@cdot65/prisma-airs-cli 5.3.0 → 5.4.1

package/dist/cli/index.js

@@ -30,7 +30,7 @@ import {
   validateTopic,
   writeBackupFile,
   writeReportFile
-} from "../chunk-7Z76VCB3.js";
+} from "../chunk-36Z6IPH6.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -49,189 +49,36 @@ function installProcessGuards() {
 }
 
 // src/cli/program.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
 
-// src/cli/commands/aigateway.ts
+// src/cli/commands/agentguard.ts
+import { randomUUID } from "crypto";
+import { lstat } from "fs/promises";
+import { resolve } from "path";
 import {
-  GatewayDefaultsInputSchema,
-  GatewayRateLimitInputSchema,
-  GatewayUsageLimitInputSchema
+  AgentGuardClient,
+  AgentGuardPageOptionsSchema,
+  AgentGuardScanListOptionsSchema,
+  AgentGuardStatsOptionsSchema
 } from "@cdot65/prisma-airs-sdk";
+import { dump as dump3 } from "js-yaml";
+import { z } from "zod";
 
-// src/airs/aigateway.ts
-import {
-  AIGatewayChartFiltersSchema,
-  AIGatewayClient
-} from "@cdot65/prisma-airs-sdk";
-function toLimitArray(value) {
-  if (Array.isArray(value)) return value;
-  if (value !== null && typeof value === "object") return [value];
-  return [];
-}
-function normalizeWorkspace(raw) {
-  return {
-    id: raw.id,
-    slug: raw.slug,
-    name: raw.name,
-    icon: raw.icon,
-    description: raw.description,
-    createdAt: raw.created_at,
-    lastUpdatedAt: raw.last_updated_at,
-    isDefault: Boolean(raw.is_default),
-    status: raw.status,
-    scopeName: raw.scope_name
-  };
-}
-function normalizeWorkspaceDetail(raw) {
+// src/config/client-options.ts
+function agentGuardClientOptions(config) {
   return {
-    ...normalizeWorkspace(raw),
-    defaults: raw.defaults,
-    usageLimits: toLimitArray(raw.usage_limits),
-    rateLimits: toLimitArray(raw.rate_limits),
-    securitySettings: raw.security_settings,
-    dataPlaneSecuritySettings: raw.data_plane_security_settings,
-    settings: raw.settings
+    clientId: config.mgmtClientId,
+    clientSecret: config.mgmtClientSecret,
+    tsgId: config.mgmtTsgId,
+    dataEndpoint: config.agentGuardDataEndpoint,
+    mgmtEndpoint: config.agentGuardMgmtEndpoint,
+    tokenEndpoint: config.agentGuardTokenEndpoint ?? config.mgmtTokenEndpoint
   };
 }
-function aiGatewayGrantHint(err) {
-  const status = err?.status ?? err?.statusCode;
-  if (status !== 403) return void 0;
-  const message = err instanceof Error ? err.message : String(err);
-  const grant = message.includes("AB03") ? "the service account is missing a workspace-scope grant (data plane, /ai_gw/v2)" : "the service account is missing a tenant-root admin grant (admin plane, /ai_gw/admin/v2)";
-  return `${grant}. SCM Access Management edits the existing role row by default \u2014 use "Add Role" so the account ends up with both role rows, not one row moved.`;
-}
-var SdkAiGatewayService = class {
-  client;
-  constructor(opts) {
-    this.client = new AIGatewayClient(opts);
-  }
-  async listWorkspaces(options) {
-    const response = await this.client.workspaces.list(options);
-    return response.data.map(normalizeWorkspace);
-  }
-  async listAllWorkspaces() {
-    const [active, archived] = await Promise.all([
-      this.client.workspaces.list({ plane: "admin" }),
-      this.client.workspaces.list({ plane: "admin", status: "archived" })
-    ]);
-    return [
-      ...active.data,
-      ...archived.data
-    ].map(normalizeWorkspace);
-  }
-  async getWorkspace(workspaceRef, options) {
-    try {
-      const raw = await this.client.workspaces.get(workspaceRef, options);
-      return normalizeWorkspaceDetail(raw);
-    } catch (err) {
-      const status = err.statusCode;
-      if (status !== 404) throw err;
-      const resolved = await this.resolveWorkspaceRef(workspaceRef, [
-        options?.plane ?? "data",
-        "admin"
-      ]);
-      if (resolved === workspaceRef) throw err;
-      const raw = await this.client.workspaces.get(resolved, options);
-      return normalizeWorkspaceDetail(raw);
-    }
-  }
-  async createWorkspace(request) {
-    const body = {
-      name: request.name,
-      scope_name: request.scopeName
-    };
-    if (request.description !== void 0) body.description = request.description;
-    if (request.icon !== void 0) body.icon = request.icon;
-    if (request.defaults !== void 0) body.defaults = request.defaults;
-    if (request.users !== void 0) body.users = request.users;
-    if (request.usageLimits !== void 0) body.usage_limits = request.usageLimits;
-    if (request.rateLimits !== void 0) body.rate_limits = request.rateLimits;
-    const created = await this.client.workspaces.create(body);
-    return this.refetchAfterWrite(created.id, created);
-  }
-  async updateWorkspace(workspaceRef, request) {
-    const ref = await this.resolveWorkspaceRef(workspaceRef, ["admin"]);
-    const body = {};
-    if (request.name !== void 0) body.name = request.name;
-    if (request.description !== void 0) body.description = request.description;
-    if (request.icon !== void 0) body.icon = request.icon;
-    if (request.defaults !== void 0) body.defaults = request.defaults;
-    if (request.usageLimits !== void 0) body.usage_limits = request.usageLimits;
-    if (request.rateLimits !== void 0) body.rate_limits = request.rateLimits;
-    await this.client.workspaces.update(ref, body);
-    return this.getWorkspace(ref, { plane: "admin" });
-  }
-  async deleteWorkspace(workspaceRef) {
-    const ref = await this.resolveWorkspaceRef(workspaceRef, ["admin"]);
-    await this.client.workspaces.delete(ref);
-  }
-  /**
-   * The API accepts only a UUID or slug as a workspace ref — a display name
-   * gets a misleading 400 AB01 ("No update fields provided") on writes.
-   * Match a user-supplied ref against the workspace list so name | slug |
-   * uuid all work. Unmatched refs pass through so the API's own error stands.
-   */
-  async resolveWorkspaceRef(ref, planes, requireSlug = false) {
-    for (const plane of planes) {
-      let rows;
-      try {
-        rows = await this.listWorkspaces({ plane });
-      } catch {
-        continue;
-      }
-      const byRef = rows.find((w) => w.id === ref || w.slug === ref);
-      if (byRef) return requireSlug ? byRef.slug : ref;
-      const byName = rows.filter((w) => w.name === ref);
-      if (byName.length > 1) {
-        throw new Error(
-          `workspace name '${ref}' is ambiguous (${byName.map((w) => w.slug).join(", ")}) \u2014 use a slug or UUID`
-        );
-      }
-      if (byName.length === 1) return byName[0].slug;
-    }
-    return ref;
-  }
-  async getTelemetryCost(opts) {
-    const { workspaceSlug: workspaceRef, days = 7, ...rawFilters } = opts;
-    const filters = AIGatewayChartFiltersSchema.parse(rawFilters);
-    if (!Number.isSafeInteger(days) || days <= 0)
-      throw new Error("Expected days to be a positive integer");
-    const workspaceSlug = await this.resolveWorkspaceRef(workspaceRef, ["data", "admin"], true);
-    const raw = await this.client.telemetry.cost({
-      workspaceSlug,
-      days,
-      ...filters
-    });
-    return {
-      workspaceSlug,
-      days,
-      totalCents: raw.data.total,
-      totalUsd: raw.data.total / 100,
-      avgCents: raw.data.avg,
-      avgUsd: raw.data.avg / 100,
-      quotaExceeded: raw.data.isQuotaExceeded,
-      records: raw.data.records.map((r) => ({
-        date: r.x,
-        costCents: r.y,
-        costUsd: r.y / 100
-      }))
-    };
-  }
-  /** Re-read after a write, falling back to the (partial) write response if the get fails. */
-  async refetchAfterWrite(workspaceRef, writeResponse) {
-    try {
-      return await this.getWorkspace(workspaceRef, { plane: "admin" });
-    } catch {
-      return normalizeWorkspaceDetail(writeResponse);
-    }
-  }
-};
-
-// src/config/client-options.ts
 function managementClientOptions(config) {
   return {
     clientId: config.mgmtClientId,
@@ -283,6 +130,207 @@ function modelSecurityClientOptions(config) {
   };
 }
 
