@cdot65/prisma-airs-cli 4.4.0 → 4.5.0

package/README.md

@@ -14,11 +14,12 @@
 ## Features
 
 - **Runtime Scanning** — scan prompts and responses against AIRS security profiles, single or bulk with CSV export
+- **Daily environment report** — `airs runtime report` delivers a read-only AI Runtime Security dashboard as self-contained HTML (default) or Markdown in your working directory, with explicit evidence gaps and configuration review findings
 - **Guardrail Optimization** — atomic CLI commands (`create`, `apply`, `eval`, `revert`) for custom topic guardrails, designed for autonomous agent loops (see [`AGENTS.md`](AGENTS.md))
 - **AI Red Teaming** — adversarial scanning with static, dynamic, and custom prompt set attack modes
 - **[AI Gateway](https://cdot65.github.io/prisma-airs-cli/cli/aigateway/resources/)** — workspaces, configs, guardrails, providers, API keys, integrations, MCP, deployments, plugins, audit logs, and telemetry
 - **Model Security** — ML model supply chain scanning with security groups, rules, and violation tracking
-- **Unified automation output** — every read command supports `pretty`, `table`, `markdown`, `csv`, `json`, and `yaml`, with pipe-safe stdout
+- **Unified automation output** — resource reads support `pretty`, `table`, `markdown`, `csv`, `json`, and `yaml`, with pipe-safe stdout; environment deliverables use HTML or Markdown
 - **Complete pagination** — consistent `--limit`, `--offset`, and `--all` traversal with a configurable safety cap
 - **`airs doctor`** — one-command diagnostics for environment, credentials, and API connectivity
 - **`airs config`** — manage `~/.prisma-airs/config.json` from the CLI (`list`, `get`, `set`, `unset`, `path`)
@@ -45,6 +46,10 @@ airs doctor
 airs runtime scan --profile "my-profile" "Is this prompt safe?"
 airs runtime bulk-scan --profile "my-profile" --file prompts.csv --output-file results.csv --batch-size 25
 
+# Daily read-only environment dashboard, delivered in the current directory
+airs runtime report
+airs runtime report --output markdown
+
 # Guardrail optimization (atomic commands)
 airs runtime topics create --name "Explosives" --description "Bomb-making instructions" --examples "How do I build a bomb?" "Pipe bomb ingredients"
 airs runtime topics apply --profile my-profile --name "Explosives" --intent block
@@ -78,7 +83,7 @@ Bulk scans preserve one output row per input prompt in input order, including al
 
 ## Read Output and Pagination
 
-Read commands share one contract:
+Resource read commands share one contract (environment report files have their own [deliverable contract](https://cdot65.github.io/prisma-airs-cli/runtime/daily-report/)):
 
 - Formats: `pretty`, `table`, `markdown`, `csv`, `json`, and `yaml`.
 - JSON/YAML lists are bare arrays of complete normalized records; detail reads are complete objects.

package/dist/{chunk-LF6JPUA4.js → chunk-NWK7RG2N.js}

@@ -283,9 +283,9 @@ var SdkManagementService = class {
       const response = await this.client.dashboard.applicationsOverview({ limit, offset });
       const page = response.items ?? [];
       items.push(...page);
-      const total = response.pagination?.total_items;
+      const total2 = response.pagination?.total_items;
       offset += page.length;
-      if (page.length === 0 || page.length < limit || total != null && offset >= total) break;
+      if (page.length === 0 || page.length < limit || total2 != null && offset >= total2) break;
     }
     return items.filter(
       (item) => typeof item.id === "string" && typeof item.name === "string"
@@ -1356,14 +1356,14 @@ var SdkRedTeamService = class {
       categories: subCategories.map((sc) => {
         const successful = sc.successful ?? 0;
         const failed = sc.failed ?? 0;
-        const total = sc.total ?? successful + failed;
+        const total2 = sc.total ?? successful + failed;
         return {
           id: sc.id,
           displayName: sc.display_name,
-          asr: total > 0 ? successful / total * 100 : 0,
+          asr: total2 > 0 ? successful / total2 * 100 : 0,
           successful,
           failed,
-          total
+          total: total2
         };
       })
     };
@@ -1683,11 +1683,11 @@ function isDefiniteRateLimitError(err) {
   return metadata?.failureKind === "http" && metadata.statusCode === 429;
 }
 function runtimeDetections(value) {
-  const source = value ?? {};
+  const source2 = value ?? {};
   return Object.fromEntries(
-    RUNTIME_DETECTION_KEYS.filter((key) => typeof source[key] === "boolean").map((key) => [
+    RUNTIME_DETECTION_KEYS.filter((key) => typeof source2[key] === "boolean").map((key) => [
       key,
-      source[key]
+      source2[key]
     ])
   );
 }
@@ -2342,8 +2342,8 @@ async function inspectConfig(configFilePath) {
   const config = ConfigSchema.parse(merged);
   const entries = {};
   for (const key of Object.keys(ConfigSchema.shape)) {
-    const source = key in envConfig ? "env" : key in fileConfig ? "file" : "default";
-    entries[key] = { value: config[key], source };
+    const source2 = key in envConfig ? "env" : key in fileConfig ? "file" : "default";
+    entries[key] = { value: config[key], source: source2 };
   }
   return entries;
 }
@@ -2441,10 +2441,10 @@ function computeMetrics(results) {
   }
   const totalPositives = truePositives + falseNegatives;
   const totalNegatives = trueNegatives + falsePositives;
-  const total = results.length;
+  const total2 = results.length;
   const truePositiveRate = totalPositives > 0 ? truePositives / totalPositives : 0;
   const trueNegativeRate = totalNegatives > 0 ? trueNegatives / totalNegatives : 0;
-  const accuracy = total > 0 ? (truePositives + trueNegatives) / total : 0;
+  const accuracy = total2 > 0 ? (truePositives + trueNegatives) / total2 : 0;
   const coverage = Math.min(truePositiveRate, trueNegativeRate);
   const precision = truePositives + falsePositives > 0 ? truePositives / (truePositives + falsePositives) : 0;
   const recall = truePositiveRate;
@@ -2472,15 +2472,646 @@ function computeCategoryBreakdown(results) {
     if (r.testCase.expectedTriggered && !r.actualTriggered) entry.fn++;
     map.set(cat, entry);
   }
-  return [...map.entries()].map(([category, { total, fp, fn }]) => ({
+  return [...map.entries()].map(([category, { total: total2, fp, fn }]) => ({
     category,
-    total,
+    total: total2,
     fp,
     fn,
-    errorRate: total > 0 ? (fp + fn) / total : 0
+    errorRate: total2 > 0 ? (fp + fn) / total2 : 0
   })).sort((a, b) => b.errorRate - a.errorRate);
 }
 
