+        emitList(customerAppsView, items, fmt, {
+          page: { returned: items.length, total: items.length, all: true }
+        });
+        return;
+      }
       const result = await service.listCustomerApps({
-        limit: Number.parseInt(opts.limit, 10)
+        limit: page.limit,
+        offset: page.offset
+      });
+      emitList(customerAppsView, result.apps, fmt, {
+        page: { returned: result.apps.length, next: result.nextOffset }
       });
-      renderCustomerAppList(result.apps, fmt);
     } catch (err) {
       fail(err);
     }
   });
-  customerApps.command("get <appName>").description("Get customer app details").action(async (appName) => {
+  const customerAppsGet = customerApps.command("get <appName>").description("Get customer app details").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (appName, opts) => {
     try {
-      renderRuntimeConfigHeader();
+      const fmt = await resolveOutput(customerAppsGet, opts);
+      if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
       const app = await service.getCustomerApp(appName);
-      renderCustomerAppDetail(app);
+      emitDetail(customerAppsView, app, fmt);
     } catch (err) {
       fail(err);
     }
@@ -6767,7 +7967,7 @@ function registerRuntimeCommand(program) {
     }
   });
   const profiles = runtime.command("profiles").description("Manage AIRS security profiles");
-  profiles.command("list").description("List security profiles").option("--limit <n>", "Max results", "100").option("--offset <n>", "Starting offset", "0").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").addHelpText(
+  const profilesList = registerListFlags(profiles.command("list"), { dialect: "offset" }).description("List security profiles").option("--all-versions", "Include every profile revision").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples(
       "airs runtime profiles list",
@@ -6776,49 +7976,55 @@ function registerRuntimeCommand(program) {
     )
   ).action(async (opts) => {
     try {
-      const fmt = opts.output;
-      if (!OUTPUT_FORMATS.includes(fmt)) {
-        usageError(`Invalid output format "${fmt}". Valid: ${OUTPUT_FORMATS.join(", ")}`);
-      }
+      const fmt = await resolveOutput(profilesList, opts);
+      const page = resolveListParams(profilesList, opts, { dialect: "offset" });
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
+      if (page.all) {
+        const items = await service.listAllProfiles({
+          limit: page.limit,
+          latest: !opts.allVersions,
+          max: page.max
+        });
+        emitList(profilesView, items, fmt, {
+          page: { returned: items.length, total: items.length, all: true }
+        });
+        return;
+      }
       const result = await service.listProfiles({
-        limit: Number.parseInt(opts.limit, 10),
-        offset: Number.parseInt(opts.offset, 10)
+        limit: page.limit,
+        offset: page.offset,
+        latest: !opts.allVersions
+      });
+      emitList(profilesView, result.profiles, fmt, {
+        page: {
+          returned: result.profiles.length,
+          next: result.nextOffset
+        }
       });
-      renderProfileList(result.profiles, fmt);
-      if (fmt === "pretty" && result.nextOffset != null) {
-        ui.dim(`Next offset: ${result.nextOffset}`);
-      }
     } catch (err) {
       fail(err);
     }
   });
-  profiles.command("get <nameOrId>").description("Get a security profile by name or UUID").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (nameOrId, opts) => {
+  const profilesGet = profiles.command("get <nameOrId>").description("Get a security profile by name or UUID").option("--revision <n>", "Select an exact revision", Number).option("--all-versions", "Return every matching revision").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (nameOrId, opts) => {
     try {
-      const fmt = opts.output;
-      if (fmt !== "pretty" && fmt !== "json" && fmt !== "yaml") {
-        usageError(`Invalid output format "${fmt}". Valid: pretty, json, yaml`);
-      }
+      const fmt = await resolveOutput(profilesGet, opts);
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
       const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
         nameOrId
       );
-      const profile = isUuid ? await service.getProfile(nameOrId) : await service.getProfileByName(nameOrId);
-      if (fmt === "json") {
-        console.log(JSON.stringify(profile, null, 2));
-      } else if (fmt === "yaml") {
-        const lines = [`profileId: ${profile.profileId}`, `profileName: ${profile.profileName}`];
-        if (profile.revision != null) lines.push(`revision: ${profile.revision}`);
-        if (profile.active != null) lines.push(`active: ${profile.active}`);
