@cdot65/prisma-airs-cli 5.1.0 → 5.2.0

package/dist/cli/index.js

@@ -9,6 +9,7 @@ import {
   SdkPromptSetService,
   SdkRedTeamService,
   SdkRuntimeService,
+  collectGatewayEnvironmentReport,
   collectRedTeamEnvironmentReport,
   collectRuntimeDailyReport,
   computeMetrics,
@@ -17,6 +18,8 @@ import {
   loadConfig,
   readBackupDir,
   readBackupFile,
+  renderEnvironmentReportHtml,
+  renderEnvironmentReportMarkdown,
   renderRedTeamReportHtml,
   renderRedTeamReportMarkdown,
   renderRuntimeReportHtml,
@@ -27,7 +30,7 @@ import {
   validateTopic,
   writeBackupFile,
   writeReportFile
-} from "../chunk-DR6MZG4E.js";
+} from "../chunk-7Z76VCB3.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -46,7 +49,7 @@ function installProcessGuards() {
 }
 
 // src/cli/program.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
@@ -3055,8 +3058,8 @@ function registerAiGatewayInference(parent) {
         process.once("SIGINT", interrupt);
         process.once("SIGTERM", interrupt);
         process.stdout.on("error", outputError);
-        const write = (text2) => new Promise((resolve5, reject) => {
-          process.stdout.write(text2, (error) => error ? reject(error) : resolve5());
+        const write = (text2) => new Promise((resolve6, reject) => {
+          process.stdout.write(text2, (error) => error ? reject(error) : resolve6());
         });
         const requestOptions = { signal: controller.signal };
         const result = kind === "chat" ? await client.createChatCompletion(
@@ -4341,6 +4344,20 @@ function registerOrganisations(root) {
   const self = showHelpOnEmpty(
     group.command("self").description("Manage the current organisation")
   );
+  const info = addReadOutput(
+    group.command("info").description("Get organisation dashboard info (settings redacted)").requiredOption("--tsg-id <id>", "Tenant service group ID")
+  );
+  info.action(
+    (opts) => runDetail(
+      info,
+      opts,
+      async (client) => redactAIGatewaySecrets(
+        "organisations.getInfo",
+        await client.organisations.getInfo(opts.tsgId),
+        "response"
+      )
+    )
+  );
   const selfGet = addReadOutput(self.command("get").description("Get the current organisation"));
   selfGet.action((opts) => runDetail(selfGet, opts, (client) => client.organisations.getSelf()));
   const selfUpdate = addWriteOutput(
@@ -4431,6 +4448,10 @@ function registerAiGatewayInventory(root) {
     { option: "name", path: "name" },
     { option: "workspace", path: "workspace_id" }
   ];
+  const catalog = addReadOutput(
+    guardrails.command("catalog").description("Get available guardrail evaluator schemas (not enabled policies)")
+  );
+  catalog.action((opts) => runDetail(catalog, opts, (client) => client.guardrails.getCatalog()));
   const addGuardrailFields = (command) => command.option("--actions <json>", "Guardrail actions object").option("--checks <json>", "Guardrail checks array").option("--name <name>", "Guardrail name").option("--workspace <uuid>", "Workspace UUID");
   const guardrailUpdateFields = guardrailFields.filter((field) => field.option !== "workspace");
   const addGuardrailUpdateFields = (command) => command.option("--actions <json>", "Guardrail actions object").option("--checks <json>", "Guardrail checks array").option("--name <name>", "Guardrail name");
@@ -4501,7 +4522,8 @@ function registerAiGatewayInventory(root) {
 // src/cli/commands/aigateway/telemetry.ts
 import {
   AI_GW_GROUP_COLUMNS,
-  AI_GW_GROUP_DIMENSIONS
+  AI_GW_GROUP_DIMENSIONS,
+  redactAIGatewaySecrets as redactAIGatewaySecrets2
 } from "@cdot65/prisma-airs-sdk";
 
