@cdot65/prisma-airs-cli 4.4.0 → 5.0.0

package/dist/{chunk-LF6JPUA4.js → chunk-IRLIFMGQ.js}

@@ -283,9 +283,9 @@ var SdkManagementService = class {
       const response = await this.client.dashboard.applicationsOverview({ limit, offset });
       const page = response.items ?? [];
       items.push(...page);
-      const total = response.pagination?.total_items;
+      const total2 = response.pagination?.total_items;
       offset += page.length;
-      if (page.length === 0 || page.length < limit || total != null && offset >= total) break;
+      if (page.length === 0 || page.length < limit || total2 != null && offset >= total2) break;
     }
     return items.filter(
       (item) => typeof item.id === "string" && typeof item.name === "string"
@@ -1356,14 +1356,14 @@ var SdkRedTeamService = class {
       categories: subCategories.map((sc) => {
         const successful = sc.successful ?? 0;
         const failed = sc.failed ?? 0;
-        const total = sc.total ?? successful + failed;
+        const total2 = sc.total ?? successful + failed;
         return {
           id: sc.id,
           displayName: sc.display_name,
-          asr: total > 0 ? successful / total * 100 : 0,
+          asr: total2 > 0 ? successful / total2 * 100 : 0,
           successful,
           failed,
-          total
+          total: total2
         };
       })
     };
@@ -1683,11 +1683,11 @@ function isDefiniteRateLimitError(err) {
   return metadata?.failureKind === "http" && metadata.statusCode === 429;
 }
 function runtimeDetections(value) {
-  const source = value ?? {};
+  const source2 = value ?? {};
   return Object.fromEntries(
-    RUNTIME_DETECTION_KEYS.filter((key) => typeof source[key] === "boolean").map((key) => [
+    RUNTIME_DETECTION_KEYS.filter((key) => typeof source2[key] === "boolean").map((key) => [
       key,
-      source[key]
+      source2[key]
     ])
   );
 }
@@ -2239,6 +2239,7 @@ var ConfigSchema = z.object({
   mgmtClientSecret: z.string().optional(),
   mgmtTsgId: z.string().optional(),
   mgmtEndpoint: z.string().optional(),
+  mgmtDashboardEndpoint: z.string().url().optional(),
   mgmtTokenEndpoint: z.string().optional(),
   dlpEndpoint: z.string().optional(),
   // Red Team (endpoints only; creds shared with mgmt*)
@@ -2281,6 +2282,7 @@ function fromEnv() {
     mgmtClientSecret: env.PANW_MGMT_CLIENT_SECRET,
     mgmtTsgId: env.PANW_MGMT_TSG_ID,
     mgmtEndpoint: env.PANW_MGMT_ENDPOINT,
+    mgmtDashboardEndpoint: env.PANW_MGMT_DASHBOARD_ENDPOINT,
     mgmtTokenEndpoint: env.PANW_MGMT_TOKEN_ENDPOINT,
     dlpEndpoint: env.PANW_DLP_ENDPOINT,
     redTeamDataEndpoint: env.PANW_RED_TEAM_DATA_ENDPOINT,
@@ -2342,8 +2344,8 @@ async function inspectConfig(configFilePath) {
   const config = ConfigSchema.parse(merged);
   const entries = {};
   for (const key of Object.keys(ConfigSchema.shape)) {
-    const source = key in envConfig ? "env" : key in fileConfig ? "file" : "default";
-    entries[key] = { value: config[key], source };
+    const source2 = key in envConfig ? "env" : key in fileConfig ? "file" : "default";
+    entries[key] = { value: config[key], source: source2 };
   }
   return entries;
 }
@@ -2441,10 +2443,10 @@ function computeMetrics(results) {
   }
   const totalPositives = truePositives + falseNegatives;
   const totalNegatives = trueNegatives + falsePositives;
-  const total = results.length;
+  const total2 = results.length;
   const truePositiveRate = totalPositives > 0 ? truePositives / totalPositives : 0;
   const trueNegativeRate = totalNegatives > 0 ? trueNegatives / totalNegatives : 0;
-  const accuracy = total > 0 ? (truePositives + trueNegatives) / total : 0;
+  const accuracy = total2 > 0 ? (truePositives + trueNegatives) / total2 : 0;
   const coverage = Math.min(truePositiveRate, trueNegativeRate);
   const precision = truePositives + falsePositives > 0 ? truePositives / (truePositives + falsePositives) : 0;
   const recall = truePositiveRate;
@@ -2472,15 +2474,774 @@ function computeCategoryBreakdown(results) {
     if (r.testCase.expectedTriggered && !r.actualTriggered) entry.fn++;
     map.set(cat, entry);
   }
-  return [...map.entries()].map(([category, { total, fp, fn }]) => ({
+  return [...map.entries()].map(([category, { total: total2, fp, fn }]) => ({
     category,
-    total,
+    total: total2,
     fp,
     fn,
-    errorRate: total > 0 ? (fp + fn) / total : 0
+    errorRate: total2 > 0 ? (fp + fn) / total2 : 0
   })).sort((a, b) => b.errorRate - a.errorRate);
 }
 
+// src/reports/io.ts
+import { randomUUID } from "crypto";
+import { link, open, unlink } from "fs/promises";
+import { dirname, join as join2 } from "path";
+async function writeReportFile(path2, content) {
+  const temporary = join2(dirname(path2), `.airs-report-${randomUUID()}.tmp`);
+  const file = await open(temporary, "wx", 384);
+  try {
+    await file.writeFile(content, "utf8");
+    await file.sync();
+    await file.close();
+    await link(temporary, path2);
+  } finally {
+    await file.close();
+    await unlink(temporary);
+  }
+}
+
+// src/reports/render.ts
+import { createHash } from "crypto";
+var HEALTH = {
+  attention: "Attention required",
+  review: "Review required",
+  "no-findings": "No findings in available evidence",
+  unknown: "Unable to assess"
