@cdot65/prisma-airs-cli 4.0.1 → 4.1.1

package/dist/cli/index.js

@@ -45,6 +45,13 @@ import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
 
+// src/cli/commands/aigateway.ts
+import {
+  GatewayDefaultsInputSchema,
+  GatewayRateLimitInputSchema,
+  GatewayUsageLimitInputSchema
+} from "@cdot65/prisma-airs-sdk";
+
 // src/airs/aigateway.ts
 import {
   AIGatewayClient
@@ -2936,29 +2943,1534 @@ function renderScanLogList(results, pageToken, format = "pretty") {
   console.log();
 }
 
-// src/cli/confirm.ts
-async function confirmOrAbort(message, force, options = {}) {
-  if (force) return;
-  const interactive = options.isTTY ?? process.stdout.isTTY === true;
-  if (!interactive) {
-    usageError(
-      `refusing to ${options.action ?? "proceed"} without --force in non-interactive mode`
-    );
+// src/cli/confirm.ts
+async function confirmOrAbort(message, force, options = {}) {
+  if (force) return;
+  const interactive = options.isTTY ?? process.stdout.isTTY === true;
+  if (!interactive) {
+    await options.onAbort?.(2);
+    usageError(
+      `refusing to ${options.action ?? "proceed"} without --force in non-interactive mode`
+    );
+  }
+  const prompt = options.promptFn ?? (await import("@inquirer/prompts")).confirm;
+  const confirmed = await prompt({ message, default: false });
+  if (!confirmed) {
+    await options.onAbort?.(0);
+    ui.info("Aborted");
+    process.exit(0);
+  }
+}
+
+// src/cli/examples.ts
+function examples(...lines) {
+  return `
+Examples:
+${lines.map((l) => `  $ ${l}`).join("\n")}
+`;
+}
+
+// src/cli/commands/aigateway/inventory.ts
+import {
+  AI_GATEWAY_DEPLOYMENT_STATUSES,
+  AI_GATEWAY_DEPLOYMENT_TYPES,
+  AI_GATEWAY_KNOWN_API_KEY_SCOPES,
+  AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
+  AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
+  GatewayApiKeyRotateRequestSchema,
+  GatewayApiKeyUpdateRequestSchema,
+  GatewayConfigCreateRequestSchema,
+  GatewayConfigUpdateRequestSchema,
+  GatewayDeploymentCreateRequestSchema,
+  GatewayDeploymentUpdateRequestSchema,
+  GatewayGuardrailCreateRequestSchema,
+  GatewayGuardrailUpdateRequestSchema,
+  GatewayIntegrationCreateRequestSchema,
+  GatewayIntegrationModelsBulkUpdateRequestSchema,
+  GatewayIntegrationUpdateRequestSchema,
+  GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
+  GatewayOrganisationAuthSettingsUpdateRequestSchema,
+  GatewayOrganisationUpdateRequestSchema,
+  GatewayPluginCreateRequestSchema,
+  GatewayProviderCreateRequestSchema,
+  GatewayProviderUpdateRequestSchema,
+  GatewayServiceApiKeyCreateRequestSchema,
+  GatewayUserApiKeyCreateRequestSchema,
+  McpIntegrationCapabilitiesBulkUpdateRequestSchema,
+  McpIntegrationCreateRequestSchema,
+  McpIntegrationUpdateRequestSchema,
+  McpIntegrationWorkspacesBulkUpdateRequestSchema,
+  redactAIGatewaySecrets
+} from "@cdot65/prisma-airs-sdk";
+
+// src/cli/debug-logger.ts
+import {
+  appendFileSync,
+  mkdirSync,
+  readdirSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { dirname, join } from "path";
+var AIRS_DOMAINS = [
+  "api.sase.paloaltonetworks.com",
+  "service.api.aisecurity.paloaltonetworks.com",
+  "auth.apps.paloaltonetworks.com",
+  "api.dlp.paloaltonetworks.com"
+];
+function isAirsUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return AIRS_DOMAINS.some((d) => parsed.hostname === d || parsed.hostname.endsWith(`.${d}`));
+  } catch {
+    return false;
+  }
+}
+var MASK = "***";
+var SENSITIVE_KEY_PATTERN = /token|secret|password|passwd|credential|authorization|cookie|api[-_]?key|client[-_]?auth|^key$/i;
+function isSensitiveKey(key) {
+  return SENSITIVE_KEY_PATTERN.test(key);
+}
+function redactHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    out[k] = isSensitiveKey(k) ? MASK : v;
+  }
+  return out;
+}
+function redactDeep(value) {
+  if (Array.isArray(value)) {
+    return value.map(redactDeep);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = isSensitiveKey(k) ? MASK : redactDeep(v);
+    }
+    return out;
+  }
+  return value;
+}
+function redactUrl(url) {
+  try {
+    const parsed = new URL(url);
+    let touched = false;
+    for (const key of parsed.searchParams.keys()) {
+      if (isSensitiveKey(key)) {
+        parsed.searchParams.set(key, MASK);
+        touched = true;
+      }
+    }
+    return touched ? parsed.toString() : url;
+  } catch {
+    return url;
+  }
+}
+function pruneDebugLogs(dir, keep) {
+  let files;
+  try {
+    files = readdirSync(dir).filter((f) => f.startsWith("debug-api-") && f.endsWith(".jsonl"));
+  } catch {
+    return;
+  }
+  const byAge = files.map((f) => {
+    const path3 = join(dir, f);
+    try {
+      return { path: path3, mtime: statSync(path3).mtimeMs };
+    } catch {
+      return null;
+    }
+  }).filter((e) => e !== null).sort((a, b) => b.mtime - a.mtime);
+  for (const { path: path3 } of byAge.slice(keep)) {
+    try {
+      unlinkSync(path3);
+    } catch {
+    }
+  }
+}
+function headersToRecord(headers) {
+  if (!headers) return {};
+  if (typeof headers === "object" && "forEach" in headers && typeof headers.forEach === "function") {
+    const out = {};
+    headers.forEach((v, k) => {
+      out[k] = v;
+    });
+    return out;
+  }
+  if (Array.isArray(headers)) {
+    return Object.fromEntries(headers);
+  }
+  return headers;
+}
+var KEEP_DEBUG_LOGS = 10;
+function installDebugLogger(logPath) {
+  mkdirSync(dirname(logPath), { recursive: true });
+  writeFileSync(logPath, "", "utf-8");
+  pruneDebugLogs(dirname(logPath), KEEP_DEBUG_LOGS);
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async function debugFetch(input, init2) {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    if (!isAirsUrl(url)) {
+      return originalFetch(input, init2);
+    }
+    const method = init2?.method ?? (input instanceof Request ? input.method : "GET");
+    const reqHeaders = redactHeaders(headersToRecord(init2?.headers));
+    const loggedUrl = redactUrl(url);
+    let reqBody;
+    if (init2?.body) {
+      try {
+        reqBody = redactDeep(JSON.parse(String(init2.body)));
+      } catch {
+        reqBody = String(init2.body);
+      }
+    }
+    const ts2 = (/* @__PURE__ */ new Date()).toISOString();
+    const startMs = Date.now();
+    let response;
+    let resBody;
+    let error;
+    try {
+      response = await originalFetch(input, init2);
+    } catch (err) {
+      error = err instanceof Error ? err.message : String(err);
+      const entry2 = JSON.stringify({
+        timestamp: ts2,
+        durationMs: Date.now() - startMs,
+        request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
+        error
+      });
+      appendFileSync(logPath, `${entry2}
+`);
+      throw err;
+    }
+    const durationMs = Date.now() - startMs;
+    const resHeaders = {};
+    response.headers.forEach((v, k) => {
+      resHeaders[k] = v;
+    });
+    const clone = response.clone();
+    try {
+      const text = await clone.text();
+      try {
+        resBody = redactDeep(JSON.parse(text));
+      } catch {
+        resBody = text;
+      }
+    } catch {
+      resBody = "<unreadable>";
+    }
+    const entry = JSON.stringify({
+      timestamp: ts2,
+      durationMs,
+      request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
+      response: {
+        status: response.status,
+        statusText: response.statusText,
+        headers: redactHeaders(resHeaders),
+        body: resBody
+      }
+    });
+    appendFileSync(logPath, `${entry}
+`);
+    return response;
+  };
+  return {
+    teardown() {
+      globalThis.fetch = originalFetch;
+    }
+  };
+}
+
+// src/cli/commands/aigateway/shared.ts
+import { open, readFile, unlink } from "fs/promises";
+import { AIGatewayClient as AIGatewayClient2 } from "@cdot65/prisma-airs-sdk";
+import { dump as dump3, load } from "js-yaml";
+async function defaultClientFactory() {
+  const config = await loadConfig();
+  return new AIGatewayClient2(aiGatewayClientOptions(config));
+}
+var clientFactory = defaultClientFactory;
+async function createAiGatewayClient() {
+  return clientFactory();
+}
+function showHelpOnEmpty(command) {
+  return command.action(() => command.outputHelp());
+}
+function addReadOutput(command) {
+  return command.option(
+    "--output <format>",
+    "Output format: pretty, table, markdown, csv, json, yaml"
+  );
+}
+function addWriteOutput(command) {
+  return command.option("--output <format>", "Output format: pretty, json, yaml");
+}
+async function readGatewayRequest(path3) {
+  let parsed;
+  try {
+    const text = await readFile(path3, "utf8");
+    parsed = path3.endsWith(".yaml") || path3.endsWith(".yml") ? load(text) : JSON.parse(text);
+  } catch (error) {
+    throw new CliUsageError(
+      `Unable to parse --file '${path3}' as JSON or YAML: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new CliUsageError(`--file '${path3}' must contain an object`);
+  }
+  return parsed;
+}
+function failAiGateway(error) {
+  const hint = aiGatewayGrantHint(error);
+  if (hint) ui.warn(`403: ${hint}`);
+  fail(error);
+}
+function responseItems(value) {
+  const record = asRecord2(value);
+  if (Array.isArray(value)) return value.map(asRecord2);
+  if (Array.isArray(record.data)) return record.data.map(asRecord2);
+  const data = asRecord2(record.data);
+  if (Array.isArray(data.records)) return data.records.map(asRecord2);
+  if (Array.isArray(record.records)) return record.records.map(asRecord2);
+  return [];
+}
+function asRecord2(value) {
+  return value !== null && typeof value === "object" ? value : { value };
+}
+function displayColumns(items) {
+  const preferred = [
+    "id",
+    "slug",
+    "name",
+    "type",
+    "status",
+    "enabled",
+    "created_at",
+    "last_updated_at"
+  ];
+  const keys = new Set(items.flatMap((item) => Object.keys(item)));
+  const scalar = (key) => items.every((item) => item[key] == null || typeof item[key] !== "object");
+  const chosen = [
+    ...preferred.filter((key) => keys.has(key) && scalar(key)),
+    ...[...keys].filter((key) => !preferred.includes(key) && scalar(key)).sort()
+  ].slice(0, 8);
+  return chosen.map((key) => ({
+    key,
+    label: key.replaceAll("_", " ").replace(/\b\w/g, (c) => c.toUpperCase())
+  }));
+}
+function renderGatewayList(items, format, label) {
+  if (format === "json") {
+    console.log(JSON.stringify(items, null, 2));
+    return;
+  }
+  if (format === "yaml") {
+    console.log(dump3(items, { noRefs: true, lineWidth: -1 }).trimEnd());
+    return;
+  }
+  if (items.length === 0) {
+    ui.emptyList(label);
+    return;
+  }
+  const columns = displayColumns(items);
+  const rendered = formatOutput(items, columns, format === "pretty" ? "table" : format);
+  if (rendered) console.log(rendered);
+}
+function renderGatewayDetail(value, format) {
+  const item = asRecord2(value);
+  if (format === "json") {
+    console.log(JSON.stringify(item, null, 2));
+    return;
+  }
+  if (format === "yaml") {
+    console.log(dump3(item, { noRefs: true, lineWidth: -1 }).trimEnd());
+    return;
+  }
+  const rows = Object.entries(item).map(([key, raw]) => ({
+    key,
