@cdot65/prisma-airs-cli 5.1.0 → 5.3.0

package/dist/cli/index.js

@@ -9,6 +9,7 @@ import {
   SdkPromptSetService,
   SdkRedTeamService,
   SdkRuntimeService,
+  collectGatewayEnvironmentReport,
   collectRedTeamEnvironmentReport,
   collectRuntimeDailyReport,
   computeMetrics,
@@ -17,6 +18,8 @@ import {
   loadConfig,
   readBackupDir,
   readBackupFile,
+  renderEnvironmentReportHtml,
+  renderEnvironmentReportMarkdown,
   renderRedTeamReportHtml,
   renderRedTeamReportMarkdown,
   renderRuntimeReportHtml,
@@ -27,7 +30,7 @@ import {
   validateTopic,
   writeBackupFile,
   writeReportFile
-} from "../chunk-DR6MZG4E.js";
+} from "../chunk-7Z76VCB3.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -46,7 +49,7 @@ function installProcessGuards() {
 }
 
 // src/cli/program.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
@@ -3055,8 +3058,8 @@ function registerAiGatewayInference(parent) {
         process.once("SIGINT", interrupt);
         process.once("SIGTERM", interrupt);
         process.stdout.on("error", outputError);
-        const write = (text2) => new Promise((resolve5, reject) => {
-          process.stdout.write(text2, (error) => error ? reject(error) : resolve5());
+        const write = (text2) => new Promise((resolve6, reject) => {
+          process.stdout.write(text2, (error) => error ? reject(error) : resolve6());
         });
         const requestOptions = { signal: controller.signal };
         const result = kind === "chat" ? await client.createChatCompletion(
@@ -4341,6 +4344,20 @@ function registerOrganisations(root) {
   const self = showHelpOnEmpty(
     group.command("self").description("Manage the current organisation")
   );
+  const info = addReadOutput(
+    group.command("info").description("Get organisation dashboard info (settings redacted)").requiredOption("--tsg-id <id>", "Tenant service group ID")
+  );
+  info.action(
+    (opts) => runDetail(
+      info,
+      opts,
+      async (client) => redactAIGatewaySecrets(
+        "organisations.getInfo",
+        await client.organisations.getInfo(opts.tsgId),
+        "response"
+      )
+    )
+  );
   const selfGet = addReadOutput(self.command("get").description("Get the current organisation"));
   selfGet.action((opts) => runDetail(selfGet, opts, (client) => client.organisations.getSelf()));
   const selfUpdate = addWriteOutput(
@@ -4431,6 +4448,10 @@ function registerAiGatewayInventory(root) {
     { option: "name", path: "name" },
     { option: "workspace", path: "workspace_id" }
   ];
+  const catalog = addReadOutput(
+    guardrails.command("catalog").description("Get available guardrail evaluator schemas (not enabled policies)")
+  );
+  catalog.action((opts) => runDetail(catalog, opts, (client) => client.guardrails.getCatalog()));
   const addGuardrailFields = (command) => command.option("--actions <json>", "Guardrail actions object").option("--checks <json>", "Guardrail checks array").option("--name <name>", "Guardrail name").option("--workspace <uuid>", "Workspace UUID");
   const guardrailUpdateFields = guardrailFields.filter((field) => field.option !== "workspace");
   const addGuardrailUpdateFields = (command) => command.option("--actions <json>", "Guardrail actions object").option("--checks <json>", "Guardrail checks array").option("--name <name>", "Guardrail name");
@@ -4501,7 +4522,8 @@ function registerAiGatewayInventory(root) {
 // src/cli/commands/aigateway/telemetry.ts
 import {
   AI_GW_GROUP_COLUMNS,
-  AI_GW_GROUP_DIMENSIONS
+  AI_GW_GROUP_DIMENSIONS,
+  redactAIGatewaySecrets as redactAIGatewaySecrets2
 } from "@cdot65/prisma-airs-sdk";
 
 // src/cli/commands/aigateway/telemetry-filters.ts
@@ -4586,7 +4608,10 @@ function parseNamedDate2(value, flag) {
 function registerMetric(telemetry, name, description, method) {
   const command = addWindowOptions(telemetry.command(name).description(description));
   command.action(
-    (opts) => runDetail(command, opts, (client) => client.telemetry[method](windowFrom(opts)))
