@cdot65/prisma-airs-cli 5.0.1 → 5.1.0

package/README.md

@@ -15,6 +15,7 @@
 
 - **Runtime Scanning** — scan prompts and responses against AIRS security profiles, single or bulk with CSV export
 - **Daily environment report** — `airs runtime report` delivers a read-only AI Runtime Security dashboard as self-contained HTML (default) or Markdown in your working directory, with explicit evidence gaps and configuration review findings
+- **Red Team environment dashboard** — `airs redteam dashboard` collects seven read-only SDK feeds into private HTML/Markdown deliverables, with source completeness, quota and risk review findings, and independently scoped scan-creation activity
 - **SCM dashboard and sessions** — `runtime dashboard` and `runtime sessions` expose application activity, daily trends, checked pagination and explicit session-to-content drill-down. Legacy `scan-logs query` is **broken/under refactor** and exits with migration guidance; see the [session reference](https://cdot65.github.io/prisma-airs-cli/cli/runtime/sessions/)
 - **Guardrail Optimization** — atomic CLI commands (`create`, `apply`, `eval`, `revert`) for custom topic guardrails, designed for autonomous agent loops (see [`AGENTS.md`](AGENTS.md))
 - **AI Red Teaming** — adversarial scanning with static, dynamic, and custom prompt set attack modes
@@ -65,6 +66,9 @@ airs runtime topics revert --profile my-profile --name "Explosives"
 airs redteam scan --target <uuid> --name "Full Scan" --type STATIC
 airs redteam report <job-id>
 
+# Read-only environment dashboard (HTML by default; --output markdown also supported)
+airs redteam dashboard --strict
+
 # Red team custom target adapters
 airs redteam adapter list --output json
 