+    value: raw !== null && typeof raw === "object" ? JSON.stringify(raw) : raw
+  }));
+  const rendered = formatOutput(
+    rows,
+    [
+      { key: "key", label: "Field" },
+      { key: "value", label: "Value" }
+    ],
+    format === "pretty" ? "table" : format
+  );
+  if (rendered) console.log(rendered);
+}
+async function runList(command, opts, label, load2) {
+  try {
+    const format = await resolveOutput(command, opts);
+    const client = await createAiGatewayClient();
+    renderGatewayList(responseItems(await load2(client)), format, label);
+  } catch (error) {
+    failAiGateway(error);
+  }
+}
+async function runDetail(command, opts, load2) {
+  try {
+    const format = await resolveOutput(command, opts);
+    const client = await createAiGatewayClient();
+    renderGatewayDetail(await load2(client), format);
+  } catch (error) {
+    failAiGateway(error);
+  }
+}
+async function runWrite(command, opts, prepareOrWrite, preparedWrite) {
+  try {
+    const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
+    const prepared = preparedWrite ? await prepareOrWrite() : void 0;
+    const client = await createAiGatewayClient();
+    const result = preparedWrite ? await preparedWrite(client, prepared) : await prepareOrWrite(client);
+    renderGatewayDetail(result, format);
+  } catch (error) {
+    failAiGateway(error);
+  }
+}
+async function runConfirmedWrite(command, opts, prompt, prepareOrWrite, preparedWrite) {
+  try {
+    const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
+    const prepared = preparedWrite ? await prepareOrWrite() : void 0;
+    const action = prompt.replace(/\?$/, "").replace(/^./, (character) => character.toLowerCase());
+    await confirmOrAbort(prompt, Boolean(opts.force), { action });
+    const client = await createAiGatewayClient();
+    const result = preparedWrite ? await preparedWrite(client, prepared) : await prepareOrWrite(client);
+    renderGatewayDetail(result ?? { success: true }, format);
+  } catch (error) {
+    failAiGateway(error);
+  }
+}
+async function runSecretWrite(command, opts, prepare, write, prompt, settings = {}) {
+  let destinationHandle;
+  let destinationReserved = false;
+  let secretPersisted = false;
+  const cleanupReservedDestination = async () => {
+    if (destinationHandle) await destinationHandle.close().catch(() => void 0);
+    destinationHandle = void 0;
+    if (opts.secretOutput && destinationReserved && !secretPersisted) {
+      await unlink(opts.secretOutput).catch(() => void 0);
+    }
+    destinationReserved = false;
+  };
+  try {
+    const prepared = await prepare();
+    const requiresDestination = settings.requiresDestination?.(prepared) ?? true;
+    if (requiresDestination && !opts.secretOutput && !opts.showSecret) {
+      throw new CliUsageError(
+        "Choose --secret-output <path> (recommended) or --show-secret before requesting a one-time credential"
+      );
+    }
+    const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
+    if (requiresDestination && opts.secretOutput) {
+      destinationHandle = await open(opts.secretOutput, "wx", 384);
+      destinationReserved = true;
+    }
+    if (prompt) {
+      const action = prompt.replace(/\?$/, "").replace(/^./, (character) => character.toLowerCase());
+      await confirmOrAbort(prompt, Boolean(opts.force), {
+        action,
+        onAbort: cleanupReservedDestination
+      });
+    }
+    const client = await createAiGatewayClient();
+    const result = await write(client, prepared);
+    if (requiresDestination && opts.secretOutput && destinationHandle) {
+      await destinationHandle.writeFile(`${JSON.stringify(result, null, 2)}
+`, "utf8");
+      secretPersisted = true;
+      await destinationHandle.close();
+      destinationHandle = void 0;
+      renderGatewayDetail({ saved_to: opts.secretOutput }, format);
+      return;
+    }
+    renderGatewayDetail(
+      requiresDestination ? result : settings.redactResponse?.(result) ?? result,
+      format
+    );
+  } catch (error) {
+    await cleanupReservedDestination();
+    failAiGateway(error);
+  }
+}
+
+// src/cli/commands/aigateway/structured-input.ts
+import {
+  AISecSDKException,
+  buildDottedObject,
+  ErrorType,
+  GatewayJsonObjectSchema,
+  setDottedValue
+} from "@cdot65/prisma-airs-sdk";
+function collectOption(value, previous = []) {
+  return [...previous, value];
+}
+function addStructuredInputOptions(command) {
+  return command.option("--file <path>", "Advanced JSON/YAML request base; named flags override it").option(
+    "--set <path=value>",
+    "Set a typed JSON value at a request path (repeatable)",
+    collectOption
+  ).option(
+    "--set-string <path=value>",
+    "Set a literal string at a request path (repeatable)",
+    collectOption
+  );
+}
+function parseBooleanOption(value) {
+  if (value === true || value === false) return value;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  throw new CliUsageError("Expected true or false");
+}
+function parseIntegerOption(value) {
+  const text = String(value);
+  if (!/^-?(0|[1-9]\d*)$/.test(text)) throw new CliUsageError("Expected an integer");
+  const parsed = Number(text);
+  if (!Number.isSafeInteger(parsed)) throw new CliUsageError("Expected a safe integer");
+  return parsed;
+}
+function parseDateOption(value) {
+  const parsed = new Date(String(value));
+  if (Number.isNaN(parsed.getTime())) throw new CliUsageError("Expected an ISO-8601 timestamp");
+  return parsed;
+}
+function parseCsvOption(value) {
+  const values = String(value).split(",").map((item) => item.trim()).filter(Boolean);
+  if (values.length === 0) throw new CliUsageError("Expected a non-empty comma-separated list");
+  return values;
+}
+function parseJsonOption(value) {
+  try {
+    return JSON.parse(String(value));
+  } catch {
+    throw new CliUsageError("Expected valid JSON");
+  }
+}
+function repeatableValues(value) {
+  if (Array.isArray(value)) return value.map(String);
+  return [String(value)];
+}
+function splitKeyValue(raw, label) {
+  const separator = raw.indexOf("=");
+  if (separator <= 0) throw new CliUsageError(`Expected ${label}=value`);
+  return [raw.slice(0, separator), raw.slice(separator + 1)];
+}
+function parseBooleanBindingsOption(value) {
+  return repeatableValues(value).map((raw) => {
+    const [id, enabled] = splitKeyValue(raw, "id");
+    return { id, enabled: parseBooleanOption(enabled) };
+  });
+}
+function parseModelBindingsOption(value) {
+  return repeatableValues(value).map((raw) => {
+    const [slug, enabled] = splitKeyValue(raw, "slug");
+    return { slug, enabled: parseBooleanOption(enabled) };
+  });
+}
+function parseCapabilityBindingsOption(value) {
+  return repeatableValues(value).map((raw) => {
+    const [identity, enabled] = splitKeyValue(raw, "type:name");
+    const separator = identity.indexOf(":");
+    if (separator <= 0 || separator === identity.length - 1) {
+      throw new CliUsageError("Expected type:name=enabled");
+    }
+    return {
+      type: identity.slice(0, separator),
+      name: identity.slice(separator + 1),
+      enabled: parseBooleanOption(enabled)
+    };
+  });
+}
+function parseStringMapOption(value) {
+  const result = {};
+  for (const raw of repeatableValues(value)) {
+    const [key, item] = splitKeyValue(raw, "key");
+    if (["__proto__", "constructor", "prototype"].includes(key)) {
+      throw new CliUsageError(`Unsafe key: ${key}`);
+    }
+    if (Object.hasOwn(result, key)) throw new CliUsageError(`Duplicate key: ${key}`);
+    result[key] = item;
+  }
+  return result;
+}
+function parseAssignment(raw, forceString) {
+  const separator = raw.indexOf("=");
+  if (separator <= 0) throw new CliUsageError("Expected path=value");
+  const path3 = raw.slice(0, separator);
+  const text = raw.slice(separator + 1);
+  if (forceString) return [path3, text];
+  try {
+    return [path3, JSON.parse(text)];
+  } catch {
+    return [path3, text];
+  }
+}
+function schemaMessage(error) {
+  const issues = error?.issues;
+  if (!Array.isArray(issues) || issues.length === 0)
+    return "request body does not match its schema";
+  return issues.map((issue) => {
+    const path3 = issue.path?.length ? issue.path.map(String).join(".") : "<root>";
+    return `${path3}: ${issue.message ?? "invalid value"}`;
+  }).join("; ");
+}
+function optionName(option) {
+  return `--${option.replace(/[A-Z]/g, (character) => `-${character.toLowerCase()}`)}`;
+}
+function asUsageError(error, prefix = "Invalid AI Gateway request") {
+  if (error instanceof CliUsageError) return error;
+  if (error instanceof AISecSDKException && error.errorType === ErrorType.USER_REQUEST_PAYLOAD_ERROR) {
+    return new CliUsageError(`${prefix}: ${error.message}`);
+  }
+  return new CliUsageError(`${prefix}: ${schemaMessage(error)}`);
+}
+async function buildStructuredRequest(options, schema, fields = []) {
+  try {
+    let body = {};
+    if (options.file) {
+      body = GatewayJsonObjectSchema.parse(await readGatewayRequest(options.file));
+    }
+    for (const field of fields) {
+      const raw = options[field.option];
+      if (raw === void 0 || Array.isArray(raw) && raw.length === 0) continue;
+      let value;
+      try {
+        value = field.parse ? field.parse(raw) : raw;
+      } catch (error) {
+        if (error instanceof CliUsageError) {
+          throw new CliUsageError(`Invalid ${optionName(field.option)}: ${error.message}`);
+        }
+        throw error;
+      }
+      body = setDottedValue(body, field.path, value);
+    }
+    const assignments = [
+      ...(options.set ?? []).map((raw) => {
+        try {
+          const [path3, value] = parseAssignment(raw, false);
+          return { path: path3, value };
+        } catch (error) {
+          if (error instanceof CliUsageError) {
+            throw new CliUsageError(`Invalid --set '${raw}': ${error.message}`);
+          }
+          throw error;
+        }
+      }),
+      ...(options.setString ?? []).map((raw) => {
+        try {
+          const [path3, value] = parseAssignment(raw, true);
+          return { path: path3, value };
+        } catch (error) {
+          if (error instanceof CliUsageError) {
+            throw new CliUsageError(`Invalid --set-string '${raw}': ${error.message}`);
+          }
+          throw error;
+        }
+      })
+    ];
+    buildDottedObject(assignments);
+    for (const { path: path3, value } of assignments) body = setDottedValue(body, path3, value);
+    return schema.parse(body);
+  } catch (error) {
+    throw asUsageError(error);
+  }
+}
+
+// src/cli/commands/aigateway/inventory.ts
+function registerScopedReads(root, name, description, select, options = {}) {
+  const group = showHelpOnEmpty(root.command(name).description(description));
+  const list = addReadOutput(
+    group.command("list").description(`List ${name} in a workspace (data plane)`).requiredOption("--workspace <uuid>", "Workspace UUID")
+  );
+  list.action(
+    (opts) => runList(list, opts, name, (client) => select(client).list({ workspaceId: opts.workspace }))
+  );