 // src/cli/commands/aigateway/telemetry-filters.ts
@@ -4586,7 +4608,10 @@ function parseNamedDate2(value, flag) {
 function registerMetric(telemetry, name, description, method) {
   const command = addWindowOptions(telemetry.command(name).description(description));
   command.action(
-    (opts) => runDetail(command, opts, (client) => client.telemetry[method](windowFrom(opts)))
+    (opts) => runDetail(command, opts, async (client) => {
+      const result = await client.telemetry[method](windowFrom(opts));
+      return method === "filterBoundaries" ? redactAIGatewaySecrets2("telemetry.filterBoundaries", result, "response") : result;
+    })
   );
 }
 function registerFilteredMetric(telemetry, name, description) {
@@ -4634,6 +4659,24 @@ function registerAiGatewayTelemetryReads(telemetry) {
   );
   registerMetric(telemetry, "error-trends", "Get error trends", "errorTrends");
   registerMetric(telemetry, "errors", "Get error count", "errors");
+  registerMetric(
+    telemetry,
+    "error-category-trends",
+    "Get errors by HTTP status",
+    "errorCategoryTrends"
+  );
+  registerMetric(
+    telemetry,
+    "grouped-errors",
+    "Get HTTP error counts by time bucket",
+    "groupedErrors"
+  );
+  registerMetric(
+    telemetry,
+    "filter-boundaries",
+    "Get available analytics filters and bounds",
+    "filterBoundaries"
+  );
   const feedback = showHelpOnEmpty(
     telemetry.command("feedback").description("Inspect model feedback telemetry")
   );
@@ -4676,7 +4719,7 @@ function registerAiGatewayTelemetryReads(telemetry) {
   registerFilteredMetric(telemetry, "latency", "Get latency telemetry");
   const logs = showHelpOnEmpty(telemetry.command("logs").description("Inspect request logs"));
   const logsList = addWindowOptions(
-    logs.command("list").description("List request logs").option("--page-size <n>", "Rows per response", "50").option("--status-code <code>", "Filter by HTTP status").option("--trace-id <id>", "Return one trace id")
+    logs.command("list").description("List request logs").option("--page-size <n>", "Rows per response", "50").option("--current-page <n>", "Zero-based transaction page", "0").option("--status-code <code>", "Filter by HTTP status").option("--trace-id <id>", "Return one trace id")
   );
   logsList.action(
     (opts) => runDetail(
@@ -4685,6 +4728,7 @@ function registerAiGatewayTelemetryReads(telemetry) {
       (client) => client.telemetry.logs({
         ...windowFrom(opts),
         pageSize: parsePositiveInteger2(opts.pageSize ?? "50", "--page-size"),
+        currentPage: parseNonnegativePage(opts.currentPage ?? "0"),
         ...opts.statusCode ? { statusCode: parsePositiveInteger2(opts.statusCode, "--status-code") } : {},
         ...opts.traceId ? { traceId: opts.traceId } : {}
       })
@@ -4696,6 +4740,99 @@ function registerAiGatewayTelemetryReads(telemetry) {
   registerMetric(telemetry, "user-trends", "Get user trends", "userTrends");
   registerMetric(telemetry, "users", "Get unique-user count", "users");
 }
+function parseNonnegativePage(value) {
+  if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)))
+    throw new CliUsageError("--current-page must be a nonnegative safe integer");
+  return Number(value);
+}
+
+// src/cli/commands/aigateway-dashboard.ts
+import { lstat } from "fs/promises";
+import { resolve } from "path";
+import { AIGatewayClient as AIGatewayClient3 } from "@cdot65/prisma-airs-sdk";
+import { z } from "zod";
+import { randomUUID } from "crypto";
+function registerAiGatewayDashboardCommand(aigateway) {
+  const command = aigateway.command("dashboard").description("Generate an AI Gateway environment dashboard (read-only)").requiredOption("--workspace <ref>", "Workspace slug, UUID, or unique display name").option("--days <n>", "Rolling window in days (default: 1)", "1").option("--start <iso>", "Explicit ISO-8601 start; requires --end").option("--end <iso>", "Explicit ISO-8601 end; requires --start").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
+    "--output-file <path>",
+    "Destination (default: new timestamped file in CWD); - for stdout; never overwrite"
+  ).option("--title <text>", "Report title", "AI Gateway environment report").option("--max-pages <n>", "Page budget per source, 1\u2013100 (50 transactions/page)", "40").option("--strict", "Exit 1 after writing if any source is incomplete").addHelpText(
+    "after",
+    examples(
+      "airs aigateway dashboard --workspace ws-develo-71f8d8 --output-file ./airs-daily.html",
+      "airs aigateway dashboard --workspace ws-develo-71f8d8 --output markdown --output-file ./airs-daily.md",
+      "airs aigateway dashboard --workspace ws-develo-71f8d8",
+      "airs aigateway dashboard --workspace ws-develo-71f8d8 --strict --max-pages 20 --output-file - > daily.html"
+    )
+  ).action(async (opts) => {
+    const format = opts.output ?? command.parent?.parent?.opts().output ?? "html";
+    if (format !== "html" && format !== "markdown")
+      usageError("Report output must be html or markdown");
+    if (typeof opts.workspace !== "string" || !opts.workspace.trim())
+      usageError("--workspace cannot be empty");
+    if (!/^[1-9]\d*$/.test(opts.days) || !Number.isSafeInteger(Number(opts.days)))
+      usageError("--days must be a positive integer");
+    if (Boolean(opts.start) !== Boolean(opts.end))
+      usageError("--start and --end must be supplied together");
+    if (opts.start && command.getOptionValueSource("days") !== "default")
+      usageError("Use --days or --start/--end, not both");
+    const end = opts.end ? new Date(opts.end) : /* @__PURE__ */ new Date();
+    const start = opts.start ? new Date(opts.start) : new Date(end.getTime() - Number(opts.days) * 864e5);
+    const iso = z.string().datetime({ offset: true });
+    if (opts.start && (!iso.safeParse(opts.start).success || !iso.safeParse(opts.end).success) || !Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || start >= end)
+      usageError("Provide a valid increasing ISO-8601 window with timezone");
+    const maxPages = Number(opts.maxPages);
+    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages) || maxPages > 100)
+      usageError("--max-pages must be an integer from 1 to 100");
+    if (typeof opts.title !== "string" || !opts.title.trim() || opts.title.length > 240)
+      usageError("--title must contain 1\u2013240 characters");
+    if (opts.outputFile !== void 0 && !opts.outputFile.trim())
+      usageError("--output-file cannot be empty");
+    const defaultName = `airs-aigateway-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve(opts.outputFile ?? defaultName);
+    try {
+      if (outputPath) {
+        const existing = await lstat(outputPath).catch((error) => {
+          if (error.code !== "ENOENT") throw error;
+          return void 0;
+        });
+        if (existing) throw new Error("Output already exists");
+      }
+      const config = await loadConfig();
+      const client = new AIGatewayClient3({
+        ...aiGatewayClientOptions(config),
+        numRetries: 0
+      });
+      ui.status("Collecting AI Gateway statistics and current configuration (read-only)...");
+      const report = await collectGatewayEnvironmentReport(client, {
+        title: opts.title,
+        maxPages,
+        workspace: opts.workspace,
+        tsgId: config.mgmtTsgId ?? process.env.PANW_AI_GW_TSG_ID ?? "",
+        start,
+        end
+      });
+      const rendered = format === "html" ? renderEnvironmentReportHtml(report) : renderEnvironmentReportMarkdown(report);
+      if (outputPath) {
+        await writeReportFile(outputPath, rendered);
+        ui.status(`Report \u2192 ${outputPath.replace(/[\p{Cc}\p{Cf}]/gu, "_")} (mode 0600)`);
+      } else {
+        await new Promise(
+          (done, reject) => process.stdout.write(rendered, (error) => error ? reject(error) : done())
+        );
+      }
+      const incomplete = report.sources.filter((source) => source.status !== "complete").length;
+      if (incomplete)
+        ui.status(`${incomplete} source(s) incomplete; review the evidence section.`);
+      if (report.health === "unknown" || opts.strict && incomplete > 0) process.exitCode = 1;
+    } catch {
+      ui.error(
+        "Report generation failed. Verify Management API configuration and a writable, new output path. Existing files are never overwritten."
+      );
+      process.exitCode = 1;
+    }
+  });
+}
 
