@cdot65/prisma-airs-cli 5.0.1 → 5.2.0

package/dist/{chunk-IRLIFMGQ.js → chunk-7Z76VCB3.js}

@@ -2483,6 +2483,433 @@ function computeCategoryBreakdown(results) {
   })).sort((a, b) => b.errorRate - a.errorRate);
 }
 
+// src/reports/aigateway.ts
+function record(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) throw new Error("Invalid object");
+  return v;
+}
+function numeric(v, integer = false) {
+  if (v === null) return null;
+  if (typeof v !== "number" || !Number.isFinite(v) || integer && (!Number.isSafeInteger(v) || v < 0))
+    throw new Error("Invalid number");
+  return v;
+}
+function count(v) {
+  const n = numeric(v, true);
+  if (n === null) throw new Error("Missing count");
+  return n;
+}
+var CHARTS = {
+  requests: ["total"],
+  errors: ["total"],
+  users: ["total"],
+  cost: ["total", "avg"],
+  latency: ["total", "p50", "p90", "p99"],
+  tokens: ["total", "total_request_units", "total_response_units"],
+  cacheSummary: [
+    "summary.cacheHits",
+    "summary.avgCacheLatency",
+    "summary.totalRequests",
+    "summary.cacheSpeedup"
+  ],
+  cacheHitTrend: ["summary.totalCacheHits", "summary.hitRate"],
+  userTrends: ["summary.total", "summary.unique", "summary.avg"],
+  errorTrends: ["summary.errorPercent"],
+  errorCategoryTrends: ["summary.totalErrors", "summary.totalUniqueErrorCodes"],
+  groupedErrors: ["total"],
+  rescuedRetries: ["total", "retryTotal", "fallbackTotal"],
+  feedbackTrend: ["total"],
+  feedbackWeighted: ["total"],
+  feedbackScoreDistribution: ["total"],
+  feedbackModels: []
+};
+async function collectGatewayEnvironmentReport(client, options) {
+  const maxPages = options.maxPages ?? 40;
+  if (!Number.isSafeInteger(maxPages) || maxPages < 1 || maxPages > 100)
+    throw new Error("maxPages must be 1\u2013100");
+  if (!options.workspace.trim() || !options.tsgId.trim() || !Number.isFinite(options.start.getTime()) || !Number.isFinite(options.end.getTime()) || options.start >= options.end)
+    throw new Error("Invalid report scope");
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const report = {
+    schemaVersion: 1,
+    product: "Prisma AIRS AI Gateway",
+    schemaLabel: "AI Gateway",
+    windowLabel: "Telemetry window (UTC)",
+    title: options.title ?? "AI Gateway daily report",
+    collectionStartedAt: now().toISOString(),
+    generatedAt: "",
+    window: { start: options.start.toISOString(), end: options.end.toISOString() },
+    health: "unknown",
+    sources: [],
+    findings: [],
+    tables: [],
+    limitations: [
+      "Read-only operational evidence, not a security certification or availability SLA. No inference or configuration changes are performed.",
+      "All telemetry uses the displayed fixed window. Configuration and organisation/catalog reads describe current state, not daily changes.",
+      "Requests, errors, feedback and log totals are independent server aggregates, not an atomic snapshot. An AIRS block is not necessarily an outage.",
+      "Cost values are cents; latency values are milliseconds. Feedback scores may be negative. Null means unknown, not zero.",
+      "Only aggregate numbers and HTTP status codes are retained. Keys, user identities, workspace names/IDs, metadata, URLs, prompts, raw logs and configuration bodies are excluded.",
+      "Catalog entries describe available capabilities, not enabled protection. Organisation limit sentinel values are not interpreted as quota exhaustion.",
+      "Incomplete sources and page budgets are explicit. Current inventory lists have no verified continuation contract; total/has_more mismatches are partial."
+    ]
+  };
+  const metrics2 = {
+    title: "Telemetry metrics",
+    note: "Server field names are preserved. cost: cents; latency and avgCacheLatency: ms; errorPercent: percent. Feedback is not a request count.",
+    headers: ["Source", "Metric", "Value"],
+    rows: []
+  };
+  const trends = {
+    title: "Error timeline",
+    note: "Server UTC buckets; counts by HTTP status. Not a count of unique violating sessions.",
+    headers: ["UTC bucket", "HTTP status", "Errors"],
+    rows: []
+  };
+  const statuses = {
+    title: "Error categories",
+    note: "Server-reported errors by HTTP status; 446 denotes an AIRS block.",
+    headers: ["HTTP status", "Errors"],
+    rows: []
+  };
+  const inventory = {
+    title: "Current configuration and capabilities",
+    note: "Aggregate counts only. Active tenant workspaces are tenant-wide; keys and configs use the selected workspace.",
+    headers: ["Source", "Metric", "Value"],
+    rows: []
+  };
+  report.tables.push(metrics2, statuses, trends, inventory);
+  async function source2(name, window2, collect2) {
+    const s = {
+      name,
+      method: name,
+      window: window2,
+      status: "complete",
+      records: 0,
+      pages: 0,
+      notes: []
+    };
+    report.sources.push(s);
+    try {
+      await collect2(s);
+    } catch (error) {
+      s.status = s.records ? "partial" : "unavailable";
+      const code = error?.statusCode;
+      s.notes.push(
+        typeof code === "number" && Number.isInteger(code) && code >= 400 && code <= 599 ? `HTTP ${code}: request failed; check access and service availability.` : "Request, scope or response validation failed; upstream details omitted."
