@cdot65/prisma-airs-cli 5.0.1 → 5.2.0

package/dist/cli/index.js

@@ -9,6 +9,8 @@ import {
   SdkPromptSetService,
   SdkRedTeamService,
   SdkRuntimeService,
+  collectGatewayEnvironmentReport,
+  collectRedTeamEnvironmentReport,
   collectRuntimeDailyReport,
   computeMetrics,
   getOrCreateManagementClient,
@@ -16,6 +18,10 @@ import {
   loadConfig,
   readBackupDir,
   readBackupFile,
+  renderEnvironmentReportHtml,
+  renderEnvironmentReportMarkdown,
+  renderRedTeamReportHtml,
+  renderRedTeamReportMarkdown,
   renderRuntimeReportHtml,
   renderRuntimeReportMarkdown,
   resolveConfigFilePath,
@@ -24,7 +30,7 @@ import {
   validateTopic,
   writeBackupFile,
   writeReportFile
-} from "../chunk-IRLIFMGQ.js";
+} from "../chunk-7Z76VCB3.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -43,7 +49,7 @@ function installProcessGuards() {
 }
 
 // src/cli/program.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
@@ -3052,8 +3058,8 @@ function registerAiGatewayInference(parent) {
         process.once("SIGINT", interrupt);
         process.once("SIGTERM", interrupt);
         process.stdout.on("error", outputError);
-        const write = (text2) => new Promise((resolve4, reject) => {
-          process.stdout.write(text2, (error) => error ? reject(error) : resolve4());
+        const write = (text2) => new Promise((resolve6, reject) => {
+          process.stdout.write(text2, (error) => error ? reject(error) : resolve6());
         });
         const requestOptions = { signal: controller.signal };
         const result = kind === "chat" ? await client.createChatCompletion(
@@ -4338,6 +4344,20 @@ function registerOrganisations(root) {
   const self = showHelpOnEmpty(
     group.command("self").description("Manage the current organisation")
   );
+  const info = addReadOutput(
+    group.command("info").description("Get organisation dashboard info (settings redacted)").requiredOption("--tsg-id <id>", "Tenant service group ID")
+  );
+  info.action(
+    (opts) => runDetail(
+      info,
+      opts,
+      async (client) => redactAIGatewaySecrets(
+        "organisations.getInfo",
+        await client.organisations.getInfo(opts.tsgId),
+        "response"
+      )
+    )
+  );
   const selfGet = addReadOutput(self.command("get").description("Get the current organisation"));
   selfGet.action((opts) => runDetail(selfGet, opts, (client) => client.organisations.getSelf()));
   const selfUpdate = addWriteOutput(
@@ -4428,6 +4448,10 @@ function registerAiGatewayInventory(root) {
     { option: "name", path: "name" },
     { option: "workspace", path: "workspace_id" }
   ];
+  const catalog = addReadOutput(
+    guardrails.command("catalog").description("Get available guardrail evaluator schemas (not enabled policies)")
+  );
+  catalog.action((opts) => runDetail(catalog, opts, (client) => client.guardrails.getCatalog()));
   const addGuardrailFields = (command) => command.option("--actions <json>", "Guardrail actions object").option("--checks <json>", "Guardrail checks array").option("--name <name>", "Guardrail name").option("--workspace <uuid>", "Workspace UUID");
   const guardrailUpdateFields = guardrailFields.filter((field) => field.option !== "workspace");
   const addGuardrailUpdateFields = (command) => command.option("--actions <json>", "Guardrail actions object").option("--checks <json>", "Guardrail checks array").option("--name <name>", "Guardrail name");
@@ -4498,7 +4522,8 @@ function registerAiGatewayInventory(root) {
 // src/cli/commands/aigateway/telemetry.ts
 import {
   AI_GW_GROUP_COLUMNS,
-  AI_GW_GROUP_DIMENSIONS
+  AI_GW_GROUP_DIMENSIONS,
+  redactAIGatewaySecrets as redactAIGatewaySecrets2
 } from "@cdot65/prisma-airs-sdk";
 
 // src/cli/commands/aigateway/telemetry-filters.ts
@@ -4583,7 +4608,10 @@ function parseNamedDate2(value, flag) {
 function registerMetric(telemetry, name, description, method) {
   const command = addWindowOptions(telemetry.command(name).description(description));
   command.action(