 // src/cli/commands/aigateway.ts
 async function createService() {
@@ -4759,6 +4896,7 @@ function scopeNameLooksUnrelated(name, scopeName) {
 function registerAiGatewayCommand(program) {
   const aigateway = program.command("aigateway").description("Manage and observe Prisma AIRS AI Gateway resources").action(() => aigateway.outputHelp());
   registerAiGatewayInventory(aigateway);
+  registerAiGatewayDashboardCommand(aigateway);
   registerAiGatewayInference(aigateway);
   const workspace = aigateway.command("workspaces").alias("workspace").description("Manage gateway workspaces").action(() => workspace.outputHelp());
   const workspaceList = workspace.command("list").description("List workspaces (default: active workspaces you are scoped to)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--status <status>", "Filter by lifecycle state: active or archived").option("--all", "Merge active + archived admin-plane reads (whole tenant, both states)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
@@ -5201,7 +5339,7 @@ function registerConfigCommand(program) {
 }
 
 // src/cli/commands/doctor.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { readFile as readFile4 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
 var DOCTOR_TIMEOUT_MS = 5e3;
@@ -5299,8 +5437,8 @@ async function withTimeout(promise, ms) {
   try {
     return await Promise.race([
       promise,
-      new Promise((resolve5) => {
-        timer = setTimeout(() => resolve5(TIMED_OUT), ms);
+      new Promise((resolve6) => {
+        timer = setTimeout(() => resolve6(TIMED_OUT), ms);
       })
     ]);
   } finally {
@@ -5455,7 +5593,7 @@ async function defaultScannerProbe() {
   const config = await loadConfig();
   init(runtimeInitOptions(config));
   const scanner = new Scanner();
-  return scanner.queryByScanIds([randomUUID()]);
+  return scanner.queryByScanIds([randomUUID2()]);
 }
 async function defaultMgmtProbe() {
   const config = await loadConfig();
@@ -5570,12 +5708,12 @@ function hasBin(bin) {
   }
 }
 function run(bin, args, label) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn(bin, args, { stdio: "inherit" });
     child.on("error", (err) => reject(new Error(`Failed to start ${bin}: ${err.message}`)));
     child.on("close", (code) => {
       if (code !== 0) reject(new Error(`${label} failed with exit code ${code}`));
-      else resolve5();
+      else resolve6();
     });
   });
 }
@@ -6154,10 +6292,10 @@ async function backupTargets(opts) {
 }
 
