@cdot65/prisma-airs-cli 3.0.1 → 3.2.0

package/dist/{chunk-JXHYQFEK.js → chunk-TTBN7YHC.js}

@@ -456,6 +456,51 @@ function normalizeFile(raw) {
     result: raw.result
   };
 }
+function normalizeModel(raw) {
+  return {
+    uuid: raw.uuid,
+    tsgId: raw.tsg_id,
+    name: raw.name,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at,
+    latestVersionUuid: raw.latest_version_uuid,
+    latestVersionFingerprint: raw.latest_version_fingerprint,
+    latestVersionRevision: raw.latest_version_revision,
+    latestVersionHfCommitSha: raw.latest_version_hf_commit_sha,
+    latestVersionOutcome: raw.latest_version_outcome,
+    latestVersionFormats: raw.latest_version_formats,
+    latestVersionSourceTypes: raw.latest_version_source_types,
+    latestVersionScanTime: raw.latest_version_scan_time
+  };
+}
+function normalizeModelVersion(raw) {
+  const summary = raw.last_eval_summary;
+  return {
+    uuid: raw.uuid,
+    tsgId: raw.tsg_id,
+    modelUuid: raw.model_uuid,
+    revision: raw.revision,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at,
+    fingerprint: raw.fingerprint,
+    fileCount: raw.file_count,
+    license: raw.license,
+    latestScanTime: raw.latest_scan_time,
+    hfCommitSha: raw.hf_commit_sha,
+    hfCommitTitle: raw.hf_commit_title,
+    hfCommitAuthors: raw.hf_commit_authors,
+    hfModelName: raw.hf_model_name,
+    hfOrganization: raw.hf_organization,
+    modelFormats: raw.model_formats,
+    sourceTypes: raw.source_types,
+    lastEvalOutcome: raw.last_eval_outcome,
+    lastEvalSummary: summary ? {
+      rulesFailed: summary.rules_failed ?? 0,
+      rulesPassed: summary.rules_passed ?? 0,
+      totalRules: summary.total_rules ?? 0
+    } : summary
+  };
+}
 var SdkModelSecurityService = class {
   client;
   constructor(opts) {
@@ -680,6 +725,58 @@ var SdkModelSecurityService = class {
       expiresAt: raw.expires_at
     };
   }
+  // -----------------------------------------------------------------------
+  // Models (read-only catalog)
+  // -----------------------------------------------------------------------
+  async listModels(opts) {
+    const sdkOpts = {};
+    if (opts?.search) sdkOpts.search = opts.search;
+    if (opts?.searchQuery) sdkOpts.search_query = opts.searchQuery;
+    if (opts?.sortField) sdkOpts.sort_field = opts.sortField;
+    if (opts?.sortOrder) sdkOpts.sort_order = opts.sortOrder;
+    if (opts?.skip !== void 0) sdkOpts.skip = opts.skip;
+    if (opts?.limit !== void 0) sdkOpts.limit = opts.limit;
+    const response = await this.client.models.listModels(sdkOpts);
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      models: raw.models.map(normalizeModel)
+    };
+  }
+  async getModel(uuid) {
+    const response = await this.client.models.getModel(uuid);
+    return normalizeModel(response);
+  }
+  async listModelVersions(modelUuid, opts) {
+    const sdkOpts = {};
+    if (opts?.sortOrder) sdkOpts.sort_order = opts.sortOrder;
+    if (opts?.skip !== void 0) sdkOpts.skip = opts.skip;
+    if (opts?.limit !== void 0) sdkOpts.limit = opts.limit;
+    const response = await this.client.models.listModelVersions(modelUuid, sdkOpts);
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      versions: raw.model_versions.map(normalizeModelVersion)
+    };
+  }
+  async getModelVersion(uuid) {
+    const response = await this.client.models.getModelVersion(uuid);
+    return normalizeModelVersion(response);
+  }
+  async listModelVersionFiles(modelVersionUuid, opts) {
+    const sdkOpts = {};
+    if (opts?.skip !== void 0) sdkOpts.skip = opts.skip;
+    if (opts?.limit !== void 0) sdkOpts.limit = opts.limit;
+    const response = await this.client.models.listModelVersionFiles(
+      modelVersionUuid,
+      sdkOpts
+    );
+    const raw = response;
+    return {
+      totalItems: raw.pagination.total_items ?? 0,
+      files: raw.files.map(normalizeFile)