package/dist/{chunk-IRLIFMGQ.js → chunk-DR6MZG4E.js}

@@ -2501,7 +2501,302 @@ async function writeReportFile(path2, content) {
   }
 }
 
-// src/reports/render.ts
+// src/reports/redteam.ts
+var DataError = class extends Error {
+};
+var label = (value) => typeof value === "string" ? value.replace(/[\p{Cc}\p{Cf}]/gu, " ").slice(0, 120) : "Unknown";
+function count(value) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+    throw new DataError("A required counter is missing or invalid.");
+  return value;
+}
+function failure(error) {
+  if (error instanceof DataError) return error.message;
+  const code = error?.statusCode;
+  return typeof code === "number" && Number.isInteger(code) && code >= 400 && code <= 599 ? `HTTP ${code}: source unavailable; check credentials, service availability and SDK compatibility.` : "Source request or validation failed. No upstream error body is included.";
+}
+async function collectRedTeamEnvironmentReport(client, options = {}) {
+  const maxPages = options.maxPages ?? 40;
+  if (!Number.isSafeInteger(maxPages) || maxPages < 1 || maxPages > 100)
+    throw new Error("maxPages must be an integer from 1 to 100");
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const end = now();
+  const report = {
+    schemaVersion: 1,
+    product: "Prisma AIRS AI Red Teaming",
+    title: options.title ?? "Red Team environment report",
+    collectionStartedAt: end.toISOString(),
+    generatedAt: "",
+    window: { start: new Date(end.getTime() - 864e5).toISOString(), end: end.toISOString() },
+    health: "unknown",
+    sources: [],
+    findings: [],
+    tables: [],
+    limitations: [
+      "This is a read-only snapshot, not a security certification, availability SLA or numerical health score.",
+      "Only scan creation timestamps are filtered locally to the preceding 24 hours. Current scan status is not a history of status changes.",
+      "Dashboard statistics use server defaults with an unverified measurement window. They are not daily totals and need not match the paginated scan inventory.",
+      "Targets and adapters are current configuration inventories, not configuration change logs. Broker channels not online may be intentionally idle; no outage is inferred.",
+      "Risk categories are server-reported. Quota consumption is not reset or reinterpreted as daily usage; unlimited zero allocation is not exhaustion.",
+      "Partial sources describe collected records only. Missing data is unknown, never zero. Independently read pages are not an atomic snapshot.",
+      "Only aggregate counters and category labels are included. Target names, IDs, connection settings, scripts, variables, prompts and scan content are excluded."
+    ]
+  };
+  function finding(priority, title, evidence, recommendation, source3) {
+    report.findings.push({ priority, title, evidence, recommendation, source: source3 });
+  }
+  async function source2(name, method, window, read) {
+    const s = {
+      name,
+      method,
+      window,
+      status: "unavailable",
+      records: 0,
+      pages: 0,
+      notes: []
+    };
+    report.sources.push(s);
+    try {
+      await read(s);
+      if (s.status !== "partial") s.status = "complete";
+    } catch (error) {
+      s.status = s.records > 0 ? "partial" : "unavailable";
+      s.notes.push(failure(error));
+    }
+    if (s.status !== "complete")
+      finding(
+        "review",
+        `${name} incomplete`,
+        s.notes.join(" "),
+        "Resolve the source error or increase the page budget, then regenerate.",
+        name
+      );
+  }
+  async function pages(s, read) {
+    const rows = [];
+    const seen = /* @__PURE__ */ new Set();
+    let total2;
+    try {
+      for (let page = 0; page < maxPages; page++) {
+        const r = await read(rows.length);
+        s.pages++;
+        if (!Array.isArray(r.data)) throw new DataError("Missing inventory array.");
+        const reported = count(r.pagination.total_items);
+        total2 ??= reported;
+        if (total2 !== reported) throw new DataError("Inventory changed during pagination.");
+        if (r.data.length > 15) throw new DataError("Page exceeds requested size.");
+        for (const row of r.data) {
+          if (!row.uuid || seen.has(row.uuid))
+            throw new DataError("Missing or repeated identity; pagination stopped.");
+          seen.add(row.uuid);
+          rows.push(row);
+          s.records = rows.length;
+        }
+        if (rows.length > total2) throw new DataError("Inventory exceeds reported total.");
+        if (rows.length === total2) return rows;
+        if (!r.data.length) throw new DataError("Premature empty page.");
+      }
+      throw new DataError(`Reached the ${maxPages}-page budget; inventory is incomplete.`);
+    } catch (error) {
+      if (!rows.length) throw error;
+      s.status = "partial";
+      s.notes.push(failure(error));
+      return rows;
+    }
+  }
+  const table = (title, note, headers, rows) => report.tables.push({ title, note, headers, rows });
+  function groups(values) {
+    const counts = /* @__PURE__ */ new Map();
+    for (const v of values) {
+      const key = label(v);
+      counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    return [...counts].sort(([a], [b]) => a.localeCompare(b));
+  }
+  await source2("Overview", "getDashboardOverview()", "Current dashboard snapshot", async (s) => {
+    const r = await client.getDashboardOverview();
+    const total2 = count(r.total_targets);
+    table("Dashboard overview", s.window, ["Metric", "Count"], [["Targets", total2]]);
+    s.records = 1;
+    s.pages = 1;
+  });
+  await source2(
+    "Statistics",
+    "getScanStatistics()",
+    "Server-default window (unverified)",
+    async (s) => {
+      const r = await client.getScanStatistics();
+      const rows = [
+        ["Scans", count(r.total_scans)],
+        ["Targets scanned", count(r.targets_scanned)]
+      ];
+      for (const risk of r.risk_profile ?? []) {
+        const n = count(risk.total);
+        rows.push([`Risk: ${label(risk.risk_rating)}`, n]);
+        if (/^(high|critical)$/i.test(risk.risk_rating) && n > 0)
+          finding(
+            "attention",
+            "Elevated risk reported",
+            `${n} in the ${label(risk.risk_rating)} risk category.`,
+            "Review affected targets in Red Team; the statistics window is server-defined.",
+            s.name
+          );
+      }
+      for (const status of r.scan_status ?? [])
+        rows.push([`Status: ${label(status.name)}`, count(status.count)]);
+      table("Dashboard scan statistics", s.window, ["Metric", "Count"], rows);
+      s.records = 1;
+      s.pages = 1;
+    }
+  );
+  await source2("Targets", "targets.list()", "Current paginated inventory", async (s) => {
+    const rows = await pages(s, (skip) => client.targets.list({ skip, limit: 15 }));
+    table(
+      "Target inventory",
+      "Collected targets by type; consult source completeness.",
+      ["Type", "Count"],
+      groups(rows.map((r) => r.target_type))
+    );
+  });
+  await source2("Quota", "getQuotaSummary() \u2014 GET", "Current quota snapshot", async (s) => {
+    if (!client.getQuotaSummary)
+      throw new DataError(
+        "Installed SDK lacks getQuotaSummary(); use the locally updated SDK. POST is not used as a fallback."
+      );
+    const r = await client.getQuotaSummary();
+    const rows = [];
+    for (const kind of ["static", "dynamic", "custom"]) {
+      const q = r[kind];
+      const allocated = count(q.allocated);
+      const consumed = count(q.consumed);
+      if (typeof q.unlimited !== "boolean") throw new DataError("Missing unlimited quota flag.");
+      rows.push([
+        kind,
+        allocated,
+        consumed,
+        q.unlimited ? "Unlimited" : String(Math.max(0, allocated - consumed))
+      ]);
+      if (!q.unlimited && consumed >= allocated)
+        finding(
+          "attention",
+          `${kind} quota has no remaining allocation`,
+          `${consumed} consumed; ${allocated} allocated.`,
+          "Review quota allocation before scheduling more scans.",
+          s.name
+        );
+    }
+    table(
+      "Quota",
+      "Remaining is shown only for finite quotas; these are not daily usage counters.",
+      ["Type", "Allocated", "Consumed", "Remaining"],
+      rows
+    );
+    s.records = 3;
+    s.pages = 1;
+  });
+  await source2(
+    "Scans",
+    "scans.list()",
+    "Paginated inventory; local 24-hour creation filter",
+    async (s) => {
+      const rows = await pages(s, (skip) => client.scans.list({ skip, limit: 15 }));
+      let unknown = 0;
+      const recent = rows.filter((r) => {
+        const t = typeof r.created_at === "string" && /(?:Z|[+-]\d{2}:\d{2})$/i.test(r.created_at) ? Date.parse(r.created_at) : Number.NaN;
+        if (!Number.isFinite(t) || t > end.getTime()) {
+          unknown++;
+          return false;
+        }
+        return t >= end.getTime() - 864e5;
+      });
+      table(
+        "Scan inventory and daily creation activity",
+        "Daily count covers collected records created in the stated UTC window, not scans completed or attacks executed.",
+        ["Metric", "Count"],
+        [
+          ["Collected scans", rows.length],
+          ["Created in preceding 24 hours", recent.length],
+          ["Unusable or future creation timestamps", unknown]
+        ]
+      );
+      table(
+        "Current status of collected scans",
+        "All collected scans, independent of creation window.",
+        ["Status", "Count"],
+        groups(rows.map((r) => r.status))
+      );
+      const failed = rows.filter((r) => /^(failed|error)$/i.test(r.status ?? "")).length;
+      if (failed)
+        finding(
+          "attention",
+          "Scans require failure review",
+          `${failed} collected scans currently report failed/error status.`,
+          "Inspect individual scan reports and error logs before rerunning; no reruns are performed here.",
+          s.name
+        );
+      if (unknown)
+        finding(
+          "review",
+          "Daily activity has timestamp gaps",
+          `${unknown} records could not be assigned to the daily window.`,
+          "Review source timestamps; do not interpret the daily count as complete.",
+          s.name
+        );
+    }
+  );
+  await source2(
+    "Network broker",
+    "networkBroker.getChannelStats()",
+    "Current channel snapshot",
+    async (s) => {
+      const r = await client.networkBroker.getChannelStats();