-    (opts) => runDetail(command, opts, (client) => client.telemetry[method](windowFrom(opts)))
+    (opts) => runDetail(command, opts, async (client) => {
+      const result = await client.telemetry[method](windowFrom(opts));
+      return method === "filterBoundaries" ? redactAIGatewaySecrets2("telemetry.filterBoundaries", result, "response") : result;
+    })
   );
 }
 function registerFilteredMetric(telemetry, name, description) {
@@ -4631,6 +4659,24 @@ function registerAiGatewayTelemetryReads(telemetry) {
   );
   registerMetric(telemetry, "error-trends", "Get error trends", "errorTrends");
   registerMetric(telemetry, "errors", "Get error count", "errors");
+  registerMetric(
+    telemetry,
+    "error-category-trends",
+    "Get errors by HTTP status",
+    "errorCategoryTrends"
+  );
+  registerMetric(
+    telemetry,
+    "grouped-errors",
+    "Get HTTP error counts by time bucket",
+    "groupedErrors"
+  );
+  registerMetric(
+    telemetry,
+    "filter-boundaries",
+    "Get available analytics filters and bounds",
+    "filterBoundaries"
+  );
   const feedback = showHelpOnEmpty(
     telemetry.command("feedback").description("Inspect model feedback telemetry")
   );
@@ -4673,7 +4719,7 @@ function registerAiGatewayTelemetryReads(telemetry) {
   registerFilteredMetric(telemetry, "latency", "Get latency telemetry");
   const logs = showHelpOnEmpty(telemetry.command("logs").description("Inspect request logs"));
   const logsList = addWindowOptions(
-    logs.command("list").description("List request logs").option("--page-size <n>", "Rows per response", "50").option("--status-code <code>", "Filter by HTTP status").option("--trace-id <id>", "Return one trace id")
+    logs.command("list").description("List request logs").option("--page-size <n>", "Rows per response", "50").option("--current-page <n>", "Zero-based transaction page", "0").option("--status-code <code>", "Filter by HTTP status").option("--trace-id <id>", "Return one trace id")
   );
   logsList.action(
     (opts) => runDetail(
@@ -4682,6 +4728,7 @@ function registerAiGatewayTelemetryReads(telemetry) {
       (client) => client.telemetry.logs({
         ...windowFrom(opts),
         pageSize: parsePositiveInteger2(opts.pageSize ?? "50", "--page-size"),
+        currentPage: parseNonnegativePage(opts.currentPage ?? "0"),
         ...opts.statusCode ? { statusCode: parsePositiveInteger2(opts.statusCode, "--status-code") } : {},
         ...opts.traceId ? { traceId: opts.traceId } : {}
       })
@@ -4693,6 +4740,99 @@ function registerAiGatewayTelemetryReads(telemetry) {
   registerMetric(telemetry, "user-trends", "Get user trends", "userTrends");
   registerMetric(telemetry, "users", "Get unique-user count", "users");
 }
+function parseNonnegativePage(value) {
+  if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)))
+    throw new CliUsageError("--current-page must be a nonnegative safe integer");
+  return Number(value);
+}
+
+// src/cli/commands/aigateway-dashboard.ts
+import { lstat } from "fs/promises";
+import { resolve } from "path";
+import { AIGatewayClient as AIGatewayClient3 } from "@cdot65/prisma-airs-sdk";
+import { z } from "zod";
+import { randomUUID } from "crypto";
+function registerAiGatewayDashboardCommand(aigateway) {
+  const command = aigateway.command("dashboard").description("Generate an AI Gateway environment dashboard (read-only)").requiredOption("--workspace <ref>", "Workspace slug, UUID, or unique display name").option("--days <n>", "Rolling window in days (default: 1)", "1").option("--start <iso>", "Explicit ISO-8601 start; requires --end").option("--end <iso>", "Explicit ISO-8601 end; requires --start").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
+    "--output-file <path>",
+    "Destination (default: new timestamped file in CWD); - for stdout; never overwrite"
+  ).option("--title <text>", "Report title", "AI Gateway environment report").option("--max-pages <n>", "Page budget per source, 1\u2013100 (50 transactions/page)", "40").option("--strict", "Exit 1 after writing if any source is incomplete").addHelpText(