 // src/cli/commands/redteam-dashboard.ts
-import { lstat } from "fs/promises";
-import { resolve } from "path";
+import { lstat as lstat2 } from "fs/promises";
+import { resolve as resolve2 } from "path";
 import { RedTeamClient } from "@cdot65/prisma-airs-sdk";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 function registerRedTeamDashboardCommand(redteam) {
   const command = redteam.command("dashboard").description("Generate a Red Team environment dashboard (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
     "--output-file <path>",
@@ -6181,11 +6319,11 @@ function registerRedTeamDashboardCommand(redteam) {
       usageError("--title must contain 1\u2013240 characters");
     if (opts.outputFile !== void 0 && !opts.outputFile.trim())
       usageError("--output-file cannot be empty");
-    const defaultName = `airs-redteam-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID2().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
-    const outputPath = opts.outputFile === "-" ? void 0 : resolve(opts.outputFile ?? defaultName);
+    const defaultName = `airs-redteam-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID3().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve2(opts.outputFile ?? defaultName);
     try {
       if (outputPath) {
-        const existing = await lstat(outputPath).catch((error) => {
+        const existing = await lstat2(outputPath).catch((error) => {
           if (error.code !== "ENOENT") throw error;
           return void 0;
         });
@@ -7459,7 +7597,7 @@ function registerRedteamCommand(program) {
 }
 
 // src/cli/commands/runtime.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import * as fs5 from "fs";
 import { readFile as readFile10 } from "fs/promises";
 import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
@@ -7707,7 +7845,7 @@ function mergeProfilePolicy(existing, overrides) {
 }
 
 // src/cli/bulk-scan-lock.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import * as fs3 from "fs/promises";
 function errorCode(error) {
   return error?.code;
@@ -7738,7 +7876,7 @@ function processIsAlive(pid) {
   }
 }
 async function installLock(lockPath, record) {
-  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID3()}`;
+  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID4()}`;
   try {
     await fs3.writeFile(candidate, JSON.stringify(record), {
       encoding: "utf-8",
@@ -7756,7 +7894,7 @@ async function acquireBulkScanLock(statePath) {
     version: 1,
     pid: process.pid,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    token: randomUUID3()
+    token: randomUUID4()
   };
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
@@ -7792,32 +7930,32 @@ async function acquireBulkScanLock(statePath) {
 }
 
 // src/cli/bulk-scan-state.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import * as fs4 from "fs/promises";
 import * as path2 from "path";
-import { z } from "zod";
-var BulkScanResultSchema = z.object({
-  index: z.number().int().nonnegative(),
-  reqId: z.number().int().nonnegative(),
-  prompt: z.string(),
-  response: z.string().optional(),
-  scanId: z.string(),
-  reportId: z.string(),
-  action: z.enum(["allow", "block", "failed"]),
-  category: z.string(),
-  triggered: z.boolean(),
-  detections: z.record(z.boolean()),
-  error: z.string().optional()
+import { z as z2 } from "zod";
+var BulkScanResultSchema = z2.object({
+  index: z2.number().int().nonnegative(),
+  reqId: z2.number().int().nonnegative(),
+  prompt: z2.string(),
+  response: z2.string().optional(),
+  scanId: z2.string(),
+  reportId: z2.string(),
+  action: z2.enum(["allow", "block", "failed"]),
+  category: z2.string(),
+  triggered: z2.boolean(),
+  detections: z2.record(z2.boolean()),
+  error: z2.string().optional()
 });
-var BulkScanItemSchema = z.object({
-  index: z.number().int().nonnegative(),
-  reqId: z.number().int().nonnegative(),
-  prompt: z.string(),
-  status: z.enum(["pending", "submitting", "submitted", "complete", "failed", "ambiguous"]),
-  scanId: z.string().min(1).optional(),
-  receiptReportId: z.string().optional(),
+var BulkScanItemSchema = z2.object({
+  index: z2.number().int().nonnegative(),
+  reqId: z2.number().int().nonnegative(),
+  prompt: z2.string(),
+  status: z2.enum(["pending", "submitting", "submitted", "complete", "failed", "ambiguous"]),
+  scanId: z2.string().min(1).optional(),
+  receiptReportId: z2.string().optional(),
   result: BulkScanResultSchema.optional(),
-  error: z.string().optional()
+  error: z2.string().optional()
 }).superRefine((item, ctx) => {
   if (item.reqId !== item.index) {
     ctx.addIssue({ code: "custom", message: "reqId must match the stable input index" });
@@ -7855,15 +7993,15 @@ var BulkScanItemSchema = z.object({
     }
   }
 });
-var BulkScanStateSchema = z.object({
-  version: z.literal(2),
-  profile: z.string().min(1),
-  sessionId: z.string().optional(),
-  outputFile: z.string().min(1),
-  batchSize: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  createdAt: z.string().datetime(),
-  updatedAt: z.string().datetime(),
-  items: z.array(BulkScanItemSchema).min(1)
+var BulkScanStateSchema = z2.object({
+  version: z2.literal(2),
+  profile: z2.string().min(1),
+  sessionId: z2.string().optional(),
+  outputFile: z2.string().min(1),
+  batchSize: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  createdAt: z2.string().datetime(),
+  updatedAt: z2.string().datetime(),
+  items: z2.array(BulkScanItemSchema).min(1)
 }).superRefine((state, ctx) => {
   const indices = /* @__PURE__ */ new Set();
   for (const [position, item] of state.items.entries()) {
@@ -7889,8 +8027,8 @@ async function saveBulkScanState(state, dir, filePath) {
   }
   await fs4.mkdir(dir, { recursive: true, mode: 448 });
   if (!filePath) await fs4.chmod(dir, 448);
-  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID4()}.bulk-scan.json`);
-  const temporary = `${target}.tmp-${process.pid}-${randomUUID4()}`;
+  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID5()}.bulk-scan.json`);
+  const temporary = `${target}.tmp-${process.pid}-${randomUUID5()}`;
   try {
     await fs4.writeFile(temporary, JSON.stringify(state, null, 2), {
       encoding: "utf-8",
@@ -9015,8 +9153,8 @@ function registerCleanupCommand(parent) {
 }
 