-        if (profile.createdBy) lines.push(`createdBy: ${profile.createdBy}`);
-        if (profile.updatedBy) lines.push(`updatedBy: ${profile.updatedBy}`);
-        if (profile.lastModifiedTs) lines.push(`lastModifiedTs: ${profile.lastModifiedTs}`);
-        if (profile.policy) lines.push(`policy: ${JSON.stringify(profile.policy, null, 2)}`);
-        console.log(lines.join("\n"));
+      if (opts.revision !== void 0 || opts.allVersions) {
+        const profiles2 = (await service.listAllProfiles({ latest: false })).filter(
+          (profile) => isUuid ? profile.profileId === nameOrId : profile.profileName === nameOrId
+        );
+        const selected = opts.revision === void 0 ? profiles2 : profiles2.filter((profile) => profile.revision === opts.revision);
+        if (selected.length === 0) throw new Error(`Profile ${nameOrId} not found`);
+        if (opts.allVersions) emitList(profilesView, selected, fmt);
+        else emitDetail(profilesView, selected[0], fmt);
       } else {
-        renderProfileDetail(profile);
+        const profile = isUuid ? await service.getProfile(nameOrId) : await service.getProfileByName(nameOrId);
+        emitDetail(profilesView, profile, fmt);
       }
     } catch (err) {
       fail(err);
@@ -7061,10 +8267,10 @@ function registerRuntimeCommand(program) {
       ui.header("Resume Poll Complete");
       ui.keyValue([
         ["Total", results.length],
-        ["Blocked", chalk10.red(String(blocked))],
-        ["Allowed", chalk10.green(String(allowed))],
-        ["Failed", chalk10.red(String(failed))],
-        ["Output", chalk10.cyan(outputPath)]
+        ["Blocked", chalk11.red(String(blocked))],
+        ["Allowed", chalk11.green(String(allowed))],
+        ["Failed", chalk11.red(String(failed))],
+        ["Output", chalk11.cyan(outputPath)]
       ]);
       if (failed > 0) {
         ui.error(`${failed} prompt(s) failed; successful results were preserved.`);
@@ -7143,52 +8349,47 @@ function registerRuntimeCommand(program) {
     }
   });
   registerEvalCommand(topics);
-  topics.command("get <nameOrId>").description("Get a custom topic by name or UUID").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (nameOrId, opts) => {
+  const topicsGet = topics.command("get <nameOrId>").description("Get a custom topic by name or UUID").option("--revision <n>", "Select an exact revision", Number).option("--all-versions", "Return every matching revision").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (nameOrId, opts) => {
     try {
-      const fmt = opts.output;
-      if (fmt !== "pretty" && fmt !== "json" && fmt !== "yaml") {
-        usageError(`Invalid output format "${fmt}". Valid: pretty, json, yaml`);
-      }
+      const fmt = await resolveOutput(topicsGet, opts);
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
       const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
         nameOrId
       );
-      const topic = isUuid ? await service.getTopic(nameOrId) : await service.getTopicByName(nameOrId);
-      if (fmt === "json") {
-        console.log(JSON.stringify(topic, null, 2));
-      } else if (fmt === "yaml") {
-        const lines = [`topic_id: ${topic.topic_id}`, `topic_name: ${topic.topic_name}`];
-        if (topic.revision != null) lines.push(`revision: ${topic.revision}`);
-        if (topic.description) lines.push(`description: ${topic.description}`);
-        if (topic.examples?.length) {
-          lines.push("examples:");
-          for (const ex of topic.examples) lines.push(`  - ${ex}`);
-        }
-        if (topic.created_by) lines.push(`created_by: ${topic.created_by}`);
-        if (topic.updated_by) lines.push(`updated_by: ${topic.updated_by}`);
-        if (topic.last_modified_ts) lines.push(`last_modified_ts: ${topic.last_modified_ts}`);
-        console.log(lines.join("\n"));
+      if (opts.revision !== void 0 || opts.allVersions) {
+        const topics2 = (await service.listTopics()).filter(
+          (topic) => isUuid ? topic.topic_id === nameOrId : topic.topic_name === nameOrId
+        );
+        const selected = opts.revision === void 0 ? topics2 : topics2.filter((topic) => topic.revision === opts.revision);
+        if (selected.length === 0) throw new Error(`Topic ${nameOrId} not found`);
+        if (opts.allVersions) emitList(topicsView, selected, fmt);
+        else emitDetail(topicsView, selected[0], fmt);
       } else {
-        renderTopicDetail(topic);
+        const topic = isUuid ? await service.getTopic(nameOrId) : await service.getTopicByName(nameOrId);
+        emitDetail(topicsView, topic, fmt);
       }
     } catch (err) {
       fail(err);
     }
   });
