@cdot65/prisma-airs-cli 5.7.1 → 5.8.1

package/dist/cli/index.js

@@ -59,7 +59,7 @@ function installProcessGuards() {
 }
 
 // src/cli/program.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
 import { dirname as dirname5, join as join5 } from "path";
 import { fileURLToPath } from "url";
@@ -142,8 +142,8 @@ function modelSecurityClientOptions(config) {
 
 // src/reports/agentguard.ts
 async function collectAgentGuardReport(client, options = {}) {
-  const maxPages2 = options.maxPages ?? 40;
-  if (!Number.isSafeInteger(maxPages2) || maxPages2 < 1 || maxPages2 > 100)
+  const maxPages3 = options.maxPages ?? 40;
+  if (!Number.isSafeInteger(maxPages3) || maxPages3 < 1 || maxPages3 > 100)
     throw new Error("maxPages must be between 1 and 100");
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const end = now();
@@ -205,7 +205,7 @@ async function collectAgentGuardReport(client, options = {}) {
     const seen = /* @__PURE__ */ new Set();
     let total;
     try {
-      for (let page = 0; page < maxPages2; page++) {
+      for (let page = 0; page < maxPages3; page++) {
         const r = await read(rows.length);
         s.pages++;
         if (!Number.isSafeInteger(r.total) || r.total < 0 || !Array.isArray(r.rows) || r.rows.length > 10)
@@ -222,7 +222,7 @@ async function collectAgentGuardReport(client, options = {}) {
         if (pageCount ? r.rows.length < 10 : rows.length === total) return rows;
         if (!r.rows.length) throw new Error();
       }
-      s.notes.push(`Reached the ${maxPages2}-page budget.`);
+      s.notes.push(`Reached the ${maxPages3}-page budget.`);
       throw new Error();
     } catch (error) {
       if (!rows.length) throw error;
@@ -3494,7 +3494,7 @@ function registerAiGatewayInference(parent) {
       const outputError = (error) => controller.abort(error);
       let stream;
       let failed = false;
-      let failure2;
+      let failure3;
       try {
         const format = await resolveOutput(command, opts, { allowed: ["pretty", "json", "yaml"] });
         const config = await loadConfig({ aiGwInferenceEndpoint: opts.endpoint });
@@ -3521,8 +3521,8 @@ function registerAiGatewayInference(parent) {
         process.once("SIGINT", interrupt);
         process.once("SIGTERM", interrupt);
         process.stdout.on("error", outputError);
-        const write = (text2) => new Promise((resolve8, reject) => {
-          process.stdout.write(text2, (error) => error ? reject(error) : resolve8());
+        const write = (text2) => new Promise((resolve9, reject) => {
+          process.stdout.write(text2, (error) => error ? reject(error) : resolve9());
         });
         const requestOptions = { signal: controller.signal };
         const result = kind === "chat" ? await client.createChatCompletion(
@@ -3557,7 +3557,7 @@ function registerAiGatewayInference(parent) {
         }
       } catch (error) {
         failed = true;
-        failure2 = error;
+        failure3 = error;
       } finally {
         await stream?.cancel();
         controller.abort();
@@ -3565,10 +3565,10 @@ function registerAiGatewayInference(parent) {
         process.removeListener("SIGTERM", interrupt);
         process.stdout.removeListener("error", outputError);
       }
-      if (failed && failure2?.code !== "EPIPE") {
-        if (failure2?.errorType === ErrorType.USER_REQUEST_PAYLOAD_ERROR)
-          usageError(failure2 instanceof Error ? failure2.message : "Invalid inference options");
-        fail(failure2);
+      if (failed && failure3?.code !== "EPIPE") {
+        if (failure3?.errorType === ErrorType.USER_REQUEST_PAYLOAD_ERROR)
+          usageError(failure3 instanceof Error ? failure3.message : "Invalid inference options");
+        fail(failure3);
       }
     });
   }
@@ -3896,20 +3896,20 @@ function renderGatewayDetail(value, format) {
   );
   if (rendered) console.log(rendered);
 }
-async function runList(command, opts, label, load3) {
+async function runList(command, opts, label, load4) {
   try {
     const format = await resolveOutput(command, opts);
     const client = await createAiGatewayClient();
-    renderGatewayList(responseItems(await load3(client)), format, label);
+    renderGatewayList(responseItems(await load4(client)), format, label);
   } catch (error) {
     failAiGateway(error);
   }
 }
-async function runDetail(command, opts, load3) {
+async function runDetail(command, opts, load4) {
   try {
     const format = await resolveOutput(command, opts);
     const client = await createAiGatewayClient();
-    renderGatewayDetail(await load3(client), format);
+    renderGatewayDetail(await load4(client), format);
   } catch (error) {
     failAiGateway(error);
   }
@@ -5244,8 +5244,8 @@ function registerAiGatewayReportCommand(aigateway) {
     const iso = z2.string().datetime({ offset: true });
     if (opts.start && (!iso.safeParse(opts.start).success || !iso.safeParse(opts.end).success) || !Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || start >= end)
       usageError("Provide a valid increasing ISO-8601 window with timezone");
-    const maxPages2 = Number(opts.maxPages);
-    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages2) || maxPages2 > 100)
+    const maxPages3 = Number(opts.maxPages);
+    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages3) || maxPages3 > 100)
       usageError("--max-pages must be an integer from 1 to 100");
     if (typeof opts.title !== "string" || !opts.title.trim() || opts.title.length > 240)
       usageError("--title must contain 1\u2013240 characters");
@@ -5269,7 +5269,7 @@ function registerAiGatewayReportCommand(aigateway) {
       ui.status("Collecting AI Gateway statistics and current configuration (read-only)...");
       const report = await collectGatewayEnvironmentReport(client, {
         title: opts.title,
-        maxPages: maxPages2,
+        maxPages: maxPages3,
         workspace: opts.workspace,
         tsgId: config.mgmtTsgId ?? process.env.PANW_AI_GW_TSG_ID ?? "",
         start,
@@ -5900,8 +5900,8 @@ async function withTimeout(promise, ms) {
   try {
     return await Promise.race([
       promise,
-      new Promise((resolve8) => {
-        timer = setTimeout(() => resolve8(TIMED_OUT), ms);
+      new Promise((resolve9) => {
+        timer = setTimeout(() => resolve9(TIMED_OUT), ms);
       })
     ]);
   } finally {
@@ -6186,12 +6186,12 @@ function hasBin(bin) {
   }
 }
 function run2(bin, args, label) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const child = spawn(bin, args, { stdio: "inherit" });
     child.on("error", (err) => reject(new Error(`Failed to start ${bin}: ${err.message}`)));
     child.on("close", (code) => {
       if (code !== 0) reject(new Error(`${label} failed with exit code ${code}`));
-      else resolve8();
+      else resolve9();
     });
   });
 }
@@ -6801,8 +6801,8 @@ function registerRedTeamReportCommand(redteam, scanReport) {
     const format = opts.output ?? command.parent?.parent?.opts().output ?? "html";
     if (format !== "html" && format !== "markdown")
       usageError("Report output must be html or markdown");
-    const maxPages2 = Number(opts.maxPages);
-    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages2) || maxPages2 > 100)
+    const maxPages3 = Number(opts.maxPages);
+    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages3) || maxPages3 > 100)
       usageError("--max-pages must be an integer from 1 to 100");
     if (typeof opts.title !== "string" || !opts.title.trim() || opts.title.length > 240)
       usageError("--title must contain 1\u2013240 characters");
@@ -6826,7 +6826,7 @@ function registerRedTeamReportCommand(redteam, scanReport) {
       ui.status("Collecting Red Team statistics and current configuration (read-only)...");
       const report = await collectRedTeamEnvironmentReport(client, {
         title: opts.title,
-        maxPages: maxPages2
+        maxPages: maxPages3
       });
       const rendered = format === "html" ? renderRedTeamReportHtml(report) : renderRedTeamReportMarkdown(report);
       if (outputPath) {
@@ -8085,9 +8085,9 @@ function registerRedteamCommand(program) {
 }
 
 // src/cli/commands/runtime.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import * as fs5 from "fs";
-import { readFile as readFile11 } from "fs/promises";
+import { readFile as readFile12 } from "fs/promises";
 import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
 import chalk11 from "chalk";
 