+    (opts) => runDetail(command, opts, async (client) => {
+      const result = await client.telemetry[method](windowFrom(opts));
+      return method === "filterBoundaries" ? redactAIGatewaySecrets2("telemetry.filterBoundaries", result, "response") : result;
+    })
   );
 }
 function registerFilteredMetric(telemetry, name, description) {
@@ -4634,6 +4659,24 @@ function registerAiGatewayTelemetryReads(telemetry) {
   );
   registerMetric(telemetry, "error-trends", "Get error trends", "errorTrends");
   registerMetric(telemetry, "errors", "Get error count", "errors");
+  registerMetric(
+    telemetry,
+    "error-category-trends",
+    "Get errors by HTTP status",
+    "errorCategoryTrends"
+  );
+  registerMetric(
+    telemetry,
+    "grouped-errors",
+    "Get HTTP error counts by time bucket",
+    "groupedErrors"
+  );
+  registerMetric(
+    telemetry,
+    "filter-boundaries",
+    "Get available analytics filters and bounds",
+    "filterBoundaries"
+  );
   const feedback = showHelpOnEmpty(
     telemetry.command("feedback").description("Inspect model feedback telemetry")
   );
@@ -4676,7 +4719,7 @@ function registerAiGatewayTelemetryReads(telemetry) {
   registerFilteredMetric(telemetry, "latency", "Get latency telemetry");
   const logs = showHelpOnEmpty(telemetry.command("logs").description("Inspect request logs"));
   const logsList = addWindowOptions(
-    logs.command("list").description("List request logs").option("--page-size <n>", "Rows per response", "50").option("--status-code <code>", "Filter by HTTP status").option("--trace-id <id>", "Return one trace id")
+    logs.command("list").description("List request logs").option("--page-size <n>", "Rows per response", "50").option("--current-page <n>", "Zero-based transaction page", "0").option("--status-code <code>", "Filter by HTTP status").option("--trace-id <id>", "Return one trace id")
   );
   logsList.action(
     (opts) => runDetail(
@@ -4685,6 +4728,7 @@ function registerAiGatewayTelemetryReads(telemetry) {
       (client) => client.telemetry.logs({
         ...windowFrom(opts),
         pageSize: parsePositiveInteger2(opts.pageSize ?? "50", "--page-size"),
+        currentPage: parseNonnegativePage(opts.currentPage ?? "0"),
         ...opts.statusCode ? { statusCode: parsePositiveInteger2(opts.statusCode, "--status-code") } : {},
         ...opts.traceId ? { traceId: opts.traceId } : {}
       })
@@ -4696,6 +4740,99 @@ function registerAiGatewayTelemetryReads(telemetry) {
   registerMetric(telemetry, "user-trends", "Get user trends", "userTrends");
   registerMetric(telemetry, "users", "Get unique-user count", "users");
 }
+function parseNonnegativePage(value) {
+  if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)))
+    throw new CliUsageError("--current-page must be a nonnegative safe integer");
+  return Number(value);
+}
+
+// src/cli/commands/aigateway-report.ts
+import { lstat } from "fs/promises";
+import { resolve } from "path";
+import { AIGatewayClient as AIGatewayClient3 } from "@cdot65/prisma-airs-sdk";
+import { z } from "zod";
+import { randomUUID } from "crypto";
+function registerAiGatewayReportCommand(aigateway) {
+  const command = aigateway.command("report").alias("dashboard").description("Generate an AI Gateway environment report (read-only)").requiredOption("--workspace <ref>", "Workspace slug, UUID, or unique display name").option("--days <n>", "Rolling window in days (default: 1)", "1").option("--start <iso>", "Explicit ISO-8601 start; requires --end").option("--end <iso>", "Explicit ISO-8601 end; requires --start").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
+    "--output-file <path>",
+    "Destination (default: new timestamped file in CWD); - for stdout; never overwrite"
+  ).option("--title <text>", "Report title", "AI Gateway environment report").option("--max-pages <n>", "Page budget per source, 1\u2013100 (50 transactions/page)", "40").option("--strict", "Exit 1 after writing if any source is incomplete").addHelpText(