+    "after",
+    examples(
+      "airs aigateway dashboard --workspace ws-develo-71f8d8 --output-file ./airs-daily.html",
+      "airs aigateway dashboard --workspace ws-develo-71f8d8 --output markdown --output-file ./airs-daily.md",
+      "airs aigateway dashboard --workspace ws-develo-71f8d8",
+      "airs aigateway dashboard --workspace ws-develo-71f8d8 --strict --max-pages 20 --output-file - > daily.html"
+    )
+  ).action(async (opts) => {
+    const format = opts.output ?? command.parent?.parent?.opts().output ?? "html";
+    if (format !== "html" && format !== "markdown")
+      usageError("Report output must be html or markdown");
+    if (typeof opts.workspace !== "string" || !opts.workspace.trim())
+      usageError("--workspace cannot be empty");
+    if (!/^[1-9]\d*$/.test(opts.days) || !Number.isSafeInteger(Number(opts.days)))
+      usageError("--days must be a positive integer");
+    if (Boolean(opts.start) !== Boolean(opts.end))
+      usageError("--start and --end must be supplied together");
+    if (opts.start && command.getOptionValueSource("days") !== "default")
+      usageError("Use --days or --start/--end, not both");
+    const end = opts.end ? new Date(opts.end) : /* @__PURE__ */ new Date();
+    const start = opts.start ? new Date(opts.start) : new Date(end.getTime() - Number(opts.days) * 864e5);
+    const iso = z.string().datetime({ offset: true });
+    if (opts.start && (!iso.safeParse(opts.start).success || !iso.safeParse(opts.end).success) || !Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || start >= end)
+      usageError("Provide a valid increasing ISO-8601 window with timezone");
+    const maxPages = Number(opts.maxPages);
+    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages) || maxPages > 100)
+      usageError("--max-pages must be an integer from 1 to 100");
+    if (typeof opts.title !== "string" || !opts.title.trim() || opts.title.length > 240)
+      usageError("--title must contain 1\u2013240 characters");
+    if (opts.outputFile !== void 0 && !opts.outputFile.trim())
+      usageError("--output-file cannot be empty");
+    const defaultName = `airs-aigateway-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve(opts.outputFile ?? defaultName);
+    try {
+      if (outputPath) {
+        const existing = await lstat(outputPath).catch((error) => {
+          if (error.code !== "ENOENT") throw error;
+          return void 0;
+        });
+        if (existing) throw new Error("Output already exists");
+      }
+      const config = await loadConfig();
+      const client = new AIGatewayClient3({
+        ...aiGatewayClientOptions(config),
+        numRetries: 0
+      });
+      ui.status("Collecting AI Gateway statistics and current configuration (read-only)...");
+      const report = await collectGatewayEnvironmentReport(client, {
+        title: opts.title,
+        maxPages,
+        workspace: opts.workspace,
+        tsgId: config.mgmtTsgId ?? process.env.PANW_AI_GW_TSG_ID ?? "",
+        start,
+        end
+      });
+      const rendered = format === "html" ? renderEnvironmentReportHtml(report) : renderEnvironmentReportMarkdown(report);
+      if (outputPath) {
+        await writeReportFile(outputPath, rendered);
+        ui.status(`Report \u2192 ${outputPath.replace(/[\p{Cc}\p{Cf}]/gu, "_")} (mode 0600)`);
+      } else {
+        await new Promise(
+          (done, reject) => process.stdout.write(rendered, (error) => error ? reject(error) : done())
+        );
+      }
+      const incomplete = report.sources.filter((source) => source.status !== "complete").length;
+      if (incomplete)
+        ui.status(`${incomplete} source(s) incomplete; review the evidence section.`);
+      if (report.health === "unknown" || opts.strict && incomplete > 0) process.exitCode = 1;
+    } catch {
+      ui.error(
+        "Report generation failed. Verify Management API configuration and a writable, new output path. Existing files are never overwritten."