+// src/reports/agentguard.ts
+async function collectAgentGuardReport(client, options = {}) {
+  const maxPages = options.maxPages ?? 40;
+  if (!Number.isSafeInteger(maxPages) || maxPages < 1 || maxPages > 100)
+    throw new Error("maxPages must be between 1 and 100");
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const end = now();
+  const window2 = {
+    start: new Date(end.getTime() - 30 * 864e5).toISOString(),
+    end: end.toISOString()
+  };
+  const report = {
+    schemaVersion: 1,
+    product: "Prisma AIRS AI Supply Chain \u2014 AgentGuard",
+    title: options.title ?? "AgentGuard environment report",
+    collectionStartedAt: end.toISOString(),
+    generatedAt: "",
+    window: window2,
+    windowLabel: "30-day scan inventory; rolling 30_DAYS statistics; current rule catalog",
+    schemaLabel: "Experimental browser APIs",
+    health: "unknown",
+    sources: [],
+    findings: [],
+    tables: [],
+    limitations: [
+      "Read-only evidence, not a security certification or numerical health score. Browser APIs are undocumented and may change.",
+      "Scans use explicit start/end timestamps; statistics use the server rolling 30_DAYS window. These independently read sources are not an atomic snapshot and need not reconcile.",
+      "Scan rows are not unique skills. Parent/batch rows are excluded from outcome counts to avoid counting them alongside children; per-scan vulnerability counts are never summed.",
+      "Rule default states describe the catalog, not effective tenant policies. No scan creation, policy changes or skill uploads are performed.",
+      "Missing or incomplete evidence is unknown, not zero. Scan names, identifiers, URLs, device metadata, source code and finding text are excluded."
+    ]
+  };
+  const label = (v, allowed) => v === null ? "UNKNOWN" : allowed.includes(v) ? v : "OTHER";
+  async function source(name, method, range, read) {
+    const s = {
+      name,
+      method,
+      window: range,
+      status: "unavailable",
+      pages: 0,
+      records: 0,
+      notes: []
+    };
+    report.sources.push(s);
+    try {
+      await read(s);
+      if (s.status !== "partial") s.status = "complete";
+    } catch {
+      s.status = s.records ? "partial" : "unavailable";
+      s.notes.push("Request or validation failed; no upstream error body included.");
+    }
+    if (s.status !== "complete")
+      report.findings.push({
+        priority: "review",
+        title: `${name} incomplete`,
+        evidence: s.notes.join(" "),
+        recommendation: "Check service access or increase the page budget, then regenerate.",
+        source: name
+      });
+  }
+  async function pages(s, read, pageCount = false) {
+    const rows = [];
+    const seen = /* @__PURE__ */ new Set();
+    let total;
+    try {
+      for (let page = 0; page < maxPages; page++) {
+        const r = await read(rows.length);
+        s.pages++;
+        if (!Number.isSafeInteger(r.total) || r.total < 0 || !Array.isArray(r.rows) || r.rows.length > 10)
+          throw new Error();
+        total ??= r.total;
+        if (!pageCount && (r.total !== total || rows.length + r.rows.length > total))
+          throw new Error();
+        for (const row of r.rows) {
+          if (!row.uuid || seen.has(row.uuid)) throw new Error();
+          seen.add(row.uuid);
+          rows.push(row);
+          s.records = rows.length;
+        }
+        if (pageCount ? r.rows.length < 10 : rows.length === total) return rows;
+        if (!r.rows.length) throw new Error();
+      }
+      s.notes.push(`Reached the ${maxPages}-page budget.`);
+      throw new Error();
+    } catch (error) {
+      if (!rows.length) throw error;
+      s.status = "partial";
+      s.notes.push(
+        "Inventory incomplete: pagination changed, repeated, stopped early, failed or reached its budget."
+      );
+      return rows;
+    }
+  }
+  await source("Scans", "listScans()", `${window2.start} to ${window2.end}`, async (s) => {
+    const rows = await pages(s, async (skip) => {
+      const p = await client.listScans({
+        skip,
+        limit: 10,
+        start_time: window2.start,
+        end_time: window2.end,
+        isBackgroundRefresh: false
+      });
+      return { rows: p.scans, total: p.pagination.total_items };
+    });
+    const inside = rows.filter((r) => {
+      const t = Date.parse(r.created_at);
+      return Number.isFinite(t) && t >= Date.parse(window2.start) && t <= end.getTime();
+    });
+    if (inside.length !== rows.length) {
+      s.status = "partial";
+      s.notes.push("Rows with missing or out-of-window creation timestamps were excluded.");
+    }
+    const leaf = inside.filter((r) => !r.is_batch && r.child_scan_uuids.length === 0);
+    const groups = /* @__PURE__ */ new Map();
+    for (const r of leaf) {
+      const key = `${label(r.artifact_type, ["SKILL", "AGENT"])} / ${label(r.eval_outcome, ["BLOCKED", "ALLOWED", "PENDING", "ERROR"])}`;
+      groups.set(key, (groups.get(key) ?? 0) + 1);
+    }
+    report.tables.push({
+      title: "Scan outcomes",
+      note: `Collected ${s.records} rows; excluded ${inside.length - leaf.length} parent/batch rows. ${s.status === "partial" ? "Partial inventory only." : "Complete inventory for requested window."}`,
+      headers: ["Artifact / outcome", "Scan rows"],
+      rows: [...groups].sort(([a], [b]) => a.localeCompare(b))
+    });
+    const blocked = leaf.filter((r) => r.eval_outcome === "BLOCKED").length;
+    if (blocked)
+      report.findings.push({
+        priority: "attention",
+        title: "Blocked scans require review",
+        evidence: `${blocked} collected non-parent scan rows have BLOCKED evaluations.`,
+        recommendation: "Inspect the affected scans and findings before approving the artifacts.",
+        source: "Scans"
+      });
+    const unsettled = leaf.filter(
+      (r) => r.status !== "COMPLETED" || !["ALLOWED", "BLOCKED"].includes(r.eval_outcome ?? "")
+    ).length;
+    if (unsettled)
+      report.findings.push({
+        priority: "review",
+        title: "Scans without a completed decision",
+        evidence: `${unsettled} collected non-parent rows are pending, failed or have an unfamiliar status.`,
+        recommendation: "Review scan status; absence of a completed decision is not a passing evaluation.",
+        source: "Scans"
+      });
+  });
+  await source("Statistics", "getScanStats()", "Server rolling 30_DAYS", async (s) => {
+    const r = await client.getScanStats({ time_period: "30_DAYS" });
+    report.tables.push({
+      title: "Skill statistics",
+      note: "Server aggregates; percentage changes may be unavailable.",
+      headers: ["Metric", "Count", "Change (%)"],
+      rows: [
+        [
+          "Unique skills scanned",
+          r.unique_skills_scanned.count,
+          r.unique_skills_scanned.percent_change
+        ],
+        [
+          "Vulnerabilities found",
+          r.total_vulnerabilities_found.count,
+          r.total_vulnerabilities_found.percent_change
+        ]
+      ]
+    });
+    if (r.total_vulnerabilities_found.count > 0)
+      report.findings.push({
+        priority: "attention",
+        title: "Skill vulnerabilities reported",
+        evidence: `${r.total_vulnerabilities_found.count} findings reported in the server statistics window.`,
+        recommendation: "Review vulnerability details and remediate before use; findings are not a count of distinct vulnerable skills.",
+        source: "Statistics"
+      });
+    s.records = 1;
+    s.pages = 1;
+  });
+  await source("Rules", "listRules()", "Current catalog", async (s) => {
+    const rows = await pages(
+      s,
+      async (skip) => {
+        const p = await client.listRules({ skip, limit: 10 });
+        return { rows: p.rules, total: p.pagination.total_items };
+      },
+      true
+    );
+    const groups = /* @__PURE__ */ new Map();
+    for (const r of rows) {
+      const state = label(r.default_state, ["BLOCKING", "ALLOWING"]);
+      groups.set(state, (groups.get(state) ?? 0) + 1);
+    }
+    report.tables.push({
+      title: "Rule catalog defaults",
+      note: "These are not effective tenant policy settings.",
+      headers: ["Default state", "Rules"],
+      rows: [...groups].sort(([a], [b]) => a.localeCompare(b))
+    });
+  });
+  report.health = report.sources.every((s) => s.status === "unavailable") ? "unknown" : report.findings.some((f) => f.priority === "attention") ? "attention" : report.findings.length ? "review" : "no-findings";
+  report.generatedAt = now().toISOString();
+  return report;
+}
+
 // src/cli/renderer/aigateway.ts
 import chalk4 from "chalk";
 import { dump as yamlDump } from "js-yaml";
@@ -2787,140 +2835,541 @@ function renderCustomerAppList(apps, format = "pretty") {
     );
     return;
   }
-  ui.section("Customer Apps:");
-  for (const a of apps) {
-    if (a.id) ui.dim(a.id);
-    const desc = a.description ? chalk9.dim(` \u2014 ${a.description.slice(0, 80)}`) : "";
-    console.log(`    ${a.name}${desc}`);
+  ui.section("Customer Apps:");
+  for (const a of apps) {
+    if (a.id) ui.dim(a.id);
+    const desc = a.description ? chalk9.dim(` \u2014 ${a.description.slice(0, 80)}`) : "";
+    console.log(`    ${a.name}${desc}`);
+  }
+  console.log();
+}
+function renderCustomerAppDetail(app) {
+  ui.section("Customer App Detail:");
+  const pairs = [];
+  if (app.id) pairs.push(["ID", app.id]);
+  pairs.push(["Name", app.name]);
+  if (app.description) pairs.push(["Desc", app.description]);
+  pairs.push(["Data", JSON.stringify(app.raw, null, 2).slice(0, 500)]);
+  ui.keyValue(pairs);
+  console.log();
+}
+function renderCustomerAppConsumption(data, format = "pretty") {
+  const fmt = (n, scale) => n == null ? "-" : `${n}${scale ?? ""}`;
+  if (format !== "pretty") {
+    const rows = data.detectors.map((d) => ({
+      app_name: data.appName,
+      app_id: data.appId,
+      monitoring_since: data.monitoringSince ?? "",
+      daily_avg: fmt(data.tokens.dailyAverage, data.tokens.dailyAverageScale),
+      monthly_total: fmt(data.tokens.monthlyTotal, data.tokens.monthlyTotalScale),
+      sessions_total: data.sessions.total,
+      sessions_violating: data.sessions.violating,
+      detector: d.type,
+      critical: d.critical,
+      high: d.high,
+      medium: d.medium,
+      low: d.low,
+      total: d.total
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "app_name", label: "App" },
+          { key: "app_id", label: "AppId" },
+          { key: "monitoring_since", label: "MonitoringSince" },
+          { key: "daily_avg", label: "DailyAvg" },
+          { key: "monthly_total", label: "MonthlyTotal" },
+          { key: "sessions_total", label: "Sessions" },
+          { key: "sessions_violating", label: "Violating" },
+          { key: "detector", label: "Detector" },
+          { key: "critical", label: "C" },
+          { key: "high", label: "H" },
+          { key: "medium", label: "M" },
+          { key: "low", label: "L" },
+          { key: "total", label: "Total" }
+        ],
+        format
+      )
+    );
+    return;
+  }
+  ui.header(data.appName, `(${data.appId})`);
+  const pairs = [];
+  if (data.monitoringSince) pairs.push(["Monitoring since", data.monitoringSince]);
+  if (data.source) pairs.push(["Source", data.source]);
+  if (data.cloud) pairs.push(["Cloud", data.cloud]);
+  if (data.profiles.length > 0) pairs.push(["Profiles", data.profiles.join(", ")]);
+  if (pairs.length > 0) ui.keyValue(pairs);
+  ui.section("Token consumption:");
+  ui.keyValue([
+    ["Daily avg", fmt(data.tokens.dailyAverage, data.tokens.dailyAverageScale)],
+    ["Monthly total", fmt(data.tokens.monthlyTotal, data.tokens.monthlyTotalScale)]
+  ]);
+  ui.section("Sessions:");
+  ui.keyValue([
+    ["Total", data.sessions.total],
+    ["Violating", data.sessions.violating]
+  ]);
+  const firing = data.detectors.filter((d) => d.total > 0);
+  ui.section(
+    `Detectors (${data.totalViolating} violating, ${firing.length}/${data.detectors.length} firing):`
+  );
+  if (firing.length === 0) {
+    ui.dim("no detector violations in window");
+  } else {
+    ui.table(
+      [
+        { key: "detector", label: "Detector" },
+        { key: "total", label: "Total" },
+        { key: "severity", label: "Severity" }
+      ],
+      firing.map((d) => ({
+        detector: d.type,
+        total: d.total,
+        severity: `c=${d.critical} h=${d.high} m=${d.medium} l=${d.low}`
+      }))
+    );
+  }
+  console.log();
+}
+function renderDeploymentProfileList(profiles, format = "pretty") {
+  if (profiles.length === 0) {
+    ui.emptyList("deployment profiles");
+    return;
+  }
+  if (format !== "pretty") {
+    const rows = profiles.map((p) => ({
+      name: p.raw.dp_name ?? p.raw.profile_name ?? p.raw.name ?? "",
+      status: p.raw.status ?? "",
+      authCode: p.raw.auth_code ?? ""
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "name", label: "Name" },
+          { key: "status", label: "Status" },
+          { key: "authCode", label: "Auth Code" }
+        ],
+        format
+      )
+    );
+    return;
+  }
+  ui.section("Deployment Profiles:");
+  for (const p of profiles) {
+    const name = p.raw.dp_name ?? p.raw.profile_name ?? p.raw.name ?? "unknown";
+    const status = p.raw.status;
+    const authCode = p.raw.auth_code;
+    const statusColor5 = status === "active" ? chalk9.green : chalk9.dim;
+    console.log(
+      `    ${name}${status ? `  ${statusColor5(status)}` : ""}${authCode ? `  ${chalk9.dim(authCode)}` : ""}`
+    );
+  }
+  console.log();
+}
+
+// src/cli/commands/agentguard.ts
+var createClient = async () => new AgentGuardClient({ ...agentGuardClientOptions(await loadConfig()), numRetries: 0 });
+var integer = (value) => {
+  if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)))
+    usageError("Pagination requires a safe nonnegative integer");
+  return Number(value);
+};
+var pageOptions = (cmd) => cmd.option("--limit <n>", "Page size", integer, 10).option("--offset <n>", "Starting offset", integer, 0);
+var readOutput = (cmd) => cmd.option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml");
+var query = (schema, value) => {
+  const result = schema.safeParse(value);
+  if (!result.success)
+    usageError(
+      "Invalid AgentGuard query. Check pagination, UUID and ISO timestamps; statistics support 30_DAYS only."
+    );
+  return result.data;
+};
+function emit(value, format) {
+  if (format === "json") console.log(JSON.stringify(value, null, 2));
+  else if (format === "yaml") console.log(dump3(value, { noRefs: true, lineWidth: -1 }).trimEnd());
+  else {
+    const records = Object.values(value).find(Array.isArray);
+    if (records) {
+      const keys = [...new Set(records.flatMap((r) => Object.keys(r)))].filter((k) => !["description", "remediation"].includes(k)).slice(0, 9);
+      console.log(
+        formatOutput(
+          records,
+          keys.map((key) => ({ key, label: key.replaceAll("_", " ") })),
+          format === "pretty" ? "table" : format
+        )
+      );
+      ui.status(`Returned ${records.length} records; see JSON/YAML for pagination metadata.`);
+      return;
+    }
+    const rows = Object.entries(value).map(([key, v]) => ({
+      key,
+      value: typeof v === "object" ? JSON.stringify(v) : String(v)
+    }));
+    console.log(
+      formatOutput(
+        rows,
+        [
+          { key: "key", label: "Field" },
+          { key: "value", label: "Value" }
+        ],
+        format === "pretty" ? "table" : format
+      )
+    );
+  }
+}
+async function run(read, cmd) {
+  try {
+    const format = await resolveOutput(cmd, cmd.opts());
+    emit(await read(), format);
+  } catch (error) {
+    const status = error?.statusCode;
+    ui.error(
+      `AgentGuard request failed${typeof status === "number" && Number.isInteger(status) && status >= 400 && status <= 599 ? ` (HTTP ${status})` : ""}. Check credentials, query options and service availability. No upstream body is included.`
+    );
+    process.exitCode = 1;
+  }
+}
+async function inventory(read, options, pageCount = false) {
+  if (options.max !== void 0 && (!Number.isSafeInteger(options.max) || options.max < 0))
+    usageError("--max must be a safe nonnegative integer");
+  const rows = [];
+  const seen = /* @__PURE__ */ new Set();
+  let total;
+  const cap = options.all ? options.max || Number.MAX_SAFE_INTEGER : options.limit;
+  for (let page = 0; page < 1e3; page++) {
+    const limit = Math.min(options.limit, cap - rows.length);
+    const p = await read(options.offset + rows.length, limit);
+    total ??= p.total;
+    if (!pageCount && p.total !== total || p.rows.length > limit)
+      throw new Error("Unstable pagination");
+    for (const row of p.rows) {
+      if (!row.uuid || seen.has(row.uuid)) throw new Error("Repeated identity");
+      seen.add(row.uuid);
+      rows.push(row);
+    }
+    const next = options.offset + rows.length;
+    if (!pageCount && next > total && rows.length) throw new Error("Invalid total");
+    const complete = pageCount ? p.rows.length < limit : next >= total;
+    if (!options.all || complete || rows.length === cap)
+      return {
+        rows,
+        pagination: {
+          total_items: pageCount ? complete && options.offset === 0 ? rows.length : null : total,
+          returned: rows.length,
+          skip: options.offset,
+          next_offset: complete ? null : next,
+          truncated: !complete
+        }
+      };
+    if (!p.rows.length) throw new Error("Premature empty page");
+  }
+  throw new Error("Pagination safety limit reached");
+}
+function registerAgentGuardCommand(program) {
+  const group = program.command("agentguard").description("AI Supply Chain agent and skill scan telemetry (experimental, OAuth)");
+  const scans = group.command("scans").description("Inspect agent and skill scans (read-only)");
+  const list = readOutput(
+    pageOptions(
+      scans.command("list").description("List one page of scans; sensitive metadata is excluded")
+    )
+  ).option("--start <iso>", "Inclusive creation time start (ISO timestamp)").option("--end <iso>", "Creation time end (ISO timestamp)").action(async (opts) => {
+    const options = query(AgentGuardScanListOptionsSchema, {
+      skip: opts.offset,
+      limit: opts.limit,
+      start_time: opts.start,
+      end_time: opts.end,
+      isBackgroundRefresh: false
+    });
+    await run(async () => {
+      const client = await createClient();
+      const p = await inventory(async (skip, limit) => {
+        const page = await client.listScans({ ...options, skip, limit });
+        return { rows: page.scans, total: page.pagination.total_items };
+      }, opts);
+      return {
+        pagination: p.pagination,
+        scans: p.rows.map((r) => ({
+          uuid: r.uuid,
+          artifact_type: r.artifact_type,
+          status: r.status,
+          eval_outcome: r.eval_outcome,
+          created_at: r.created_at,
+          vulnerability_count: r.summary?.vulnerability_count ?? null,
+          attack_chain_count: r.summary?.attack_chain_count ?? null,
+          is_batch: r.is_batch,
+          parent_uuid: r.parent_uuid
+        }))
+      };
+    }, list);
+  });
+  const vulnerabilities = readOutput(
+    scans.command("vulnerabilities <scanUuid>").description("List finding metadata; --include-content explicitly reveals sensitive details")
+  ).option("--include-content", "Include source code, paths and finding text (sensitive)").action(async (id, opts) => {
+    query(z.string().uuid(), id);
+    await run(async () => {
+      const p = await (await createClient()).listScanVulnerabilities(id);
+      return {
+        pagination: p.pagination,
+        vulnerabilities: p.vulnerabilities.map(
+          (r) => opts.includeContent ? r : {
+            uuid: r.uuid,
+            scan_uuid: r.scan_uuid,
+            vulnerability_type: r.vulnerability_type,
+            attack_chain_count: r.attack_chain_count
+          }
+        ),
+        content_included: !!opts.includeContent
+      };
+    }, vulnerabilities);
+  });
+  const stats = readOutput(
+    group.command("stats").description("Read server rolling 30-day skill statistics")
+  ).option("--time-period <period>", "Verified period: 30_DAYS", "30_DAYS").action(async (opts) => {
+    const options = query(AgentGuardStatsOptionsSchema, { time_period: opts.timePeriod });
+    await run(async () => (await createClient()).getScanStats(options), stats);
+  });
+  const rulesGroup = group.command("rules").description("Rule catalog (not effective tenant policy)");
+  const rules = readOutput(
+    pageOptions(rulesGroup.command("list").description("List rule catalog defaults"))
+  ).action(async (opts) => {
+    const options = query(AgentGuardPageOptionsSchema, { skip: opts.offset, limit: opts.limit });
+    await run(async () => {
+      const client = await createClient();
+      const p = await inventory(
+        async (skip, limit) => {
+          const page = await client.listRules({ ...options, skip, limit });
+          return { rows: page.rules, total: page.pagination.total_items };
+        },
+        opts,
+        true
+      );
+      return { pagination: p.pagination, rules: p.rows };
+    }, rules);
+  });
+  group.command("report").description("Generate an aggregate-only 30-day HTML/Markdown report").option("--output <format>", "Deliverable: html (default) or markdown").option("--output-file <path>", "New file in CWD by default; - for stdout; never overwrite").option("--max-pages <n>", "Page budget per inventory (1\u2013100, 10 rows/page)", integer, 40).option("--title <text>", "Report title", "AgentGuard environment report").option("--strict", "Exit 1 after writing if any source is incomplete").action(async (opts) => {
+    const format = opts.output ?? program.opts().output ?? "html";
+    if (!["html", "markdown"].includes(format))
+      usageError("Report output must be html or markdown");
+    if (opts.maxPages < 1 || opts.maxPages > 100)
+      usageError("--max-pages must be between 1 and 100");
+    if (!opts.title.trim() || opts.title.length > 240)
+      usageError("--title must contain 1\u2013240 characters");
+    if (opts.outputFile !== void 0 && !opts.outputFile.trim())
+      usageError("--output-file cannot be empty");
+    const path3 = opts.outputFile === "-" ? void 0 : resolve(
+      opts.outputFile ?? `airs-agentguard-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID().slice(0, 8)}.${format === "html" ? "html" : "md"}`
+    );
+    try {
+      if (path3) {
+        const exists = await lstat(path3).catch((e) => {
+          if (e.code !== "ENOENT") throw e;
+          return void 0;
+        });
+        if (exists) throw new Error();
+      }
+      const data = await collectAgentGuardReport(await createClient(), {
+        title: opts.title,
+        maxPages: opts.maxPages
+      });
+      const output = format === "html" ? renderEnvironmentReportHtml(data) : renderEnvironmentReportMarkdown(data);
+      if (path3) {
+        await writeReportFile(path3, output);
+        ui.status(`Report \u2192 ${path3.replace(/[\p{Cc}\p{Cf}]/gu, "_")} (mode 0600)`);
+      } else
+        await new Promise(
+          (done, reject) => process.stdout.write(output, (error) => error ? reject(error) : done())
+        );
+      const incomplete = data.sources.filter((s) => s.status !== "complete").length;
+      if (incomplete)
+        ui.status(`${incomplete} source(s) incomplete; review the evidence section.`);
+      if (data.health === "unknown" || opts.strict && incomplete) process.exitCode = 1;
+    } catch {
+      ui.error(
+        "AgentGuard report failed. Check credentials and a writable, new output path. Existing files are never overwritten."
+      );
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/cli/commands/aigateway.ts
+import {
+  GatewayDefaultsInputSchema,
+  GatewayRateLimitInputSchema,
+  GatewayUsageLimitInputSchema
+} from "@cdot65/prisma-airs-sdk";
+
+// src/airs/aigateway.ts
+import {
+  AIGatewayChartFiltersSchema,
+  AIGatewayClient
+} from "@cdot65/prisma-airs-sdk";
+function toLimitArray(value) {
+  if (Array.isArray(value)) return value;
+  if (value !== null && typeof value === "object") return [value];
+  return [];
+}
+function normalizeWorkspace(raw) {
+  return {
+    id: raw.id,
+    slug: raw.slug,
+    name: raw.name,
+    icon: raw.icon,
+    description: raw.description,
+    createdAt: raw.created_at,
+    lastUpdatedAt: raw.last_updated_at,
+    isDefault: Boolean(raw.is_default),
+    status: raw.status,
+    scopeName: raw.scope_name
+  };
+}
+function normalizeWorkspaceDetail(raw) {
+  return {
+    ...normalizeWorkspace(raw),
+    defaults: raw.defaults,
+    usageLimits: toLimitArray(raw.usage_limits),
+    rateLimits: toLimitArray(raw.rate_limits),
+    securitySettings: raw.security_settings,
+    dataPlaneSecuritySettings: raw.data_plane_security_settings,
+    settings: raw.settings
+  };
+}
+function aiGatewayGrantHint(err) {
+  const status = err?.status ?? err?.statusCode;
+  if (status !== 403) return void 0;
+  const message = err instanceof Error ? err.message : String(err);
+  const grant = message.includes("AB03") ? "the service account is missing a workspace-scope grant (data plane, /ai_gw/v2)" : "the service account is missing a tenant-root admin grant (admin plane, /ai_gw/admin/v2)";
+  return `${grant}. SCM Access Management edits the existing role row by default \u2014 use "Add Role" so the account ends up with both role rows, not one row moved.`;
+}
+var SdkAiGatewayService = class {
+  client;
+  constructor(opts) {
+    this.client = new AIGatewayClient(opts);
+  }
+  async listWorkspaces(options) {
+    const response = await this.client.workspaces.list(options);
+    return response.data.map(normalizeWorkspace);
+  }
+  async listAllWorkspaces() {
+    const [active, archived] = await Promise.all([
+      this.client.workspaces.list({ plane: "admin" }),
+      this.client.workspaces.list({ plane: "admin", status: "archived" })
+    ]);
+    return [
+      ...active.data,
+      ...archived.data
+    ].map(normalizeWorkspace);
+  }
+  async getWorkspace(workspaceRef, options) {
+    try {
+      const raw = await this.client.workspaces.get(workspaceRef, options);
+      return normalizeWorkspaceDetail(raw);
+    } catch (err) {
+      const status = err.statusCode;
+      if (status !== 404) throw err;
+      const resolved = await this.resolveWorkspaceRef(workspaceRef, [
+        options?.plane ?? "data",
+        "admin"
+      ]);
+      if (resolved === workspaceRef) throw err;
+      const raw = await this.client.workspaces.get(resolved, options);
+      return normalizeWorkspaceDetail(raw);
+    }
+  }
+  async createWorkspace(request) {
+    const body = {
+      name: request.name,
+      scope_name: request.scopeName
+    };
+    if (request.description !== void 0) body.description = request.description;
+    if (request.icon !== void 0) body.icon = request.icon;
+    if (request.defaults !== void 0) body.defaults = request.defaults;
+    if (request.users !== void 0) body.users = request.users;
+    if (request.usageLimits !== void 0) body.usage_limits = request.usageLimits;
+    if (request.rateLimits !== void 0) body.rate_limits = request.rateLimits;
+    const created = await this.client.workspaces.create(body);
+    return this.refetchAfterWrite(created.id, created);
   }
-  console.log();
-}
-function renderCustomerAppDetail(app) {
-  ui.section("Customer App Detail:");
-  const pairs = [];
-  if (app.id) pairs.push(["ID", app.id]);
-  pairs.push(["Name", app.name]);
-  if (app.description) pairs.push(["Desc", app.description]);
-  pairs.push(["Data", JSON.stringify(app.raw, null, 2).slice(0, 500)]);
-  ui.keyValue(pairs);
-  console.log();
-}
-function renderCustomerAppConsumption(data, format = "pretty") {
-  const fmt = (n, scale) => n == null ? "-" : `${n}${scale ?? ""}`;
-  if (format !== "pretty") {
-    const rows = data.detectors.map((d) => ({
-      app_name: data.appName,
-      app_id: data.appId,
-      monitoring_since: data.monitoringSince ?? "",
-      daily_avg: fmt(data.tokens.dailyAverage, data.tokens.dailyAverageScale),
-      monthly_total: fmt(data.tokens.monthlyTotal, data.tokens.monthlyTotalScale),
-      sessions_total: data.sessions.total,
-      sessions_violating: data.sessions.violating,
-      detector: d.type,
-      critical: d.critical,
-      high: d.high,
-      medium: d.medium,
-      low: d.low,
-      total: d.total
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "app_name", label: "App" },
-          { key: "app_id", label: "AppId" },
-          { key: "monitoring_since", label: "MonitoringSince" },
-          { key: "daily_avg", label: "DailyAvg" },
-          { key: "monthly_total", label: "MonthlyTotal" },
-          { key: "sessions_total", label: "Sessions" },
-          { key: "sessions_violating", label: "Violating" },
-          { key: "detector", label: "Detector" },
-          { key: "critical", label: "C" },
-          { key: "high", label: "H" },
-          { key: "medium", label: "M" },
-          { key: "low", label: "L" },
-          { key: "total", label: "Total" }
-        ],
-        format
-      )
-    );
-    return;
+  async updateWorkspace(workspaceRef, request) {
+    const ref = await this.resolveWorkspaceRef(workspaceRef, ["admin"]);
+    const body = {};
+    if (request.name !== void 0) body.name = request.name;
+    if (request.description !== void 0) body.description = request.description;
+    if (request.icon !== void 0) body.icon = request.icon;
+    if (request.defaults !== void 0) body.defaults = request.defaults;
+    if (request.usageLimits !== void 0) body.usage_limits = request.usageLimits;
+    if (request.rateLimits !== void 0) body.rate_limits = request.rateLimits;
+    await this.client.workspaces.update(ref, body);
+    return this.getWorkspace(ref, { plane: "admin" });
   }
-  ui.header(data.appName, `(${data.appId})`);
-  const pairs = [];
-  if (data.monitoringSince) pairs.push(["Monitoring since", data.monitoringSince]);
-  if (data.source) pairs.push(["Source", data.source]);
-  if (data.cloud) pairs.push(["Cloud", data.cloud]);
-  if (data.profiles.length > 0) pairs.push(["Profiles", data.profiles.join(", ")]);
-  if (pairs.length > 0) ui.keyValue(pairs);
-  ui.section("Token consumption:");
-  ui.keyValue([
-    ["Daily avg", fmt(data.tokens.dailyAverage, data.tokens.dailyAverageScale)],
-    ["Monthly total", fmt(data.tokens.monthlyTotal, data.tokens.monthlyTotalScale)]
-  ]);
-  ui.section("Sessions:");
-  ui.keyValue([
-    ["Total", data.sessions.total],
-    ["Violating", data.sessions.violating]
-  ]);
-  const firing = data.detectors.filter((d) => d.total > 0);
-  ui.section(
-    `Detectors (${data.totalViolating} violating, ${firing.length}/${data.detectors.length} firing):`
-  );
-  if (firing.length === 0) {
-    ui.dim("no detector violations in window");
-  } else {
-    ui.table(
-      [
-        { key: "detector", label: "Detector" },
-        { key: "total", label: "Total" },
-        { key: "severity", label: "Severity" }
-      ],
-      firing.map((d) => ({
-        detector: d.type,
-        total: d.total,
-        severity: `c=${d.critical} h=${d.high} m=${d.medium} l=${d.low}`
-      }))
-    );
+  async deleteWorkspace(workspaceRef) {
+    const ref = await this.resolveWorkspaceRef(workspaceRef, ["admin"]);
+    await this.client.workspaces.delete(ref);
   }
-  console.log();
-}
-function renderDeploymentProfileList(profiles, format = "pretty") {
-  if (profiles.length === 0) {
-    ui.emptyList("deployment profiles");
-    return;
+  /**
+   * The API accepts only a UUID or slug as a workspace ref — a display name
+   * gets a misleading 400 AB01 ("No update fields provided") on writes.
+   * Match a user-supplied ref against the workspace list so name | slug |
+   * uuid all work. Unmatched refs pass through so the API's own error stands.
+   */
+  async resolveWorkspaceRef(ref, planes, requireSlug = false) {
+    for (const plane of planes) {
+      let rows;
+      try {
+        rows = await this.listWorkspaces({ plane });
+      } catch {
+        continue;
+      }
+      const byRef = rows.find((w) => w.id === ref || w.slug === ref);
+      if (byRef) return requireSlug ? byRef.slug : ref;
+      const byName = rows.filter((w) => w.name === ref);
+      if (byName.length > 1) {
+        throw new Error(
+          `workspace name '${ref}' is ambiguous (${byName.map((w) => w.slug).join(", ")}) \u2014 use a slug or UUID`
+        );
+      }
+      if (byName.length === 1) return byName[0].slug;
+    }
+    return ref;
   }
-  if (format !== "pretty") {
-    const rows = profiles.map((p) => ({
-      name: p.raw.dp_name ?? p.raw.profile_name ?? p.raw.name ?? "",
-      status: p.raw.status ?? "",
-      authCode: p.raw.auth_code ?? ""
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "name", label: "Name" },
-          { key: "status", label: "Status" },
-          { key: "authCode", label: "Auth Code" }
-        ],
-        format
-      )
-    );
-    return;
+  async getTelemetryCost(opts) {
+    const { workspaceSlug: workspaceRef, days = 7, ...rawFilters } = opts;
+    const filters = AIGatewayChartFiltersSchema.parse(rawFilters);
+    if (!Number.isSafeInteger(days) || days <= 0)
+      throw new Error("Expected days to be a positive integer");
+    const workspaceSlug = await this.resolveWorkspaceRef(workspaceRef, ["data", "admin"], true);
+    const raw = await this.client.telemetry.cost({
+      workspaceSlug,
+      days,
+      ...filters
+    });
+    return {
+      workspaceSlug,
+      days,
+      totalCents: raw.data.total,
+      totalUsd: raw.data.total / 100,
+      avgCents: raw.data.avg,
+      avgUsd: raw.data.avg / 100,
+      quotaExceeded: raw.data.isQuotaExceeded,
+      records: raw.data.records.map((r) => ({
+        date: r.x,
+        costCents: r.y,
+        costUsd: r.y / 100
+      }))
+    };
   }
-  ui.section("Deployment Profiles:");
-  for (const p of profiles) {
-    const name = p.raw.dp_name ?? p.raw.profile_name ?? p.raw.name ?? "unknown";
-    const status = p.raw.status;
-    const authCode = p.raw.auth_code;
-    const statusColor5 = status === "active" ? chalk9.green : chalk9.dim;
-    console.log(
-      `    ${name}${status ? `  ${statusColor5(status)}` : ""}${authCode ? `  ${chalk9.dim(authCode)}` : ""}`
-    );
+  /** Re-read after a write, falling back to the (partial) write response if the get fails. */
+  async refetchAfterWrite(workspaceRef, writeResponse) {
+    try {
+      return await this.getWorkspace(workspaceRef, { plane: "admin" });
+    } catch {
+      return normalizeWorkspaceDetail(writeResponse);
+    }
   }
-  console.log();
-}
+};
 
