@cdot65/prisma-airs-cli 3.3.0 → 4.0.1

package/dist/cli/index.js

@@ -20,7 +20,7 @@ import {
   sanitizeFilename,
   validateTopic,
   writeBackupFile
-} from "../chunk-2VIUZRPB.js";
+} from "../chunk-W5YDJS7H.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -187,9 +187,15 @@ var SdkAiGatewayService = class {
       workspaceSlug,
       days,
       totalCents: raw.data.total,
+      totalUsd: raw.data.total / 100,
       avgCents: raw.data.avg,
+      avgUsd: raw.data.avg / 100,
       quotaExceeded: raw.data.isQuotaExceeded,
-      records: raw.data.records.map((r) => ({ date: r.x, costCents: r.y }))
+      records: raw.data.records.map((r) => ({
+        date: r.x,
+        costCents: r.y,
+        costUsd: r.y / 100
+      }))
     };
   }
   /** Re-read after a write, falling back to the (partial) write response if the get fails. */
@@ -249,7 +255,11 @@ import { dump as yamlDump } from "js-yaml";
 
 // src/cli/renderer/common.ts
 import chalk2 from "chalk";
+import { dump } from "js-yaml";
+var CliUsageError = class extends Error {
+};
 function fail(err) {
+  if (err instanceof CliUsageError) usageError(err.message);
   const message = err instanceof Error ? err.message : String(err);
   const status = err?.status ?? err?.statusCode;
   console.error(chalk2.red(`
@@ -267,44 +277,90 @@ function usageError(message) {
 `));
   process.exit(2);
 }
-var OUTPUT_FORMATS = ["pretty", "table", "csv", "json", "yaml"];
+var OUTPUT_FORMATS = [
+  "pretty",
+  "table",
+  "markdown",
+  "csv",
+  "json",
+  "yaml"
+];
+async function resolveOutput(command, opts, resolution = {}) {
+  const localIsExplicit = command.getOptionValueSource?.("output") === "cli";
+  let rootCommand = command;
+  while (rootCommand.parent) rootCommand = rootCommand.parent;
+  const globalIsExplicit = rootCommand.getOptionValueSource?.("output") === "cli";
+  const globalOutput = globalIsExplicit ? rootCommand.opts().output : void 0;
+  let configured;
+  try {
+    configured = (await loadConfig()).defaultOutput;
+  } catch (error) {
+    if (process.env.PANW_CLI_OUTPUT !== void 0) configured = process.env.PANW_CLI_OUTPUT;
+    else throw error;
+  }
+  const candidate = String(
+    localIsExplicit ? opts.output : globalOutput ?? configured ?? "pretty"
+  );
+  if (!OUTPUT_FORMATS.includes(candidate))
+    throw new CliUsageError(
+      `Invalid output format '${candidate}'. Expected: ${OUTPUT_FORMATS.join(", ")}`
+    );
+  const format = candidate;
+  const allowed = resolution.allowed ?? OUTPUT_FORMATS;
+  if (!allowed.includes(format))
+    throw new CliUsageError(
+      `Output format '${format}' is not supported here. Expected: ${allowed.join(", ")}`
+    );
+  return format;
+}
+function displayValue(value) {
+  if (value == null) return "";
+  return typeof value === "object" ? JSON.stringify(value) : String(value);
+}
+function csvCell(value) {
+  const text = displayValue(value);
+  return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+function markdownCell(value) {
+  return displayValue(value).replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\r?\n/g, "<br>");
+}
 function formatOutput(rows, columns, format) {
-  if (rows.length === 0) return "";
-  const vals = (row, key) => String(row[key] ?? "");
+  if (rows.length === 0) {
+    if (format === "json") return "[]";
+    if (format === "yaml") return "[]\n";
+    return "";
+  }
+  const projected = rows.map((row) => columns.map((column) => row[column.key]));
   switch (format) {
     case "json":
-      return JSON.stringify(
-        rows.map((r) => {
-          const obj = {};
-          for (const c of columns) obj[c.key] = r[c.key];
-          return obj;
-        }),
-        null,
-        2
-      );
-    case "csv": {
-      const header = columns.map((c) => c.label).join(",");
-      const lines = rows.map(
-        (r) => columns.map((c) => {
-          const v = vals(r, c.key);
-          return v.includes(",") || v.includes('"') ? `"${v.replace(/"/g, '""')}"` : v;
-        }).join(",")
-      );
-      return [header, ...lines].join("\n");
-    }
-    case "yaml": {
-      return rows.map((r) => columns.map((c) => `${c.key}: ${vals(r, c.key)}`).join("\n")).join("\n---\n");
+      return JSON.stringify(rows, null, 2);
+    case "yaml":
+      return dump(rows, { noRefs: true, lineWidth: -1 }).trimEnd();
+    case "csv":
+      return [
+        columns.map((column) => csvCell(column.label)).join(","),
+        ...projected.map((values) => values.map(csvCell).join(","))
+      ].join("\n");
+    case "markdown": {
+      const header = `| ${columns.map((column) => markdownCell(column.label)).join(" | ")} |`;
+      const divider = `| ${columns.map(() => "---").join(" | ")} |`;
+      return [
+        header,
+        divider,
+        ...projected.map((values) => `| ${values.map(markdownCell).join(" | ")} |`)
+      ].join("\n");
     }
     case "table": {
+      const values = projected.map((row) => row.map(displayValue));
       const widths = columns.map(
-        (c) => Math.max(c.label.length, ...rows.map((r) => vals(r, c.key).length))
+        (column, index) => Math.max(column.label.length, ...values.map((row) => row[index].length))
       );
-      const sep = widths.map((w) => "\u2500".repeat(w + 2)).join("\u253C");
-      const header = columns.map((c, i) => ` ${c.label.padEnd(widths[i])} `).join("\u2502");
-      const body = rows.map(
-        (r) => columns.map((c, i) => ` ${vals(r, c.key).padEnd(widths[i])} `).join("\u2502")
+      const separator = widths.map((width) => "\u2500".repeat(width + 2)).join("\u253C");
+      const header = columns.map((column, index) => ` ${column.label.padEnd(widths[index])} `).join("\u2502");
+      const body = values.map(
+        (row) => row.map((value, index) => ` ${value.padEnd(widths[index])} `).join("\u2502")
       );
-      return [header, sep, ...body].join("\n");
+      return [header, separator, ...body].join("\n");
     }
     default:
       return "";
@@ -403,6 +459,65 @@ ${INDENT}${chalk3.bold(label)}
   }
 };
 
+// src/cli/renderer/view.ts
+import { dump as dump2 } from "js-yaml";
+function asRecord(item) {
+  return item;
+}
+function project(view, item) {
+  const source = asRecord(item);
+  return Object.fromEntries(
+    view.columns.map((column) => [column.key, column.get ? column.get(item) : source[column.key]])
+  );
+}
+function renderPageStatus(page) {
+  if (!page) return;
+  if (page.all) ui.status(`Showing all ${page.total ?? page.returned}`);
+  else if (page.total !== void 0)
+    ui.status(
+      `Showing ${page.returned} of ${page.total}${page.next !== void 0 ? ` (next --offset ${page.next})` : ""}`
+    );
+  else if (page.next !== void 0) ui.status(`Showing ${page.returned} (more available)`);
+  else ui.status(`Showing ${page.returned}`);
+}
+function emitList(view, items, format, opts = {}) {
+  if (format === "pretty") {
+    if (items.length === 0) ui.emptyList(view.name);
+    else view.pretty.list(items);
+  } else {
+    const rows = format === "json" || format === "yaml" ? items.map((item) => view.structured?.(item) ?? asRecord(item)) : items.map((item) => project(view, item));
+    const rendered = formatOutput(rows, view.columns, format);
+    if (rendered) console.log(rendered);
+  }
+  renderPageStatus(opts.page);
+}
+function emitDetail(view, item, format) {
+  if (format === "pretty") {
+    view.pretty.detail(item);
+    return;
+  }
+  const structured = view.structured?.(item) ?? asRecord(item);
+  if (format === "json") console.log(JSON.stringify(structured, null, 2));
+  else if (format === "yaml")
+    console.log(dump2(structured, { noRefs: true, lineWidth: -1 }).trimEnd());
+  else {
+    const rows = Object.entries(structured).map(([key, value]) => ({
+      key,
+      value: value != null && typeof value === "object" ? JSON.stringify(value) : value
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "key", label: "Key" },
+          { key: "value", label: "Value" }
+        ],
+        format
+      )
+    );
+  }
+}
+
 // src/cli/renderer/aigateway.ts
 function renderAiGatewayHeader() {
   ui.header("Prisma AIRS \u2014 AI Gateway", "Gateway workspace operations");
@@ -498,7 +613,17 @@ function renderWorkspaceDetail(workspace, format = "pretty") {
 }
 function renderCostReport(report, format = "pretty") {
   if (format !== "pretty") {
-    console.log(format === "json" ? JSON.stringify(report, null, 2) : yamlDump(report));
+    emitDetail(
+      {
+        name: "cost report",
+        columns: [],
+        pretty: { list() {
+        }, detail() {
+        } }
+      },
+      report,
+      format
+    );
     return;
   }
   const dollars = (cents) => `$${(cents / 100).toFixed(2)}`;
@@ -597,60 +722,67 @@ function pageMeta(page, returned) {
     returned
   };
 }
-function emitList(page, fmt, header, toRow, columns, prettyLine) {
-  const content = Array.isArray(page?.content) ? page.content : [];
-  const rows = content.map(toRow);
-  if (fmt === "json" || fmt === "yaml") {
-    emitStructured({ items: rows, page: pageMeta(page, content.length) }, fmt);
-    return;
-  }
-  if (content.length === 0) {
-    ui.emptyList(header.toLowerCase());
-    return;
-  }
-  if (fmt === "pretty") {
-    ui.section(`${header}:`);
-    for (const item of content) console.log(prettyLine(item));
-    const meta = pageMeta(page, content.length);
-    console.log();
-    ui.dim(
-      `page=${meta.number} size=${meta.size} returned=${meta.returned} total=${meta.total ?? "?"}`
-    );
-    console.log();
-    return;
-  }
-  console.log(formatOutput(rows, columns, fmt));
+function camelKey(key) {
+  return key.replace(/[_-]([a-z0-9])/g, (_, char) => char.toUpperCase());
 }
-function fieldsToObject(fields) {
-  const obj = {};
-  for (const f of fields) {
-    if (f.value === void 0 || f.value === null || f.value === "") continue;
-    obj[toKey(f.label)] = f.value;
+function camelize(value) {
+  if (Array.isArray(value)) return value.map(camelize);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, child]) => [
+        camelKey(key),
+        camelize(child)
+      ])
+    );
   }
-  return obj;
-}
-function toKey(label) {
-  return label.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return value;
 }
-function emitDetail(_item, fmt, fields, title) {
-  if (fmt === "json" || fmt === "yaml") {
-    emitStructured(fieldsToObject(fields), fmt);
-    return;
-  }
-  if (fmt === "pretty") {
-    ui.section(`${title}:`);
-    const pairs = [];
-    for (const f of fields) {
-      if (f.value === void 0 || f.value === null || f.value === "") continue;
-      pairs.push([f.label, f.value]);
+function emitList2(page, fmt, header, toRow, columns, prettyLine) {
+  const content = Array.isArray(page?.content) ? page.content : [];
+  const meta = pageMeta(page, content.length);
+  const view = {
+    name: header.toLowerCase(),
+    columns: columns.map((column) => ({
+      ...column,
+      get: (item) => toRow(item)[column.key]
+    })),
+    structured: (item) => camelize(item),
+    pretty: {
+      list(items) {
+        ui.section(`${header}:`);
+        for (const item of items) console.log(prettyLine(item));
+        console.log();
+      },
+      detail() {
+      }
     }