+      const total2 = count(r.total_channels);
+      const online = count(r.online_channels);
+      if (online > total2) throw new DataError("Online channel count exceeds total.");
+      table(
+        "Network broker",
+        "Not-online channels may be intentionally idle; this does not establish an outage.",
+        ["Metric", "Count"],
+        [
+          ["Configured channels", total2],
+          ["Online channels", online]
+        ]
+      );
+      if (total2 > online)
+        finding(
+          "review",
+          "Confirm expected broker connectivity",
+          `${online} of ${total2} configured channels are online.`,
+          "Compare with intended channel schedules before investigating connectivity.",
+          s.name
+        );
+      s.records = 1;
+      s.pages = 1;
+    }
+  );
+  await source2(
+    "Adapters",
+    "adapters.list({ include_target_count: true })",
+    "Current paginated configuration",
+    async (s) => {
+      const rows = await pages(
+        s,
+        (skip) => client.adapters.list({ skip, limit: 15, include_target_count: true })
+      );
+      table(
+        "Adapter inventory",
+        "Configuration status only; scripts and variables are excluded.",
+        ["Status", "Count"],
+        groups(rows.map((r) => r.status))
+      );
+    }
+  );
+  report.health = report.sources.every((s) => s.status === "unavailable") ? "unknown" : report.findings.some((f) => f.priority === "attention") ? "attention" : report.findings.length ? "review" : "no-findings";
+  report.generatedAt = now().toISOString();
+  return report;
+}
+
+// src/reports/redteam-render.ts
 import { createHash } from "crypto";
 var HEALTH = {
   attention: "Attention required",
@@ -2509,7 +2804,107 @@ var HEALTH = {
   "no-findings": "No findings in available evidence",
   unknown: "Unable to assess"
 };
-function html(value) {
+var html = (v) => String(v ?? "Unknown").replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+var md = (v) => String(v ?? "Unknown").replace(
+  /[&<>"'\\`*_[\]{}()|!#~\r\n]/g,
+  (c) => /[\r\n]/.test(c) ? " " : `&#${c.charCodeAt(0)};`
+);
+function tables(r) {
+  return [
+    ...r.tables,
+    {
+      title: "Evidence and completeness",
+      note: "Complete means the source was collected within its budget, not that the environment is secure. Unavailable is not zero.",
+      headers: ["Source", "SDK method", "Window", "Status", "Records", "Pages", "Notes"],
+      rows: r.sources.map((s) => [
+        s.name,
+        s.method,
+        s.window,
+        s.status,
+        s.records,
+        s.pages,
+        s.notes.join(" ") || "Collection completed."
+      ])
+    }
+  ];
+}
+function renderRedTeamReportMarkdown(r) {
+  const lines = [
+    `# ${md(r.title)}`,
+    "",
+    `**${r.product}**`,
+    "",
+    `Assessment: **${HEALTH[r.health]}**`,
+    "",
+    `Collection: ${r.collectionStartedAt} \u2192 ${r.generatedAt}`,
+    "",
+    `Scan creation window (UTC): ${r.window.start} \u2192 ${r.window.end}`,
+    "",
+    "## What needs attention",
+    ""
+  ];
+  for (const f of r.findings)
+    lines.push(
+      `### ${f.priority.toUpperCase()}: ${md(f.title)}`,
+      "",
+      `Evidence: ${md(f.evidence)}`,
+      "",
+      `Next step: ${md(f.recommendation)}`,
+      "",
+      `Source: ${md(f.source)}`,
+      ""
+    );
+  if (!r.findings.length)
+    lines.push("No findings in available evidence; this does not establish absence of risk.", "");
+  for (const t of tables(r)) {
+    lines.push(`## ${md(t.title)}`, "", md(t.note), "");
+    if (t.rows.length)
+      lines.push(
+        `| ${t.headers.map(md).join(" | ")} |`,
+        `| ${t.headers.map(() => "---").join(" | ")} |`,
+        ...t.rows.map((row) => `| ${row.map(md).join(" | ")} |`),
+        ""
+      );
+    else
+      lines.push(
+        "No rows collected; consult source completeness before interpreting this as empty.",
+        ""
+      );
+  }
+  lines.push(
+    "## Scope and limitations",
+    "",
+    ...r.limitations.map((v) => `- ${md(v)}`),
+    "",
+    `Prisma AIRS CLI \xB7 Red Team report schema ${r.schemaVersion}`,
+    ""
+  );
+  return lines.join("\n");
+}
+var CSS = `
+:root{font:16px/1.6 system-ui,sans-serif;color:#193449;background:#f0f4f7}*{box-sizing:border-box}body{margin:0}header{background:#152e43;color:white;padding:3rem max(1rem,calc((100vw - 1160px)/2))}h1{font-size:clamp(1.8rem,4vw,3rem);line-height:1.15}h1,h2,h3,p,td{overflow-wrap:anywhere}main{max-width:1200px;margin:auto;padding:1rem}section,article{padding:1.4rem;background:white;border:1px solid #cddbe4;border-radius:10px;margin:1rem 0}.finding{border-left:5px solid #b08528}.finding[data-priority=attention]{border-left-color:#b1392d}.note{color:#536575;font-size:.9rem}.badge{border:1px solid;padding:.3rem .8rem;border-radius:30px;display:inline-block}nav,.controls{display:flex;gap:1rem;flex-wrap:wrap}button,select{font:inherit;padding:.4rem;border:1px solid #526778;border-radius:5px;background:white;color:#193449}a{color:#006b63}.table-wrap{overflow:auto}table{border-collapse:collapse;width:100%;text-align:left}th,td{padding:.7rem;border-bottom:1px solid #d4dfe6;vertical-align:top}th{background:#edf3f7}caption{text-align:left}footer{padding:1rem;color:#536575}.js-only{display:none}.ready .js-only{display:flex}[hidden]{display:none!important}:focus-visible{outline:3px solid #ae6816;outline-offset:3px}.skip{position:absolute;left:-10000px}.skip:focus{left:1rem;top:1rem;background:white;padding:1rem}@media(max-width:600px){header{padding:1.5rem 1rem}section{padding:1rem}th,td{padding:.5rem}}@media print{body{background:white;font-size:10pt}header{background:white;color:black;padding:0}main{max-width:none;padding:0}nav,.controls,.skip{display:none!important}[hidden]{display:revert!important}.table-wrap{overflow:visible}section{border:0;padding:0}article{break-inside:avoid}}
+`;
+var JS = `'use strict';document.documentElement.classList.add('ready');document.getElementById('print').addEventListener('click',function(){window.print()});document.getElementById('priority').addEventListener('change',function(){var n=0;document.querySelectorAll('.finding').forEach(function(e){e.hidden=this.value!=='all'&&e.dataset.priority!==this.value;if(!e.hidden)n++},this);document.getElementById('count').textContent=n+' findings shown'});`;
+function renderRedTeamReportHtml(r) {
+  const hash = (v) => createHash("sha256").update(v).digest("base64");
+  const policy = `default-src 'none'; script-src 'sha256-${hash(JS)}'; style-src 'sha256-${hash(CSS)}'; connect-src 'none'; base-uri 'none'; form-action 'none'`;
+  const sections = tables(r).map(
+    (t, i) => `<section id="table-${i}"><h2>${html(t.title)}</h2><p class="note">${html(t.note)}</p>${t.rows.length ? `<div class="table-wrap" role="region" aria-label="${html(t.title)}" tabindex="0"><table><caption>${t.rows.length} aggregate rows</caption><thead><tr>${t.headers.map((v) => `<th scope="col">${html(v)}</th>`).join("")}</tr></thead><tbody>${t.rows.map((row) => `<tr>${row.map((v) => `<td>${html(v)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>` : "<p>No rows collected; consult source completeness before interpreting this as empty.</p>"}</section>`
+  ).join("");
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${html(policy)}"><meta name="referrer" content="no-referrer"><title>${html(r.title)}</title><style>${CSS}</style></head><body><a class="skip" href="#main">Skip to report</a><header><p>${r.product}</p><h1>${html(r.title)}</h1><span class="badge">${HEALTH[r.health]}</span><p>Collection: ${html(r.collectionStartedAt)} \u2192 ${html(r.generatedAt)}</p><p>Scan creation window (UTC): ${html(r.window.start)} \u2192 ${html(r.window.end)}</p><p>Read-only evidence \xB7 Confidential environment metadata</p></header><main id="main"><nav aria-label="Report sections"><a href="#findings">Attention</a><a href="#table-0">Evidence tables</a><a href="#scope">Scope</a></nav><section id="findings"><h2>What needs attention</h2><div class="controls js-only"><label for="priority">Priority</label><select id="priority"><option value="all">All</option><option value="attention">Attention</option><option value="review">Review</option></select><span id="count" role="status"></span><button id="print" type="button">Print / save PDF</button></div>${r.findings.map((f) => `<article class="finding" data-priority="${html(f.priority)}"><h3>${html(f.title)}</h3><p>${html(f.evidence)}</p><p><strong>Next step:</strong> ${html(f.recommendation)}</p><p class="note">${html(f.source)}</p></article>`).join("") || "<p>No findings in available evidence; this does not establish absence of risk.</p>"}</section>${sections}<section id="scope"><h2>Scope and limitations</h2><ul>${r.limitations.map((v) => `<li>${html(v)}</li>`).join("")}</ul></section><footer>Prisma AIRS CLI \xB7 Red Team report schema ${r.schemaVersion} \xB7 Works offline and without JavaScript.</footer></main><script>${JS}</script></body></html>
+`;
+}
+
+// src/reports/render.ts
+import { createHash as createHash2 } from "crypto";
+var HEALTH2 = {
+  attention: "Attention required",
+  review: "Review required",
+  "no-findings": "No findings in available evidence",
+  unknown: "Unable to assess"
+};
+function html2(value) {
   return String(value ?? "Unknown").replace(
     /[&<>"']/g,
     (char) => ({
@@ -2521,7 +2916,7 @@ function html(value) {
     })[char] ?? char
   );
 }
-function md(value) {
+function md2(value) {
   return String(value ?? "Unknown").replace(
     /[&<>"'\\`*_[\]{}()|!#~\r\n]/g,
     (char) => char === "\r" || char === "\n" ? " " : `&#${char.charCodeAt(0)};`
@@ -2530,7 +2925,7 @@ function md(value) {
 function number(value) {
   return value === null ? "Unknown" : value.toLocaleString("en-US", { maximumFractionDigits: 2 });
 }
-function tables(report) {
+function tables2(report) {
   const sessionSource = report.sources.find((source2) => source2.name === "Daily session inventory");
   return [
     {
@@ -2660,15 +3055,15 @@ function metrics(report) {
 }
 function renderRuntimeReportMarkdown(report) {
   const lines = [
-    `# ${md(report.title)}`,
+    `# ${md2(report.title)}`,
     "",
-    `**${md(report.product)}**`,
+    `**${md2(report.product)}**`,
     "",
-    `Assessment: **${HEALTH[report.health]}**`,
+    `Assessment: **${HEALTH2[report.health]}**`,
     "",
-    `Window: ${md(report.window.start)} \u2192 ${md(report.window.end)}`,
+    `Window: ${md2(report.window.start)} \u2192 ${md2(report.window.end)}`,
     "",