+// src/reports/io.ts
+import { randomUUID } from "crypto";
+import { link, open, unlink } from "fs/promises";
+import { dirname, join as join2 } from "path";
+async function writeReportFile(path2, content) {
+  const temporary = join2(dirname(path2), `.airs-report-${randomUUID()}.tmp`);
+  const file = await open(temporary, "wx", 384);
+  try {
+    await file.writeFile(content, "utf8");
+    await file.sync();
+    await file.close();
+    await link(temporary, path2);
+  } finally {
+    await file.close();
+    await unlink(temporary);
+  }
+}
+
+// src/reports/render.ts
+import { createHash } from "crypto";
+var HEALTH = {
+  attention: "Attention required",
+  review: "Review required",
+  "no-findings": "No findings in available evidence",
+  unknown: "Unable to assess"
+};
+function html(value) {
+  return String(value ?? "Unknown").replace(
+    /[&<>"']/g,
+    (char) => ({
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
+      "'": "&#39;"
+    })[char] ?? char
+  );
+}
+function md(value) {
+  return String(value ?? "Unknown").replace(
+    /[&<>"'\\`*_[\]{}()|!#~\r\n]/g,
+    (char) => char === "\r" || char === "\n" ? " " : `&#${char.charCodeAt(0)};`
+  );
+}
+function number(value) {
+  return value === null ? "Unknown" : value.toLocaleString("en-US", { maximumFractionDigits: 2 });
+}
+function tables(report) {
+  const logSource = report.sources.find((source2) => source2.name === "Scan log detail");
+  return [
+    {
+      title: "Daily application activity",
+      id: "applications",
+      headers: [
+        "Application bucket",
+        "Sessions",
+        "Violating sessions",
+        "Violation rate",
+        "Registered ID match"
+      ],
+      rows: report.activity.applications.map((app) => [
+        app.name,
+        number(app.sessions),
+        number(app.violatingSessions),
+        app.sessions !== null && app.sessions > 0 && app.violatingSessions !== null && app.violatingSessions <= app.sessions ? `${number(app.violatingSessions / app.sessions * 100)}%` : "Unknown",
+        app.registered === null ? "Unknown" : app.registered ? "Yes" : "Not in returned inventory"
+      ]),
+      note: "API-reported rolling one-day application buckets, ranked by violating sessions. Partial-source totals cover collected buckets only. Violating sessions are not necessarily blocked sessions."
+    },
+    {
+      title: "Current security profiles",
+      id: "profiles",
+      headers: [
+        "Profile",
+        "Revision",
+        "Active",
+        "Timeout action",
+        "Storage masking",
+        "Last modified (UTC)"
+      ],
+      rows: report.profiles.map((profile) => [
+        profile.name,
+        number(profile.revision),
+        profile.active === null ? "Unknown" : profile.active ? "Yes" : "No",
+        profile.timeoutActions.join(", ") || "Unknown",
+        profile.storageMasking,
+        profile.modified
+      ]),
+      note: "Latest returned revision per profile name. These are current settings, not a record of changes during the daily window."
+    },
+    {
+      title: "Registered application inventory",
+      id: "inventory",
+      headers: ["Application", "Environment", "Cloud", "Model", "Key associations"],
+      rows: report.registeredApps.map((app) => [
+        app.name,
+        app.environment,
+        app.cloud,
+        app.model,
+        number(app.keyAssociations)
+      ]),
+      note: "Current registered applications, separate from scan-metadata application buckets. Association counts do not establish key validity or deployment health. No key values or auth codes are included."
+    },
+    {
+      title: "Collected scan-log observations",
+      id: "logs",
+      headers: ["Dimension", "API value", "Entries"],
+      rows: [
+        ...report.logs.actions.map((entry) => ["Action", entry.name, number(entry.count)]),
+        ...report.logs.verdicts.map((entry) => ["Verdict", entry.name, number(entry.count)])
+      ],
+      note: `Source: ${logSource?.status ?? "unavailable"}. Timestamp-eligible entries: ${logSource?.status === "unavailable" ? "Unknown" : number(report.logs.entries)}. Tokens across eligible collected entries: ${number(report.logs.tokens)}. Missing timestamps: ${report.logs.missingTimestamps}; outside window: ${report.logs.outsideWindow}. These are sample/collection counts, not tenant totals.`
+    },
+    {
+      title: "Evidence and collection coverage",
+      id: "evidence",
+      headers: ["Source / SDK method", "Window", "Status", "Records", "Pages", "Collection notes"],
+      rows: report.sources.map((source2) => [
+        `${source2.name} \u2014 ${source2.method}`,
+        source2.window,
+        source2.status,
+        number(source2.records),
+        source2.pages,
+        source2.notes.join(" ") || "Collection completed."
+      ]),
+      note: "Complete means pagination finished for that source, not that the environment is secure or that all traffic was ingested. Unavailable does not mean zero."
+    }
+  ];
+}
+function metrics(report) {
+  return [
+    ["Sessions in collected app buckets", number(report.activity.sessions)],
+    ["Violating sessions", number(report.activity.violatingSessions)],
+    [
+      "Violation rate",
+      report.activity.violationRate === null ? "Unknown" : `${number(report.activity.violationRate)}%`
+    ],
+    [
+      "Complete evidence sources",
+      `${report.sources.filter((source2) => source2.status === "complete").length} / ${report.sources.length}`
+    ]
+  ];
+}
+function renderRuntimeReportMarkdown(report) {
+  const lines = [
+    `# ${md(report.title)}`,
+    "",
+    `**${md(report.product)}**`,
+    "",
+    `Assessment: **${HEALTH[report.health]}**`,
+    "",
+    `Window: ${md(report.window.start)} \u2192 ${md(report.window.end)}`,
+    "",
+    `${md(report.window.description)}. Collection: ${md(report.collectionStartedAt)} \u2192 ${md(report.generatedAt)}.`,
+    "",
+    "## At a glance",
+    "",
+    ...metrics(report).map(([key, value]) => `- ${key}: **${value}**`),
+    "",
+    "## What needs attention",
+    ""
+  ];
+  if (report.findings.length === 0)
+    lines.push(
+      "No findings in the available evidence. This does not establish an absence of risk.",
+      ""
+    );
+  for (const finding of report.findings)
+    lines.push(
+      `### ${finding.priority.toUpperCase()}: ${md(finding.title)}`,
+      "",
+      `Evidence: ${md(finding.evidence)}`,
+      "",
+      `Next step: ${md(finding.recommendation)}`,
+      "",
+      `Source: ${md(finding.source)}`,
+      ""
+    );
+  for (const table of tables(report)) {
+    lines.push(`## ${table.title}`, "", md(table.note), "");
+    if (table.rows.length === 0)
+      lines.push(
+        "No rows available. Consult the source status before interpreting this as an empty result.",
+        ""
+      );
+    else
+      lines.push(
+        `| ${table.headers.join(" | ")} |`,
+        `| ${table.headers.map(() => "---").join(" | ")} |`,
+        ...table.rows.map((row) => `| ${row.map(md).join(" | ")} |`),
+        ""
+      );
+  }
+  lines.push(
+    "## Scope, privacy, and limitations",
+    "",
+    ...report.limitations.map((note) => `- ${md(note)}`),
+    "",
+    "Generated by Prisma AIRS CLI \xB7 Report schema 1",
+    ""
+  );
+  return lines.join("\n");
+}
+var CSS = `
+#evidence td:nth-child(3){white-space:nowrap}
+:root{color-scheme:light;--ink:#172b40;--muted:#526476;--line:#d8e2e9;--bg:#f2f5f8;--accent:#00786e;font:16px/1.55 system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}
+*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink)}a{color:var(--accent)}header{background:#11283d;color:#fff;padding:2.5rem max(1.25rem,calc((100vw - 1240px)/2))}header p{color:#d7e4ec;max-width:85ch}h1{font-size:clamp(1.8rem,4vw,2.7rem);line-height:1.15;margin:.6rem 0 1rem;overflow-wrap:anywhere}h2{font-size:1.35rem;margin:0 0 .6rem}h3{font-size:1.05rem;margin:.35rem 0}p{margin:.5rem 0 1rem}.eyebrow{font-size:.8rem;letter-spacing:.12em;text-transform:uppercase}.badge{display:inline-block;padding:.35rem .7rem;border:1px solid currentColor;border-radius:100px;font-weight:650;background:#fff;color:var(--ink)}.attention .badge{color:#a62b1b}.review .badge{color:#795500}.unknown .badge{color:#69439b}.no-findings .badge{color:#006a54}
