@cdot65/prisma-airs-cli 5.1.0 → 5.3.0

package/dist/{chunk-DR6MZG4E.js → chunk-7Z76VCB3.js}

@@ -2483,6 +2483,433 @@ function computeCategoryBreakdown(results) {
   })).sort((a, b) => b.errorRate - a.errorRate);
 }
 
+// src/reports/aigateway.ts
+function record(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) throw new Error("Invalid object");
+  return v;
+}
+function numeric(v, integer = false) {
+  if (v === null) return null;
+  if (typeof v !== "number" || !Number.isFinite(v) || integer && (!Number.isSafeInteger(v) || v < 0))
+    throw new Error("Invalid number");
+  return v;
+}
+function count(v) {
+  const n = numeric(v, true);
+  if (n === null) throw new Error("Missing count");
+  return n;
+}
+var CHARTS = {
+  requests: ["total"],
+  errors: ["total"],
+  users: ["total"],
+  cost: ["total", "avg"],
+  latency: ["total", "p50", "p90", "p99"],
+  tokens: ["total", "total_request_units", "total_response_units"],
+  cacheSummary: [
+    "summary.cacheHits",
+    "summary.avgCacheLatency",
+    "summary.totalRequests",
+    "summary.cacheSpeedup"
+  ],
+  cacheHitTrend: ["summary.totalCacheHits", "summary.hitRate"],
+  userTrends: ["summary.total", "summary.unique", "summary.avg"],
+  errorTrends: ["summary.errorPercent"],
+  errorCategoryTrends: ["summary.totalErrors", "summary.totalUniqueErrorCodes"],
+  groupedErrors: ["total"],
+  rescuedRetries: ["total", "retryTotal", "fallbackTotal"],
+  feedbackTrend: ["total"],
+  feedbackWeighted: ["total"],
+  feedbackScoreDistribution: ["total"],
+  feedbackModels: []
+};
+async function collectGatewayEnvironmentReport(client, options) {
+  const maxPages = options.maxPages ?? 40;
+  if (!Number.isSafeInteger(maxPages) || maxPages < 1 || maxPages > 100)
+    throw new Error("maxPages must be 1\u2013100");
+  if (!options.workspace.trim() || !options.tsgId.trim() || !Number.isFinite(options.start.getTime()) || !Number.isFinite(options.end.getTime()) || options.start >= options.end)
+    throw new Error("Invalid report scope");
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const report = {
+    schemaVersion: 1,
+    product: "Prisma AIRS AI Gateway",
+    schemaLabel: "AI Gateway",
+    windowLabel: "Telemetry window (UTC)",
+    title: options.title ?? "AI Gateway daily report",
+    collectionStartedAt: now().toISOString(),
+    generatedAt: "",
+    window: { start: options.start.toISOString(), end: options.end.toISOString() },
+    health: "unknown",
+    sources: [],
+    findings: [],
+    tables: [],
+    limitations: [
+      "Read-only operational evidence, not a security certification or availability SLA. No inference or configuration changes are performed.",
+      "All telemetry uses the displayed fixed window. Configuration and organisation/catalog reads describe current state, not daily changes.",
+      "Requests, errors, feedback and log totals are independent server aggregates, not an atomic snapshot. An AIRS block is not necessarily an outage.",
+      "Cost values are cents; latency values are milliseconds. Feedback scores may be negative. Null means unknown, not zero.",
+      "Only aggregate numbers and HTTP status codes are retained. Keys, user identities, workspace names/IDs, metadata, URLs, prompts, raw logs and configuration bodies are excluded.",
+      "Catalog entries describe available capabilities, not enabled protection. Organisation limit sentinel values are not interpreted as quota exhaustion.",
+      "Incomplete sources and page budgets are explicit. Current inventory lists have no verified continuation contract; total/has_more mismatches are partial."
+    ]
+  };
+  const metrics2 = {
+    title: "Telemetry metrics",
+    note: "Server field names are preserved. cost: cents; latency and avgCacheLatency: ms; errorPercent: percent. Feedback is not a request count.",
+    headers: ["Source", "Metric", "Value"],
+    rows: []
+  };
+  const trends = {
+    title: "Error timeline",
+    note: "Server UTC buckets; counts by HTTP status. Not a count of unique violating sessions.",
+    headers: ["UTC bucket", "HTTP status", "Errors"],
+    rows: []
+  };
+  const statuses = {
+    title: "Error categories",
+    note: "Server-reported errors by HTTP status; 446 denotes an AIRS block.",
+    headers: ["HTTP status", "Errors"],
+    rows: []
+  };
+  const inventory = {
+    title: "Current configuration and capabilities",
+    note: "Aggregate counts only. Active tenant workspaces are tenant-wide; keys and configs use the selected workspace.",
+    headers: ["Source", "Metric", "Value"],
+    rows: []
+  };
+  report.tables.push(metrics2, statuses, trends, inventory);
+  async function source2(name, window2, collect2) {
+    const s = {
+      name,
+      method: name,
+      window: window2,
+      status: "complete",
+      records: 0,
+      pages: 0,
+      notes: []
+    };
+    report.sources.push(s);
+    try {
+      await collect2(s);
+    } catch (error) {
+      s.status = s.records ? "partial" : "unavailable";
+      const code = error?.statusCode;
+      s.notes.push(
+        typeof code === "number" && Number.isInteger(code) && code >= 400 && code <= 599 ? `HTTP ${code}: request failed; check access and service availability.` : "Request, scope or response validation failed; upstream details omitted."