-    `${md(report.window.description)}. Collection: ${md(report.collectionStartedAt)} \u2192 ${md(report.generatedAt)}.`,
+    `${md2(report.window.description)}. Collection: ${md2(report.collectionStartedAt)} \u2192 ${md2(report.generatedAt)}.`,
     "",
     "## At a glance",
     "",
@@ -2684,17 +3079,17 @@ function renderRuntimeReportMarkdown(report) {
     );
   for (const finding of report.findings)
     lines.push(
-      `### ${finding.priority.toUpperCase()}: ${md(finding.title)}`,
+      `### ${finding.priority.toUpperCase()}: ${md2(finding.title)}`,
       "",
-      `Evidence: ${md(finding.evidence)}`,
+      `Evidence: ${md2(finding.evidence)}`,
       "",
-      `Next step: ${md(finding.recommendation)}`,
+      `Next step: ${md2(finding.recommendation)}`,
       "",
-      `Source: ${md(finding.source)}`,
+      `Source: ${md2(finding.source)}`,
       ""
     );
-  for (const table of tables(report)) {
-    lines.push(`## ${table.title}`, "", md(table.note), "");
+  for (const table of tables2(report)) {
+    lines.push(`## ${table.title}`, "", md2(table.note), "");
     if (table.rows.length === 0)
       lines.push(
         "No rows available. Consult the source status before interpreting this as an empty result.",
@@ -2704,21 +3099,21 @@ function renderRuntimeReportMarkdown(report) {
       lines.push(
         `| ${table.headers.join(" | ")} |`,
         `| ${table.headers.map(() => "---").join(" | ")} |`,
-        ...table.rows.map((row) => `| ${row.map(md).join(" | ")} |`),
+        ...table.rows.map((row) => `| ${row.map(md2).join(" | ")} |`),
         ""
       );
   }
   lines.push(
     "## Scope, privacy, and limitations",
     "",
-    ...report.limitations.map((note) => `- ${md(note)}`),
+    ...report.limitations.map((note) => `- ${md2(note)}`),
     "",
     `Generated by Prisma AIRS CLI \xB7 Report schema ${report.schemaVersion}`,
     ""
   );
   return lines.join("\n");
 }
-var CSS = `
+var CSS2 = `
 #evidence td:nth-child(3){white-space:nowrap}
 :root{color-scheme:light;--ink:#172b40;--muted:#526476;--line:#d8e2e9;--bg:#f2f5f8;--accent:#00786e;font:16px/1.55 system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}
 *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink)}a{color:var(--accent)}header{background:#11283d;color:#fff;padding:2.5rem max(1.25rem,calc((100vw - 1240px)/2))}header p{color:#d7e4ec;max-width:85ch}h1{font-size:clamp(1.8rem,4vw,2.7rem);line-height:1.15;margin:.6rem 0 1rem;overflow-wrap:anywhere}h2{font-size:1.35rem;margin:0 0 .6rem}h3{font-size:1.05rem;margin:.35rem 0}p{margin:.5rem 0 1rem}.eyebrow{font-size:.8rem;letter-spacing:.12em;text-transform:uppercase}.badge{display:inline-block;padding:.35rem .7rem;border:1px solid currentColor;border-radius:100px;font-weight:650;background:#fff;color:var(--ink)}.attention .badge{color:#a62b1b}.review .badge{color:#795500}.unknown .badge{color:#69439b}.no-findings .badge{color:#006a54}
@@ -2726,7 +3121,7 @@ main{max-width:1280px;margin:auto;padding:1.5rem 1.25rem 3rem}nav{display:flex;g
 @media(max-width:760px){.cards{grid-template-columns:repeat(2,minmax(0,1fr))}section{padding:1rem}header{padding:1.5rem 1.25rem}.card strong{font-size:1.5rem}}
 @media print{body{background:#fff;font-size:10pt}header{background:#fff;color:#000;padding:0}header p{color:#333}main{padding:0;max-width:none}nav,.toolbar,.skip{display:none!important}section,.card{border-radius:0;break-inside:auto}.finding,.card{break-inside:avoid}.table-wrap{overflow:visible}table{font-size:8pt}th,td{min-width:0;padding:.3rem}.hidden,[hidden]{display:revert!important}h2,h3{break-after:avoid}a{color:#000}}
 `;
-var JS = `
+var JS2 = `
 'use strict';
 document.documentElement.classList.add('js-ready');
 document.getElementById('print-report').addEventListener('click',function(){window.print();});
@@ -2744,21 +3139,21 @@ search.addEventListener('input',function(){
 });
 `;
 function renderRuntimeReportHtml(report) {
-  const hash = (text) => createHash("sha256").update(text).digest("base64");
-  const policy = `default-src 'none'; script-src 'sha256-${hash(JS)}'; style-src 'sha256-${hash(CSS)}'; base-uri 'none'; form-action 'none'; connect-src 'none'; img-src 'none'`;
+  const hash = (text) => createHash2("sha256").update(text).digest("base64");
+  const policy = `default-src 'none'; script-src 'sha256-${hash(JS2)}'; style-src 'sha256-${hash(CSS2)}'; base-uri 'none'; form-action 'none'; connect-src 'none'; img-src 'none'`;
   const findingCards = report.findings.map(
-    (finding) => `<article class="finding" data-priority="${html(finding.priority)}"><span class="priority">${html(finding.priority)}</span><h3>${html(finding.title)}</h3><p><strong>Evidence:</strong> ${html(finding.evidence)}</p><p><strong>Next step:</strong> ${html(finding.recommendation)}</p><p class="note">Source: ${html(finding.source)}</p></article>`
+    (finding) => `<article class="finding" data-priority="${html2(finding.priority)}"><span class="priority">${html2(finding.priority)}</span><h3>${html2(finding.title)}</h3><p><strong>Evidence:</strong> ${html2(finding.evidence)}</p><p><strong>Next step:</strong> ${html2(finding.recommendation)}</p><p class="note">Source: ${html2(finding.source)}</p></article>`
   ).join("");
-  const sections = tables(report).map(
-    (table) => `<section id="${table.id}" aria-labelledby="${table.id}-title"><h2 id="${table.id}-title">${table.title}</h2><p class="note">${html(table.note)}</p>${table.id === "applications" ? '<div class="toolbar js-only"><label for="app-search">Find an application</label><input id="app-search" type="search" placeholder="Filter application buckets"><span id="app-count" role="status"></span></div>' : ""}${table.rows.length ? `<div class="table-wrap" role="region" aria-label="${table.title}" tabindex="0"><table><caption>${table.rows.length} collected rows</caption><thead><tr>${table.headers.map((header) => `<th scope="col">${header}</th>`).join("")}</tr></thead><tbody>${table.rows.map((row) => `<tr>${row.map((cell) => `<td>${html(cell)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>` : "<p>No rows available. Consult the source status before interpreting this as an empty result.</p>"}</section>`
+  const sections = tables2(report).map(
+    (table) => `<section id="${table.id}" aria-labelledby="${table.id}-title"><h2 id="${table.id}-title">${table.title}</h2><p class="note">${html2(table.note)}</p>${table.id === "applications" ? '<div class="toolbar js-only"><label for="app-search">Find an application</label><input id="app-search" type="search" placeholder="Filter application buckets"><span id="app-count" role="status"></span></div>' : ""}${table.rows.length ? `<div class="table-wrap" role="region" aria-label="${table.title}" tabindex="0"><table><caption>${table.rows.length} collected rows</caption><thead><tr>${table.headers.map((header) => `<th scope="col">${header}</th>`).join("")}</tr></thead><tbody>${table.rows.map((row) => `<tr>${row.map((cell) => `<td>${html2(cell)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>` : "<p>No rows available. Consult the source status before interpreting this as an empty result.</p>"}</section>`
   ).join("");
   return `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${html(policy)}"><meta name="referrer" content="no-referrer"><title>${html(report.title)} \u2014 Prisma AIRS</title><style>${CSS}</style></head>
-<body class="${html(report.health)}"><a class="skip" href="#main">Skip to report</a><header><div class="eyebrow">Prisma AIRS \xB7 AI Runtime Security</div><h1>${html(report.title)}</h1><span class="badge">${HEALTH[report.health]}</span><p>${html(report.window.description)}<br><time>${html(report.window.start)}</time> \u2192 <time>${html(report.window.end)}</time></p><p>Collected ${html(report.collectionStartedAt)} \u2192 ${html(report.generatedAt)}<br>Read-only evidence \xB7 Confidential environment metadata</p></header>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${html2(policy)}"><meta name="referrer" content="no-referrer"><title>${html2(report.title)} \u2014 Prisma AIRS</title><style>${CSS2}</style></head>
+<body class="${html2(report.health)}"><a class="skip" href="#main">Skip to report</a><header><div class="eyebrow">Prisma AIRS \xB7 AI Runtime Security</div><h1>${html2(report.title)}</h1><span class="badge">${HEALTH2[report.health]}</span><p>${html2(report.window.description)}<br><time>${html2(report.window.start)}</time> \u2192 <time>${html2(report.window.end)}</time></p><p>Collected ${html2(report.collectionStartedAt)} \u2192 ${html2(report.generatedAt)}<br>Read-only evidence \xB7 Confidential environment metadata</p></header>
 <main id="main"><nav aria-label="Report sections"><a href="#findings">Attention</a><a href="#applications">Activity</a><a href="#profiles">Profiles</a><a href="#inventory">Inventory</a><a href="#evidence">Evidence</a><a href="#scope">Scope</a></nav>
 <div class="cards">${metrics(report).map(([name, value]) => `<div class="card"><span>${name}</span><strong>${value}</strong></div>`).join("")}</div>
 <section id="findings"><h2>What needs attention</h2><p class="note">Observed violations and configuration review items, not a numerical health score. Collection gaps remain visible in the evidence table.</p><div class="toolbar js-only"><label for="finding-filter">Priority</label><select id="finding-filter"><option value="all">All findings</option><option value="attention">Attention</option><option value="review">Review</option><option value="info">Information</option></select><span id="finding-count" role="status"></span><button id="print-report" type="button">Print / save PDF</button></div>${findingCards || "<p>No findings in the available evidence. This does not establish an absence of risk.</p>"}</section>
-${sections}<section id="scope"><h2>Scope, privacy, and limitations</h2><ul>${report.limitations.map((note) => `<li>${html(note)}</li>`).join("")}</ul></section><footer>Generated by Prisma AIRS CLI \xB7 Report schema ${report.schemaVersion} \xB7 Self-contained HTML; no network access required. All evidence remains readable with JavaScript disabled.</footer></main><script>${JS}</script></body></html>
+${sections}<section id="scope"><h2>Scope, privacy, and limitations</h2><ul>${report.limitations.map((note) => `<li>${html2(note)}</li>`).join("")}</ul></section><footer>Generated by Prisma AIRS CLI \xB7 Report schema ${report.schemaVersion} \xB7 Self-contained HTML; no network access required. All evidence remains readable with JavaScript disabled.</footer></main><script>${JS2}</script></body></html>
 `;
 }
 