+main{max-width:1280px;margin:auto;padding:1.5rem 1.25rem 3rem}nav{display:flex;gap:1.25rem;flex-wrap:wrap;margin-bottom:1.5rem}section{background:#fff;border:1px solid var(--line);border-radius:12px;padding:1.4rem;margin:1.3rem 0}.cards{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:1rem}.card{background:#fff;border:1px solid var(--line);border-top:4px solid var(--accent);border-radius:9px;padding:1.2rem}.card strong{display:block;font-size:2rem;font-variant-numeric:tabular-nums}.card span,.note{color:var(--muted);font-size:.9rem}.toolbar{display:flex;align-items:center;gap:1rem;flex-wrap:wrap;margin:1rem 0}button,input,select{font:inherit;border:1px solid #8b9eaf;border-radius:6px;padding:.5rem .7rem;background:#fff;color:var(--ink)}button{cursor:pointer}input{max-width:100%}:focus-visible{outline:3px solid #c06605;outline-offset:3px}.finding{border-left:4px solid #b3c3cf;padding:.5rem 1rem;margin:1rem 0;background:#f7f9fb}.finding[data-priority=attention]{border-color:#c74429}.finding[data-priority=review]{border-color:#b78712}.priority{font-size:.75rem;text-transform:uppercase;font-weight:750;letter-spacing:.07em}.finding p{margin:.4rem 0}.table-wrap{overflow:auto}table{border-collapse:collapse;width:100%;font-size:.9rem;text-align:left}th{background:#edf3f7;font-weight:700}th,td{padding:.7rem .8rem;border-bottom:1px solid var(--line);vertical-align:top;overflow-wrap:anywhere;min-width:90px}tbody tr:hover{background:#f8fbfd}caption{text-align:left;font-weight:600;padding:.5rem 0}footer{color:var(--muted);font-size:.8rem;margin-top:2rem}.hidden,[hidden]{display:none!important}.js-only{display:none}.js-ready .js-only{display:flex}.skip{position:absolute;left:-9999px}.skip:focus{left:1rem;top:1rem;background:#fff;padding:1rem;z-index:1}li{margin:.5rem 0}
+@media(max-width:760px){.cards{grid-template-columns:repeat(2,minmax(0,1fr))}section{padding:1rem}header{padding:1.5rem 1.25rem}.card strong{font-size:1.5rem}}
+@media print{body{background:#fff;font-size:10pt}header{background:#fff;color:#000;padding:0}header p{color:#333}main{padding:0;max-width:none}nav,.toolbar,.skip{display:none!important}section,.card{border-radius:0;break-inside:auto}.finding,.card{break-inside:avoid}.table-wrap{overflow:visible}table{font-size:8pt}th,td{min-width:0;padding:.3rem}.hidden,[hidden]{display:revert!important}h2,h3{break-after:avoid}a{color:#000}}
+`;
+var JS = `
+'use strict';
+document.documentElement.classList.add('js-ready');
+document.getElementById('print-report').addEventListener('click',function(){window.print();});
+var filter=document.getElementById('finding-filter');
+filter.addEventListener('change',function(){
+  var visible=0;
+  document.querySelectorAll('.finding').forEach(function(row){row.hidden=filter.value!=='all'&&row.dataset.priority!==filter.value;if(!row.hidden)visible++;});
+  document.getElementById('finding-count').textContent=visible+' findings shown';
+});
+var search=document.getElementById('app-search');
+search.addEventListener('input',function(){
+  var query=search.value.toLowerCase().trim(),visible=0;
+  document.querySelectorAll('#applications tbody tr').forEach(function(row){row.hidden=!row.textContent.toLowerCase().includes(query);if(!row.hidden)visible++;});
+  document.getElementById('app-count').textContent=visible+' application buckets shown';
+});
+`;
+function renderRuntimeReportHtml(report) {
+  const hash = (text) => createHash("sha256").update(text).digest("base64");
+  const policy = `default-src 'none'; script-src 'sha256-${hash(JS)}'; style-src 'sha256-${hash(CSS)}'; base-uri 'none'; form-action 'none'; connect-src 'none'; img-src 'none'`;
+  const findingCards = report.findings.map(
+    (finding) => `<article class="finding" data-priority="${html(finding.priority)}"><span class="priority">${html(finding.priority)}</span><h3>${html(finding.title)}</h3><p><strong>Evidence:</strong> ${html(finding.evidence)}</p><p><strong>Next step:</strong> ${html(finding.recommendation)}</p><p class="note">Source: ${html(finding.source)}</p></article>`
+  ).join("");
+  const sections = tables(report).map(
+    (table) => `<section id="${table.id}" aria-labelledby="${table.id}-title"><h2 id="${table.id}-title">${table.title}</h2><p class="note">${html(table.note)}</p>${table.id === "applications" ? '<div class="toolbar js-only"><label for="app-search">Find an application</label><input id="app-search" type="search" placeholder="Filter application buckets"><span id="app-count" role="status"></span></div>' : ""}${table.rows.length ? `<div class="table-wrap" role="region" aria-label="${table.title}" tabindex="0"><table><caption>${table.rows.length} collected rows</caption><thead><tr>${table.headers.map((header) => `<th scope="col">${header}</th>`).join("")}</tr></thead><tbody>${table.rows.map((row) => `<tr>${row.map((cell) => `<td>${html(cell)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>` : "<p>No rows available. Consult the source status before interpreting this as an empty result.</p>"}</section>`
+  ).join("");
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${html(policy)}"><meta name="referrer" content="no-referrer"><title>${html(report.title)} \u2014 Prisma AIRS</title><style>${CSS}</style></head>
+<body class="${html(report.health)}"><a class="skip" href="#main">Skip to report</a><header><div class="eyebrow">Prisma AIRS \xB7 AI Runtime Security</div><h1>${html(report.title)}</h1><span class="badge">${HEALTH[report.health]}</span><p>${html(report.window.description)}<br><time>${html(report.window.start)}</time> \u2192 <time>${html(report.window.end)}</time></p><p>Collected ${html(report.collectionStartedAt)} \u2192 ${html(report.generatedAt)}<br>Read-only evidence \xB7 Confidential environment metadata</p></header>
+<main id="main"><nav aria-label="Report sections"><a href="#findings">Attention</a><a href="#applications">Activity</a><a href="#profiles">Profiles</a><a href="#inventory">Inventory</a><a href="#evidence">Evidence</a><a href="#scope">Scope</a></nav>
+<div class="cards">${metrics(report).map(([name, value]) => `<div class="card"><span>${name}</span><strong>${value}</strong></div>`).join("")}</div>
+<section id="findings"><h2>What needs attention</h2><p class="note">Observed violations and configuration review items, not a numerical health score. Collection gaps remain visible in the evidence table.</p><div class="toolbar js-only"><label for="finding-filter">Priority</label><select id="finding-filter"><option value="all">All findings</option><option value="attention">Attention</option><option value="review">Review</option><option value="info">Information</option></select><span id="finding-count" role="status"></span><button id="print-report" type="button">Print / save PDF</button></div>${findingCards || "<p>No findings in the available evidence. This does not establish an absence of risk.</p>"}</section>
+${sections}<section id="scope"><h2>Scope, privacy, and limitations</h2><ul>${report.limitations.map((note) => `<li>${html(note)}</li>`).join("")}</ul></section><footer>Generated by Prisma AIRS CLI \xB7 Report schema 1 \xB7 Self-contained HTML; no network access required. All evidence remains readable with JavaScript disabled.</footer></main><script>${JS}</script></body></html>
+`;
+}
+
+// src/reports/runtime.ts
+var PAGE_SIZE = 100;
+var DAY_MS = 864e5;
+var ReportDataError = class extends Error {
+};
+function safeFailure(error) {
+  if (error instanceof ReportDataError) return error.message;
+  const code = error?.statusCode;
+  if (typeof code === "number" && Number.isInteger(code) && code >= 400 && code <= 599) {
+    if (code === 401 || code === 403)
+      return `HTTP ${code}: check Management API credentials and grants.`;
+    if (code === 429) return "HTTP 429: rate limited; retry the report later.";
+    return `HTTP ${code}: source request failed; verify service availability and API compatibility.`;
+  }
+  return "Source request or response validation failed; check connectivity and SDK compatibility.";
+}
+function label(value) {
+  return (value?.replace(/[\p{Cc}\p{Cf}]/gu, " ").trim() || "Unknown").slice(0, 240);
+}
+function count(value) {
+  return Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+async function collect(source2, maxPages, read, identity) {
+  const records = /* @__PURE__ */ new Map();
+  let offset = 0;
+  try {
+    for (let page = 0; page < maxPages; page++) {