+};
+function html(value) {
+  return String(value ?? "Unknown").replace(
+    /[&<>"']/g,
+    (char) => ({
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
+      "'": "&#39;"
+    })[char] ?? char
+  );
+}
+function md(value) {
+  return String(value ?? "Unknown").replace(
+    /[&<>"'\\`*_[\]{}()|!#~\r\n]/g,
+    (char) => char === "\r" || char === "\n" ? " " : `&#${char.charCodeAt(0)};`
+  );
+}
+function number(value) {
+  return value === null ? "Unknown" : value.toLocaleString("en-US", { maximumFractionDigits: 2 });
+}
+function tables(report) {
+  const sessionSource = report.sources.find((source2) => source2.name === "Daily session inventory");
+  return [
+    {
+      title: "Daily application activity",
+      id: "applications",
+      headers: [
+        "Application bucket",
+        "Sessions",
+        "Violating sessions",
+        "Violation rate",
+        "Registered ID match"
+      ],
+      rows: report.activity.applications.map((app) => [
+        app.name,
+        number(app.sessions),
+        number(app.violatingSessions),
+        app.sessions !== null && app.sessions > 0 && app.violatingSessions !== null && app.violatingSessions <= app.sessions ? `${number(app.violatingSessions / app.sessions * 100)}%` : "Unknown",
+        app.registered === null ? "Unknown" : app.registered ? "Yes" : "Not in returned inventory"
+      ]),
+      note: "API-reported rolling one-day application buckets, ranked by violating sessions. Partial-source totals cover collected buckets only. Violating sessions are not necessarily blocked sessions."
+    },
+    {
+      title: "Current security profiles",
+      id: "profiles",
+      headers: [
+        "Profile",
+        "Revision",
+        "Active",
+        "Timeout action",
+        "Storage masking",
+        "Last modified (UTC)"
+      ],
+      rows: report.profiles.map((profile) => [
+        profile.name,
+        number(profile.revision),
+        profile.active === null ? "Unknown" : profile.active ? "Yes" : "No",
+        profile.timeoutActions.join(", ") || "Unknown",
+        profile.storageMasking,
+        profile.modified
+      ]),
+      note: "Latest returned revision per profile name. These are current settings, not a record of changes during the daily window."
+    },
+    {
+      title: "Registered application inventory",
+      id: "inventory",
+      headers: ["Application", "Environment", "Cloud", "Model", "Key associations"],
+      rows: report.registeredApps.map((app) => [
+        app.name,
+        app.environment,
+        app.cloud,
+        app.model,
+        number(app.keyAssociations)
+      ]),
+      note: "Current registered applications, separate from scan-metadata application buckets. Association counts do not establish key validity or deployment health. No key values or auth codes are included."
+    },
+    {
+      title: "Collected session observations",
+      id: "sessions",
+      headers: ["Session status", "Entries"],
+      rows: report.sessions.statuses.map((entry) => [entry.name, number(entry.count)]),
+      note: `Source: ${sessionSource?.status ?? "unavailable"}. Timestamp-eligible entries: ${number(report.sessions.entries)}. Violated status: ${number(report.sessions.violatingSessions)}. Missing timestamps: ${report.sessions.missingTimestamps}; outside window: ${report.sessions.outsideWindow}. These are collected session counts, not scan actions or detector events. No scan content is fetched.`
+    },
+    {
+      title: "Daily session chart",
+      id: "session-chart",
+      headers: ["Bucket time (UTC)", "Sessions", "Violating sessions", "Detector violations"],
+      rows: report.dailyTelemetry.chart.buckets.map((bucket) => [
+        bucket.time,
+        number(bucket.sessions),
+        number(bucket.violatingSessions),
+        number(bucket.violations.total)
+      ]),
+      note: `Independent chart totals: ${number(report.dailyTelemetry.chart.sessions)} sessions; ${number(report.dailyTelemetry.chart.violatingSessions)} violating sessions. Do not force these counters to equal a separately paginated inventory.`
+    },
+    {
+      title: "Top applications by detector violations",
+      id: "top-violations",
+      headers: ["Application bucket", "Detector violations", "Detection types"],
+      rows: report.dailyTelemetry.topApplications.map((app) => [
+        app.name,
+        number(app.violations),
+        app.detectors.map((detector) => `${detector.name}: ${number(detector.count)}`).join(", ")
+      ]),
+      note: "Server-ranked subset for one day, not a complete application inventory. Detector violations may exceed the number of violating sessions."
+    },
+    {
+      title: "Daily detector severity trend",
+      id: "violation-trend",
+      headers: ["Bucket time (UTC)", "Critical", "High", "Medium", "Low", "Total"],
+      rows: report.dailyTelemetry.violationTrend.map((bucket) => [
+        bucket.time,
+        ...["critical", "high", "medium", "low", "total"].map(
+          (key) => number(bucket.violations[key])
+        )
+      ]),
+      note: "API-reported detector-policy events over the rolling day. Severity counts are preserved independently from distinct session counts; no previous-day comparison is inferred."