+    "after",
+    examples(
+      "airs aigateway report --workspace ws-develo-71f8d8 --output-file ./airs-daily.html",
+      "airs aigateway report --workspace ws-develo-71f8d8 --output markdown --output-file ./airs-daily.md",
+      "airs aigateway report --workspace ws-develo-71f8d8",
+      "airs aigateway report --workspace ws-develo-71f8d8 --strict --max-pages 20 --output-file - > daily.html"
+    )
+  ).action(async (opts) => {
+    const format = opts.output ?? command.parent?.parent?.opts().output ?? "html";
+    if (format !== "html" && format !== "markdown")
+      usageError("Report output must be html or markdown");
+    if (typeof opts.workspace !== "string" || !opts.workspace.trim())
+      usageError("--workspace cannot be empty");
+    if (!/^[1-9]\d*$/.test(opts.days) || !Number.isSafeInteger(Number(opts.days)))
+      usageError("--days must be a positive integer");
+    if (Boolean(opts.start) !== Boolean(opts.end))
+      usageError("--start and --end must be supplied together");
+    if (opts.start && command.getOptionValueSource("days") !== "default")
+      usageError("Use --days or --start/--end, not both");
+    const end = opts.end ? new Date(opts.end) : /* @__PURE__ */ new Date();
+    const start = opts.start ? new Date(opts.start) : new Date(end.getTime() - Number(opts.days) * 864e5);
+    const iso = z.string().datetime({ offset: true });
+    if (opts.start && (!iso.safeParse(opts.start).success || !iso.safeParse(opts.end).success) || !Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || start >= end)
+      usageError("Provide a valid increasing ISO-8601 window with timezone");
+    const maxPages = Number(opts.maxPages);
+    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages) || maxPages > 100)
+      usageError("--max-pages must be an integer from 1 to 100");
+    if (typeof opts.title !== "string" || !opts.title.trim() || opts.title.length > 240)
+      usageError("--title must contain 1\u2013240 characters");
+    if (opts.outputFile !== void 0 && !opts.outputFile.trim())
+      usageError("--output-file cannot be empty");
+    const defaultName = `airs-aigateway-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve(opts.outputFile ?? defaultName);
+    try {
+      if (outputPath) {
+        const existing = await lstat(outputPath).catch((error) => {
+          if (error.code !== "ENOENT") throw error;
+          return void 0;
+        });
+        if (existing) throw new Error("Output already exists");
+      }
+      const config = await loadConfig();
+      const client = new AIGatewayClient3({
+        ...aiGatewayClientOptions(config),
+        numRetries: 0
+      });
+      ui.status("Collecting AI Gateway statistics and current configuration (read-only)...");
+      const report = await collectGatewayEnvironmentReport(client, {
+        title: opts.title,
+        maxPages,
+        workspace: opts.workspace,
+        tsgId: config.mgmtTsgId ?? process.env.PANW_AI_GW_TSG_ID ?? "",
+        start,
+        end
+      });
+      const rendered = format === "html" ? renderEnvironmentReportHtml(report) : renderEnvironmentReportMarkdown(report);
+      if (outputPath) {
+        await writeReportFile(outputPath, rendered);
+        ui.status(`Report \u2192 ${outputPath.replace(/[\p{Cc}\p{Cf}]/gu, "_")} (mode 0600)`);
+      } else {
+        await new Promise(
+          (done, reject) => process.stdout.write(rendered, (error) => error ? reject(error) : done())
+        );
+      }
+      const incomplete = report.sources.filter((source) => source.status !== "complete").length;
+      if (incomplete)
+        ui.status(`${incomplete} source(s) incomplete; review the evidence section.`);
+      if (report.health === "unknown" || opts.strict && incomplete > 0) process.exitCode = 1;
+    } catch {
+      ui.error(
+        "Report generation failed. Verify Management API configuration and a writable, new output path. Existing files are never overwritten."