+      const result = await read(offset);
+      source2.pages++;
+      if (!Array.isArray(result.items))
+        throw new ReportDataError(
+          "The API returned no record array. An empty object or absent collection does not establish zero activity."
+        );
+      const before = records.size;
+      for (const item of result.items) records.set(identity(item), item);
+      source2.records = records.size;
+      if (result.note) source2.notes.push(result.note);
+      if (records.size - before !== result.items.length) {
+        source2.notes.push("Overlapping or repeated records detected; duplicates excluded.");
+        source2.status = "partial";
+      }
+      if (result.next === void 0) {
+        if (source2.status !== "partial") source2.status = "complete";
+        return [...records.values()];
+      }
+      if (!Number.isSafeInteger(result.next) || result.next <= offset || records.size === before) {
+        source2.notes.push("Pagination did not advance; collection stopped safely.");
+        source2.status = "partial";
+        return [...records.values()];
+      }
+      offset = result.next;
+    }
+    source2.notes.push(`Reached the ${maxPages}-page budget; this is not a complete inventory.`);
+    source2.status = "partial";
+  } catch (error) {
+    source2.status = source2.pages > 0 && records.size > 0 ? "partial" : "unavailable";
+    source2.notes.push(safeFailure(error));
+  }
+  return [...records.values()];
+}
+function source(name, method, window) {
+  return { name, method, window, status: "unavailable", records: 0, pages: 0, notes: [] };
+}
+function inventoryNext(next, size, offset) {
+  return next === 0 ? void 0 : next ?? (size === PAGE_SIZE ? offset + size : void 0);
+}
+function total(values) {
+  if (values.some((value) => value === null)) return null;
+  const result = values.reduce((sum, value) => sum + (value ?? 0), 0);
+  return count(result);
+}
+function distribution(rows, key) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const name = label(row[key]).toLowerCase();
+    groups.set(name, (groups.get(name) ?? 0) + 1);
+  }
+  return [...groups].map(([name, n]) => ({ name, count: n })).sort((a, b) => b.count - a.count);
+}
+async function collectRuntimeDailyReport(client, options = {}) {
+  const maxPages = options.maxPages ?? 10;
+  if (!Number.isSafeInteger(maxPages) || maxPages < 1 || maxPages > 100) {
+    throw new Error("maxPages must be an integer from 1 to 100");
+  }
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const started = now();
+  const end = started.toISOString();
+  const start = new Date(started.getTime() - DAY_MS).toISOString();
+  const activitySource = source(
+    "Daily application activity",
+    "dashboard.applicationsOverview",
+    "Rolling 1 day"
+  );
+  const profileSource = source(
+    "Security profiles",
+    "profiles.list (latest=true)",
+    "Current configuration"
+  );
+  const appSource = source("Registered applications", "customerApps.list", "Current configuration");
+  const logSource = source(
+    "Scan log detail",
+    "scanLogs.query (read-only POST)",
+    "Rolling 24 hours"
+  );
+  let pageToken;
+  const seenTokens = /* @__PURE__ */ new Set();
+  const [applications, profileRows, registered, rawLogs] = await Promise.all([
+    collect(
+      activitySource,
+      maxPages,
+      async (offset) => {
+        const page = await client.dashboard.applicationsOverview({
+          timeInterval: 1,
+          timeUnit: "day",
+          limit: PAGE_SIZE,
+          offset
+        });
+        const size = page.items?.length ?? 0;
+        const totalItems = count(page.pagination?.total_items);
+        if (totalItems !== null && totalItems > offset + size && size === 0) {
+          throw new ReportDataError("The API returned an empty page before its advertised total.");
+        }
+        return {
+          items: page.items,
+          next: totalItems !== null ? offset + size < totalItems ? offset + size : void 0 : size === PAGE_SIZE ? offset + size : void 0
+        };
+      },
+      (item) => JSON.stringify([item.id, item.name])
+    ),
+    collect(
+      profileSource,
+      maxPages,
+      async (offset) => {
+        const page = await client.profiles.list({ latest: true, limit: PAGE_SIZE, offset });
+        return {
+          items: page.ai_profiles,
+          next: inventoryNext(page.next_offset, page.ai_profiles.length, offset)
+        };
+      },
+      (item) => JSON.stringify([item.profile_name, item.revision])
+    ),
+    collect(
+      appSource,
+      maxPages,
+      async (offset) => {
+        const page = await client.customerApps.list({ limit: PAGE_SIZE, offset });
+        return {
+          items: page.customer_apps,
+          next: inventoryNext(page.next_offset, page.customer_apps?.length ?? 0, offset)
+        };
+      },
+      (item) => item.customer_appId
+    ),
+    collect(
+      logSource,
+      maxPages,
+      async (offset) => {
+        const pageNumber = offset + 1;
+        const page = await client.scanLogs.query({
+          time_interval: 24,
+          time_unit: "hours",
+          pageNumber,
+          pageSize: PAGE_SIZE,
+          filter: "all",
+          page_token: pageToken
+        });
+        const items = page.scan_result_for_dashboard?.scan_result_entries;
+        if (page.page_number !== void 0 && page.page_number !== pageNumber) {
+          throw new ReportDataError(
+            "The scan-log response page number did not match the requested page."
+          );
+        }
+        const totalPages = count(page.total_pages);
+        let next;
+        if (totalPages !== null) next = pageNumber < totalPages ? offset + 1 : void 0;
+        else if (page.page_token || items?.length === PAGE_SIZE) next = offset + 1;
+        if (next !== void 0 && page.page_token) {
+          if (seenTokens.has(page.page_token))
+            throw new ReportDataError(
+              "The scan-log continuation token repeated; collection stopped safely."
+            );
+          seenTokens.add(page.page_token);
+          pageToken = page.page_token;
+        }
+        return { items, next };
+      },
+      (item) => JSON.stringify([item.scan_id, item.scan_sub_req_id])
+    )
+  ]);
+  const findings = [];
+  const add = (priority, title, evidence, recommendation, evidenceSource) => {
+    findings.push({ priority, title, evidence, recommendation, source: evidenceSource });
+  };
+  for (const s of [activitySource, profileSource, appSource, logSource]) {
+    if (s.status !== "complete")
+      add(
+        "review",
+        `${s.name}: ${s.status}`,
+        s.notes.join(" "),
+        "Restore access or retry collection; do not treat missing data as zero. Increase --max-pages if the page budget was reached.",
+        s.name
+      );
+  }
+  const appIds = new Set(registered.map((app) => app.customer_appId));
+  const reportApps = applications.map((app) => ({
+    name: label(app.name),
+    sessions: count(app.sessions_total),
+    violatingSessions: count(app.sessions_violated),
+    registered: app.id && appIds.has(app.id) ? true : appSource.status === "complete" && app.id ? false : null
+  })).sort(
+    (a, b) => (b.violatingSessions ?? -1) - (a.violatingSessions ?? -1) || a.name.localeCompare(b.name)
+  );
+  const sessions = activitySource.status === "unavailable" ? null : total(reportApps.map((app) => app.sessions));
+  const violatingSessions = activitySource.status === "unavailable" ? null : total(reportApps.map((app) => app.violatingSessions));
+  const inconsistent = reportApps.some(
+    (app) => app.sessions !== null && app.violatingSessions !== null && app.violatingSessions > app.sessions
+  );
+  if (inconsistent || reportApps.some((app) => app.sessions === null || app.violatingSessions === null)) {
+    add(
+      "review",
+      "Activity counters need verification",
+      "Some application counters are absent, invalid, or report more violating sessions than total sessions.",
+      "Compare these buckets with the SCM dashboard. A violation rate is withheld when counters are inconsistent.",
+      activitySource.name
+    );
+  }
+  if ((violatingSessions ?? 0) > 0)
+    add(
+      "attention",
+      "Violating sessions observed",
+      `${violatingSessions} violating sessions across ${reportApps.filter((app) => (app.violatingSessions ?? 0) > 0).length} application buckets in the collected daily data.`,