+      );
+    }
+  }
+  function envelope(v, s) {
+    const r = record(v);
+    if (r.success !== true) throw new Error("Unsuccessful response");
+    const d = record(r.data);
+    if (d.isQuotaExceeded !== false) {
+      s.status = "partial";
+      s.notes.push("Quota exceeded or quota state unknown; aggregates may be incomplete.");
+    }
+    return d;
+  }
+  function list(v, s) {
+    const r = record(v);
+    if (r.success === false || !Array.isArray(r.data)) throw new Error("Invalid list");
+    const rows = r.data.map(record);
+    const total2 = count(r.total);
+    if (r.has_more === true || total2 !== rows.length) {
+      s.status = "partial";
+      s.notes.push("List is truncated or total differs; continuation is not documented.");
+    }
+    s.records = rows.length;
+    s.pages = 1;
+    return rows;
+  }
+  let workspaceId;
+  let workspaceSlug;
+  await source2("workspaces.list", "Current active tenant workspaces (admin)", async (s) => {
+    const rows = list(await client.workspaces.list({ plane: "admin" }), s);
+    inventory.rows.push([s.name, "Active workspaces returned", rows.length]);
+    const exact = rows.filter((r) => r.id === options.workspace || r.slug === options.workspace);
+    const matches = exact.length ? exact : rows.filter((r) => r.name === options.workspace);
+    if (matches.length !== 1 || typeof matches[0]?.id !== "string" || typeof matches[0]?.slug !== "string")
+      throw new Error("Workspace missing or ambiguous");
+    workspaceId = matches[0].id;
+    workspaceSlug = matches[0].slug;
+  });
+  const window = () => {
+    if (!workspaceSlug) throw new Error("Workspace unresolved");
+    return { workspaceSlug, start: new Date(options.start), end: new Date(options.end) };
+  };
+  const scope = () => {
+    if (!workspaceId) throw new Error("Workspace unresolved");
+    return { workspaceId };
+  };
+  for (const [method, fields] of Object.entries(CHARTS)) {
+    await source2(`telemetry.${method}`, "Displayed telemetry window", async (s) => {
+      const d = envelope(await client.telemetry[method](window()), s);
+      const rows = fields.map((field) => {
+        const value = field.split(".").reduce((v, key) => record(v)[key], d);
+        const n = numeric(value);
+        const signed = method.startsWith("feedback");
+        const fractional = signed || method === "cost" || method === "latency" || field.endsWith("avg") || field.endsWith("Latency") || field.endsWith("Speedup") || field.endsWith("Rate") || field.endsWith("Percent");
+        if (n !== null && (!signed && n < 0 || !fractional && !Number.isSafeInteger(n)))
+          throw new Error("Invalid metric");
+        return [method, field, n];
+      });
+      const buckets = d.records ?? d.trend;
+      if (buckets !== void 0 && !Array.isArray(buckets)) throw new Error("Invalid buckets");
+      s.records = Array.isArray(buckets) ? buckets.length : 1;
+      s.pages = 1;
+      if (method === "feedbackModels") rows.push([method, "Models with feedback", s.records]);
+      if (method === "errorCategoryTrends") {
+        const entries = d.trend.map((v) => {
+          const r = record(v);
+          return [count(r.response_status_code), count(r.count)];
+        });
+        statuses.rows.push(...entries);
+        if (entries.some(([code, n]) => code >= 200 && code < 300 && n > 0))
+          report.findings.push({
+            priority: "review",
+            title: "Success-status responses appear in error analytics",
+            evidence: "The server classifies some HTTP 2xx responses as errors. Error analytics are not identical to non-2xx transaction counts.",
+            recommendation: "Inspect the underlying application/provider error classifications before calculating an HTTP failure rate.",
+            source: s.name
+          });
+        if (entries.some(([code, n]) => n > 0 && (code === 429 || code >= 500)))
+          report.findings.push({
+            priority: "attention",
+            title: "Rate limiting or server errors observed",
+            evidence: "Error categories include HTTP 429 or 5xx responses in the selected window.",
+            recommendation: "Review provider availability, quotas and retry policies; correlate with transaction logs.",
+            source: s.name
+          });
+        else if (entries.some(([, n]) => n > 0))
+          report.findings.push({
+            priority: "review",
+            title: "Gateway errors or policy blocks observed",
+            evidence: "Nonzero error-category counts were returned.",
+            recommendation: "Review status categories; distinguish expected AIRS blocks from integration failures.",
+            source: s.name
+          });
+      }
+      if (method === "groupedErrors") {
+        const entries = [];
+        for (const v of d.trend) {
+          const r = record(v);
+          if (typeof r.x !== "string" || !Number.isFinite(Date.parse(r.x)) || !Array.isArray(r.y))
+            throw new Error("Invalid trend");
+          for (const v2 of r.y) {
+            const y = record(v2);
+            entries.push([
+              new Date(r.x).toISOString(),
+              count(y.response_status_code),
+              count(y.count)
+            ]);
+          }
+        }
+        trends.rows.push(...entries);
+      }
+      metrics2.rows.push(...rows);
+    });
+  }
+  await source2("telemetry.filterBoundaries", "Displayed telemetry window", async (s) => {