 // src/cli/commands/runtime-dashboard.ts
-import { lstat as lstat2 } from "fs/promises";
-import { resolve as resolve3 } from "path";
+import { lstat as lstat3 } from "fs/promises";
+import { resolve as resolve4 } from "path";
 import { dump as dump5 } from "js-yaml";
 var TIME_UNITS = ["hour", "hours", "day", "days"];
 function integer2(value, name, minimum = 0) {
@@ -9092,8 +9230,8 @@ function registerRuntimeDashboardCommands(runtime) {
               "Scan content requires exactly one of --show-content or --output-file <new-path>"
             );
           if (opts.outputFile) {
-            const path3 = resolve3(text(opts.outputFile, "--output-file"));
-            const existing = await lstat2(path3).catch((error) => {
+            const path3 = resolve4(text(opts.outputFile, "--output-file"));
+            const existing = await lstat3(path3).catch((error) => {
               if (error.code !== "ENOENT") throw error;
               return void 0;
             });
@@ -9108,7 +9246,7 @@ function registerRuntimeDashboardCommands(runtime) {
         const result = await read(client.dashboard);
         const output = format === "yaml" ? dump5(result, { noRefs: true, lineWidth: -1 }).trimEnd() : JSON.stringify(result, null, 2);
         if (command.name() === "scan-content" && opts.outputFile) {
-          await writeReportFile(resolve3(String(opts.outputFile)), `${output}
+          await writeReportFile(resolve4(String(opts.outputFile)), `${output}
 `);
           ui.status("Scan content exported to the requested private file (0600).");
         } else console.log(output);
@@ -9279,9 +9417,9 @@ function registerRuntimeDashboardCommands(runtime) {
 }
 
 // src/cli/commands/runtime-report.ts
-import { lstat as lstat3 } from "fs/promises";
-import { resolve as resolve4 } from "path";
-import { randomUUID as randomUUID5 } from "crypto";
+import { lstat as lstat4 } from "fs/promises";
+import { resolve as resolve5 } from "path";
+import { randomUUID as randomUUID6 } from "crypto";
 function registerRuntimeReportCommand(runtime) {
   const command = runtime.command("report").description("Generate a daily AI Runtime Security environment dashboard (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
     "--output-file <path>",
@@ -9305,11 +9443,11 @@ function registerRuntimeReportCommand(runtime) {
       usageError("--title must contain 1\u2013240 characters");
     if (opts.outputFile !== void 0 && !opts.outputFile.trim())
       usageError("--output-file cannot be empty");
-    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID5().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
-    const outputPath = opts.outputFile === "-" ? void 0 : resolve4(opts.outputFile ?? defaultName);
+    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID6().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve5(opts.outputFile ?? defaultName);
     try {
       if (outputPath) {
-        const existing = await lstat3(outputPath).catch((error) => {
+        const existing = await lstat4(outputPath).catch((error) => {
           if (error.code !== "ENOENT") throw error;
           return void 0;
         });
@@ -9796,7 +9934,7 @@ function completedBulkResults(state) {
 }
 async function writeBulkResults(outputPath, results) {
   await fs5.promises.mkdir(dirname3(outputPath), { recursive: true });
-  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID6()}`;
+  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID7()}`;
   try {
     await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
       encoding: "utf-8",
@@ -10641,7 +10779,7 @@ function buildProgram() {
   program.hook("preAction", async (_thisCommand, actionCommand) => {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
-    const isEnvironmentReport = actionCommand.name() === "report" && actionCommand.parent?.name() === "runtime" || actionCommand.name() === "dashboard" && actionCommand.parent?.name() === "redteam";
+    const isEnvironmentReport = actionCommand.name() === "report" && actionCommand.parent?.name() === "runtime" || actionCommand.name() === "dashboard" && ["redteam", "aigateway"].includes(actionCommand.parent?.name() ?? "");
     if (isEnvironmentReport && (root.debug || /^(1|true|yes|on)$/i.test(process.env.PANW_AI_SEC_DEBUG?.trim() ?? "")))
       usageError(
         "Disable --debug and PANW_AI_SEC_DEBUG for environment reports to avoid persisting sensitive traffic content"
@@ -10657,7 +10795,7 @@ function buildProgram() {
     if (root.debug) {
       const logPath = join4(
         process.cwd(),
-        `debug-api-${Date.now()}-${randomUUID7().slice(0, 8)}.jsonl`
+        `debug-api-${Date.now()}-${randomUUID8().slice(0, 8)}.jsonl`
       );
       try {
         installDebugLogger(logPath);