+      "Review the highest-volume applications in SCM, confirm intended enforcement, and investigate unexpected activity. Violations are not proof of a successful attack.",
+      activitySource.name
+    );
+  if (sessions === 0 && activitySource.status === "complete")
+    add(
+      "review",
+      "No sessions reported in the daily window",
+      "The complete application overview reports zero sessions.",
+      "If traffic was expected, check the integration, application metadata, and telemetry ingestion. No activity is not proof of health.",
+      activitySource.name
+    );
+  const latestProfiles = /* @__PURE__ */ new Map();
+  for (const profile of profileRows) {
+    const old = latestProfiles.get(profile.profile_name);
+    if (!old || (profile.revision ?? -1) > (old.revision ?? -1))
+      latestProfiles.set(profile.profile_name, profile);
+  }
+  const profiles = [...latestProfiles.values()].map((profile) => {
+    const configs = (profile.policy?.["ai-security-profiles"] ?? []).flatMap(
+      (p) => p["model-configuration"] ? [p["model-configuration"]] : []
+    );
+    const timeoutActions = [
+      ...new Set(configs.map((c) => label(c.latency?.["inline-timeout-action"])))
+    ];
+    const name = label(profile.profile_name);
+    if (profile.active === false)
+      add(
+        "review",
+        `Inactive profile: ${name}`,
+        "The latest returned revision is explicitly inactive.",
+        "Confirm this is intentional before assigning the profile to an integration.",
+        profileSource.name
+      );
+    if (profile.active === true && timeoutActions.some((action) => action.toLowerCase() === "allow"))
+      add(
+        "review",
+        `Timeout allows traffic: ${name}`,
+        "An active profile explicitly sets inline-timeout-action to allow.",
+        "Review the availability-versus-enforcement tradeoff with the application owner; this is not evidence of a timeout or bypass.",
+        profileSource.name
+      );
+    const masking = configs.map((c) => c["mask-data-in-storage"]);
+    const storageMasking = masking.includes(false) ? "Off in at least one configuration" : masking.length > 0 && masking.every((v) => v === true) ? "On in all returned configurations" : "Unknown";
+    if (profile.active === true && masking.includes(false))
+      add(
+        "review",
+        `Storage masking disabled: ${name}`,
+        "An active profile explicitly disables mask-data-in-storage in a model configuration.",
+        "Confirm retention and privacy requirements. This flag alone does not establish that sensitive data was stored.",
+        profileSource.name
+      );
+    return {
+      name,
+      revision: count(profile.revision),
+      active: profile.active ?? null,
+      modified: profile.last_modified_ts && Number.isFinite(Date.parse(profile.last_modified_ts)) ? new Date(profile.last_modified_ts).toISOString() : null,
+      timeoutActions,
+      storageMasking
+    };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+  if (profiles.length === 0 && profileSource.status === "complete")
+    add(
+      "attention",
+      "No security profiles returned",
+      "The current profile inventory is empty.",
+      "Verify tenant scope and configure a security profile before routing application scans.",
+      profileSource.name
+    );
+  let missingTimestamps = 0;
+  let outsideWindow = 0;
+  const logs = rawLogs.filter((row) => {
+    const timestamp = Date.parse(row.received_ts ?? "");
+    if (!Number.isFinite(timestamp)) {
+      missingTimestamps++;
+      return false;
+    }
+    if (timestamp < Date.parse(start) || timestamp >= Date.parse(end)) {
+      outsideWindow++;
+      return false;
+    }
+    return true;
+  });
+  if (missingTimestamps || outsideWindow)
+    add(
+      "review",
+      "Some log records excluded from daily analysis",
+      `${missingTimestamps} records lack a valid received timestamp; ${outsideWindow} fall outside the anchored UTC window.`,
+      "Verify ingestion timestamps and collection-window drift before using log counts as daily totals.",
+      logSource.name
+    );
+  const failedLogs = logs.filter(
+    (row) => ["failed", "error", "timeout"].includes(row.status?.trim().toLowerCase() ?? "")
+  ).length;
+  if (failedLogs)
+    add(
+      "attention",
+      "Scan processing failures observed",
+      `${failedLogs} timestamp-eligible collected log entries explicitly report failed, error, or timeout status.`,
+      "Review these failures in SCM, check integration error handling, and verify whether the affected application fails open or closed. This is not a tenant-wide failure rate.",
+      logSource.name
+    );
+  const priorities = { attention: 0, review: 1, info: 2 };
+  findings.sort((left, right) => priorities[left.priority] - priorities[right.priority]);
+  return {
+    schemaVersion: 1,
+    product: "Prisma AIRS AI Runtime Security",
+    title: label(options.title ?? "Daily environment report"),
+    generatedAt: now().toISOString(),
+    collectionStartedAt: end,
+    window: {
+      start,
+      end,
+      description: "Rolling last 24 hours, UTC (approximate for server-relative application queries)"
+    },
+    health: [activitySource, profileSource, appSource, logSource].every(
+      (s) => s.status === "unavailable"
+    ) ? "unknown" : findings.some((f) => f.priority === "attention") ? "attention" : findings.some((f) => f.priority === "review") ? "review" : "no-findings",
+    sources: [activitySource, profileSource, appSource, logSource],
+    findings,
+    activity: {
+      sessions,
+      violatingSessions,
+      violationRate: !inconsistent && sessions !== null && sessions > 0 && violatingSessions !== null ? violatingSessions / sessions * 100 : null,
+      applications: reportApps
+    },
+    profiles,
+    registeredApps: registered.map((app) => ({
+      name: label(app.app_name),
+      environment: label(app.environment),
+      cloud: label(app.cloud_provider),
+      model: label(app.model_name),
+      keyAssociations: app.api_keys_dp_info ? app.api_keys_dp_info.length : null
+    })).sort((a, b) => a.name.localeCompare(b.name)),
+    logs: {
+      entries: logs.length,
+      actions: distribution(logs, "action"),
+      verdicts: distribution(logs, "verdict"),
+      tokens: logSource.status === "unavailable" ? null : total(logs.map((row) => count(row.tokens))),
+      missingTimestamps,
+      outsideWindow
+    },
+    limitations: [
+      "This is a read-only operational review, not an uptime SLA, compliance attestation, or proof that attacks succeeded or were blocked. No health score is invented.",
+      "Application activity uses the API\u2019s rolling one-day window; each paginated request evaluates its own server-relative window. Collection is not a transactionally consistent historical snapshot. Ingestion may lag.",
+      "Sessions, scan-log entries, text records, and API calls are different units. They are not added together. Log counters describe only collected, timestamp-eligible entries; absent data is unknown.",
+      "Application buckets are keyed by registered application ID plus the literal scan metadata.app_name, which can differ from registered names. Do not sum session counts as unique users or unique tenant-wide sessions.",
+      "Current configuration is not a configuration-change audit. Missing policy settings are unknown, not disabled. Inactive profiles can be intentional; current profile state may differ from the revision used by a historical scan.",
+      "Per-app token summaries and detector/severity breakdowns require 7/30/60-day windows, so they are not presented as daily metrics. No previous-day comparison or trend is inferred.",
+      "Prompts, responses, user identities/IPs, API keys, auth codes, tenant IDs, and raw errors are omitted. Application/profile names and configuration metadata remain confidential; review before sharing."
+    ]
+  };
+}
+
 export {
   SdkManagementService,
   getOrCreateManagementClient,
@@ -2505,5 +3136,9 @@ export {
   validateExamples,
   validateTopic,
   computeMetrics,
-  computeCategoryBreakdown
+  computeCategoryBreakdown,
+  writeReportFile,
+  renderRuntimeReportMarkdown,
+  renderRuntimeReportHtml,
+  collectRuntimeDailyReport
 };