@@ -9550,23 +9550,1017 @@ function register5(dlp) {
   });
 }
 
+// src/cli/commands/dlp/transfer.ts
+import { randomUUID as randomUUID7 } from "crypto";
+import { readFile as readFile9, stat } from "fs/promises";
+import { extname, resolve as resolve5 } from "path";
+import { AISecSDKException as AISecSDKException2, ManagementClient } from "@cdot65/prisma-airs-sdk";
+import { dump as dump6, JSON_SCHEMA, load as load2 } from "js-yaml";
+import { ZodError } from "zod";
+
+// src/backup/dlp-resources.ts
+import {
+  AdvancedDataProfileRequestSchema,
+  DataPatternRequestSchema,
+  DataPatternResponseSchema,
+  DataProfileResponseSchema,
+  DictionaryRequestSchema,
+  DictionaryResponseSchema
+} from "@cdot65/prisma-airs-sdk";
+import { z as z5 } from "zod";
+var DLP_RESOURCE_KINDS = ["dictionaries", "patterns", "profiles"];
+var DlpResourcesBackupSchema = z5.object({
+  version: z5.literal(1),
+  resourceType: z5.literal("dlp-resources"),
+  exportedAt: z5.string().datetime({ offset: true }),
+  source: z5.object({ tsgId: z5.string().min(1) }).strict(),
+  dictionaries: z5.array(DictionaryResponseSchema).max(1e4),
+  patterns: z5.array(DataPatternResponseSchema).max(1e4),
+  profiles: z5.array(DataProfileResponseSchema).max(1e4)
+}).strict();
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+var PORTABLE_TECHNIQUES = /* @__PURE__ */ new Set(["regex", "weighted_regex", "file_property"]);
+var RETIRED_PATTERN = /* @__PURE__ */ new Set(["deleted", "disabled"]);
+var RETIRED_PROFILE = /* @__PURE__ */ new Set(["deleted", "disabled"]);
+var SERVER_METADATA_KEYS = /* @__PURE__ */ new Set([
+  "id",
+  "version",
+  "status",
+  "profile_status",
+  "tenant_id",
+  "license_type",
+  "is_parent_managed",
+  "audit_metadata",
+  "type",
+  "advance_data_patterns_rule_request",
+  "dictionary_metadata",
+  "detection_technique",
+  "detection_sub_technique",
+  "attributes",
+  "keywords",
+  "tags"
+]);
+function pagesLimit(value) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > 1e3)
+    throw new Error("maxPages must be an integer from 1 to 1000");
+}
+function assertName(name) {
+  if (!name.trim() || [...name].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+    throw new Error("DLP resource names must be nonempty and contain no control characters");
+}
+async function springPages(fetch, maxPages3, label) {
+  pagesLimit(maxPages3);
+  const items = [];
+  for (let page = 0; page < maxPages3; page++) {
+    const result = await fetch(page);
+    items.push(...result.content);
+    if (items.length > 1e4)
+      throw new Error(`Inventory of ${label} exceeds the 10000-record safety limit`);
+    const last = result.last ?? (result.totalPages !== void 0 ? page + 1 >= result.totalPages : result.content.length < 100);
+    if (last) return items;
+    if (!result.content.length) throw new Error(`Inventory of ${label} did not advance`);
+  }
+  throw new Error(`Inventory of ${label} is incomplete: increase --max-pages`);
+}
+async function inventories(api, maxPages3) {
+  return {
+    dictionaries: await springPages(
+      (page) => api.dictionaries.list({ page, size: 100, keywords: true }),
+      maxPages3,
+      "dictionaries"
+    ),
+    patterns: await springPages(
+      (page) => api.patterns.list({ page, size: 100 }),
+      maxPages3,
+      "data patterns"
+    ),
+    profiles: await springPages(
+      (page) => api.profiles.list({ page, size: 100 }),
+      maxPages3,
+      "data profiles"
+    )
+  };
+}
+function canonical(value) {
+  const order = (v) => Array.isArray(v) ? v.map(order) : object(v) ? Object.fromEntries(
+    Object.entries(v).filter(([, child]) => child !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([k, child]) => [k, order(child)])
+  ) : v;
+  return JSON.stringify(order(value));
+}
+function tenantIdentity(records) {
+  const values = new Set(
+    records.map((record) => record.tenant_id).filter((value) => value != null)
+  );
+  if (values.size > 1) throw new Error("Inventory reports mixed DLP tenant identities");
+  return [...values][0];
+}
+function ruleLeaves(profile) {
+  const leaves = [];
+  const visit = (node, depth) => {
+    if (depth > 100) throw new Error("Unsupported detection rule: expression tree too deep");
+    if (!object(node)) return;
+    if (object(node.rule_item)) {
+      if (typeof node.rule_item.detection_technique !== "string")
+        throw new Error("Unsupported detection rule: leaf without a detection technique");
+      leaves.push({ value: node.rule_item, technique: node.rule_item.detection_technique });
+    }
+    if (Array.isArray(node.sub_expressions))
+      for (const child of node.sub_expressions) visit(child, depth + 1);
+  };
+  for (const rule of profile.detection_rules ?? []) {
+    if (!object(rule)) throw new Error("Unsupported detection rule shape");
+    if (rule.rule_type !== "expression_tree")
+      throw new Error(`Unsupported detection rule type: ${String(rule.rule_type)}`);
+    visit(rule.expression_tree, 0);
+  }
+  return leaves;
+}
+function assertKnownReferences(body, known, label) {
+  const visit = (value, path3) => {
+    if (Array.isArray(value)) {
+      value.forEach((v, i) => {
+        visit(v, `${path3}[${i}]`);
+      });
+      return;
+    }
+    if (!object(value)) return;
+    for (const [key, child] of Object.entries(value)) {
+      if (child !== null && child !== "" && /(?:^|[-_])(id|uuid)$|(?:Id|ID|Uuid|UUID)$/.test(key) && !(known.has(value) && key === "id"))
+        throw new Error(`Unsupported cross-tenant reference in ${label} at ${path3}.${key}`);
+      visit(child, `${path3}.${key}`);
+    }
+  };
+  visit(body, label);
+}
+function uniqueNames(records, label) {
+  const names = /* @__PURE__ */ new Set();
+  for (const record of records) {
+    const name = record.name;
+    if (!name) throw new Error(`Backup contains a ${label} without a name`);
+    assertName(name);
+    if (names.has(name)) throw new Error(`Backup contains duplicate ${label} names: ${name}`);
+    names.add(name);
+  }
+}
+async function backupDlpResources(api, tsgId, options = {}) {
+  if (!tsgId) throw new Error("Source TSG ID is required");
+  const maxPages3 = options.maxPages ?? 100;
+  const kinds = options.resources ?? [...DLP_RESOURCE_KINDS];
+  if (!kinds.length || kinds.some((kind) => !DLP_RESOURCE_KINDS.includes(kind)))
+    throw new Error("resources must name dictionaries, patterns and/or profiles");
+  const inventory2 = await inventories(api, maxPages3);
+  tenantIdentity([...inventory2.patterns, ...inventory2.profiles]);
+  const dictionaries = /* @__PURE__ */ new Map();
+  const patterns = /* @__PURE__ */ new Map();
+  const addDictionary = (record) => {
+    if (!record.id) throw new Error("Inventory dictionary has no id");
+    if (record.type !== "predefined" && !Array.isArray(record.keywords))
+      throw new Error(`Dictionary keywords were not returned by the region: ${record.name}`);
+    dictionaries.set(record.id, structuredClone(record));
+  };
+  const addPattern = (record) => {
+    if (!record.id) throw new Error("Inventory data pattern has no id");
+    patterns.set(record.id, structuredClone(record));
+  };
+  if (kinds.includes("dictionaries")) {
+    for (const record of inventory2.dictionaries)
+      if (record.type !== "predefined") addDictionary(record);
+  }
+  if (kinds.includes("patterns")) {
+    for (const record of inventory2.patterns)
+      if (record.type !== "predefined" && !RETIRED_PATTERN.has(record.status ?? "active"))
+        addPattern(record);
+  }
+  const profiles2 = [];
+  const skipped = [];
+  if (kinds.includes("profiles")) {
+    const patternById = new Map(inventory2.patterns.map((p) => [p.id ?? "", p]));
+    const dictionaryById = new Map(inventory2.dictionaries.map((d) => [d.id ?? "", d]));
+    for (const profile of inventory2.profiles) {
+      if (profile.type === "predefined") continue;
+      if (RETIRED_PROFILE.has(profile.profile_status ?? "active")) continue;
+      const name = profile.name ?? "(unnamed)";
+      try {
+        for (const leaf of ruleLeaves(profile)) {
+          const id = leaf.value.id;
+          if (id == null || id === "") {
+            if (leaf.value.edm_dataset_id != null)
+              throw new Error("references an EDM dataset directly");
+            continue;
+          }
+          if (typeof id !== "string") throw new Error("has a non-string rule reference id");
+          if (leaf.technique === "dictionary") {
+            const record = dictionaryById.get(id);
+            if (!record) throw new Error(`references an unknown dictionary: ${id}`);
+            if (leaf.value.version != null)
+              throw new Error(`references a version-pinned dictionary: ${id}`);
+            addDictionary(record);
+          } else {
+            const record = patternById.get(id);
+            if (!record) throw new Error(`references an unknown data pattern: ${id}`);
+            if (leaf.value.version != null && record.version !== leaf.value.version)
+              throw new Error(
+                `references data pattern version ${leaf.value.version}, but the catalog holds version ${record.version ?? "unknown"}: ${id}`
+              );
+            addPattern(record);
+          }
+        }
+        profiles2.push(structuredClone(profile));
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : "unsupported rule";
+        skipped.push({ profile: name, reason });
+      }
+    }
+    if (skipped.length && !options.skipUnsupported)
+      throw new Error(
+        `Profiles cannot be exported: ${skipped.map((item) => `${item.profile} (${item.reason})`).join("; ")}; exclude unsupported profiles explicitly with --skip-unsupported`
+      );
+  }
+  const byName = (a, b) => (a.name ?? "").localeCompare(b.name ?? "");
+  const dictionaryRecords = [...dictionaries.values()].sort(byName);
+  const patternRecords = [...patterns.values()].sort(byName);
+  profiles2.sort(byName);
+  uniqueNames(dictionaryRecords, "dictionary");
+  uniqueNames(patternRecords, "data pattern");
+  uniqueNames(profiles2, "data profile");
+  if (!dictionaryRecords.length && !patternRecords.length && !profiles2.length)
+    throw new Error("No matching DLP resources to back up");
+  const backup = DlpResourcesBackupSchema.parse({
+    version: 1,
+    resourceType: "dlp-resources",
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    source: { tsgId },
+    dictionaries: dictionaryRecords,
+    patterns: patternRecords,
+    profiles: profiles2
+  });
+  return { backup, skipped };
+}
+function compareEcho(request, readBack) {
+  const differences = [];
+  const serverAdded = [];
+  const visit = (source, target, path3, top) => {
+    const a = source ?? null;
+    const b = target ?? null;
+    if (a === null && b === null) return;
+    if (a === null) {
+      serverAdded.push(path3);
+      return;
+    }
+    if (b === null) {
+      differences.push(path3);
+      return;
+    }
+    if (Array.isArray(a) || Array.isArray(b)) {
+      if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
+        differences.push(path3);
+        return;
+      }
+      a.forEach((item, index) => {
+        visit(item, b[index], `${path3}[${index}]`, false);
+      });
+      return;
+    }
+    if (object(a) && object(b)) {
+      for (const key of /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)])) {
+        if (top && !(key in a) && SERVER_METADATA_KEYS.has(key)) continue;
+        visit(a[key], b[key], `${path3}.${key}`, false);
+      }
+      return;
+    }
+    if (a !== b) differences.push(path3);
+  };
+  visit(request, readBack, "body", true);
+  return { matches: differences.length === 0, differences, serverAdded };
+}
+function keywordSet(value) {
+  if (!Array.isArray(value) || value.some((keyword) => typeof keyword !== "string"))
+    return void 0;
+  return [...value].sort();
+}
+function dictionaryEcho(metadata, record, keywords) {
+  const { original_file_name, ...projection } = metadata;
+  const echo = compareEcho(projection, record);
+  const echoedFile = record?.dictionary_metadata?.original_file_name;
+  const echoedKeywords = keywordSet(record?.keywords);
+  const matches = echo.matches && (echoedFile == null || echoedFile === original_file_name) && echoedKeywords !== void 0 && canonical(echoedKeywords) === canonical(keywords);
+  return { matches, serverAdded: echo.serverAdded };
+}
+function dictionaryRequest(source, name) {
+  const metadata = {
+    category: source.category,
+    name,
+    original_file_name: source.dictionary_metadata?.original_file_name ?? "keywords.txt",
+    region_name: source.region_name,
+    ...source.description != null ? { description: source.description } : {},
+    ...source.is_case_sensitive != null ? { is_case_sensitive: source.is_case_sensitive } : {}
+  };
+  const parsed = DictionaryRequestSchema.safeParse(metadata);
+  if (!parsed.success)
+    throw new Error(`Dictionary cannot be rebuilt from the backup: ${source.name}`);
+  return parsed.data;
+}
+function patternRequest(source, name) {
+  const body = {
+    name,
+    type: source.type,
+    detection_config: source.detection_config,
+    ...source.matching_rules != null ? { matching_rules: source.matching_rules } : {},
+    ...source.description != null ? { description: source.description } : {},
+    ...source.tags != null ? { tags: source.tags } : {}
+  };
+  const parsed = DataPatternRequestSchema.safeParse(structuredClone(body));
+  if (!parsed.success)
+    throw new Error(`Data pattern cannot be rebuilt from the backup: ${source.name}`);
+  return parsed.data;
+}
+function portablePattern(record) {
+  return PORTABLE_TECHNIQUES.has(record.detection_config?.technique ?? "") && record.detection_config?.technique !== void 0;
+}
+function matchByName(records, name, retired, label) {
+  const matches = records.filter((record) => record.name === name && !retired(record));
+  if (matches.length > 1) throw new Error(`Ambiguous destination ${label} name: ${name}`);
+  return matches[0];
+}
+async function planDlpResourcesRestore(api, input2, destinationTsgId, options = {}) {
+  const backup = DlpResourcesBackupSchema.parse(input2);
+  if (!destinationTsgId) throw new Error("Destination TSG ID is required");
+  const maxPages3 = options.maxPages ?? 100;
+  pagesLimit(maxPages3);
+  const prefix = options.namePrefix ?? "";
+  if (prefix.length > 64 || [...prefix].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+    throw new Error("Invalid --name-prefix");
+  const conflict = options.onConflict ?? "error";