+  let get = group.command("get <id>").description(`Get one ${name.replace(/s$/, "")} by UUID (data plane)`);
+  if (options.sensitiveDetail) {
+    get = get.option("--reveal-sensitive", "Show credential-bearing fields");
+  }
+  addReadOutput(get);
+  get.action(
+    (id, opts) => runDetail(get, opts, async (client) => {
+      const result = await select(client).get(id);
+      if (!options.sensitiveDetail || opts.revealSensitive) return result;
+      const metadataRedacted = options.sensitiveOperation ? redactAIGatewaySecrets(options.sensitiveOperation, result, "response") : result;
+      return redactDeep(metadataRedacted);
+    })
+  );
+  return group;
+}
+var knownValues = (values) => values.join(", ");
+function redactApiKeyMaterial(value) {
+  if (Array.isArray(value)) return value.map(redactApiKeyMaterial);
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      key === "key" ? "***" : redactApiKeyMaterial(entry)
+    ])
+  );
+}
+function parseNamedDate(value, flag) {
+  try {
+    return parseDateOption(value);
+  } catch (error) {
+    throw new CliUsageError(
+      `Invalid ${flag}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function parsePositiveInteger(value, flag) {
+  try {
+    const parsed = parseIntegerOption(value);
+    if (parsed <= 0) throw new CliUsageError("Expected a positive integer");
+    return parsed;
+  } catch (error) {
+    throw new CliUsageError(
+      `Invalid ${flag}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function addCrudMutationNodes(group, resource, request, operations) {
+  let create = group.command("create").description(`Create a ${resource} from structured flags`);
+  if (request.createOptions) create = request.createOptions(create);
+  create = addWriteOutput(addStructuredInputOptions(create));
+  create.action(
+    (opts) => runWrite(
+      create,
+      opts,
+      () => buildStructuredRequest(opts, request.createSchema, request.createFields),
+      (client, body) => operations.create(client, body)
+    )
+  );
+  let update = group.command("update <id>").description(`Update a ${resource} with structured flags`);
+  if (request.updateOptions) update = request.updateOptions(update);
+  update = addWriteOutput(addStructuredInputOptions(update));
+  update.action(
+    (id, opts) => runWrite(
+      update,
+      opts,
+      () => buildStructuredRequest(opts, request.updateSchema, request.updateFields),
+      (client, body) => operations.update(client, id, body)
+    )
+  );
+  const remove = addWriteOutput(
+    group.command("delete <id>").description("Permanently delete this resource").option("--force", "Skip confirmation prompt")
+  );
+  remove.action(
+    (id, opts) => runConfirmedWrite(
+      remove,
+      opts,
+      `Permanently delete ${resource} ${id}?`,
+      (client) => operations.delete(client, id)
+    )
+  );
+}
+function registerApiKeys(root) {
+  const apiKeys = showHelpOnEmpty(
+    root.command("api-keys").description("Manage service and user gateway credentials")
+  );
+  for (const kind of ["service", "user"]) {
+    const group = showHelpOnEmpty(apiKeys.command(kind).description(`Manage ${kind} API keys`));
+    const list = addReadOutput(
+      group.command("list").description(`List ${kind} API keys in a workspace (data plane)`).requiredOption("--workspace <uuid>", "Workspace UUID").option("--reveal-sensitive", "Show API key material")
+    );
+    list.action(
+      (opts) => runList(list, opts, `${kind} API keys`, async (client) => {
+        const result = await (kind === "service" ? client.apiKeys.listService({ workspaceId: opts.workspace }) : client.apiKeys.listUser({ workspaceId: opts.workspace }));
+        return opts.revealSensitive ? result : redactApiKeyMaterial(result);
+      })
+    );
+    const get = addReadOutput(
+      group.command("get <id>").description(`Get one ${kind} API key`).option("--reveal-sensitive", "Show API key material")
+    );
+    get.action(
+      (id, opts) => runDetail(get, opts, async (client) => {
+        const result = await (kind === "service" ? client.apiKeys.getService(id) : client.apiKeys.getUser(id));
+        return opts.revealSensitive ? result : redactApiKeyMaterial(result);
+      })
+    );
+    const createFields = [
+      { option: "alertEmails", path: "alert_emails", parse: parseCsvOption },
+      { option: "description", path: "description" },
+      { option: "expiresAt", path: "expires_at" },
+      { option: "name", path: "name" },
+      { option: "organisationId", path: "organisation_id" },
+      { option: "scopes", path: "scopes", parse: parseCsvOption },
+      { option: "type", path: "type" },
+      { option: "workspace", path: "workspace_id" },
+      ...kind === "user" ? [{ option: "userId", path: "user_id" }] : []
+    ];
+    let createCommand = group.command("create").description(`Create a ${kind} API key from structured flags`).option("--alert-emails <emails>", "Comma-separated alert email addresses").option("--description <text>", "Credential description").option("--expires-at <iso>", "Expiration as ISO-8601").option("--name <name>", "Credential name").option("--organisation-id <tsg>", "Numeric TSG id").option(
+      "--scopes <scopes>",
+      `Comma-separated scopes (known: ${knownValues(AI_GATEWAY_KNOWN_API_KEY_SCOPES)})`
+    ).option("--type <type>", "Credential type").option("--workspace <uuid>", "Workspace UUID").option("--secret-output <path>", "Write the one-time credential to a new 0600 file").option("--show-secret", "Print the one-time credential to stdout");
+    if (kind === "user") createCommand = createCommand.option("--user-id <uuid>", "User UUID");
+    const create = addWriteOutput(addStructuredInputOptions(createCommand));
+    create.action((opts) => {
+      if (kind === "service") {
+        return runSecretWrite(
+          create,
+          opts,
+          () => buildStructuredRequest(opts, GatewayServiceApiKeyCreateRequestSchema, createFields),
+          (client, body) => client.apiKeys.createService(body)
+        );
+      }
+      return runSecretWrite(
+        create,
+        opts,
+        () => buildStructuredRequest(opts, GatewayUserApiKeyCreateRequestSchema, createFields),
+        (client, body) => client.apiKeys.createUser(body)
+      );
+    });
+    const update = addWriteOutput(
+      addStructuredInputOptions(
+        group.command("update <id>").description(`Update a ${kind} API key with structured flags`).option("--alert-emails <emails>", "Comma-separated alert email addresses").option("--description <text>", "Credential description").option("--expires-at <iso>", "Expiration as ISO-8601").option("--name <name>", "Credential name").option("--reset-usage <boolean>", "Reset accumulated usage: true or false").option(
+          "--scopes <scopes>",
+          `Comma-separated scopes (known: ${knownValues(AI_GATEWAY_KNOWN_API_KEY_SCOPES)})`
+        )
+      )
+    );
+    update.action(
+      (id, opts) => runWrite(
+        update,
+        opts,
+        () => buildStructuredRequest(opts, GatewayApiKeyUpdateRequestSchema, [
+          { option: "alertEmails", path: "alert_emails", parse: parseCsvOption },
+          { option: "description", path: "description" },
+          { option: "expiresAt", path: "expires_at" },
+          { option: "name", path: "name" },
+          { option: "resetUsage", path: "reset_usage", parse: parseBooleanOption },
+          { option: "scopes", path: "scopes", parse: parseCsvOption }
+        ]),
+        (client, body) => kind === "service" ? client.apiKeys.updateService(id, body) : client.apiKeys.updateUser(id, body)
+      )
+    );
+    const remove = addWriteOutput(
+      group.command("delete <id>").description(`Revoke a ${kind} API key`).option("--force", "Skip confirmation prompt")
+    );
+    remove.action(
+      (id, opts) => runConfirmedWrite(
+        remove,
+        opts,
+        `Revoke ${kind} API key ${id}?`,
+        (client) => kind === "service" ? client.apiKeys.deleteService(id) : client.apiKeys.deleteUser(id)
+      )
+    );
+    const rotate = addWriteOutput(
+      group.command("rotate <id>").description(`Rotate a ${kind} API key`).option("--force", "Skip confirmation prompt").option("--secret-output <path>", "Write the one-time credential to a new 0600 file").option("--show-secret", "Print the one-time credential to stdout").option("--transition-ms <ms>", "Credential overlap in milliseconds")
+    );
+    rotate.action(
+      (id, opts) => runSecretWrite(
+        rotate,
+        opts,
+        () => buildStructuredRequest(opts, GatewayApiKeyRotateRequestSchema, [
+          {
+            option: "transitionMs",
+            path: "key_transition_period_ms",
+            parse: parseIntegerOption
+          }
+        ]),
+        (client, body) => kind === "service" ? client.apiKeys.rotateService(id, body) : client.apiKeys.rotateUser(id, body),
+        `Rotate ${kind} API key ${id}?`
+      )
+    );
+  }
+}
+function registerAuditLogs(root) {
+  const group = showHelpOnEmpty(
+    root.command("audit-logs").description("Inspect organisation audit activity")
+  );
+  const list = addReadOutput(
+    group.command("list").description("List audit activity for a UTC time window (admin plane)").option("--days <n>", "Rolling window in days", "7").option("--end <iso>", "Window end as ISO-8601").option("--reveal-sensitive", "Show sensitive request fields").option("--start <iso>", "Window start as ISO-8601")
+  );
+  list.action((opts) => {
+    return runList(list, opts, "audit logs", async (client) => {
+      const end = opts.end ? parseNamedDate(opts.end, "--end") : /* @__PURE__ */ new Date();
+      const start = opts.start ? parseNamedDate(opts.start, "--start") : new Date(end.getTime() - parsePositiveInteger(opts.days, "--days") * 864e5);
+      const result = await client.auditLogs.list({ start, end });
+      return opts.revealSensitive ? result : redactDeep(result);
+    });
+  });
+}
+function registerConfigs(root) {
+  const group = registerScopedReads(
+    root,
+    "configs",
+    "Manage routing configurations",
+    (client) => client.configs
+  );
+  const versions = addReadOutput(
+    group.command("versions <id>").description("List immutable config versions")
+  );
+  versions.action(
+    (id, opts) => runList(versions, opts, "config versions", (client) => client.configs.listVersions(id))
+  );
+  const commonFields = [
+    { option: "name", path: "name" },
+    { option: "workspace", path: "workspace_id" },
+    { option: "status", path: "status" }
+  ];
+  addCrudMutationNodes(
+    group,
+    "config",
+    {
+      createFields: commonFields,
+      createOptions: (command) => command.option("--name <name>", "Config name").option("--workspace <uuid>", "Workspace UUID"),
+      createSchema: GatewayConfigCreateRequestSchema,
+      updateFields: commonFields,
+      updateOptions: (command) => command.option("--name <name>", "New config name").option("--status <status>", "New config status").option("--workspace <uuid>", "New workspace UUID"),
+      updateSchema: GatewayConfigUpdateRequestSchema
+    },
+    {
+      create: (client, body) => client.configs.create(body),