-    ui.keyValue(pairs);
-    console.log();
-    return;
-  }
-  const rows = [Object.fromEntries(fields.map((f) => [f.label, f.value ?? ""]))];
-  const columns = fields.map((f) => ({ key: f.label, label: f.label }));
-  console.log(formatOutput(rows, columns, fmt));
+  };
+  const total = typeof meta.total === "number" ? meta.total : void 0;
+  const number = Number(meta.number ?? 0);
+  const size = Number(meta.size ?? content.length);
+  const next = total !== void 0 && (number + 1) * size < total ? (number + 1) * size : void 0;
+  emitList(view, content, fmt, { page: { returned: content.length, total, next } });
+}
+function emitDetail2(item, fmt, fields, title) {
+  const view = {
+    name: title.toLowerCase(),
+    columns: [],
+    structured: (value) => camelize(value),
+    pretty: {
+      list() {
+      },
+      detail() {
+        ui.section(`${title}:`);
+        ui.keyValue(
+          fields.filter(
+            (field) => field.value !== void 0 && field.value !== null && field.value !== ""
+          ).map((field) => [field.label, field.value])
+        );
+        console.log();
+      }
+    }
+  };
+  emitDetail(view, item, fmt);
 }
 function ackObject(verb, item) {
   const out = { action: verb };
@@ -681,7 +813,7 @@ function emitIdAck(verb, id) {
 }
 var dlpFilteringProfiles = {
   renderList(page, fmt) {
-    emitList(
+    emitList2(
       page,
       fmt,
       "Data Filtering Profiles",
@@ -711,7 +843,7 @@ var dlpFilteringProfiles = {
     );
   },
   renderGet(item, fmt) {
-    emitDetail(
+    emitDetail2(
       item,
       fmt,
       [
@@ -740,7 +872,7 @@ var dlpFilteringProfiles = {
 };
 var dlpPatterns = {
   renderList(page, fmt) {
-    emitList(
+    emitList2(
       page,
       fmt,
       "Data Patterns",
@@ -769,7 +901,7 @@ var dlpPatterns = {
     );
   },
   renderGet(item, fmt) {
-    emitDetail(
+    emitDetail2(
       item,
       fmt,
       [
@@ -808,7 +940,7 @@ var dlpPatterns = {
 };
 var dlpProfiles = {
   renderList(page, fmt) {
-    emitList(
+    emitList2(
       page,
       fmt,
       "Data Profiles",
@@ -837,7 +969,7 @@ var dlpProfiles = {
     );
   },
   renderGet(item, fmt) {
-    emitDetail(
+    emitDetail2(
       item,
       fmt,
       [
@@ -865,7 +997,7 @@ var dlpProfiles = {
 };
 var dlpDictionaries = {
   renderList(page, fmt) {
-    emitList(
+    emitList2(
       page,
       fmt,
       "Data Dictionaries",
@@ -894,7 +1026,7 @@ var dlpDictionaries = {
     );
   },
   renderGet(item, fmt) {
-    emitDetail(
+    emitDetail2(
       item,
       fmt,
       [
@@ -989,7 +1121,15 @@ function renderEvalTerminal(output) {
 
 // src/cli/renderer/modelsecurity.ts
 import chalk7 from "chalk";
-import { dump as yamlDump3 } from "js-yaml";
+function resourceView(name, columns, pretty) {
+  return { name, columns, pretty };
+}
+function structuredList(name, items, columns, format, pretty) {
+  emitList(resourceView(name, columns, { list: pretty, detail: () => void 0 }), items, format);
+}
+function structuredDetail(name, item, format, pretty) {
+  emitDetail(resourceView(name, [], { list: () => void 0, detail: pretty }), item, format);
+}
 function renderModelSecurityHeader() {
   ui.header("Prisma AIRS \u2014 Model Security", "ML model supply chain security");
 }
@@ -1012,31 +1152,25 @@ function stateColor(state) {
   }
 }
 function renderGroupList(groups, format = "pretty") {
-  if (groups.length === 0) {
-    ui.emptyList("security groups");
-    return;
-  }
   if (format !== "pretty") {
-    const rows = groups.map((g) => ({
-      id: g.uuid,
-      name: g.name,
-      state: g.state,
-      sourceType: g.sourceType
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "name", label: "Name" },
-          { key: "state", label: "State" },
-          { key: "sourceType", label: "Source Type" }
-        ],
-        format
-      )
+    structuredList(
+      "security groups",
+      groups,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "name", label: "Name" },
+        { key: "state", label: "State" },
+        { key: "sourceType", label: "Source Type" }
+      ],
+      format,
+      () => void 0
     );
     return;
   }
+  if (groups.length === 0) {
+    ui.emptyList("security groups");
+    return;
+  }
   ui.section("Security Groups:");
   for (const g of groups) {
     ui.dim(g.uuid);
@@ -1046,12 +1180,8 @@ function renderGroupList(groups, format = "pretty") {
   console.log();
 }
 function renderGroupDetail(group, format = "pretty") {
-  if (format === "json") {
-    console.log(JSON.stringify(group, null, 2));
-    return;
-  }
-  if (format === "yaml") {
-    console.log(yamlDump3(group));
+  if (format !== "pretty") {
+    structuredDetail("security group", group, format, () => void 0);
     return;
   }
   ui.section("Security Group Detail:");
@@ -1068,33 +1198,30 @@ function renderGroupDetail(group, format = "pretty") {
   console.log();
 }
 function renderRuleList(rules, format = "pretty") {
-  if (rules.length === 0) {
-    ui.emptyList("security rules");
-    return;
-  }
   if (format !== "pretty") {
-    const rows = rules.map((r) => ({
-      id: r.uuid,
-      name: r.name,
-      type: r.ruleType,
-      defaultState: r.defaultState,
-      sources: r.compatibleSources.join(", ")
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "name", label: "Name" },
-          { key: "type", label: "Type" },
-          { key: "defaultState", label: "Default State" },
-          { key: "sources", label: "Sources" }
-        ],
-        format
-      )
+    structuredList(
+      "security rules",
+      rules,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "name", label: "Name" },
+        { key: "ruleType", label: "Type" },
+        { key: "defaultState", label: "Default State" },
+        {
+          key: "compatibleSources",
+          label: "Sources",
+          get: (rule) => rule.compatibleSources.join(", ")
+        }
+      ],
+      format,
+      () => void 0
     );
     return;
   }
+  if (rules.length === 0) {
+    ui.emptyList("security rules");
+    return;
+  }
   ui.section("Security Rules:");
   for (const r of rules) {
     ui.dim(r.uuid);
@@ -1106,7 +1233,11 @@ function renderRuleList(rules, format = "pretty") {
   }
   console.log();
 }
-function renderRuleDetail(rule) {
+function renderRuleDetail(rule, format = "pretty") {
+  if (format !== "pretty") {
+    structuredDetail("security rule", rule, format, () => void 0);
+    return;
+  }
   ui.section("Security Rule Detail:");
   ui.keyValue([
     ["UUID", rule.uuid],
@@ -1137,7 +1268,21 @@ function renderRuleDetail(rule) {
   }
   console.log();
 }
-function renderRuleInstanceList(instances) {
+function renderRuleInstanceList(instances, format = "pretty") {
+  if (format !== "pretty") {
+    structuredList(
+      "rule instances",
+      instances,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "securityRuleUuid", label: "Rule ID" },
+        { key: "state", label: "State" }
+      ],
+      format,
+      () => void 0
+    );
+    return;
+  }
   if (instances.length === 0) {
     ui.emptyList("rule instances");
     return;
@@ -1150,7 +1295,11 @@ function renderRuleInstanceList(instances) {
   }
   console.log();
 }
-function renderRuleInstanceDetail(instance) {
+function renderRuleInstanceDetail(instance, format = "pretty") {
+  if (format !== "pretty") {
+    structuredDetail("rule instance", instance, format, () => void 0);
+    return;
+  }
   ui.section("Rule Instance Detail:");
   const pairs = [
     ["UUID", instance.uuid],
@@ -1175,37 +1324,26 @@ function renderRuleInstanceDetail(instance) {
   console.log();
 }
 function renderMsScanList(scans, format = "pretty") {
-  if (scans.length === 0) {
-    ui.emptyList("scans");
-    return;
-  }
   if (format !== "pretty") {
-    const rows = scans.map((s) => ({
-      id: s.uuid,
-      outcome: s.evalOutcome,
-      origin: s.scanOrigin,
-      modelUri: s.modelUri ?? "",
-      createdAt: s.createdAt,
-      passed: s.evalSummary?.rulesPassed ?? "",
-      failed: s.evalSummary?.rulesFailed ?? ""
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "outcome", label: "Outcome" },
-          { key: "origin", label: "Origin" },
-          { key: "modelUri", label: "Model URI" },
-          { key: "passed", label: "Passed" },
-          { key: "failed", label: "Failed" },
-          { key: "createdAt", label: "Created" }
-        ],
-        format
-      )
+    structuredList(
+      "scans",
+      scans,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "evalOutcome", label: "Outcome" },
+        { key: "scanOrigin", label: "Origin" },
+        { key: "modelUri", label: "Model URI" },
+        { key: "createdAt", label: "Created" }
+      ],
+      format,
+      () => void 0
     );
     return;
   }
+  if (scans.length === 0) {
+    ui.emptyList("scans");
+    return;
+  }
   ui.section("Model Security Scans:");
   for (const s of scans) {
     ui.dim(s.uuid);
@@ -1222,7 +1360,11 @@ function renderMsScanList(scans, format = "pretty") {
   }
   console.log();
 }
-function renderMsScanDetail(scan) {
+function renderMsScanDetail(scan, format = "pretty") {
+  if (format !== "pretty") {
+    structuredDetail("scan", scan, format, () => void 0);
+    return;
+  }
   ui.section("Scan Detail:");
   const pairs = [
     ["UUID", scan.uuid],
@@ -1248,7 +1390,22 @@ function renderMsScanDetail(scan) {
   }
   console.log();
 }
-function renderEvaluationList(evaluations) {
+function renderEvaluationList(evaluations, format = "pretty") {
+  if (format !== "pretty") {
+    structuredList(
+      "evaluations",
+      evaluations,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "ruleName", label: "Rule" },
+        { key: "result", label: "Result" },
+        { key: "ruleInstanceState", label: "State" }
+      ],
+      format,
+      () => void 0
+    );
+    return;
+  }
   if (evaluations.length === 0) {
     ui.emptyList("evaluations");
     return;
@@ -1262,7 +1419,11 @@ function renderEvaluationList(evaluations) {
   }
   console.log();
 }
-function renderEvaluationDetail(evaluation) {
+function renderEvaluationDetail(evaluation, format = "pretty") {
+  if (format !== "pretty") {
+    structuredDetail("evaluation", evaluation, format, () => void 0);
+    return;
+  }
   ui.section("Evaluation Detail:");
   ui.keyValue([
     ["UUID", evaluation.uuid],
@@ -1275,7 +1436,22 @@ function renderEvaluationDetail(evaluation) {
   ]);
   console.log();
 }
-function renderViolationList(violations) {
+function renderViolationList(violations, format = "pretty") {
+  if (format !== "pretty") {
+    structuredList(
+      "violations",
+      violations,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "ruleName", label: "Rule" },
+        { key: "file", label: "File" },
+        { key: "threat", label: "Threat" }
+      ],
+      format,
+      () => void 0
+    );
+    return;
+  }
   if (violations.length === 0) {
     ui.emptyList("violations");
     return;
@@ -1289,7 +1465,11 @@ function renderViolationList(violations) {
   }
   console.log();
 }
-function renderViolationDetail(violation) {
+function renderViolationDetail(violation, format = "pretty") {
+  if (format !== "pretty") {