 // src/cli/confirm.ts
 async function confirmOrAbort(message, force, options = {}) {
@@ -2958,8 +3407,8 @@ import {
   GatewayInferenceInputCreateEmbeddingRequestSchema,
   GatewayInferenceInputCreateResponseSchema
 } from "@cdot65/prisma-airs-sdk";
-import { dump as dump3 } from "js-yaml";
-function integer(raw, flag) {
+import { dump as dump4 } from "js-yaml";
+function integer2(raw, flag) {
   const value = Number(raw);
   if (!Number.isSafeInteger(value) || value < 1)
     throw new CliUsageError(`${flag} must be a positive integer`);
@@ -2992,11 +3441,11 @@ async function inferenceBody(kind, prompt, opts, defaultModel) {
   body.model = model;
   if (opts.stream !== void 0) body.stream = opts.stream;
   if (opts.maxTokens !== void 0)
-    body[kind === "responses" ? "max_output_tokens" : "max_completion_tokens"] = integer(
+    body[kind === "responses" ? "max_output_tokens" : "max_completion_tokens"] = integer2(
       opts.maxTokens,
       "--max-tokens"
     );
-  if (opts.dimensions !== void 0) body.dimensions = integer(opts.dimensions, "--dimensions");
+  if (opts.dimensions !== void 0) body.dimensions = integer2(opts.dimensions, "--dimensions");
   if (opts.encoding !== void 0) body.encoding_format = opts.encoding;
   if (kind === "responses" && body.store === void 0) body.store = false;
   return body;
@@ -3052,14 +3501,14 @@ function registerAiGatewayInference(parent) {
         const client = new AIGatewayInferenceClient({
           endpoint: config.aiGwInferenceEndpoint,
           apiKey: config.aiGwInferenceApiKey,
-          timeoutMs: integer(opts.timeout ?? "60000", "--timeout"),
+          timeoutMs: integer2(opts.timeout ?? "60000", "--timeout"),
           numRetries: 0
         });
         process.once("SIGINT", interrupt);
         process.once("SIGTERM", interrupt);
         process.stdout.on("error", outputError);
-        const write = (text2) => new Promise((resolve6, reject) => {
-          process.stdout.write(text2, (error) => error ? reject(error) : resolve6());
+        const write = (text2) => new Promise((resolve7, reject) => {
+          process.stdout.write(text2, (error) => error ? reject(error) : resolve7());
         });
         const requestOptions = { signal: controller.signal };
         const result = kind === "chat" ? await client.createChatCompletion(
@@ -3086,7 +3535,7 @@ function registerAiGatewayInference(parent) {
           }
           if (format === "pretty") await write("\n");
         } else {
-          const text2 = format === "yaml" ? dump3(result, { noRefs: true }).trimEnd() : format === "pretty" && kind !== "embeddings" ? responseText(result) : JSON.stringify(result, null, 2);
+          const text2 = format === "yaml" ? dump4(result, { noRefs: true }).trimEnd() : format === "pretty" && kind !== "embeddings" ? responseText(result) : JSON.stringify(result, null, 2);
           await write(`${text2}
 `);
           if ("status" in result && (result.status === "failed" || result.status === "incomplete"))
@@ -3224,7 +3673,7 @@ function headersToRecord(headers) {
   }
   return headers;
 }
-function installDebugLogger(logPath) {
+function installDebugLogger(logPath, options = {}) {
   mkdirSync(dirname(logPath), { recursive: true, mode: 448 });
   writeFileSync(logPath, "", { encoding: "utf8", mode: 384, flag: "wx" });
   const originalFetch = globalThis.fetch;
@@ -3239,7 +3688,7 @@ function installDebugLogger(logPath) {
     if (!isAirsUrl(url) && !inference) {
       return originalFetch(input, init2);
     }
-    const dashboard = /\/v1\/mgmt\/(dashboard\/|reports\/scancontent(?:\?|$))/.test(url);
+    const dashboard = options.omitBodies || /\/v1\/mgmt\/(dashboard\/|reports\/scancontent(?:\?|$))/.test(url) || /\/aiag\//.test(new URL(url).pathname);
     const method = init2?.method ?? (input instanceof Request ? input.method : "GET");
     const reqHeaders = redactHeaders(rawHeaders);
     const loggedUrl = redactUrl(url);
@@ -3317,7 +3766,7 @@ function installDebugLogger(logPath) {
 // src/cli/commands/aigateway/shared.ts
 import { open, readFile as readFile2, unlink } from "fs/promises";
 import { AIGatewayClient as AIGatewayClient2 } from "@cdot65/prisma-airs-sdk";
-import { dump as dump4, load } from "js-yaml";
+import { dump as dump5, load } from "js-yaml";
 async function defaultClientFactory() {
   const config = await loadConfig();
   return new AIGatewayClient2(aiGatewayClientOptions(config));
@@ -3398,7 +3847,7 @@ function renderGatewayList(items, format, label) {
     return;
   }
   if (format === "yaml") {
-    console.log(dump4(items, { noRefs: true, lineWidth: -1 }).trimEnd());
+    console.log(dump5(items, { noRefs: true, lineWidth: -1 }).trimEnd());
     return;
   }
   if (items.length === 0) {
@@ -3416,7 +3865,7 @@ function renderGatewayDetail(value, format) {
     return;
   }
   if (format === "yaml") {
-    console.log(dump4(item, { noRefs: true, lineWidth: -1 }).trimEnd());
+    console.log(dump5(item, { noRefs: true, lineWidth: -1 }).trimEnd());
     return;
   }
   const rows = Object.entries(item).map(([key, raw]) => ({
@@ -4747,11 +5196,11 @@ function parseNonnegativePage(value) {
 }
 