+      );
+      process.exitCode = 1;
+    }
+  });
+}
 
 // src/cli/commands/aigateway.ts
 async function createService() {
@@ -4756,6 +4896,7 @@ function scopeNameLooksUnrelated(name, scopeName) {
 function registerAiGatewayCommand(program) {
   const aigateway = program.command("aigateway").description("Manage and observe Prisma AIRS AI Gateway resources").action(() => aigateway.outputHelp());
   registerAiGatewayInventory(aigateway);
+  registerAiGatewayDashboardCommand(aigateway);
   registerAiGatewayInference(aigateway);
   const workspace = aigateway.command("workspaces").alias("workspace").description("Manage gateway workspaces").action(() => workspace.outputHelp());
   const workspaceList = workspace.command("list").description("List workspaces (default: active workspaces you are scoped to)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--status <status>", "Filter by lifecycle state: active or archived").option("--all", "Merge active + archived admin-plane reads (whole tenant, both states)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
@@ -5198,7 +5339,7 @@ function registerConfigCommand(program) {
 }
 
 // src/cli/commands/doctor.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { readFile as readFile4 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
 var DOCTOR_TIMEOUT_MS = 5e3;
@@ -5296,8 +5437,8 @@ async function withTimeout(promise, ms) {
   try {
     return await Promise.race([
       promise,
-      new Promise((resolve4) => {
-        timer = setTimeout(() => resolve4(TIMED_OUT), ms);
+      new Promise((resolve6) => {
+        timer = setTimeout(() => resolve6(TIMED_OUT), ms);
       })
     ]);
   } finally {
@@ -5452,7 +5593,7 @@ async function defaultScannerProbe() {
   const config = await loadConfig();
   init(runtimeInitOptions(config));
   const scanner = new Scanner();
-  return scanner.queryByScanIds([randomUUID()]);
+  return scanner.queryByScanIds([randomUUID2()]);
 }
 async function defaultMgmtProbe() {
   const config = await loadConfig();
@@ -5567,12 +5708,12 @@ function hasBin(bin) {
   }
 }
 function run(bin, args, label) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn(bin, args, { stdio: "inherit" });
     child.on("error", (err) => reject(new Error(`Failed to start ${bin}: ${err.message}`)));
     child.on("close", (code) => {
       if (code !== 0) reject(new Error(`${label} failed with exit code ${code}`));
-      else resolve4();
+      else resolve6();
     });
   });
 }
@@ -6150,6 +6291,76 @@ async function backupTargets(opts) {
   return results;
 }
 
+// src/cli/commands/redteam-dashboard.ts
+import { lstat as lstat2 } from "fs/promises";
+import { resolve as resolve2 } from "path";
+import { RedTeamClient } from "@cdot65/prisma-airs-sdk";
+import { randomUUID as randomUUID3 } from "crypto";
+function registerRedTeamDashboardCommand(redteam) {
+  const command = redteam.command("dashboard").description("Generate a Red Team environment dashboard (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
+    "--output-file <path>",
+    "Destination (default: new timestamped file in CWD); - for stdout; never overwrite"
+  ).option("--title <text>", "Report title", "Red Team environment report").option("--max-pages <n>", "Page budget per source, 1\u2013100 (15 records/page)", "40").option("--strict", "Exit 1 after writing if any source is incomplete").addHelpText(
+    "after",
+    examples(
+      "airs redteam dashboard --output-file ./airs-daily.html",
+      "airs redteam dashboard --output markdown --output-file ./airs-daily.md",
+      "airs redteam dashboard",
+      "airs redteam dashboard --strict --max-pages 20 --output-file - > daily.html"
+    )
+  ).action(async (opts) => {
+    const format = opts.output ?? command.parent?.parent?.opts().output ?? "html";
+    if (format !== "html" && format !== "markdown")
+      usageError("Report output must be html or markdown");
+    const maxPages = Number(opts.maxPages);
+    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages) || maxPages > 100)
+      usageError("--max-pages must be an integer from 1 to 100");