+    structuredDetail("violation", violation, format, () => void 0);
+    return;
+  }
   ui.section("Violation Detail:");
   ui.keyValue([
     ["UUID", violation.uuid],
@@ -1302,7 +1482,22 @@ function renderViolationDetail(violation) {
   ]);
   console.log();
 }
-function renderFileList(files) {
+function renderFileList(files, format = "pretty") {
+  if (format !== "pretty") {
+    structuredList(
+      "files",
+      files,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "path", label: "Path" },
+        { key: "type", label: "Type" },
+        { key: "result", label: "Result" }
+      ],
+      format,
+      () => void 0
+    );
+    return;
+  }
   if (files.length === 0) {
     ui.emptyList("files");
     return;
@@ -1338,33 +1533,30 @@ function renderLabelValues(key, values) {
   console.log();
 }
 function renderModelList(models, format = "pretty") {
-  if (models.length === 0) {
-    ui.emptyList("models");
-    return;
-  }
   if (format !== "pretty") {
-    const rows = models.map((m) => ({
-      id: m.uuid,
-      name: m.name,
-      outcome: m.latestVersionOutcome ?? "",
-      formats: (m.latestVersionFormats ?? []).join(", "),
-      scanned: m.latestVersionScanTime ?? ""
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "name", label: "Name" },
-          { key: "outcome", label: "Outcome" },
-          { key: "formats", label: "Formats" },
-          { key: "scanned", label: "Last Scan" }
-        ],
-        format
-      )
+    structuredList(
+      "models",
+      models,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "name", label: "Name" },
+        { key: "latestVersionOutcome", label: "Outcome" },
+        {
+          key: "latestVersionFormats",
+          label: "Formats",
+          get: (model) => (model.latestVersionFormats ?? []).join(", ")
+        },
+        { key: "latestVersionScanTime", label: "Last Scan" }
+      ],
+      format,
+      () => void 0
     );
     return;
   }
+  if (models.length === 0) {
+    ui.emptyList("models");
+    return;
+  }
   ui.section("Models:");
   for (const m of models) {
     ui.dim(m.uuid);
@@ -1376,7 +1568,7 @@ function renderModelList(models, format = "pretty") {
 }
 function renderModelDetail(model, format = "pretty") {
   if (format !== "pretty") {
-    console.log(format === "json" ? JSON.stringify(model, null, 2) : yamlDump3(model));
+    structuredDetail("model", model, format, () => void 0);
     return;
   }
   ui.section("Model Detail:");
@@ -1403,33 +1595,26 @@ function renderModelDetail(model, format = "pretty") {
   console.log();
 }
 function renderModelVersionList(versions, format = "pretty") {
-  if (versions.length === 0) {
-    ui.emptyList("versions");
-    return;
-  }
   if (format !== "pretty") {
-    const rows = versions.map((v) => ({
-      id: v.uuid,
-      revision: v.revision,
-      files: v.fileCount ?? "",
-      outcome: v.lastEvalOutcome ?? "",
-      scanned: v.latestScanTime ?? ""
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "revision", label: "Revision" },
-          { key: "files", label: "Files" },
-          { key: "outcome", label: "Outcome" },
-          { key: "scanned", label: "Last Scan" }
-        ],
-        format
-      )
+    structuredList(
+      "versions",
+      versions,
+      [
+        { key: "uuid", label: "ID" },
+        { key: "revision", label: "Revision" },
+        { key: "fileCount", label: "Files" },
+        { key: "lastEvalOutcome", label: "Outcome" },
+        { key: "latestScanTime", label: "Last Scan" }
+      ],
+      format,
+      () => void 0
     );
     return;
   }
+  if (versions.length === 0) {
+    ui.emptyList("versions");
+    return;
+  }
   ui.section("Model Versions:");
   for (const v of versions) {
     ui.dim(v.uuid);
@@ -1441,7 +1626,7 @@ function renderModelVersionList(versions, format = "pretty") {
 }
 function renderModelVersionDetail(version, format = "pretty") {
   if (format !== "pretty") {
-    console.log(format === "json" ? JSON.stringify(version, null, 2) : yamlDump3(version));
+    structuredDetail("model version", version, format, () => void 0);
     return;
   }
   ui.section("Model Version Detail:");
@@ -1473,31 +1658,12 @@ function renderModelVersionDetail(version, format = "pretty") {
   console.log();
 }
 function renderModelFileList(files, format = "pretty") {
-  if (files.length === 0) {
-    ui.emptyList("files");
+  if (format !== "pretty") {
+    renderFileList(files, format);
     return;
   }
-  if (format !== "pretty") {
-    const rows = files.map((f) => ({
-      id: f.uuid,
-      path: f.path,
-      type: f.type,
-      formats: f.formats.join(", "),
-      result: f.result
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "id", label: "ID" },
-          { key: "path", label: "Path" },
-          { key: "type", label: "Type" },
-          { key: "formats", label: "Formats" },
-          { key: "result", label: "Result" }
-        ],
-        format
-      )
-    );
+  if (files.length === 0) {
+    ui.emptyList("files");
     return;
   }
   renderFileList(files);
@@ -1505,7 +1671,7 @@ function renderModelFileList(files, format = "pretty") {
 
 // src/cli/renderer/redteam.ts
 import chalk8 from "chalk";
-import { dump as yamlDump4 } from "js-yaml";
+import { dump as yamlDump3 } from "js-yaml";
 function renderRedteamHeader() {
   ui.header("Prisma AIRS \u2014 AI Red Team", "Adversarial scan operations");
 }
@@ -1825,7 +1991,7 @@ function renderTargetDetail(target, format = "pretty") {
     if (format === "json") {
       console.log(JSON.stringify(target, null, 2));
     } else if (format === "yaml") {
-      console.log(yamlDump4(target));
+      console.log(yamlDump3(target));
     }
     return;
   }
@@ -1857,7 +2023,7 @@ function renderPromptSetDetail(ps, format = "pretty", info) {
     if (format === "json") {
       console.log(JSON.stringify(payload, null, 2));
     } else if (format === "yaml") {
-      console.log(yamlDump4(payload));
+      console.log(yamlDump3(payload));
     }
     return;
   }
@@ -1894,7 +2060,7 @@ function renderPromptList(prompts, format = "pretty") {
     if (format === "json") {
       console.log(JSON.stringify(prompts, null, 2));
     } else if (format === "yaml") {
-      console.log(yamlDump4(prompts));
+      console.log(yamlDump3(prompts));
     }
     return;
   }
@@ -1917,7 +2083,7 @@ function renderPromptDetail(p, format = "pretty") {
     if (format === "json") {
       console.log(JSON.stringify(p, null, 2));
     } else if (format === "yaml") {
-      console.log(yamlDump4(p));
+      console.log(yamlDump3(p));
     }
     return;
   }
@@ -1937,7 +2103,7 @@ function renderPropertyNames(names, format = "pretty") {
     if (format === "json") {
       console.log(JSON.stringify(names, null, 2));
     } else if (format === "yaml") {
-      console.log(yamlDump4(names));
+      console.log(yamlDump3(names));
     } else {
       const rows = names.map((n) => ({ name: n }));
       console.log(formatOutput(rows, [{ key: "name", label: "Name" }], format));
@@ -1992,7 +2158,7 @@ function renderPropertyValues(payload, format = "pretty") {
     if (format === "json") {
       console.log(JSON.stringify(payload, null, 2));
     } else if (format === "yaml") {
-      console.log(yamlDump4(payload));
+      console.log(yamlDump3(payload));
     }
     return;
   }
@@ -2023,7 +2189,7 @@ function renderInstanceDetail(inst, format = "pretty") {
     if (format === "json") {
       console.log(JSON.stringify(inst, null, 2));
     } else if (format === "yaml") {
-      console.log(yamlDump4(inst));
+      console.log(yamlDump3(inst));
     }
     return;
   }
@@ -2041,7 +2207,7 @@ function renderRegistryCredentials(creds, format = "pretty") {
     if (format === "json") {
       console.log(JSON.stringify(creds, null, 2));
     } else if (format === "yaml") {
-      console.log(yamlDump4(creds));
+      console.log(yamlDump3(creds));
     }
     return;
   }
@@ -2103,7 +2269,7 @@ function renderChannelList(channels, format = "pretty") {
 }
 function renderChannelDetail(channel, format = "pretty") {
   if (format !== "pretty") {
-    console.log(format === "json" ? JSON.stringify(channel, null, 2) : yamlDump4(channel));
+    console.log(format === "json" ? JSON.stringify(channel, null, 2) : yamlDump3(channel));
     return;
   }
   ui.section("Channel Detail:");
@@ -2129,7 +2295,7 @@ function renderChannelDetail(channel, format = "pretty") {
 }
 function renderChannelStats(stats, format = "pretty") {
   if (format !== "pretty") {
-    console.log(format === "json" ? JSON.stringify(stats, null, 2) : yamlDump4(stats));
+    console.log(format === "json" ? JSON.stringify(stats, null, 2) : yamlDump3(stats));
     return;
   }
   ui.section("Network Broker Stats:");
@@ -2147,7 +2313,7 @@ function renderChannelStats(stats, format = "pretty") {
 function renderLanguages(data, format = "pretty") {
   if (format !== "pretty") {
     if (format === "json" || format === "yaml") {
-      console.log(format === "json" ? JSON.stringify(data, null, 2) : yamlDump4(data));
+      console.log(format === "json" ? JSON.stringify(data, null, 2) : yamlDump3(data));
       return;
     }
     console.log(
@@ -2256,7 +2422,7 @@ function renderAdapterList(adapters, format = "pretty", totalItems) {
 }
 function renderAdapterDetail(adapter, format = "pretty") {
   if (format !== "pretty") {
-    console.log(format === "json" ? JSON.stringify(adapter, null, 2) : yamlDump4(adapter));
+    console.log(format === "json" ? JSON.stringify(adapter, null, 2) : yamlDump3(adapter));
     return;
   }
   ui.section("Adapter Detail:");
@@ -2289,7 +2455,7 @@ function renderAdapterDetail(adapter, format = "pretty") {
 }
 function renderAdapterValidation(result, format = "pretty") {
   if (format !== "pretty") {
-    console.log(format === "json" ? JSON.stringify(result, null, 2) : yamlDump4(result));
+    console.log(format === "json" ? JSON.stringify(result, null, 2) : yamlDump3(result));
     return;
   }
   if (result.validated) {
@@ -2723,7 +2889,8 @@ function renderDeploymentProfileList(profiles, format = "pretty") {
 }
 function renderScanLogList(results, pageToken, format = "pretty") {
   if (results.length === 0) {
-    ui.emptyList("scan logs");
+    if (format === "pretty") ui.emptyList("scan logs");
+    else console.log(formatOutput([], [], format));
     return;
   }
   if (format !== "pretty") {
@@ -2856,7 +3023,7 @@ function scopeNameLooksUnrelated(name, scopeName) {
 function registerAiGatewayCommand(program) {
   const aigateway = program.command("aigateway").description("AI Gateway operations");
   const workspace = aigateway.command("workspace").description("Manage AI Gateway workspaces");
-  workspace.command("list").description("List workspaces (default: active workspaces you are scoped to)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--status <status>", "Filter by lifecycle state: active or archived").option("--all", "Merge active + archived admin-plane reads (whole tenant, both states)").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").addHelpText(