+      delete: (client, id) => client.configs.delete(id),
+      update: (client, id, body) => client.configs.update(id, body)
+    }
+  );
+}
+function registerDeployments(root) {
+  const group = showHelpOnEmpty(
+    root.command("deployments").description("Manage self-hosted gateway registrations")
+  );
+  const list = addReadOutput(group.command("list").description("List deployments (admin plane)"));
+  list.action((opts) => runList(list, opts, "deployments", (client) => client.deployments.list()));
+  const get = addReadOutput(
+    group.command("get <id>").description("Get a deployment by UUID (admin plane)")
+  );
+  get.action((id, opts) => runDetail(get, opts, (client) => client.deployments.get(id)));
+  const ping = addReadOutput(
+    group.command("ping <id>").description("Run the optional control-plane ingress diagnostic")
+  );
+  ping.action((id, opts) => runDetail(ping, opts, (client) => client.deployments.ping(id)));
+  const archive = addWriteOutput(
+    group.command("archive <id>").description("Archive a deployment registration").requiredOption("--organisation-id <tsg>", "Numeric TSG id").option("--force", "Skip confirmation prompt")
+  );
+  archive.action(
+    (id, opts) => runConfirmedWrite(
+      archive,
+      opts,
+      `Archive deployment ${id}?`,
+      (client) => client.deployments.delete(id, opts.organisationId)
+    )
+  );
+  const create = addWriteOutput(
+    addStructuredInputOptions(
+      group.command("create").description("Register a self-hosted deployment from structured flags").option("--auth-settings <json>", "Deployment authentication settings object").option("--deployment-config <json>", "Deployment configuration object").option("--is-default <boolean>", "Make this the default deployment").option("--name <name>", "Deployment name").option("--organisation-id <tsg>", "Numeric TSG id").option("--slug <slug>", "Stable deployment slug").option("--type <type>", `Deployment type: ${knownValues(AI_GATEWAY_DEPLOYMENT_TYPES)}`).option("--secret-output <path>", "Write registration credentials to a new 0600 file").option("--show-secret", "Print registration credentials to stdout")
+    )
+  );
+  create.action(
+    (opts) => runSecretWrite(
+      create,
+      opts,
+      () => buildStructuredRequest(opts, GatewayDeploymentCreateRequestSchema, [
+        { option: "authSettings", path: "auth_settings", parse: parseJsonOption },
+        { option: "deploymentConfig", path: "deployment_config", parse: parseJsonOption },
+        { option: "isDefault", path: "is_default", parse: parseBooleanOption },
+        { option: "name", path: "name" },
+        { option: "organisationId", path: "organisation_id" },
+        { option: "slug", path: "slug" },
+        { option: "type", path: "type" }
+      ]),
+      (client, body) => client.deployments.create(body)
+    )
+  );
+  const update = addWriteOutput(
+    addStructuredInputOptions(
+      group.command("update <id>").description("Update a deployment registration with structured flags").option("--auth-settings <json>", "Deployment authentication settings object").option("--deployment-config <json>", "Deployment configuration object").option("--is-default <boolean>", "Make this the default deployment").option("--name <name>", "Deployment name").option("--override-existing <boolean>", "Override an existing registration").option("--rotate-auth <boolean>", "Rotate deployment authentication").option("--secret-output <path>", "Write rotated credentials to a new 0600 file").option("--show-secret", "Print rotated credentials to stdout").option(
+        "--status <status>",
+        `Deployment status: ${knownValues(AI_GATEWAY_DEPLOYMENT_STATUSES)}`
+      ).option("--type <type>", `Deployment type: ${knownValues(AI_GATEWAY_DEPLOYMENT_TYPES)}`)
+    )
+  );
+  update.action(
+    (id, opts) => runSecretWrite(
+      update,
+      opts,
+      () => buildStructuredRequest(opts, GatewayDeploymentUpdateRequestSchema, [
+        { option: "authSettings", path: "auth_settings", parse: parseJsonOption },
+        { option: "deploymentConfig", path: "deployment_config", parse: parseJsonOption },
+        { option: "isDefault", path: "is_default", parse: parseBooleanOption },
+        { option: "name", path: "name" },
+        { option: "overrideExisting", path: "override_existing", parse: parseBooleanOption },
+        { option: "rotateAuth", path: "rotate_auth", parse: parseBooleanOption },
+        { option: "status", path: "status" },
+        { option: "type", path: "type" }
+      ]),
+      (client, body) => client.deployments.update(id, body),
+      void 0,
+      {
+        requiresDestination: (body) => body.rotate_auth === true,
+        redactResponse: (result) => redactAIGatewaySecrets("deployments.update", result, "response")
+      }
+    )
+  );
+}
+function registerIntegrations(root) {
+  const group = showHelpOnEmpty(
+    root.command("integrations").description("Manage organisation provider integrations")
+  );
+  const list = addReadOutput(
+    group.command("list").description("List provider integrations (admin plane)")
+  );
+  list.action(
+    (opts) => runList(list, opts, "integrations", (client) => client.integrations.list())
+  );
+  const get = addReadOutput(
+    group.command("get <id>").description("Get a provider integration by UUID")
+  );
+  get.action((id, opts) => runDetail(get, opts, (client) => client.integrations.get(id)));
+  const integrationFields = [
+    { option: "aiProviderId", path: "ai_provider_id" },
+    { option: "configurations", path: "configurations", parse: parseJsonOption },
+    { option: "description", path: "description" },
+    { option: "key", path: "key" },
+    { option: "name", path: "name" },
+    { option: "organisationId", path: "organisation_id" },
+    { option: "secretMappings", path: "secret_mappings", parse: parseJsonOption },
+    { option: "slug", path: "slug" }
+  ];
+  const addIntegrationFields = (command) => command.option("--ai-provider-id <uuid>", "Provider catalog UUID").option("--configurations <json>", "Provider configuration object").option("--description <text>", "Integration description").option("--key <credential>", "Inline provider credential (prefer secret mappings)").option("--name <name>", "Integration name").option("--organisation-id <tsg>", "Numeric TSG id").option("--secret-mappings <json>", "Secret reference mapping array").option("--slug <slug>", "Stable integration slug");
+  const integrationUpdateFields = integrationFields.filter(
+    (field) => ["configurations", "description", "key", "name", "secretMappings"].includes(field.option)
+  );
+  const addIntegrationUpdateFields = (command) => command.option("--configurations <json>", "Provider configuration object").option("--description <text>", "Integration description").option("--key <credential>", "Inline provider credential (prefer secret mappings)").option("--name <name>", "Integration name").option("--secret-mappings <json>", "Secret reference mapping array");
+  const create = addWriteOutput(
+    addStructuredInputOptions(
+      addIntegrationFields(
+        group.command("create").description("Create an integration from structured flags")
+      )
+    )
+  );
+  create.action(
+    (opts) => runWrite(
+      create,
+      opts,
+      () => buildStructuredRequest(opts, GatewayIntegrationCreateRequestSchema, integrationFields),
+      (client, body) => client.integrations.create(body)
+    )
+  );
+  const update = addWriteOutput(
+    addStructuredInputOptions(
+      addIntegrationUpdateFields(
+        group.command("update <id>").description("Update an integration with structured flags")
+      )
+    )
+  );
+  update.action(
+    (id, opts) => runWrite(
+      update,
+      opts,
+      () => buildStructuredRequest(
+        opts,
+        GatewayIntegrationUpdateRequestSchema,
+        integrationUpdateFields
+      ),
+      (client, body) => client.integrations.update(id, body)
+    )
+  );
+  const remove = addWriteOutput(
+    group.command("delete <id>").description("Permanently delete this integration").requiredOption("--organisation-id <tsg>", "Numeric TSG id").option("--force", "Skip confirmation prompt")
+  );
+  remove.action(
+    (id, opts) => runConfirmedWrite(
+      remove,
+      opts,
+      `Permanently delete integration ${id}?`,
+      (client) => client.integrations.delete(id, opts.organisationId)
+    )
+  );
+  const models = showHelpOnEmpty(
+    group.command("models").description("Inspect or replace model bindings")
+  );
+  const modelsList = addReadOutput(
+    models.command("list <id>").description("List models for an integration")
+  );
+  modelsList.action(
+    (id, opts) => runList(modelsList, opts, "integration models", (client) => client.integrations.getModels(id))
+  );
+  const modelsSet = addWriteOutput(
+    addStructuredInputOptions(
+      models.command("set <id>").description("Replace model bindings").option("--allow-all-models <boolean>", "Allow every model: true or false").option("--model <slug=enabled>", "Model binding (repeatable)", collectOption).option("--force", "Skip confirmation prompt")
+    )
+  );
+  modelsSet.action(
+    (id, opts) => runConfirmedWrite(
+      modelsSet,
+      opts,
+      `Replace model bindings on ${id}?`,
+      () => buildStructuredRequest(opts, GatewayIntegrationModelsBulkUpdateRequestSchema, [
+        { option: "allowAllModels", path: "allow_all_models", parse: parseBooleanOption },
+        { option: "model", path: "models", parse: parseModelBindingsOption }
+      ]),
+      (client, body) => client.integrations.setModels(id, body)
+    )
+  );
+  const workspaces = showHelpOnEmpty(
+    group.command("workspaces").description("Inspect or replace workspace bindings")
+  );
+  const workspacesList = addReadOutput(
+    workspaces.command("list <id>").description("List workspace bindings")
+  );
+  workspacesList.action(
+    (id, opts) => runDetail(workspacesList, opts, (client) => client.integrations.getWorkspaces(id))
+  );
+  const workspacesSet = addWriteOutput(
+    addStructuredInputOptions(
+      workspaces.command("set <id>").description("Replace workspace bindings").option("--create-default-provider <boolean>", "Create defaults for new bindings").option("--default-provider-slug <slug>", "Default provider slug").option("--global-access <boolean>", "Enable or disable access to every workspace").option("--preserve-existing", "Preserve bindings not named by this command").option("--workspace-binding <id=enabled>", "Workspace binding (repeatable)", collectOption).option("--force", "Skip confirmation prompt")
+    )
+  );
+  workspacesSet.action(
+    (id, opts) => runConfirmedWrite(
+      workspacesSet,
+      opts,
+      `Replace workspace bindings on ${id}?`,
+      () => buildStructuredRequest(
+        {
+          ...opts,
+          overrideExistingWorkspaceAccess: !opts.preserveExisting
+        },
+        GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
+        [
+          {
+            option: "createDefaultProvider",
+            path: "create_default_provider",