+      );
+      process.exitCode = 1;
+    }
+  });
+}
 
 // src/cli/commands/aigateway.ts
 async function createService() {
@@ -4759,6 +4896,7 @@ function scopeNameLooksUnrelated(name, scopeName) {
 function registerAiGatewayCommand(program) {
   const aigateway = program.command("aigateway").description("Manage and observe Prisma AIRS AI Gateway resources").action(() => aigateway.outputHelp());
   registerAiGatewayInventory(aigateway);
+  registerAiGatewayReportCommand(aigateway);
   registerAiGatewayInference(aigateway);
   const workspace = aigateway.command("workspaces").alias("workspace").description("Manage gateway workspaces").action(() => workspace.outputHelp());
   const workspaceList = workspace.command("list").description("List workspaces (default: active workspaces you are scoped to)").option("--plane <plane>", "Plane to read from: data (scoped) or admin (whole tenant)").option("--status <status>", "Filter by lifecycle state: active or archived").option("--all", "Merge active + archived admin-plane reads (whole tenant, both states)").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").addHelpText(
@@ -5201,7 +5339,7 @@ function registerConfigCommand(program) {
 }
 
 // src/cli/commands/doctor.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { readFile as readFile4 } from "fs/promises";
 import { init, Scanner } from "@cdot65/prisma-airs-sdk";
 var DOCTOR_TIMEOUT_MS = 5e3;
@@ -5299,8 +5437,8 @@ async function withTimeout(promise, ms) {
   try {
     return await Promise.race([
       promise,
-      new Promise((resolve5) => {
-        timer = setTimeout(() => resolve5(TIMED_OUT), ms);
+      new Promise((resolve6) => {
+        timer = setTimeout(() => resolve6(TIMED_OUT), ms);
       })
     ]);
   } finally {
@@ -5455,7 +5593,7 @@ async function defaultScannerProbe() {
   const config = await loadConfig();
   init(runtimeInitOptions(config));
   const scanner = new Scanner();
-  return scanner.queryByScanIds([randomUUID()]);
+  return scanner.queryByScanIds([randomUUID2()]);
 }
 async function defaultMgmtProbe() {
   const config = await loadConfig();
@@ -5570,12 +5708,12 @@ function hasBin(bin) {
   }
 }
 function run(bin, args, label) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn(bin, args, { stdio: "inherit" });
     child.on("error", (err) => reject(new Error(`Failed to start ${bin}: ${err.message}`)));
     child.on("close", (code) => {
       if (code !== 0) reject(new Error(`${label} failed with exit code ${code}`));
-      else resolve5();
+      else resolve6();
     });
   });
 }
@@ -6153,24 +6291,33 @@ async function backupTargets(opts) {
   return results;
 }
 
-// src/cli/commands/redteam-dashboard.ts
-import { lstat } from "fs/promises";
-import { resolve } from "path";
+// src/cli/commands/redteam-report.ts
+import { lstat as lstat2 } from "fs/promises";
+import { resolve as resolve2 } from "path";
 import { RedTeamClient } from "@cdot65/prisma-airs-sdk";
-import { randomUUID as randomUUID2 } from "crypto";
-function registerRedTeamDashboardCommand(redteam) {
-  const command = redteam.command("dashboard").description("Generate a Red Team environment dashboard (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
+import { randomUUID as randomUUID3 } from "crypto";
+function registerRedTeamReportCommand(redteam, scanReport) {
+  const command = redteam.command("report [jobId]").alias("dashboard").description("Generate an environment report, or view an individual scan report by job ID").option("--attacks", "Individual scan only: include attack list", false).option("--severity <level>", "Individual scan only: filter attacks by severity").option("--limit <n>", "Individual scan only: max attacks to show", "20").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
     "--output-file <path>",
     "Destination (default: new timestamped file in CWD); - for stdout; never overwrite"
   ).option("--title <text>", "Report title", "Red Team environment report").option("--max-pages <n>", "Page budget per source, 1\u2013100 (15 records/page)", "40").option("--strict", "Exit 1 after writing if any source is incomplete").addHelpText(
     "after",
     examples(
-      "airs redteam dashboard --output-file ./airs-daily.html",
-      "airs redteam dashboard --output markdown --output-file ./airs-daily.md",
-      "airs redteam dashboard",
-      "airs redteam dashboard --strict --max-pages 20 --output-file - > daily.html"
+      "airs redteam report --output-file ./airs-daily.html",