+  const workspaceList = workspace.command("list").description("List workspaces (default: active workspaces you are scoped to)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--status <status>", "Filter by lifecycle state: active or archived").option("--all", "Merge active + archived admin-plane reads (whole tenant, both states)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples(
       "airs aigateway workspace list",
@@ -2866,7 +3033,7 @@ function registerAiGatewayCommand(program) {
     )
   ).action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(workspaceList, opts);
       if (fmt === "pretty") renderAiGatewayHeader();
       const plane = parsePlane(opts.plane);
       const status = parseStatus(opts.status);
@@ -2887,7 +3054,7 @@ function registerAiGatewayCommand(program) {
       failWithGrantHint(err);
     }
   });
-  workspace.command("get <ref>").description("Get one workspace by UUID or slug (includes settings blocks)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--output <format>", "Output format: pretty, json, yaml", "pretty").addHelpText(
+  const workspaceGet = workspace.command("get <ref>").description("Get one workspace by UUID or slug (includes settings blocks)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples(
       "airs aigateway workspace get ws-main-a-349e0e",
@@ -2895,7 +3062,7 @@ function registerAiGatewayCommand(program) {
     )
   ).action(async (ref, opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(workspaceGet, opts);
       if (fmt === "pretty") renderAiGatewayHeader();
       const plane = parsePlane(opts.plane);
       const service = await createService();
@@ -2980,9 +3147,9 @@ function registerAiGatewayCommand(program) {
     }
   });
   const telemetry = aigateway.command("telemetry").description("AI Gateway runtime telemetry (data plane)");
-  telemetry.command("cost").description(
+  const cost = telemetry.command("cost").description(
     "Total and per-day spend for a workspace (API reports cents; pretty output shows dollars)"
-  ).requiredOption("--workspace <slug>", "Workspace slug (not UUID), e.g. ws-main-a-349e0e").option("--days <n>", "Rolling window in days, counted back from now", "7").option("--output <format>", "Output format: pretty, json, yaml", "pretty").addHelpText(
+  ).requiredOption("--workspace <slug>", "Workspace slug (not UUID), e.g. ws-main-a-349e0e").option("--days <n>", "Rolling window in days, counted back from now", "7").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples(
       "airs aigateway telemetry cost --workspace ws-main-a-349e0e",
@@ -2990,7 +3157,7 @@ function registerAiGatewayCommand(program) {
     )
   ).action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(cost, opts);
       if (fmt === "pretty") renderAiGatewayHeader();
       const days = Number.parseInt(opts.days, 10);
       if (!Number.isFinite(days) || days <= 0) {
@@ -3194,13 +3361,6 @@ function assertKnownKey(key) {
     usageError(`Unknown config key '${key}'. Valid keys: ${CONFIG_KEYS.join(", ")}`);
   }
 }
-var LIST_FORMATS = ["pretty", "json", "yaml"];
-function parseListFormat(value) {
-  if (!LIST_FORMATS.includes(value)) {
-    usageError(`Invalid --output '${value}'. Valid formats: ${LIST_FORMATS.join(", ")}`);
-  }
-  return value;
-}
 var COLUMNS = [
   { key: "key", label: "Key" },
   { key: "value", label: "Value" },
@@ -3215,9 +3375,9 @@ function registerConfigCommand(program) {
       "airs config get mgmtTsgId"
     )
   );
-  config.command("list").description("Show effective configuration with per-key source (env/file/default)").option("--output <format>", "Output format: pretty, json, or yaml", "pretty").option("--reveal", "Show secret values in full").action(async (opts) => {
+  const configList = config.command("list").description("Show effective configuration with per-key source (env/file/default)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").option("--reveal", "Show secret values in full").action(async (opts) => {
     try {
-      const fmt = parseListFormat(opts.output);
+      const fmt = await resolveOutput(configList, opts);
       const filePath = resolveConfigFilePath();
       const rows = buildConfigRows(await inspectConfig(), Boolean(opts.reveal));
       if (fmt === "pretty") {
@@ -3232,12 +3392,18 @@ function registerConfigCommand(program) {
       fail(err);
     }
   });
-  config.command("get <key>").description("Print a single effective config value").option("--reveal", "Show the real value of a secret key").action(async (key, opts) => {
+  const configGet = config.command("get <key>").description("Print a single effective config value").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").option("--reveal", "Show the real value of a secret key").action(async (key, opts) => {
     try {
       assertKnownKey(key);
       const inspected = await inspectConfig();
       const entry = inspected[key];
       const raw = entry.value == null ? "" : String(entry.value);
+      const fmt = await resolveOutput(configGet, opts);
+      const value = raw !== "" && isSecretKey(key) && !opts.reveal ? maskSecret(raw) : raw;
+      if (fmt !== "pretty") {
+        console.log(formatOutput([{ key, value, source: entry.source }], COLUMNS, fmt));
+        return;
+      }
       if (raw !== "" && isSecretKey(key)) {
         if (opts.reveal) {
           ui.status(`Warning: printing secret value for '${key}'`);
@@ -3590,20 +3756,6 @@ var STATUS_KIND = {
   warn: "warn",
   fail: "error"
 };
-var DOCTOR_FORMATS = ["pretty", "json", "yaml"];
-function parseDoctorFormat(value) {
-  if (!DOCTOR_FORMATS.includes(value)) {
-    usageError(`Invalid --output '${value}'. Valid formats: ${DOCTOR_FORMATS.join(", ")}`);
-  }
-  return value;
-}
-function toYaml(checks) {
-  return checks.map((c) => {
-    const lines = [`name: ${c.name}`, `status: ${c.status}`, `detail: ${c.detail}`];
-    if (c.hint) lines.push(`hint: ${c.hint}`);
-    return lines.join("\n");
-  }).join("\n---\n");
-}
 function renderPretty(checks) {
   ui.header("Doctor", "Prisma AIRS CLI preflight checks");
   for (const check of checks) {
@@ -3623,18 +3775,27 @@ function renderPretty(checks) {
   console.log("");
 }
 function registerDoctorCommand(program) {
-  program.command("doctor").description("Check credentials, config, and API connectivity (preflight)").option("--output <format>", "Output format: pretty, json, or yaml", "pretty").addHelpText(
+  const doctor = program.command("doctor").description("Check credentials, config, and API connectivity (preflight)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples("airs doctor", `airs doctor --output json | jq '.[] | select(.status != "pass")'`)
   ).action(async (opts) => {
-    const fmt = parseDoctorFormat(opts.output);
+    const fmt = await resolveOutput(doctor, opts);
     const checks = await runDoctor();
-    if (fmt === "json") {
-      console.log(JSON.stringify(checks, null, 2));
-    } else if (fmt === "yaml") {
-      console.log(toYaml(checks));
-    } else {
+    if (fmt === "pretty") {
       renderPretty(checks);
+    } else {
+      console.log(
+        formatOutput(
+          checks.map((check) => ({ ...check })),
+          [
+            { key: "name", label: "Name" },
+            { key: "status", label: "Status" },
+            { key: "detail", label: "Detail" },
+            { key: "hint", label: "Hint" }
+          ],
+          fmt
+        )
+      );
     }
     process.exit(hasFailure(checks) ? 1 : 0);
   });
@@ -3669,27 +3830,29 @@ async function createService2() {
 function registerModelSecurityCommand(program) {
   const ms = program.command("model-security").description("AI Model Security operations \u2014 groups, rules, scans");
   const groups = ms.command("groups").description("Manage security groups");
-  groups.command("list").description("List security groups").option("--source-types <types>", "Filter by source types (comma-separated)").option("--search <query>", "Search by name or UUID").option("--sort-field <field>", "Sort field (created_at, updated_at)").option("--sort-dir <dir>", "Sort direction (asc, desc)").option("--enabled-rules <uuids>", "Filter by enabled rule UUIDs (comma-separated)").option("--limit <n>", "Max results", "20").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+  const groupsList = groups.command("list").description("List security groups").option("--source-types <types>", "Filter by source types (comma-separated)").option("--search <query>", "Search by name or UUID").option("--sort-field <field>", "Sort field (created_at, updated_at)").option("--sort-dir <dir>", "Sort direction (asc, desc)").option("--enabled-rules <uuids>", "Filter by enabled rule UUIDs (comma-separated)").option("--limit <n>", "Max results", "20").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(groupsList, opts);
       if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
-      const result = await service.listGroups({
+      const listOptions = {
         sourceTypes: opts.sourceTypes ? opts.sourceTypes.split(",").map((s) => s.trim()) : void 0,
         searchQuery: opts.search,
         sortField: opts.sortField,
         sortDir: opts.sortDir,
         enabledRules: opts.enabledRules ? opts.enabledRules.split(",").map((s) => s.trim()) : void 0,
-        limit: Number.parseInt(opts.limit, 10)
-      });
-      renderGroupList(result.groups, fmt);
+        limit: Number.parseInt(opts.limit, 10),
+        skip: Number(opts.offset ?? 0)
+      };
+      const rows = opts.all ? await service.listAllGroups({ ...listOptions, max: Number(opts.max) }) : (await service.listGroups(listOptions)).groups;
+      renderGroupList(rows, fmt);
     } catch (err) {
       fail(err);
     }
   });
-  groups.command("get <uuid>").description("Get security group details").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (uuid, opts) => {
+  const groupsGet = groups.command("get <uuid>").description("Get security group details").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (uuid, opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(groupsGet, opts);
       if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
       const group = await service.getGroup(uuid);
@@ -3877,24 +4040,26 @@ function registerModelSecurityCommand(program) {
   const ruleInstances = ms.command("rule-instances").description("Manage rule instances in groups");
   ruleInstances.command("list <groupUuid>").description("List rule instances in a security group").option("--security-rule-uuid <uuid>", "Filter by security rule UUID").option("--state <state>", "Filter by state (DISABLED, ALLOWING, BLOCKING)").option("--limit <n>", "Max results", "20").action(async (groupUuid, opts) => {
     try {
-      renderModelSecurityHeader();
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
       const result = await service.listRuleInstances(groupUuid, {
         securityRuleUuid: opts.securityRuleUuid,
         state: opts.state,
         limit: Number.parseInt(opts.limit, 10)
       });
-      renderRuleInstanceList(result.ruleInstances);
+      renderRuleInstanceList(result.ruleInstances, fmt);
     } catch (err) {
       fail(err);
     }
   });
-  ruleInstances.command("get <groupUuid> <instanceUuid>").description("Get rule instance details").action(async (groupUuid, instanceUuid) => {
+  ruleInstances.command("get <groupUuid> <instanceUuid>").description("Get rule instance details").action(async (groupUuid, instanceUuid, opts) => {