+    },
+    {
+      title: "Evidence and collection coverage",
+      id: "evidence",
+      headers: ["Source / SDK method", "Window", "Status", "Records", "Pages", "Collection notes"],
+      rows: report.sources.map((source2) => [
+        `${source2.name} \u2014 ${source2.method}`,
+        source2.window,
+        source2.status,
+        number(source2.records),
+        source2.pages,
+        source2.notes.join(" ") || "Collection completed."
+      ]),
+      note: "Complete means pagination finished for that source, not that the environment is secure or that all traffic was ingested. Unavailable does not mean zero."
+    }
+  ];
+}
+function metrics(report) {
+  return [
+    ["Sessions in collected app buckets", number(report.activity.sessions)],
+    ["Violating sessions", number(report.activity.violatingSessions)],
+    [
+      "Violation rate",
+      report.activity.violationRate === null ? "Unknown" : `${number(report.activity.violationRate)}%`
+    ],
+    [
+      "Complete evidence sources",
+      `${report.sources.filter((source2) => source2.status === "complete").length} / ${report.sources.length}`
+    ]
+  ];
+}
+function renderRuntimeReportMarkdown(report) {
+  const lines = [
+    `# ${md(report.title)}`,
+    "",
+    `**${md(report.product)}**`,
+    "",
+    `Assessment: **${HEALTH[report.health]}**`,
+    "",
+    `Window: ${md(report.window.start)} \u2192 ${md(report.window.end)}`,
+    "",
+    `${md(report.window.description)}. Collection: ${md(report.collectionStartedAt)} \u2192 ${md(report.generatedAt)}.`,
+    "",
+    "## At a glance",
+    "",
+    ...metrics(report).map(([key, value]) => `- ${key}: **${value}**`),
+    "",
+    "## What needs attention",
+    ""
+  ];
+  if (report.findings.length === 0)
+    lines.push(
+      "No findings in the available evidence. This does not establish an absence of risk.",
+      ""
+    );
+  for (const finding of report.findings)
+    lines.push(
+      `### ${finding.priority.toUpperCase()}: ${md(finding.title)}`,
+      "",
+      `Evidence: ${md(finding.evidence)}`,
+      "",
+      `Next step: ${md(finding.recommendation)}`,
+      "",
+      `Source: ${md(finding.source)}`,
+      ""
+    );
+  for (const table of tables(report)) {
+    lines.push(`## ${table.title}`, "", md(table.note), "");
+    if (table.rows.length === 0)
+      lines.push(
+        "No rows available. Consult the source status before interpreting this as an empty result.",
+        ""
+      );
+    else
+      lines.push(
+        `| ${table.headers.join(" | ")} |`,
+        `| ${table.headers.map(() => "---").join(" | ")} |`,
+        ...table.rows.map((row) => `| ${row.map(md).join(" | ")} |`),
+        ""
+      );
+  }
+  lines.push(
+    "## Scope, privacy, and limitations",
+    "",
+    ...report.limitations.map((note) => `- ${md(note)}`),
+    "",
+    `Generated by Prisma AIRS CLI \xB7 Report schema ${report.schemaVersion}`,
+    ""
+  );
+  return lines.join("\n");
+}
+var CSS = `
+#evidence td:nth-child(3){white-space:nowrap}
+:root{color-scheme:light;--ink:#172b40;--muted:#526476;--line:#d8e2e9;--bg:#f2f5f8;--accent:#00786e;font:16px/1.55 system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}
+*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink)}a{color:var(--accent)}header{background:#11283d;color:#fff;padding:2.5rem max(1.25rem,calc((100vw - 1240px)/2))}header p{color:#d7e4ec;max-width:85ch}h1{font-size:clamp(1.8rem,4vw,2.7rem);line-height:1.15;margin:.6rem 0 1rem;overflow-wrap:anywhere}h2{font-size:1.35rem;margin:0 0 .6rem}h3{font-size:1.05rem;margin:.35rem 0}p{margin:.5rem 0 1rem}.eyebrow{font-size:.8rem;letter-spacing:.12em;text-transform:uppercase}.badge{display:inline-block;padding:.35rem .7rem;border:1px solid currentColor;border-radius:100px;font-weight:650;background:#fff;color:var(--ink)}.attention .badge{color:#a62b1b}.review .badge{color:#795500}.unknown .badge{color:#69439b}.no-findings .badge{color:#006a54}
+main{max-width:1280px;margin:auto;padding:1.5rem 1.25rem 3rem}nav{display:flex;gap:1.25rem;flex-wrap:wrap;margin-bottom:1.5rem}section{background:#fff;border:1px solid var(--line);border-radius:12px;padding:1.4rem;margin:1.3rem 0}.cards{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:1rem}.card{background:#fff;border:1px solid var(--line);border-top:4px solid var(--accent);border-radius:9px;padding:1.2rem}.card strong{display:block;font-size:2rem;font-variant-numeric:tabular-nums}.card span,.note{color:var(--muted);font-size:.9rem}.toolbar{display:flex;align-items:center;gap:1rem;flex-wrap:wrap;margin:1rem 0}button,input,select{font:inherit;border:1px solid #8b9eaf;border-radius:6px;padding:.5rem .7rem;background:#fff;color:var(--ink)}button{cursor:pointer}input{max-width:100%}:focus-visible{outline:3px solid #c06605;outline-offset:3px}.finding{border-left:4px solid #b3c3cf;padding:.5rem 1rem;margin:1rem 0;background:#f7f9fb}.finding[data-priority=attention]{border-color:#c74429}.finding[data-priority=review]{border-color:#b78712}.priority{font-size:.75rem;text-transform:uppercase;font-weight:750;letter-spacing:.07em}.finding p{margin:.4rem 0}.table-wrap{overflow:auto}table{border-collapse:collapse;width:100%;font-size:.9rem;text-align:left}th{background:#edf3f7;font-weight:700}th,td{padding:.7rem .8rem;border-bottom:1px solid var(--line);vertical-align:top;overflow-wrap:anywhere;min-width:90px}tbody tr:hover{background:#f8fbfd}caption{text-align:left;font-weight:600;padding:.5rem 0}footer{color:var(--muted);font-size:.8rem;margin-top:2rem}.hidden,[hidden]{display:none!important}.js-only{display:none}.js-ready .js-only{display:flex}.skip{position:absolute;left:-9999px}.skip:focus{left:1rem;top:1rem;background:#fff;padding:1rem;z-index:1}li{margin:.5rem 0}