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { CreateCustomTopicRequest, CustomTopic as CustomTopic$1, CreateSecurityProfileRequest, ManagementClientOptions, ModelSecurityClientOptions, RedTeamClientOptions, InitOptions, ManagementClient, RedTeamClient, QuotaSummary } from '@cdot65/prisma-airs-sdk';
+import { CreateCustomTopicRequest, CustomTopic as CustomTopic$1, CreateSecurityProfileRequest, ManagementClientOptions, ModelSecurityClientOptions, RedTeamClientOptions, InitOptions, ManagementClient, AIGatewayClient, RedTeamClient, QuotaSummary } from '@cdot65/prisma-airs-sdk';
 import { z } from 'zod';
 
 /**
@@ -1845,9 +1845,6 @@ declare function computeMetrics(results: TestResult[]): EfficacyMetrics;
 /** Compute per-category error breakdown from test results. Sorted by error rate descending. */
 declare function computeCategoryBreakdown(results: TestResult[]): CategoryBreakdown[];
 
-/** Atomically publish a private report without overwriting a file or following a symlink. */
-declare function writeReportFile(path: string, content: string): Promise<void>;
-
 /** Read-only SDK surface needed by the first product report. */
 interface RuntimeReportClient {
     dashboard: Pick<ManagementClient['dashboard'], 'applicationsOverview' | 'sessionsOverview' | 'sessionsChart' | 'topApplicationsViolations' | 'applicationsViolationsTrend'>;
@@ -1857,6 +1854,31 @@ interface RuntimeReportClient {
 type ReportSourceStatus = 'complete' | 'partial' | 'unavailable';
 type ReportPriority = 'attention' | 'review' | 'info';
 type ReportFormat = 'html' | 'markdown';
+interface EnvironmentReportTable {
+    title: string;
+    note: string;
+    headers: string[];
+    rows: Array<Array<string | number | null>>;
+}
+/** Aggregate-only view shared by portable product dashboards. */
+interface EnvironmentReport {
+    schemaVersion: 1;
+    product: string;
+    title: string;
+    collectionStartedAt: string;
+    generatedAt: string;
+    window: {
+        start: string;
+        end: string;
+    };
+    windowLabel?: string;
+    schemaLabel?: string;
+    health: 'attention' | 'review' | 'no-findings' | 'unknown';
+    sources: ReportSource[];
+    findings: ReportFinding[];
+    tables: EnvironmentReportTable[];
+    limitations: string[];
+}
 interface ReportSource {
     name: string;
     method: string;
@@ -1970,6 +1992,27 @@ interface RuntimeReportOptions {
     now?: () => Date;
 }
 
+type GatewayReportClient = Pick<AIGatewayClient, 'telemetry' | 'workspaces' | 'configs' | 'apiKeys' | 'organisations' | 'guardrails'>;
+interface GatewayReportOptions {
+    workspace: string;
+    tsgId: string;
+    start: Date;
+    end: Date;
+    title?: string;
+    maxPages?: number;
+    now?: () => Date;
+}
+/** Collect all 25 supplied read feeds; retain only allowlisted aggregate evidence. */
+declare function collectGatewayEnvironmentReport(client: GatewayReportClient, options: GatewayReportOptions): Promise<EnvironmentReport>;
+
+/** Portable Markdown using the same allowlisted evidence as the HTML dashboard. */
+declare function renderEnvironmentReportMarkdown(r: EnvironmentReport): string;
+/** Self-contained HTML with hash-based CSP, static inline JS/CSS and no remote resources. */
+declare function renderEnvironmentReportHtml(r: EnvironmentReport): string;
+
+/** Atomically publish a private report without overwriting a file or following a symlink. */
+declare function writeReportFile(path: string, content: string): Promise<void>;
+
 /** Read-only SDK surface; older SDK installations explicitly report quota as unavailable. */
 type RedTeamReportClient = Pick<RedTeamClient, 'getDashboardOverview' | 'getScanStatistics'> & {
     targets: Pick<RedTeamClient['targets'], 'list'>;
@@ -2005,9 +2048,9 @@ interface RedTeamEnvironmentReport {
 declare function collectRedTeamEnvironmentReport(client: RedTeamReportClient, options?: RuntimeReportOptions): Promise<RedTeamEnvironmentReport>;
 