+      );
+    }
+  }
+  function envelope(v, s) {
+    const r = record(v);
+    if (r.success !== true) throw new Error("Unsuccessful response");
+    const d = record(r.data);
+    if (d.isQuotaExceeded !== false) {
+      s.status = "partial";
+      s.notes.push("Quota exceeded or quota state unknown; aggregates may be incomplete.");
+    }
+    return d;
+  }
+  function list(v, s) {
+    const r = record(v);
+    if (r.success === false || !Array.isArray(r.data)) throw new Error("Invalid list");
+    const rows = r.data.map(record);
+    const total2 = count(r.total);
+    if (r.has_more === true || total2 !== rows.length) {
+      s.status = "partial";
+      s.notes.push("List is truncated or total differs; continuation is not documented.");
+    }
+    s.records = rows.length;
+    s.pages = 1;
+    return rows;
+  }
+  let workspaceId;
+  let workspaceSlug;
+  await source2("workspaces.list", "Current active tenant workspaces (admin)", async (s) => {
+    const rows = list(await client.workspaces.list({ plane: "admin" }), s);
+    inventory.rows.push([s.name, "Active workspaces returned", rows.length]);
+    const exact = rows.filter((r) => r.id === options.workspace || r.slug === options.workspace);
+    const matches = exact.length ? exact : rows.filter((r) => r.name === options.workspace);
+    if (matches.length !== 1 || typeof matches[0]?.id !== "string" || typeof matches[0]?.slug !== "string")
+      throw new Error("Workspace missing or ambiguous");
+    workspaceId = matches[0].id;
+    workspaceSlug = matches[0].slug;
+  });
+  const window = () => {
+    if (!workspaceSlug) throw new Error("Workspace unresolved");
+    return { workspaceSlug, start: new Date(options.start), end: new Date(options.end) };
+  };
+  const scope = () => {
+    if (!workspaceId) throw new Error("Workspace unresolved");
+    return { workspaceId };
+  };
+  for (const [method, fields] of Object.entries(CHARTS)) {
+    await source2(`telemetry.${method}`, "Displayed telemetry window", async (s) => {
+      const d = envelope(await client.telemetry[method](window()), s);
+      const rows = fields.map((field) => {
+        const value = field.split(".").reduce((v, key) => record(v)[key], d);
+        const n = numeric(value);
+        const signed = method.startsWith("feedback");
+        const fractional = signed || method === "cost" || method === "latency" || field.endsWith("avg") || field.endsWith("Latency") || field.endsWith("Speedup") || field.endsWith("Rate") || field.endsWith("Percent");
+        if (n !== null && (!signed && n < 0 || !fractional && !Number.isSafeInteger(n)))
+          throw new Error("Invalid metric");
+        return [method, field, n];
+      });
+      const buckets = d.records ?? d.trend;
+      if (buckets !== void 0 && !Array.isArray(buckets)) throw new Error("Invalid buckets");
+      s.records = Array.isArray(buckets) ? buckets.length : 1;
+      s.pages = 1;
+      if (method === "feedbackModels") rows.push([method, "Models with feedback", s.records]);
+      if (method === "errorCategoryTrends") {
+        const entries = d.trend.map((v) => {
+          const r = record(v);
+          return [count(r.response_status_code), count(r.count)];
+        });
+        statuses.rows.push(...entries);
+        if (entries.some(([code, n]) => code >= 200 && code < 300 && n > 0))
+          report.findings.push({
+            priority: "review",
+            title: "Success-status responses appear in error analytics",
+            evidence: "The server classifies some HTTP 2xx responses as errors. Error analytics are not identical to non-2xx transaction counts.",
+            recommendation: "Inspect the underlying application/provider error classifications before calculating an HTTP failure rate.",
+            source: s.name
+          });
+        if (entries.some(([code, n]) => n > 0 && (code === 429 || code >= 500)))
+          report.findings.push({
+            priority: "attention",
+            title: "Rate limiting or server errors observed",
+            evidence: "Error categories include HTTP 429 or 5xx responses in the selected window.",
+            recommendation: "Review provider availability, quotas and retry policies; correlate with transaction logs.",
+            source: s.name
+          });
+        else if (entries.some(([, n]) => n > 0))
+          report.findings.push({
+            priority: "review",
+            title: "Gateway errors or policy blocks observed",
+            evidence: "Nonzero error-category counts were returned.",
+            recommendation: "Review status categories; distinguish expected AIRS blocks from integration failures.",
+            source: s.name
+          });
+      }
+      if (method === "groupedErrors") {
+        const entries = [];
+        for (const v of d.trend) {
+          const r = record(v);
+          if (typeof r.x !== "string" || !Number.isFinite(Date.parse(r.x)) || !Array.isArray(r.y))
+            throw new Error("Invalid trend");
+          for (const v2 of r.y) {
+            const y = record(v2);
+            entries.push([
+              new Date(r.x).toISOString(),
+              count(y.response_status_code),
+              count(y.count)
+            ]);
+          }
+        }
+        trends.rows.push(...entries);
+      }
+      metrics2.rows.push(...rows);
+    });
+  }
+  await source2("telemetry.filterBoundaries", "Displayed telemetry window", async (s) => {
+    const d = envelope(await client.telemetry.filterBoundaries(window()), s);
+    for (const key of ["unique_ai_models", "unique_status_codes"]) {
+      if (!Array.isArray(d[key])) throw new Error("Invalid filter values");
+      metrics2.rows.push(["filterBoundaries", `${key} count`, d[key].length]);
+    }
+    s.records = 1;
+    s.pages = 1;
+  });
+  const logs = {
+    title: "Transaction coverage",
+    note: "Unique collected transactions by HTTP status; only complete pagination represents the entire window. Raw rows are excluded.",
+    headers: ["Metric", "Value"],
+    rows: []
+  };
+  report.tables.push(logs);
+  await source2("telemetry.logs", "Displayed telemetry window", async (s) => {
+    const ids = /* @__PURE__ */ new Set();
+    const codes = /* @__PURE__ */ new Map();
+    let expected;
+    try {
+      for (let currentPage = 0; currentPage < maxPages; currentPage++) {
+        const d = envelope(
+          await client.telemetry.logs({ ...window(), pageSize: 50, currentPage }),
+          s
+        );
+        s.pages++;
+        const total2 = count(d.total);
+        expected ??= total2;
+        if (total2 !== expected || !Array.isArray(d.records) || d.records.length > 50)
+          throw new Error("Unstable page");
+        for (const v of d.records) {
+          const r = record(v);
+          if (typeof r.id !== "string" || !r.id || ids.has(r.id) || r.workspace_slug !== workspaceSlug)
+            throw new Error("Invalid identity");
+          const timestamp = typeof r.created_at === "string" ? Date.parse(r.created_at) : NaN;
+          if (!Number.isFinite(timestamp) || timestamp < options.start.getTime() || timestamp > options.end.getTime())
+            throw new Error("Outside window");
+          const code = count(r.response_status_code);
+          ids.add(r.id);
+          codes.set(code, (codes.get(code) ?? 0) + 1);
+          s.records = ids.size;
+        }
+        if (ids.size > expected) throw new Error("Unexpected total");
+        if (ids.size === expected) return;
+        if (!d.records.length) throw new Error("Premature empty page");
+      }
+      s.status = "partial";
+      s.notes.push(
+        "Transaction page budget reached. Increase --max-pages to collect the remaining rows."