@@ -2778,10 +3173,10 @@ function safeFailure(error) {
   }
   return "Source request or response validation failed; check connectivity and SDK compatibility.";
 }
-function label(value) {
+function label2(value) {
   return (value?.replace(/[\p{Cc}\p{Cf}]/gu, " ").trim() || "Unknown").slice(0, 240);
 }
-function count(value) {
+function count2(value) {
   return Number.isSafeInteger(value) && value >= 0 ? value : null;
 }
 async function collect(source2, maxPages, read, identity) {
@@ -2831,23 +3226,23 @@ function inventoryNext(next, size, offset) {
 function total(values) {
   if (values.some((value) => value === null)) return null;
   const result = values.reduce((sum, value) => sum + (value ?? 0), 0);
-  return count(result);
+  return count2(result);
 }
 function distribution(rows) {
   const groups = /* @__PURE__ */ new Map();
   for (const row of rows) {
-    const name = label(row.violation_status).toLowerCase();
+    const name = label2(row.violation_status).toLowerCase();
     groups.set(name, (groups.get(name) ?? 0) + 1);
   }
   return [...groups].map(([name, n]) => ({ name, count: n })).sort((a, b) => b.count - a.count);
 }
 function severity(value) {
   return {
-    critical: count(value.critical),
-    high: count(value.high),
-    medium: count(value.medium),
-    low: count(value.low),
-    total: count(value.total)
+    critical: count2(value.critical),
+    high: count2(value.high),
+    medium: count2(value.medium),
+    low: count2(value.low),
+    total: count2(value.total)
   };
 }
 async function collectRuntimeDailyReport(client, options = {}) {
@@ -2910,7 +3305,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
           offset
         });
         const size = page.items?.length ?? 0;
-        const totalItems = count(page.pagination?.total_items);
+        const totalItems = count2(page.pagination?.total_items);
         if (totalItems !== null) {
           if (expectedAppTotal !== void 0 && totalItems !== expectedAppTotal)
             throw new ReportDataError(
@@ -2962,7 +3357,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
       async (offset) => {
         const page = await client.dashboard.sessionsOverview({ ...daily, limit: 25, offset });
         const size = page.items?.length ?? 0;
-        const totalItems = count(page.pagination?.total_items);
+        const totalItems = count2(page.pagination?.total_items);
         if (totalItems === null || page.pagination?.skip !== offset || page.pagination?.limit !== 25)
           throw new ReportDataError("Missing or mismatched session pagination metadata.");
         if (expectedSessionTotal !== void 0 && expectedSessionTotal !== totalItems)
@@ -3018,9 +3413,9 @@ async function collectRuntimeDailyReport(client, options = {}) {
   }
   const appIds = new Set(registered.map((app) => app.customer_appId));
   const reportApps = applications.map((app) => ({
-    name: label(app.name),
-    sessions: count(app.sessions_total),
-    violatingSessions: count(app.sessions_violated),
+    name: label2(app.name),
+    sessions: count2(app.sessions_total),
+    violatingSessions: count2(app.sessions_violated),
     registered: app.id && appIds.has(app.id) ? true : appSource.status === "complete" && app.id ? false : null
   })).sort(
     (a, b) => (b.violatingSessions ?? -1) - (a.violatingSessions ?? -1) || a.name.localeCompare(b.name)
@@ -3066,9 +3461,9 @@ async function collectRuntimeDailyReport(client, options = {}) {
       (p) => p["model-configuration"] ? [p["model-configuration"]] : []
     );
     const timeoutActions = [
-      ...new Set(configs.map((c) => label(c.latency?.["inline-timeout-action"])))
+      ...new Set(configs.map((c) => label2(c.latency?.["inline-timeout-action"])))
     ];
-    const name = label(profile.profile_name);
+    const name = label2(profile.profile_name);
     if (profile.active === false)
       add(
         "review",
@@ -3097,7 +3492,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
       );
     return {
       name,
-      revision: count(profile.revision),
+      revision: count2(profile.revision),
       active: profile.active ?? null,
       modified: profile.last_modified_ts && Number.isFinite(Date.parse(profile.last_modified_ts)) ? new Date(profile.last_modified_ts).toISOString() : null,
       timeoutActions,
@@ -3145,8 +3540,8 @@ async function collectRuntimeDailyReport(client, options = {}) {
       "Review these sessions in SCM and check integration error handling. This is not a tenant-wide failure rate.",
       sessionSource.name
     );
-  const chartSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count(bucket.total)));
-  const chartViolatingSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count(bucket.violating)));
+  const chartSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count2(bucket.total)));
+  const chartViolatingSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count2(bucket.violating)));
   if (chartSessions !== null && sessionSource.status === "complete" && chartSessions !== rawSessions.length)
     add(
       "review",
@@ -3157,7 +3552,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
     );
   const urgentViolations = total(
     trend.map(
-      (bucket) => total([count(bucket.violation_breakdown.critical), count(bucket.violation_breakdown.high)])
+      (bucket) => total([count2(bucket.violation_breakdown.critical), count2(bucket.violation_breakdown.high)])
     )
   );
   if ((urgentViolations ?? 0) > 0)
@@ -3173,7 +3568,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
   return {
     schemaVersion: 2,
     product: "Prisma AIRS AI Runtime Security",
-    title: label(options.title ?? "Daily environment report"),
+    title: label2(options.title ?? "Daily environment report"),
     generatedAt: now().toISOString(),
     collectionStartedAt: end,
     window: {
@@ -3192,10 +3587,10 @@ async function collectRuntimeDailyReport(client, options = {}) {
     },
     profiles,
     registeredApps: registered.map((app) => ({
-      name: label(app.app_name),
-      environment: label(app.environment),
-      cloud: label(app.cloud_provider),
-      model: label(app.model_name),
+      name: label2(app.app_name),
+      environment: label2(app.environment),
+      cloud: label2(app.cloud_provider),
+      model: label2(app.model_name),
       keyAssociations: app.api_keys_dp_info ? app.api_keys_dp_info.length : null
     })).sort((a, b) => a.name.localeCompare(b.name)),
     sessions: {
@@ -3210,22 +3605,22 @@ async function collectRuntimeDailyReport(client, options = {}) {
         sessions: chartSessions,
         violatingSessions: chartViolatingSessions,
         buckets: chart.map((bucket) => ({
-          time: label(bucket.time),
-          sessions: count(bucket.total),
-          violatingSessions: count(bucket.violating),
+          time: label2(bucket.time),
+          sessions: count2(bucket.total),
+          violatingSessions: count2(bucket.violating),
           violations: severity(bucket.violation_breakdown)
         }))
       },
       topApplications: rankings.map((app) => ({
-        name: label(app.name),
-        violations: count(app.total_violations),
+        name: label2(app.name),
+        violations: count2(app.total_violations),
         detectors: app.policy_violations.map((detector) => ({
-          name: label(detector.detection_type),
-          count: count(detector.total)
+          name: label2(detector.detection_type),
+          count: count2(detector.total)
         }))
       })),
       violationTrend: trend.map((bucket) => ({
-        time: label(bucket.date),
+        time: label2(bucket.date),
         violations: severity(bucket.violation_breakdown)
       }))
     },
@@ -3268,6 +3663,9 @@ export {
   computeMetrics,
   computeCategoryBreakdown,
   writeReportFile,
+  collectRedTeamEnvironmentReport,
+  renderRedTeamReportMarkdown,
+  renderRedTeamReportHtml,
   renderRuntimeReportMarkdown,
   renderRuntimeReportHtml,
   collectRuntimeDailyReport