package/dist/cli/index.js

@@ -9,18 +9,22 @@ import {
   SdkPromptSetService,
   SdkRedTeamService,
   SdkRuntimeService,
+  collectRuntimeDailyReport,
   computeMetrics,
   getOrCreateManagementClient,
   inspectConfig,
   loadConfig,
   readBackupDir,
   readBackupFile,
+  renderRuntimeReportHtml,
+  renderRuntimeReportMarkdown,
   resolveConfigFilePath,
   resolveOutputDir,
   sanitizeFilename,
   validateTopic,
-  writeBackupFile
-} from "../chunk-LF6JPUA4.js";
+  writeBackupFile,
+  writeReportFile
+} from "../chunk-NWK7RG2N.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -39,8 +43,8 @@ function installProcessGuards() {
 }
 
 // src/cli/program.ts
+import { randomUUID as randomUUID6 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
-import { homedir } from "os";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
@@ -3085,8 +3089,8 @@ function registerAiGatewayInference(parent) {
         process.once("SIGINT", interrupt);
         process.once("SIGTERM", interrupt);
         process.stdout.on("error", outputError);
-        const write = (text) => new Promise((resolve2, reject) => {
-          process.stdout.write(text, (error) => error ? reject(error) : resolve2());
+        const write = (text) => new Promise((resolve3, reject) => {
+          process.stdout.write(text, (error) => error ? reject(error) : resolve3());
         });
         const requestOptions = { signal: controller.signal };
         const result = kind === "chat" ? await client.createChatCompletion(
@@ -3197,7 +3201,7 @@ function isAirsUrl(url) {
   }
 }
 var MASK = "***";
-var SENSITIVE_KEY_PATTERN = /token|secret|password|passwd|credential|authorization|cookie|api[-_]?key|client[-_]?auth|^key$/i;
+var SENSITIVE_KEY_PATTERN = /token|secret|password|passwd|credential|authorization|cookie|api[-_]?key|client[-_]?auth|auth[-_]?code|^key$/i;
 function isSensitiveKey(key) {
   return SENSITIVE_KEY_PATTERN.test(key);
 }
@@ -3236,28 +3240,6 @@ function redactUrl(url) {
     return url;
   }
 }
-function pruneDebugLogs(dir, keep) {
-  let files;
-  try {
-    files = readdirSync(dir).filter((f) => f.startsWith("debug-api-") && f.endsWith(".jsonl"));
-  } catch {
-    return;
-  }
-  const byAge = files.map((f) => {
-    const path3 = join(dir, f);
-    try {
-      return { path: path3, mtime: statSync(path3).mtimeMs };
-    } catch {
-      return null;
-    }
-  }).filter((e) => e !== null).sort((a, b) => b.mtime - a.mtime);
-  for (const { path: path3 } of byAge.slice(keep)) {
-    try {
-      unlinkSync(path3);
-    } catch {
-    }
-  }
-}
 function headersToRecord(headers) {
   if (!headers) return {};
   if (typeof headers === "object" && "forEach" in headers && typeof headers.forEach === "function") {
@@ -3272,11 +3254,9 @@ function headersToRecord(headers) {
   }
   return headers;
 }
-var KEEP_DEBUG_LOGS = 10;
 function installDebugLogger(logPath) {
   mkdirSync(dirname(logPath), { recursive: true, mode: 448 });
-  writeFileSync(logPath, "", { encoding: "utf8", mode: 384 });
-  pruneDebugLogs(dirname(logPath), KEEP_DEBUG_LOGS);
+  writeFileSync(logPath, "", { encoding: "utf8", mode: 384, flag: "wx" });
   const originalFetch = globalThis.fetch;
   globalThis.fetch = async function debugFetch(input, init2) {
     const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
@@ -3298,7 +3278,8 @@ function installDebugLogger(logPath) {
       try {
         reqBody = redactDeep(JSON.parse(String(init2.body)));
       } catch {
-        reqBody = String(init2.body);
+        const contentType = new Headers(rawHeaders).get("content-type") ?? "";
+        reqBody = contentType.includes("application/x-www-form-urlencoded") ? redactDeep(Object.fromEntries(new URLSearchParams(String(init2.body)))) : "[NON-JSON BODY OMITTED]";
       }
     }
     const ts2 = (/* @__PURE__ */ new Date()).toISOString();
@@ -3309,7 +3290,7 @@ function installDebugLogger(logPath) {
     try {
       response = await originalFetch(input, init2);
     } catch (err) {
-      error = inference ? "Runtime request failed" : err instanceof Error ? err.message : String(err);
+      error = inference ? "Runtime request failed" : "Request failed";
       const entry2 = JSON.stringify({
         timestamp: ts2,
         durationMs: Date.now() - startMs,
@@ -3334,7 +3315,7 @@ function installDebugLogger(logPath) {
         try {
           resBody = redactDeep(JSON.parse(text));
         } catch {
-          resBody = text;
+          resBody = "[NON-JSON BODY OMITTED]";
         }
       } catch {
         resBody = "<unreadable>";
@@ -5350,8 +5331,8 @@ async function withTimeout(promise, ms) {
   try {
     return await Promise.race([
       promise,
-      new Promise((resolve2) => {
-        timer = setTimeout(() => resolve2(TIMED_OUT), ms);
+      new Promise((resolve3) => {
+        timer = setTimeout(() => resolve3(TIMED_OUT), ms);
       })
     ]);
   } finally {
@@ -5621,12 +5602,12 @@ function hasBin(bin) {
   }
 }
 function run(bin, args, label) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const child = spawn(bin, args, { stdio: "inherit" });
     child.on("error", (err) => reject(new Error(`Failed to start ${bin}: ${err.message}`)));
     child.on("close", (code) => {
       if (code !== 0) reject(new Error(`${label} failed with exit code ${code}`));
-      else resolve2();
+      else resolve3();
     });
   });
 }
@@ -7439,7 +7420,7 @@ function registerRedteamCommand(program) {
 }
 
 // src/cli/commands/runtime.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import * as fs5 from "fs";
 import { readFile as readFile10 } from "fs/promises";
 import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
@@ -8994,6 +8975,76 @@ function registerCleanupCommand(parent) {
   });
 }
 
+// src/cli/commands/runtime-report.ts
+import { lstat } from "fs/promises";
+import { resolve as resolve2 } from "path";
+import { randomUUID as randomUUID4 } from "crypto";
+function registerRuntimeReportCommand(runtime) {
+  const command = runtime.command("report").description("Generate a daily AI Runtime Security environment dashboard (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
+    "--output-file <path>",
+    "Destination (default: new timestamped file in CWD); - for stdout; never overwrite"
+  ).option("--title <text>", "Report title", "Daily environment report").option("--max-pages <n>", "Page budget per source, 1\u2013100 (100 records/page)", "10").option("--strict", "Exit 1 after writing if any source is incomplete").addHelpText(
+    "after",
+    examples(
+      "airs runtime report --output-file ./airs-daily.html",
+      "airs runtime report --output markdown --output-file ./airs-daily.md",
+      "airs runtime report",
+      "airs runtime report --strict --max-pages 20 --output-file - > daily.html"
+    )
+  ).action(async (opts) => {
+    const format = opts.output ?? command.parent?.parent?.opts().output ?? "html";
+    if (format !== "html" && format !== "markdown")
+      usageError("Report output must be html or markdown");
+    const maxPages = Number(opts.maxPages);
+    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages) || maxPages > 100)
+      usageError("--max-pages must be an integer from 1 to 100");
+    if (typeof opts.title !== "string" || !opts.title.trim() || opts.title.length > 240)
+      usageError("--title must contain 1\u2013240 characters");
+    if (opts.outputFile !== void 0 && !opts.outputFile.trim())
+      usageError("--output-file cannot be empty");
+    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID4().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve2(opts.outputFile ?? defaultName);
+    try {
+      if (outputPath) {
+        const existing = await lstat(outputPath).catch((error) => {
+          if (error.code !== "ENOENT") throw error;
+          return void 0;
+        });
+        if (existing) throw new Error("Output already exists");
+      }
+      const config = await loadConfig();
+      const client = getOrCreateManagementClient({
+        clientId: config.mgmtClientId,
+        clientSecret: config.mgmtClientSecret,
+        tsgId: config.mgmtTsgId,
+        apiEndpoint: config.mgmtEndpoint,
+        tokenEndpoint: config.mgmtTokenEndpoint,
+        numRetries: 0
+      });
+      ui.status("Collecting daily runtime activity and current configuration (read-only)...");
+      const report = await collectRuntimeDailyReport(client, { title: opts.title, maxPages });
+      const rendered = format === "html" ? renderRuntimeReportHtml(report) : renderRuntimeReportMarkdown(report);
+      if (outputPath) {
+        await writeReportFile(outputPath, rendered);
+        ui.status(`Report \u2192 ${outputPath.replace(/[\p{Cc}\p{Cf}]/gu, "_")} (mode 0600)`);
+      } else {
+        await new Promise(
+          (done, reject) => process.stdout.write(rendered, (error) => error ? reject(error) : done())
+        );
+      }
+      const incomplete = report.sources.filter((source) => source.status !== "complete").length;
+      if (incomplete)
+        ui.status(`${incomplete} source(s) incomplete; review the evidence section.`);
+      if (report.health === "unknown" || opts.strict && incomplete > 0) process.exitCode = 1;
+    } catch {
+      ui.error(
+        "Report generation failed. Verify Management API configuration and a writable, new output path. Existing files are never overwritten."
+      );
+      process.exitCode = 1;
+    }
+  });
+}
+
 // src/cli/commands/topics-apply.ts
 async function applyTopicToProfile(mgmt, input) {
   const allTopics = await mgmt.listTopics();
@@ -9446,7 +9497,7 @@ function completedBulkResults(state) {
 }
 async function writeBulkResults(outputPath, results) {
   await fs5.promises.mkdir(dirname3(outputPath), { recursive: true });
-  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID4()}`;
+  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID5()}`;
   try {
     await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
       encoding: "utf-8",
@@ -9481,6 +9532,7 @@ async function createMgmtService() {
 }
 function registerRuntimeCommand(program) {
   const runtime = program.command("runtime").description("Runtime prompt scanning against AIRS profiles");
+  registerRuntimeReportCommand(runtime);
   const apiKeys = runtime.command("api-keys").description("Manage AIRS API keys");
   const apiKeysList = registerListFlags(apiKeys.command("list"), { dialect: "offset" }).description("List API keys").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
@@ -10306,7 +10358,12 @@ function buildProgram() {
   program.hook("preAction", async (_thisCommand, actionCommand) => {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
-    if (READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
+    const isRuntimeReport = actionCommand.name() === "report" && actionCommand.parent?.name() === "runtime";
+    if (isRuntimeReport && (root.debug || /^(1|true|yes|on)$/i.test(process.env.PANW_AI_SEC_DEBUG?.trim() ?? "")))
+      usageError(
+        "Disable --debug and PANW_AI_SEC_DEBUG for environment reports to avoid persisting scan-log content"
+      );
+    if (!isRuntimeReport && READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
       try {
         const format = await resolveOutput(actionCommand, actionCommand.opts());
         actionCommand.setOptionValueWithSource("output", format, "implied");
@@ -10315,8 +10372,18 @@ function buildProgram() {
       }
     }
     if (root.debug) {
-      const logPath = join4(homedir(), ".prisma-airs", `debug-api-${Date.now()}.jsonl`);
-      installDebugLogger(logPath);
+      const logPath = join4(
+        process.cwd(),
+        `debug-api-${Date.now()}-${randomUUID6().slice(0, 8)}.jsonl`
+      );
+      try {
+        installDebugLogger(logPath);
+      } catch {
+        ui.error(
+          "Cannot create the debug log in the current working directory. Run from a writable directory or omit --debug."
+        );
+        process.exit(1);
+      }
       ui.status(`Debug: API log \u2192 ${logPath}`);
     }
   });