+            parse: parseBooleanOption
+          },
+          { option: "defaultProviderSlug", path: "default_provider_slug" },
+          {
+            option: "globalAccess",
+            path: "global_workspace_access.enabled",
+            parse: parseBooleanOption
+          },
+          {
+            option: "overrideExistingWorkspaceAccess",
+            path: "override_existing_workspace_access",
+            parse: parseBooleanOption
+          },
+          { option: "workspaceBinding", path: "workspaces", parse: parseBooleanBindingsOption }
+        ]
+      ),
+      (client, body) => client.integrations.setWorkspaces(id, body)
+    )
+  );
+}
+function registerMcp(root) {
+  const mcp = showHelpOnEmpty(
+    root.command("mcp").description("Manage MCP integrations and servers")
+  );
+  const group = showHelpOnEmpty(
+    mcp.command("integrations").description("Manage MCP server integrations")
+  );
+  const list = addReadOutput(
+    group.command("list").description("List MCP integrations (admin plane)")
+  );
+  list.action(
+    (opts) => runList(list, opts, "MCP integrations", (client) => client.mcpIntegrations.list())
+  );
+  const get = addReadOutput(
+    group.command("get <id>").description("Get an MCP integration by UUID")
+  );
+  get.action((id, opts) => runDetail(get, opts, (client) => client.mcpIntegrations.get(id)));
+  const mcpFields = [
+    { option: "authType", path: "auth_type" },
+    { option: "configurations", path: "configurations", parse: parseJsonOption },
+    { option: "description", path: "description" },
+    { option: "name", path: "name" },
+    { option: "organisationId", path: "organisation_id" },
+    { option: "secretMappings", path: "secret_mappings", parse: parseJsonOption },
+    { option: "slug", path: "slug" },
+    { option: "transport", path: "transport" },
+    { option: "url", path: "url" }
+  ];
+  const addMcpFields = (command) => command.option(
+    "--auth-type <type>",
+    `Authentication type (known: ${knownValues(AI_GATEWAY_KNOWN_MCP_AUTH_TYPES)})`
+  ).option("--configurations <json>", "MCP authentication/configuration object").option("--description <text>", "Integration description").option("--name <name>", "Integration name").option("--organisation-id <tsg>", "Numeric TSG id").option("--secret-mappings <json>", "Secret reference mapping array").option("--slug <slug>", "Stable integration slug").option(
+    "--transport <transport>",
+    `Transport (known: ${knownValues(AI_GATEWAY_KNOWN_MCP_TRANSPORTS)})`
+  ).option("--url <url>", "MCP server URL");
+  const mcpUpdateFields = mcpFields.filter(
+    (field) => [
+      "authType",
+      "configurations",
+      "description",
+      "name",
+      "secretMappings",
+      "transport",
+      "url"
+    ].includes(field.option)
+  );
+  const addMcpUpdateFields = (command) => command.option(
+    "--auth-type <type>",
+    `Authentication type (known: ${knownValues(AI_GATEWAY_KNOWN_MCP_AUTH_TYPES)})`
+  ).option("--configurations <json>", "MCP authentication/configuration object").option("--description <text>", "Integration description").option("--name <name>", "Integration name").option("--secret-mappings <json>", "Secret reference mapping array").option(
+    "--transport <transport>",
+    `Transport (known: ${knownValues(AI_GATEWAY_KNOWN_MCP_TRANSPORTS)})`
+  ).option("--url <url>", "MCP server URL");
+  addCrudMutationNodes(
+    group,
+    "MCP integration",
+    {
+      createFields: mcpFields,
+      createOptions: addMcpFields,
+      createSchema: McpIntegrationCreateRequestSchema,
+      updateFields: mcpUpdateFields,
+      updateOptions: addMcpUpdateFields,
+      updateSchema: McpIntegrationUpdateRequestSchema
+    },
+    {
+      create: (client, body) => client.mcpIntegrations.create(body),
+      delete: (client, id) => client.mcpIntegrations.delete(id),
+      update: (client, id, body) => client.mcpIntegrations.update(id, body)
+    }
+  );
+  const capabilities = showHelpOnEmpty(
+    group.command("capabilities").description("Inspect or replace MCP capabilities")
+  );
+  const capabilitiesList = addReadOutput(
+    capabilities.command("list <id>").description("List discovered MCP capabilities")
+  );
+  capabilitiesList.action(
+    (id, opts) => runDetail(capabilitiesList, opts, (client) => client.mcpIntegrations.getCapabilities(id))
+  );
+  const capabilitiesSet = addWriteOutput(
+    addStructuredInputOptions(
+      capabilities.command("set <id>").description("Replace enabled MCP capabilities").option(
+        "--capability <type:name=enabled>",
+        `Capability binding (repeatable; type: ${knownValues(AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES)})`,
+        collectOption
+      ).option("--force", "Skip confirmation prompt")
+    )
+  );
+  capabilitiesSet.action(
+    (id, opts) => runConfirmedWrite(
+      capabilitiesSet,
+      opts,
+      `Replace enabled MCP capabilities on ${id}?`,
+      () => buildStructuredRequest(opts, McpIntegrationCapabilitiesBulkUpdateRequestSchema, [
+        { option: "capability", path: "capabilities", parse: parseCapabilityBindingsOption }
+      ]),
+      (client, body) => client.mcpIntegrations.setCapabilities(id, body)
+    )
+  );
+  const metadata = addReadOutput(
+    group.command("metadata <id>").description("Get discovered MCP metadata")
+  );
+  metadata.action(
+    (id, opts) => runDetail(metadata, opts, (client) => client.mcpIntegrations.getMetadata(id))
+  );
+  const workspaces = showHelpOnEmpty(
+    group.command("workspaces").description("Inspect or replace MCP workspace access")
+  );
+  const workspacesList = addReadOutput(
+    workspaces.command("list <id>").description("Read workspace access from integration detail")
+  );
+  workspacesList.action(
+    (id, opts) => runDetail(workspacesList, opts, (client) => client.mcpIntegrations.get(id))
+  );
+  const workspacesSet = addWriteOutput(
+    addStructuredInputOptions(
+      workspaces.command("set <id>").description("Replace MCP workspace access").option("--global-access <boolean>", "Enable or disable access to every workspace").option("--preserve-existing", "Preserve bindings not named by this command").option("--workspace-binding <id=enabled>", "Workspace binding (repeatable)", collectOption).option("--force", "Skip confirmation prompt")
+    )
+  );
+  workspacesSet.action(
+    (id, opts) => runConfirmedWrite(
+      workspacesSet,
+      opts,
+      `Replace MCP workspace access on ${id}?`,
+      () => buildStructuredRequest(
+        {
+          ...opts,
+          overrideExistingWorkspaceAccess: !opts.preserveExisting
+        },
+        McpIntegrationWorkspacesBulkUpdateRequestSchema,
+        [
+          {
+            option: "globalAccess",
+            path: "global_workspace_access.enabled",
+            parse: parseBooleanOption
+          },
+          {
+            option: "overrideExistingWorkspaceAccess",
+            path: "override_existing_workspace_access",
+            parse: parseBooleanOption
+          },
+          { option: "workspaceBinding", path: "workspaces", parse: parseBooleanBindingsOption }
+        ]
+      ),
+      (client, body) => client.mcpIntegrations.setWorkspaces(id, body)
+    )
+  );
+}
+function registerOrganisations(root) {
+  const group = showHelpOnEmpty(
+    root.command("organisations").description("Manage organisation and authentication settings")
+  );
+  const self = showHelpOnEmpty(
+    group.command("self").description("Manage the current organisation")
+  );
+  const selfGet = addReadOutput(self.command("get").description("Get the current organisation"));
+  selfGet.action((opts) => runDetail(selfGet, opts, (client) => client.organisations.getSelf()));
+  const selfUpdate = addWriteOutput(
+    addStructuredInputOptions(
+      self.command("update").description("Update the current organisation with structured flags").option("--name <name>", "Organisation name")
+    )
+  );
+  selfUpdate.action(
+    (opts) => runWrite(
+      selfUpdate,
+      opts,
+      () => buildStructuredRequest(opts, GatewayOrganisationUpdateRequestSchema, [
+        { option: "name", path: "name" }
+      ]),
+      (client, body) => client.organisations.updateSelf(body)
+    )
+  );
+  const auth = showHelpOnEmpty(
+    group.command("auth-settings").description("Manage organisation authentication settings")
+  );
+  const authGet = addReadOutput(
+    auth.command("get").description("Get authentication settings").requiredOption("--tsg-id <tsg>", "Numeric TSG id").option("--reveal-sensitive", "Show SCIM and authentication secrets")
+  );
+  authGet.action(
+    (opts) => runDetail(authGet, opts, async (client) => {
+      const result = await client.organisations.getAuthSettings(opts.tsgId);
+      return opts.revealSensitive ? result : redactAIGatewaySecrets("organisations.getAuthSettings", result, "response");
+    })
+  );
+  const authUpdate = addWriteOutput(
+    addStructuredInputOptions(
+      auth.command("update").description("Update authentication settings with structured flags").requiredOption("--tsg-id <tsg>", "Numeric TSG id").option("--auth-settings <json>", "Authentication settings object").option("--domains <domains>", "Comma-separated allowed domains").option("--scim-token <token>", "SCIM token")
+    )
+  );
+  authUpdate.action(
+    (opts) => runWrite(
+      authUpdate,
+      opts,
+      () => buildStructuredRequest(opts, GatewayOrganisationAuthSettingsUpdateRequestSchema, [
+        { option: "authSettings", path: "auth_settings", parse: parseJsonOption },
+        { option: "domains", path: "domains", parse: parseCsvOption },
+        { option: "scimToken", path: "scim_token" }
+      ]),
+      (client, body) => client.organisations.updateAuthSettings(opts.tsgId, body)
+    )
+  );
+}
+function registerPlugins(root) {
+  const group = showHelpOnEmpty(root.command("plugins").description("Manage gateway plugins"));
+  const list = addReadOutput(group.command("list").description("List installed gateway plugins"));
+  list.action((opts) => runList(list, opts, "plugins", (client) => client.plugins.list()));
+  const create = addWriteOutput(
+    addStructuredInputOptions(
+      group.command("create").description("Install a gateway plugin from structured flags").option(
+        "--credential <key=value>",
+        "Plugin credential (repeatable; treated as sensitive)",
+        collectOption
+      ).option("--integration-id <uuid>", "Integration UUID").option("--organisation-id <tsg>", "Numeric TSG id")
+    )
+  );
+  create.action(
+    (opts) => runWrite(
+      create,
+      opts,
+      () => buildStructuredRequest(opts, GatewayPluginCreateRequestSchema, [
+        { option: "credential", path: "credentials", parse: parseStringMapOption },
+        { option: "integrationId", path: "integration_id" },
+        { option: "organisationId", path: "organisation_id" }
+      ]),
+      (client, body) => client.plugins.create(body)
+    )
+  );
+}
+function registerAiGatewayInventory(root) {
+  registerApiKeys(root);
+  registerAuditLogs(root);
+  registerConfigs(root);
+  registerDeployments(root);