+    };
+  }
 };
 
 // src/airs/promptsets.ts
@@ -862,6 +959,37 @@ function sanitizeTargetMetadata(metadata) {
   }
   return metadata;
 }
+function normalizeChannel(raw) {
+  return {
+    uuid: raw.uuid,
+    name: raw.name,
+    description: raw.description,
+    status: raw.status,
+    addedBy: raw.added_by,
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at,
+    lastOnlineAt: raw.last_online_at,
+    connectedClientsCount: raw.connected_clients_count,
+    outdatedClientsCount: raw.outdated_clients_count,
+    features: raw.features
+  };
+}
+function normalizeErrorLog(raw) {
+  return {
+    createdAt: raw.created_at,
+    updatedAt: raw.updated_at,
+    jobId: raw.job_id,
+    targetId: raw.target_id,
+    targetVersion: raw.target_version,
+    attackId: raw.attack_id,
+    errorType: raw.error_type,
+    errorSource: raw.error_source,
+    errorMessage: raw.error_message,
+    targetObject: raw.target_object,
+    extraInfo: raw.extra_info,
+    version: raw.version
+  };
+}
 function normalizeTargetDetail(raw) {
   return {
     uuid: raw.uuid,
@@ -1210,21 +1338,213 @@ var SdkRedTeamService = class {
       await delay(intervalMs);
     }
   }
+  async listChannels(opts) {
+    const sdkOpts = {};
+    if (opts?.limit != null) sdkOpts.limit = opts.limit;
+    if (opts?.offset != null) sdkOpts.skip = opts.offset;
+    if (opts?.search) sdkOpts.search = opts.search;
+    if (opts?.status) sdkOpts.status = opts.status;
+    const raw = await this.client.networkBroker.listChannels(sdkOpts);
+    const pagination = raw.pagination;
+    return {
+      channels: (raw.data ?? []).map(normalizeChannel),
+      totalItems: pagination?.total_items
+    };
+  }
+  async getChannel(channelId) {
+    const raw = await this.client.networkBroker.getChannel(channelId);
+    return normalizeChannel(raw);
+  }
+  async createChannel(request) {
+    const body = { name: request.name };
+    if (request.description !== void 0) body.description = request.description;
+    const raw = await this.client.networkBroker.createChannel(
+      body
+    );
+    return normalizeChannel(raw);
+  }
+  async updateChannel(channelId, request) {
+    const body = {};
+    if (request.name !== void 0) body.name = request.name;
+    if (request.description !== void 0) body.description = request.description;
+    const raw = await this.client.networkBroker.updateChannel(
+      channelId,
+      body
+    );
+    return normalizeChannel(raw);
+  }
+  async getChannelStats() {
+    const raw = await this.client.networkBroker.getChannelStats();
+    return {
+      serverDomain: raw.network_channels_server_domain,
+      dockerRegistry: raw.docker_registry,
+      helmChart: raw.helm_chart,
+      dockerImage: raw.docker_image,
+      onlineChannels: raw.online_channels,
+      totalChannels: raw.total_channels,
+      clientVersion: raw.client_version
+    };
+  }
+  async getLanguages(management = false) {
+    const raw = await (management ? this.client.getManagementLanguages() : this.client.getLanguages());
+    return {
+      multilingualEnabled: Boolean(raw.multilingual_enabled),
+      supportedJobTypes: raw.supported_job_types ?? [],
+      languages: (raw.languages ?? []).map((l) => ({
+        code: l.code,
+        name: l.name
+      }))
+    };
+  }
+  async getTargetProfileErrorLogs(targetId, opts) {
+    const sdkOpts = {};
+    if (opts?.limit != null) sdkOpts.limit = opts.limit;
+    if (opts?.offset != null) sdkOpts.skip = opts.offset;
+    if (opts?.search) sdkOpts.search = opts.search;
+    const raw = await this.client.getTargetProfileErrorLogs(targetId, sdkOpts);
+    const pagination = raw.pagination;
+    return {
+      logs: (raw.data ?? []).map(normalizeErrorLog),
+      totalItems: pagination?.total_items
+    };
+  }
 };
 
 // src/airs/runtime.ts
-import { Content, init, Scanner } from "@cdot65/prisma-airs-sdk";