+  if (!["error", "verify", "skip"].includes(conflict)) throw new Error("Invalid conflict policy");
+  const patternMap2 = options.patternMap ?? {};
+  uniqueNames(backup.dictionaries, "dictionary");
+  uniqueNames(backup.patterns, "data pattern");
+  uniqueNames(backup.profiles, "data profile");
+  const unknownMapped = Object.keys(patternMap2).filter(
+    (name) => !backup.patterns.some((p) => p.name === name)
+  );
+  if (unknownMapped.length)
+    throw new Error(`--pattern-map names absent from the backup: ${unknownMapped.join(", ")}`);
+  const crossTenant = backup.source.tsgId !== destinationTsgId;
+  const destination = await inventories(api, maxPages3);
+  const sourceTenant = tenantIdentity([...backup.patterns, ...backup.profiles]);
+  const destinationTenant = tenantIdentity([...destination.patterns, ...destination.profiles]);
+  if (sourceTenant !== void 0 && destinationTenant !== void 0) {
+    if (crossTenant && sourceTenant === destinationTenant)
+      throw new Error(
+        "Destination credentials report the source DLP tenant; check the selected tenant before restoring"
+      );
+    if (!crossTenant && sourceTenant !== destinationTenant)
+      throw new Error(
+        "Destination DLP tenant does not match the backup source; use distinct tenant credentials deliberately"
+      );
+  }
+  const dictionaryPlans = [];
+  for (const source of backup.dictionaries) {
+    if (!source.id || !source.name) throw new Error("Backup dictionary lacks identity");
+    if (source.type === "predefined") {
+      const match2 = matchByName(destination.dictionaries, source.name, () => false, "dictionary");
+      if (!match2?.id || match2.type !== "predefined")
+        throw new Error(`Missing predefined destination dictionary: ${source.name}`);
+      dictionaryPlans.push({
+        sourceId: source.id,
+        name: source.name,
+        action: "resolve",
+        existing: structuredClone(match2)
+      });
+      continue;
+    }
+    const name = `${prefix}${source.name}`;
+    assertName(name);
+    const metadata = dictionaryRequest(source, name);
+    const keywords = keywordSet(source.keywords);
+    if (!keywords) throw new Error(`Backup dictionary lacks keywords: ${source.name}`);
+    const match = matchByName(destination.dictionaries, name, () => false, "dictionary");
+    if (!match) {
+      dictionaryPlans.push({ sourceId: source.id, name, action: "create", metadata, keywords });
+      continue;
+    }
+    if (!match.id) throw new Error(`Destination dictionary has no identity: ${name}`);
+    if (!dictionaryEcho(metadata, match, keywords).matches)
+      throw new Error(
+        `Destination dictionary differs: ${name}; use --name-prefix to avoid changing a shared dictionary`
+      );
+    dictionaryPlans.push({
+      sourceId: source.id,
+      name,
+      action: "reuse",
+      metadata,
+      keywords,
+      existing: structuredClone(match)
+    });
+  }
+  const patternPlans = [];
+  for (const source of backup.patterns) {
+    if (!source.id || !source.name) throw new Error("Backup data pattern lacks identity");
+    const retired = (record) => RETIRED_PATTERN.has(record.status ?? "active");
+    if (source.type === "predefined") {
+      const match2 = matchByName(destination.patterns, source.name, retired, "data pattern");
+      if (!match2?.id || match2.type !== "predefined")
+        throw new Error(`Missing predefined destination data pattern: ${source.name}`);
+      patternPlans.push({
+        sourceId: source.id,
+        name: source.name,
+        action: "resolve",
+        existing: structuredClone(match2)
+      });
+      continue;
+    }
+    if (Object.hasOwn(patternMap2, source.name)) {
+      const target = patternMap2[source.name];
+      const match2 = matchByName(destination.patterns, target, retired, "data pattern");
+      if (!match2?.id) throw new Error(`Missing mapped destination data pattern: ${target}`);
+      patternPlans.push({
+        sourceId: source.id,
+        name: target,
+        action: "map",
+        existing: structuredClone(match2)
+      });
+      continue;
+    }
+    if (!portablePattern(source))
+      throw new Error(
+        `Data pattern uses a tenant-bound detection technique: ${source.name}; provision it in the destination and bind it with --pattern-map "${source.name}=<destination-name>"`
+      );
+    const name = `${prefix}${source.name}`;
+    assertName(name);
+    const body = patternRequest(source, name);
+    if (crossTenant) assertKnownReferences(body, /* @__PURE__ */ new Set(), `pattern ${source.name}`);
+    const match = matchByName(destination.patterns, name, retired, "data pattern");
+    if (!match) {
+      patternPlans.push({ sourceId: source.id, name, action: "create", body });
+      continue;
+    }
+    if (!match.id) throw new Error(`Destination data pattern has no identity: ${name}`);
+    if (!compareEcho(body, match).matches)
+      throw new Error(
+        `Destination data pattern differs: ${name}; use --name-prefix to avoid changing a shared pattern`
+      );
+    patternPlans.push({
+      sourceId: source.id,
+      name,
+      action: "reuse",
+      body,
+      existing: structuredClone(match)
+    });
+  }
+  const profilePlans = [];
+  for (const source of backup.profiles) {
+    if (!source.name) throw new Error("Backup data profile lacks identity");
+    if (source.type === "predefined") throw new Error("Backup contains a predefined data profile");
+    const name = `${prefix}${source.name}`;
+    assertName(name);
+    const match = matchByName(
+      destination.profiles,
+      name,
+      (record) => RETIRED_PROFILE.has(record.profile_status ?? "active"),
+      "data profile"
+    );
+    if (match && conflict === "error")
+      throw new Error(
+        `Destination data profile already exists: ${name}; choose --on-conflict verify or skip`
+      );
+    if (match && !match.id) throw new Error(`Destination data profile has no identity: ${name}`);
+    profilePlans.push({
+      name,
+      source: structuredClone(source),
+      existing: match ? structuredClone(match) : void 0,
+      action: match ? conflict === "skip" ? "skip" : "verify" : "create"
+    });
+  }
+  const plan = {
+    sourceTsgId: backup.source.tsgId,
+    destinationTsgId,
+    dictionaries: dictionaryPlans,
+    patterns: patternPlans,
+    profiles: profilePlans,
+    maxPages: maxPages3
+  };
+  const bindings = planBindings(plan);
+  const planned = /* @__PURE__ */ new Set([
+    ...dictionaryPlans.map((d) => d.sourceId),
+    ...patternPlans.map((p) => p.sourceId)
+  ]);
+  for (const item of profilePlans) {
+    if (item.action === "skip") continue;
+    for (const leaf of ruleLeaves(item.source)) {
+      const id = leaf.value.id;
+      if (id != null && id !== "" && !planned.has(String(id)))
+        throw new Error(
+          `Backup data profile references a resource absent from the backup: ${item.name}`
+        );
+    }
+    const body = profileRequest(item, bindings, crossTenant, item.action === "verify");
+    if (item.action === "verify" && body && !compareEcho(body, item.existing).matches)
+      throw new Error(
+        `Destination data profile does not match restore plan: ${item.name}; verification made no changes`
+      );
+  }
+  return plan;
+}
+function planBindings(plan) {
+  const bindings = /* @__PURE__ */ new Map();
+  for (const item of plan.dictionaries)
+    if (item.existing?.id) bindings.set(item.sourceId, { id: item.existing.id, name: item.name });
+  for (const item of plan.patterns)
+    if (item.existing?.id)
+      bindings.set(item.sourceId, {
+        id: item.existing.id,
+        name: item.name,
+        version: item.existing.version ?? void 0
+      });
+  return bindings;
+}
+function profileRequest(item, bindings, crossTenant, requireBindings) {
+  const detectionRules = structuredClone(item.source.detection_rules ?? []);
+  const known = /* @__PURE__ */ new Set();
+  let deferred = false;
+  const remapped = { ...structuredClone(item.source), detection_rules: detectionRules };
+  for (const leaf of ruleLeaves(remapped)) {
+    known.add(leaf.value);
+    const id = leaf.value.id;
+    if (id == null || id === "") continue;
+    const binding = bindings.get(String(id));
+    if (!binding) {
+      if (requireBindings)
+        throw new Error(
+          `Missing planned dependency binding; an existing data profile cannot be verified without its destination dependencies: ${item.name}`
+        );
+      deferred = true;
+      continue;
+    }
+    leaf.value.id = binding.id;
+    if (leaf.value.name != null) leaf.value.name = binding.name;
+    if (leaf.value.version != null) {
+      if (binding.version === void 0)
+        throw new Error(`Destination data pattern version is unknown: ${binding.name}`);
+      leaf.value.version = binding.version;
+    }
+  }
+  const body = {
+    name: item.name,
+    detection_rules: detectionRules,
+    ...item.source.profile_type != null ? { profile_type: item.source.profile_type } : {},
+    ...item.source.description != null ? { description: item.source.description } : {},
+    ...item.source.is_granular_data_profile != null ? { is_granular_data_profile: item.source.is_granular_data_profile } : {}
+  };
+  if (crossTenant) assertKnownReferences(body, known, `profile ${item.name}`);
+  const parsed = AdvancedDataProfileRequestSchema.parse(body);
+  return deferred ? void 0 : parsed;
+}
+var DEPENDENCY_ACTIONS = {
+  create: "created",
+  reuse: "reused",
+  resolve: "resolved",
+  map: "mapped"
+};
+function assertUnchanged(current, prior, label) {
+  if (canonical(current ?? null) !== canonical(prior ?? null))
+    throw new Error(`Destination ${label} changed after planning`);
+}
+async function restoreDlpResources(api, plan) {
+  const result = {
+    sourceTsgId: plan.sourceTsgId,
+    destinationTsgId: plan.destinationTsgId,
+    complete: false,
+    dictionaries: [],
+    patterns: [],
+    profiles: [],
+    serverAdded: []
+  };
+  const crossTenant = plan.sourceTsgId !== plan.destinationTsgId;
+  try {
+    const current = await inventories(api, plan.maxPages);
+    for (const item of plan.dictionaries) {
+      const match = matchByName(current.dictionaries, item.name, () => false, "dictionary");
+      if (item.existing) assertUnchanged(match, item.existing, `dictionary: ${item.name}`);
+      else if (match)
+        throw new Error(`Destination dictionary changed after planning: ${item.name}`);
+    }
+    const retiredPattern = (record) => RETIRED_PATTERN.has(record.status ?? "active");
+    for (const item of plan.patterns) {
+      const match = matchByName(current.patterns, item.name, retiredPattern, "data pattern");
+      if (item.existing) assertUnchanged(match, item.existing, `data pattern: ${item.name}`);
+      else if (match)
+        throw new Error(`Destination data pattern changed after planning: ${item.name}`);
+    }
+    for (const item of plan.profiles) {
+      const match = matchByName(
+        current.profiles,
+        item.name,
+        (record) => RETIRED_PROFILE.has(record.profile_status ?? "active"),
+        "data profile"
+      );
+      if (item.existing) assertUnchanged(match, item.existing, `data profile: ${item.name}`);
+      else if (match)
+        throw new Error(`Destination data profile changed after planning: ${item.name}`);
+    }
+    const bindings = planBindings(plan);
+    for (const item of plan.dictionaries) {
+      if (item.action !== "create") {
+        const id = item.existing?.id;
+        if (!id) throw new Error(`Destination dictionary has no identity: ${item.name}`);
+        result.dictionaries.push({ name: item.name, action: DEPENDENCY_ACTIONS[item.action], id });
+        continue;
+      }
+      if (!item.metadata || !item.keywords) throw new Error("Dictionary plan is incomplete");
+      const created = await api.dictionaries.create({
+        metadata: item.metadata,
+        file: `${item.keywords.join("\n")}
+`,
+        includeKeywords: true
+      });
+      if (!created.id) throw new Error(`Restored dictionary did not verify: ${item.name}`);
+      const readBack = await api.dictionaries.get(created.id, { includeKeywords: true });
+      const echo = dictionaryEcho(item.metadata, readBack, item.keywords);
+      if (!echo.matches || readBack.name !== item.name)
+        throw new Error(`Restored dictionary did not verify: ${item.name}`);
+      if (echo.serverAdded.length)
+        result.serverAdded.push({ resource: `dictionary ${item.name}`, fields: echo.serverAdded });
+      bindings.set(item.sourceId, { id: created.id, name: item.name });
+      result.dictionaries.push({ name: item.name, action: "created", id: created.id });
+    }
+    for (const item of plan.patterns) {
+      if (item.action !== "create") {
+        const id = item.existing?.id;
+        if (!id) throw new Error(`Destination data pattern has no identity: ${item.name}`);
+        result.patterns.push({ name: item.name, action: DEPENDENCY_ACTIONS[item.action], id });
+        continue;
+      }
+      if (!item.body) throw new Error("Data pattern plan is incomplete");
+      const created = await api.patterns.create(item.body);
+      if (!created.id) throw new Error(`Restored data pattern did not verify: ${item.name}`);
+      const readBack = await api.patterns.get(created.id);
+      const echo = compareEcho(item.body, readBack);
+      if (!echo.matches || readBack.name !== item.name || RETIRED_PATTERN.has(readBack.status ?? "active"))
+        throw new Error(`Restored data pattern did not verify: ${item.name}`);
+      if (echo.serverAdded.length)
+        result.serverAdded.push({
+          resource: `data pattern ${item.name}`,
+          fields: echo.serverAdded
+        });
+      bindings.set(item.sourceId, {
+        id: created.id,
+        name: item.name,
+        version: readBack.version ?? void 0
+      });
+      result.patterns.push({ name: item.name, action: "created", id: created.id });
+    }
+    for (const item of plan.profiles) {
+      if (item.action === "skip") {
+        result.profiles.push({
+          name: item.name,
+          action: "skipped",
+          id: item.existing?.id ?? void 0
+        });
+        continue;
+      }
+      const body = profileRequest(item, bindings, crossTenant, true);
+      if (!body) throw new Error(`Missing planned dependency binding: ${item.name}`);
+      if (item.action === "verify") {
+        const echo2 = compareEcho(body, item.existing);
+        if (!echo2.matches)
+          throw new Error(`Destination data profile does not match restore plan: ${item.name}`);