+    if (typeof opts.title !== "string" || !opts.title.trim() || opts.title.length > 240)
+      usageError("--title must contain 1\u2013240 characters");
+    if (opts.outputFile !== void 0 && !opts.outputFile.trim())
+      usageError("--output-file cannot be empty");
+    const defaultName = `airs-redteam-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID3().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve2(opts.outputFile ?? defaultName);
+    try {
+      if (outputPath) {
+        const existing = await lstat2(outputPath).catch((error) => {
+          if (error.code !== "ENOENT") throw error;
+          return void 0;
+        });
+        if (existing) throw new Error("Output already exists");
+      }
+      const config = await loadConfig();
+      const client = new RedTeamClient({
+        ...redTeamClientOptions(config),
+        numRetries: 0
+      });
+      ui.status("Collecting Red Team statistics and current configuration (read-only)...");
+      const report = await collectRedTeamEnvironmentReport(client, {
+        title: opts.title,
+        maxPages
+      });
+      const rendered = format === "html" ? renderRedTeamReportHtml(report) : renderRedTeamReportMarkdown(report);
+      if (outputPath) {
+        await writeReportFile(outputPath, rendered);
+        ui.status(`Report \u2192 ${outputPath.replace(/[\p{Cc}\p{Cf}]/gu, "_")} (mode 0600)`);
+      } else {
+        await new Promise(
+          (done, reject) => process.stdout.write(rendered, (error) => error ? reject(error) : done())
+        );
+      }
+      const incomplete = report.sources.filter((source) => source.status !== "complete").length;
+      if (incomplete)
+        ui.status(`${incomplete} source(s) incomplete; review the evidence section.`);
+      if (report.health === "unknown" || opts.strict && incomplete > 0) process.exitCode = 1;
+    } catch {
+      ui.error(
+        "Report generation failed. Verify Management API configuration and a writable, new output path. Existing files are never overwritten."
+      );
+      process.exitCode = 1;
+    }
+  });
+}
+
 // src/cli/commands/restore.ts
 var SERVER_DERIVED_FIELDS = [
   "uuid",
@@ -6392,6 +6603,7 @@ function parseAdapterVariables(input) {
 }
 function registerRedteamCommand(program) {
   const redteam = program.command("redteam").description("AI Red Team scan operations");
+  registerRedTeamDashboardCommand(redteam);
   redteam.command("abort <jobId>").description("Abort a running scan").action(async (jobId) => {
     try {
       renderRedteamHeader();
@@ -7385,7 +7597,7 @@ function registerRedteamCommand(program) {
 }
 
 // src/cli/commands/runtime.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import * as fs5 from "fs";
 import { readFile as readFile10 } from "fs/promises";
 import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
@@ -7633,7 +7845,7 @@ function mergeProfilePolicy(existing, overrides) {
 }
 
 // src/cli/bulk-scan-lock.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import * as fs3 from "fs/promises";
 function errorCode(error) {
   return error?.code;
@@ -7664,7 +7876,7 @@ function processIsAlive(pid) {
   }
 }
 async function installLock(lockPath, record) {
-  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID2()}`;
+  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID4()}`;
   try {
     await fs3.writeFile(candidate, JSON.stringify(record), {
       encoding: "utf-8",
@@ -7682,7 +7894,7 @@ async function acquireBulkScanLock(statePath) {
     version: 1,
     pid: process.pid,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    token: randomUUID2()
+    token: randomUUID4()
   };
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
@@ -7718,32 +7930,32 @@ async function acquireBulkScanLock(statePath) {
 }
 
 // src/cli/bulk-scan-state.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import * as fs4 from "fs/promises";
 import * as path2 from "path";
-import { z } from "zod";
-var BulkScanResultSchema = z.object({
-  index: z.number().int().nonnegative(),
-  reqId: z.number().int().nonnegative(),
-  prompt: z.string(),
-  response: z.string().optional(),
-  scanId: z.string(),