+    const d = envelope(await client.telemetry.filterBoundaries(window()), s);
+    for (const key of ["unique_ai_models", "unique_status_codes"]) {
+      if (!Array.isArray(d[key])) throw new Error("Invalid filter values");
+      metrics2.rows.push(["filterBoundaries", `${key} count`, d[key].length]);
+    }
+    s.records = 1;
+    s.pages = 1;
+  });
+  const logs = {
+    title: "Transaction coverage",
+    note: "Unique collected transactions by HTTP status; only complete pagination represents the entire window. Raw rows are excluded.",
+    headers: ["Metric", "Value"],
+    rows: []
+  };
+  report.tables.push(logs);
+  await source2("telemetry.logs", "Displayed telemetry window", async (s) => {
+    const ids = /* @__PURE__ */ new Set();
+    const codes = /* @__PURE__ */ new Map();
+    let expected;
+    try {
+      for (let currentPage = 0; currentPage < maxPages; currentPage++) {
+        const d = envelope(
+          await client.telemetry.logs({ ...window(), pageSize: 50, currentPage }),
+          s
+        );
+        s.pages++;
+        const total2 = count(d.total);
+        expected ??= total2;
+        if (total2 !== expected || !Array.isArray(d.records) || d.records.length > 50)
+          throw new Error("Unstable page");
+        for (const v of d.records) {
+          const r = record(v);
+          if (typeof r.id !== "string" || !r.id || ids.has(r.id) || r.workspace_slug !== workspaceSlug)
+            throw new Error("Invalid identity");
+          const timestamp = typeof r.created_at === "string" ? Date.parse(r.created_at) : NaN;
+          if (!Number.isFinite(timestamp) || timestamp < options.start.getTime() || timestamp > options.end.getTime())
+            throw new Error("Outside window");
+          const code = count(r.response_status_code);
+          ids.add(r.id);
+          codes.set(code, (codes.get(code) ?? 0) + 1);
+          s.records = ids.size;
+        }
+        if (ids.size > expected) throw new Error("Unexpected total");
+        if (ids.size === expected) return;
+        if (!d.records.length) throw new Error("Premature empty page");
+      }
+      s.status = "partial";
+      s.notes.push(
+        "Transaction page budget reached. Increase --max-pages to collect the remaining rows."
+      );
+    } finally {
+      logs.rows.push(["Server total", expected ?? null], ["Unique collected", ids.size]);
+      for (const [code, n] of [...codes].sort(([a], [b]) => a - b))
+        logs.rows.push([`HTTP ${code}`, n]);
+    }
+  });
+  for (const method of ["configs.list", "apiKeys.listService", "apiKeys.listUser"]) {
+    await source2(method, "Current selected workspace configuration", async (s) => {
+      const response = method === "configs.list" ? await client.configs.list(scope()) : method === "apiKeys.listService" ? await client.apiKeys.listService(scope()) : await client.apiKeys.listUser(scope());
+      const rows = list(response, s);
+      inventory.rows.push([method, "Rows returned", rows.length]);
+    });
+  }
+  await source2("organisations.getInfo", "Current tenant configuration", async (s) => {
+    const r = await client.organisations.getInfo(options.tsgId);
+    inventory.rows.push([
+      s.name,
+      "Configured limit categories",
+      Object.keys(r.benefits.limits).length
+    ]);
+    s.records = 1;
+    s.pages = 1;
+  });
+  await source2(
+    "guardrails.getCatalog",
+    "Current tenant capability catalog (not enabled guardrails)",
+    async (s) => {
+      const r = await client.guardrails.getCatalog();
+      inventory.rows.push([s.name, "Available evaluators", r.evals.length]);
+      s.records = r.evals.length;
+      s.pages = 1;
+    }
+  );
+  for (const s of report.sources.filter((s2) => s2.status !== "complete"))
+    report.findings.push({
+      priority: "review",
+      title: `Incomplete evidence: ${s.name}`,
+      evidence: s.notes.join(" "),
+      recommendation: "Resolve source access or validation problems and rerun. Do not interpret missing metrics as zero.",
+      source: s.name
+    });
+  const telemetryAvailable = report.sources.some(
+    (s) => s.name.startsWith("telemetry.") && s.status === "complete"
+  );
+  report.health = !telemetryAvailable ? "unknown" : report.findings.some((f) => f.priority === "attention") ? "attention" : report.findings.length ? "review" : "no-findings";
+  report.generatedAt = now().toISOString();
+  return report;
+}
+
+// src/reports/environment-render.ts
+import { createHash } from "crypto";
+var HEALTH = {
+  attention: "Attention required",
+  review: "Review required",
+  "no-findings": "No findings in available evidence",
+  unknown: "Unable to assess"
+};
+var html = (v) => String(v ?? "Unknown").replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+var md = (v) => String(v ?? "Unknown").replace(
+  /[&<>"'\\`*_[\]{}()|!#~\r\n]/g,
+  (c) => /[\r\n]/.test(c) ? " " : `&#${c.charCodeAt(0)};`
+);
+function tables(r) {
+  return [
+    ...r.tables,
+    {
+      title: "Evidence and completeness",
+      note: "Complete means the source was collected within its budget, not that the environment is secure. Unavailable is not zero.",
+      headers: ["Source", "SDK method", "Window", "Status", "Records", "Pages", "Notes"],
+      rows: r.sources.map((s) => [
+        s.name,
+        s.method,
+        s.window,
+        s.status,
+        s.records,
+        s.pages,
+        s.notes.join(" ") || "Collection completed."