+        if (echo2.serverAdded.length)
+          result.serverAdded.push({
+            resource: `data profile ${item.name}`,
+            fields: echo2.serverAdded
+          });
+        result.profiles.push({
+          name: item.name,
+          action: "verified",
+          id: item.existing?.id ?? void 0
+        });
+        continue;
+      }
+      const created = await api.profiles.create(body);
+      if (!created.id) throw new Error(`Restored data profile did not verify: ${item.name}`);
+      const readBack = await api.profiles.get(created.id);
+      const echo = compareEcho(body, readBack);
+      if (!echo.matches || readBack.name !== item.name || RETIRED_PROFILE.has(readBack.profile_status ?? "active"))
+        throw new Error(`Restored data profile did not verify: ${item.name}`);
+      if (echo.serverAdded.length)
+        result.serverAdded.push({
+          resource: `data profile ${item.name}`,
+          fields: echo.serverAdded
+        });
+      result.profiles.push({ name: item.name, action: "created", id: created.id });
+    }
+    result.complete = true;
+  } catch (error) {
+    const status = error?.statusCode;
+    result.error = Number.isInteger(status) ? `API request failed (HTTP ${status}); verify destination state before retrying` : error instanceof Error && /^(Destination|Restored|Missing|Inventory|Ambiguous|Dictionary|Data pattern|Data profile)/.test(
+      error.message
+    ) ? error.message : "Restore stopped; verify destination state before retrying";
+  }
+  return result;
+}
+
+// src/cli/commands/dlp/transfer.ts
+var MAX_BACKUP_BYTES = 20 * 1024 * 1024;
+var FORMATS = "Output format: pretty, table, markdown, csv, json, yaml";
+function maxPages(value) {
+  if (!/^\d+$/.test(value) || Number(value) < 1 || Number(value) > 1e3)
+    usageError("--max-pages must be an integer from 1 to 1000");
+  return Number(value);
+}
+function resourceKinds(value) {
+  const kinds = value.split(",").map((kind) => kind.trim());
+  if (!kinds.length || kinds.some((kind) => !DLP_RESOURCE_KINDS.includes(kind)) || new Set(kinds).size !== kinds.length)
+    throw new CliUsageError("--resources takes a unique list of dictionaries, patterns, profiles");
+  return kinds;
+}
+function patternMap(values) {
+  const entries = values.map((value) => {
+    const at = value.indexOf("=");
+    if (at < 1 || at === value.length - 1)
+      throw new CliUsageError("--pattern-map requires source-name=destination-name");
+    return [value.slice(0, at), value.slice(at + 1)];
+  });
+  if (new Set(entries.map(([key]) => key)).size !== entries.length)
+    throw new CliUsageError("Duplicate source names in --pattern-map");
+  return Object.fromEntries(entries);
+}
+async function context() {
+  const config = await loadConfig();
+  if (!config.mgmtTsgId || !config.mgmtClientId || !config.mgmtClientSecret)
+    throw new CliUsageError(
+      "DLP transfer requires configured Management client ID, secret and TSG ID"
+    );
+  const client = new ManagementClient({ ...managementClientOptions(config), numRetries: 0 });
+  return {
+    api: {
+      dictionaries: client.dlp.dictionaries,
+      patterns: client.dlp.dataPatterns,
+      profiles: client.dlp.dataProfiles
+    },
+    tsgId: config.mgmtTsgId
+  };
+}
+function failure(error) {
+  if (error instanceof CliUsageError) usageError(error.message);
+  if (error instanceof ZodError) {
+    ui.error("Invalid DLP backup/request schema; content is not logged.");
+  } else if (error instanceof AISecSDKException2) {
+    ui.error(
+      `DLP transfer API request failed${error.statusCode ? ` (HTTP ${error.statusCode})` : ""}; no automatic retry was made.`
+    );
+  } else if (error?.code) {
+    ui.error(
+      `DLP transfer file operation failed (${error.code}); existing files are not overwritten.`
+    );
+  } else {
+    ui.error(error instanceof Error ? error.message : "DLP transfer failed");
+  }
+  process.exitCode = 1;
+}
+function renderRestore(value, columns, format) {
+  if (format !== "pretty" && format !== "table" && format !== "markdown")
+    return formatOutput([value], columns, format);
+  const markdown = format === "markdown";
+  const rows = (key) => Array.isArray(value[key]) ? value[key] : [];
+  const heading = (text2) => markdown ? `### ${text2}
+` : text2;
+  const blocks = [
+    heading(
+      value.dryRun ? "Restore preview \u2014 no changes made" : value.complete ? "Restore complete" : "Restore incomplete \u2014 completed writes remain"
+    ),
+    `Source TSG: ${value.sourceTsgId}
+${markdown ? "\n" : ""}Destination TSG: ${value.destinationTsgId}`
+  ];
+  for (const [key, title] of [
+    ["dictionaries", "Dictionaries"],
+    ["patterns", "Data patterns"],
+    ["profiles", "Data profiles"]
+  ]) {
+    blocks.push(heading(`${title} (${rows(key).length})`));
+    blocks.push(
+      formatOutput(
+        rows(key),
+        [
+          { key: "action", label: "Action" },
+          { key: "name", label: "Name" }
+        ],
+        markdown ? "markdown" : "table"
+      ) || "(none)"
+    );
+  }
+  if (rows("serverAdded").length) {
+    blocks.push(heading("Verified server-added fields (source omitted these)"));
+    for (const item of rows("serverAdded"))
+      blocks.push(
+        `${item.resource}: ${Array.isArray(item.fields) ? item.fields.length : 0} fields; use --output json for paths`
+      );
+  }
+  if (value.error) blocks.push(`Error: ${value.error}`);
+  return blocks.join("\n\n");
+}
+function register6(dlp) {
+  const backup = dlp.command("backup").description(
+    "Back up custom DLP dictionaries (with keywords), data patterns and data profiles with their referenced dependencies"
+  ).option(
+    "--resources <list>",
+    "Comma-separated primary resources: dictionaries, patterns, profiles (default: all)",
+    resourceKinds
+  ).option("--file-format <format>", "Backup file format: json or yaml", "json").option("--output-file <path>", "New private backup file; defaults to the current directory").option(
+    "--skip-unsupported",
+    "Exclude profiles with non-transferable rules (multi-profile, direct EDM) instead of failing"
+  ).option(
+    "--max-pages <n>",
+    "Maximum pages per inventory; incomplete exports fail",
+    maxPages,
+    100
+  ).option("--output <format>", FORMATS).addHelpText(
+    "after",
+    examples(
+      "airs runtime dlp backup --output-file ./dlp-backup.json",
+      "airs runtime dlp backup --resources profiles --skip-unsupported --output-file ./profiles.yaml --file-format yaml"
+    )
+  ).action(async (opts) => {
+    try {
+      if (!["json", "yaml"].includes(opts.fileFormat))
+        throw new CliUsageError("--file-format must be json or yaml");
+      const format = await resolveOutput(backup, opts);
+      const extension = opts.fileFormat === "yaml" ? ".yaml" : ".json";
+      if (opts.outputFile === "-")
+        throw new CliUsageError(
+          "Backups contain dictionary keywords and require a private file destination, not stdout"
+        );
+      const path3 = resolve5(
+        opts.outputFile ?? `airs-dlp-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${randomUUID7().slice(0, 8)}${extension}`
+      );
+      if (!(opts.fileFormat === "json" ? [".json"] : [".yaml", ".yml"]).includes(
+        extname(path3).toLowerCase()
+      ))
+        throw new CliUsageError("Backup filename extension must match --file-format");
+      const { api, tsgId } = await context();
+      const { backup: data, skipped } = await backupDlpResources(api, tsgId, {
+        resources: opts.resources,
+        maxPages: opts.maxPages,
+        skipUnsupported: Boolean(opts.skipUnsupported)
+      });
+      for (const item of skipped)
+        ui.warning(`Skipped unsupported data profile: ${item.profile} (${item.reason})`);
+      const content = opts.fileFormat === "yaml" ? dump6(data, { schema: JSON_SCHEMA, noRefs: true, lineWidth: -1 }) : `${JSON.stringify(data, null, 2)}
+`;
+      if (Buffer.byteLength(content) > MAX_BACKUP_BYTES)
+        throw new Error("Backup exceeds the 20 MiB size limit; select fewer --resources");
+      await writeReportFile(path3, content);
+      console.log(
+        formatOutput(
+          [
+            {
+              file: path3,
+              sourceTsgId: tsgId,
+              dictionaries: data.dictionaries.length,
+              patterns: data.patterns.length,
+              profiles: data.profiles.length,
+              skipped: skipped.length
+            }
+          ],
+          [
+            { key: "file", label: "Backup file" },
+            { key: "sourceTsgId", label: "Source TSG" },
+            { key: "dictionaries", label: "Dictionaries" },
+            { key: "patterns", label: "Patterns" },
+            { key: "profiles", label: "Profiles" },
+            { key: "skipped", label: "Skipped" }
+          ],
+          format === "pretty" ? "table" : format
+        )
+      );
+    } catch (error) {
+      failure(error);
+    }
+  });
+  const restore = dlp.command("restore <file>").description(
+    "Restore DLP resources into the selected tenant, staged dictionaries \u2192 patterns \u2192 profiles; validate all dependencies before changes"
+  ).option("--dry-run", "Read and validate a restore plan without changing destination resources").option("--name-prefix <prefix>", "Prefix restored custom resource names to avoid collisions").option(
+    "--on-conflict <policy>",
+    "Existing data profile names: error, verify (resume without writes) or skip. Updates are unsupported until the DLP profile write path is live-verified.",
+    "error"
+  ).option(
+    "--pattern-map <source=destination>",
+    "Bind a tenant-bound source pattern to an existing destination pattern (repeatable)",
+    (value, prior) => [...prior, value],
+    []
+  ).option(
+    "--max-pages <n>",
+    "Maximum pages per inventory; incomplete inventories fail",
+    maxPages,
+    100
+  ).option("--expect-tsg <id>", "Assert destination tenant ID; required with --force").option(
+    "--force",
+    "Execute without a prompt; requires --expect-tsg and does not override conflicts"
+  ).option("--output <format>", FORMATS).addHelpText(
+    "after",
+    examples(
+      "airs runtime dlp restore ./dlp-backup.json --dry-run --output json",
+      'airs runtime dlp restore ./dlp-backup.json --pattern-map "EDM SSN=Dest SSN" --dry-run',
+      "airs runtime dlp restore ./dlp-backup.json --name-prefix migrated- --expect-tsg <destination-tsg> --force"
+    )
+  ).action(async (file, opts) => {
+    try {
+      if (!["error", "verify", "skip"].includes(opts.onConflict))
+        throw new CliUsageError("--on-conflict must be error, verify or skip");
+      if (opts.force && !opts.expectTsg)
+        throw new CliUsageError("--force requires --expect-tsg <destination-tsg>");
+      const mappings = patternMap(opts.patternMap);
+      const path3 = resolve5(file);
+      const extension = extname(path3).toLowerCase();
+      if (![".json", ".yaml", ".yml"].includes(extension))
+        throw new CliUsageError("Backup file must use .json, .yaml or .yml");
+      const info = await stat(path3);
+      if (!info.isFile() || info.size > MAX_BACKUP_BYTES)
+        throw new CliUsageError("Backup must be a regular file no larger than 20 MiB");
+      let input2;
+      try {
+        const text2 = await readFile9(path3, "utf8");
+        if (Buffer.byteLength(text2) > MAX_BACKUP_BYTES) throw new Error("Backup too large");
+        input2 = extension === ".json" ? JSON.parse(text2) : load2(text2, { schema: JSON_SCHEMA });
+      } catch {
+        throw new CliUsageError("Backup is not valid JSON/YAML; contents are not logged");
+      }
+      const data = DlpResourcesBackupSchema.parse(input2);
+      const format = await resolveOutput(restore, opts);
+      const { api, tsgId } = await context();
+      if (opts.expectTsg && opts.expectTsg !== tsgId)
+        throw new CliUsageError(
+          "--expect-tsg does not match the selected destination tenant; no API request was made"
+        );
+      const plan = await planDlpResourcesRestore(api, data, tsgId, {
+        namePrefix: opts.namePrefix,
+        onConflict: opts.onConflict,
+        patternMap: mappings,
+        maxPages: opts.maxPages
+      });
+      const summary = {
+        sourceTsgId: plan.sourceTsgId,
+        destinationTsgId: plan.destinationTsgId,
+        dryRun: Boolean(opts.dryRun),
+        dictionaries: plan.dictionaries.map((d) => ({ name: d.name, action: d.action })),
+        patterns: plan.patterns.map((p) => ({ name: p.name, action: p.action })),
+        profiles: plan.profiles.map((p) => ({ name: p.name, action: p.action }))
+      };
+      const columns = [
+        { key: "sourceTsgId", label: "Source TSG" },
+        { key: "destinationTsgId", label: "Destination TSG" },
+        { key: "dictionaries", label: "Dictionaries" },
+        { key: "patterns", label: "Data patterns" },
+        { key: "profiles", label: "Data profiles" },
+        { key: "serverAdded", label: "Verified server-added fields" },
+        { key: "dryRun", label: "Dry run" },
+        { key: "complete", label: "Complete" }
+      ];
+      if (opts.dryRun) {
+        console.log(renderRestore(summary, columns, format));
+        return;
+      }
+      const writes = plan.dictionaries.filter((d) => d.action === "create").length + plan.patterns.filter((p) => p.action === "create").length + plan.profiles.filter((p) => p.action === "create").length;
+      if (writes)
+        await confirmOrAbort(
+          `Restore ${writes} DLP resources from TSG ${plan.sourceTsgId} to TSG ${tsgId}?`,
+          Boolean(opts.force),
+          { action: `restore DLP resources into TSG ${tsgId}` }
+        );
+      const result = await restoreDlpResources(api, plan);
+      console.log(renderRestore({ ...result }, columns, format));
+      if (!result.complete) {
+        ui.error(result.error ?? "Restore incomplete");
+        process.exitCode = 1;
+      }
+    } catch (error) {
+      failure(error);
+    }
+  });
+}
+
 // src/cli/commands/dlp/index.ts
 function registerDlpCommands(runtime) {
-  const dlp = runtime.command("dlp").description("DLP management (filtering-profiles, patterns, profiles, dictionaries, generate)");
+  const dlp = runtime.command("dlp").description(
+    "DLP management (filtering-profiles, patterns, profiles, dictionaries, generate, backup/restore)"
+  );
   register2(dlp);
   register4(dlp);
   register5(dlp);
   register(dlp);
   register3(dlp);
+  register6(dlp);
 }
 