+  const guardrails = registerScopedReads(
+    root,
+    "guardrails",
+    "Manage workspace guardrails",
+    (client) => client.guardrails
+  );
+  const guardrailFields = [
+    { option: "actions", path: "actions", parse: parseJsonOption },
+    { option: "checks", path: "checks", parse: parseJsonOption },
+    { option: "name", path: "name" },
+    { option: "workspace", path: "workspace_id" }
+  ];
+  const addGuardrailFields = (command) => command.option("--actions <json>", "Guardrail actions object").option("--checks <json>", "Guardrail checks array").option("--name <name>", "Guardrail name").option("--workspace <uuid>", "Workspace UUID");
+  const guardrailUpdateFields = guardrailFields.filter((field) => field.option !== "workspace");
+  const addGuardrailUpdateFields = (command) => command.option("--actions <json>", "Guardrail actions object").option("--checks <json>", "Guardrail checks array").option("--name <name>", "Guardrail name");
+  addCrudMutationNodes(
+    guardrails,
+    "guardrail",
+    {
+      createFields: guardrailFields,
+      createOptions: addGuardrailFields,
+      createSchema: GatewayGuardrailCreateRequestSchema,
+      updateFields: guardrailUpdateFields,
+      updateOptions: addGuardrailUpdateFields,
+      updateSchema: GatewayGuardrailUpdateRequestSchema
+    },
+    {
+      create: (client, body) => client.guardrails.create(body),
+      delete: (client, id) => client.guardrails.delete(id),
+      update: (client, id, body) => client.guardrails.update(id, body)
+    }
+  );
+  registerIntegrations(root);
+  registerMcp(root);
+  registerOrganisations(root);
+  registerPlugins(root);
+  const providers = registerScopedReads(
+    root,
+    "providers",
+    "Manage workspace provider bindings",
+    (client) => client.providers,
+    { sensitiveDetail: true, sensitiveOperation: "providers.get" }
+  );
+  const providerFields = [
+    { option: "aiProviderId", path: "ai_provider_id" },
+    { option: "expiresAt", path: "expires_at" },
+    { option: "integrationId", path: "integration_id" },
+    { option: "name", path: "name" },
+    { option: "note", path: "note" },
+    { option: "rateLimit", path: "rate_limits", parse: parseJsonOption },
+    { option: "resetUsage", path: "reset_usage", parse: parseBooleanOption },
+    { option: "slug", path: "slug" },
+    { option: "usageLimit", path: "usage_limits", parse: parseJsonOption },
+    { option: "workspace", path: "workspace_id" }
+  ];
+  const addProviderFields = (command) => command.option("--ai-provider-id <uuid>", "Provider catalog UUID").option("--expires-at <iso>", "Expiration as ISO-8601").option("--integration-id <uuid>", "Organisation integration UUID").option("--name <name>", "Provider binding name").option("--note <text>", "Operator note").option("--rate-limit <json>", "Rate-limit object").option("--reset-usage <boolean>", "Reset accumulated usage: true or false").option("--slug <slug>", "Provider binding slug").option("--usage-limit <json>", "Usage-limit object").option("--workspace <uuid>", "Workspace UUID");
+  const providerUpdateFields = providerFields.filter(
+    (field) => ["expiresAt", "name", "note", "rateLimit", "resetUsage", "usageLimit"].includes(field.option)
+  );
+  const addProviderUpdateFields = (command) => command.option("--expires-at <iso>", "Expiration as ISO-8601").option("--name <name>", "Provider binding name").option("--note <text>", "Operator note").option("--rate-limit <json>", "Rate-limit object").option("--reset-usage <boolean>", "Reset accumulated usage: true or false").option("--usage-limit <json>", "Usage-limit object");
+  addCrudMutationNodes(
+    providers,
+    "provider",
+    {
+      createFields: providerFields,
+      createOptions: addProviderFields,
+      createSchema: GatewayProviderCreateRequestSchema,
+      updateFields: providerUpdateFields,
+      updateOptions: addProviderUpdateFields,
+      updateSchema: GatewayProviderUpdateRequestSchema
+    },
+    {
+      create: (client, body) => client.providers.create(body),
+      delete: (client, id) => client.providers.delete(id),
+      update: (client, id, body) => client.providers.update(id, body)
+    }
+  );
+}
+
+// src/cli/commands/aigateway/telemetry.ts
+function addWindowOptions(command) {
+  return addReadOutput(
+    command.requiredOption("--workspace <slug>", "Workspace slug").option("--days <n>", "Rolling window in days", "7").option("--end <iso>", "Window end as ISO-8601").option("--start <iso>", "Window start as ISO-8601")
+  );
+}
+function windowFrom(opts) {
+  const window = { workspaceSlug: opts.workspace };
+  if (opts.start) window.start = parseNamedDate2(opts.start, "--start");
+  else window.days = parsePositiveInteger2(opts.days ?? "7", "--days");
+  if (opts.end) window.end = parseNamedDate2(opts.end, "--end");
+  return window;
+}
+function parsePositiveInteger2(value, flag) {
+  try {
+    const parsed = parseIntegerOption(value);
+    if (parsed <= 0) throw new CliUsageError("Expected a positive integer");
+    return parsed;
+  } catch (error) {
+    if (error instanceof CliUsageError)
+      throw new CliUsageError(`Invalid ${flag}: ${error.message}`);
+    throw error;
   }
-  const prompt = options.promptFn ?? (await import("@inquirer/prompts")).confirm;
-  const confirmed = await prompt({ message, default: false });
-  if (!confirmed) {
-    ui.info("Aborted");
-    process.exit(0);
+}
+function parseNamedDate2(value, flag) {
+  try {
+    return parseDateOption(value);
+  } catch (error) {
+    if (error instanceof CliUsageError)
+      throw new CliUsageError(`Invalid ${flag}: ${error.message}`);
+    throw error;
   }
 }
-
-// src/cli/examples.ts
-function examples(...lines) {
-  return `
-Examples:
-${lines.map((l) => `  $ ${l}`).join("\n")}
-`;
+function registerMetric(telemetry, name, description, method) {
+  const command = addWindowOptions(telemetry.command(name).description(description));
+  command.action(
+    (opts) => runDetail(command, opts, (client) => client.telemetry[method](windowFrom(opts)))
+  );
+}
+function registerAiGatewayTelemetryReads(telemetry) {
+  const cache = showHelpOnEmpty(telemetry.command("cache").description("Inspect cache telemetry"));
+  const cacheSummary = addWindowOptions(cache.command("summary").description("Get cache totals"));
+  cacheSummary.action(
+    (opts) => runDetail(cacheSummary, opts, (client) => client.telemetry.cacheSummary(windowFrom(opts)))
+  );
+  const cacheTrend = addWindowOptions(cache.command("trend").description("Get cache-hit trend"));
+  cacheTrend.action(
+    (opts) => runDetail(cacheTrend, opts, (client) => client.telemetry.cacheHitTrend(windowFrom(opts)))
+  );
+  registerMetric(telemetry, "error-trends", "Get error trends", "errorTrends");
+  registerMetric(telemetry, "errors", "Get error count", "errors");
+  const feedback = showHelpOnEmpty(
+    telemetry.command("feedback").description("Inspect model feedback telemetry")
+  );
+  const feedbackMethods = {
+    distribution: "feedbackScoreDistribution",
+    models: "feedbackModels",
+    trend: "feedbackTrend",
+    weighted: "feedbackWeighted"
+  };
+  for (const [name, method] of Object.entries(feedbackMethods)) {
+    const command = addWindowOptions(feedback.command(name).description(`Get feedback ${name}`));
+    command.action(
+      (opts) => runDetail(command, opts, (client) => client.telemetry[method](windowFrom(opts)))
+    );
+  }
+  const groupBy = addWindowOptions(
+    telemetry.command("group-by <dimension>").description("Aggregate telemetry by provider, model, status, or another SDK dimension").option("--columns <names>", "Comma-separated aggregate columns")
+  );
+  groupBy.action(
+    (dimension, opts) => runDetail(
+      groupBy,
+      opts,
+      (client) => client.telemetry.groupBy(dimension, {
+        ...windowFrom(opts),
+        ...opts.columns ? { columns: opts.columns.split(",").map((value) => value.trim()) } : {}
+      })
+    )
+  );
+  registerMetric(telemetry, "latency", "Get latency telemetry", "latency");
+  const logs = showHelpOnEmpty(telemetry.command("logs").description("Inspect request logs"));
+  const logsList = addWindowOptions(
+    logs.command("list").description("List request logs").option("--page-size <n>", "Rows per response", "50").option("--status-code <code>", "Filter by HTTP status").option("--trace-id <id>", "Return one trace id")
+  );
+  logsList.action(
+    (opts) => runDetail(
+      logsList,
+      opts,
+      (client) => client.telemetry.logs({
+        ...windowFrom(opts),
+        pageSize: parsePositiveInteger2(opts.pageSize ?? "50", "--page-size"),
+        ...opts.statusCode ? { statusCode: parsePositiveInteger2(opts.statusCode, "--status-code") } : {},
+        ...opts.traceId ? { traceId: opts.traceId } : {}
+      })
+    )
+  );
+  registerMetric(telemetry, "requests", "Get request count", "requests");
+  registerMetric(telemetry, "rescued-retries", "Get rescued retry telemetry", "rescuedRetries");
+  registerMetric(telemetry, "tokens", "Get token usage", "tokens");
+  registerMetric(telemetry, "user-trends", "Get user trends", "userTrends");
+  registerMetric(telemetry, "users", "Get unique-user count", "users");
 }
 
 // src/cli/commands/aigateway.ts
@@ -3001,18 +4513,18 @@ function buildWorkspaceWriteRequest(opts) {
   const defaults = parseJsonFlag(opts.defaults, "--defaults");
   const metadata = parseJsonFlag(opts.metadata, "--metadata");
   if (defaults !== void 0 || metadata !== void 0) {
-    out.defaults = {
+    out.defaults = GatewayDefaultsInputSchema.parse({
       ...typeof defaults === "object" && defaults !== null ? defaults : {},
       ...metadata !== void 0 ? { metadata } : {}
-    };
+    });
   }
   if (opts.users !== void 0) {
     out.users = opts.users.split(",").map((u) => u.trim()).filter(Boolean);
   }
   const usage = parseJsonFlag(opts.usageLimits, "--usage-limits");
-  if (usage !== void 0) out.usageLimits = usage;
+  if (usage !== void 0) out.usageLimits = GatewayUsageLimitInputSchema.array().parse(usage);
   const rate = parseJsonFlag(opts.rateLimits, "--rate-limits");
-  if (rate !== void 0) out.rateLimits = rate;
+  if (rate !== void 0) out.rateLimits = GatewayRateLimitInputSchema.array().parse(rate);
   return out;
 }
 function scopeNameLooksUnrelated(name, scopeName) {
@@ -3021,15 +4533,16 @@ function scopeNameLooksUnrelated(name, scopeName) {
   return !scopeName.toLowerCase().replace(/[^a-z0-9]/g, "").includes(nameToken);
 }
 function registerAiGatewayCommand(program) {
-  const aigateway = program.command("aigateway").description("AI Gateway operations");
-  const workspace = aigateway.command("workspace").description("Manage AI Gateway workspaces");
+  const aigateway = program.command("aigateway").description("Manage and observe Prisma AIRS AI Gateway resources").action(() => aigateway.outputHelp());
+  registerAiGatewayInventory(aigateway);
+  const workspace = aigateway.command("workspaces").alias("workspace").description("Manage gateway workspaces").action(() => workspace.outputHelp());