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { CreateCustomTopicRequest, CustomTopic as CustomTopic$1, CreateSecurityProfileRequest, ManagementClientOptions, ModelSecurityClientOptions, RedTeamClientOptions, InitOptions } from '@cdot65/prisma-airs-sdk';
+import { CreateCustomTopicRequest, CustomTopic as CustomTopic$1, CreateSecurityProfileRequest, ManagementClientOptions, ModelSecurityClientOptions, RedTeamClientOptions, InitOptions, ManagementClient } from '@cdot65/prisma-airs-sdk';
 import { z } from 'zod';
 
 /**
@@ -1842,4 +1842,113 @@ declare function computeMetrics(results: TestResult[]): EfficacyMetrics;
 /** Compute per-category error breakdown from test results. Sorted by error rate descending. */
 declare function computeCategoryBreakdown(results: TestResult[]): CategoryBreakdown[];
 
-export { AirsScanService, type AnalysisReport, type ApiKeyInfo, type ApiKeyListResult, type BackupEnvelope, type BackupFormat, type BackupResult, type BatchEntry, type BulkScanAction, type BulkScanResult, type CategoryBreakdown, type ConsumptionAppListEntry, type ConsumptionQueryOptions, type ConsumptionTimeInterval, type CustomTopic, type CustomerAppConsumption, type CustomerAppInfo, type CustomerAppListResult, type DeleteResponse, type DeploymentProfileInfo, type EfficacyMetrics, type EulaContent, type EulaStatus, type IndexedPrompt, type InstanceDetail, type InstanceRequest, type InstanceResponse, type IterationResult, type ManagementService, type ModelSecurityEvaluation, type ModelSecurityFile, type ModelSecurityFileListOptions, type ModelSecurityGroup, type ModelSecurityGroupCreateRequest, type ModelSecurityGroupListOptions, type ModelSecurityGroupUpdateRequest, type ModelSecurityLabel, type ModelSecurityModel, type ModelSecurityModelListOptions, type ModelSecurityModelVersion, type ModelSecurityModelVersionListOptions, type ModelSecurityPyPIAuth, type ModelSecurityRule, type ModelSecurityRuleEditableField, type ModelSecurityRuleInstance, type ModelSecurityRuleInstanceListOptions, type ModelSecurityRuleInstanceUpdateRequest, type ModelSecurityRuleListOptions, type ModelSecurityScan, type ModelSecurityScanListOptions, type ModelSecurityService, type ModelSecurityViolation, type MutationResponse, type PaginationOptions, type PollRetryOptions, type ProfileTopic, type PromptDetail, type PromptSetDetail, type PromptSetService, type PromptSetVersionInfo, type PropertyValueList, type RedTeamAdapterCreateRequest, type RedTeamAdapterDetail, type RedTeamAdapterListItem, type RedTeamAdapterListOptions, type RedTeamAdapterUpdateOverrides, type RedTeamAdapterValidateRequest, type RedTeamAdapterValidationResult, type RedTeamAdapterVar, type RedTeamAttack, type RedTeamCategory, type RedTeamChannel, type RedTeamChannelCreateRequest, type RedTeamChannelListOptions, type RedTeamChannelStats, type RedTeamChannelUpdateRequest, type RedTeamCustomAttack, type RedTeamCustomReport, type RedTeamDynamicReport, type RedTeamErrorLog, type RedTeamJob, type RedTeamLanguages, type RedTeamService, type RedTeamStaticReport, type RedTeamTarget, type RedTeamTargetCreateRequest, type RedTeamTargetDetail, type RedTeamTargetUpdateRequest, type RegistryCredentials, type ReliableRuntimeService, type ResourceType, type RestoreResult, type RunState, type RuntimeScanResult, type RuntimeService, SDK_ASYNC_BATCH_SIZE, type ScanLogQueryOptions, type ScanLogQueryResult, type ScanResult, type ScanService, SdkManagementService, SdkModelSecurityService, SdkPromptSetService, SdkRedTeamService, SdkRuntimeService, type SecurityProfileInfo, type SecurityProfileListResult, type SubmittedBatch, type TargetAuthValidationRequest, type TargetAuthValidationResult, type TargetOperationOptions, type TestCase, type TestResult, type UserInput, type ValidationError, computeCategoryBreakdown, computeMetrics, loadConfig, readBackupDir, readBackupFile, resolveOutputDir, sanitizeFilename, validateDescription, validateExamples, validateName, validateTopic, writeBackupFile };
+/** Atomically publish a private report without overwriting a file or following a symlink. */
+declare function writeReportFile(path: string, content: string): Promise<void>;
+
+/** Read-only SDK surface needed by the first product report. */
+interface RuntimeReportClient {
+    dashboard: Pick<ManagementClient['dashboard'], 'applicationsOverview'>;
+    profiles: Pick<ManagementClient['profiles'], 'list'>;
+    customerApps: Pick<ManagementClient['customerApps'], 'list'>;
+    scanLogs: Pick<ManagementClient['scanLogs'], 'query'>;
+}
+type ReportSourceStatus = 'complete' | 'partial' | 'unavailable';
+type ReportPriority = 'attention' | 'review' | 'info';
+type ReportFormat = 'html' | 'markdown';
+interface ReportSource {
+    name: string;
+    method: string;
+    window: string;
+    status: ReportSourceStatus;
+    records: number;
+    pages: number;
+    notes: string[];
+}
+interface ReportFinding {
+    priority: ReportPriority;
+    title: string;
+    evidence: string;
+    recommendation: string;
+    source: string;
+}
+interface ReportApplication {
+    name: string;
+    sessions: number | null;
+    violatingSessions: number | null;
+    registered: boolean | null;
+}
+interface ReportProfile {
+    name: string;
+    revision: number | null;
+    active: boolean | null;
+    modified: string | null;
+    timeoutActions: string[];
+    storageMasking: string;
+}
+interface ReportRegisteredApp {
+    name: string;
+    environment: string;
+    cloud: string;
+    model: string;
+    keyAssociations: number | null;
+}
+interface ReportLogSummary {
+    entries: number;
+    actions: Array<{
+        name: string;
+        count: number;
+    }>;
+    verdicts: Array<{
+        name: string;
+        count: number;
+    }>;
+    tokens: number | null;
+    missingTimestamps: number;
+    outsideWindow: number;
+}
+/** Allowlisted, credential-free projection; never contains raw responses or scan content. */
+interface RuntimeDailyReport {
+    schemaVersion: 1;
+    product: 'Prisma AIRS AI Runtime Security';
+    title: string;
+    generatedAt: string;
+    collectionStartedAt: string;
+    window: {