package/dist/cli/index.js

@@ -9,6 +9,7 @@ import {
   SdkPromptSetService,
   SdkRedTeamService,
   SdkRuntimeService,
+  collectRedTeamEnvironmentReport,
   collectRuntimeDailyReport,
   computeMetrics,
   getOrCreateManagementClient,
@@ -16,6 +17,8 @@ import {
   loadConfig,
   readBackupDir,
   readBackupFile,
+  renderRedTeamReportHtml,
+  renderRedTeamReportMarkdown,
   renderRuntimeReportHtml,
   renderRuntimeReportMarkdown,
   resolveConfigFilePath,
@@ -24,7 +27,7 @@ import {
   validateTopic,
   writeBackupFile,
   writeReportFile
-} from "../chunk-IRLIFMGQ.js";
+} from "../chunk-DR6MZG4E.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -43,7 +46,7 @@ function installProcessGuards() {
 }
 
 // src/cli/program.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
@@ -3052,8 +3055,8 @@ function registerAiGatewayInference(parent) {
         process.once("SIGINT", interrupt);
         process.once("SIGTERM", interrupt);
         process.stdout.on("error", outputError);
-        const write = (text2) => new Promise((resolve4, reject) => {
-          process.stdout.write(text2, (error) => error ? reject(error) : resolve4());
+        const write = (text2) => new Promise((resolve5, reject) => {
+          process.stdout.write(text2, (error) => error ? reject(error) : resolve5());
         });
         const requestOptions = { signal: controller.signal };
         const result = kind === "chat" ? await client.createChatCompletion(
@@ -5296,8 +5299,8 @@ async function withTimeout(promise, ms) {
   try {
     return await Promise.race([
       promise,
-      new Promise((resolve4) => {
-        timer = setTimeout(() => resolve4(TIMED_OUT), ms);
+      new Promise((resolve5) => {
+        timer = setTimeout(() => resolve5(TIMED_OUT), ms);
       })
     ]);
   } finally {
@@ -5567,12 +5570,12 @@ function hasBin(bin) {
   }
 }
 function run(bin, args, label) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const child = spawn(bin, args, { stdio: "inherit" });
     child.on("error", (err) => reject(new Error(`Failed to start ${bin}: ${err.message}`)));
     child.on("close", (code) => {
       if (code !== 0) reject(new Error(`${label} failed with exit code ${code}`));
-      else resolve4();
+      else resolve5();
     });
   });
 }
@@ -6150,6 +6153,76 @@ async function backupTargets(opts) {
   return results;
 }
 
+// src/cli/commands/redteam-dashboard.ts
+import { lstat } from "fs/promises";
+import { resolve } from "path";
+import { RedTeamClient } from "@cdot65/prisma-airs-sdk";
+import { randomUUID as randomUUID2 } from "crypto";
+function registerRedTeamDashboardCommand(redteam) {
+  const command = redteam.command("dashboard").description("Generate a Red Team environment dashboard (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
+    "--output-file <path>",
+    "Destination (default: new timestamped file in CWD); - for stdout; never overwrite"
+  ).option("--title <text>", "Report title", "Red Team environment report").option("--max-pages <n>", "Page budget per source, 1\u2013100 (15 records/page)", "40").option("--strict", "Exit 1 after writing if any source is incomplete").addHelpText(
+    "after",
+    examples(
+      "airs redteam dashboard --output-file ./airs-daily.html",
+      "airs redteam dashboard --output markdown --output-file ./airs-daily.md",
+      "airs redteam dashboard",
+      "airs redteam dashboard --strict --max-pages 20 --output-file - > daily.html"
+    )
+  ).action(async (opts) => {
+    const format = opts.output ?? command.parent?.parent?.opts().output ?? "html";
+    if (format !== "html" && format !== "markdown")
+      usageError("Report output must be html or markdown");
+    const maxPages = Number(opts.maxPages);
+    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages) || maxPages > 100)
+      usageError("--max-pages must be an integer from 1 to 100");
+    if (typeof opts.title !== "string" || !opts.title.trim() || opts.title.length > 240)
+      usageError("--title must contain 1\u2013240 characters");
+    if (opts.outputFile !== void 0 && !opts.outputFile.trim())
+      usageError("--output-file cannot be empty");
+    const defaultName = `airs-redteam-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID2().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve(opts.outputFile ?? defaultName);
+    try {
+      if (outputPath) {
+        const existing = await lstat(outputPath).catch((error) => {
+          if (error.code !== "ENOENT") throw error;
+          return void 0;
+        });
+        if (existing) throw new Error("Output already exists");
+      }
+      const config = await loadConfig();
+      const client = new RedTeamClient({
+        ...redTeamClientOptions(config),
+        numRetries: 0
+      });
+      ui.status("Collecting Red Team statistics and current configuration (read-only)...");
+      const report = await collectRedTeamEnvironmentReport(client, {
+        title: opts.title,
+        maxPages
+      });
+      const rendered = format === "html" ? renderRedTeamReportHtml(report) : renderRedTeamReportMarkdown(report);
+      if (outputPath) {
+        await writeReportFile(outputPath, rendered);
+        ui.status(`Report \u2192 ${outputPath.replace(/[\p{Cc}\p{Cf}]/gu, "_")} (mode 0600)`);
+      } else {
+        await new Promise(
+          (done, reject) => process.stdout.write(rendered, (error) => error ? reject(error) : done())
+        );
+      }
+      const incomplete = report.sources.filter((source) => source.status !== "complete").length;
+      if (incomplete)
+        ui.status(`${incomplete} source(s) incomplete; review the evidence section.`);
+      if (report.health === "unknown" || opts.strict && incomplete > 0) process.exitCode = 1;
+    } catch {
+      ui.error(
+        "Report generation failed. Verify Management API configuration and a writable, new output path. Existing files are never overwritten."
+      );
+      process.exitCode = 1;
+    }
+  });
+}
+
 // src/cli/commands/restore.ts
 var SERVER_DERIVED_FIELDS = [
   "uuid",
@@ -6392,6 +6465,7 @@ function parseAdapterVariables(input) {
 }
 function registerRedteamCommand(program) {
   const redteam = program.command("redteam").description("AI Red Team scan operations");
+  registerRedTeamDashboardCommand(redteam);
   redteam.command("abort <jobId>").description("Abort a running scan").action(async (jobId) => {
     try {
       renderRedteamHeader();
@@ -7385,7 +7459,7 @@ function registerRedteamCommand(program) {
 }
 
 // src/cli/commands/runtime.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import * as fs5 from "fs";
 import { readFile as readFile10 } from "fs/promises";
 import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
@@ -7633,7 +7707,7 @@ function mergeProfilePolicy(existing, overrides) {
 }
 
 // src/cli/bulk-scan-lock.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import * as fs3 from "fs/promises";
 function errorCode(error) {
   return error?.code;
@@ -7664,7 +7738,7 @@ function processIsAlive(pid) {
   }
 }
 async function installLock(lockPath, record) {
-  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID2()}`;
+  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID3()}`;
   try {
     await fs3.writeFile(candidate, JSON.stringify(record), {
       encoding: "utf-8",
@@ -7682,7 +7756,7 @@ async function acquireBulkScanLock(statePath) {
     version: 1,
     pid: process.pid,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    token: randomUUID2()
+    token: randomUUID3()
   };
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
@@ -7718,7 +7792,7 @@ async function acquireBulkScanLock(statePath) {
 }
 
 // src/cli/bulk-scan-state.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import * as fs4 from "fs/promises";
 import * as path2 from "path";
 import { z } from "zod";
@@ -7815,8 +7889,8 @@ async function saveBulkScanState(state, dir, filePath) {
   }
   await fs4.mkdir(dir, { recursive: true, mode: 448 });
   if (!filePath) await fs4.chmod(dir, 448);
-  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID3()}.bulk-scan.json`);
-  const temporary = `${target}.tmp-${process.pid}-${randomUUID3()}`;
+  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID4()}.bulk-scan.json`);
+  const temporary = `${target}.tmp-${process.pid}-${randomUUID4()}`;
   try {
     await fs4.writeFile(temporary, JSON.stringify(state, null, 2), {
       encoding: "utf-8",
@@ -8941,8 +9015,8 @@ function registerCleanupCommand(parent) {
 }
 
 // src/cli/commands/runtime-dashboard.ts
-import { lstat } from "fs/promises";
-import { resolve as resolve2 } from "path";
+import { lstat as lstat2 } from "fs/promises";
+import { resolve as resolve3 } from "path";
 import { dump as dump5 } from "js-yaml";
 var TIME_UNITS = ["hour", "hours", "day", "days"];
 function integer2(value, name, minimum = 0) {
@@ -9018,8 +9092,8 @@ function registerRuntimeDashboardCommands(runtime) {
               "Scan content requires exactly one of --show-content or --output-file <new-path>"
             );
           if (opts.outputFile) {
-            const path3 = resolve2(text(opts.outputFile, "--output-file"));
-            const existing = await lstat(path3).catch((error) => {
+            const path3 = resolve3(text(opts.outputFile, "--output-file"));
+            const existing = await lstat2(path3).catch((error) => {
               if (error.code !== "ENOENT") throw error;
               return void 0;
             });
@@ -9034,7 +9108,7 @@ function registerRuntimeDashboardCommands(runtime) {
         const result = await read(client.dashboard);
         const output = format === "yaml" ? dump5(result, { noRefs: true, lineWidth: -1 }).trimEnd() : JSON.stringify(result, null, 2);
         if (command.name() === "scan-content" && opts.outputFile) {
-          await writeReportFile(resolve2(String(opts.outputFile)), `${output}
+          await writeReportFile(resolve3(String(opts.outputFile)), `${output}
 `);
           ui.status("Scan content exported to the requested private file (0600).");
         } else console.log(output);
@@ -9205,9 +9279,9 @@ function registerRuntimeDashboardCommands(runtime) {
 }
 