     try {
-      renderModelSecurityHeader();
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
       const instance = await service.getRuleInstance(groupUuid, instanceUuid);
-      renderRuleInstanceDetail(instance);
+      renderRuleInstanceDetail(instance, fmt);
     } catch (err) {
       fail(err);
     }
@@ -3915,33 +4080,36 @@ function registerModelSecurityCommand(program) {
     }
   });
   const rules = ms.command("rules").description("Browse security rules");
-  rules.command("list").description("List available security rules").option("--source-type <type>", "Filter by source type").option("--search <query>", "Search by name or UUID").option("--limit <n>", "Max results", "20").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+  const rulesList = rules.command("list").description("List available security rules").option("--source-type <type>", "Filter by source type").option("--search <query>", "Search by name or UUID").option("--limit <n>", "Max results", "20").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(rulesList, opts);
       if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
-      const result = await service.listRules({
+      const listOptions = {
         sourceType: opts.sourceType,
         searchQuery: opts.search,
-        limit: Number.parseInt(opts.limit, 10)
-      });
-      renderRuleList(result.rules, fmt);
+        limit: Number.parseInt(opts.limit, 10),
+        skip: Number(opts.offset ?? 0)
+      };
+      const rows = opts.all ? await service.listAllRules({ ...listOptions, max: Number(opts.max) }) : (await service.listRules(listOptions)).rules;
+      renderRuleList(rows, fmt);
     } catch (err) {
       fail(err);
     }
   });
-  rules.command("get <uuid>").description("Get security rule details").action(async (uuid) => {
+  rules.command("get <uuid>").description("Get security rule details").action(async (uuid, opts) => {
     try {
-      renderModelSecurityHeader();
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
       const rule = await service.getRule(uuid);
-      renderRuleDetail(rule);
+      renderRuleDetail(rule, fmt);
     } catch (err) {
       fail(err);
     }
   });
   const scans = ms.command("scans").description("Model security scan operations");
-  scans.command("list").description("List model security scans").option("--eval-outcome <outcome>", "Filter by eval outcome").option("--source-type <type>", "Filter by source type").option("--scan-origin <origin>", "Filter by scan origin").option("--search <query>", "Search scans").option("--limit <n>", "Max results", "20").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").addHelpText(
+  const scansList = scans.command("list").description("List model security scans").option("--eval-outcome <outcome>", "Filter by eval outcome").option("--source-type <type>", "Filter by source type").option("--scan-origin <origin>", "Filter by scan origin").option("--search <query>", "Search scans").option("--limit <n>", "Max results", "20").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples(
       "airs model-security scans list",
@@ -3950,27 +4118,30 @@ function registerModelSecurityCommand(program) {
     )
   ).action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(scansList, opts);
       if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
-      const result = await service.listScans({
+      const listOptions = {
         evalOutcome: opts.evalOutcome,
         sourceType: opts.sourceType,
         scanOrigin: opts.scanOrigin,
         search: opts.search,
-        limit: Number.parseInt(opts.limit, 10)
-      });
-      renderMsScanList(result.scans, fmt);
+        limit: Number.parseInt(opts.limit, 10),
+        skip: Number(opts.offset ?? 0)
+      };
+      const rows = opts.all ? await service.listAllScans({ ...listOptions, max: Number(opts.max) }) : (await service.listScans(listOptions)).scans;
+      renderMsScanList(rows, fmt);
     } catch (err) {
       fail(err);
     }
   });
-  scans.command("get <uuid>").description("Get scan details").action(async (uuid) => {
+  scans.command("get <uuid>").description("Get scan details").action(async (uuid, opts) => {
     try {
-      renderModelSecurityHeader();
+      const fmt = opts.output;
+      if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
       const scan = await service.getScan(uuid);
-      renderMsScanDetail(scan);
+      renderMsScanDetail(scan, fmt);
     } catch (err) {
       fail(err);
     }
@@ -4046,27 +4217,28 @@ function registerModelSecurityCommand(program) {
     }
   });
   const models = ms.command("models").description("Browse the scanned model catalog (read-only)");
-  models.command("list").description("List models in the catalog").option("--search <text>", "Filter by search text").option("--search-query <text>", "Filter by model UUID or name").option("--sort-field <field>", "Sort field: created_at, updated_at").option("--sort-order <order>", "Sort order: asc, desc").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").addHelpText("after", examples("airs model-security models list")).action(async (opts) => {
+  const modelsList = models.command("list").description("List models in the catalog").option("--search <text>", "Filter by search text").option("--search-query <text>", "Filter by model UUID or name").option("--sort-field <field>", "Sort field: created_at, updated_at").option("--sort-order <order>", "Sort order: asc, desc").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText("after", examples("airs model-security models list")).action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(modelsList, opts);
       if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
-      const result = await service.listModels({
+      const listOptions = {
         search: opts.search,
         searchQuery: opts.searchQuery,
         sortField: opts.sortField,
         sortOrder: opts.sortOrder,
         limit: opts.limit ? Number.parseInt(opts.limit, 10) : void 0,
         skip: opts.offset ? Number.parseInt(opts.offset, 10) : void 0
-      });
-      renderModelList(result.models, fmt);
+      };
+      const rows = opts.all ? await service.listAllModels({ ...listOptions, max: Number(opts.max) }) : (await service.listModels(listOptions)).models;
+      renderModelList(rows, fmt);
     } catch (err) {
       fail(err);
     }
   });
-  models.command("get <uuid>").description("Get a model by UUID").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (uuid, opts) => {
+  const modelsGet = models.command("get <uuid>").description("Get a model by UUID").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (uuid, opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(modelsGet, opts);
       if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
       const model = await service.getModel(uuid);
@@ -4075,9 +4247,9 @@ function registerModelSecurityCommand(program) {
       fail(err);
     }
   });
-  models.command("versions <modelUuid>").description("List versions of a model").option("--sort-order <order>", "Sort order: asc, desc").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (modelUuid, opts) => {
+  const modelVersions = models.command("versions <modelUuid>").description("List versions of a model").option("--sort-order <order>", "Sort order: asc, desc").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (modelUuid, opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(modelVersions, opts);
       if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
       const result = await service.listModelVersions(modelUuid, {
@@ -4090,9 +4262,9 @@ function registerModelSecurityCommand(program) {
       fail(err);
     }
   });
-  models.command("version <uuid>").description("Get a model version by UUID").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (uuid, opts) => {
+  const modelVersion = models.command("version <uuid>").description("Get a model version by UUID").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (uuid, opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(modelVersion, opts);
       if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
       const version = await service.getModelVersion(uuid);
@@ -4101,9 +4273,9 @@ function registerModelSecurityCommand(program) {
       fail(err);
     }
   });
-  models.command("files <modelVersionUuid>").description("List files in a model version").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (modelVersionUuid, opts) => {
+  const modelFiles = models.command("files <modelVersionUuid>").description("List files in a model version").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (modelVersionUuid, opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(modelFiles, opts);
       if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
       const result = await service.listModelVersionFiles(modelVersionUuid, {
@@ -4352,8 +4524,12 @@ function parseAttackGoals(input) {
   return parsed;
 }
 function sliceClientSide(items, opts) {
-  const offset = opts.offset !== void 0 ? Number.parseInt(opts.offset, 10) : 0;
-  const limit = opts.limit !== void 0 ? Number.parseInt(opts.limit, 10) : void 0;
+  if (opts.all) {
+    const max = opts.max === void 0 ? 1e4 : Number(opts.max);
+    return max === 0 ? items : items.slice(0, max);
+  }
+  const offset = opts.offset !== void 0 ? Number.parseInt(String(opts.offset), 10) : 0;
+  const limit = opts.limit !== void 0 ? Number.parseInt(String(opts.limit), 10) : void 0;
   return items.slice(offset, limit === void 0 ? void 0 : offset + limit);
 }
 function parsePositiveInt(input, flag) {
@@ -4634,12 +4810,14 @@ function registerRedteamCommand(program) {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
       const service = await createService3();
-      const scans = await service.listScans({
+      const listOptions = {
         status: opts.status,
         jobType: opts.type,
         targetId: opts.target,
-        limit: Number.parseInt(opts.limit, 10)
-      });
+        limit: Number.parseInt(opts.limit, 10),
+        offset: Number(opts.offset ?? 0)
+      };
+      const scans = opts.all ? await service.listAllScans({ ...listOptions, max: Number(opts.max) }) : await service.listScans(listOptions);
       renderScanList(scans, fmt);
     } catch (err) {
       fail(err);
@@ -5142,12 +5320,18 @@ function registerRedteamCommand(program) {
       fail(err);
     }
   });
-  const targetsBackup = targets.command("backup").description("Backup red team targets to local JSON/YAML files").option("--output-dir <path>", "Output directory").option("--output <format>", "Output format: json or yaml", "json").option("--name <targetName>", "Backup a single target by name");
+  const targetsBackup = targets.command("backup").description("Backup red team targets to local JSON/YAML files").option("--output-dir <path>", "Output directory").option("--file-format <format>", "Backup file format: json or yaml", "json").option("--name <targetName>", "Backup a single target by name");
+  registerDeprecatedAlias(targetsBackup, {
+    oldFlag: "--output <format>",
+    oldKey: "output",
+    canonicalFlag: "--file-format",
+    canonicalKey: "fileFormat"