-  reportId: z.string(),
-  action: z.enum(["allow", "block", "failed"]),
-  category: z.string(),
-  triggered: z.boolean(),
-  detections: z.record(z.boolean()),
-  error: z.string().optional()
+import { z as z2 } from "zod";
+var BulkScanResultSchema = z2.object({
+  index: z2.number().int().nonnegative(),
+  reqId: z2.number().int().nonnegative(),
+  prompt: z2.string(),
+  response: z2.string().optional(),
+  scanId: z2.string(),
+  reportId: z2.string(),
+  action: z2.enum(["allow", "block", "failed"]),
+  category: z2.string(),
+  triggered: z2.boolean(),
+  detections: z2.record(z2.boolean()),
+  error: z2.string().optional()
 });
-var BulkScanItemSchema = z.object({
-  index: z.number().int().nonnegative(),
-  reqId: z.number().int().nonnegative(),
-  prompt: z.string(),
-  status: z.enum(["pending", "submitting", "submitted", "complete", "failed", "ambiguous"]),
-  scanId: z.string().min(1).optional(),
-  receiptReportId: z.string().optional(),
+var BulkScanItemSchema = z2.object({
+  index: z2.number().int().nonnegative(),
+  reqId: z2.number().int().nonnegative(),
+  prompt: z2.string(),
+  status: z2.enum(["pending", "submitting", "submitted", "complete", "failed", "ambiguous"]),
+  scanId: z2.string().min(1).optional(),
+  receiptReportId: z2.string().optional(),
   result: BulkScanResultSchema.optional(),
-  error: z.string().optional()
+  error: z2.string().optional()
 }).superRefine((item, ctx) => {
   if (item.reqId !== item.index) {
     ctx.addIssue({ code: "custom", message: "reqId must match the stable input index" });
@@ -7781,15 +7993,15 @@ var BulkScanItemSchema = z.object({
     }
   }
 });
-var BulkScanStateSchema = z.object({
-  version: z.literal(2),
-  profile: z.string().min(1),
-  sessionId: z.string().optional(),
-  outputFile: z.string().min(1),
-  batchSize: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  createdAt: z.string().datetime(),
-  updatedAt: z.string().datetime(),
-  items: z.array(BulkScanItemSchema).min(1)
+var BulkScanStateSchema = z2.object({
+  version: z2.literal(2),
+  profile: z2.string().min(1),
+  sessionId: z2.string().optional(),
+  outputFile: z2.string().min(1),
+  batchSize: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  createdAt: z2.string().datetime(),
+  updatedAt: z2.string().datetime(),
+  items: z2.array(BulkScanItemSchema).min(1)
 }).superRefine((state, ctx) => {
   const indices = /* @__PURE__ */ new Set();
   for (const [position, item] of state.items.entries()) {
@@ -7815,8 +8027,8 @@ async function saveBulkScanState(state, dir, filePath) {
   }
   await fs4.mkdir(dir, { recursive: true, mode: 448 });
   if (!filePath) await fs4.chmod(dir, 448);
-  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID3()}.bulk-scan.json`);
-  const temporary = `${target}.tmp-${process.pid}-${randomUUID3()}`;
+  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID5()}.bulk-scan.json`);
+  const temporary = `${target}.tmp-${process.pid}-${randomUUID5()}`;
   try {
     await fs4.writeFile(temporary, JSON.stringify(state, null, 2), {
       encoding: "utf-8",
@@ -8941,8 +9153,8 @@ function registerCleanupCommand(parent) {
 }
 
 // src/cli/commands/runtime-dashboard.ts
-import { lstat } from "fs/promises";
-import { resolve as resolve2 } from "path";
+import { lstat as lstat3 } from "fs/promises";
+import { resolve as resolve4 } from "path";
 import { dump as dump5 } from "js-yaml";
 var TIME_UNITS = ["hour", "hours", "day", "days"];
 function integer2(value, name, minimum = 0) {
@@ -9018,8 +9230,8 @@ function registerRuntimeDashboardCommands(runtime) {
               "Scan content requires exactly one of --show-content or --output-file <new-path>"
             );
           if (opts.outputFile) {
-            const path3 = resolve2(text(opts.outputFile, "--output-file"));
-            const existing = await lstat(path3).catch((error) => {
+            const path3 = resolve4(text(opts.outputFile, "--output-file"));
+            const existing = await lstat3(path3).catch((error) => {
               if (error.code !== "ENOENT") throw error;
               return void 0;
             });