+@media(max-width:760px){.cards{grid-template-columns:repeat(2,minmax(0,1fr))}section{padding:1rem}header{padding:1.5rem 1.25rem}.card strong{font-size:1.5rem}}
+@media print{body{background:#fff;font-size:10pt}header{background:#fff;color:#000;padding:0}header p{color:#333}main{padding:0;max-width:none}nav,.toolbar,.skip{display:none!important}section,.card{border-radius:0;break-inside:auto}.finding,.card{break-inside:avoid}.table-wrap{overflow:visible}table{font-size:8pt}th,td{min-width:0;padding:.3rem}.hidden,[hidden]{display:revert!important}h2,h3{break-after:avoid}a{color:#000}}
+`;
+var JS = `
+'use strict';
+document.documentElement.classList.add('js-ready');
+document.getElementById('print-report').addEventListener('click',function(){window.print();});
+var filter=document.getElementById('finding-filter');
+filter.addEventListener('change',function(){
+  var visible=0;
+  document.querySelectorAll('.finding').forEach(function(row){row.hidden=filter.value!=='all'&&row.dataset.priority!==filter.value;if(!row.hidden)visible++;});
+  document.getElementById('finding-count').textContent=visible+' findings shown';
+});
+var search=document.getElementById('app-search');
+search.addEventListener('input',function(){
+  var query=search.value.toLowerCase().trim(),visible=0;
+  document.querySelectorAll('#applications tbody tr').forEach(function(row){row.hidden=!row.textContent.toLowerCase().includes(query);if(!row.hidden)visible++;});
+  document.getElementById('app-count').textContent=visible+' application buckets shown';
+});
+`;
+function renderRuntimeReportHtml(report) {
+  const hash = (text) => createHash("sha256").update(text).digest("base64");
+  const policy = `default-src 'none'; script-src 'sha256-${hash(JS)}'; style-src 'sha256-${hash(CSS)}'; base-uri 'none'; form-action 'none'; connect-src 'none'; img-src 'none'`;
+  const findingCards = report.findings.map(
+    (finding) => `<article class="finding" data-priority="${html(finding.priority)}"><span class="priority">${html(finding.priority)}</span><h3>${html(finding.title)}</h3><p><strong>Evidence:</strong> ${html(finding.evidence)}</p><p><strong>Next step:</strong> ${html(finding.recommendation)}</p><p class="note">Source: ${html(finding.source)}</p></article>`
+  ).join("");
+  const sections = tables(report).map(
+    (table) => `<section id="${table.id}" aria-labelledby="${table.id}-title"><h2 id="${table.id}-title">${table.title}</h2><p class="note">${html(table.note)}</p>${table.id === "applications" ? '<div class="toolbar js-only"><label for="app-search">Find an application</label><input id="app-search" type="search" placeholder="Filter application buckets"><span id="app-count" role="status"></span></div>' : ""}${table.rows.length ? `<div class="table-wrap" role="region" aria-label="${table.title}" tabindex="0"><table><caption>${table.rows.length} collected rows</caption><thead><tr>${table.headers.map((header) => `<th scope="col">${header}</th>`).join("")}</tr></thead><tbody>${table.rows.map((row) => `<tr>${row.map((cell) => `<td>${html(cell)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>` : "<p>No rows available. Consult the source status before interpreting this as an empty result.</p>"}</section>`
+  ).join("");
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${html(policy)}"><meta name="referrer" content="no-referrer"><title>${html(report.title)} \u2014 Prisma AIRS</title><style>${CSS}</style></head>
+<body class="${html(report.health)}"><a class="skip" href="#main">Skip to report</a><header><div class="eyebrow">Prisma AIRS \xB7 AI Runtime Security</div><h1>${html(report.title)}</h1><span class="badge">${HEALTH[report.health]}</span><p>${html(report.window.description)}<br><time>${html(report.window.start)}</time> \u2192 <time>${html(report.window.end)}</time></p><p>Collected ${html(report.collectionStartedAt)} \u2192 ${html(report.generatedAt)}<br>Read-only evidence \xB7 Confidential environment metadata</p></header>
+<main id="main"><nav aria-label="Report sections"><a href="#findings">Attention</a><a href="#applications">Activity</a><a href="#profiles">Profiles</a><a href="#inventory">Inventory</a><a href="#evidence">Evidence</a><a href="#scope">Scope</a></nav>
+<div class="cards">${metrics(report).map(([name, value]) => `<div class="card"><span>${name}</span><strong>${value}</strong></div>`).join("")}</div>
+<section id="findings"><h2>What needs attention</h2><p class="note">Observed violations and configuration review items, not a numerical health score. Collection gaps remain visible in the evidence table.</p><div class="toolbar js-only"><label for="finding-filter">Priority</label><select id="finding-filter"><option value="all">All findings</option><option value="attention">Attention</option><option value="review">Review</option><option value="info">Information</option></select><span id="finding-count" role="status"></span><button id="print-report" type="button">Print / save PDF</button></div>${findingCards || "<p>No findings in the available evidence. This does not establish an absence of risk.</p>"}</section>
+${sections}<section id="scope"><h2>Scope, privacy, and limitations</h2><ul>${report.limitations.map((note) => `<li>${html(note)}</li>`).join("")}</ul></section><footer>Generated by Prisma AIRS CLI \xB7 Report schema ${report.schemaVersion} \xB7 Self-contained HTML; no network access required. All evidence remains readable with JavaScript disabled.</footer></main><script>${JS}</script></body></html>
+`;
+}
+
+// src/reports/runtime.ts
+var PAGE_SIZE = 100;
+var DAY_MS = 864e5;
+var ReportDataError = class extends Error {
+};
+function safeFailure(error) {