+      ])
+    }
+  ];
+}
+function renderEnvironmentReportMarkdown(r) {
+  const lines = [
+    `# ${md(r.title)}`,
+    "",
+    `**${md(r.product)}**`,
+    "",
+    `Assessment: **${HEALTH[r.health]}**`,
+    "",
+    `Collection: ${r.collectionStartedAt} \u2192 ${r.generatedAt}`,
+    "",
+    `${md(r.windowLabel ?? "Scan creation window (UTC)")}: ${r.window.start} \u2192 ${r.window.end}`,
+    "",
+    "## What needs attention",
+    ""
+  ];
+  for (const f of r.findings)
+    lines.push(
+      `### ${f.priority.toUpperCase()}: ${md(f.title)}`,
+      "",
+      `Evidence: ${md(f.evidence)}`,
+      "",
+      `Next step: ${md(f.recommendation)}`,
+      "",
+      `Source: ${md(f.source)}`,
+      ""
+    );
+  if (!r.findings.length)
+    lines.push("No findings in available evidence; this does not establish absence of risk.", "");
+  for (const t of tables(r)) {
+    lines.push(`## ${md(t.title)}`, "", md(t.note), "");
+    if (t.rows.length)
+      lines.push(
+        `| ${t.headers.map(md).join(" | ")} |`,
+        `| ${t.headers.map(() => "---").join(" | ")} |`,
+        ...t.rows.map((row) => `| ${row.map(md).join(" | ")} |`),
+        ""
+      );
+    else
+      lines.push(
+        "No rows collected; consult source completeness before interpreting this as empty.",
+        ""
+      );
+  }
+  lines.push(
+    "## Scope and limitations",
+    "",
+    ...r.limitations.map((v) => `- ${md(v)}`),
+    "",
+    `Prisma AIRS CLI \xB7 ${md(r.schemaLabel ?? "Red Team")} report schema ${r.schemaVersion}`,
+    ""
+  );
+  return lines.join("\n");
+}
+var CSS = `
+:root{font:16px/1.6 system-ui,sans-serif;color:#193449;background:#f0f4f7}*{box-sizing:border-box}body{margin:0}header{background:#152e43;color:white;padding:3rem max(1rem,calc((100vw - 1160px)/2))}h1{font-size:clamp(1.8rem,4vw,3rem);line-height:1.15}h1,h2,h3,p,td{overflow-wrap:anywhere}main{max-width:1200px;margin:auto;padding:1rem}section,article{padding:1.4rem;background:white;border:1px solid #cddbe4;border-radius:10px;margin:1rem 0}.finding{border-left:5px solid #b08528}.finding[data-priority=attention]{border-left-color:#b1392d}.note{color:#536575;font-size:.9rem}.badge{border:1px solid;padding:.3rem .8rem;border-radius:30px;display:inline-block}nav,.controls{display:flex;gap:1rem;flex-wrap:wrap}button,select{font:inherit;padding:.4rem;border:1px solid #526778;border-radius:5px;background:white;color:#193449}a{color:#006b63}.table-wrap{overflow:auto}table{border-collapse:collapse;width:100%;text-align:left}th,td{padding:.7rem;border-bottom:1px solid #d4dfe6;vertical-align:top}th{background:#edf3f7}caption{text-align:left}footer{padding:1rem;color:#536575}.js-only{display:none}.ready .js-only{display:flex}[hidden]{display:none!important}:focus-visible{outline:3px solid #ae6816;outline-offset:3px}.skip{position:absolute;left:-10000px}.skip:focus{left:1rem;top:1rem;background:white;padding:1rem}@media(max-width:600px){header{padding:1.5rem 1rem}section{padding:1rem}th,td{padding:.5rem}}@media print{body{background:white;font-size:10pt}header{background:white;color:black;padding:0}main{max-width:none;padding:0}nav,.controls,.skip{display:none!important}[hidden]{display:revert!important}.table-wrap{overflow:visible}section{border:0;padding:0}article{break-inside:avoid}}
+`;
+var JS = `'use strict';document.documentElement.classList.add('ready');document.getElementById('print').addEventListener('click',function(){window.print()});document.getElementById('priority').addEventListener('change',function(){var n=0;document.querySelectorAll('.finding').forEach(function(e){e.hidden=this.value!=='all'&&e.dataset.priority!==this.value;if(!e.hidden)n++},this);document.getElementById('count').textContent=n+' findings shown'});`;
+function renderEnvironmentReportHtml(r) {
+  const hash = (v) => createHash("sha256").update(v).digest("base64");
+  const policy = `default-src 'none'; script-src 'sha256-${hash(JS)}'; style-src 'sha256-${hash(CSS)}'; connect-src 'none'; base-uri 'none'; form-action 'none'`;
+  const sections = tables(r).map(
+    (t, i) => `<section id="table-${i}"><h2>${html(t.title)}</h2><p class="note">${html(t.note)}</p>${t.rows.length ? `<div class="table-wrap" role="region" aria-label="${html(t.title)}" tabindex="0"><table><caption>${t.rows.length} aggregate rows</caption><thead><tr>${t.headers.map((v) => `<th scope="col">${html(v)}</th>`).join("")}</tr></thead><tbody>${t.rows.map((row) => `<tr>${row.map((v) => `<td>${html(v)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>` : "<p>No rows collected; consult source completeness before interpreting this as empty.</p>"}</section>`
+  ).join("");