@@ -9034,7 +9246,7 @@ function registerRuntimeDashboardCommands(runtime) {
         const result = await read(client.dashboard);
         const output = format === "yaml" ? dump5(result, { noRefs: true, lineWidth: -1 }).trimEnd() : JSON.stringify(result, null, 2);
         if (command.name() === "scan-content" && opts.outputFile) {
-          await writeReportFile(resolve2(String(opts.outputFile)), `${output}
+          await writeReportFile(resolve4(String(opts.outputFile)), `${output}
 `);
           ui.status("Scan content exported to the requested private file (0600).");
         } else console.log(output);
@@ -9205,9 +9417,9 @@ function registerRuntimeDashboardCommands(runtime) {
 }
 
 // src/cli/commands/runtime-report.ts
-import { lstat as lstat2 } from "fs/promises";
-import { resolve as resolve3 } from "path";
-import { randomUUID as randomUUID4 } from "crypto";
+import { lstat as lstat4 } from "fs/promises";
+import { resolve as resolve5 } from "path";
+import { randomUUID as randomUUID6 } from "crypto";
 function registerRuntimeReportCommand(runtime) {
   const command = runtime.command("report").description("Generate a daily AI Runtime Security environment dashboard (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
     "--output-file <path>",
@@ -9231,11 +9443,11 @@ function registerRuntimeReportCommand(runtime) {
       usageError("--title must contain 1\u2013240 characters");
     if (opts.outputFile !== void 0 && !opts.outputFile.trim())
       usageError("--output-file cannot be empty");
-    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID4().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
-    const outputPath = opts.outputFile === "-" ? void 0 : resolve3(opts.outputFile ?? defaultName);
+    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID6().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve5(opts.outputFile ?? defaultName);
     try {
       if (outputPath) {
-        const existing = await lstat2(outputPath).catch((error) => {
+        const existing = await lstat4(outputPath).catch((error) => {
           if (error.code !== "ENOENT") throw error;
           return void 0;
         });
@@ -9722,7 +9934,7 @@ function completedBulkResults(state) {
 }
 async function writeBulkResults(outputPath, results) {
   await fs5.promises.mkdir(dirname3(outputPath), { recursive: true });
-  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID5()}`;
+  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID7()}`;
   try {
     await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
       encoding: "utf-8",
@@ -10567,12 +10779,12 @@ function buildProgram() {
   program.hook("preAction", async (_thisCommand, actionCommand) => {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
-    const isRuntimeReport = actionCommand.name() === "report" && actionCommand.parent?.name() === "runtime";
-    if (isRuntimeReport && (root.debug || /^(1|true|yes|on)$/i.test(process.env.PANW_AI_SEC_DEBUG?.trim() ?? "")))
+    const isEnvironmentReport = actionCommand.name() === "report" && actionCommand.parent?.name() === "runtime" || actionCommand.name() === "dashboard" && ["redteam", "aigateway"].includes(actionCommand.parent?.name() ?? "");
+    if (isEnvironmentReport && (root.debug || /^(1|true|yes|on)$/i.test(process.env.PANW_AI_SEC_DEBUG?.trim() ?? "")))
       usageError(
         "Disable --debug and PANW_AI_SEC_DEBUG for environment reports to avoid persisting sensitive traffic content"
       );
-    if (!isRuntimeReport && READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
+    if (!isEnvironmentReport && READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
       try {
         const format = await resolveOutput(actionCommand, actionCommand.opts());
         actionCommand.setOptionValueWithSource("output", format, "implied");
@@ -10583,7 +10795,7 @@ function buildProgram() {
     if (root.debug) {
       const logPath = join4(
         process.cwd(),
-        `debug-api-${Date.now()}-${randomUUID6().slice(0, 8)}.jsonl`
+        `debug-api-${Date.now()}-${randomUUID8().slice(0, 8)}.jsonl`
       );
       try {
         installDebugLogger(logPath);