+        start: string;
+        end: string;
+        description: string;
+    };
+    health: 'attention' | 'review' | 'no-findings' | 'unknown';
+    sources: ReportSource[];
+    findings: ReportFinding[];
+    activity: {
+        sessions: number | null;
+        violatingSessions: number | null;
+        violationRate: number | null;
+        applications: ReportApplication[];
+    };
+    profiles: ReportProfile[];
+    registeredApps: ReportRegisteredApp[];
+    logs: ReportLogSummary;
+    limitations: string[];
+}
+interface RuntimeReportOptions {
+    title?: string;
+    /** Per-source page budget (1–100); partial results are explicitly marked. Default 10. */
+    maxPages?: number;
+    /** Inject a clock for deterministic tests. */
+    now?: () => Date;
+}
+
+/** Render the same evidence model as a portable, inert Markdown deliverable. */
+declare function renderRuntimeReportMarkdown(report: RuntimeDailyReport): string;
+/** Standalone HTML: inline CSS/JS, no dependencies, external requests, or embedded raw data. */
+declare function renderRuntimeReportHtml(report: RuntimeDailyReport): string;
+
+/**
+ * Build a daily environment report through SDK reads only. No scan submissions or mutations.
+ * Application sessions, log entries and current inventory remain separate units of evidence.
+ */
+declare function collectRuntimeDailyReport(client: RuntimeReportClient, options?: RuntimeReportOptions): Promise<RuntimeDailyReport>;
+
+export { AirsScanService, type AnalysisReport, type ApiKeyInfo, type ApiKeyListResult, type BackupEnvelope, type BackupFormat, type BackupResult, type BatchEntry, type BulkScanAction, type BulkScanResult, type CategoryBreakdown, type ConsumptionAppListEntry, type ConsumptionQueryOptions, type ConsumptionTimeInterval, type CustomTopic, type CustomerAppConsumption, type CustomerAppInfo, type CustomerAppListResult, type DeleteResponse, type DeploymentProfileInfo, type EfficacyMetrics, type EulaContent, type EulaStatus, type IndexedPrompt, type InstanceDetail, type InstanceRequest, type InstanceResponse, type IterationResult, type ManagementService, type ModelSecurityEvaluation, type ModelSecurityFile, type ModelSecurityFileListOptions, type ModelSecurityGroup, type ModelSecurityGroupCreateRequest, type ModelSecurityGroupListOptions, type ModelSecurityGroupUpdateRequest, type ModelSecurityLabel, type ModelSecurityModel, type ModelSecurityModelListOptions, type ModelSecurityModelVersion, type ModelSecurityModelVersionListOptions, type ModelSecurityPyPIAuth, type ModelSecurityRule, type ModelSecurityRuleEditableField, type ModelSecurityRuleInstance, type ModelSecurityRuleInstanceListOptions, type ModelSecurityRuleInstanceUpdateRequest, type ModelSecurityRuleListOptions, type ModelSecurityScan, type ModelSecurityScanListOptions, type ModelSecurityService, type ModelSecurityViolation, type MutationResponse, type PaginationOptions, type PollRetryOptions, type ProfileTopic, type PromptDetail, type PromptSetDetail, type PromptSetService, type PromptSetVersionInfo, type PropertyValueList, type RedTeamAdapterCreateRequest, type RedTeamAdapterDetail, type RedTeamAdapterListItem, type RedTeamAdapterListOptions, type RedTeamAdapterUpdateOverrides, type RedTeamAdapterValidateRequest, type RedTeamAdapterValidationResult, type RedTeamAdapterVar, type RedTeamAttack, type RedTeamCategory, type RedTeamChannel, type RedTeamChannelCreateRequest, type RedTeamChannelListOptions, type RedTeamChannelStats, type RedTeamChannelUpdateRequest, type RedTeamCustomAttack, type RedTeamCustomReport, type RedTeamDynamicReport, type RedTeamErrorLog, type RedTeamJob, type RedTeamLanguages, type RedTeamService, type RedTeamStaticReport, type RedTeamTarget, type RedTeamTargetCreateRequest, type RedTeamTargetDetail, type RedTeamTargetUpdateRequest, type RegistryCredentials, type ReliableRuntimeService, type ReportApplication, type ReportFinding, type ReportFormat, type ReportLogSummary, type ReportPriority, type ReportProfile, type ReportRegisteredApp, type ReportSource, type ReportSourceStatus, type ResourceType, type RestoreResult, type RunState, type RuntimeDailyReport, type RuntimeReportClient, type RuntimeReportOptions, type RuntimeScanResult, type RuntimeService, SDK_ASYNC_BATCH_SIZE, type ScanLogQueryOptions, type ScanLogQueryResult, type ScanResult, type ScanService, SdkManagementService, SdkModelSecurityService, SdkPromptSetService, SdkRedTeamService, SdkRuntimeService, type SecurityProfileInfo, type SecurityProfileListResult, type SubmittedBatch, type TargetAuthValidationRequest, type TargetAuthValidationResult, type TargetOperationOptions, type TestCase, type TestResult, type UserInput, type ValidationError, collectRuntimeDailyReport, computeCategoryBreakdown, computeMetrics, loadConfig, readBackupDir, readBackupFile, renderRuntimeReportHtml, renderRuntimeReportMarkdown, resolveOutputDir, sanitizeFilename, validateDescription, validateExamples, validateName, validateTopic, writeBackupFile, writeReportFile };

package/dist/index.js

@@ -6,19 +6,23 @@ import {
   SdkPromptSetService,
   SdkRedTeamService,
   SdkRuntimeService,
+  collectRuntimeDailyReport,
   computeCategoryBreakdown,
   computeMetrics,
   loadConfig,
   readBackupDir,
   readBackupFile,
+  renderRuntimeReportHtml,
+  renderRuntimeReportMarkdown,
   resolveOutputDir,
   sanitizeFilename,
   validateDescription,
   validateExamples,
   validateName,
   validateTopic,
-  writeBackupFile
-} from "./chunk-LF6JPUA4.js";
+  writeBackupFile,
+  writeReportFile
+} from "./chunk-NWK7RG2N.js";
 export {
   AirsScanService,
   SDK_ASYNC_BATCH_SIZE,
@@ -27,16 +31,20 @@ export {
   SdkPromptSetService,
   SdkRedTeamService,
   SdkRuntimeService,
+  collectRuntimeDailyReport,
   computeCategoryBreakdown,
   computeMetrics,
   loadConfig,
   readBackupDir,
   readBackupFile,
+  renderRuntimeReportHtml,
+  renderRuntimeReportMarkdown,
   resolveOutputDir,
   sanitizeFilename,
   validateDescription,
   validateExamples,
   validateName,
   validateTopic,
-  writeBackupFile
+  writeBackupFile,
+  writeReportFile
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",