 // src/cli/commands/profile-transfer.ts
-import { randomUUID as randomUUID7 } from "crypto";
-import { readFile as readFile9, stat } from "fs/promises";
-import { extname, resolve as resolve5 } from "path";
-import { AISecSDKException as AISecSDKException2, ManagementClient } from "@cdot65/prisma-airs-sdk";
-import { dump as dump6, JSON_SCHEMA, load as load2 } from "js-yaml";
-import { ZodError } from "zod";
+import { randomUUID as randomUUID8 } from "crypto";
+import { readFile as readFile10, stat as stat2 } from "fs/promises";
+import { extname as extname2, resolve as resolve6 } from "path";
+import { AISecSDKException as AISecSDKException3, ManagementClient as ManagementClient2 } from "@cdot65/prisma-airs-sdk";
+import { dump as dump7, JSON_SCHEMA as JSON_SCHEMA2, load as load3 } from "js-yaml";
+import { ZodError as ZodError2 } from "zod";
 
 // src/backup/runtime-profiles.ts
 import {
@@ -9575,10 +10569,10 @@ import {
   PolicySchema,
   SecurityProfileSchema
 } from "@cdot65/prisma-airs-sdk";
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 
 // src/backup/runtime-policy.ts
-function object(value) {
+function object2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function compareRuntimePolicies(expected, actual) {
@@ -9599,7 +10593,7 @@ function compareRuntimePolicies(expected, actual) {
       });
       return;
     }
-    if (object(source) && object(target)) {
+    if (object2(source) && object2(target)) {
       for (const key of /* @__PURE__ */ new Set([...Object.keys(source), ...Object.keys(target)])) {
         const field = `${path3}.${key}`;
         if (!Object.hasOwn(source, key) && Object.hasOwn(target, key)) {
@@ -9630,14 +10624,14 @@ function compareRuntimePolicies(expected, actual) {
           }
           if (relative === "model.app-protection" && key === "url-detected-severity")
             allowed = "low";
-          if (relative === "model.app-protection" && key === "default-url-category" && object(target[key])) {
+          if (relative === "model.app-protection" && key === "default-url-category" && object2(target[key])) {
             const value = target[key];
             if (Object.keys(value).length === 1 && value.member === null) {
               serverDefaults.push(field);
               continue;
             }
           }
-          if ((/^model\.model-protection\[\d+\]$/.test(relative) && source.name === "toxic-content" && target.name === source.name || insideToxicCategories && /^model\.model-protection\[\d+\]\.toxic-category-list\[\d+\]$/.test(relative) && typeof source.category === "string" && source.category.length > 0 && source.category === target.category) && key === "severity-by-confidence" && object(target[key])) {
+          if ((/^model\.model-protection\[\d+\]$/.test(relative) && source.name === "toxic-content" && target.name === source.name || insideToxicCategories && /^model\.model-protection\[\d+\]\.toxic-category-list\[\d+\]$/.test(relative) && typeof source.category === "string" && source.category.length > 0 && source.category === target.category) && key === "severity-by-confidence" && object2(target[key])) {
             const value = target[key];
             if (Object.keys(value).length === 2 && value.high === "medium" && value.moderate === "low") {
               serverDefaults.push(field);
@@ -9672,26 +10666,26 @@ function compareRuntimePolicies(expected, actual) {
 }
 