-var BATCH_SIZE = 5;
+import {
+  Content,
+  init,
+  MAX_NUMBER_OF_BATCH_SCAN_OBJECTS,
+  Scanner
+} from "@cdot65/prisma-airs-sdk";
+var SDK_ASYNC_BATCH_SIZE = MAX_NUMBER_OF_BATCH_SCAN_OBJECTS;
 var DEFAULT_POLL_INTERVAL_MS = 5e3;
 var DEFAULT_MAX_RETRIES = 5;
 var DEFAULT_BASE_DELAY_MS = 1e4;
+var DEFAULT_MAX_NO_PROGRESS_POLLS = 120;
+var NO_SDK_RETRIES = { numRetries: 0 };
+var RUNTIME_DETECTION_KEYS = [
+  "topic_violation",
+  "injection",
+  "toxic_content",
+  "dlp",
+  "url_cats",
+  "malicious_code",
+  "source_code",
+  "agent"
+];
+var REPORT_DETECTION_KEYS = {
+  topic_guardrails: "topic_violation",
+  topic_violation: "topic_violation",
+  pi: "injection",
+  prompt_injection: "injection",
+  injection: "injection",
+  tc: "toxic_content",
+  toxic_content: "toxic_content",
+  dlp: "dlp",
+  uf: "url_cats",
+  url_filtering: "url_cats",
+  url_cats: "url_cats",
+  mc: "malicious_code",
+  malicious_code: "malicious_code",
+  source_code: "source_code",
+  agent: "agent"
+};
 function isRateLimitError(err) {
+  if (err?.statusCode === 429) return true;
   if (err instanceof Error) {
     const msg = err.message.toLowerCase();
     return msg.includes("rate limit") || msg.includes("rate_limit") || msg.includes("429");
   }
   return false;
 }
+function isDefiniteRateLimitError(err) {
+  const metadata = err;
+  return metadata?.failureKind === "http" && metadata.statusCode === 429;
+}
+function runtimeDetections(value) {
+  const source = value ?? {};
+  return Object.fromEntries(
+    RUNTIME_DETECTION_KEYS.filter((key) => typeof source[key] === "boolean").map((key) => [
+      key,
+      source[key]
+    ])
+  );
+}
+function runtimeAction(value) {
+  const normalized = typeof value === "string" ? value.toLowerCase() : "";
+  if (normalized === "allow" || normalized === "block") return normalized;
+  return "failed";
+}
+function scanResponseToResult(response, prompt) {
+  const detections = runtimeDetections(response.prompt_detected);
+  const action = runtimeAction(response.action);
+  const failed = response.error === true || response.timeout === true || action === "failed";
+  const errors = Array.isArray(response.errors) ? response.errors.map((entry) => {
+    const detail = entry;
+    return [detail.feature, detail.status, detail.content_type].filter(Boolean).join(": ");
+  }) : [];
+  return {
+    prompt,
+    response: void 0,
+    scanId: response.scan_id ?? "",
+    reportId: response.report_id ?? "",
+    action: failed ? "failed" : action,
+    category: failed ? "error" : response.category ?? "unknown",
+    triggered: RUNTIME_DETECTION_KEYS.some((key) => detections[key] === true),
+    detections,
+    ...failed ? {
+      error: errors.filter(Boolean).join("; ") || (response.timeout === true ? "AIRS scan timed out" : response.error === true ? "AIRS scan failed" : `Unknown AIRS action: ${String(response.action ?? "missing")}`)
+    } : {}
+  };
+}
+function threatReportToResult(report, entry) {
+  const detections = {};
+  let sawBlock = false;
+  let unexpectedAction;
+  const detectionResults = Array.isArray(report.detection_results) ? report.detection_results : [];
+  for (const detection of detectionResults) {
+    const service = String(detection.detection_service ?? "").toLowerCase();
+    const detectorAction = String(detection.action ?? "").toLowerCase();
+    const verdict = String(detection.verdict ?? "").toLowerCase();
+    const fired = detectorAction === "block" || ["malicious", "unsafe", "violation", "detected"].includes(verdict);
+    const namedKey = REPORT_DETECTION_KEYS[service] ?? service;
+    const key = namedKey || (fired ? "unknown" : "");
+    if (key) detections[key] = detections[key] === true || fired;
+    if (detectorAction === "block") sawBlock = true;
+    else if (detectorAction && detectorAction !== "allow") unexpectedAction = detectorAction;
+  }