 // src/cli/commands/aigateway-report.ts
-import { lstat } from "fs/promises";
-import { resolve } from "path";
+import { lstat as lstat2 } from "fs/promises";
+import { resolve as resolve2 } from "path";
 import { AIGatewayClient as AIGatewayClient3 } from "@cdot65/prisma-airs-sdk";
-import { z } from "zod";
-import { randomUUID } from "crypto";
+import { z as z2 } from "zod";
+import { randomUUID as randomUUID2 } from "crypto";
 function registerAiGatewayReportCommand(aigateway) {
   const command = aigateway.command("report").alias("dashboard").description("Generate an AI Gateway environment report (read-only)").requiredOption("--workspace <ref>", "Workspace slug, UUID, or unique display name").option("--days <n>", "Rolling window in days (default: 1)", "1").option("--start <iso>", "Explicit ISO-8601 start; requires --end").option("--end <iso>", "Explicit ISO-8601 end; requires --start").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
     "--output-file <path>",
@@ -4778,7 +5227,7 @@ function registerAiGatewayReportCommand(aigateway) {
       usageError("Use --days or --start/--end, not both");
     const end = opts.end ? new Date(opts.end) : /* @__PURE__ */ new Date();
     const start = opts.start ? new Date(opts.start) : new Date(end.getTime() - Number(opts.days) * 864e5);
-    const iso = z.string().datetime({ offset: true });
+    const iso = z2.string().datetime({ offset: true });
     if (opts.start && (!iso.safeParse(opts.start).success || !iso.safeParse(opts.end).success) || !Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || start >= end)
       usageError("Provide a valid increasing ISO-8601 window with timezone");
     const maxPages = Number(opts.maxPages);
@@ -4788,11 +5237,11 @@ function registerAiGatewayReportCommand(aigateway) {
       usageError("--title must contain 1\u2013240 characters");
     if (opts.outputFile !== void 0 && !opts.outputFile.trim())
       usageError("--output-file cannot be empty");
-    const defaultName = `airs-aigateway-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
-    const outputPath = opts.outputFile === "-" ? void 0 : resolve(opts.outputFile ?? defaultName);
+    const defaultName = `airs-aigateway-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID2().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve2(opts.outputFile ?? defaultName);
     try {
       if (outputPath) {
-        const existing = await lstat(outputPath).catch((error) => {
+        const existing = await lstat2(outputPath).catch((error) => {
           if (error.code !== "ENOENT") throw error;
           return void 0;
         });
@@ -5339,7 +5788,7 @@ function registerConfigCommand(program) {
 }
 