 /** Portable Markdown using the same allowlisted evidence as the HTML dashboard. */
-declare function renderRedTeamReportMarkdown(r: RedTeamEnvironmentReport): string;
-/** Self-contained HTML with hash-based CSP, static inline JS/CSS and no remote resources. */
-declare function renderRedTeamReportHtml(r: RedTeamEnvironmentReport): string;
+declare function renderRedTeamReportMarkdown(report: RedTeamEnvironmentReport): string;
+/** Self-contained HTML with hash-based CSP and no remote resources. */
+declare function renderRedTeamReportHtml(report: RedTeamEnvironmentReport): string;
 
 /** Render the same evidence model as a portable, inert Markdown deliverable. */
 declare function renderRuntimeReportMarkdown(report: RuntimeDailyReport): string;
@@ -2020,4 +2063,4 @@ declare function renderRuntimeReportHtml(report: RuntimeDailyReport): string;
  */
 declare function collectRuntimeDailyReport(client: RuntimeReportClient, options?: RuntimeReportOptions): Promise<RuntimeDailyReport>;
 
-export { AirsScanService, type AnalysisReport, type ApiKeyInfo, type ApiKeyListResult, type BackupEnvelope, type BackupFormat, type BackupResult, type BatchEntry, type BulkScanAction, type BulkScanResult, type CategoryBreakdown, type ConsumptionAppListEntry, type ConsumptionQueryOptions, type ConsumptionTimeInterval, type CustomTopic, type CustomerAppConsumption, type CustomerAppInfo, type CustomerAppListResult, type DeleteResponse, type DeploymentProfileInfo, type EfficacyMetrics, type EulaContent, type EulaStatus, type IndexedPrompt, type InstanceDetail, type InstanceRequest, type InstanceResponse, type IterationResult, type ManagementService, type ModelSecurityEvaluation, type ModelSecurityFile, type ModelSecurityFileListOptions, type ModelSecurityGroup, type ModelSecurityGroupCreateRequest, type ModelSecurityGroupListOptions, type ModelSecurityGroupUpdateRequest, type ModelSecurityLabel, type ModelSecurityModel, type ModelSecurityModelListOptions, type ModelSecurityModelVersion, type ModelSecurityModelVersionListOptions, type ModelSecurityPyPIAuth, type ModelSecurityRule, type ModelSecurityRuleEditableField, type ModelSecurityRuleInstance, type ModelSecurityRuleInstanceListOptions, type ModelSecurityRuleInstanceUpdateRequest, type ModelSecurityRuleListOptions, type ModelSecurityScan, type ModelSecurityScanListOptions, type ModelSecurityService, type ModelSecurityViolation, type MutationResponse, type PaginationOptions, type PollRetryOptions, type ProfileTopic, type PromptDetail, type PromptSetDetail, type PromptSetService, type PromptSetVersionInfo, type PropertyValueList, type RedTeamAdapterCreateRequest, type RedTeamAdapterDetail, type RedTeamAdapterListItem, type RedTeamAdapterListOptions, type RedTeamAdapterUpdateOverrides, type RedTeamAdapterValidateRequest, type RedTeamAdapterValidationResult, type RedTeamAdapterVar, type RedTeamAttack, type RedTeamCategory, type RedTeamChannel, type RedTeamChannelCreateRequest, type RedTeamChannelListOptions, type RedTeamChannelStats, type RedTeamChannelUpdateRequest, type RedTeamCustomAttack, type RedTeamCustomReport, type RedTeamDynamicReport, type RedTeamEnvironmentReport, type RedTeamErrorLog, type RedTeamJob, type RedTeamLanguages, type RedTeamReportClient, type RedTeamReportTable, type RedTeamService, type RedTeamStaticReport, type RedTeamTarget, type RedTeamTargetCreateRequest, type RedTeamTargetDetail, type RedTeamTargetUpdateRequest, type RegistryCredentials, type ReliableRuntimeService, type ReportApplication, type ReportDailyTelemetry, type ReportFinding, type ReportFormat, type ReportPriority, type ReportProfile, type ReportRegisteredApp, type ReportSessionSummary, type ReportSeverity, type ReportSource, type ReportSourceStatus, type ResourceType, type RestoreResult, type RunState, type RuntimeDailyReport, type RuntimeReportClient, type RuntimeReportOptions, type RuntimeScanResult, type RuntimeService, SDK_ASYNC_BATCH_SIZE, type ScanLogQueryOptions, type ScanLogQueryResult, type ScanResult, type ScanService, SdkManagementService, SdkModelSecurityService, SdkPromptSetService, SdkRedTeamService, SdkRuntimeService, type SecurityProfileInfo, type SecurityProfileListResult, type SubmittedBatch, type TargetAuthValidationRequest, type TargetAuthValidationResult, type TargetOperationOptions, type TestCase, type TestResult, type UserInput, type ValidationError, collectRedTeamEnvironmentReport, collectRuntimeDailyReport, computeCategoryBreakdown, computeMetrics, loadConfig, readBackupDir, readBackupFile, renderRedTeamReportHtml, renderRedTeamReportMarkdown, renderRuntimeReportHtml, renderRuntimeReportMarkdown, resolveOutputDir, sanitizeFilename, validateDescription, validateExamples, validateName, validateTopic, writeBackupFile, writeReportFile };