+      "airs redteam report --output markdown --output-file ./airs-daily.md",
+      "airs redteam report",
+      "airs redteam report --strict --max-pages 20 --output-file - > daily.html"
     )
-  ).action(async (opts) => {
+  ).action(async (jobId, opts) => {
+    const explicit = (name) => command.getOptionValueSource(name) === "cli";
+    if (jobId !== void 0) {
+      if (["output", "outputFile", "title", "maxPages", "strict"].some(explicit) || ["html", "markdown"].includes(command.parent?.parent?.opts().output))
+        usageError("Environment report options cannot be combined with a scan job ID");
+      await scanReport(jobId, opts);
+      return;
+    }
+    if (["attacks", "severity", "limit"].some(explicit))
+      usageError("--attacks, --severity and --limit require a scan job ID");
     const format = opts.output ?? command.parent?.parent?.opts().output ?? "html";
     if (format !== "html" && format !== "markdown")
       usageError("Report output must be html or markdown");
@@ -6181,11 +6328,11 @@ function registerRedTeamDashboardCommand(redteam) {
       usageError("--title must contain 1\u2013240 characters");
     if (opts.outputFile !== void 0 && !opts.outputFile.trim())
       usageError("--output-file cannot be empty");
-    const defaultName = `airs-redteam-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID2().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
-    const outputPath = opts.outputFile === "-" ? void 0 : resolve(opts.outputFile ?? defaultName);
+    const defaultName = `airs-redteam-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID3().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve2(opts.outputFile ?? defaultName);
     try {
       if (outputPath) {
-        const existing = await lstat(outputPath).catch((error) => {
+        const existing = await lstat2(outputPath).catch((error) => {
           if (error.code !== "ENOENT") throw error;
           return void 0;
         });
@@ -6465,7 +6612,6 @@ function parseAdapterVariables(input) {
 }
 function registerRedteamCommand(program) {
   const redteam = program.command("redteam").description("AI Red Team scan operations");
-  registerRedTeamDashboardCommand(redteam);
   redteam.command("abort <jobId>").description("Abort a running scan").action(async (jobId) => {
     try {
       renderRedteamHeader();
@@ -6848,7 +6994,7 @@ function registerRedteamCommand(program) {
       fail(err);
     }
   });
-  redteam.command("report <jobId>").description("View scan report").option("--attacks", "Include attack list", false).option("--severity <level>", "Filter attacks by severity").option("--limit <n>", "Max attacks to show", "20").action(async (jobId, opts) => {
+  registerRedTeamReportCommand(redteam, async (jobId, opts) => {
     try {
       renderRedteamHeader();
       const service = await createService3();
@@ -7459,7 +7605,7 @@ function registerRedteamCommand(program) {
 }
 
 // src/cli/commands/runtime.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import * as fs5 from "fs";
 import { readFile as readFile10 } from "fs/promises";
 import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
@@ -7707,7 +7853,7 @@ function mergeProfilePolicy(existing, overrides) {
 }
 
 // src/cli/bulk-scan-lock.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import * as fs3 from "fs/promises";
 function errorCode(error) {
   return error?.code;
@@ -7738,7 +7884,7 @@ function processIsAlive(pid) {
   }
 }
 async function installLock(lockPath, record) {
-  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID3()}`;
+  const candidate = `${lockPath}.candidate-${process.pid}-${randomUUID4()}`;
   try {
     await fs3.writeFile(candidate, JSON.stringify(record), {
       encoding: "utf-8",
@@ -7756,7 +7902,7 @@ async function acquireBulkScanLock(statePath) {
     version: 1,
     pid: process.pid,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    token: randomUUID3()
+    token: randomUUID4()
   };
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
@@ -7792,32 +7938,32 @@ async function acquireBulkScanLock(statePath) {
 }
 
 // src/cli/bulk-scan-state.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import * as fs4 from "fs/promises";
 import * as path2 from "path";
-import { z } from "zod";
-var BulkScanResultSchema = z.object({
-  index: z.number().int().nonnegative(),
-  reqId: z.number().int().nonnegative(),
-  prompt: z.string(),
-  response: z.string().optional(),