   const workspaceList = workspace.command("list").description("List workspaces (default: active workspaces you are scoped to)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--status <status>", "Filter by lifecycle state: active or archived").option("--all", "Merge active + archived admin-plane reads (whole tenant, both states)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples(
-      "airs aigateway workspace list",
-      "airs aigateway workspace list --plane admin",
-      "airs aigateway workspace list --plane admin --status archived",
-      "airs aigateway workspace list --all --output json"
+      "airs aigateway workspaces list",
+      "airs aigateway workspaces list --plane admin",
+      "airs aigateway workspaces list --plane admin --status archived",
+      "airs aigateway workspaces list --all --output json"
     )
   ).action(async (opts) => {
     try {
@@ -3057,8 +4570,8 @@ function registerAiGatewayCommand(program) {
   const workspaceGet = workspace.command("get <ref>").description("Get one workspace by UUID or slug (includes settings blocks)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples(
-      "airs aigateway workspace get ws-main-a-349e0e",
-      "airs aigateway workspace get 16f7e90d-382a-4e78-b577-1b01eb5f8297 --plane admin --output json"
+      "airs aigateway workspaces get ws-main-a-349e0e",
+      "airs aigateway workspaces get 16f7e90d-382a-4e78-b577-1b01eb5f8297 --plane admin --output json"
     )
   ).action(async (ref, opts) => {
     try {
@@ -3081,8 +4594,8 @@ function registerAiGatewayCommand(program) {
   ).option("--description <text>", "Workspace description").option("--icon <icon>", "Workspace icon").option("--metadata <json>", "Sugar for defaults.metadata (flat string map)").option("--defaults <json>", "Workspace defaults object").option("--users <ids>", "Comma-separated user ids to seed the workspace with").option("--usage-limits <json>", "Usage-limit policies \u2014 a JSON ARRAY of policy objects").option("--rate-limits <json>", "Rate-limit policies \u2014 a JSON ARRAY of policy objects").option("--output <format>", "Output format: pretty, json, yaml", "pretty").addHelpText(
     "after",
     examples(
-      "airs aigateway workspace create --name Production --scope-name ws_production_bx7qw0",
-      `airs aigateway workspace create --name Production --scope-name ws_production_bx7qw0 --metadata '{"env":"production"}' --rate-limits '[{"type":"requests","unit":"rpm","value":100}]'`
+      "airs aigateway workspaces create --name Production --scope-name ws_production_bx7qw0",
+      `airs aigateway workspaces create --name Production --scope-name ws_production_bx7qw0 --metadata '{"env":"production"}' --rate-limits '[{"type":"requests","unit":"rpm","value":100}]'`
     )
   ).action(async (opts) => {
     try {
@@ -3108,7 +4621,7 @@ function registerAiGatewayCommand(program) {
   workspace.command("update <ref>").description("Update a workspace (admin plane, partial patch)").option("--name <name>", "New display name").option("--description <text>", "New description").option("--icon <icon>", "New icon").option("--metadata <json>", "Sugar for defaults.metadata (flat string map)").option("--defaults <json>", "Workspace defaults object").option("--usage-limits <json>", "Usage-limit policies \u2014 a JSON ARRAY of policy objects").option("--rate-limits <json>", "Rate-limit policies \u2014 a JSON ARRAY of policy objects").option("--output <format>", "Output format: pretty, json, yaml", "pretty").addHelpText(
     "after",
     examples(
-      `airs aigateway workspace update ws-produc-985697 --description 'Production workloads, us-east'`
+      `airs aigateway workspaces update ws-produc-985697 --description 'Production workloads, us-east'`
     )
   ).action(async (ref, opts) => {
     try {
@@ -3128,9 +4641,14 @@ function registerAiGatewayCommand(program) {
       failWithGrantHint(err);
     }
   });
-  workspace.command("delete <ref>").description("Archive a workspace (soft delete \u2014 there is no hard delete)").option("--force", "Skip confirmation prompt").addHelpText("after", examples("airs aigateway workspace delete ws-produc-985697 --force")).action(async (ref, opts) => {
+  const archiveWorkspace = async (ref, opts, deprecated) => {
     try {
       renderAiGatewayHeader();
+      if (deprecated) {
+        ui.warn(
+          "`aigateway workspace delete` is deprecated because this operation archives; use `aigateway workspaces archive`."
+        );
+      }
       await confirmOrAbort(
         `Archive workspace ${ref}? (soft delete \u2014 the row remains under --status archived)`,
         Boolean(opts.force),
@@ -3140,13 +4658,16 @@ function registerAiGatewayCommand(program) {
       await service.deleteWorkspace(ref);
       ui.success(`Workspace archived: ${ref}`);
       ui.status(
-        "This is a soft delete \u2014 the workspace remains visible via `workspace list --plane admin --status archived`. A `get` on it now answers 404; that is expected."
+        "This is a soft delete \u2014 the workspace remains visible via `workspaces list --plane admin --status archived`. A `get` on it now answers 404; that is expected."
       );
     } catch (err) {
       failWithGrantHint(err);
     }
-  });
-  const telemetry = aigateway.command("telemetry").description("AI Gateway runtime telemetry (data plane)");
+  };
+  workspace.command("archive <ref>").description("Archive a workspace (soft delete \u2014 there is no hard delete)").option("--force", "Skip confirmation prompt").addHelpText("after", examples("airs aigateway workspaces archive ws-produc-985697 --force")).action((ref, opts) => archiveWorkspace(ref, opts, false));
+  workspace.command("delete <ref>", { hidden: true }).description("Deprecated compatibility command for archive").option("--force", "Skip confirmation prompt").action((ref, opts) => archiveWorkspace(ref, opts, true));
+  const telemetry = aigateway.command("telemetry").description("AI Gateway runtime telemetry (data plane)").action(() => telemetry.outputHelp());
+  registerAiGatewayTelemetryReads(telemetry);
   const cost = telemetry.command("cost").description(
     "Total and per-day spend for a workspace (API reports cents; pretty output shows dollars)"
   ).requiredOption("--workspace <slug>", "Workspace slug (not UUID), e.g. ws-main-a-349e0e").option("--days <n>", "Rolling window in days, counted back from now", "7").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
@@ -3292,8 +4813,8 @@ function registerCompletionCommand(program) {
 }
 
 // src/cli/commands/config.ts
-import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname } from "path";
+import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
+import { dirname as dirname2 } from "path";
 var CONFIG_KEYS = Object.keys(ConfigSchema.shape);
 var SECRET_PATTERN = /key|secret|token|password/i;
 function isKnownKey(key) {
@@ -3316,7 +4837,7 @@ function buildConfigRows(inspected, reveal) {
 async function readConfigFileStrict(filePath) {
   let raw;
   try {
-    raw = await readFile(filePath, "utf-8");
+    raw = await readFile2(filePath, "utf-8");
   } catch {
     return { ok: true, data: {} };
   }
@@ -3341,7 +4862,7 @@ async function setConfigValue(filePath, key, value) {
   }
   const coerced = result.data[key];
   const next = { ...read.data, [key]: coerced };
-  await mkdir(dirname(filePath), { recursive: true });
+  await mkdir(dirname2(filePath), { recursive: true });
   await writeFile(filePath, `${JSON.stringify(next, null, 2)}
 `, "utf-8");
   return { ok: true, value: coerced };
@@ -3452,7 +4973,7 @@ function registerConfigCommand(program) {
 
 // src/cli/commands/doctor.ts
 import { randomUUID } from "crypto";
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile3 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
 var DOCTOR_TIMEOUT_MS = 5e3;
 var MIN_NODE_MAJOR = 20;
@@ -3472,7 +4993,7 @@ async function checkConfigFile(filePath) {
   const name = "Config file";
   let raw;
   try {
-    raw = await readFile2(filePath, "utf-8");
+    raw = await readFile3(filePath, "utf-8");
   } catch {
     return {
       name,
@@ -5634,8 +7155,8 @@ function registerRedteamCommand(program) {
 // src/cli/commands/runtime.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import * as fs5 from "fs";
-import { readFile as readFile8 } from "fs/promises";
-import { basename as basename3, dirname as dirname2, join as join2, resolve as resolvePath } from "path";
+import { readFile as readFile9 } from "fs/promises";
+import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
 import chalk11 from "chalk";
 
 // src/cli/builders/profile-builder.ts
@@ -6313,7 +7834,7 @@ var topicsView = {
 };
 
 // src/cli/commands/dlp/dictionaries.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 import { basename as basename2 } from "path";
 
 // src/airs/dlp/dictionaries.ts
@@ -6352,7 +7873,7 @@ var SdkDictionariesService = class {
 };
 
 // src/cli/commands/dlp/patch.ts
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 function buildMergePatch(opts) {
   const out = {};
   for (const entry of opts.set ?? []) {
@@ -6394,7 +7915,7 @@ function coerceValue(raw) {
 async function parseBody(opts) {
   let raw;
   if (opts.bodyFile) {
-    raw = await readFile5(opts.bodyFile, "utf-8");
+    raw = await readFile6(opts.bodyFile, "utf-8");
   } else if (opts.body === "-") {
     const chunks = [];
     for await (const chunk of opts.stdin ?? process.stdin) {
@@ -6415,7 +7936,7 @@ async function parseBody(opts) {
 // src/cli/commands/dlp/dictionaries.ts
 async function buildMetadata(opts) {
   if (opts.metadataFile) {
-    return JSON.parse(await readFile6(opts.metadataFile, "utf-8"));
+    return JSON.parse(await readFile7(opts.metadataFile, "utf-8"));
   }
   if (!opts.name || !opts.category || !opts.region || !opts.file) {
     throw new Error("--name, --category, --region, and --file are required");
@@ -6460,7 +7981,7 @@ function register(dlp) {
     try {
       const metadata = await buildMetadata(opts);
       if (!opts.file) throw new Error("--file is required (multipart upload)");
-      const file = await readFile6(opts.file);
+      const file = await readFile7(opts.file);
       const r = await new SdkDictionariesService().create({
         metadata,
         file,
@@ -6488,7 +8009,7 @@ function register(dlp) {
     try {
       const metadata = await buildMetadata(opts);
       if (!opts.file) throw new Error("--file is required (multipart upload)");
-      const file = await readFile6(opts.file);
+      const file = await readFile7(opts.file);
       const r = await new SdkDictionariesService().replace(id, {
         metadata,
         file,
@@ -7308,7 +8829,7 @@ function registerCreateCommand(parent) {
 }
 
 // src/cli/commands/topics-eval.ts
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 
 // src/core/prompt-loader.ts
 function parseCsvLine(line) {
@@ -7451,7 +8972,7 @@ function registerEvalCommand(parent) {
     resolveDeprecatedAliases(cmd, opts);
     try {
       const config = await loadConfig();
-      const csvContent = await readFile7(opts.prompts, "utf-8");
+      const csvContent = await readFile8(opts.prompts, "utf-8");