+  });
   registerDeprecatedAlias(targetsBackup, {
     oldFlag: "--format <format>",
     oldKey: "format",
-    canonicalFlag: "--output",
-    canonicalKey: "output"
+    canonicalFlag: "--file-format",
+    canonicalKey: "fileFormat"
   });
   targetsBackup.action(async (opts) => {
     resolveDeprecatedAliases(targetsBackup, opts);
@@ -5156,7 +5340,7 @@ function registerRedteamCommand(program) {
       const outputDir = resolveOutputDir(opts.outputDir, "targets");
       const results = await backupTargets({
         outputDir,
-        format: opts.output ?? "json",
+        format: opts.fileFormat ?? "json",
         name: opts.name
       });
       renderBackupSummary(results, outputDir);
@@ -5221,11 +5405,13 @@ function registerRedteamCommand(program) {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
       const service = await createService3();
-      const { adapters, totalItems } = await service.listAdapters({
+      const listOptions = {
         limit: opts.limit ? parsePositiveInt(opts.limit, "--limit") : void 0,
         offset: opts.offset ? Number.parseInt(opts.offset, 10) : void 0,
         search: opts.search
-      });
+      };
+      const result = opts.all ? { adapters: await service.listAllAdapters({ ...listOptions, max: Number(opts.max) }) } : await service.listAdapters(listOptions);
+      const { adapters, totalItems } = result;
       renderAdapterList(adapters, fmt, totalItems);
     } catch (err) {
       fail(err);
@@ -5367,12 +5553,13 @@ function registerRedteamCommand(program) {
       const fmt = opts.output;
       if (fmt === "pretty") renderRedteamHeader();
       const service = await createService3();
-      const { channels: list } = await service.listChannels({
+      const listOptions = {
         limit: opts.limit ? parsePositiveInt(opts.limit, "--limit") : void 0,
         offset: opts.offset ? Number.parseInt(opts.offset, 10) : void 0,
         search: opts.search,
         status: opts.status
-      });
+      };
+      const list = opts.all ? await service.listAllChannels({ ...listOptions, max: Number(opts.max) }) : (await service.listChannels(listOptions)).channels;
       renderChannelList(list, fmt);
     } catch (err) {
       fail(err);
@@ -5914,6 +6101,31 @@ async function loadBulkScanState(filePath) {
 
 // src/cli/pagination.ts
 var DEFAULT_PAGE_SIZE = 50;
+var DEFAULT_OFFSET_LIMIT = 100;
+var DEFAULT_MAX_ITEMS = 1e4;
+function registerListFlags(command, options) {
+  const defaultLimit = options.dialect === "offset" ? DEFAULT_OFFSET_LIMIT : DEFAULT_PAGE_SIZE;
+  return command.option("--limit <n>", `Items per page (default: ${defaultLimit})`, Number, defaultLimit).option("--offset <n>", "Item offset (default: 0)", Number, 0).option("--all", "Walk all pages").option("--max <n>", "Maximum items with --all; 0 removes the cap", Number, DEFAULT_MAX_ITEMS);
+}
+function integerFlag(name, value, minimum) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < minimum) {
+    const qualifier = minimum === 1 ? "a positive integer" : "a non-negative integer";
+    throw new CliUsageError(`${name} must be ${qualifier}`);
+  }
+  return parsed;
+}
+function resolveListParams(command, opts, options) {
+  const defaultLimit = options.dialect === "offset" ? DEFAULT_OFFSET_LIMIT : DEFAULT_PAGE_SIZE;
+  const limit = integerFlag("--limit", opts.limit ?? defaultLimit, 1);
+  const offset = integerFlag("--offset", opts.offset ?? 0, 0);
+  const max = integerFlag("--max", opts.max ?? DEFAULT_MAX_ITEMS, 0);
+  const all = Boolean(opts.all);
+  if (all && command.getOptionValueSource?.("offset") === "cli") {
+    throw new CliUsageError("--all cannot be combined with --offset");
+  }
+  return { limit, offset, all, max };
+}
 function registerPageAliases(cmd, opts) {
   registerDeprecatedAlias(cmd, {
     oldFlag: `${opts.sizeFlag} <n>`,
@@ -6035,6 +6247,71 @@ function parseQuotedField(content, start, len) {
   return { value, nextIndex: i };
 }
 
+// src/cli/renderer/views/runtime.ts
+var profilesView = {
+  name: "profiles",
+  columns: [
+    { key: "profileId", label: "ID" },
+    { key: "profileName", label: "Name" },
+    { key: "active", label: "Active" },
+    { key: "revision", label: "Revision" }
+  ],
+  pretty: {
+    list: (items) => renderProfileList(items, "pretty"),
+    detail: renderProfileDetail
+  }
+};
+var apiKeysView = {
+  name: "API keys",
+  columns: [
+    { key: "id", label: "ID" },
+    { key: "name", label: "Name" },
+    { key: "last8", label: "Last 8" },
+    { key: "expiresAt", label: "Expires" }
+  ],
+  pretty: {
+    list: (items) => renderApiKeyList(items, "pretty"),
+    detail: renderApiKeyDetail
+  }
+};
+var customerAppsView = {
+  name: "customer apps",
+  columns: [
+    { key: "id", label: "ID" },
+    { key: "name", label: "Name" },
+    { key: "description", label: "Description" }
+  ],
+  pretty: {
+    list: (items) => renderCustomerAppList(items, "pretty"),
+    detail: renderCustomerAppDetail
+  }
+};
+var topicsView = {
+  name: "topics",
+  columns: [
+    { key: "topic_id", label: "ID" },
+    { key: "topic_name", label: "Name" },
+    { key: "revision", label: "Revision" },
+    { key: "description", label: "Description" }
+  ],
+  structured: (topic) => ({
+    topicId: topic.topic_id,
+    topicName: topic.topic_name,
+    revision: topic.revision,
+    active: topic.active,
+    description: topic.description,
+    examples: topic.examples,
+    createdBy: topic.created_by,
+    updatedBy: topic.updated_by,
+    lastModifiedTs: topic.last_modified_ts,
+    createdTs: topic.created_ts
+  }),
+  pretty: {
+    list: (items) => renderTopicList(items, "pretty"),
+    detail: renderTopicDetail
+  }
+};
+
 // src/cli/commands/dlp/dictionaries.ts
 import { readFile as readFile6 } from "fs/promises";
 import { basename as basename2 } from "path";
@@ -6048,6 +6325,9 @@ var SdkDictionariesService = class {
   async list(params) {
     return this.client.list(params);
   }
+  async listAll(params) {
+    return this.client.listAll(params);
+  }
   async create(params) {
     return this.client.create(params);
   }
@@ -6155,20 +6435,22 @@ function register(dlp) {
     "--offset <n>",
     "Starting offset \u2014 rounds down to a page boundary",
     (v) => Number.parseInt(v, 10)
-  ).option("--sort <field,dir>", "(repeatable)", (v, p = []) => [...p, v]).option("--keywords", "Include keyword list in response").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format", "pretty");
+  ).option("--sort <field,dir>", "(repeatable)", (v, p = []) => [...p, v]).option("--keywords", "Include keyword list in response").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml");
   registerPageAliases(listCmd, { sizeFlag: "--size", sizeKey: "size" });
   listCmd.action(async (opts) => {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const includeKeywords = opts.keywords || opts.includeKeywords;
+      const svc = new SdkDictionariesService();
+      const params = {
+        size,
+        sort: opts.sort,
+        keywords: includeKeywords ? true : void 0
+      };
+      const all = opts.all ? await svc.listAll({ ...params, max: Number(opts.max) }) : void 0;
       dlpDictionaries.renderList(
-        await new SdkDictionariesService().list({
-          page,
-          size,
-          sort: opts.sort,
-          keywords: includeKeywords ? true : void 0
-        }),
-        opts.output
+        all ? { content: all, totalElements: all.length } : await svc.list({ ...params, page }),
+        await resolveOutput(listCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -6189,12 +6471,12 @@ function register(dlp) {
       usageError(err instanceof Error ? err.message : String(err));
     }
   });
-  group.command("get <id>").option("--keywords", "").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format", "pretty").action(async (id, opts) => {
+  const getCmd = group.command("get <id>").option("--keywords", "").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (id, opts) => {
     try {
       const includeKeywords = opts.keywords || opts.includeKeywords;
       dlpDictionaries.renderGet(
         await new SdkDictionariesService().get(id, { includeKeywords }),
-        opts.output
+        await resolveOutput(getCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -6255,6 +6537,9 @@ var SdkDataFilteringProfilesService = class {
   async list(params) {
     return this.client.list(params);
   }
+  async listAll(params) {
+    return this.client.listAll(params);
+  }
   async get(id) {
     return this.client.get(id);
   }
@@ -6388,7 +6673,7 @@ function listFlags(cmd) {
     "--offset <n>",
     "Starting offset \u2014 rounds down to a page boundary",
     (v) => Number.parseInt(v, 10)
-  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format", "pretty");
+  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml");
   registerPageAliases(cmd, { sizeFlag: "--size", sizeKey: "size" });
   return cmd;
 }
@@ -6409,16 +6694,17 @@ function register2(dlp) {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataFilteringProfilesService();
-      const r = await svc.list({ page, size, sort: opts.sort });
-      dlpFilteringProfiles.renderList(r, opts.output);
+      const all = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
+      const r = all ? { content: all, totalElements: all.length } : await svc.list({ page, size, sort: opts.sort });
+      dlpFilteringProfiles.renderList(r, await resolveOutput(listCmd, opts));
     } catch (err) {
       fail(err);
     }
   });
-  group.command("get <id>").description("Get a filtering profile by id").option("--output <fmt>", "Output format", "pretty").action(async (id, opts) => {
+  const getCmd = group.command("get <id>").description("Get a filtering profile by id").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (id, opts) => {
     try {
       const svc = new SdkDataFilteringProfilesService();
-      dlpFilteringProfiles.renderGet(await svc.get(id), opts.output);
+      dlpFilteringProfiles.renderGet(await svc.get(id), await resolveOutput(getCmd, opts));
     } catch (err) {
       fail(err);
     }
@@ -6514,6 +6800,9 @@ var SdkDataPatternsService = class {
   async list(params) {
     return this.client.list(params);
   }
+  async listAll(params) {
+    return this.client.listAll(params);
+  }
   async create(body) {
     return this.client.create(body);
   }
@@ -6537,7 +6826,7 @@ function listFlags2(cmd) {
     "--offset <n>",
     "Starting offset \u2014 rounds down to a page boundary",
     (v) => Number.parseInt(v, 10)
-  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format", "pretty");
+  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml");
   registerPageAliases(cmd, { sizeFlag: "--size", sizeKey: "size" });
   return cmd;
 }
@@ -6559,9 +6848,10 @@ function register4(dlp) {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataPatternsService();
+      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
       dlpPatterns.renderList(
-        await svc.list({ page, size, sort: opts.sort }),
-        opts.output
+        result ? { content: result, totalElements: result.length } : await svc.list({ page, size, sort: opts.sort }),