 // src/cli/commands/doctor.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import { readFile as readFile4 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
 var DOCTOR_TIMEOUT_MS = 5e3;
@@ -5437,8 +5886,8 @@ async function withTimeout(promise, ms) {
   try {
     return await Promise.race([
       promise,
-      new Promise((resolve6) => {
-        timer = setTimeout(() => resolve6(TIMED_OUT), ms);
+      new Promise((resolve7) => {
+        timer = setTimeout(() => resolve7(TIMED_OUT), ms);
       })
     ]);
   } finally {
@@ -5593,7 +6042,7 @@ async function defaultScannerProbe() {
   const config = await loadConfig();
   init(runtimeInitOptions(config));
   const scanner = new Scanner();
-  return scanner.queryByScanIds([randomUUID2()]);
+  return scanner.queryByScanIds([randomUUID3()]);
 }
 async function defaultMgmtProbe() {
   const config = await loadConfig();
@@ -5698,6 +6147,21 @@ function registerDoctorCommand(program) {
 // src/cli/commands/modelsecurity.ts
 import { execFileSync, spawn } from "child_process";
 import * as fs from "fs";
+import { z as z3 } from "zod";
+function supplyChainWindow(opts) {
+  const parsed = z3.object({
+    start: z3.string().datetime({ offset: true }).optional(),
+    end: z3.string().datetime({ offset: true }).optional(),
+    modelVersion: z3.string().uuid().optional()
+  }).refine((v) => !v.start || !v.end || Date.parse(v.start) <= Date.parse(v.end)).safeParse(opts);
+  if (!parsed.success)
+    usageError("Use valid ISO timestamps with start <= end and a valid model-version UUID.");
+  return {
+    startTime: parsed.data.start,
+    endTime: parsed.data.end,
+    modelVersionUuid: parsed.data.modelVersion
+  };
+}
 var VALID_EXTRAS = ["all", "aws", "gcp", "azure", "artifactory", "gitlab"];
 function hasBin(bin) {
   try {
@@ -5707,13 +6171,13 @@ function hasBin(bin) {
     return false;
   }
 }
-function run(bin, args, label) {
-  return new Promise((resolve6, reject) => {
+function run2(bin, args, label) {
+  return new Promise((resolve7, reject) => {
     const child = spawn(bin, args, { stdio: "inherit" });
     child.on("error", (err) => reject(new Error(`Failed to start ${bin}: ${err.message}`)));
     child.on("close", (code) => {
       if (code !== 0) reject(new Error(`${label} failed with exit code ${code}`));
-      else resolve6();
+      else resolve7();
     });
   });
 }
@@ -5847,7 +6311,7 @@ function registerModelSecurityCommand(program) {
       }
       for (const step of steps) {
         ui.status(`\u2192 ${step.label}`);
-        await run(step.bin, step.args, step.label);
+        await run2(step.bin, step.args, step.label);
       }
       ui.success("model-security-client installed successfully.");
       if (useUv) {
@@ -6003,7 +6467,7 @@ function registerModelSecurityCommand(program) {
     }
   });
   const scans = ms.command("scans").description("Model security scan operations");
-  const scansList = scans.command("list").description("List model security scans").option("--eval-outcome <outcome>", "Filter by eval outcome").option("--source-type <type>", "Filter by source type").option("--scan-origin <origin>", "Filter by scan origin").option("--search <query>", "Search scans").option("--limit <n>", "Max results", "20").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
+  const scansList = scans.command("list").description("List model security scans").option("--model-version <uuid>", "Filter scans by model version UUID").option("--start <iso>", "Creation time start (ISO timestamp)").option("--end <iso>", "Creation time end (ISO timestamp)").option("--eval-outcome <outcome>", "Filter by eval outcome").option("--source-type <type>", "Filter by source type").option("--scan-origin <origin>", "Filter by scan origin").option("--search <query>", "Search scans").option("--limit <n>", "Max results", "20").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
     "after",
     examples(
       "airs model-security scans list",
@@ -6017,6 +6481,7 @@ function registerModelSecurityCommand(program) {
       const service = await createService2();
       const listOptions = {
         evalOutcome: opts.evalOutcome,
+        ...supplyChainWindow(opts),
         sourceType: opts.sourceType,
         scanOrigin: opts.scanOrigin,
         search: opts.search,
@@ -6111,7 +6576,7 @@ function registerModelSecurityCommand(program) {
     }
   });
   const models = ms.command("models").description("Browse the scanned model catalog (read-only)");
-  const modelsList = models.command("list").description("List models in the catalog").option("--search <text>", "Filter by search text").option("--search-query <text>", "Filter by model UUID or name").option("--sort-field <field>", "Sort field: created_at, updated_at").option("--sort-order <order>", "Sort order: asc, desc").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText("after", examples("airs model-security models list")).action(async (opts) => {
+  const modelsList = models.command("list").description("List models in the catalog").option("--start <iso>", "Creation time start (ISO timestamp)").option("--end <iso>", "Creation time end (ISO timestamp)").option("--search <text>", "Filter by search text").option("--search-query <text>", "Filter by model UUID or name").option("--sort-field <field>", "Sort field: created_at, updated_at").option("--sort-order <order>", "Sort order: asc, desc").option("--limit <n>", "Max results").option("--offset <n>", "Starting offset").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText("after", examples("airs model-security models list")).action(async (opts) => {
     try {
       const fmt = await resolveOutput(modelsList, opts);
       if (fmt === "pretty") renderModelSecurityHeader();
@@ -6119,6 +6584,7 @@ function registerModelSecurityCommand(program) {
       const listOptions = {
         search: opts.search,
         searchQuery: opts.searchQuery,
+        ...supplyChainWindow(opts),
         sortField: opts.sortField,
         sortOrder: opts.sortOrder,
         limit: opts.limit ? Number.parseInt(opts.limit, 10) : void 0,
@@ -6292,10 +6758,10 @@ async function backupTargets(opts) {
 }
 