       const { cases, intent } = loadPrompts(csvContent, (msg) => ui.status(`Warning: ${msg}`));
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
@@ -7622,7 +9143,7 @@ function completedBulkResults(state) {
   return state.items.flatMap((item) => item.result ? [item.result] : []).sort((left, right) => left.index - right.index);
 }
 async function writeBulkResults(outputPath, results) {
-  await fs5.promises.mkdir(dirname2(outputPath), { recursive: true });
+  await fs5.promises.mkdir(dirname3(outputPath), { recursive: true });
   const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID4()}`;
   try {
     await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
@@ -7640,10 +9161,10 @@ function isDefiniteSubmissionRejection(error) {
   const metadata = error;
   return metadata?.failureKind === "http" && typeof metadata.statusCode === "number" && metadata.statusCode >= 400 && metadata.statusCode < 500;
 }
-function parsePositiveInteger(value, optionName) {
+function parsePositiveInteger3(value, optionName2) {
   const parsed = Number(value);
   if (!/^[1-9]\d*$/.test(value) || !Number.isSafeInteger(parsed)) {
-    usageError(`${optionName} must be a positive integer`);
+    usageError(`${optionName2} must be a positive integer`);
   }
   return parsed;
 }
@@ -7746,14 +9267,14 @@ function registerRuntimeCommand(program) {
     if (!opts.file) {
       usageError("--file <file> is required");
     }
-    const batchSize = parsePositiveInteger(opts.batchSize, "--batch-size");
+    const batchSize = parsePositiveInteger3(opts.batchSize, "--batch-size");
     let releaseJobLock;
     try {
       const config = await loadConfig({});
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
       }
-      const raw = await readFile8(opts.file, "utf-8");
+      const raw = await readFile9(opts.file, "utf-8");
       const prompts = parseInputFile(raw, opts.file);
       if (prompts.length === 0) {
         usageError("No prompts found in input file");
@@ -7763,7 +9284,7 @@ function registerRuntimeCommand(program) {
         opts.outputFile ?? `${opts.profile.replace(/\s+/g, "-")}-bulk-scan.csv`
       );
       const stateDir = resolvePath(
-        basename3(config.dataDir) === "runs" ? join2(dirname2(config.dataDir), "bulk-scans") : join2(config.dataDir, "bulk-scans")
+        basename3(config.dataDir) === "runs" ? join3(dirname3(config.dataDir), "bulk-scans") : join3(config.dataDir, "bulk-scans")
       );
       const createdAt = (/* @__PURE__ */ new Date()).toISOString();
       const state = {
@@ -8202,7 +9723,7 @@ function registerRuntimeCommand(program) {
       );
       const outputPath = resolvePath(opts.outputFile ?? state.outputFile);
       state.outputFile = outputPath;
-      await saveBulkScanState(state, dirname2(stateFile), stateFile);
+      await saveBulkScanState(state, dirname3(stateFile), stateFile);
       const pollSubmitted = async (items) => {
         for (const batch of submittedBatches(items)) {
           const results2 = await service.pollBatch(batch, void 0, {
@@ -8211,12 +9732,12 @@ function registerRuntimeCommand(program) {
             },
             onProgress: async (progress) => {
               recordBulkResults(state, progress);
-              await saveBulkScanState(state, dirname2(stateFile), stateFile);
+              await saveBulkScanState(state, dirname3(stateFile), stateFile);
               await writeBulkResults(outputPath, completedBulkResults(state));
             }
           });
           recordBulkResults(state, results2);
-          await saveBulkScanState(state, dirname2(stateFile), stateFile);
+          await saveBulkScanState(state, dirname3(stateFile), stateFile);
           await writeBulkResults(outputPath, completedBulkResults(state));
         }
       };
@@ -8240,7 +9761,7 @@ function registerRuntimeCommand(program) {
         for (let start = 0; start < pendingItems.length; start += SDK_ASYNC_BATCH_SIZE) {
           const chunk = pendingItems.slice(start, start + SDK_ASYNC_BATCH_SIZE);
           for (const item of chunk) item.status = "submitting";
-          await saveBulkScanState(state, dirname2(stateFile), stateFile);
+          await saveBulkScanState(state, dirname3(stateFile), stateFile);
           try {
             const batch = await service.submitBatch(state.profile, chunk, state.sessionId, {
               onRetry: (attempt, delayMs) => {
@@ -8256,19 +9777,19 @@ function registerRuntimeCommand(program) {
               item.receiptReportId = batch.reportId;
               item.error = void 0;
             }
-            await saveBulkScanState(state, dirname2(stateFile), stateFile);
+            await saveBulkScanState(state, dirname3(stateFile), stateFile);
           } catch (error) {
             for (const item of chunk) {
               item.status = isDefiniteSubmissionRejection(error) ? "pending" : "ambiguous";
               item.error = error instanceof Error ? error.message : String(error);
             }
-            await saveBulkScanState(state, dirname2(stateFile), stateFile);
+            await saveBulkScanState(state, dirname3(stateFile), stateFile);
             throw error;
           }
         }
         await pollSubmitted(logicalBatch);
       }
-      await saveBulkScanState(state, dirname2(stateFile), stateFile);
+      await saveBulkScanState(state, dirname3(stateFile), stateFile);
       const results = completedBulkResults(state);
       await writeBulkResults(outputPath, results);
       const blocked = results.filter((r) => r.action === "block").length;
@@ -8421,185 +9942,6 @@ function registerRuntimeCommand(program) {
   registerDlpCommands(runtime);
 }
 
-// src/cli/debug-logger.ts
-import {
-  appendFileSync,
-  mkdirSync,
-  readdirSync,
-  statSync,
-  unlinkSync,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { dirname as dirname3, join as join3 } from "path";
-var AIRS_DOMAINS = [
-  "api.sase.paloaltonetworks.com",
-  "service.api.aisecurity.paloaltonetworks.com",
-  "auth.apps.paloaltonetworks.com",
-  "api.dlp.paloaltonetworks.com"
-];
-function isAirsUrl(url) {
-  try {
-    const parsed = new URL(url);
-    return AIRS_DOMAINS.some((d) => parsed.hostname === d || parsed.hostname.endsWith(`.${d}`));
-  } catch {
-    return false;
-  }
-}
-var MASK = "***";
-var SENSITIVE_KEY_PATTERN = /token|secret|password|passwd|credential|authorization|cookie|api[-_]?key/i;
-function isSensitiveKey(key) {
-  return SENSITIVE_KEY_PATTERN.test(key);
-}
-function redactHeaders(headers) {
-  const out = {};
-  for (const [k, v] of Object.entries(headers)) {
-    out[k] = isSensitiveKey(k) ? MASK : v;
-  }
-  return out;
-}
-function redactDeep(value) {
-  if (Array.isArray(value)) {
-    return value.map(redactDeep);
-  }
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = isSensitiveKey(k) ? MASK : redactDeep(v);
-    }
-    return out;
-  }
-  return value;
-}
-function redactUrl(url) {
-  try {
-    const parsed = new URL(url);
-    let touched = false;
-    for (const key of parsed.searchParams.keys()) {
-      if (isSensitiveKey(key)) {
-        parsed.searchParams.set(key, MASK);
-        touched = true;
-      }
-    }
-    return touched ? parsed.toString() : url;
-  } catch {
-    return url;
-  }
-}
-function pruneDebugLogs(dir, keep) {
-  let files;
-  try {
-    files = readdirSync(dir).filter((f) => f.startsWith("debug-api-") && f.endsWith(".jsonl"));
-  } catch {
-    return;
-  }
-  const byAge = files.map((f) => {
-    const path3 = join3(dir, f);
-    try {
-      return { path: path3, mtime: statSync(path3).mtimeMs };
-    } catch {
-      return null;
-    }
-  }).filter((e) => e !== null).sort((a, b) => b.mtime - a.mtime);
-  for (const { path: path3 } of byAge.slice(keep)) {
-    try {
-      unlinkSync(path3);
-    } catch {
-    }
-  }
-}
-function headersToRecord(headers) {
-  if (!headers) return {};
-  if (typeof headers === "object" && "forEach" in headers && typeof headers.forEach === "function") {
-    const out = {};
-    headers.forEach((v, k) => {
-      out[k] = v;
-    });
-    return out;
-  }
-  if (Array.isArray(headers)) {
-    return Object.fromEntries(headers);
-  }
-  return headers;
-}
-var KEEP_DEBUG_LOGS = 10;
-function installDebugLogger(logPath) {
-  mkdirSync(dirname3(logPath), { recursive: true });
-  writeFileSync2(logPath, "", "utf-8");
-  pruneDebugLogs(dirname3(logPath), KEEP_DEBUG_LOGS);
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = async function debugFetch(input, init2) {
-    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-    if (!isAirsUrl(url)) {
-      return originalFetch(input, init2);
-    }
-    const method = init2?.method ?? (input instanceof Request ? input.method : "GET");
-    const reqHeaders = redactHeaders(headersToRecord(init2?.headers));
-    const loggedUrl = redactUrl(url);
-    let reqBody;
-    if (init2?.body) {
-      try {
-        reqBody = redactDeep(JSON.parse(String(init2.body)));
-      } catch {
-        reqBody = String(init2.body);
-      }
-    }
-    const ts2 = (/* @__PURE__ */ new Date()).toISOString();
-    const startMs = Date.now();
-    let response;
-    let resBody;
-    let error;
-    try {
-      response = await originalFetch(input, init2);
-    } catch (err) {
-      error = err instanceof Error ? err.message : String(err);
-      const entry2 = JSON.stringify({
-        timestamp: ts2,
-        durationMs: Date.now() - startMs,
-        request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
-        error
-      });
-      appendFileSync(logPath, `${entry2}
-`);
-      throw err;
-    }
-    const durationMs = Date.now() - startMs;
-    const resHeaders = {};
-    response.headers.forEach((v, k) => {
-      resHeaders[k] = v;
-    });
-    const clone = response.clone();
-    try {
-      const text = await clone.text();
-      try {
-        resBody = redactDeep(JSON.parse(text));
-      } catch {
-        resBody = text;
-      }
-    } catch {
-      resBody = "<unreadable>";
-    }
-    const entry = JSON.stringify({
-      timestamp: ts2,
-      durationMs,
-      request: { method, url: loggedUrl, headers: reqHeaders, body: reqBody },
-      response: {
-        status: response.status,
-        statusText: response.statusText,
-        headers: redactHeaders(resHeaders),
-        body: resBody
-      }
-    });
-    appendFileSync(logPath, `${entry}
-`);
-    return response;
-  };
-  return {
-    teardown() {
-      globalThis.fetch = originalFetch;
-    }
-  };
-}
-
 // src/cli/program.ts
 var READ_COMMAND_NAMES = /* @__PURE__ */ new Set([
   "categories",
@@ -8625,7 +9967,9 @@ var READ_COMMAND_NAMES = /* @__PURE__ */ new Set([
 function applyListDeleteAliases(cmd) {
   for (const sub of cmd.commands) {
     if (sub.name() === "list" && !sub.aliases().includes("ls")) sub.alias("ls");
-    if (sub.name() === "delete" && !sub.aliases().includes("rm")) sub.alias("rm");
+    const isHiddenCompatibilityCommand = sub.name() === "delete" && Boolean(sub._hidden);
+    if (sub.name() === "delete" && !isHiddenCompatibilityCommand && !sub.aliases().includes("rm"))
+      sub.alias("rm");
     applyListDeleteAliases(sub);
   }
 }