 // src/backup/runtime-profiles.ts
-var RuntimeProfilesBackupSchema = z5.object({
-  version: z5.literal(1),
-  resourceType: z5.literal("runtime-security-profiles"),
-  exportedAt: z5.string().datetime({ offset: true }),
-  source: z5.object({ tsgId: z5.string().min(1) }).strict(),
-  profiles: z5.array(SecurityProfileSchema).min(1).max(1e4),
-  topics: z5.array(CustomTopicSchema).max(1e4)
+var RuntimeProfilesBackupSchema = z6.object({
+  version: z6.literal(1),
+  resourceType: z6.literal("runtime-security-profiles"),
+  exportedAt: z6.string().datetime({ offset: true }),
+  source: z6.object({ tsgId: z6.string().min(1) }).strict(),
+  profiles: z6.array(SecurityProfileSchema).min(1).max(1e4),
+  topics: z6.array(CustomTopicSchema).max(1e4)
 }).strict();
-function object2(value) {
+function object3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function pagesLimit(value) {
+function pagesLimit2(value) {
   if (!Number.isSafeInteger(value) || value < 1 || value > 1e3)
     throw new Error("maxPages must be an integer from 1 to 1000");
 }
-async function offsetPages(fetch, maxPages2) {
-  pagesLimit(maxPages2);
+async function offsetPages(fetch, maxPages3) {
+  pagesLimit2(maxPages3);
   const items = [];
   let offset = 0;
-  for (let page = 0; page < maxPages2; page++) {
+  for (let page = 0; page < maxPages3; page++) {
     const result = await fetch(offset);
     items.push(...result.items);
     if (items.length > 1e4) throw new Error("Inventory exceeds the 10000-record safety limit");
@@ -9706,7 +10700,7 @@ function latestProfiles(profiles2) {
   const names = /* @__PURE__ */ new Map();
   const revisions = /* @__PURE__ */ new Set();
   for (const profile of profiles2) {
-    assertName(profile.profile_name);
+    assertName2(profile.profile_name);
     const identity2 = JSON.stringify([profile.profile_name, profile.profile_id, profile.revision]);
     if (revisions.has(identity2)) throw new Error("Inventory contains repeated profile records");
     revisions.add(identity2);
@@ -9718,7 +10712,7 @@ function latestProfiles(profiles2) {
   }
   return [...names.values()].sort((a, b) => a.profile_name.localeCompare(b.profile_name));
 }
-function assertName(name) {
+function assertName2(name) {
   if (!name.trim() || [...name].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
     throw new Error("Profile/topic names must be nonempty and contain no control characters");
 }
@@ -9726,19 +10720,19 @@ function assertTenant(profiles2, tsgId) {
   if (profiles2.some((profile) => profile.tsg_id != null && String(profile.tsg_id) !== tsgId))
     throw new Error("Destination/source profile tenant identity does not match the selected TSG");
 }
-async function profiles(api, maxPages2) {
+async function profiles(api, maxPages3) {
   return latestProfiles(
     await offsetPages(async (offset) => {
       const page = await api.profiles.list({ offset, limit: 100, latest: true });
       return { items: page.ai_profiles, next: page.next_offset };
-    }, maxPages2)
+    }, maxPages3)
   );
 }
-async function topics(api, maxPages2) {
+async function topics(api, maxPages3) {
   return offsetPages(async (offset) => {
     const page = await api.topics.list({ offset, limit: 100 });
     return { items: page.custom_topics, next: page.next_offset };
-  }, maxPages2);
+  }, maxPages3);
 }
 function topicReferences(policy) {
   const refs = [];
@@ -9747,7 +10741,7 @@ function topicReferences(policy) {
       value.forEach(visit);
       return;
     }
-    if (!object2(value)) return;
+    if (!object3(value)) return;
     if ("topic_id" in value) {
       if (typeof value.topic_id !== "string" || typeof value.topic_name !== "string" || !Number.isSafeInteger(value.revision) || Number(value.revision) < 0)
         throw new Error("Invalid topic identity in profile policy");
@@ -9763,8 +10757,8 @@ function topicKey(ref) {
 }
 async function backupRuntimeProfiles(api, tsgId, options = {}) {
   if (!tsgId) throw new Error("Source TSG ID is required");
-  const maxPages2 = options.maxPages ?? 100;
-  let selected = await profiles(api, maxPages2);
+  const maxPages3 = options.maxPages ?? 100;
+  let selected = await profiles(api, maxPages3);
   assertTenant(selected, tsgId);
   if (options.profile)
     selected = selected.filter(
@@ -9777,7 +10771,7 @@ async function backupRuntimeProfiles(api, tsgId, options = {}) {
     PolicySchema.parse(profile.policy);
   }
   const refs = selected.flatMap((profile) => topicReferences(profile.policy));
-  const definitions = refs.length ? await topics(api, maxPages2) : [];
+  const definitions = refs.length ? await topics(api, maxPages3) : [];
   const needed = /* @__PURE__ */ new Map();
   for (const ref of refs) {
     const matches = definitions.filter((topic) => topicKey(topic) === topicKey(ref));
@@ -9800,21 +10794,21 @@ function sameTopic(a, b) {
   return a.description === b.description && JSON.stringify(a.examples) === JSON.stringify(b.examples) && (a.active ?? true) === (b.active ?? true);
 }
 function dlpReferences(policy) {
-  if (!object2(policy)) return [];
+  if (!object3(policy)) return [];
   const refs = [];
   for (const entry of Array.isArray(policy["dlp-data-profiles"]) ? policy["dlp-data-profiles"] : []) {
-    if (!object2(entry) || typeof entry.name !== "string")
+    if (!object3(entry) || typeof entry.name !== "string")
       throw new Error("Invalid embedded DLP reference");
     refs.push({ value: entry, name: entry.name, kind: "embedded" });
   }
   for (const entry of Array.isArray(policy["ai-security-profiles"]) ? policy["ai-security-profiles"] : []) {
-    if (!object2(entry) || !object2(entry["model-configuration"])) continue;
+    if (!object3(entry) || !object3(entry["model-configuration"])) continue;
     const protection = entry["model-configuration"]["data-protection"];
-    if (!object2(protection) || !object2(protection["data-leak-detection"])) continue;
+    if (!object3(protection) || !object3(protection["data-leak-detection"])) continue;
     const members = protection["data-leak-detection"].member;
     if (!Array.isArray(members)) continue;
     for (const member of members) {
-      if (!object2(member) || typeof member.text !== "string") throw new Error("Invalid DLP member");
+      if (!object3(member) || typeof member.text !== "string") throw new Error("Invalid DLP member");
       if (member.text.toLowerCase() === "sensitive content" && (member.id === "" || member.id === void 0) && (member.version === "2" || member.version === void 0) && !refs.some((ref) => ref.kind === "embedded" && ref.name === member.text))
         continue;
       refs.push({ value: member, name: member.text, kind: "member" });
@@ -9857,7 +10851,7 @@ function assertKnownPolicyReferences(policy) {
       });
       return;
     }
-    if (!object2(value)) return;
+    if (!object3(value)) return;
     for (const [key, child] of Object.entries(value)) {
       if (child !== null && child !== "" && /(?:^|[-_])(id|uuid)$|(?:Id|ID|Uuid|UUID)$/.test(key) && !known.get(value)?.includes(key))
         throw new Error(`Unsupported cross-tenant policy reference at ${path3}.${key}`);
@@ -9866,9 +10860,9 @@ function assertKnownPolicyReferences(policy) {
   };
   visit(policy, "policy");
 }
-async function dataProfiles(api, maxPages2) {
+async function dataProfiles(api, maxPages3) {
   const items = [];
-  for (let page = 0; page < maxPages2; page++) {
+  for (let page = 0; page < maxPages3; page++) {
     const result = await api.dataProfiles.list({ page, size: 100 });
     items.push(...result.content);
     if (items.length > 1e4) throw new Error("DLP inventory exceeds the safety limit");
@@ -9881,8 +10875,8 @@ async function dataProfiles(api, maxPages2) {
 async function planRuntimeProfilesRestore(api, input2, destinationTsgId, options = {}) {
   const backup = RuntimeProfilesBackupSchema.parse(input2);
   if (!destinationTsgId) throw new Error("Destination TSG ID is required");
-  const maxPages2 = options.maxPages ?? 100;
-  pagesLimit(maxPages2);
+  const maxPages3 = options.maxPages ?? 100;
+  pagesLimit2(maxPages3);
   const prefix = options.namePrefix ?? "";
   if (prefix.length > 64 || [...prefix].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
     throw new Error("Invalid --name-prefix");
@@ -9905,7 +10899,7 @@ async function planRuntimeProfilesRestore(api, input2, destinationTsgId, options
     });
     if (crossTenant) assertKnownPolicyReferences(profile.policy);
   }
-  const existing = await profiles(api, maxPages2);
+  const existing = await profiles(api, maxPages3);
   assertTenant(existing, destinationTsgId);
   const profilePlans = selected.map((source) => {
     const name = `${prefix}${source.profile_name}`;
@@ -9924,7 +10918,7 @@ async function planRuntimeProfilesRestore(api, input2, destinationTsgId, options
   });
   const changing = profilePlans.filter((p) => p.action !== "skip");
   const refs = changing.flatMap((p) => topicReferences(p.source.policy));
-  const targetTopics = refs.length ? await topics(api, maxPages2) : [];
+  const targetTopics = refs.length ? await topics(api, maxPages3) : [];
   const topicPlans = /* @__PURE__ */ new Map();
   const topicNames = /* @__PURE__ */ new Map();
   for (const ref of refs) {
@@ -9937,7 +10931,7 @@ async function planRuntimeProfilesRestore(api, input2, destinationTsgId, options
       throw new Error(`Backup lacks an unambiguous topic definition: ${ref.topic_name}`);
     const source = definitions[0];
     const name = `${prefix}${source.topic_name}`;
-    assertName(name);
+    assertName2(name);
     if (topicNames.has(name) && topicNames.get(name) !== key)
       throw new Error(
         `Multiple source revisions use topic name ${name}; split the backup by profile/revision before restoring`
@@ -9964,7 +10958,7 @@ async function planRuntimeProfilesRestore(api, input2, destinationTsgId, options
       );
     if (!targetFor(name)) unresolved.add(name);
   }
-  const catalog = names.some((name) => targetFor(name)) ? await dataProfiles(api, maxPages2) : [];
+  const catalog = names.some((name) => targetFor(name)) ? await dataProfiles(api, maxPages3) : [];
   const resolved = [];
   for (const name of names) {
     const target = targetFor(name);
@@ -10015,7 +11009,7 @@ async function planRuntimeProfilesRestore(api, input2, destinationTsgId, options
     dlpMappings,
     dlpFallbacks,
     serverDefaults: [],
-    maxPages: maxPages2
+    maxPages: maxPages3
   };
   const existingTopics = new Map(
     plan.topics.filter((t) => t.existing).map((t) => [t.key, t.existing])
@@ -10032,8 +11026,8 @@ async function planRuntimeProfilesRestore(api, input2, destinationTsgId, options
   }
   return plan;
 }
-function canonical(value) {
-  const order = (v) => Array.isArray(v) ? v.map(order) : object2(v) ? Object.fromEntries(
+function canonical2(value) {
+  const order = (v) => Array.isArray(v) ? v.map(order) : object3(v) ? Object.fromEntries(
     Object.entries(v).sort(([a], [b]) => a.localeCompare(b)).map(([k, child]) => [k, order(child)])
   ) : v;
   return JSON.stringify(order(value));
@@ -10044,7 +11038,7 @@ function canonicalPolicy(policy) {
     const protection = entry["model-configuration"]?.["data-protection"];
     if (protection && !("database-security" in protection)) protection["database-security"] = null;
   }
-  return canonical(value);
+  return canonical2(value);
 }
 function unchanged(current, prior) {
   return Boolean(
@@ -10187,9 +11181,9 @@ function mappedPolicy(item, plan, mappedTopics) {
 }
 