+export { AirsScanService, type AnalysisReport, type ApiKeyInfo, type ApiKeyListResult, type BackupEnvelope, type BackupFormat, type BackupResult, type BatchEntry, type BulkScanAction, type BulkScanResult, type CategoryBreakdown, type ConsumptionAppListEntry, type ConsumptionQueryOptions, type ConsumptionTimeInterval, type CustomTopic, type CustomerAppConsumption, type CustomerAppInfo, type CustomerAppListResult, type DeleteResponse, type DeploymentProfileInfo, type EfficacyMetrics, type EnvironmentReport, type EnvironmentReportTable, type EulaContent, type EulaStatus, type GatewayReportClient, type GatewayReportOptions, type IndexedPrompt, type InstanceDetail, type InstanceRequest, type InstanceResponse, type IterationResult, type ManagementService, type ModelSecurityEvaluation, type ModelSecurityFile, type ModelSecurityFileListOptions, type ModelSecurityGroup, type ModelSecurityGroupCreateRequest, type ModelSecurityGroupListOptions, type ModelSecurityGroupUpdateRequest, type ModelSecurityLabel, type ModelSecurityModel, type ModelSecurityModelListOptions, type ModelSecurityModelVersion, type ModelSecurityModelVersionListOptions, type ModelSecurityPyPIAuth, type ModelSecurityRule, type ModelSecurityRuleEditableField, type ModelSecurityRuleInstance, type ModelSecurityRuleInstanceListOptions, type ModelSecurityRuleInstanceUpdateRequest, type ModelSecurityRuleListOptions, type ModelSecurityScan, type ModelSecurityScanListOptions, type ModelSecurityService, type ModelSecurityViolation, type MutationResponse, type PaginationOptions, type PollRetryOptions, type ProfileTopic, type PromptDetail, type PromptSetDetail, type PromptSetService, type PromptSetVersionInfo, type PropertyValueList, type RedTeamAdapterCreateRequest, type RedTeamAdapterDetail, type RedTeamAdapterListItem, type RedTeamAdapterListOptions, type RedTeamAdapterUpdateOverrides, type RedTeamAdapterValidateRequest, type RedTeamAdapterValidationResult, type RedTeamAdapterVar, type RedTeamAttack, type RedTeamCategory, type RedTeamChannel, type RedTeamChannelCreateRequest, type RedTeamChannelListOptions, type RedTeamChannelStats, type RedTeamChannelUpdateRequest, type RedTeamCustomAttack, type RedTeamCustomReport, type RedTeamDynamicReport, type RedTeamEnvironmentReport, type RedTeamErrorLog, type RedTeamJob, type RedTeamLanguages, type RedTeamReportClient, type RedTeamReportTable, type RedTeamService, type RedTeamStaticReport, type RedTeamTarget, type RedTeamTargetCreateRequest, type RedTeamTargetDetail, type RedTeamTargetUpdateRequest, type RegistryCredentials, type ReliableRuntimeService, type ReportApplication, type ReportDailyTelemetry, type ReportFinding, type ReportFormat, type ReportPriority, type ReportProfile, type ReportRegisteredApp, type ReportSessionSummary, type ReportSeverity, type ReportSource, type ReportSourceStatus, type ResourceType, type RestoreResult, type RunState, type RuntimeDailyReport, type RuntimeReportClient, type RuntimeReportOptions, type RuntimeScanResult, type RuntimeService, SDK_ASYNC_BATCH_SIZE, type ScanLogQueryOptions, type ScanLogQueryResult, type ScanResult, type ScanService, SdkManagementService, SdkModelSecurityService, SdkPromptSetService, SdkRedTeamService, SdkRuntimeService, type SecurityProfileInfo, type SecurityProfileListResult, type SubmittedBatch, type TargetAuthValidationRequest, type TargetAuthValidationResult, type TargetOperationOptions, type TestCase, type TestResult, type UserInput, type ValidationError, collectGatewayEnvironmentReport, collectRedTeamEnvironmentReport, collectRuntimeDailyReport, computeCategoryBreakdown, computeMetrics, loadConfig, readBackupDir, readBackupFile, renderEnvironmentReportHtml, renderEnvironmentReportMarkdown, renderRedTeamReportHtml, renderRedTeamReportMarkdown, renderRuntimeReportHtml, renderRuntimeReportMarkdown, resolveOutputDir, sanitizeFilename, validateDescription, validateExamples, validateName, validateTopic, writeBackupFile, writeReportFile };