+  const triggered = Object.values(detections).some(Boolean);
+  const action = sawBlock ? "block" : unexpectedAction ? "failed" : "allow";
+  return {
+    index: entry.index,
+    reqId: entry.reqId,
+    prompt: entry.prompt,
+    response: void 0,
+    scanId: entry.scanId,
+    reportId: report.report_id ?? "",
+    action,
+    category: action === "failed" ? "error" : triggered ? "malicious" : "benign",
+    triggered,
+    detections,
+    ...action === "failed" ? { error: `Unknown AIRS action in threat report: ${unexpectedAction}` } : {}
+  };
+}
+function failedBulkResult(entry, error = "AIRS async scan failed") {
+  return {
+    index: entry.index,
+    reqId: entry.reqId,
+    prompt: entry.prompt,
+    response: void 0,
+    scanId: entry.scanId,
+    reportId: "",
+    action: "failed",
+    category: "error",
+    triggered: false,
+    detections: {},
+    error
+  };
+}
 var SdkRuntimeService = class {
   scanner;
   constructor(opts) {
@@ -1236,23 +1556,208 @@ var SdkRuntimeService = class {
     if (response) contentOpts.response = response;
     const content = new Content(contentOpts);
     const res = await this.scanner.syncScan({ profile_name: profileName }, content, void 0);
-    const detected = res.prompt_detected ?? {};
-    const triggered = !!(detected.topic_violation || detected.injection || detected.toxic_content || detected.dlp || detected.url_cats || detected.malicious_code);
+    const normalized = scanResponseToResult(res, prompt);
     return {
-      prompt,
+      ...normalized,
       response,
-      scanId: res.scan_id ?? "",
-      reportId: res.report_id ?? "",
-      action: res.action === "block" ? "block" : "allow",
-      category: res.category ?? "unknown",
-      triggered,
-      detections: detected
+      action: normalized.action === "block" ? "block" : "allow"
+    };
+  }
+  async submitBatch(profileName, prompts, sessionId, retryOpts) {
+    if (prompts.length < 1 || prompts.length > SDK_ASYNC_BATCH_SIZE) {
+      throw new Error(`submitBatch requires between 1 and ${SDK_ASYNC_BATCH_SIZE} prompts`);
+    }
+    const promptIndices = /* @__PURE__ */ new Set();
+    for (const prompt of prompts) {
+      if (!Number.isSafeInteger(prompt.index) || prompt.index < 0 || promptIndices.has(prompt.index)) {
+        throw new Error("submitBatch requires a unique nonnegative safe index for every prompt");
+      }
+      promptIndices.add(prompt.index);
+    }
+    const scanObjects = prompts.map(({ index, prompt }) => ({
+      req_id: index,
+      scan_req: {
+        ai_profile: { profile_name: profileName },
+        contents: [{ prompt }],
+        ...sessionId ? { session_id: sessionId } : {}
+      }
+    }));
+    const maxRetries = retryOpts?.maxRetries ?? DEFAULT_MAX_RETRIES;
+    const baseDelay = retryOpts?.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+    let retryAttempt = 0;
+    let receipt;
+    while (true) {
+      try {
+        receipt = await this.scanner.asyncScan(scanObjects, NO_SDK_RETRIES);
+        break;
+      } catch (error) {
+        if (!isDefiniteRateLimitError(error) || retryAttempt >= maxRetries) throw error;
+        retryAttempt++;
+        const retryAfterMs = error.retryAfterMs;
+        const delayMs = typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs >= 0 ? retryAfterMs : baseDelay * 2 ** (retryAttempt - 1);
+        retryOpts?.onRetry?.(retryAttempt, delayMs);
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+      }
+    }
+    return {
+      scanId: receipt.scan_id,
+      reportId: receipt.report_id,
+      entries: prompts.map(({ index, prompt }) => ({
+        scanId: receipt.scan_id,
+        reqId: index,
+        index,
+        prompt
+      }))
     };
   }
+  async pollBatch(batch, intervalMs = DEFAULT_POLL_INTERVAL_MS, retryOpts) {
+    if (batch.entries.length < 1 || batch.entries.length > SDK_ASYNC_BATCH_SIZE) {