+  if (error instanceof ReportDataError) return error.message;
+  const code = error?.statusCode;
+  if (typeof code === "number" && Number.isInteger(code) && code >= 400 && code <= 599) {
+    if (code === 401 || code === 403)
+      return `HTTP ${code}: check Management API credentials and grants.`;
+    if (code === 429) return "HTTP 429: rate limited; retry the report later.";
+    return `HTTP ${code}: source request failed; verify service availability and API compatibility.`;
+  }
+  return "Source request or response validation failed; check connectivity and SDK compatibility.";
+}
+function label(value) {
+  return (value?.replace(/[\p{Cc}\p{Cf}]/gu, " ").trim() || "Unknown").slice(0, 240);
+}
+function count(value) {
+  return Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+async function collect(source2, maxPages, read, identity) {
+  const records = /* @__PURE__ */ new Map();
+  let offset = 0;
+  try {
+    for (let page = 0; page < maxPages; page++) {
+      const result = await read(offset);
+      source2.pages++;
+      if (!Array.isArray(result.items))
+        throw new ReportDataError(
+          "The API returned no record array. An empty object or absent collection does not establish zero activity."
+        );
+      const before = records.size;
+      for (const item of result.items) records.set(identity(item), item);
+      source2.records = records.size;
+      if (result.note) source2.notes.push(result.note);
+      if (records.size - before !== result.items.length) {
+        source2.notes.push("Overlapping or repeated records detected; duplicates excluded.");
+        source2.status = "partial";
+      }
+      if (result.next === void 0) {
+        if (source2.status !== "partial") source2.status = "complete";
+        return [...records.values()];
+      }
+      if (!Number.isSafeInteger(result.next) || result.next <= offset || records.size === before) {
+        source2.notes.push("Pagination did not advance; collection stopped safely.");
+        source2.status = "partial";
+        return [...records.values()];
+      }
+      offset = result.next;
+    }
+    source2.notes.push(`Reached the ${maxPages}-page budget; this is not a complete inventory.`);
+    source2.status = "partial";
+  } catch (error) {
+    source2.status = source2.pages > 0 && records.size > 0 ? "partial" : "unavailable";
+    source2.notes.push(safeFailure(error));
+  }
+  return [...records.values()];
+}
+function source(name, method, window) {
+  return { name, method, window, status: "unavailable", records: 0, pages: 0, notes: [] };
+}
+function inventoryNext(next, size, offset) {
+  return next === 0 ? void 0 : next ?? (size === PAGE_SIZE ? offset + size : void 0);
+}
+function total(values) {
+  if (values.some((value) => value === null)) return null;
+  const result = values.reduce((sum, value) => sum + (value ?? 0), 0);
+  return count(result);
+}
+function distribution(rows) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const name = label(row.violation_status).toLowerCase();
+    groups.set(name, (groups.get(name) ?? 0) + 1);
+  }
+  return [...groups].map(([name, n]) => ({ name, count: n })).sort((a, b) => b.count - a.count);
+}
+function severity(value) {
+  return {
+    critical: count(value.critical),
+    high: count(value.high),
+    medium: count(value.medium),
+    low: count(value.low),
+    total: count(value.total)
+  };
+}
+async function collectRuntimeDailyReport(client, options = {}) {
+  const maxPages = options.maxPages ?? 40;
+  if (!Number.isSafeInteger(maxPages) || maxPages < 1 || maxPages > 100) {
+    throw new Error("maxPages must be an integer from 1 to 100");
+  }
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const started = now();
+  const end = started.toISOString();
+  const start = new Date(started.getTime() - DAY_MS).toISOString();
+  const activitySource = source(
+    "Daily application activity",
+    "dashboard.applicationsOverview",
+    "Rolling 1 day"
+  );
+  const profileSource = source(
+    "Security profiles",
+    "profiles.list (latest=true)",
+    "Current configuration"
+  );
+  const appSource = source("Registered applications", "customerApps.list", "Current configuration");
+  const sessionSource = source(
+    "Daily session inventory",
+    "dashboard.sessionsOverview",
+    "Rolling 1 day"
+  );
+  const chartSource = source("Daily session chart", "dashboard.sessionsChart", "Rolling 1 day");
+  const rankingSource = source(
+    "Top application violations",
+    "dashboard.topApplicationsViolations",
+    "Rolling 1 day; server-ranked subset"
+  );
+  const trendSource = source(
+    "Daily violation trend",
+    "dashboard.applicationsViolationsTrend",
+    "Rolling 1 day"
+  );
+  const sources = [
+    activitySource,
+    profileSource,
+    appSource,
+    sessionSource,
+    chartSource,
+    rankingSource,
+    trendSource
+  ];
+  const daily = { timeInterval: 1, timeUnit: "day" };
+  let expectedSessionTotal;
+  let expectedAppTotal;
+  const [applications, profileRows, registered, rawSessions, chart, rankings, trend] = await Promise.all([
+    collect(
+      activitySource,
+      maxPages,
+      async (offset) => {
+        const page = await client.dashboard.applicationsOverview({
+          timeInterval: 1,
+          timeUnit: "day",
+          limit: PAGE_SIZE,
+          offset
+        });
+        const size = page.items?.length ?? 0;
+        const totalItems = count(page.pagination?.total_items);
+        if (totalItems !== null) {
+          if (expectedAppTotal !== void 0 && totalItems !== expectedAppTotal)
+            throw new ReportDataError(
+              "Application total changed during pagination; retry for a stable inventory."