 // src/cli/commands/redteam-report.ts
-import { lstat as lstat2 } from "fs/promises";
-import { resolve as resolve2 } from "path";
+import { lstat as lstat3 } from "fs/promises";
+import { resolve as resolve3 } from "path";
 import { RedTeamClient } from "@cdot65/prisma-airs-sdk";
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 function registerRedTeamReportCommand(redteam, scanReport) {
   const command = redteam.command("report [jobId]").alias("dashboard").description("Generate an environment report, or view an individual scan report by job ID").option("--attacks", "Individual scan only: include attack list", false).option("--severity <level>", "Individual scan only: filter attacks by severity").option("--limit <n>", "Individual scan only: max attacks to show", "20").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
     "--output-file <path>",
@@ -6328,11 +6794,11 @@ function registerRedTeamReportCommand(redteam, scanReport) {
       usageError("--title must contain 1\u2013240 characters");
     if (opts.outputFile !== void 0 && !opts.outputFile.trim())
       usageError("--output-file cannot be empty");
-    const defaultName = `airs-redteam-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID3().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
-    const outputPath = opts.outputFile === "-" ? void 0 : resolve2(opts.outputFile ?? defaultName);
+    const defaultName = `airs-redteam-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID4().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve3(opts.outputFile ?? defaultName);
     try {
       if (outputPath) {
-        const existing = await lstat2(outputPath).catch((error) => {
+        const existing = await lstat3(outputPath).catch((error) => {
           if (error.code !== "ENOENT") throw error;
           return void 0;
         });
@@ -7605,7 +8071,7 @@ function registerRedteamCommand(program) {
 }
 