-  scanId: z.string(),
-  reportId: z.string(),
-  action: z.enum(["allow", "block", "failed"]),
-  category: z.string(),
-  triggered: z.boolean(),
-  detections: z.record(z.boolean()),
-  error: z.string().optional()
+import { z as z2 } from "zod";
+var BulkScanResultSchema = z2.object({
+  index: z2.number().int().nonnegative(),
+  reqId: z2.number().int().nonnegative(),
+  prompt: z2.string(),
+  response: z2.string().optional(),
+  scanId: z2.string(),
+  reportId: z2.string(),
+  action: z2.enum(["allow", "block", "failed"]),
+  category: z2.string(),
+  triggered: z2.boolean(),
+  detections: z2.record(z2.boolean()),
+  error: z2.string().optional()
 });
-var BulkScanItemSchema = z.object({
-  index: z.number().int().nonnegative(),
-  reqId: z.number().int().nonnegative(),
-  prompt: z.string(),
-  status: z.enum(["pending", "submitting", "submitted", "complete", "failed", "ambiguous"]),
-  scanId: z.string().min(1).optional(),
-  receiptReportId: z.string().optional(),
+var BulkScanItemSchema = z2.object({
+  index: z2.number().int().nonnegative(),
+  reqId: z2.number().int().nonnegative(),
+  prompt: z2.string(),
+  status: z2.enum(["pending", "submitting", "submitted", "complete", "failed", "ambiguous"]),
+  scanId: z2.string().min(1).optional(),
+  receiptReportId: z2.string().optional(),
   result: BulkScanResultSchema.optional(),
-  error: z.string().optional()
+  error: z2.string().optional()
 }).superRefine((item, ctx) => {
   if (item.reqId !== item.index) {
     ctx.addIssue({ code: "custom", message: "reqId must match the stable input index" });
@@ -7855,15 +8001,15 @@ var BulkScanItemSchema = z.object({
     }
   }
 });
-var BulkScanStateSchema = z.object({
-  version: z.literal(2),
-  profile: z.string().min(1),
-  sessionId: z.string().optional(),
-  outputFile: z.string().min(1),
-  batchSize: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  createdAt: z.string().datetime(),
-  updatedAt: z.string().datetime(),
-  items: z.array(BulkScanItemSchema).min(1)
+var BulkScanStateSchema = z2.object({
+  version: z2.literal(2),
+  profile: z2.string().min(1),
+  sessionId: z2.string().optional(),
+  outputFile: z2.string().min(1),
+  batchSize: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  createdAt: z2.string().datetime(),
+  updatedAt: z2.string().datetime(),
+  items: z2.array(BulkScanItemSchema).min(1)
 }).superRefine((state, ctx) => {
   const indices = /* @__PURE__ */ new Set();
   for (const [position, item] of state.items.entries()) {
@@ -7889,8 +8035,8 @@ async function saveBulkScanState(state, dir, filePath) {
   }
   await fs4.mkdir(dir, { recursive: true, mode: 448 });
   if (!filePath) await fs4.chmod(dir, 448);
-  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID4()}.bulk-scan.json`);
-  const temporary = `${target}.tmp-${process.pid}-${randomUUID4()}`;
+  const target = filePath ?? path2.join(dir, `${state.createdAt.replace(/[:.]/g, "-")}-${randomUUID5()}.bulk-scan.json`);
+  const temporary = `${target}.tmp-${process.pid}-${randomUUID5()}`;
   try {
     await fs4.writeFile(temporary, JSON.stringify(state, null, 2), {
       encoding: "utf-8",
@@ -9015,8 +9161,8 @@ function registerCleanupCommand(parent) {
 }
 
 // src/cli/commands/runtime-dashboard.ts
-import { lstat as lstat2 } from "fs/promises";
-import { resolve as resolve3 } from "path";
+import { lstat as lstat3 } from "fs/promises";
+import { resolve as resolve4 } from "path";
 import { dump as dump5 } from "js-yaml";
 var TIME_UNITS = ["hour", "hours", "day", "days"];
 function integer2(value, name, minimum = 0) {
@@ -9092,8 +9238,8 @@ function registerRuntimeDashboardCommands(runtime) {
               "Scan content requires exactly one of --show-content or --output-file <new-path>"
             );
           if (opts.outputFile) {
-            const path3 = resolve3(text(opts.outputFile, "--output-file"));
-            const existing = await lstat2(path3).catch((error) => {
+            const path3 = resolve4(text(opts.outputFile, "--output-file"));
+            const existing = await lstat3(path3).catch((error) => {
               if (error.code !== "ENOENT") throw error;
               return void 0;
             });
@@ -9108,7 +9254,7 @@ function registerRuntimeDashboardCommands(runtime) {
         const result = await read(client.dashboard);
         const output = format === "yaml" ? dump5(result, { noRefs: true, lineWidth: -1 }).trimEnd() : JSON.stringify(result, null, 2);