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${html(policy)}"><meta name="referrer" content="no-referrer"><title>${html(r.title)}</title><style>${CSS}</style></head><body><a class="skip" href="#main">Skip to report</a><header><p>${html(r.product)}</p><h1>${html(r.title)}</h1><span class="badge">${HEALTH[r.health]}</span><p>Collection: ${html(r.collectionStartedAt)} \u2192 ${html(r.generatedAt)}</p><p>${html(r.windowLabel ?? "Scan creation window (UTC)")}: ${html(r.window.start)} \u2192 ${html(r.window.end)}</p><p>Read-only evidence \xB7 Confidential environment metadata</p></header><main id="main"><nav aria-label="Report sections"><a href="#findings">Attention</a><a href="#table-0">Evidence tables</a><a href="#scope">Scope</a></nav><section id="findings"><h2>What needs attention</h2><div class="controls js-only"><label for="priority">Priority</label><select id="priority"><option value="all">All</option><option value="attention">Attention</option><option value="review">Review</option></select><span id="count" role="status"></span><button id="print" type="button">Print / save PDF</button></div>${r.findings.map((f) => `<article class="finding" data-priority="${html(f.priority)}"><h3>${html(f.title)}</h3><p>${html(f.evidence)}</p><p><strong>Next step:</strong> ${html(f.recommendation)}</p><p class="note">${html(f.source)}</p></article>`).join("") || "<p>No findings in available evidence; this does not establish absence of risk.</p>"}</section>${sections}<section id="scope"><h2>Scope and limitations</h2><ul>${r.limitations.map((v) => `<li>${html(v)}</li>`).join("")}</ul></section><footer>Prisma AIRS CLI \xB7 ${html(r.schemaLabel ?? "Red Team")} report schema ${r.schemaVersion} \xB7 Works offline and without JavaScript.</footer></main><script>${JS}</script></body></html>
+`;
+}
+
 // src/reports/io.ts
 import { randomUUID } from "crypto";
 import { link, open, unlink } from "fs/promises";
@@ -2505,7 +2932,7 @@ async function writeReportFile(path2, content) {
 var DataError = class extends Error {
 };
 var label = (value) => typeof value === "string" ? value.replace(/[\p{Cc}\p{Cf}]/gu, " ").slice(0, 120) : "Unknown";
-function count(value) {
+function count2(value) {
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
     throw new DataError("A required counter is missing or invalid.");
   return value;
@@ -2581,7 +3008,7 @@ async function collectRedTeamEnvironmentReport(client, options = {}) {
         const r = await read(rows.length);
         s.pages++;
         if (!Array.isArray(r.data)) throw new DataError("Missing inventory array.");
-        const reported = count(r.pagination.total_items);
+        const reported = count2(r.pagination.total_items);
         total2 ??= reported;
         if (total2 !== reported) throw new DataError("Inventory changed during pagination.");
         if (r.data.length > 15) throw new DataError("Page exceeds requested size.");
@@ -2615,7 +3042,7 @@ async function collectRedTeamEnvironmentReport(client, options = {}) {
   }
   await source2("Overview", "getDashboardOverview()", "Current dashboard snapshot", async (s) => {
     const r = await client.getDashboardOverview();
-    const total2 = count(r.total_targets);
+    const total2 = count2(r.total_targets);
     table("Dashboard overview", s.window, ["Metric", "Count"], [["Targets", total2]]);
     s.records = 1;
     s.pages = 1;
@@ -2627,11 +3054,11 @@ async function collectRedTeamEnvironmentReport(client, options = {}) {
     async (s) => {
       const r = await client.getScanStatistics();
       const rows = [
-        ["Scans", count(r.total_scans)],
-        ["Targets scanned", count(r.targets_scanned)]
+        ["Scans", count2(r.total_scans)],
+        ["Targets scanned", count2(r.targets_scanned)]
       ];
       for (const risk of r.risk_profile ?? []) {
-        const n = count(risk.total);
+        const n = count2(risk.total);
         rows.push([`Risk: ${label(risk.risk_rating)}`, n]);
         if (/^(high|critical)$/i.test(risk.risk_rating) && n > 0)
           finding(
@@ -2643,7 +3070,7 @@ async function collectRedTeamEnvironmentReport(client, options = {}) {
           );
       }
       for (const status of r.scan_status ?? [])
-        rows.push([`Status: ${label(status.name)}`, count(status.count)]);
+        rows.push([`Status: ${label(status.name)}`, count2(status.count)]);
       table("Dashboard scan statistics", s.window, ["Metric", "Count"], rows);
       s.records = 1;
       s.pages = 1;
@@ -2667,8 +3094,8 @@ async function collectRedTeamEnvironmentReport(client, options = {}) {
     const rows = [];
     for (const kind of ["static", "dynamic", "custom"]) {
       const q = r[kind];
-      const allocated = count(q.allocated);
-      const consumed = count(q.consumed);
+      const allocated = count2(q.allocated);