-  topics.command("list").description("List custom topics").option("--limit <n>", "Max results", "100").option("--offset <n>", "Starting offset", "0").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+  const topicsList = registerListFlags(topics.command("list"), { dialect: "offset" }).description("List custom topics").option("--all-versions", "Include every topic revision").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(topicsList, opts);
+      const params = resolveListParams(topicsList, opts, { dialect: "offset" });
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
-      const allTopics = await service.listTopics();
-      const offset = Number.parseInt(opts.offset, 10);
-      const limit = Number.parseInt(opts.limit, 10);
-      const page = allTopics.slice(offset, offset + limit);
-      renderTopicList(page, fmt);
-      if (fmt === "pretty" && offset + limit < allTopics.length) {
-        ui.dim(`Showing ${page.length} of ${allTopics.length} topics`);
-      }
+      const allTopics = opts.allVersions ? await service.listTopics() : await service.listLatestTopics(
+        params.all ? { offset: 0, limit: params.max === 0 ? 1e4 : params.max } : { offset: params.offset, limit: params.limit }
+      );
+      const page = opts.allVersions && !params.all ? allTopics.slice(params.offset, params.offset + params.limit) : allTopics;
+      emitList(topicsView, page, fmt, {
+        page: params.all ? { returned: page.length, total: page.length, all: true } : {
+          returned: page.length,
+          total: opts.allVersions ? allTopics.length : void 0,
+          next: opts.allVersions && params.offset + params.limit < allTopics.length ? params.offset + params.limit : void 0
+        }
+      });
     } catch (err) {
       fail(err);
     }
@@ -7397,16 +8598,45 @@ function applyListDeleteAliases(cmd) {
     applyListDeleteAliases(sub);
   }
 }
+function applyReadContractFlags(cmd) {
+  for (const sub of cmd.commands) {
+    const flags = () => sub.options.map((option) => option.long);
+    if ((sub.name() === "list" || sub.name() === "get") && !flags().includes("--output")) {
+      sub.option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml");
+    }
+    if (sub.name() === "list" && (flags().includes("--limit") || flags().includes("--offset"))) {
+      if (!flags().includes("--limit")) sub.option("--limit <n>", "Items per page", Number, 50);
+      if (!flags().includes("--offset")) sub.option("--offset <n>", "Item offset", Number, 0);
+      if (!flags().includes("--all")) sub.option("--all", "Walk all pages");
+      if (!flags().includes("--max")) {
+        sub.option("--max <n>", "Maximum items with --all; 0 removes the cap", Number, 1e4);
+      }
+    }
+    applyReadContractFlags(sub);
+  }
+}
+function applySortedHelp(cmd) {
+  cmd.configureHelp({ sortOptions: true, sortSubcommands: true });
+  for (const sub of cmd.commands) applySortedHelp(sub);
+}
 function buildProgram() {
   const here = dirname4(fileURLToPath(import.meta.url));
   const pkg = JSON.parse(readFileSync4(join4(here, "../../package.json"), "utf-8"));
   const program = new Command();
   program.name("airs").description(
     "CLI and library for Palo Alto Prisma AIRS \u2014 guardrail refinement, AI red teaming, model security scanning, profile audits"
-  ).version(pkg.version).option("--debug", "Log all AIRS/SCM API requests and responses to a JSONL file").option("--quiet", "Suppress status and decorative output (data and errors still print)");
-  program.hook("preAction", (_thisCommand, actionCommand) => {
+  ).version(pkg.version).option("--debug", "Log all AIRS/SCM API requests and responses to a JSONL file").option("--output <format>", "Default output format for read commands").option("--quiet", "Suppress status and decorative output (data and errors still print)");
+  program.hook("preAction", async (_thisCommand, actionCommand) => {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
+    if ((actionCommand.name() === "list" || actionCommand.name() === "get") && actionCommand.options.some((option) => option.long === "--output")) {
+      try {
+        const format = await resolveOutput(actionCommand, actionCommand.opts());
+        actionCommand.setOptionValueWithSource("output", format, "implied");
+      } catch (error) {
+        fail(error);
+      }
+    }
     if (root.debug) {
       const logPath = join4(homedir(), ".prisma-airs", `debug-api-${Date.now()}.jsonl`);
       installDebugLogger(logPath);
@@ -7416,10 +8646,13 @@ function buildProgram() {
   registerRuntimeCommand(program);
   registerRedteamCommand(program);
   registerModelSecurityCommand(program);
+  registerAiGatewayCommand(program);
   registerConfigCommand(program);
   registerDoctorCommand(program);
   registerCompletionCommand(program);
   applyListDeleteAliases(program);
+  applyReadContractFlags(program);
+  applySortedHelp(program);
   return program;
 }