 // src/cli/commands/profile-transfer.ts
-var MAX_BACKUP_BYTES = 20 * 1024 * 1024;
-var FORMATS = "Output format: pretty, table, markdown, csv, json, yaml";
-function renderRestore(value, columns, format) {
+var MAX_BACKUP_BYTES2 = 20 * 1024 * 1024;
+var FORMATS2 = "Output format: pretty, table, markdown, csv, json, yaml";
+function renderRestore2(value, columns, format) {
   if (format !== "pretty" && format !== "table" && format !== "markdown")
     return formatOutput([value], columns, format);
   const markdown = format === "markdown";
@@ -10249,7 +11243,7 @@ ${markdown ? "\n" : ""}Destination TSG: ${value.destinationTsgId}`
   if (value.error) blocks.push(`Error: ${value.error}`);
   return blocks.join("\n\n");
 }
-function maxPages(value) {
+function maxPages2(value) {
   if (!/^\d+$/.test(value) || Number(value) < 1 || Number(value) > 1e3)
     usageError("--max-pages must be an integer from 1 to 1000");
   return Number(value);
@@ -10265,13 +11259,13 @@ function dlpMap(values) {
     throw new CliUsageError("Duplicate source names in --dlp-map");
   return Object.fromEntries(entries);
 }
-async function context() {
+async function context2() {
   const config = await loadConfig();
   if (!config.mgmtTsgId || !config.mgmtClientId || !config.mgmtClientSecret)
     throw new CliUsageError(
       "Profile transfer requires configured Management client ID, secret and TSG ID"
     );
-  const client = new ManagementClient({ ...managementClientOptions(config), numRetries: 0 });
+  const client = new ManagementClient2({ ...managementClientOptions(config), numRetries: 0 });
   return {
     api: {
       profiles: client.profiles,
@@ -10281,11 +11275,11 @@ async function context() {
     tsgId: config.mgmtTsgId
   };
 }
-function failure(error) {
+function failure2(error) {
   if (error instanceof CliUsageError) usageError(error.message);
-  if (error instanceof ZodError) {
+  if (error instanceof ZodError2) {
     ui.error("Invalid profile backup/request schema; content is not logged.");
-  } else if (error instanceof AISecSDKException2) {
+  } else if (error instanceof AISecSDKException3) {
     ui.error(
       `Profile transfer API request failed${error.statusCode ? ` (HTTP ${error.statusCode})` : ""}; no automatic retry was made.`
     );
@@ -10304,9 +11298,9 @@ function registerProfileTransferCommands(profiles2) {
   ).option("--all", "Back up all latest profiles (cannot be combined with a profile selector)").option("--file-format <format>", "Backup file format: json or yaml", "json").option("--output-file <path>", "New private backup file; defaults to the current directory").option(
     "--max-pages <n>",
     "Maximum pages per inventory; incomplete exports fail",
-    maxPages,
+    maxPages2,
     100
-  ).option("--output <format>", FORMATS).addHelpText(
+  ).option("--output <format>", FORMATS2).addHelpText(
     "after",
     examples(
       "airs runtime profiles backup --all --output-file ./profiles.json",
@@ -10322,18 +11316,18 @@ function registerProfileTransferCommands(profiles2) {
       const extension = opts.fileFormat === "yaml" ? ".yaml" : ".json";
       if (opts.outputFile === "-")
         throw new CliUsageError("Backups require a private file destination, not stdout");
-      const path3 = resolve5(
-        opts.outputFile ?? `airs-runtime-profiles-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${randomUUID7().slice(0, 8)}${extension}`
+      const path3 = resolve6(
+        opts.outputFile ?? `airs-runtime-profiles-backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${randomUUID8().slice(0, 8)}${extension}`
       );
       if (!(opts.fileFormat === "json" ? [".json"] : [".yaml", ".yml"]).includes(
-        extname(path3).toLowerCase()
+        extname2(path3).toLowerCase()
       ))
         throw new CliUsageError("Backup filename extension must match --file-format");
-      const { api, tsgId } = await context();
+      const { api, tsgId } = await context2();
       const data = await backupRuntimeProfiles(api, tsgId, { profile, maxPages: opts.maxPages });
-      const content = opts.fileFormat === "yaml" ? dump6(data, { schema: JSON_SCHEMA, noRefs: true, lineWidth: -1 }) : `${JSON.stringify(data, null, 2)}
+      const content = opts.fileFormat === "yaml" ? dump7(data, { schema: JSON_SCHEMA2, noRefs: true, lineWidth: -1 }) : `${JSON.stringify(data, null, 2)}
 `;
-      if (Buffer.byteLength(content) > MAX_BACKUP_BYTES)
+      if (Buffer.byteLength(content) > MAX_BACKUP_BYTES2)
         throw new Error("Backup exceeds the 20 MiB size limit; select individual profiles");
       await writeReportFile(path3, content);
       console.log(
@@ -10356,7 +11350,7 @@ function registerProfileTransferCommands(profiles2) {
         )
       );
     } catch (error) {
-      failure(error);
+      failure2(error);
     }
   });
   const restore = profiles2.command("restore <file>").description(
@@ -10377,12 +11371,12 @@ function registerProfileTransferCommands(profiles2) {
   ).option(
     "--max-pages <n>",
     "Maximum pages per inventory; incomplete inventories fail",
-    maxPages,
+    maxPages2,
     100
   ).option("--expect-tsg <id>", "Assert destination tenant ID; required with --force").option(
     "--force",
     "Execute without a prompt; requires --expect-tsg and does not override conflicts"
-  ).option("--output <format>", FORMATS).addHelpText(
+  ).option("--output <format>", FORMATS2).addHelpText(
     "after",
     examples(
       "airs runtime profiles restore ./profiles.json --dry-run --output json",
@@ -10398,24 +11392,24 @@ function registerProfileTransferCommands(profiles2) {
       if (opts.force && !opts.expectTsg)
         throw new CliUsageError("--force requires --expect-tsg <destination-tsg>");
       const mappings = dlpMap(opts.dlpMap);
-      const path3 = resolve5(file);
-      const extension = extname(path3).toLowerCase();
+      const path3 = resolve6(file);
+      const extension = extname2(path3).toLowerCase();
       if (![".json", ".yaml", ".yml"].includes(extension))
         throw new CliUsageError("Backup file must use .json, .yaml or .yml");
-      const info = await stat(path3);
-      if (!info.isFile() || info.size > MAX_BACKUP_BYTES)
+      const info = await stat2(path3);
+      if (!info.isFile() || info.size > MAX_BACKUP_BYTES2)
         throw new CliUsageError("Backup must be a regular file no larger than 20 MiB");
       let input2;
       try {
-        const text2 = await readFile9(path3, "utf8");
-        if (Buffer.byteLength(text2) > MAX_BACKUP_BYTES) throw new Error("Backup too large");
-        input2 = extension === ".json" ? JSON.parse(text2) : load2(text2, { schema: JSON_SCHEMA });
+        const text2 = await readFile10(path3, "utf8");
+        if (Buffer.byteLength(text2) > MAX_BACKUP_BYTES2) throw new Error("Backup too large");
+        input2 = extension === ".json" ? JSON.parse(text2) : load3(text2, { schema: JSON_SCHEMA2 });
       } catch {
         throw new CliUsageError("Backup is not valid JSON/YAML; contents are not logged");
       }
       const data = RuntimeProfilesBackupSchema.parse(input2);
       const format = await resolveOutput(restore, opts);
-      const { api, tsgId } = await context();
+      const { api, tsgId } = await context2();
       if (opts.expectTsg && opts.expectTsg !== tsgId)
         throw new CliUsageError(
           "--expect-tsg does not match the selected destination tenant; no API request was made"
@@ -10459,7 +11453,7 @@ function registerProfileTransferCommands(profiles2) {
           `DLP protection change: ${fallback.profile} will use Basic detection instead of ${fallback.replaced.join(", ")}. Custom rules are not preserved.`
         );
       if (opts.dryRun) {
-        console.log(renderRestore(summary, columns, format));
+        console.log(renderRestore2(summary, columns, format));
         return;
       }
       const changing = plan.profiles.filter(
@@ -10472,13 +11466,13 @@ function registerProfileTransferCommands(profiles2) {
           { action: `restore profiles into TSG ${tsgId}` }
         );
       const result = await restoreRuntimeProfiles(api, plan);
-      console.log(renderRestore({ ...result }, columns, format));
+      console.log(renderRestore2({ ...result }, columns, format));
       if (!result.complete) {
         ui.error(result.error ?? "Restore incomplete");
         process.exitCode = 1;
       }
     } catch (error) {
-      failure(error);
+      failure2(error);
     }
   });
 }
@@ -10586,8 +11580,8 @@ function registerCleanupCommand(parent) {
 