+      );
+    } finally {
+      logs.rows.push(["Server total", expected ?? null], ["Unique collected", ids.size]);
+      for (const [code, n] of [...codes].sort(([a], [b]) => a - b))
+        logs.rows.push([`HTTP ${code}`, n]);
+    }
+  });
+  for (const method of ["configs.list", "apiKeys.listService", "apiKeys.listUser"]) {
+    await source2(method, "Current selected workspace configuration", async (s) => {
+      const response = method === "configs.list" ? await client.configs.list(scope()) : method === "apiKeys.listService" ? await client.apiKeys.listService(scope()) : await client.apiKeys.listUser(scope());
+      const rows = list(response, s);
+      inventory.rows.push([method, "Rows returned", rows.length]);
+    });
+  }
+  await source2("organisations.getInfo", "Current tenant configuration", async (s) => {
+    const r = await client.organisations.getInfo(options.tsgId);
+    inventory.rows.push([
+      s.name,
+      "Configured limit categories",
+      Object.keys(r.benefits.limits).length
+    ]);
+    s.records = 1;
+    s.pages = 1;
+  });
+  await source2(
+    "guardrails.getCatalog",
+    "Current tenant capability catalog (not enabled guardrails)",
+    async (s) => {
+      const r = await client.guardrails.getCatalog();
+      inventory.rows.push([s.name, "Available evaluators", r.evals.length]);
+      s.records = r.evals.length;
+      s.pages = 1;
+    }
+  );
+  for (const s of report.sources.filter((s2) => s2.status !== "complete"))
+    report.findings.push({
+      priority: "review",
+      title: `Incomplete evidence: ${s.name}`,
+      evidence: s.notes.join(" "),
+      recommendation: "Resolve source access or validation problems and rerun. Do not interpret missing metrics as zero.",
+      source: s.name
+    });
+  const telemetryAvailable = report.sources.some(
+    (s) => s.name.startsWith("telemetry.") && s.status === "complete"
+  );
+  report.health = !telemetryAvailable ? "unknown" : report.findings.some((f) => f.priority === "attention") ? "attention" : report.findings.length ? "review" : "no-findings";
+  report.generatedAt = now().toISOString();
+  return report;
+}
+
+// src/reports/environment-render.ts
+import { createHash } from "crypto";
+var HEALTH = {
+  attention: "Attention required",
+  review: "Review required",
+  "no-findings": "No findings in available evidence",
+  unknown: "Unable to assess"
+};
+var html = (v) => String(v ?? "Unknown").replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+var md = (v) => String(v ?? "Unknown").replace(
+  /[&<>"'\\`*_[\]{}()|!#~\r\n]/g,
+  (c) => /[\r\n]/.test(c) ? " " : `&#${c.charCodeAt(0)};`
+);
+function tables(r) {
+  return [
+    ...r.tables,
+    {
+      title: "Evidence and completeness",
+      note: "Complete means the source was collected within its budget, not that the environment is secure. Unavailable is not zero.",
+      headers: ["Source", "SDK method", "Window", "Status", "Records", "Pages", "Notes"],
+      rows: r.sources.map((s) => [
+        s.name,
+        s.method,
+        s.window,
+        s.status,
+        s.records,
+        s.pages,
+        s.notes.join(" ") || "Collection completed."
+      ])
+    }
+  ];
+}
+function renderEnvironmentReportMarkdown(r) {
+  const lines = [
+    `# ${md(r.title)}`,
+    "",
+    `**${md(r.product)}**`,
+    "",
+    `Assessment: **${HEALTH[r.health]}**`,
+    "",
+    `Collection: ${r.collectionStartedAt} \u2192 ${r.generatedAt}`,
+    "",
+    `${md(r.windowLabel ?? "Scan creation window (UTC)")}: ${r.window.start} \u2192 ${r.window.end}`,
+    "",
+    "## What needs attention",
+    ""
+  ];
+  for (const f of r.findings)
+    lines.push(
+      `### ${f.priority.toUpperCase()}: ${md(f.title)}`,
+      "",
+      `Evidence: ${md(f.evidence)}`,
+      "",
+      `Next step: ${md(f.recommendation)}`,
+      "",
+      `Source: ${md(f.source)}`,
+      ""
+    );
+  if (!r.findings.length)
+    lines.push("No findings in available evidence; this does not establish absence of risk.", "");
+  for (const t of tables(r)) {
+    lines.push(`## ${md(t.title)}`, "", md(t.note), "");
+    if (t.rows.length)
+      lines.push(
+        `| ${t.headers.map(md).join(" | ")} |`,
+        `| ${t.headers.map(() => "---").join(" | ")} |`,
+        ...t.rows.map((row) => `| ${row.map(md).join(" | ")} |`),
+        ""
+      );
+    else
+      lines.push(
+        "No rows collected; consult source completeness before interpreting this as empty.",
+        ""
+      );
+  }
+  lines.push(
+    "## Scope and limitations",
+    "",
+    ...r.limitations.map((v) => `- ${md(v)}`),
+    "",
+    `Prisma AIRS CLI \xB7 ${md(r.schemaLabel ?? "Red Team")} report schema ${r.schemaVersion}`,
+    ""
+  );
+  return lines.join("\n");
+}
+var CSS = `
+:root{font:16px/1.6 system-ui,sans-serif;color:#193449;background:#f0f4f7}*{box-sizing:border-box}body{margin:0}header{background:#152e43;color:white;padding:3rem max(1rem,calc((100vw - 1160px)/2))}h1{font-size:clamp(1.8rem,4vw,3rem);line-height:1.15}h1,h2,h3,p,td{overflow-wrap:anywhere}main{max-width:1200px;margin:auto;padding:1rem}section,article{padding:1.4rem;background:white;border:1px solid #cddbe4;border-radius:10px;margin:1rem 0}.finding{border-left:5px solid #b08528}.finding[data-priority=attention]{border-left-color:#b1392d}.note{color:#536575;font-size:.9rem}.badge{border:1px solid;padding:.3rem .8rem;border-radius:30px;display:inline-block}nav,.controls{display:flex;gap:1rem;flex-wrap:wrap}button,select{font:inherit;padding:.4rem;border:1px solid #526778;border-radius:5px;background:white;color:#193449}a{color:#006b63}.table-wrap{overflow:auto}table{border-collapse:collapse;width:100%;text-align:left}th,td{padding:.7rem;border-bottom:1px solid #d4dfe6;vertical-align:top}th{background:#edf3f7}caption{text-align:left}footer{padding:1rem;color:#536575}.js-only{display:none}.ready .js-only{display:flex}[hidden]{display:none!important}:focus-visible{outline:3px solid #ae6816;outline-offset:3px}.skip{position:absolute;left:-10000px}.skip:focus{left:1rem;top:1rem;background:white;padding:1rem}@media(max-width:600px){header{padding:1.5rem 1rem}section{padding:1rem}th,td{padding:.5rem}}@media print{body{background:white;font-size:10pt}header{background:white;color:black;padding:0}main{max-width:none;padding:0}nav,.controls,.skip{display:none!important}[hidden]{display:revert!important}.table-wrap{overflow:visible}section{border:0;padding:0}article{break-inside:avoid}}
+`;
+var JS = `'use strict';document.documentElement.classList.add('ready');document.getElementById('print').addEventListener('click',function(){window.print()});document.getElementById('priority').addEventListener('change',function(){var n=0;document.querySelectorAll('.finding').forEach(function(e){e.hidden=this.value!=='all'&&e.dataset.priority!==this.value;if(!e.hidden)n++},this);document.getElementById('count').textContent=n+' findings shown'});`;
+function renderEnvironmentReportHtml(r) {
+  const hash = (v) => createHash("sha256").update(v).digest("base64");