+      throw new Error(`pollBatch requires between 1 and ${SDK_ASYNC_BATCH_SIZE} receipt entries`);
+    }
+    const receiptIds = /* @__PURE__ */ new Set();
+    for (const entry of batch.entries) {
+      if (entry.scanId !== batch.scanId) {
+        throw new Error(`Receipt entry scan ID ${entry.scanId} does not match ${batch.scanId}`);
+      }
+      if (!Number.isSafeInteger(entry.reqId) || entry.reqId < 0 || entry.reqId !== entry.index || receiptIds.has(entry.reqId)) {
+        throw new Error("pollBatch requires a unique request ID matching each prompt index");
+      }
+      receiptIds.add(entry.reqId);
+    }
+    const maxRetries = retryOpts?.maxRetries ?? DEFAULT_MAX_RETRIES;
+    const baseDelay = retryOpts?.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+    const maxNoProgressPolls = retryOpts?.maxNoProgressPolls ?? DEFAULT_MAX_NO_PROGRESS_POLLS;
+    const entries = new Map(batch.entries.map((entry) => [entry.reqId, entry]));
+    const resolved = /* @__PURE__ */ new Map();
+    let retryLevel = 0;
+    let noProgressPolls = 0;
+    while (resolved.size < batch.entries.length) {
+      let rows;
+      try {
+        rows = await this.scanner.queryByScanIds([batch.scanId], NO_SDK_RETRIES);
+      } catch (err) {
+        if (isRateLimitError(err) && retryLevel < maxRetries) {
+          retryLevel++;
+          const retryAfterMs = err.retryAfterMs;
+          const delayMs = typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs >= 0 ? retryAfterMs : baseDelay * 2 ** (retryLevel - 1);
+          retryOpts?.onRetry?.(retryLevel, delayMs);
+          await new Promise((resolve) => setTimeout(resolve, delayMs));
+          continue;
+        }
+        throw err;
+      }
+      const resolvedBeforePoll = resolved.size;
+      const fallbackReports = /* @__PURE__ */ new Map();
+      for (const row of rows) {
+        const scanId = row.scan_id ?? batch.scanId;
+        const reqId = row.req_id;
+        const status = (row.status ?? "").toLowerCase();
+        const terminal = status === "failed" || status === "complete" || status === "completed";
+        if (reqId === void 0 && terminal && scanId === batch.scanId) {
+          if (status === "failed") {
+            const newlyFailed = [];
+            for (const entry2 of batch.entries) {
+              if (!resolved.has(entry2.reqId)) {
+                const result = failedBulkResult(entry2);
+                resolved.set(entry2.reqId, result);
+                newlyFailed.push(result);
+              }
+            }
+            if (newlyFailed.length > 0) await retryOpts?.onProgress?.(newlyFailed);
+            continue;
+          }
+          const reportId = row.result?.report_id ?? row.report_id ?? batch.reportId;
+          if (!reportId) {
+            throw new Error(
+              `AIRS result correlation failed for scan ${scanId}: terminal row has no request or report ID`
+            );
+          }
+          fallbackReports.set(scanId, reportId);
+          continue;
+        }
+        const entry = reqId === void 0 || scanId !== batch.scanId ? void 0 : entries.get(reqId);
+        if (!entry || resolved.has(entry.reqId)) continue;
+        if (status === "failed") {
+          const result = failedBulkResult(entry);
+          resolved.set(entry.reqId, result);
+          await retryOpts?.onProgress?.([result]);
+          continue;
+        }
+        if ((status === "complete" || status === "completed") && row.result) {
+          const nestedResult = row.result;
+          const nestedScanId = nestedResult.scan_id;
+          if (nestedScanId && nestedScanId !== scanId) {
+            throw new Error(
+              `AIRS result correlation mismatch: nested scan ID ${nestedScanId} does not match ${scanId}`
+            );
+          }
+          const result = {
+            ...scanResponseToResult(nestedResult, entry.prompt),