         if (command.name() === "scan-content" && opts.outputFile) {
-          await writeReportFile(resolve3(String(opts.outputFile)), `${output}
+          await writeReportFile(resolve4(String(opts.outputFile)), `${output}
 `);
           ui.status("Scan content exported to the requested private file (0600).");
         } else console.log(output);
@@ -9279,11 +9425,11 @@ function registerRuntimeDashboardCommands(runtime) {
 }
 
 // src/cli/commands/runtime-report.ts
-import { lstat as lstat3 } from "fs/promises";
-import { resolve as resolve4 } from "path";
-import { randomUUID as randomUUID5 } from "crypto";
+import { lstat as lstat4 } from "fs/promises";
+import { resolve as resolve5 } from "path";
+import { randomUUID as randomUUID6 } from "crypto";
 function registerRuntimeReportCommand(runtime) {
-  const command = runtime.command("report").description("Generate a daily AI Runtime Security environment dashboard (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
+  const command = runtime.command("report").description("Generate a daily AI Runtime Security environment report (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
     "--output-file <path>",
     "Destination (default: new timestamped file in CWD); - for stdout; never overwrite"
   ).option("--title <text>", "Report title", "Daily environment report").option("--max-pages <n>", "Page budget per source, 1\u2013100 (25 sessions/page)", "40").option("--strict", "Exit 1 after writing if any source is incomplete").addHelpText(
@@ -9305,11 +9451,11 @@ function registerRuntimeReportCommand(runtime) {
       usageError("--title must contain 1\u2013240 characters");
     if (opts.outputFile !== void 0 && !opts.outputFile.trim())
       usageError("--output-file cannot be empty");
-    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID5().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
-    const outputPath = opts.outputFile === "-" ? void 0 : resolve4(opts.outputFile ?? defaultName);
+    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID6().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve5(opts.outputFile ?? defaultName);
     try {
       if (outputPath) {
-        const existing = await lstat3(outputPath).catch((error) => {
+        const existing = await lstat4(outputPath).catch((error) => {
           if (error.code !== "ENOENT") throw error;
           return void 0;
         });
@@ -9796,7 +9942,7 @@ function completedBulkResults(state) {
 }
 async function writeBulkResults(outputPath, results) {
   await fs5.promises.mkdir(dirname3(outputPath), { recursive: true });
-  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID6()}`;
+  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID7()}`;
   try {
     await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
       encoding: "utf-8",
@@ -10641,12 +10787,12 @@ function buildProgram() {
   program.hook("preAction", async (_thisCommand, actionCommand) => {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
-    const isEnvironmentReport = actionCommand.name() === "report" && actionCommand.parent?.name() === "runtime" || actionCommand.name() === "dashboard" && actionCommand.parent?.name() === "redteam";
+    const isEnvironmentReport = actionCommand.name() === "report" && ["runtime", "redteam", "aigateway"].includes(actionCommand.parent?.name() ?? "") && !(actionCommand.parent?.name() === "redteam" && actionCommand.args.length > 0);
     if (isEnvironmentReport && (root.debug || /^(1|true|yes|on)$/i.test(process.env.PANW_AI_SEC_DEBUG?.trim() ?? "")))
       usageError(
         "Disable --debug and PANW_AI_SEC_DEBUG for environment reports to avoid persisting sensitive traffic content"
       );
-    if (!isEnvironmentReport && READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
+    if (!isEnvironmentReport && !(actionCommand.name() === "report" && actionCommand.parent?.name() === "redteam") && READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
       try {
         const format = await resolveOutput(actionCommand, actionCommand.opts());
         actionCommand.setOptionValueWithSource("output", format, "implied");
@@ -10657,7 +10803,7 @@ function buildProgram() {
     if (root.debug) {
       const logPath = join4(
         process.cwd(),
-        `debug-api-${Date.now()}-${randomUUID7().slice(0, 8)}.jsonl`
+        `debug-api-${Date.now()}-${randomUUID8().slice(0, 8)}.jsonl`
       );
       try {
         installDebugLogger(logPath);