+  const policy = `default-src 'none'; script-src 'sha256-${hash(JS)}'; style-src 'sha256-${hash(CSS)}'; connect-src 'none'; base-uri 'none'; form-action 'none'`;
+  const sections = tables(r).map(
+    (t, i) => `<section id="table-${i}"><h2>${html(t.title)}</h2><p class="note">${html(t.note)}</p>${t.rows.length ? `<div class="table-wrap" role="region" aria-label="${html(t.title)}" tabindex="0"><table><caption>${t.rows.length} aggregate rows</caption><thead><tr>${t.headers.map((v) => `<th scope="col">${html(v)}</th>`).join("")}</tr></thead><tbody>${t.rows.map((row) => `<tr>${row.map((v) => `<td>${html(v)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>` : "<p>No rows collected; consult source completeness before interpreting this as empty.</p>"}</section>`
+  ).join("");
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${html(policy)}"><meta name="referrer" content="no-referrer"><title>${html(r.title)}</title><style>${CSS}</style></head><body><a class="skip" href="#main">Skip to report</a><header><p>${html(r.product)}</p><h1>${html(r.title)}</h1><span class="badge">${HEALTH[r.health]}</span><p>Collection: ${html(r.collectionStartedAt)} \u2192 ${html(r.generatedAt)}</p><p>${html(r.windowLabel ?? "Scan creation window (UTC)")}: ${html(r.window.start)} \u2192 ${html(r.window.end)}</p><p>Read-only evidence \xB7 Confidential environment metadata</p></header><main id="main"><nav aria-label="Report sections"><a href="#findings">Attention</a><a href="#table-0">Evidence tables</a><a href="#scope">Scope</a></nav><section id="findings"><h2>What needs attention</h2><div class="controls js-only"><label for="priority">Priority</label><select id="priority"><option value="all">All</option><option value="attention">Attention</option><option value="review">Review</option></select><span id="count" role="status"></span><button id="print" type="button">Print / save PDF</button></div>${r.findings.map((f) => `<article class="finding" data-priority="${html(f.priority)}"><h3>${html(f.title)}</h3><p>${html(f.evidence)}</p><p><strong>Next step:</strong> ${html(f.recommendation)}</p><p class="note">${html(f.source)}</p></article>`).join("") || "<p>No findings in available evidence; this does not establish absence of risk.</p>"}</section>${sections}<section id="scope"><h2>Scope and limitations</h2><ul>${r.limitations.map((v) => `<li>${html(v)}</li>`).join("")}</ul></section><footer>Prisma AIRS CLI \xB7 ${html(r.schemaLabel ?? "Red Team")} report schema ${r.schemaVersion} \xB7 Works offline and without JavaScript.</footer></main><script>${JS}</script></body></html>
+`;
+}
+
 // src/reports/io.ts
 import { randomUUID } from "crypto";
 import { link, open, unlink } from "fs/promises";
@@ -2501,15 +2928,318 @@ async function writeReportFile(path2, content) {
   }
 }
 
+// src/reports/redteam.ts
+var DataError = class extends Error {
+};
+var label = (value) => typeof value === "string" ? value.replace(/[\p{Cc}\p{Cf}]/gu, " ").slice(0, 120) : "Unknown";
+function count2(value) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+    throw new DataError("A required counter is missing or invalid.");
+  return value;
+}
+function failure(error) {
+  if (error instanceof DataError) return error.message;
+  const code = error?.statusCode;
+  return typeof code === "number" && Number.isInteger(code) && code >= 400 && code <= 599 ? `HTTP ${code}: source unavailable; check credentials, service availability and SDK compatibility.` : "Source request or validation failed. No upstream error body is included.";
+}
+async function collectRedTeamEnvironmentReport(client, options = {}) {
+  const maxPages = options.maxPages ?? 40;
+  if (!Number.isSafeInteger(maxPages) || maxPages < 1 || maxPages > 100)
+    throw new Error("maxPages must be an integer from 1 to 100");
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const end = now();
+  const report = {
+    schemaVersion: 1,
+    product: "Prisma AIRS AI Red Teaming",
+    title: options.title ?? "Red Team environment report",
+    collectionStartedAt: end.toISOString(),
+    generatedAt: "",
+    window: { start: new Date(end.getTime() - 864e5).toISOString(), end: end.toISOString() },
+    health: "unknown",
+    sources: [],
+    findings: [],
+    tables: [],
+    limitations: [
+      "This is a read-only snapshot, not a security certification, availability SLA or numerical health score.",
+      "Only scan creation timestamps are filtered locally to the preceding 24 hours. Current scan status is not a history of status changes.",
+      "Dashboard statistics use server defaults with an unverified measurement window. They are not daily totals and need not match the paginated scan inventory.",
+      "Targets and adapters are current configuration inventories, not configuration change logs. Broker channels not online may be intentionally idle; no outage is inferred.",
+      "Risk categories are server-reported. Quota consumption is not reset or reinterpreted as daily usage; unlimited zero allocation is not exhaustion.",
+      "Partial sources describe collected records only. Missing data is unknown, never zero. Independently read pages are not an atomic snapshot.",
+      "Only aggregate counters and category labels are included. Target names, IDs, connection settings, scripts, variables, prompts and scan content are excluded."
+    ]
+  };
+  function finding(priority, title, evidence, recommendation, source3) {
+    report.findings.push({ priority, title, evidence, recommendation, source: source3 });
+  }
+  async function source2(name, method, window, read) {
+    const s = {
+      name,
+      method,
+      window,
+      status: "unavailable",
+      records: 0,
+      pages: 0,
+      notes: []
+    };
+    report.sources.push(s);
+    try {
+      await read(s);
+      if (s.status !== "partial") s.status = "complete";
+    } catch (error) {
+      s.status = s.records > 0 ? "partial" : "unavailable";
+      s.notes.push(failure(error));
+    }
+    if (s.status !== "complete")
+      finding(
+        "review",
+        `${name} incomplete`,
+        s.notes.join(" "),
+        "Resolve the source error or increase the page budget, then regenerate.",
+        name
+      );
+  }
+  async function pages(s, read) {
+    const rows = [];
+    const seen = /* @__PURE__ */ new Set();
+    let total2;
+    try {
+      for (let page = 0; page < maxPages; page++) {
+        const r = await read(rows.length);
+        s.pages++;
+        if (!Array.isArray(r.data)) throw new DataError("Missing inventory array.");
+        const reported = count2(r.pagination.total_items);
+        total2 ??= reported;
+        if (total2 !== reported) throw new DataError("Inventory changed during pagination.");
+        if (r.data.length > 15) throw new DataError("Page exceeds requested size.");
+        for (const row of r.data) {
+          if (!row.uuid || seen.has(row.uuid))
+            throw new DataError("Missing or repeated identity; pagination stopped.");
+          seen.add(row.uuid);
+          rows.push(row);
+          s.records = rows.length;