+      const consumed = count2(q.consumed);
       if (typeof q.unlimited !== "boolean") throw new DataError("Missing unlimited quota flag.");
       rows.push([
         kind,
@@ -2750,8 +3177,8 @@ async function collectRedTeamEnvironmentReport(client, options = {}) {
     "Current channel snapshot",
     async (s) => {
       const r = await client.networkBroker.getChannelStats();
-      const total2 = count(r.total_channels);
-      const online = count(r.online_channels);
+      const total2 = count2(r.total_channels);
+      const online = count2(r.online_channels);
       if (online > total2) throw new DataError("Online channel count exceeds total.");
       table(
         "Network broker",
@@ -2797,103 +3224,11 @@ async function collectRedTeamEnvironmentReport(client, options = {}) {
 }
 
 // src/reports/redteam-render.ts
-import { createHash } from "crypto";
-var HEALTH = {
-  attention: "Attention required",
-  review: "Review required",
-  "no-findings": "No findings in available evidence",
-  unknown: "Unable to assess"
-};
-var html = (v) => String(v ?? "Unknown").replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
-var md = (v) => String(v ?? "Unknown").replace(
-  /[&<>"'\\`*_[\]{}()|!#~\r\n]/g,
-  (c) => /[\r\n]/.test(c) ? " " : `&#${c.charCodeAt(0)};`
-);
-function tables(r) {
-  return [
-    ...r.tables,
-    {
-      title: "Evidence and completeness",
-      note: "Complete means the source was collected within its budget, not that the environment is secure. Unavailable is not zero.",
-      headers: ["Source", "SDK method", "Window", "Status", "Records", "Pages", "Notes"],
-      rows: r.sources.map((s) => [
-        s.name,
-        s.method,
-        s.window,
-        s.status,
-        s.records,
-        s.pages,
-        s.notes.join(" ") || "Collection completed."
-      ])
-    }
-  ];
-}
-function renderRedTeamReportMarkdown(r) {
-  const lines = [
-    `# ${md(r.title)}`,
-    "",
-    `**${r.product}**`,
-    "",
-    `Assessment: **${HEALTH[r.health]}**`,
-    "",
-    `Collection: ${r.collectionStartedAt} \u2192 ${r.generatedAt}`,
-    "",
-    `Scan creation window (UTC): ${r.window.start} \u2192 ${r.window.end}`,
-    "",
-    "## What needs attention",
-    ""
-  ];
-  for (const f of r.findings)
-    lines.push(
-      `### ${f.priority.toUpperCase()}: ${md(f.title)}`,
-      "",
-      `Evidence: ${md(f.evidence)}`,
-      "",
-      `Next step: ${md(f.recommendation)}`,
-      "",
-      `Source: ${md(f.source)}`,
-      ""
-    );
-  if (!r.findings.length)
-    lines.push("No findings in available evidence; this does not establish absence of risk.", "");
-  for (const t of tables(r)) {
-    lines.push(`## ${md(t.title)}`, "", md(t.note), "");
-    if (t.rows.length)
-      lines.push(
-        `| ${t.headers.map(md).join(" | ")} |`,
-        `| ${t.headers.map(() => "---").join(" | ")} |`,
-        ...t.rows.map((row) => `| ${row.map(md).join(" | ")} |`),
-        ""
-      );
-    else
-      lines.push(
-        "No rows collected; consult source completeness before interpreting this as empty.",
-        ""
-      );
-  }
-  lines.push(
-    "## Scope and limitations",
-    "",
-    ...r.limitations.map((v) => `- ${md(v)}`),
-    "",
-    `Prisma AIRS CLI \xB7 Red Team report schema ${r.schemaVersion}`,
-    ""
-  );
-  return lines.join("\n");
+function renderRedTeamReportMarkdown(report) {
+  return renderEnvironmentReportMarkdown(report);
 }
-var CSS = `
-:root{font:16px/1.6 system-ui,sans-serif;color:#193449;background:#f0f4f7}*{box-sizing:border-box}body{margin:0}header{background:#152e43;color:white;padding:3rem max(1rem,calc((100vw - 1160px)/2))}h1{font-size:clamp(1.8rem,4vw,3rem);line-height:1.15}h1,h2,h3,p,td{overflow-wrap:anywhere}main{max-width:1200px;margin:auto;padding:1rem}section,article{padding:1.4rem;background:white;border:1px solid #cddbe4;border-radius:10px;margin:1rem 0}.finding{border-left:5px solid #b08528}.finding[data-priority=attention]{border-left-color:#b1392d}.note{color:#536575;font-size:.9rem}.badge{border:1px solid;padding:.3rem .8rem;border-radius:30px;display:inline-block}nav,.controls{display:flex;gap:1rem;flex-wrap:wrap}button,select{font:inherit;padding:.4rem;border:1px solid #526778;border-radius:5px;background:white;color:#193449}a{color:#006b63}.table-wrap{overflow:auto}table{border-collapse:collapse;width:100%;text-align:left}th,td{padding:.7rem;border-bottom:1px solid #d4dfe6;vertical-align:top}th{background:#edf3f7}caption{text-align:left}footer{padding:1rem;color:#536575}.js-only{display:none}.ready .js-only{display:flex}[hidden]{display:none!important}:focus-visible{outline:3px solid #ae6816;outline-offset:3px}.skip{position:absolute;left:-10000px}.skip:focus{left:1rem;top:1rem;background:white;padding:1rem}@media(max-width:600px){header{padding:1.5rem 1rem}section{padding:1rem}th,td{padding:.5rem}}@media print{body{background:white;font-size:10pt}header{background:white;color:black;padding:0}main{max-width:none;padding:0}nav,.controls,.skip{display:none!important}[hidden]{display:revert!important}.table-wrap{overflow:visible}section{border:0;padding:0}article{break-inside:avoid}}