 // src/cli/commands/runtime-report.ts
-import { lstat as lstat2 } from "fs/promises";
-import { resolve as resolve3 } from "path";
-import { randomUUID as randomUUID4 } from "crypto";
+import { lstat as lstat3 } from "fs/promises";
+import { resolve as resolve4 } from "path";
+import { randomUUID as randomUUID5 } from "crypto";
 function registerRuntimeReportCommand(runtime) {
   const command = runtime.command("report").description("Generate a daily AI Runtime Security environment dashboard (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
     "--output-file <path>",
@@ -9231,11 +9305,11 @@ function registerRuntimeReportCommand(runtime) {
       usageError("--title must contain 1\u2013240 characters");
     if (opts.outputFile !== void 0 && !opts.outputFile.trim())
       usageError("--output-file cannot be empty");
-    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID4().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
-    const outputPath = opts.outputFile === "-" ? void 0 : resolve3(opts.outputFile ?? defaultName);
+    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID5().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve4(opts.outputFile ?? defaultName);
     try {
       if (outputPath) {
-        const existing = await lstat2(outputPath).catch((error) => {
+        const existing = await lstat3(outputPath).catch((error) => {
           if (error.code !== "ENOENT") throw error;
           return void 0;
         });
@@ -9722,7 +9796,7 @@ function completedBulkResults(state) {
 }
 async function writeBulkResults(outputPath, results) {
   await fs5.promises.mkdir(dirname3(outputPath), { recursive: true });
-  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID5()}`;
+  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID6()}`;
   try {
     await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
       encoding: "utf-8",
@@ -10567,12 +10641,12 @@ function buildProgram() {
   program.hook("preAction", async (_thisCommand, actionCommand) => {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
-    const isRuntimeReport = actionCommand.name() === "report" && actionCommand.parent?.name() === "runtime";
-    if (isRuntimeReport && (root.debug || /^(1|true|yes|on)$/i.test(process.env.PANW_AI_SEC_DEBUG?.trim() ?? "")))
+    const isEnvironmentReport = actionCommand.name() === "report" && actionCommand.parent?.name() === "runtime" || actionCommand.name() === "dashboard" && actionCommand.parent?.name() === "redteam";
+    if (isEnvironmentReport && (root.debug || /^(1|true|yes|on)$/i.test(process.env.PANW_AI_SEC_DEBUG?.trim() ?? "")))
       usageError(
         "Disable --debug and PANW_AI_SEC_DEBUG for environment reports to avoid persisting sensitive traffic content"
       );
-    if (!isRuntimeReport && READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
+    if (!isEnvironmentReport && READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
       try {
         const format = await resolveOutput(actionCommand, actionCommand.opts());
         actionCommand.setOptionValueWithSource("output", format, "implied");
@@ -10583,7 +10657,7 @@ function buildProgram() {
     if (root.debug) {
       const logPath = join4(
         process.cwd(),
-        `debug-api-${Date.now()}-${randomUUID6().slice(0, 8)}.jsonl`
+        `debug-api-${Date.now()}-${randomUUID7().slice(0, 8)}.jsonl`
       );
       try {
         installDebugLogger(logPath);

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { CreateCustomTopicRequest, CustomTopic as CustomTopic$1, CreateSecurityProfileRequest, ManagementClientOptions, ModelSecurityClientOptions, RedTeamClientOptions, InitOptions, ManagementClient } from '@cdot65/prisma-airs-sdk';
+import { CreateCustomTopicRequest, CustomTopic as CustomTopic$1, CreateSecurityProfileRequest, ManagementClientOptions, ModelSecurityClientOptions, RedTeamClientOptions, InitOptions, ManagementClient, RedTeamClient, QuotaSummary } from '@cdot65/prisma-airs-sdk';
 import { z } from 'zod';
 
 /**
@@ -1970,6 +1970,45 @@ interface RuntimeReportOptions {
     now?: () => Date;
 }
 
+/** Read-only SDK surface; older SDK installations explicitly report quota as unavailable. */
+type RedTeamReportClient = Pick<RedTeamClient, 'getDashboardOverview' | 'getScanStatistics'> & {
+    targets: Pick<RedTeamClient['targets'], 'list'>;
+    scans: Pick<RedTeamClient['scans'], 'list'>;
+    adapters: Pick<RedTeamClient['adapters'], 'list'>;
+    networkBroker: Pick<RedTeamClient['networkBroker'], 'getChannelStats'>;
+    getQuotaSummary?: () => Promise<QuotaSummary>;
+};
+interface RedTeamReportTable {
+    title: string;
+    note: string;
+    headers: string[];
+    rows: Array<Array<string | number | null>>;
+}
+/** Aggregate-only projection: no target credentials, identities, scripts, prompts or raw responses. */
+interface RedTeamEnvironmentReport {
+    schemaVersion: 1;
+    product: 'Prisma AIRS AI Red Teaming';
+    title: string;
+    collectionStartedAt: string;
+    generatedAt: string;
+    window: {
+        start: string;
+        end: string;
+    };
+    health: 'attention' | 'review' | 'no-findings' | 'unknown';
+    sources: ReportSource[];
+    findings: ReportFinding[];
+    tables: RedTeamReportTable[];
+    limitations: string[];
+}
+/** Collect seven read-only feeds, with explicit source budgets and independent metric windows. */
+declare function collectRedTeamEnvironmentReport(client: RedTeamReportClient, options?: RuntimeReportOptions): Promise<RedTeamEnvironmentReport>;
+
+/** Portable Markdown using the same allowlisted evidence as the HTML dashboard. */
+declare function renderRedTeamReportMarkdown(r: RedTeamEnvironmentReport): string;
+/** Self-contained HTML with hash-based CSP, static inline JS/CSS and no remote resources. */
+declare function renderRedTeamReportHtml(r: RedTeamEnvironmentReport): string;
+
 /** Render the same evidence model as a portable, inert Markdown deliverable. */
 declare function renderRuntimeReportMarkdown(report: RuntimeDailyReport): string;
 /** Standalone HTML: inline CSS/JS, no dependencies, external requests, or embedded raw data. */
@@ -1981,4 +2020,4 @@ declare function renderRuntimeReportHtml(report: RuntimeDailyReport): string;
  */
 declare function collectRuntimeDailyReport(client: RuntimeReportClient, options?: RuntimeReportOptions): Promise<RuntimeDailyReport>;
 