 // src/cli/commands/runtime-dashboard.ts
 import { lstat as lstat4 } from "fs/promises";
-import { resolve as resolve6 } from "path";
-import { dump as dump7 } from "js-yaml";
+import { resolve as resolve7 } from "path";
+import { dump as dump8 } from "js-yaml";
 var TIME_UNITS = ["hour", "hours", "day", "days"];
 function integer3(value, name, minimum = 0) {
   const n = Number(value);
@@ -10649,7 +11643,7 @@ function scanOptions(command) {
 function registerRuntimeDashboardCommands(runtime) {
   const dashboard = runtime.command("dashboard").description("SCM application summaries and daily telemetry (OAuth)");
   const sessions = runtime.command("sessions").description("Verified SCM session inventory and drill-down (OAuth)");
-  function register6(command, prepare) {
+  function register7(command, prepare) {
     command.option("--output <format>", "Output format: pretty, json, yaml").action(async (opts) => {
       try {
         const read = prepare(opts);
@@ -10662,7 +11656,7 @@ function registerRuntimeDashboardCommands(runtime) {
               "Scan content requires exactly one of --show-content or --output-file <new-path>"
             );
           if (opts.outputFile) {
-            const path3 = resolve6(text(opts.outputFile, "--output-file"));
+            const path3 = resolve7(text(opts.outputFile, "--output-file"));
             const existing = await lstat4(path3).catch((error) => {
               if (error.code !== "ENOENT") throw error;
               return void 0;
@@ -10676,9 +11670,9 @@ function registerRuntimeDashboardCommands(runtime) {
           numRetries: 0
         });
         const result = await read(client.dashboard);
-        const output = format === "yaml" ? dump7(result, { noRefs: true, lineWidth: -1 }).trimEnd() : JSON.stringify(result, null, 2);
+        const output = format === "yaml" ? dump8(result, { noRefs: true, lineWidth: -1 }).trimEnd() : JSON.stringify(result, null, 2);
         if (command.name() === "scan-content" && opts.outputFile) {
-          await writeReportFile(resolve6(String(opts.outputFile)), `${output}
+          await writeReportFile(resolve7(String(opts.outputFile)), `${output}
 `);
           ui.status("Scan content exported to the requested private file (0600).");
         } else console.log(output);
@@ -10692,7 +11686,7 @@ function registerRuntimeDashboardCommands(runtime) {
       }
     });
   }
-  register6(
+  register7(
     pageOptions2(
       timeOptions(
         dashboard.command("applications").description("One page of application activity"),
@@ -10721,7 +11715,7 @@ function registerRuntimeDashboardCommands(runtime) {
     ["application", "application"],
     ["application-violations", "applicationViolationBreakdown"]
   ]) {
-    register6(
+    register7(
       timeOptions(
         dashboard.command(name).requiredOption("--app-id <id>", "Application identity").requiredOption("--app-name <name>", "Exact dashboard application name"),
         "30",
@@ -10747,7 +11741,7 @@ function registerRuntimeDashboardCommands(runtime) {
     ["violations-trend", "applicationsViolationsTrend", false],
     ["apps-list", "appsList", true]
   ]) {
-    register6(
+    register7(
       timeOptions(dashboard.command(name), days ? "30" : "1", days ? "days" : "day"),
       (opts) => {
         const query2 = window(opts);
@@ -10755,11 +11749,11 @@ function registerRuntimeDashboardCommands(runtime) {
       }
     );
   }
-  register6(timeOptions(sessions.command("chart")), (opts) => {
+  register7(timeOptions(sessions.command("chart")), (opts) => {
     const query2 = window(opts);
     return (client) => client.sessionsChart(query2);
   });
-  register6(
+  register7(
     pageOptions2(
       timeOptions(
         sessions.command("list").description("Session entries; --all walks pages with completeness checks")
@@ -10825,7 +11819,7 @@ function registerRuntimeDashboardCommands(runtime) {
       };
     }
   );
-  register6(pageOptions2(sessionOptions(sessions.command("get"))), (opts) => {
+  register7(pageOptions2(sessionOptions(sessions.command("get"))), (opts) => {
     const query2 = {
       ...identity(opts),
       limit: integer3(opts.limit, "--limit", 1),
@@ -10833,11 +11827,11 @@ function registerRuntimeDashboardCommands(runtime) {
     };
     return (client) => client.session(query2);
   });
-  register6(scanOptions(sessionOptions(sessions.command("transaction"))), (opts) => {
+  register7(scanOptions(sessionOptions(sessions.command("transaction"))), (opts) => {
     const query2 = { ...identity(opts), ...scan(opts) };
     return (client) => client.sessionTransaction(query2);
   });
-  register6(
+  register7(
     scanOptions(
       sessions.command("scan-content").description("Explicit sensitive scan-content read; never automatically fetched")
     ).option("--show-content", "Explicitly display stored content on stdout").option("--output-file <path>", "Private new file for stored content (no overwrite)"),
@@ -10850,8 +11844,8 @@ function registerRuntimeDashboardCommands(runtime) {
 
 // src/cli/commands/runtime-report.ts
 import { lstat as lstat5 } from "fs/promises";
-import { resolve as resolve7 } from "path";
-import { randomUUID as randomUUID8 } from "crypto";
+import { resolve as resolve8 } from "path";
+import { randomUUID as randomUUID9 } from "crypto";
 function registerRuntimeReportCommand(runtime) {
   const command = runtime.command("report").description("Generate a daily AI Runtime Security environment report (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
     "--output-file <path>",
@@ -10868,15 +11862,15 @@ function registerRuntimeReportCommand(runtime) {
     const format = opts.output ?? command.parent?.parent?.opts().output ?? "html";
     if (format !== "html" && format !== "markdown")
       usageError("Report output must be html or markdown");
-    const maxPages2 = Number(opts.maxPages);
-    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages2) || maxPages2 > 100)
+    const maxPages3 = Number(opts.maxPages);
+    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages3) || maxPages3 > 100)
       usageError("--max-pages must be an integer from 1 to 100");
     if (typeof opts.title !== "string" || !opts.title.trim() || opts.title.length > 240)
       usageError("--title must contain 1\u2013240 characters");
     if (opts.outputFile !== void 0 && !opts.outputFile.trim())
       usageError("--output-file cannot be empty");
-    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID8().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
-    const outputPath = opts.outputFile === "-" ? void 0 : resolve7(opts.outputFile ?? defaultName);
+    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID9().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve8(opts.outputFile ?? defaultName);
     try {
       if (outputPath) {
         const existing = await lstat5(outputPath).catch((error) => {
@@ -10891,7 +11885,7 @@ function registerRuntimeReportCommand(runtime) {
         numRetries: 0
       });
       ui.status("Collecting daily runtime activity and current configuration (read-only)...");
-      const report = await collectRuntimeDailyReport(client, { title: opts.title, maxPages: maxPages2 });
+      const report = await collectRuntimeDailyReport(client, { title: opts.title, maxPages: maxPages3 });
       const rendered = format === "html" ? renderRuntimeReportHtml(report) : renderRuntimeReportMarkdown(report);
       if (outputPath) {
         await writeReportFile(outputPath, rendered);
@@ -11051,7 +12045,7 @@ function registerCreateCommand(parent) {
 }
 
 // src/cli/commands/topics-eval.ts
-import { readFile as readFile10 } from "fs/promises";
+import { readFile as readFile11 } from "fs/promises";
 
 // src/core/prompt-loader.ts
 function parseCsvLine(line) {
@@ -11194,7 +12188,7 @@ function registerEvalCommand(parent) {
     resolveDeprecatedAliases(cmd, opts);
     try {
       const config = await loadConfig();
-      const csvContent = await readFile10(opts.prompts, "utf-8");
+      const csvContent = await readFile11(opts.prompts, "utf-8");
       const { cases, intent } = loadPrompts(csvContent, (msg) => ui.status(`Warning: ${msg}`));
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
@@ -11366,7 +12360,7 @@ function completedBulkResults(state) {
 }
 async function writeBulkResults(outputPath, results) {
   await fs5.promises.mkdir(dirname3(outputPath), { recursive: true });
-  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID9()}`;
+  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID10()}`;
   try {
     await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
       encoding: "utf-8",
@@ -11493,7 +12487,7 @@ function registerRuntimeCommand(program) {
       if (!config.airsApiKey && !config.airsApiToken) {
         fail(new Error("PANW_AI_SEC_API_KEY or PANW_AI_SEC_API_TOKEN is required"));
       }
-      const raw = await readFile11(opts.file, "utf-8");
+      const raw = await readFile12(opts.file, "utf-8");
       const prompts = parseInputFile(raw, opts.file);
       if (prompts.length === 0) {
         usageError("No prompts found in input file");
@@ -12151,7 +13145,7 @@ function registerRuntimeCommand(program) {
 }
 
 // src/config/tenant-settings.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import { constants } from "fs";
 import { access, lstat as lstat6, mkdir as mkdir3, open as open2, rename as rename2, unlink as unlink2 } from "fs/promises";
 import { dirname as dirname4, join as join4 } from "path";
@@ -12181,7 +13175,7 @@ async function createManagedTenant(name, config) {
     throw new Error("Tenant name already exists");
   const directory = join4(dirname4(tenantStorePath()), "configs");
   await mkdir3(directory, { recursive: true, mode: 448 });
-  const path3 = join4(directory, `${name}-${randomUUID10()}.json`);
+  const path3 = join4(directory, `${name}-${randomUUID11()}.json`);
   const file = await open2(path3, "wx", 384);
   try {
     const data = Object.fromEntries(
@@ -12211,11 +13205,11 @@ async function setTenantSetting(name, key, value) {
       "Cannot lock tenant config; it may be read-only or another edit is in progress"
     );
   });
-  const temporary = join4(dirname4(path3), `.airs-config-${randomUUID10()}.tmp`);
+  const temporary = join4(dirname4(path3), `.airs-config-${randomUUID11()}.tmp`);
   let created = false;
   try {
-    const stat2 = await lstat6(path3);
-    if (!stat2.isFile() || (stat2.mode & 146) === 0)
+    const stat3 = await lstat6(path3);
+    if (!stat3.isFile() || (stat3.mode & 146) === 0)
       throw new Error("Tenant config is not a writable regular file");
     await access(path3, constants.W_OK);
     const current = readTenantConfigFile(path3, entry.tsgId);
@@ -12511,7 +13505,7 @@ function buildProgram() {
     if (root.debug) {
       const logPath = join5(
         process.cwd(),
-        `debug-api-${Date.now()}-${randomUUID11().slice(0, 8)}.jsonl`
+        `debug-api-${Date.now()}-${randomUUID12().slice(0, 8)}.jsonl`
       );
       try {
         let ancestor = actionCommand;