+            scanId,
+            index: entry.index,
+            reqId: entry.reqId
+          };
+          resolved.set(entry.reqId, result);
+          await retryOpts?.onProgress?.([result]);
+        }
+      }
+      if (fallbackReports.size > 0) {
+        let reports;
+        try {
+          reports = await this.scanner.queryByReportIds(
+            [...new Set(fallbackReports.values())],
+            NO_SDK_RETRIES
+          );
+        } catch (err) {
+          if (isRateLimitError(err) && retryLevel < maxRetries) {
+            retryLevel++;
+            const retryAfterMs = err.retryAfterMs;
+            const delayMs = typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs >= 0 ? retryAfterMs : baseDelay * 2 ** (retryLevel - 1);
+            retryOpts?.onRetry?.(retryLevel, delayMs);
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+            continue;
+          }
+          throw err;
+        }
+        for (const report of reports) {
+          const reqId = report.req_id;
+          const reportScanId = report.scan_id ?? batch.scanId;
+          const expectedReportId = fallbackReports.get(reportScanId);
+          const reportId = report.report_id;
+          if (reportScanId !== batch.scanId || reportId && reportId !== expectedReportId) {
+            throw new Error(
+              `AIRS report correlation mismatch for scan ${batch.scanId}, request ${String(reqId)}`
+            );
+          }
+          const entry = reqId === void 0 ? void 0 : entries.get(reqId);
+          if (!entry || resolved.has(entry.reqId)) continue;
+          const result = threatReportToResult(report, entry);
+          resolved.set(entry.reqId, result);
+          await retryOpts?.onProgress?.([result]);
+        }
+      }
+      if (retryLevel > 0) retryLevel--;
+      if (resolved.size === resolvedBeforePoll) {
+        noProgressPolls++;
+      } else {
+        noProgressPolls = 0;
+      }
+      if (noProgressPolls >= maxNoProgressPolls) {
+        throw new Error(
+          `AIRS polling made no progress after ${noProgressPolls} polls for scan ${batch.scanId}`
+        );
+      }
+      if (resolved.size < batch.entries.length) {
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+      }
+    }
+    return [...resolved.values()].sort((left, right) => left.index - right.index);
+  }
+  /** @deprecated Use submitBatch to preserve per-prompt request correlation. */
   async submitBulkScan(profileName, prompts, sessionId) {
     const scanIds = [];
-    for (let i = 0; i < prompts.length; i += BATCH_SIZE) {
-      const batch = prompts.slice(i, i + BATCH_SIZE);
+    for (let i = 0; i < prompts.length; i += SDK_ASYNC_BATCH_SIZE) {
+      const batch = prompts.slice(i, i + SDK_ASYNC_BATCH_SIZE);
       const scanObjects = batch.map((prompt, idx) => ({
         req_id: i + idx,
         scan_req: {
@@ -1261,18 +1766,16 @@ var SdkRuntimeService = class {
           ...sessionId ? { session_id: sessionId } : {}
         }
       }));
-      const res = await this.scanner.asyncScan(scanObjects);
+      const res = await this.scanner.asyncScan(scanObjects, NO_SDK_RETRIES);
       scanIds.push(res.scan_id);
     }
     return scanIds;
   }
   /**
-   * Poll async scan results until all complete or fail.
-   *
-   * Note: The async query API (`queryByScanIds`) does not return `prompt`,
-   * `response`, `triggered`, or `detections` fields. These are set to
-   * defaults (`''`, `undefined`, `false`, `{}`) in the returned results.
-   * Use `scanPrompt()` (sync API) when these fields are needed.
+   * Compatibility poller for callers that retained only batch scan IDs.
+   * Nested detection data is preserved, but prompt text and per-request fan-out
+   * cannot be reconstructed from scan IDs alone.
+   * @deprecated Use pollBatch to preserve `(scan_id, req_id)` correlation and prompt text.