+            );
+          expectedAppTotal = totalItems;
+          if (offset + size > totalItems)
+            throw new ReportDataError("Application records exceed the advertised total.");
+        }
+        if (totalItems !== null && totalItems > offset + size && size === 0) {
+          throw new ReportDataError(
+            "The API returned an empty page before its advertised total."
+          );
+        }
+        return {
+          items: page.items,
+          next: totalItems !== null ? offset + size < totalItems ? offset + size : void 0 : size === PAGE_SIZE ? offset + size : void 0
+        };
+      },
+      (item) => JSON.stringify([item.id, item.name])
+    ),
+    collect(
+      profileSource,
+      maxPages,
+      async (offset) => {
+        const page = await client.profiles.list({ latest: true, limit: PAGE_SIZE, offset });
+        return {
+          items: page.ai_profiles,
+          next: inventoryNext(page.next_offset, page.ai_profiles.length, offset)
+        };
+      },
+      (item) => JSON.stringify([item.profile_name, item.revision])
+    ),
+    collect(
+      appSource,
+      maxPages,
+      async (offset) => {
+        const page = await client.customerApps.list({ limit: PAGE_SIZE, offset });
+        return {
+          items: page.customer_apps,
+          next: inventoryNext(page.next_offset, page.customer_apps?.length ?? 0, offset)
+        };
+      },
+      (item) => item.customer_appId
+    ),
+    collect(
+      sessionSource,
+      maxPages,
+      async (offset) => {
+        const page = await client.dashboard.sessionsOverview({ ...daily, limit: 25, offset });
+        const size = page.items?.length ?? 0;
+        const totalItems = count(page.pagination?.total_items);
+        if (totalItems === null || page.pagination?.skip !== offset || page.pagination?.limit !== 25)
+          throw new ReportDataError("Missing or mismatched session pagination metadata.");
+        if (expectedSessionTotal !== void 0 && expectedSessionTotal !== totalItems)
+          throw new ReportDataError(
+            "Session total changed during pagination; retry for a stable inventory."
+          );
+        expectedSessionTotal = totalItems;
+        if (offset + size > totalItems || size > 25 || size === 0 && offset < totalItems)
+          throw new ReportDataError("Session page does not agree with its advertised total.");
+        return {
+          items: page.items,
+          next: offset + size < totalItems ? offset + size : void 0
+        };
+      },
+      (item) => JSON.stringify([item.application_id, item.application_name, item.session_id])
+    ),
+    collect(
+      chartSource,
+      1,
+      async () => ({ items: (await client.dashboard.sessionsChart(daily)).buckets }),
+      (item) => String(item.bucket_number)
+    ),
+    collect(
+      rankingSource,
+      1,
+      async () => ({
+        items: (await client.dashboard.topApplicationsViolations(daily)).applications
+      }),
+      (item) => JSON.stringify([item.id, item.name])
+    ),
+    collect(
+      trendSource,
+      1,
+      async () => ({
+        items: (await client.dashboard.applicationsViolationsTrend(daily)).violations
+      }),
+      (item) => String(item.bucket_number)
+    )
+  ]);
+  const findings = [];
+  const add = (priority, title, evidence, recommendation, evidenceSource) => {
+    findings.push({ priority, title, evidence, recommendation, source: evidenceSource });
+  };
+  for (const s of sources) {
+    if (s.status !== "complete")
+      add(
+        "review",
+        `${s.name}: ${s.status}`,
+        s.notes.join(" "),
+        "Restore access or retry collection; do not treat missing data as zero. Increase --max-pages if the page budget was reached.",
+        s.name
+      );
+  }
+  const appIds = new Set(registered.map((app) => app.customer_appId));
+  const reportApps = applications.map((app) => ({
+    name: label(app.name),
+    sessions: count(app.sessions_total),
+    violatingSessions: count(app.sessions_violated),
+    registered: app.id && appIds.has(app.id) ? true : appSource.status === "complete" && app.id ? false : null
+  })).sort(
+    (a, b) => (b.violatingSessions ?? -1) - (a.violatingSessions ?? -1) || a.name.localeCompare(b.name)
+  );
+  const sessions = activitySource.status === "unavailable" ? null : total(reportApps.map((app) => app.sessions));
+  const violatingSessions = activitySource.status === "unavailable" ? null : total(reportApps.map((app) => app.violatingSessions));
+  const inconsistent = reportApps.some(
+    (app) => app.sessions !== null && app.violatingSessions !== null && app.violatingSessions > app.sessions
+  );
+  if (inconsistent || reportApps.some((app) => app.sessions === null || app.violatingSessions === null)) {
+    add(
+      "review",
+      "Activity counters need verification",
+      "Some application counters are absent, invalid, or report more violating sessions than total sessions.",
+      "Compare these buckets with the SCM dashboard. A violation rate is withheld when counters are inconsistent.",
+      activitySource.name
+    );
+  }
+  if ((violatingSessions ?? 0) > 0)
+    add(
+      "attention",
+      "Violating sessions observed",
+      `${violatingSessions} violating sessions across ${reportApps.filter((app) => (app.violatingSessions ?? 0) > 0).length} application buckets in the collected daily data.`,