+        await resolveOutput(listCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -6579,11 +6869,11 @@ function register4(dlp) {
       usageError(err instanceof Error ? err.message : String(err));
     }
   });
-  group.command("get <id>").description("Get a data pattern by id").option("--output <fmt>", "Output format", "pretty").action(async (id, opts) => {
+  const getCmd = group.command("get <id>").description("Get a data pattern by id").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (id, opts) => {
     try {
       dlpPatterns.renderGet(
         await new SdkDataPatternsService().get(id),
-        opts.output
+        await resolveOutput(getCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -6639,6 +6929,9 @@ var SdkDataProfilesService = class {
   async list(params) {
     return this.client.list(params);
   }
+  async listAll(params) {
+    return this.client.listAll(params);
+  }
   async create(body) {
     return this.client.create(body);
   }
@@ -6659,7 +6952,7 @@ function listFlags3(cmd) {
     "--offset <n>",
     "Starting offset \u2014 rounds down to a page boundary",
     (v) => Number.parseInt(v, 10)
-  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format", "pretty");
+  ).option("--sort <field,dir>", "Sort criteria (repeatable)", repeatable).option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml");
   registerPageAliases(cmd, { sizeFlag: "--size", sizeKey: "size" });
   return cmd;
 }
@@ -6693,9 +6986,10 @@ function register5(dlp) {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataProfilesService();
+      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
       dlpProfiles.renderList(
-        await svc.list({ page, size, sort: opts.sort }),
-        opts.output
+        result ? { content: result, totalElements: result.length } : await svc.list({ page, size, sort: opts.sort }),
+        await resolveOutput(listCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -6713,11 +7007,11 @@ function register5(dlp) {
       usageError(err instanceof Error ? err.message : String(err));
     }
   });
-  group.command("get <id>").description("Get a data profile by id").option("--output <fmt>", "Output format", "pretty").action(async (id, opts) => {
+  const getCmd = group.command("get <id>").description("Get a data profile by id").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (id, opts) => {
     try {
       dlpProfiles.renderGet(
         await new SdkDataProfilesService().get(id),
-        opts.output
+        await resolveOutput(getCmd, opts)
       );
     } catch (err) {
       fail(err);
@@ -7365,15 +7659,26 @@ async function createMgmtService() {
 function registerRuntimeCommand(program) {
   const runtime = program.command("runtime").description("Runtime prompt scanning against AIRS profiles");
   const apiKeys = runtime.command("api-keys").description("Manage AIRS API keys");
-  apiKeys.command("list").description("List API keys").option("--limit <n>", "Max results", "100").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+  const apiKeysList = registerListFlags(apiKeys.command("list"), { dialect: "offset" }).description("List API keys").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(apiKeysList, opts);
+      const page = resolveListParams(apiKeysList, opts, { dialect: "offset" });
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
+      if (page.all) {
+        const items = await service.listAllApiKeys({ limit: page.limit, max: page.max });
+        emitList(apiKeysView, items, fmt, {
+          page: { returned: items.length, total: items.length, all: true }
+        });
+        return;
+      }
       const result = await service.listApiKeys({
-        limit: Number.parseInt(opts.limit, 10)
+        limit: page.limit,
+        offset: page.offset
+      });
+      emitList(apiKeysView, result.apiKeys, fmt, {
+        page: { returned: result.apiKeys.length, next: result.nextOffset }
       });
-      renderApiKeyList(result.apiKeys, fmt);
     } catch (err) {
       fail(err);
     }
@@ -7560,25 +7865,37 @@ function registerRuntimeCommand(program) {
     }
   });
   const customerApps = runtime.command("customer-apps").description("Manage AIRS customer apps");
-  customerApps.command("list").description("List customer apps").option("--limit <n>", "Max results", "100").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+  const customerAppsList = registerListFlags(customerApps.command("list"), { dialect: "offset" }).description("List customer apps").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(customerAppsList, opts);
+      const page = resolveListParams(customerAppsList, opts, { dialect: "offset" });
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
+      if (page.all) {
+        const items = await service.listAllCustomerApps({ limit: page.limit, max: page.max });
+        emitList(customerAppsView, items, fmt, {
+          page: { returned: items.length, total: items.length, all: true }
+        });
+        return;
+      }
       const result = await service.listCustomerApps({
-        limit: Number.parseInt(opts.limit, 10)
+        limit: page.limit,
+        offset: page.offset
+      });
+      emitList(customerAppsView, result.apps, fmt, {
+        page: { returned: result.apps.length, next: result.nextOffset }
       });
-      renderCustomerAppList(result.apps, fmt);
     } catch (err) {
       fail(err);
     }
   });
-  customerApps.command("get <appName>").description("Get customer app details").action(async (appName) => {
+  const customerAppsGet = customerApps.command("get <appName>").description("Get customer app details").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (appName, opts) => {
     try {
-      renderRuntimeConfigHeader();
+      const fmt = await resolveOutput(customerAppsGet, opts);
+      if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
       const app = await service.getCustomerApp(appName);
-      renderCustomerAppDetail(app);
+      emitDetail(customerAppsView, app, fmt);
     } catch (err) {
       fail(err);
     }
@@ -7605,14 +7922,14 @@ function registerRuntimeCommand(program) {
       fail(err);
     }
   });
-  customerApps.command("consumption").argument(
+  const customerAppsConsumption = customerApps.command("consumption").argument(
     "[appName]",
     "Dashboard application name \u2014 the literal scan-payload metadata.app_name, as shown in the SCM AI Applications view (may differ from the SCM-registered customer-app name). Omit to report every dashboard bucket."
   ).description(
     "Show per-app token consumption + violation breakdown (SCM dashboard). Omit appName to scan all apps."
-  ).option("--time-interval <n>", "Window in days: 7, 30, or 60", "30").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (appName, opts) => {
+  ).option("--time-interval <n>", "Window in days: 7, 30, or 60", "30").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (appName, opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(customerAppsConsumption, opts);
       const interval = Number.parseInt(opts.timeInterval, 10);
       if (interval !== 7 && interval !== 30 && interval !== 60) {
         usageError("--time-interval must be 7, 30, or 60 (the API rejects other values)");
@@ -7646,9 +7963,9 @@ function registerRuntimeCommand(program) {
     }
   });
   const deploymentProfiles = runtime.command("deployment-profiles").description("List AIRS deployment profiles");
-  deploymentProfiles.command("list").description("List deployment profiles").option("--unactivated", "Include unactivated profiles").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+  const deploymentProfilesList = deploymentProfiles.command("list").description("List deployment profiles").option("--unactivated", "Include unactivated profiles").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(deploymentProfilesList, opts);
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
       const profiles2 = await service.listDeploymentProfiles({
@@ -7660,7 +7977,7 @@ function registerRuntimeCommand(program) {
     }
   });
   const profiles = runtime.command("profiles").description("Manage AIRS security profiles");
-  profiles.command("list").description("List security profiles").option("--limit <n>", "Max results", "100").option("--offset <n>", "Starting offset", "0").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").addHelpText(
+  const profilesList = registerListFlags(profiles.command("list"), { dialect: "offset" }).description("List security profiles").option("--all-versions", "Include every profile revision").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples(
       "airs runtime profiles list",
@@ -7669,49 +7986,55 @@ function registerRuntimeCommand(program) {
     )
   ).action(async (opts) => {
     try {
-      const fmt = opts.output;
-      if (!OUTPUT_FORMATS.includes(fmt)) {
-        usageError(`Invalid output format "${fmt}". Valid: ${OUTPUT_FORMATS.join(", ")}`);
-      }
+      const fmt = await resolveOutput(profilesList, opts);
+      const page = resolveListParams(profilesList, opts, { dialect: "offset" });
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
+      if (page.all) {
+        const items = await service.listAllProfiles({
+          limit: page.limit,
+          latest: !opts.allVersions,
+          max: page.max
+        });
+        emitList(profilesView, items, fmt, {
+          page: { returned: items.length, total: items.length, all: true }
+        });
+        return;
+      }
       const result = await service.listProfiles({
-        limit: Number.parseInt(opts.limit, 10),
-        offset: Number.parseInt(opts.offset, 10)
+        limit: page.limit,
+        offset: page.offset,
+        latest: !opts.allVersions
+      });
+      emitList(profilesView, result.profiles, fmt, {
+        page: {
+          returned: result.profiles.length,
+          next: result.nextOffset
+        }
       });
-      renderProfileList(result.profiles, fmt);
-      if (fmt === "pretty" && result.nextOffset != null) {
-        ui.dim(`Next offset: ${result.nextOffset}`);
-      }
     } catch (err) {
       fail(err);
     }
   });
-  profiles.command("get <nameOrId>").description("Get a security profile by name or UUID").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (nameOrId, opts) => {
+  const profilesGet = profiles.command("get <nameOrId>").description("Get a security profile by name or UUID").option("--revision <n>", "Select an exact revision", Number).option("--all-versions", "Return every matching revision").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (nameOrId, opts) => {
     try {
-      const fmt = opts.output;
-      if (fmt !== "pretty" && fmt !== "json" && fmt !== "yaml") {
-        usageError(`Invalid output format "${fmt}". Valid: pretty, json, yaml`);
-      }
+      const fmt = await resolveOutput(profilesGet, opts);
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
       const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
         nameOrId
       );
-      const profile = isUuid ? await service.getProfile(nameOrId) : await service.getProfileByName(nameOrId);
-      if (fmt === "json") {
-        console.log(JSON.stringify(profile, null, 2));
-      } else if (fmt === "yaml") {