 // src/cli/commands/runtime.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import * as fs5 from "fs";
 import { readFile as readFile10 } from "fs/promises";
 import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
@@ -7853,7 +8319,7 @@ function mergeProfilePolicy(existing, overrides) {
 }
 
 // src/cli/bulk-scan-lock.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import * as fs3 from "fs/promises";
 function errorCode(error) {
   return error?.code;
@@ -7884,7 +8350,7 @@ function processIsAlive(pid) {
   }
 }
 async function installLock(lockPath, record) {
-  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID4()}`;
+  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID5()}`;
   try {
     await fs3.writeFile(candidate, JSON.stringify(record), {
       encoding: "utf-8",
@@ -7902,7 +8368,7 @@ async function acquireBulkScanLock(statePath) {
     version: 1,
     pid: process.pid,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    token: randomUUID4()
+    token: randomUUID5()
   };
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
@@ -7938,32 +8404,32 @@ async function acquireBulkScanLock(statePath) {
 }
 
 // src/cli/bulk-scan-state.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import * as fs4 from "fs/promises";
 import * as path2 from "path";
-import { z as z2 } from "zod";
-var BulkScanResultSchema = z2.object({
-  index: z2.number().int().nonnegative(),
-  reqId: z2.number().int().nonnegative(),
-  prompt: z2.string(),
-  response: z2.string().optional(),
-  scanId: z2.string(),
-  reportId: z2.string(),
-  action: z2.enum(["allow", "block", "failed"]),
-  category: z2.string(),
-  triggered: z2.boolean(),
-  detections: z2.record(z2.boolean()),
-  error: z2.string().optional()
+import { z as z4 } from "zod";
+var BulkScanResultSchema = z4.object({
+  index: z4.number().int().nonnegative(),
+  reqId: z4.number().int().nonnegative(),
+  prompt: z4.string(),
+  response: z4.string().optional(),
+  scanId: z4.string(),
+  reportId: z4.string(),
+  action: z4.enum(["allow", "block", "failed"]),
+  category: z4.string(),
+  triggered: z4.boolean(),
+  detections: z4.record(z4.boolean()),
+  error: z4.string().optional()
 });
-var BulkScanItemSchema = z2.object({
-  index: z2.number().int().nonnegative(),
-  reqId: z2.number().int().nonnegative(),
-  prompt: z2.string(),
-  status: z2.enum(["pending", "submitting", "submitted", "complete", "failed", "ambiguous"]),
-  scanId: z2.string().min(1).optional(),
-  receiptReportId: z2.string().optional(),
+var BulkScanItemSchema = z4.object({
+  index: z4.number().int().nonnegative(),
+  reqId: z4.number().int().nonnegative(),
+  prompt: z4.string(),
+  status: z4.enum(["pending", "submitting", "submitted", "complete", "failed", "ambiguous"]),
+  scanId: z4.string().min(1).optional(),
+  receiptReportId: z4.string().optional(),
   result: BulkScanResultSchema.optional(),
-  error: z2.string().optional()
+  error: z4.string().optional()
 }).superRefine((item, ctx) => {
   if (item.reqId !== item.index) {
     ctx.addIssue({ code: "custom", message: "reqId must match the stable input index" });
@@ -8001,15 +8467,15 @@ var BulkScanItemSchema = z2.object({
     }
   }
 });
-var BulkScanStateSchema = z2.object({
-  version: z2.literal(2),
-  profile: z2.string().min(1),
-  sessionId: z2.string().optional(),
-  outputFile: z2.string().min(1),
-  batchSize: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  createdAt: z2.string().datetime(),
-  updatedAt: z2.string().datetime(),
-  items: z2.array(BulkScanItemSchema).min(1)
+var BulkScanStateSchema = z4.object({
+  version: z4.literal(2),
+  profile: z4.string().min(1),
+  sessionId: z4.string().optional(),
+  outputFile: z4.string().min(1),
+  batchSize: z4.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  createdAt: z4.string().datetime(),
+  updatedAt: z4.string().datetime(),
+  items: z4.array(BulkScanItemSchema).min(1)
 }).superRefine((state, ctx) => {
   const indices = /* @__PURE__ */ new Set();
   for (const [position, item] of state.items.entries()) {
@@ -8035,8 +8501,8 @@ async function saveBulkScanState(state, dir, filePath) {
   }
   await fs4.mkdir(dir, { recursive: true, mode: 448 });
   if (!filePath) await fs4.chmod(dir, 448);
-  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID5()}.bulk-scan.json`);
-  const temporary = `${target}.tmp-${process.pid}-${randomUUID5()}`;
+  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID6()}.bulk-scan.json`);
+  const temporary = `${target}.tmp-${process.pid}-${randomUUID6()}`;
   try {
     await fs4.writeFile(temporary, JSON.stringify(state, null, 2), {
       encoding: "utf-8",
@@ -9161,11 +9627,11 @@ function registerCleanupCommand(parent) {
 }
 