-`;
-var JS = `'use strict';document.documentElement.classList.add('ready');document.getElementById('print').addEventListener('click',function(){window.print()});document.getElementById('priority').addEventListener('change',function(){var n=0;document.querySelectorAll('.finding').forEach(function(e){e.hidden=this.value!=='all'&&e.dataset.priority!==this.value;if(!e.hidden)n++},this);document.getElementById('count').textContent=n+' findings shown'});`;
-function renderRedTeamReportHtml(r) {
-  const hash = (v) => createHash("sha256").update(v).digest("base64");
-  const policy = `default-src 'none'; script-src 'sha256-${hash(JS)}'; style-src 'sha256-${hash(CSS)}'; connect-src 'none'; base-uri 'none'; form-action 'none'`;
-  const sections = tables(r).map(
-    (t, i) => `<section id="table-${i}"><h2>${html(t.title)}</h2><p class="note">${html(t.note)}</p>${t.rows.length ? `<div class="table-wrap" role="region" aria-label="${html(t.title)}" tabindex="0"><table><caption>${t.rows.length} aggregate rows</caption><thead><tr>${t.headers.map((v) => `<th scope="col">${html(v)}</th>`).join("")}</tr></thead><tbody>${t.rows.map((row) => `<tr>${row.map((v) => `<td>${html(v)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>` : "<p>No rows collected; consult source completeness before interpreting this as empty.</p>"}</section>`
-  ).join("");
-  return `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="${html(policy)}"><meta name="referrer" content="no-referrer"><title>${html(r.title)}</title><style>${CSS}</style></head><body><a class="skip" href="#main">Skip to report</a><header><p>${r.product}</p><h1>${html(r.title)}</h1><span class="badge">${HEALTH[r.health]}</span><p>Collection: ${html(r.collectionStartedAt)} \u2192 ${html(r.generatedAt)}</p><p>Scan creation window (UTC): ${html(r.window.start)} \u2192 ${html(r.window.end)}</p><p>Read-only evidence \xB7 Confidential environment metadata</p></header><main id="main"><nav aria-label="Report sections"><a href="#findings">Attention</a><a href="#table-0">Evidence tables</a><a href="#scope">Scope</a></nav><section id="findings"><h2>What needs attention</h2><div class="controls js-only"><label for="priority">Priority</label><select id="priority"><option value="all">All</option><option value="attention">Attention</option><option value="review">Review</option></select><span id="count" role="status"></span><button id="print" type="button">Print / save PDF</button></div>${r.findings.map((f) => `<article class="finding" data-priority="${html(f.priority)}"><h3>${html(f.title)}</h3><p>${html(f.evidence)}</p><p><strong>Next step:</strong> ${html(f.recommendation)}</p><p class="note">${html(f.source)}</p></article>`).join("") || "<p>No findings in available evidence; this does not establish absence of risk.</p>"}</section>${sections}<section id="scope"><h2>Scope and limitations</h2><ul>${r.limitations.map((v) => `<li>${html(v)}</li>`).join("")}</ul></section><footer>Prisma AIRS CLI \xB7 Red Team report schema ${r.schemaVersion} \xB7 Works offline and without JavaScript.</footer></main><script>${JS}</script></body></html>
-`;
+function renderRedTeamReportHtml(report) {
+  return renderEnvironmentReportHtml(report);
 }
 
 // src/reports/render.ts
@@ -3176,7 +3511,7 @@ function safeFailure(error) {
 function label2(value) {
   return (value?.replace(/[\p{Cc}\p{Cf}]/gu, " ").trim() || "Unknown").slice(0, 240);
 }
-function count2(value) {
+function count3(value) {
   return Number.isSafeInteger(value) && value >= 0 ? value : null;
 }
 async function collect(source2, maxPages, read, identity) {
@@ -3226,7 +3561,7 @@ function inventoryNext(next, size, offset) {
 function total(values) {
   if (values.some((value) => value === null)) return null;
   const result = values.reduce((sum, value) => sum + (value ?? 0), 0);
-  return count2(result);
+  return count3(result);
 }
 function distribution(rows) {
   const groups = /* @__PURE__ */ new Map();
@@ -3238,11 +3573,11 @@ function distribution(rows) {
 }
 function severity(value) {
   return {
-    critical: count2(value.critical),
-    high: count2(value.high),
-    medium: count2(value.medium),
-    low: count2(value.low),
-    total: count2(value.total)
+    critical: count3(value.critical),
+    high: count3(value.high),
+    medium: count3(value.medium),
+    low: count3(value.low),