-        const lines = [`profileId: ${profile.profileId}`, `profileName: ${profile.profileName}`];
-        if (profile.revision != null) lines.push(`revision: ${profile.revision}`);
-        if (profile.active != null) lines.push(`active: ${profile.active}`);
-        if (profile.createdBy) lines.push(`createdBy: ${profile.createdBy}`);
-        if (profile.updatedBy) lines.push(`updatedBy: ${profile.updatedBy}`);
-        if (profile.lastModifiedTs) lines.push(`lastModifiedTs: ${profile.lastModifiedTs}`);
-        if (profile.policy) lines.push(`policy: ${JSON.stringify(profile.policy, null, 2)}`);
-        console.log(lines.join("\n"));
+      if (opts.revision !== void 0 || opts.allVersions) {
+        const profiles2 = (await service.listAllProfiles({ latest: false })).filter(
+          (profile) => isUuid ? profile.profileId === nameOrId : profile.profileName === nameOrId
+        );
+        const selected = opts.revision === void 0 ? profiles2 : profiles2.filter((profile) => profile.revision === opts.revision);
+        if (selected.length === 0) throw new Error(`Profile ${nameOrId} not found`);
+        if (opts.allVersions) emitList(profilesView, selected, fmt);
+        else emitDetail(profilesView, selected[0], fmt);
       } else {
-        renderProfileDetail(profile);
+        const profile = isUuid ? await service.getProfile(nameOrId) : await service.getProfileByName(nameOrId);
+        emitDetail(profilesView, profile, fmt);
       }
     } catch (err) {
       fail(err);
@@ -7994,12 +8317,12 @@ function registerRuntimeCommand(program) {
     }
   });
   const scanLogs = runtime.command("scan-logs").description("Query AIRS scan logs");
-  const scanLogsQuery = scanLogs.command("query").description("Query scan logs").requiredOption("--interval <n>", "Time interval").requiredOption("--unit <unit>", "Time unit (hours)").option("--filter <filter>", "Filter: all, benign, threat", "all").option("--limit <n>", "Max results per page (API page size)", "50").option("--offset <n>", "Starting offset \u2014 rounds down to a page boundary", "0").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty");
+  const scanLogsQuery = scanLogs.command("query").description("Query scan logs").requiredOption("--interval <n>", "Time interval").requiredOption("--unit <unit>", "Time unit (hours)").option("--filter <filter>", "Filter: all, benign, threat", "all").option("--limit <n>", "Max results per page (API page size)", "50").option("--offset <n>", "Starting offset \u2014 rounds down to a page boundary", "0").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml");
   registerPageAliases(scanLogsQuery, { sizeFlag: "--page-size", sizeKey: "pageSize" });
   scanLogsQuery.action(async (opts) => {
     try {
       const { page, size } = resolvePageParams(scanLogsQuery, opts, { indexBase: 1 });
-      const fmt = opts.output;
+      const fmt = await resolveOutput(scanLogsQuery, opts);
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
       const result = await service.queryScanLogs({
@@ -8036,52 +8359,47 @@ function registerRuntimeCommand(program) {
     }
   });
   registerEvalCommand(topics);
-  topics.command("get <nameOrId>").description("Get a custom topic by name or UUID").option("--output <format>", "Output format: pretty, json, yaml", "pretty").action(async (nameOrId, opts) => {
+  const topicsGet = topics.command("get <nameOrId>").description("Get a custom topic by name or UUID").option("--revision <n>", "Select an exact revision", Number).option("--all-versions", "Return every matching revision").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (nameOrId, opts) => {
     try {
-      const fmt = opts.output;
-      if (fmt !== "pretty" && fmt !== "json" && fmt !== "yaml") {
-        usageError(`Invalid output format "${fmt}". Valid: pretty, json, yaml`);
-      }
+      const fmt = await resolveOutput(topicsGet, opts);
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
       const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
         nameOrId
       );
-      const topic = isUuid ? await service.getTopic(nameOrId) : await service.getTopicByName(nameOrId);
-      if (fmt === "json") {
-        console.log(JSON.stringify(topic, null, 2));
-      } else if (fmt === "yaml") {
-        const lines = [`topic_id: ${topic.topic_id}`, `topic_name: ${topic.topic_name}`];
-        if (topic.revision != null) lines.push(`revision: ${topic.revision}`);
-        if (topic.description) lines.push(`description: ${topic.description}`);
-        if (topic.examples?.length) {
-          lines.push("examples:");
-          for (const ex of topic.examples) lines.push(`  - ${ex}`);
-        }
-        if (topic.created_by) lines.push(`created_by: ${topic.created_by}`);
-        if (topic.updated_by) lines.push(`updated_by: ${topic.updated_by}`);
-        if (topic.last_modified_ts) lines.push(`last_modified_ts: ${topic.last_modified_ts}`);
-        console.log(lines.join("\n"));
+      if (opts.revision !== void 0 || opts.allVersions) {
+        const topics2 = (await service.listTopics()).filter(
+          (topic) => isUuid ? topic.topic_id === nameOrId : topic.topic_name === nameOrId
+        );
+        const selected = opts.revision === void 0 ? topics2 : topics2.filter((topic) => topic.revision === opts.revision);
+        if (selected.length === 0) throw new Error(`Topic ${nameOrId} not found`);
+        if (opts.allVersions) emitList(topicsView, selected, fmt);
+        else emitDetail(topicsView, selected[0], fmt);
       } else {
-        renderTopicDetail(topic);
+        const topic = isUuid ? await service.getTopic(nameOrId) : await service.getTopicByName(nameOrId);
+        emitDetail(topicsView, topic, fmt);
       }
     } catch (err) {
       fail(err);
     }
   });
-  topics.command("list").description("List custom topics").option("--limit <n>", "Max results", "100").option("--offset <n>", "Starting offset", "0").option("--output <format>", "Output format: pretty, table, csv, json, yaml", "pretty").action(async (opts) => {
+  const topicsList = registerListFlags(topics.command("list"), { dialect: "offset" }).description("List custom topics").option("--all-versions", "Include every topic revision").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
-      const fmt = opts.output;
+      const fmt = await resolveOutput(topicsList, opts);
+      const params = resolveListParams(topicsList, opts, { dialect: "offset" });
       if (fmt === "pretty") renderRuntimeConfigHeader();
       const service = await createMgmtService();
-      const allTopics = await service.listTopics();
-      const offset = Number.parseInt(opts.offset, 10);
-      const limit = Number.parseInt(opts.limit, 10);
-      const page = allTopics.slice(offset, offset + limit);
-      renderTopicList(page, fmt);
-      if (fmt === "pretty" && offset + limit < allTopics.length) {
-        ui.dim(`Showing ${page.length} of ${allTopics.length} topics`);
-      }
+      const allTopics = opts.allVersions ? await service.listTopics() : await service.listLatestTopics(
+        params.all ? { offset: 0, limit: params.max === 0 ? 1e4 : params.max } : { offset: params.offset, limit: params.limit }
+      );
+      const page = opts.allVersions && !params.all ? allTopics.slice(params.offset, params.offset + params.limit) : allTopics;
+      emitList(topicsView, page, fmt, {
+        page: params.all ? { returned: page.length, total: page.length, all: true } : {
+          returned: page.length,
+          total: opts.allVersions ? allTopics.length : void 0,
+          next: opts.allVersions && params.offset + params.limit < allTopics.length ? params.offset + params.limit : void 0
+        }
+      });
     } catch (err) {
       fail(err);
     }
@@ -8283,6 +8601,27 @@ function installDebugLogger(logPath) {
 }
 
 // src/cli/program.ts
+var READ_COMMAND_NAMES = /* @__PURE__ */ new Set([
+  "categories",
+  "consumption",
+  "evaluation",
+  "evaluations",
+  "files",
+  "get",
+  "languages",
+  "list",
+  "pypi-auth",
+  "query",
+  "registry-credentials",
+  "report",
+  "stats",
+  "status",
+  "values",
+  "version",
+  "versions",
+  "violation",
+  "violations"
+]);
 function applyListDeleteAliases(cmd) {
   for (const sub of cmd.commands) {
     if (sub.name() === "list" && !sub.aliases().includes("ls")) sub.alias("ls");
@@ -8290,16 +8629,45 @@ function applyListDeleteAliases(cmd) {
     applyListDeleteAliases(sub);
   }
 }
+function applyReadContractFlags(cmd) {
+  for (const sub of cmd.commands) {
+    const flags = () => sub.options.map((option) => option.long);
+    if ((sub.name() === "list" || sub.name() === "get") && !flags().includes("--output")) {
+      sub.option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml");
+    }
+    if (sub.name() === "list" && (flags().includes("--limit") || flags().includes("--offset"))) {
+      if (!flags().includes("--limit")) sub.option("--limit <n>", "Items per page", Number, 50);
+      if (!flags().includes("--offset")) sub.option("--offset <n>", "Item offset", Number, 0);
+      if (!flags().includes("--all")) sub.option("--all", "Walk all pages");
+      if (!flags().includes("--max")) {
+        sub.option("--max <n>", "Maximum items with --all; 0 removes the cap", Number, 1e4);
+      }
+    }
+    applyReadContractFlags(sub);
+  }
+}
+function applySortedHelp(cmd) {
+  cmd.configureHelp({ sortOptions: true, sortSubcommands: true });
+  for (const sub of cmd.commands) applySortedHelp(sub);
+}
 function buildProgram() {
   const here = dirname4(fileURLToPath(import.meta.url));
   const pkg = JSON.parse(readFileSync4(join4(here, "../../package.json"), "utf-8"));
   const program = new Command();
   program.name("airs").description(
     "CLI and library for Palo Alto Prisma AIRS \u2014 guardrail refinement, AI red teaming, model security scanning, profile audits"
-  ).version(pkg.version).option("--debug", "Log all AIRS/SCM API requests and responses to a JSONL file").option("--quiet", "Suppress status and decorative output (data and errors still print)");
-  program.hook("preAction", (_thisCommand, actionCommand) => {
+  ).version(pkg.version).option("--debug", "Log all AIRS/SCM API requests and responses to a JSONL file").option("--output <format>", "Default output format for read commands").option("--quiet", "Suppress status and decorative output (data and errors still print)");
+  program.hook("preAction", async (_thisCommand, actionCommand) => {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
+    if (READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
+      try {
+        const format = await resolveOutput(actionCommand, actionCommand.opts());
+        actionCommand.setOptionValueWithSource("output", format, "implied");
+      } catch (error) {
+        fail(error);
+      }
+    }
     if (root.debug) {
       const logPath = join4(homedir(), ".prisma-airs", `debug-api-${Date.now()}.jsonl`);
       installDebugLogger(logPath);
@@ -8314,6 +8682,8 @@ function buildProgram() {
   registerDoctorCommand(program);
   registerCompletionCommand(program);
   applyListDeleteAliases(program);
+  applyReadContractFlags(program);
+  applySortedHelp(program);
   return program;
 }