+        }
+        if (rows.length > total2) throw new DataError("Inventory exceeds reported total.");
+        if (rows.length === total2) return rows;
+        if (!r.data.length) throw new DataError("Premature empty page.");
+      }
+      throw new DataError(`Reached the ${maxPages}-page budget; inventory is incomplete.`);
+    } catch (error) {
+      if (!rows.length) throw error;
+      s.status = "partial";
+      s.notes.push(failure(error));
+      return rows;
+    }
+  }
+  const table = (title, note, headers, rows) => report.tables.push({ title, note, headers, rows });
+  function groups(values) {
+    const counts = /* @__PURE__ */ new Map();
+    for (const v of values) {
+      const key = label(v);
+      counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    return [...counts].sort(([a], [b]) => a.localeCompare(b));
+  }
+  await source2("Overview", "getDashboardOverview()", "Current dashboard snapshot", async (s) => {
+    const r = await client.getDashboardOverview();
+    const total2 = count2(r.total_targets);
+    table("Dashboard overview", s.window, ["Metric", "Count"], [["Targets", total2]]);
+    s.records = 1;
+    s.pages = 1;
+  });
+  await source2(
+    "Statistics",
+    "getScanStatistics()",
+    "Server-default window (unverified)",
+    async (s) => {
+      const r = await client.getScanStatistics();
+      const rows = [
+        ["Scans", count2(r.total_scans)],
+        ["Targets scanned", count2(r.targets_scanned)]
+      ];
+      for (const risk of r.risk_profile ?? []) {
+        const n = count2(risk.total);
+        rows.push([`Risk: ${label(risk.risk_rating)}`, n]);
+        if (/^(high|critical)$/i.test(risk.risk_rating) && n > 0)
+          finding(
+            "attention",
+            "Elevated risk reported",
+            `${n} in the ${label(risk.risk_rating)} risk category.`,
+            "Review affected targets in Red Team; the statistics window is server-defined.",
+            s.name
+          );
+      }
+      for (const status of r.scan_status ?? [])
+        rows.push([`Status: ${label(status.name)}`, count2(status.count)]);
+      table("Dashboard scan statistics", s.window, ["Metric", "Count"], rows);
+      s.records = 1;
+      s.pages = 1;
+    }
+  );
+  await source2("Targets", "targets.list()", "Current paginated inventory", async (s) => {
+    const rows = await pages(s, (skip) => client.targets.list({ skip, limit: 15 }));
+    table(
+      "Target inventory",
+      "Collected targets by type; consult source completeness.",
+      ["Type", "Count"],
+      groups(rows.map((r) => r.target_type))
+    );
+  });
+  await source2("Quota", "getQuotaSummary() \u2014 GET", "Current quota snapshot", async (s) => {
+    if (!client.getQuotaSummary)
+      throw new DataError(
+        "Installed SDK lacks getQuotaSummary(); use the locally updated SDK. POST is not used as a fallback."
+      );
+    const r = await client.getQuotaSummary();
+    const rows = [];
+    for (const kind of ["static", "dynamic", "custom"]) {
+      const q = r[kind];
+      const allocated = count2(q.allocated);
+      const consumed = count2(q.consumed);
+      if (typeof q.unlimited !== "boolean") throw new DataError("Missing unlimited quota flag.");
+      rows.push([
+        kind,
+        allocated,
+        consumed,
+        q.unlimited ? "Unlimited" : String(Math.max(0, allocated - consumed))
+      ]);
+      if (!q.unlimited && consumed >= allocated)
+        finding(
+          "attention",
+          `${kind} quota has no remaining allocation`,
+          `${consumed} consumed; ${allocated} allocated.`,
+          "Review quota allocation before scheduling more scans.",
+          s.name
+        );
+    }
+    table(
+      "Quota",
+      "Remaining is shown only for finite quotas; these are not daily usage counters.",
+      ["Type", "Allocated", "Consumed", "Remaining"],
+      rows
+    );
+    s.records = 3;
+    s.pages = 1;
+  });
+  await source2(
+    "Scans",
+    "scans.list()",
+    "Paginated inventory; local 24-hour creation filter",
+    async (s) => {
+      const rows = await pages(s, (skip) => client.scans.list({ skip, limit: 15 }));
+      let unknown = 0;
+      const recent = rows.filter((r) => {
+        const t = typeof r.created_at === "string" && /(?:Z|[+-]\d{2}:\d{2})$/i.test(r.created_at) ? Date.parse(r.created_at) : Number.NaN;
+        if (!Number.isFinite(t) || t > end.getTime()) {
+          unknown++;
+          return false;
+        }
+        return t >= end.getTime() - 864e5;
+      });
+      table(
+        "Scan inventory and daily creation activity",
+        "Daily count covers collected records created in the stated UTC window, not scans completed or attacks executed.",
+        ["Metric", "Count"],
+        [
+          ["Collected scans", rows.length],
+          ["Created in preceding 24 hours", recent.length],
+          ["Unusable or future creation timestamps", unknown]
+        ]
+      );
+      table(
+        "Current status of collected scans",
+        "All collected scans, independent of creation window.",
+        ["Status", "Count"],
+        groups(rows.map((r) => r.status))
+      );
+      const failed = rows.filter((r) => /^(failed|error)$/i.test(r.status ?? "")).length;
+      if (failed)
+        finding(
+          "attention",
+          "Scans require failure review",
+          `${failed} collected scans currently report failed/error status.`,
+          "Inspect individual scan reports and error logs before rerunning; no reruns are performed here.",
+          s.name
+        );
+      if (unknown)
+        finding(
+          "review",
+          "Daily activity has timestamp gaps",
+          `${unknown} records could not be assigned to the daily window.`,
+          "Review source timestamps; do not interpret the daily count as complete.",
+          s.name
+        );
+    }
+  );
+  await source2(
+    "Network broker",
+    "networkBroker.getChannelStats()",
+    "Current channel snapshot",
+    async (s) => {
+      const r = await client.networkBroker.getChannelStats();
+      const total2 = count2(r.total_channels);
+      const online = count2(r.online_channels);
+      if (online > total2) throw new DataError("Online channel count exceeds total.");
+      table(
+        "Network broker",
+        "Not-online channels may be intentionally idle; this does not establish an outage.",
+        ["Metric", "Count"],
+        [
+          ["Configured channels", total2],
+          ["Online channels", online]
+        ]
+      );
+      if (total2 > online)
+        finding(
+          "review",
+          "Confirm expected broker connectivity",
+          `${online} of ${total2} configured channels are online.`,
+          "Compare with intended channel schedules before investigating connectivity.",
+          s.name
+        );
+      s.records = 1;
+      s.pages = 1;
+    }
+  );
+  await source2(
+    "Adapters",
+    "adapters.list({ include_target_count: true })",
+    "Current paginated configuration",