+    total: count3(value.total)
   };
 }
 async function collectRuntimeDailyReport(client, options = {}) {
@@ -3305,7 +3640,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
           offset
         });
         const size = page.items?.length ?? 0;
-        const totalItems = count2(page.pagination?.total_items);
+        const totalItems = count3(page.pagination?.total_items);
         if (totalItems !== null) {
           if (expectedAppTotal !== void 0 && totalItems !== expectedAppTotal)
             throw new ReportDataError(
@@ -3357,7 +3692,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
       async (offset) => {
         const page = await client.dashboard.sessionsOverview({ ...daily, limit: 25, offset });
         const size = page.items?.length ?? 0;
-        const totalItems = count2(page.pagination?.total_items);
+        const totalItems = count3(page.pagination?.total_items);
         if (totalItems === null || page.pagination?.skip !== offset || page.pagination?.limit !== 25)
           throw new ReportDataError("Missing or mismatched session pagination metadata.");
         if (expectedSessionTotal !== void 0 && expectedSessionTotal !== totalItems)
@@ -3414,8 +3749,8 @@ async function collectRuntimeDailyReport(client, options = {}) {
   const appIds = new Set(registered.map((app) => app.customer_appId));
   const reportApps = applications.map((app) => ({
     name: label2(app.name),
-    sessions: count2(app.sessions_total),
-    violatingSessions: count2(app.sessions_violated),
+    sessions: count3(app.sessions_total),
+    violatingSessions: count3(app.sessions_violated),
     registered: app.id && appIds.has(app.id) ? true : appSource.status === "complete" && app.id ? false : null
   })).sort(
     (a, b) => (b.violatingSessions ?? -1) - (a.violatingSessions ?? -1) || a.name.localeCompare(b.name)
@@ -3492,7 +3827,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
       );
     return {
       name,
-      revision: count2(profile.revision),
+      revision: count3(profile.revision),
       active: profile.active ?? null,
       modified: profile.last_modified_ts && Number.isFinite(Date.parse(profile.last_modified_ts)) ? new Date(profile.last_modified_ts).toISOString() : null,
       timeoutActions,
@@ -3540,8 +3875,8 @@ async function collectRuntimeDailyReport(client, options = {}) {
       "Review these sessions in SCM and check integration error handling. This is not a tenant-wide failure rate.",
       sessionSource.name
     );
-  const chartSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count2(bucket.total)));
-  const chartViolatingSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count2(bucket.violating)));
+  const chartSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count3(bucket.total)));
+  const chartViolatingSessions = chartSource.status === "unavailable" ? null : total(chart.map((bucket) => count3(bucket.violating)));
   if (chartSessions !== null && sessionSource.status === "complete" && chartSessions !== rawSessions.length)
     add(
       "review",
@@ -3552,7 +3887,7 @@ async function collectRuntimeDailyReport(client, options = {}) {
     );
   const urgentViolations = total(
     trend.map(
-      (bucket) => total([count2(bucket.violation_breakdown.critical), count2(bucket.violation_breakdown.high)])
+      (bucket) => total([count3(bucket.violation_breakdown.critical), count3(bucket.violation_breakdown.high)])
     )
   );
   if ((urgentViolations ?? 0) > 0)
@@ -3606,17 +3941,17 @@ async function collectRuntimeDailyReport(client, options = {}) {
         violatingSessions: chartViolatingSessions,
         buckets: chart.map((bucket) => ({
           time: label2(bucket.time),
-          sessions: count2(bucket.total),
-          violatingSessions: count2(bucket.violating),
+          sessions: count3(bucket.total),
+          violatingSessions: count3(bucket.violating),
           violations: severity(bucket.violation_breakdown)
         }))
       },
       topApplications: rankings.map((app) => ({
         name: label2(app.name),
-        violations: count2(app.total_violations),
+        violations: count3(app.total_violations),
         detectors: app.policy_violations.map((detector) => ({
           name: label2(detector.detection_type),
-          count: count2(detector.total)
+          count: count3(detector.total)
         }))
       })),
       violationTrend: trend.map((bucket) => ({
@@ -3662,6 +3997,9 @@ export {
   validateTopic,
   computeMetrics,
   computeCategoryBreakdown,
+  collectGatewayEnvironmentReport,
+  renderEnvironmentReportMarkdown,
+  renderEnvironmentReportHtml,
   writeReportFile,
   collectRedTeamEnvironmentReport,
   renderRedTeamReportMarkdown,