    */
   async pollResults(scanIds, intervalMs = DEFAULT_POLL_INTERVAL_MS, retryOpts) {
     const maxRetries = retryOpts?.maxRetries ?? DEFAULT_MAX_RETRIES;
@@ -1321,19 +1824,16 @@ var SdkRuntimeService = class {
       const status = (r.status ?? "").toLowerCase();
       if ((status === "complete" || status === "completed") && r.result) {
         const result = r.result;
+        const nestedScanId = result.scan_id;
+        if (nestedScanId && nestedScanId !== id) {
+          throw new Error(
+            `AIRS result correlation mismatch: nested scan ID ${nestedScanId} does not match ${id}`
+          );
+        }
         completed.set(id, {
-          prompt: "",
-          // not available from async API
-          response: void 0,
-          // not available from async API
-          scanId: result.scan_id ?? id,
-          reportId: result.report_id ?? "",
-          action: result.action === "block" ? "block" : "allow",
-          category: result.category ?? "unknown",
-          triggered: false,
-          // not available from async API — always false
-          detections: {}
-          // not available from async API
+          ...scanResponseToResult(result, ""),
+          scanId: id,
+          action: result.action === "block" ? "block" : "allow"
         });
         pending.delete(id);
       } else if (status === "failed") {
@@ -1345,22 +1845,38 @@ var SdkRuntimeService = class {
           scanId: id,
           reportId: "",
           action: "allow",
-          // safe default for failed scans
           category: "error",
           triggered: false,
-          // not available from async API — always false
-          detections: {}
-          // not available from async API
+          detections: {},
+          error: "AIRS async scan failed"
         });
         pending.delete(id);
       }
     }
   }
   static formatResultsCsv(results) {
-    const header = "prompt,action,category,triggered,scan_id,report_id";
+    const header = [
+      "prompt",
+      "action",
+      "category",
+      "triggered",
+      ...RUNTIME_DETECTION_KEYS,
+      "scan_id",
+      "report_id",
+      "error"
+    ].join(",");
     const rows = results.map((r) => {
-      const escaped = r.prompt.replace(/"/g, '""');
-      return `"${escaped}","${r.action}","${r.category}","${r.triggered}","${r.scanId}","${r.reportId}"`;
+      const fields = [
+        r.prompt,
+        r.action,
+        r.category,
+        String(r.triggered),
+        ...RUNTIME_DETECTION_KEYS.map((key) => String(r.detections[key] === true)),
+        r.scanId,
+        r.reportId,
+        r.error ?? ""
+      ];
+      return fields.map((field) => `"${field.replace(/"/g, '""')}"`).join(",");
     });
     return [header, ...rows].join("\n");
   }
@@ -1509,6 +2025,7 @@ var ConfigSchema = z.object({
   redTeamDataEndpoint: z.string().optional(),
   redTeamMgmtEndpoint: z.string().optional(),
   redTeamTokenEndpoint: z.string().optional(),
+  redTeamNetworkBrokerEndpoint: z.string().optional(),
   // Model Security (endpoints only; creds shared with mgmt*)
   modelSecDataEndpoint: z.string().optional(),
   modelSecMgmtEndpoint: z.string().optional(),
@@ -1539,6 +2056,7 @@ function fromEnv() {
     redTeamDataEndpoint: env.PANW_RED_TEAM_DATA_ENDPOINT,
     redTeamMgmtEndpoint: env.PANW_RED_TEAM_MGMT_ENDPOINT,
     redTeamTokenEndpoint: env.PANW_RED_TEAM_TOKEN_ENDPOINT,
+    redTeamNetworkBrokerEndpoint: env.PANW_RED_TEAM_NETWORK_BROKER_ENDPOINT,
     modelSecDataEndpoint: env.PANW_MODEL_SEC_DATA_ENDPOINT,
     modelSecMgmtEndpoint: env.PANW_MODEL_SEC_MGMT_ENDPOINT,
     modelSecTokenEndpoint: env.PANW_MODEL_SEC_TOKEN_ENDPOINT,
@@ -1731,6 +2249,7 @@ export {
   SdkModelSecurityService,
   SdkPromptSetService,
   SdkRedTeamService,
+  SDK_ASYNC_BATCH_SIZE,
   SdkRuntimeService,
   AirsScanService,
   RateLimitedScanService,