+    async (s) => {
+      const rows = await pages(
+        s,
+        (skip) => client.adapters.list({ skip, limit: 15, include_target_count: true })
+      );
+      table(
+        "Adapter inventory",
+        "Configuration status only; scripts and variables are excluded.",
+        ["Status", "Count"],
+        groups(rows.map((r) => r.status))
+      );
+    }
+  );
+  report.health = report.sources.every((s) => s.status === "unavailable") ? "unknown" : report.findings.some((f) => f.priority === "attention") ? "attention" : report.findings.length ? "review" : "no-findings";
+  report.generatedAt = now().toISOString();
+  return report;
+}
+
+// src/reports/redteam-render.ts
+function renderRedTeamReportMarkdown(report) {
+  return renderEnvironmentReportMarkdown(report);
+}
+function renderRedTeamReportHtml(report) {
+  return renderEnvironmentReportHtml(report);
+}
+
 // src/reports/render.ts
-import { createHash } from "crypto";
-var HEALTH = {
+import { createHash as createHash2 } from "crypto";
+var HEALTH2 = {
   attention: "Attention required",
   review: "Review required",
   "no-findings": "No findings in available evidence",
   unknown: "Unable to assess"
 };
-function html(value) {
+function html2(value) {
   return String(value ?? "Unknown").replace(
     /[&<>"']/g,
     (char) => ({
@@ -2521,7 +3251,7 @@ function html(value) {
     })[char] ?? char
   );
 }
-function md(value) {
+function md2(value) {
   return String(value ?? "Unknown").replace(
     /[&<>"'\\`*_[\]{}()|!#~\r\n]/g,
     (char) => char === "\r" || char === "\n" ? " " : `&#${char.charCodeAt(0)};`
@@ -2530,7 +3260,7 @@ function md(value) {
 function number(value) {
   return value === null ? "Unknown" : value.toLocaleString("en-US", { maximumFractionDigits: 2 });
 }
-function tables(report) {
+function tables2(report) {
   const sessionSource = report.sources.find((source2) => source2.name === "Daily session inventory");
   return [
     {
@@ -2660,15 +3390,15 @@ function metrics(report) {
 }
 function renderRuntimeReportMarkdown(report) {
   const lines = [
-    `# ${md(report.title)}`,
+    `# ${md2(report.title)}`,
     "",
-    `**${md(report.product)}**`,
+    `**${md2(report.product)}**`,
     "",
-    `Assessment: **${HEALTH[report.health]}**`,
+    `Assessment: **${HEALTH2[report.health]}**`,
     "",
-    `Window: ${md(report.window.start)} \u2192 ${md(report.window.end)}`,
+    `Window: ${md2(report.window.start)} \u2192 ${md2(report.window.end)}`,
     "",
-    `${md(report.window.description)}. Collection: ${md(report.collectionStartedAt)} \u2192 ${md(report.generatedAt)}.`,
+    `${md2(report.window.description)}. Collection: ${md2(report.collectionStartedAt)} \u2192 ${md2(report.generatedAt)}.`,
     "",
     "## At a glance",
     "",
@@ -2684,17 +3414,17 @@ function renderRuntimeReportMarkdown(report) {
     );
   for (const finding of report.findings)
     lines.push(
-      `### ${finding.priority.toUpperCase()}: ${md(finding.title)}`,
+      `### ${finding.priority.toUpperCase()}: ${md2(finding.title)}`,
       "",
-      `Evidence: ${md(finding.evidence)}`,
+      `Evidence: ${md2(finding.evidence)}`,
       "",
-      `Next step: ${md(finding.recommendation)}`,
+      `Next step: ${md2(finding.recommendation)}`,
       "",
-      `Source: ${md(finding.source)}`,
+      `Source: ${md2(finding.source)}`,
       ""
     );
-  for (const table of tables(report)) {
-    lines.push(`## ${table.title}`, "", md(table.note), "");
+  for (const table of tables2(report)) {
+    lines.push(`## ${table.title}`, "", md2(table.note), "");
     if (table.rows.length === 0)
       lines.push(
         "No rows available. Consult the source status before interpreting this as an empty result.",
@@ -2704,21 +3434,21 @@ function renderRuntimeReportMarkdown(report) {
       lines.push(
         `| ${table.headers.join(" | ")} |`,
         `| ${table.headers.map(() => "---").join(" | ")} |`,
-        ...table.rows.map((row) => `| ${row.map(md).join(" | ")} |`),
+        ...table.rows.map((row) => `| ${row.map(md2).join(" | ")} |`),
         ""
       );
   }
   lines.push(
     "## Scope, privacy, and limitations",
     "",
-    ...report.limitations.map((note) => `- ${md(note)}`),
+    ...report.limitations.map((note) => `- ${md2(note)}`),
     "",
     `Generated by Prisma AIRS CLI \xB7 Report schema ${report.schemaVersion}`,
     ""
   );
   return lines.join("\n");
 }
-var CSS = `
+var CSS2 = `
 #evidence td:nth-child(3){white-space:nowrap}
 :root{color-scheme:light;--ink:#172b40;--muted:#526476;--line:#d8e2e9;--bg:#f2f5f8;--accent:#00786e;font:16px/1.55 system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}
 *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink)}a{color:var(--accent)}header{background:#11283d;color:#fff;padding:2.5rem max(1.25rem,calc((100vw - 1240px)/2))}header p{color:#d7e4ec;max-width:85ch}h1{font-size:clamp(1.8rem,4vw,2.7rem);line-height:1.15;margin:.6rem 0 1rem;overflow-wrap:anywhere}h2{font-size:1.35rem;margin:0 0 .6rem}h3{font-size:1.05rem;margin:.35rem 0}p{margin:.5rem 0 1rem}.eyebrow{font-size:.8rem;letter-spacing:.12em;text-transform:uppercase}.badge{display:inline-block;padding:.35rem .7rem;border:1px solid currentColor;border-radius:100px;font-weight:650;background:#fff;color:var(--ink)}.attention .badge{color:#a62b1b}.review .badge{color:#795500}.unknown .badge{color:#69439b}.no-findings .badge{color:#006a54}
@@ -2726,7 +3456,7 @@ main{max-width:1280px;margin:auto;padding:1.5rem 1.25rem 3rem}nav{display:flex;g
 @media(max-width:760px){.cards{grid-template-columns:repeat(2,minmax(0,1fr))}section{padding:1rem}header{padding:1.5rem 1.25rem}.card strong{font-size:1.5rem}}
 @media print{body{background:#fff;font-size:10pt}header{background:#fff;color:#000;padding:0}header p{color:#333}main{padding:0;max-width:none}nav,.toolbar,.skip{display:none!important}section,.card{border-radius:0;break-inside:auto}.finding,.card{break-inside:avoid}.table-wrap{overflow:visible}table{font-size:8pt}th,td{min-width:0;padding:.3rem}.hidden,[hidden]{display:revert!important}h2,h3{break-after:avoid}a{color:#000}}
 `;
-var JS = `
+var JS2 = `
 'use strict';
 document.documentElement.classList.add('js-ready');
 document.getElementById('print-report').addEventListener('click',function(){window.print();});
@@ -2744,21 +3474,21 @@ search.addEventListener('input',function(){
 });
 `;
 function renderRuntimeReportHtml(report) {
-  const hash = (text) => createHash("sha256").update(text).digest("base64");
-  const policy = `default-src 'none'; script-src 'sha256-${hash(JS)}'; style-src 'sha256-${hash(CSS)}'; base-uri 'none'; form-action 'none'; connect-src 'none'; img-src 'none'`;
+  const hash = (text) => createHash2("sha256").update(text).digest("base64");
+  const policy = `default-src 'none'; script-src 'sha256-${hash(JS2)}'; style-src 'sha256-${hash(CSS2)}'; base-uri 'none'; form-action 'none'; connect-src 'none'; img-src 'none'`;
   const findingCards = report.findings.map(