-export { AirsScanService, type AnalysisReport, type ApiKeyInfo, type ApiKeyListResult, type BackupEnvelope, type BackupFormat, type BackupResult, type BatchEntry, type BulkScanAction, type BulkScanResult, type CategoryBreakdown, type ConsumptionAppListEntry, type ConsumptionQueryOptions, type ConsumptionTimeInterval, type CustomTopic, type CustomerAppConsumption, type CustomerAppInfo, type CustomerAppListResult, type DeleteResponse, type DeploymentProfileInfo, type EfficacyMetrics, type EulaContent, type EulaStatus, type IndexedPrompt, type InstanceDetail, type InstanceRequest, type InstanceResponse, type IterationResult, type ManagementService, type ModelSecurityEvaluation, type ModelSecurityFile, type ModelSecurityFileListOptions, type ModelSecurityGroup, type ModelSecurityGroupCreateRequest, type ModelSecurityGroupListOptions, type ModelSecurityGroupUpdateRequest, type ModelSecurityLabel, type ModelSecurityModel, type ModelSecurityModelListOptions, type ModelSecurityModelVersion, type ModelSecurityModelVersionListOptions, type ModelSecurityPyPIAuth, type ModelSecurityRule, type ModelSecurityRuleEditableField, type ModelSecurityRuleInstance, type ModelSecurityRuleInstanceListOptions, type ModelSecurityRuleInstanceUpdateRequest, type ModelSecurityRuleListOptions, type ModelSecurityScan, type ModelSecurityScanListOptions, type ModelSecurityService, type ModelSecurityViolation, type MutationResponse, type PaginationOptions, type PollRetryOptions, type ProfileTopic, type PromptDetail, type PromptSetDetail, type PromptSetService, type PromptSetVersionInfo, type PropertyValueList, type RedTeamAdapterCreateRequest, type RedTeamAdapterDetail, type RedTeamAdapterListItem, type RedTeamAdapterListOptions, type RedTeamAdapterUpdateOverrides, type RedTeamAdapterValidateRequest, type RedTeamAdapterValidationResult, type RedTeamAdapterVar, type RedTeamAttack, type RedTeamCategory, type RedTeamChannel, type RedTeamChannelCreateRequest, type RedTeamChannelListOptions, type RedTeamChannelStats, type RedTeamChannelUpdateRequest, type RedTeamCustomAttack, type RedTeamCustomReport, type RedTeamDynamicReport, type RedTeamErrorLog, type RedTeamJob, type RedTeamLanguages, type RedTeamService, type RedTeamStaticReport, type RedTeamTarget, type RedTeamTargetCreateRequest, type RedTeamTargetDetail, type RedTeamTargetUpdateRequest, type RegistryCredentials, type ReliableRuntimeService, type ReportApplication, type ReportDailyTelemetry, type ReportFinding, type ReportFormat, type ReportPriority, type ReportProfile, type ReportRegisteredApp, type ReportSessionSummary, type ReportSeverity, type ReportSource, type ReportSourceStatus, type ResourceType, type RestoreResult, type RunState, type RuntimeDailyReport, type RuntimeReportClient, type RuntimeReportOptions, type RuntimeScanResult, type RuntimeService, SDK_ASYNC_BATCH_SIZE, type ScanLogQueryOptions, type ScanLogQueryResult, type ScanResult, type ScanService, SdkManagementService, SdkModelSecurityService, SdkPromptSetService, SdkRedTeamService, SdkRuntimeService, type SecurityProfileInfo, type SecurityProfileListResult, type SubmittedBatch, type TargetAuthValidationRequest, type TargetAuthValidationResult, type TargetOperationOptions, type TestCase, type TestResult, type UserInput, type ValidationError, collectRuntimeDailyReport, computeCategoryBreakdown, computeMetrics, loadConfig, readBackupDir, readBackupFile, renderRuntimeReportHtml, renderRuntimeReportMarkdown, resolveOutputDir, sanitizeFilename, validateDescription, validateExamples, validateName, validateTopic, writeBackupFile, writeReportFile };
+export { AirsScanService, type AnalysisReport, type ApiKeyInfo, type ApiKeyListResult, type BackupEnvelope, type BackupFormat, type BackupResult, type BatchEntry, type BulkScanAction, type BulkScanResult, type CategoryBreakdown, type ConsumptionAppListEntry, type ConsumptionQueryOptions, type ConsumptionTimeInterval, type CustomTopic, type CustomerAppConsumption, type CustomerAppInfo, type CustomerAppListResult, type DeleteResponse, type DeploymentProfileInfo, type EfficacyMetrics, type EulaContent, type EulaStatus, type IndexedPrompt, type InstanceDetail, type InstanceRequest, type InstanceResponse, type IterationResult, type ManagementService, type ModelSecurityEvaluation, type ModelSecurityFile, type ModelSecurityFileListOptions, type ModelSecurityGroup, type ModelSecurityGroupCreateRequest, type ModelSecurityGroupListOptions, type ModelSecurityGroupUpdateRequest, type ModelSecurityLabel, type ModelSecurityModel, type ModelSecurityModelListOptions, type ModelSecurityModelVersion, type ModelSecurityModelVersionListOptions, type ModelSecurityPyPIAuth, type ModelSecurityRule, type ModelSecurityRuleEditableField, type ModelSecurityRuleInstance, type ModelSecurityRuleInstanceListOptions, type ModelSecurityRuleInstanceUpdateRequest, type ModelSecurityRuleListOptions, type ModelSecurityScan, type ModelSecurityScanListOptions, type ModelSecurityService, type ModelSecurityViolation, type MutationResponse, type PaginationOptions, type PollRetryOptions, type ProfileTopic, type PromptDetail, type PromptSetDetail, type PromptSetService, type PromptSetVersionInfo, type PropertyValueList, type RedTeamAdapterCreateRequest, type RedTeamAdapterDetail, type RedTeamAdapterListItem, type RedTeamAdapterListOptions, type RedTeamAdapterUpdateOverrides, type RedTeamAdapterValidateRequest, type RedTeamAdapterValidationResult, type RedTeamAdapterVar, type RedTeamAttack, type RedTeamCategory, type RedTeamChannel, type RedTeamChannelCreateRequest, type RedTeamChannelListOptions, type RedTeamChannelStats, type RedTeamChannelUpdateRequest, type RedTeamCustomAttack, type RedTeamCustomReport, type RedTeamDynamicReport, type RedTeamEnvironmentReport, type RedTeamErrorLog, type RedTeamJob, type RedTeamLanguages, type RedTeamReportClient, type RedTeamReportTable, type RedTeamService, type RedTeamStaticReport, type RedTeamTarget, type RedTeamTargetCreateRequest, type RedTeamTargetDetail, type RedTeamTargetUpdateRequest, type RegistryCredentials, type ReliableRuntimeService, type ReportApplication, type ReportDailyTelemetry, type ReportFinding, type ReportFormat, type ReportPriority, type ReportProfile, type ReportRegisteredApp, type ReportSessionSummary, type ReportSeverity, type ReportSource, type ReportSourceStatus, type ResourceType, type RestoreResult, type RunState, type RuntimeDailyReport, type RuntimeReportClient, type RuntimeReportOptions, type RuntimeScanResult, type RuntimeService, SDK_ASYNC_BATCH_SIZE, type ScanLogQueryOptions, type ScanLogQueryResult, type ScanResult, type ScanService, SdkManagementService, SdkModelSecurityService, SdkPromptSetService, SdkRedTeamService, SdkRuntimeService, type SecurityProfileInfo, type SecurityProfileListResult, type SubmittedBatch, type TargetAuthValidationRequest, type TargetAuthValidationResult, type TargetOperationOptions, type TestCase, type TestResult, type UserInput, type ValidationError, collectRedTeamEnvironmentReport, collectRuntimeDailyReport, computeCategoryBreakdown, computeMetrics, loadConfig, readBackupDir, readBackupFile, renderRedTeamReportHtml, renderRedTeamReportMarkdown, renderRuntimeReportHtml, renderRuntimeReportMarkdown, resolveOutputDir, sanitizeFilename, validateDescription, validateExamples, validateName, validateTopic, writeBackupFile, writeReportFile };

package/dist/index.js

@@ -6,12 +6,15 @@ import {
   SdkPromptSetService,
   SdkRedTeamService,
   SdkRuntimeService,
+  collectRedTeamEnvironmentReport,
   collectRuntimeDailyReport,
   computeCategoryBreakdown,
   computeMetrics,
   loadConfig,
   readBackupDir,
   readBackupFile,
+  renderRedTeamReportHtml,
+  renderRedTeamReportMarkdown,
   renderRuntimeReportHtml,
   renderRuntimeReportMarkdown,
   resolveOutputDir,
@@ -22,7 +25,7 @@ import {
   validateTopic,
   writeBackupFile,
   writeReportFile
-} from "./chunk-IRLIFMGQ.js";
+} from "./chunk-DR6MZG4E.js";
 export {
   AirsScanService,
   SDK_ASYNC_BATCH_SIZE,
@@ -31,12 +34,15 @@ export {
   SdkPromptSetService,
   SdkRedTeamService,
   SdkRuntimeService,
+  collectRedTeamEnvironmentReport,
   collectRuntimeDailyReport,
   computeCategoryBreakdown,
   computeMetrics,
   loadConfig,
   readBackupDir,
   readBackupFile,
+  renderRedTeamReportHtml,
+  renderRedTeamReportMarkdown,
   renderRuntimeReportHtml,
   renderRuntimeReportMarkdown,
   resolveOutputDir,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "5.0.1",
+  "version": "5.1.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",
@@ -59,7 +59,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@cdot65/prisma-airs-sdk": "0.26.0",
+    "@cdot65/prisma-airs-sdk": "0.27.0",
     "@inquirer/prompts": "^8.3.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",