 // src/cli/commands/runtime-dashboard.ts
-import { lstat as lstat3 } from "fs/promises";
-import { resolve as resolve4 } from "path";
-import { dump as dump5 } from "js-yaml";
+import { lstat as lstat4 } from "fs/promises";
+import { resolve as resolve5 } from "path";
+import { dump as dump6 } from "js-yaml";
 var TIME_UNITS = ["hour", "hours", "day", "days"];
-function integer2(value, name, minimum = 0) {
+function integer3(value, name, minimum = 0) {
   const n = Number(value);
   if (!/^\d+$/.test(String(value)) || !Number.isSafeInteger(n) || n < minimum)
     throw new CliUsageError(`${name} must be a safe integer >= ${minimum}`);
@@ -9177,7 +9643,7 @@ function text(value, name) {
 }
 function window(opts) {
   return {
-    timeInterval: integer2(opts.interval, "--interval", 1),
+    timeInterval: integer3(opts.interval, "--interval", 1),
     timeUnit: text(opts.unit, "--unit")
   };
 }
@@ -9192,7 +9658,7 @@ function identity(opts) {
 function scan(opts) {
   return {
     scanId: text(opts.scanId, "--scan-id"),
-    scanSubReqId: integer2(opts.scanSubReqId, "--scan-sub-req-id")
+    scanSubReqId: integer3(opts.scanSubReqId, "--scan-sub-req-id")
   };
 }
 function timeOptions(command, interval = "1", unit = "day", allowedUnits = TIME_UNITS) {
@@ -9209,7 +9675,7 @@ function timeOptions(command, interval = "1", unit = "day", allowedUnits = TIME_
     unit
   );
 }
-function pageOptions(command) {
+function pageOptions2(command) {
   return command.option("--limit <n>", "Items per page", "25").option("--offset <n>", "Item offset", "0");
 }
 function sessionOptions(command) {
@@ -9238,8 +9704,8 @@ function registerRuntimeDashboardCommands(runtime) {
               "Scan content requires exactly one of --show-content or --output-file <new-path>"
             );
           if (opts.outputFile) {
-            const path3 = resolve4(text(opts.outputFile, "--output-file"));
-            const existing = await lstat3(path3).catch((error) => {
+            const path3 = resolve5(text(opts.outputFile, "--output-file"));
+            const existing = await lstat4(path3).catch((error) => {
               if (error.code !== "ENOENT") throw error;
               return void 0;
             });
@@ -9252,9 +9718,9 @@ function registerRuntimeDashboardCommands(runtime) {
           numRetries: 0
         });
         const result = await read(client.dashboard);
-        const output = format === "yaml" ? dump5(result, { noRefs: true, lineWidth: -1 }).trimEnd() : JSON.stringify(result, null, 2);
+        const output = format === "yaml" ? dump6(result, { noRefs: true, lineWidth: -1 }).trimEnd() : JSON.stringify(result, null, 2);
         if (command.name() === "scan-content" && opts.outputFile) {
-          await writeReportFile(resolve4(String(opts.outputFile)), `${output}
+          await writeReportFile(resolve5(String(opts.outputFile)), `${output}
 `);
           ui.status("Scan content exported to the requested private file (0600).");
         } else console.log(output);
@@ -9269,7 +9735,7 @@ function registerRuntimeDashboardCommands(runtime) {
     });
   }
   register6(
-    pageOptions(
+    pageOptions2(
       timeOptions(
         dashboard.command("applications").description("One page of application activity"),
         "1",
@@ -9278,19 +9744,19 @@ function registerRuntimeDashboardCommands(runtime) {
       )
     ),
     (opts) => {
-      const interval = integer2(opts.interval, "--interval", 1);
+      const interval = integer3(opts.interval, "--interval", 1);
       const unit = text(opts.unit, "--unit");
       if (![1, 7, 30, 60].includes(interval) || !["day", "days", "hour"].includes(unit))
         throw new CliUsageError(
           "Application overview supports interval 1/7/30/60 and unit day/days/hour"
         );
-      const query = {
+      const query2 = {
         timeInterval: interval,
         timeUnit: unit,
-        limit: integer2(opts.limit, "--limit", 1),
-        offset: integer2(opts.offset, "--offset")
+        limit: integer3(opts.limit, "--limit", 1),
+        offset: integer3(opts.offset, "--offset")
       };
-      return (client) => client.applicationsOverview(query);
+      return (client) => client.applicationsOverview(query2);
     }
   );
   for (const [name, method] of [
@@ -9305,16 +9771,16 @@ function registerRuntimeDashboardCommands(runtime) {
         ["days"]
       ),
       (opts) => {
-        const interval = integer2(opts.interval, "--interval", 1);
+        const interval = integer3(opts.interval, "--interval", 1);
         if (![7, 30, 60].includes(interval) || opts.unit !== "days")
           throw new CliUsageError("Application detail requires 7, 30, or 60 days");
-        const query = {
+        const query2 = {
           appId: text(opts.appId, "--app-id"),
           appName: text(opts.appName, "--app-name"),
           timeInterval: interval,
           timeUnit: "days"
         };
-        return (client) => client[method](query);
+        return (client) => client[method](query2);
       }
     );
   }
@@ -9326,35 +9792,35 @@ function registerRuntimeDashboardCommands(runtime) {
     register6(
       timeOptions(dashboard.command(name), days ? "30" : "1", days ? "days" : "day"),
       (opts) => {
-        const query = window(opts);
-        return (client) => client[method](query);
+        const query2 = window(opts);
+        return (client) => client[method](query2);
       }
     );
   }
   register6(timeOptions(sessions.command("chart")), (opts) => {
-    const query = window(opts);
-    return (client) => client.sessionsChart(query);
+    const query2 = window(opts);
+    return (client) => client.sessionsChart(query2);
   });
   register6(
-    pageOptions(
+    pageOptions2(
       timeOptions(
         sessions.command("list").description("Session entries; --all walks pages with completeness checks")
       )
     ).option("--all", "Walk all pages (up to 100 pages)").option("--max <n>", "Item cap with --all; 0 removes item cap", "10000"),
     (opts) => {
-      const query = {
+      const query2 = {
         ...window(opts),
-        limit: integer2(opts.limit, "--limit", 1),
-        offset: integer2(opts.offset, "--offset")
+        limit: integer3(opts.limit, "--limit", 1),
+        offset: integer3(opts.offset, "--offset")
       };
-      const maximum = integer2(opts.max, "--max");
+      const maximum = integer3(opts.max, "--max");
       return async (client) => {
         const items = [];
         const seen = /* @__PURE__ */ new Set();
         let expectedTotal;
-        let offset = query.offset;
+        let offset = query2.offset;
         for (let pageIndex = 0; pageIndex < 100; pageIndex++) {
-          const page = await client.sessionsOverview({ ...query, offset });
+          const page = await client.sessionsOverview({ ...query2, offset });
           if (!opts.all) {
             ui.status(
               `Returned ${page.items.length} of ${page.pagination.total_items ?? "unknown"} sessions; this is one page.`
@@ -9362,7 +9828,7 @@ function registerRuntimeDashboardCommands(runtime) {
             return page.items;
           }
           const total = page.pagination.total_items;
-          if (!Number.isSafeInteger(total) || total < 0 || page.pagination.skip !== offset || page.pagination.limit !== query.limit || page.items.length > query.limit || expectedTotal !== void 0 && total !== expectedTotal)
+          if (!Number.isSafeInteger(total) || total < 0 || page.pagination.skip !== offset || page.pagination.limit !== query2.limit || page.items.length > query2.limit || expectedTotal !== void 0 && total !== expectedTotal)
             throw new Error("Unstable pagination");
           expectedTotal = total;
           for (const item of page.items) {
@@ -9385,7 +9851,7 @@ function registerRuntimeDashboardCommands(runtime) {
           }
           if (offset === total) {
             ui.status(
-              `Retrieved ${items.length} sessions from offset ${query.offset}; pagination complete.`
+              `Retrieved ${items.length} sessions from offset ${query2.offset}; pagination complete.`
             );
             return items;
           }
@@ -9401,33 +9867,33 @@ function registerRuntimeDashboardCommands(runtime) {
       };
     }
   );
-  register6(pageOptions(sessionOptions(sessions.command("get"))), (opts) => {
-    const query = {
+  register6(pageOptions2(sessionOptions(sessions.command("get"))), (opts) => {
+    const query2 = {
       ...identity(opts),
-      limit: integer2(opts.limit, "--limit", 1),
-      offset: integer2(opts.offset, "--offset")
+      limit: integer3(opts.limit, "--limit", 1),
+      offset: integer3(opts.offset, "--offset")
     };
-    return (client) => client.session(query);
+    return (client) => client.session(query2);
   });
   register6(scanOptions(sessionOptions(sessions.command("transaction"))), (opts) => {
-    const query = { ...identity(opts), ...scan(opts) };
-    return (client) => client.sessionTransaction(query);
+    const query2 = { ...identity(opts), ...scan(opts) };
+    return (client) => client.sessionTransaction(query2);
   });
   register6(
     scanOptions(
       sessions.command("scan-content").description("Explicit sensitive scan-content read; never automatically fetched")
     ).option("--show-content", "Explicitly display stored content on stdout").option("--output-file <path>", "Private new file for stored content (no overwrite)"),
     (opts) => {
-      const query = scan(opts);
-      return (client) => client.scanContent(query);
+      const query2 = scan(opts);
+      return (client) => client.scanContent(query2);
     }
   );
 }
 
 // src/cli/commands/runtime-report.ts
-import { lstat as lstat4 } from "fs/promises";
-import { resolve as resolve5 } from "path";
-import { randomUUID as randomUUID6 } from "crypto";
+import { lstat as lstat5 } from "fs/promises";
+import { resolve as resolve6 } from "path";
+import { randomUUID as randomUUID7 } from "crypto";
 function registerRuntimeReportCommand(runtime) {
   const command = runtime.command("report").description("Generate a daily AI Runtime Security environment report (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
     "--output-file <path>",
@@ -9451,11 +9917,11 @@ function registerRuntimeReportCommand(runtime) {
       usageError("--title must contain 1\u2013240 characters");
     if (opts.outputFile !== void 0 && !opts.outputFile.trim())
       usageError("--output-file cannot be empty");
-    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID6().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
-    const outputPath = opts.outputFile === "-" ? void 0 : resolve5(opts.outputFile ?? defaultName);
+    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID7().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve6(opts.outputFile ?? defaultName);
     try {
       if (outputPath) {
-        const existing = await lstat4(outputPath).catch((error) => {
+        const existing = await lstat5(outputPath).catch((error) => {
           if (error.code !== "ENOENT") throw error;
           return void 0;
         });
@@ -9942,7 +10408,7 @@ function completedBulkResults(state) {
 }
 async function writeBulkResults(outputPath, results) {
   await fs5.promises.mkdir(dirname3(outputPath), { recursive: true });
-  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID7()}`;
+  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID8()}`;
   try {
     await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
       encoding: "utf-8",
@@ -10745,7 +11211,8 @@ var READ_COMMAND_NAMES = /* @__PURE__ */ new Set([
   "version",
   "versions",
   "violation",
-  "violations"
+  "violations",
+  "vulnerabilities"
 ]);
 function applyListDeleteAliases(cmd) {
   for (const sub of cmd.commands) {
@@ -10787,7 +11254,9 @@ function buildProgram() {
   program.hook("preAction", async (_thisCommand, actionCommand) => {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
-    const isEnvironmentReport = actionCommand.name() === "report" && ["runtime", "redteam", "aigateway"].includes(actionCommand.parent?.name() ?? "") && !(actionCommand.parent?.name() === "redteam" && actionCommand.args.length > 0);
+    const isEnvironmentReport = actionCommand.name() === "report" && ["runtime", "redteam", "aigateway", "agentguard"].includes(
+      actionCommand.parent?.name() ?? ""
+    ) && !(actionCommand.parent?.name() === "redteam" && actionCommand.args.length > 0);
     if (isEnvironmentReport && (root.debug || /^(1|true|yes|on)$/i.test(process.env.PANW_AI_SEC_DEBUG?.trim() ?? "")))
       usageError(
         "Disable --debug and PANW_AI_SEC_DEBUG for environment reports to avoid persisting sensitive traffic content"
@@ -10803,10 +11272,16 @@ function buildProgram() {
     if (root.debug) {
       const logPath = join4(
         process.cwd(),
-        `debug-api-${Date.now()}-${randomUUID8().slice(0, 8)}.jsonl`
+        `debug-api-${Date.now()}-${randomUUID9().slice(0, 8)}.jsonl`
       );
       try {
-        installDebugLogger(logPath);
+        let ancestor = actionCommand;
+        let agentGuard = false;
+        while (ancestor) {
+          if (ancestor.name() === "agentguard") agentGuard = true;
+          ancestor = ancestor.parent;
+        }
+        installDebugLogger(logPath, { omitBodies: agentGuard });
       } catch {
         ui.error(
           "Cannot create the debug log in the current working directory. Run from a writable directory or omit --debug."
@@ -10819,6 +11294,7 @@ function buildProgram() {
   registerRuntimeCommand(program);
   registerRedteamCommand(program);
   registerModelSecurityCommand(program);
+  registerAgentGuardCommand(program);
   registerAiGatewayCommand(program);
   registerConfigCommand(program);
   registerDoctorCommand(program);