-    (finding) => `<article class="finding" data-priority="${html(finding.priority)}"><span class="priority">${html(finding.priority)}</span><h3>${html(finding.title)}</h3><p><strong>Evidence:</strong> ${html(finding.evidence)}</p><p><strong>Next step:</strong> ${html(finding.recommendation)}</p><p class="note">Source: ${html(finding.source)}</p></article>`
+    (finding) => `<article class="finding" data-priority="${html2(finding.priority)}"><span class="priority">${html2(finding.priority)}</span><h3>${html2(finding.title)}</h3><p><strong>Evidence:</strong> ${html2(finding.evidence)}</p><p><strong>Next step:</strong> ${html2(finding.recommendation)}</p><p class="note">Source: ${html2(finding.source)}</p></article>`
   ).join("");
-  const sections = tables(report).map(
-    (table) => `<section id="${table.id}" aria-labelledby="${table.id}-title"><h2 id="${table.id}-title">${table.title}</h2><p class="note">${html(table.note)}</p>${table.id === "applications" ? '<div class="toolbar js-only"><label for="app-search">Find an application</label><input id="app-search" type="search" placeholder="Filter application buckets"><span id="app-count" role="status"></span></div>' : ""}${table.rows.length ? `<div class="table-wrap" role="region" aria-label="${table.title}" tabindex="0"><table><caption>${table.rows.length} collected rows</caption><thead><tr>${table.headers.map((header) => `<th scope="col">${header}</th>`).join("")}</tr></thead><tbody>${table.rows.map((row) => `<tr>${row.map((cell) => `<td>${html(cell)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>` : "<p>No rows available. Consult the source status before interpreting this as an empty result.</p>"}</section>`
+  const sections = tables2(report).map(
+    (table) => `<section id="${table.id}" aria-labelledby="${table.id}-title"><h2 id="${table.id}-title">${table.title}</h2><p class="note">${html2(table.note)}</p>${table.id === "applications" ? '<div class="toolbar js-only"><label for="app-search">Find an application</label><input id="app-search" type="search" placeholder="Filter application buckets"><span id="app-count" role="status"></span></div>' : ""}${table.rows.length ? `<div class="table-wrap" role="region" aria-label="${table.title}" tabindex="0"><table><caption>${table.rows.length} collected rows</caption><thead><tr>${table.headers.map((header) => `<th scope="col">${header}</th>`).join("")}</tr></thead><tbody>${table.rows.map((row) => `<tr>${row.map((cell) => `<td>${html2(cell)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>` : "<p>No rows available. Consult the source status before interpreting this as an empty result.</p>"}</section>`
   ).join("");
   return `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${html(policy)}"><meta name="referrer" content="no-referrer"><title>${html(report.title)} \u2014 Prisma AIRS</title><style>${CSS}</style></head>
-<body class="${html(report.health)}"><a class="skip" href="#main">Skip to report</a><header><div class="eyebrow">Prisma AIRS \xB7 AI Runtime Security</div><h1>${html(report.title)}</h1><span class="badge">${HEALTH[report.health]}</span><p>${html(report.window.description)}<br><time>${html(report.window.start)}</time> \u2192 <time>${html(report.window.end)}</time></p><p>Collected ${html(report.collectionStartedAt)} \u2192 ${html(report.generatedAt)}<br>Read-only evidence \xB7 Confidential environment metadata</p></header>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${html2(policy)}"><meta name="referrer" content="no-referrer"><title>${html2(report.title)} \u2014 Prisma AIRS</title><style>${CSS2}</style></head>
+<body class="${html2(report.health)}"><a class="skip" href="#main">Skip to report</a><header><div class="eyebrow">Prisma AIRS \xB7 AI Runtime Security</div><h1>${html2(report.title)}</h1><span class="badge">${HEALTH2[report.health]}</span><p>${html2(report.window.description)}<br><time>${html2(report.window.start)}</time> \u2192 <time>${html2(report.window.end)}</time></p><p>Collected ${html2(report.collectionStartedAt)} \u2192 ${html2(report.generatedAt)}<br>Read-only evidence \xB7 Confidential environment metadata</p></header>
 <main id="main"><nav aria-label="Report sections"><a href="#findings">Attention</a><a href="#applications">Activity</a><a href="#profiles">Profiles</a><a href="#inventory">Inventory</a><a href="#evidence">Evidence</a><a href="#scope">Scope</a></nav>
 <div class="cards">${metrics(report).map(([name, value]) => `<div class="card"><span>${name}</span><strong>${value}</strong></div>`).join("")}</div>
 <section id="findings"><h2>What needs attention</h2><p class="note">Observed violations and configuration review items, not a numerical health score. Collection gaps remain visible in the evidence table.</p><div class="toolbar js-only"><label for="finding-filter">Priority</label><select id="finding-filter"><option value="all">All findings</option><option value="attention">Attention</option><option value="review">Review</option><option value="info">Information</option></select><span id="finding-count" role="status"></span><button id="print-report" type="button">Print / save PDF</button></div>${findingCards || "<p>No findings in the available evidence. This does not establish an absence of risk.</p>"}</section>
-${sections}<section id="scope"><h2>Scope, privacy, and limitations</h2><ul>${report.limitations.map((note) => `<li>${html(note)}</li>`).join("")}</ul></section><footer>Generated by Prisma AIRS CLI \xB7 Report schema ${report.schemaVersion} \xB7 Self-contained HTML; no network access required. All evidence remains readable with JavaScript disabled.</footer></main><script>${JS}</script></body></html>
+${sections}<section id="scope"><h2>Scope, privacy, and limitations</h2><ul>${report.limitations.map((note) => `<li>${html2(note)}</li>`).join("")}</ul></section><footer>Generated by Prisma AIRS CLI \xB7 Report schema ${report.schemaVersion} \xB7 Self-contained HTML; no network access required. All evidence remains readable with JavaScript disabled.</footer></main><script>${JS2}</script></body></html>
 `;
 }
 
@@ -2778,10 +3508,10 @@ function safeFailure(error) {
   }
   return "Source request or response validation failed; check connectivity and SDK compatibility.";
 }
-function label(value) {
+function label2(value) {
   return (value?.replace(/[\p{Cc}\p{Cf}]/gu, " ").trim() || "Unknown").slice(0, 240);
 }
-function count(value) {
+function count3(value) {
   return Number.isSafeInteger(value) && value >= 0 ? value : null;
 }
 async function collect(source2, maxPages, read, identity) {
@@ -2831,23 +3561,23 @@ function inventoryNext(next, size, offset) {
 function total(values) {
   if (values.some((value) => value === null)) return null;
   const result = values.reduce((sum, value) => sum + (value ?? 0), 0);
-  return count(result);
+  return count3(result);
 }
 function distribution(rows) {
   const groups = /* @__PURE__ */ new Map();
   for (const row of rows) {
-    const name = label(row.violation_status).toLowerCase();
+    const name = label2(row.violation_status).toLowerCase();
     groups.set(name, (groups.get(name) ?? 0) + 1);
   }