+      "Review the highest-volume applications in SCM, confirm intended enforcement, and investigate unexpected activity. Violations are not proof of a successful attack.",
+      activitySource.name
+    );
+  if (sessions === 0 && activitySource.status === "complete")
+    add(
+      "review",
+      "No sessions reported in the daily window",
+      "The complete application overview reports zero sessions.",
+      "If traffic was expected, check the integration, application metadata, and telemetry ingestion. No activity is not proof of health.",
+      activitySource.name
+    );
+  const latestProfiles = /* @__PURE__ */ new Map();
+  for (const profile of profileRows) {
+    const old = latestProfiles.get(profile.profile_name);
+    if (!old || (profile.revision ?? -1) > (old.revision ?? -1))
+      latestProfiles.set(profile.profile_name, profile);
+  }
+  const profiles = [...latestProfiles.values()].map((profile) => {
+    const configs = (profile.policy?.["ai-security-profiles"] ?? []).flatMap(
+      (p) => p["model-configuration"] ? [p["model-configuration"]] : []
+    );
+    const timeoutActions = [
+      ...new Set(configs.map((c) => label(c.latency?.["inline-timeout-action"])))
+    ];
+    const name = label(profile.profile_name);
+    if (profile.active === false)
+      add(
+        "review",
+        `Inactive profile: ${name}`,
+        "The latest returned revision is explicitly inactive.",
+        "Confirm this is intentional before assigning the profile to an integration.",
+        profileSource.name
+      );
+    if (profile.active === true && timeoutActions.some((action) => action.toLowerCase() === "allow"))
+      add(
+        "review",
+        `Timeout allows traffic: ${name}`,
+        "An active profile explicitly sets inline-timeout-action to allow.",
+        "Review the availability-versus-enforcement tradeoff with the application owner; this is not evidence of a timeout or bypass.",
+        profileSource.name
+      );
+    const masking = configs.map((c) => c["mask-data-in-storage"]);
+    const storageMasking = masking.includes(false) ? "Off in at least one configuration" : masking.length > 0 && masking.every((v) => v === true) ? "On in all returned configurations" : "Unknown";
+    if (profile.active === true && masking.includes(false))
+      add(
+        "review",
+        `Storage masking disabled: ${name}`,
+        "An active profile explicitly disables mask-data-in-storage in a model configuration.",
+        "Confirm retention and privacy requirements. This flag alone does not establish that sensitive data was stored.",
+        profileSource.name
+      );
+    return {
+      name,
+      revision: count(profile.revision),
+      active: profile.active ?? null,
+      modified: profile.last_modified_ts && Number.isFinite(Date.parse(profile.last_modified_ts)) ? new Date(profile.last_modified_ts).toISOString() : null,
+      timeoutActions,
+      storageMasking
+    };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+  if (profiles.length === 0 && profileSource.status === "complete")
+    add(
+      "attention",
+      "No security profiles returned",
+      "The current profile inventory is empty.",
+      "Verify tenant scope and configure a security profile before routing application scans.",
+      profileSource.name
+    );
+  let missingTimestamps = 0;
+  let outsideWindow = 0;
+  const sessionRows = rawSessions.filter((row) => {
+    const timestamp = Date.parse(row.last_session_activity ?? "");
+    if (!Number.isFinite(timestamp)) {
+      missingTimestamps++;
+      return false;
+    }
+    if (timestamp < Date.parse(start) || timestamp >= Date.parse(end)) {
+      outsideWindow++;
+      return false;
+    }
+    return true;
+  });
+  if (missingTimestamps || outsideWindow)
+    add(
+      "review",
+      "Some session records excluded from daily analysis",
+      `${missingTimestamps} records lack a valid last-activity timestamp; ${outsideWindow} fall outside the anchored UTC window.`,
+      "Verify ingestion timestamps and collection-window drift before using session counts as daily totals.",
+      sessionSource.name
+    );
+  const failedSessions = sessionRows.filter(
+    (row) => ["failed", "error", "timeout"].includes(row.violation_status.trim().toLowerCase())
+  ).length;
+  if (failedSessions)
+    add(
+      "attention",
+      "Session processing failures observed",
+      `${failedSessions} timestamp-eligible collected sessions explicitly report failed, error, or timeout status.`,
+      "Review these sessions in SCM and check integration error handling. This is not a tenant-wide failure rate.",
+      sessionSource.name
+    );
+  const chartSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count(bucket.total)));
+  const chartViolatingSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count(bucket.violating)));
+  if (chartSessions !== null && sessionSource.status === "complete" && chartSessions !== rawSessions.length)
+    add(
+      "review",
+      "Session sources disagree",
+      `The chart reports ${chartSessions} sessions; the independently paginated inventory returned ${rawSessions.length}.`,
+      "Preserve both measurements and verify in SCM. Separate rolling queries are not a consistent snapshot; the discrepancy has no verified cause.",