   return [...groups].map(([name, n]) => ({ name, count: n })).sort((a, b) => b.count - a.count);
 }
 function severity(value) {
   return {
-    critical: count(value.critical),
-    high: count(value.high),
-    medium: count(value.medium),
-    low: count(value.low),
-    total: count(value.total)
+    critical: count3(value.critical),
+    high: count3(value.high),
+    medium: count3(value.medium),
+    low: count3(value.low),
+    total: count3(value.total)
   };
 }
 async function collectRuntimeDailyReport(client, options = {}) {
@@ -2910,7 +3640,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
           offset
         });
         const size = page.items?.length ?? 0;
-        const totalItems = count(page.pagination?.total_items);
+        const totalItems = count3(page.pagination?.total_items);
         if (totalItems !== null) {
           if (expectedAppTotal !== void 0 && totalItems !== expectedAppTotal)
             throw new ReportDataError(
@@ -2962,7 +3692,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
       async (offset) => {
         const page = await client.dashboard.sessionsOverview({ ...daily, limit: 25, offset });
         const size = page.items?.length ?? 0;
-        const totalItems = count(page.pagination?.total_items);
+        const totalItems = count3(page.pagination?.total_items);
         if (totalItems === null || page.pagination?.skip !== offset || page.pagination?.limit !== 25)
           throw new ReportDataError("Missing or mismatched session pagination metadata.");
         if (expectedSessionTotal !== void 0 && expectedSessionTotal !== totalItems)
@@ -3018,9 +3748,9 @@ async function collectRuntimeDailyReport(client, options = {}) {
   }
   const appIds = new Set(registered.map((app) => app.customer_appId));
   const reportApps = applications.map((app) => ({
-    name: label(app.name),
-    sessions: count(app.sessions_total),
-    violatingSessions: count(app.sessions_violated),
+    name: label2(app.name),
+    sessions: count3(app.sessions_total),
+    violatingSessions: count3(app.sessions_violated),
     registered: app.id && appIds.has(app.id) ? true : appSource.status === "complete" && app.id ? false : null
   })).sort(
     (a, b) => (b.violatingSessions ?? -1) - (a.violatingSessions ?? -1) || a.name.localeCompare(b.name)
@@ -3066,9 +3796,9 @@ async function collectRuntimeDailyReport(client, options = {}) {
       (p) => p["model-configuration"] ? [p["model-configuration"]] : []
     );
     const timeoutActions = [
-      ...new Set(configs.map((c) => label(c.latency?.["inline-timeout-action"])))
+      ...new Set(configs.map((c) => label2(c.latency?.["inline-timeout-action"])))
     ];
-    const name = label(profile.profile_name);
+    const name = label2(profile.profile_name);
     if (profile.active === false)
       add(
         "review",
@@ -3097,7 +3827,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
       );
     return {
       name,
-      revision: count(profile.revision),
+      revision: count3(profile.revision),
       active: profile.active ?? null,
       modified: profile.last_modified_ts && Number.isFinite(Date.parse(profile.last_modified_ts)) ? new Date(profile.last_modified_ts).toISOString() : null,
       timeoutActions,
@@ -3145,8 +3875,8 @@ async function collectRuntimeDailyReport(client, options = {}) {
       "Review these sessions in SCM and check integration error handling. This is not a tenant-wide failure rate.",
       sessionSource.name
     );
-  const chartSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count(bucket.total)));
-  const chartViolatingSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count(bucket.violating)));
+  const chartSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count3(bucket.total)));
+  const chartViolatingSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count3(bucket.violating)));
   if (chartSessions !== null && sessionSource.status === "complete" && chartSessions !== rawSessions.length)
     add(
       "review",
@@ -3157,7 +3887,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
     );
   const urgentViolations = total(
     trend.map(
-      (bucket) => total([count(bucket.violation_breakdown.critical), count(bucket.violation_breakdown.high)])
+      (bucket) => total([count3(bucket.violation_breakdown.critical), count3(bucket.violation_breakdown.high)])
     )
   );
   if ((urgentViolations ?? 0) > 0)
@@ -3173,7 +3903,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
   return {
     schemaVersion: 2,
     product: "Prisma AIRS AI Runtime Security",
-    title: label(options.title ?? "Daily environment report"),
+    title: label2(options.title ?? "Daily environment report"),
     generatedAt: now().toISOString(),
     collectionStartedAt: end,
     window: {
@@ -3192,10 +3922,10 @@ async function collectRuntimeDailyReport(client, options = {}) {
     },
     profiles,
     registeredApps: registered.map((app) => ({
-      name: label(app.app_name),
-      environment: label(app.environment),
-      cloud: label(app.cloud_provider),
-      model: label(app.model_name),
+      name: label2(app.app_name),
+      environment: label2(app.environment),
+      cloud: label2(app.cloud_provider),
+      model: label2(app.model_name),
       keyAssociations: app.api_keys_dp_info ? app.api_keys_dp_info.length : null
     })).sort((a, b) => a.name.localeCompare(b.name)),
     sessions: {
@@ -3210,22 +3940,22 @@ async function collectRuntimeDailyReport(client, options = {}) {
         sessions: chartSessions,
         violatingSessions: chartViolatingSessions,
         buckets: chart.map((bucket) => ({
-          time: label(bucket.time),
-          sessions: count(bucket.total),
-          violatingSessions: count(bucket.violating),
+          time: label2(bucket.time),
+          sessions: count3(bucket.total),
+          violatingSessions: count3(bucket.violating),
           violations: severity(bucket.violation_breakdown)
         }))
       },
       topApplications: rankings.map((app) => ({
-        name: label(app.name),
-        violations: count(app.total_violations),
+        name: label2(app.name),
+        violations: count3(app.total_violations),
         detectors: app.policy_violations.map((detector) => ({
-          name: label(detector.detection_type),
-          count: count(detector.total)
+          name: label2(detector.detection_type),
+          count: count3(detector.total)
         }))
       })),
       violationTrend: trend.map((bucket) => ({
-        time: label(bucket.date),
+        time: label2(bucket.date),
         violations: severity(bucket.violation_breakdown)
       }))
     },
@@ -3267,7 +3997,13 @@ export {
   validateTopic,
   computeMetrics,
   computeCategoryBreakdown,
+  collectGatewayEnvironmentReport,
+  renderEnvironmentReportMarkdown,
+  renderEnvironmentReportHtml,
   writeReportFile,
+  collectRedTeamEnvironmentReport,
+  renderRedTeamReportMarkdown,
+  renderRedTeamReportHtml,
   renderRuntimeReportMarkdown,
   renderRuntimeReportHtml,
   collectRuntimeDailyReport