+      chartSource.name
+    );
+  const urgentViolations = total(
+    trend.map(
+      (bucket) => total([count(bucket.violation_breakdown.critical), count(bucket.violation_breakdown.high)])
+    )
+  );
+  if ((urgentViolations ?? 0) > 0)
+    add(
+      "attention",
+      "High or critical detector violations observed",
+      `${urgentViolations} high/critical detector violations in the returned daily trend. These are not distinct sessions.`,
+      "Investigate the affected applications and confirm enforcement decisions before assigning incident severity.",
+      trendSource.name
+    );
+  const priorities = { attention: 0, review: 1, info: 2 };
+  findings.sort((left, right) => priorities[left.priority] - priorities[right.priority]);
+  return {
+    schemaVersion: 2,
+    product: "Prisma AIRS AI Runtime Security",
+    title: label(options.title ?? "Daily environment report"),
+    generatedAt: now().toISOString(),
+    collectionStartedAt: end,
+    window: {
+      start,
+      end,
+      description: "Rolling last 24 hours, UTC (approximate for server-relative application queries)"
+    },
+    health: sources.every((s) => s.status === "unavailable") ? "unknown" : findings.some((f) => f.priority === "attention") ? "attention" : findings.some((f) => f.priority === "review") ? "review" : "no-findings",
+    sources,
+    findings,
+    activity: {
+      sessions,
+      violatingSessions,
+      violationRate: !inconsistent && sessions !== null && sessions > 0 && violatingSessions !== null ? violatingSessions / sessions * 100 : null,
+      applications: reportApps
+    },
+    profiles,
+    registeredApps: registered.map((app) => ({
+      name: label(app.app_name),
+      environment: label(app.environment),
+      cloud: label(app.cloud_provider),
+      model: label(app.model_name),
+      keyAssociations: app.api_keys_dp_info ? app.api_keys_dp_info.length : null
+    })).sort((a, b) => a.name.localeCompare(b.name)),
+    sessions: {
+      entries: sessionSource.status === "unavailable" ? null : sessionRows.length,
+      statuses: distribution(sessionRows),
+      violatingSessions: sessionSource.status === "unavailable" ? null : sessionRows.filter((row) => row.violation_status === "violated").length,
+      missingTimestamps,
+      outsideWindow
+    },
+    dailyTelemetry: {
+      chart: {
+        sessions: chartSessions,
+        violatingSessions: chartViolatingSessions,
+        buckets: chart.map((bucket) => ({
+          time: label(bucket.time),
+          sessions: count(bucket.total),
+          violatingSessions: count(bucket.violating),
+          violations: severity(bucket.violation_breakdown)
+        }))
+      },
+      topApplications: rankings.map((app) => ({
+        name: label(app.name),
+        violations: count(app.total_violations),
+        detectors: app.policy_violations.map((detector) => ({
+          name: label(detector.detection_type),
+          count: count(detector.total)
+        }))
+      })),
+      violationTrend: trend.map((bucket) => ({
+        time: label(bucket.date),
+        violations: severity(bucket.violation_breakdown)
+      }))
+    },
+    limitations: [
+      "This is a read-only operational review, not an uptime SLA, compliance attestation, or proof that attacks succeeded or were blocked. No health score is invented.",
+      "Application activity uses the API\u2019s rolling one-day window; each paginated request evaluates its own server-relative window. Collection is not a transactionally consistent historical snapshot. Ingestion may lag.",
+      "Application buckets, session inventory, chart sessions, and detector violations are different measurements. They are not added together. Session inventory summaries use timestamp-eligible entries only; absent data is unknown.",
+      "Application buckets are keyed by registered application ID plus the literal scan metadata.app_name, which can differ from registered names. Do not sum session counts as unique users or unique tenant-wide sessions.",
+      "Current configuration is not a configuration-change audit. Missing policy settings are unknown, not disabled. Inactive profiles can be intentional; current profile state may differ from the revision used by a historical scan.",
+      "Daily charts, rankings and severity trends come from their own one-day endpoints. Rankings are a server-selected subset, not a complete inventory. Per-app token summaries and drill-downs require longer windows; no daily token usage or previous-day comparison is inferred.",
+      "The legacy ScanLogsClient / scan-logs query path is broken and under refactor. This report uses the verified dashboard session APIs instead. It never automatically fetches transactions or stored scan content.",
+      "Prompts, responses, user identities/IPs, API keys, auth codes, tenant IDs, and raw errors are omitted. Application/profile names and configuration metadata remain confidential; review before sharing."
+    ]
+  };
+}
+
 export {
   SdkManagementService,
   getOrCreateManagementClient,
@@ -2505,5 +3266,9 @@ export {
   validateExamples,
   validateTopic,
   computeMetrics,
-  computeCategoryBreakdown
+  computeCategoryBreakdown,
+  writeReportFile,
+  renderRuntimeReportMarkdown,
+  renderRuntimeReportHtml,
+  collectRuntimeDailyReport
 };