@cdot65/prisma-airs-sdk 0.1.0 → 0.2.0

package/README.md

@@ -129,7 +129,39 @@ try {
 }
 ```
 
-Error types: `SERVER_SIDE_ERROR`, `CLIENT_SIDE_ERROR`, `USER_REQUEST_PAYLOAD_ERROR`, `MISSING_VARIABLE`, `AISEC_SDK_ERROR`.
+Error types: `SERVER_SIDE_ERROR`, `CLIENT_SIDE_ERROR`, `USER_REQUEST_PAYLOAD_ERROR`, `MISSING_VARIABLE`, `AISEC_SDK_ERROR`, `OAUTH_ERROR`.
+
+## Management API
+
+Separate client for CRUD operations on Security Profiles and Custom Topics via OAuth2 client credentials. See [docs/management-api.md](docs/management-api.md) for full details.
+
+```bash
+# Required env vars (or pass as constructor options)
+export PANW_MGMT_CLIENT_ID=your-client-id
+export PANW_MGMT_CLIENT_SECRET=your-client-secret
+export PANW_MGMT_TSG_ID=1234567890
+# Optional: override for EU/UK/FedRAMP
+# export PANW_MGMT_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/aisec
+```
+
+```ts
+import { ManagementClient } from '@cdot65/prisma-airs-sdk';
+
+const client = new ManagementClient();
+
+// Security Profiles
+const profiles = await client.profiles.list();
+const created = await client.profiles.create({ profile_name: 'my-profile', active: true, policy: { ... } });
+await client.profiles.update(created.profile_id, { ... });
+await client.profiles.delete(created.profile_id);
+
+// Custom Topics
+const topics = await client.topics.list();
+const topic = await client.topics.create({ topic_name: 'pii-detector', examples: ['SSN: 123-45-6789'] });
+await client.topics.update(topic.topic_id, { ... });
+await client.topics.delete(topic.topic_id);
+await client.topics.forceDelete(topic.topic_id); // even if referenced by a profile
+```
 
 ## Migration from v0.1
 

package/dist/index.cjs

@@ -31,9 +31,19 @@ __export(index_exports, {
   AsyncScanResponseSchema: () => AsyncScanResponseSchema,
   BEARER: () => BEARER,
   Content: () => Content,
+  CreateCustomTopicRequestSchema: () => CreateCustomTopicRequestSchema,
+  CreateSecurityProfileRequestSchema: () => CreateSecurityProfileRequestSchema,
+  CustomTopicListResponseSchema: () => CustomTopicListResponseSchema,
+  CustomTopicSchema: () => CustomTopicSchema,
   DEFAULT_ENDPOINT: () => DEFAULT_ENDPOINT,
+  DEFAULT_MGMT_ENDPOINT: () => DEFAULT_MGMT_ENDPOINT,
+  DEFAULT_TOKEN_ENDPOINT: () => DEFAULT_TOKEN_ENDPOINT,
   DSDetailResultSchema: () => DSDetailResultSchema,
   DSResultMetadataSchema: () => DSResultMetadataSchema,
+  DeleteProfileConflictSchema: () => DeleteProfileConflictSchema,
+  DeleteProfileResponseSchema: () => DeleteProfileResponseSchema,
+  DeleteTopicConflictSchema: () => DeleteTopicConflictSchema,
+  DeleteTopicResponseSchema: () => DeleteTopicResponseSchema,
   DetectionServiceResultSchema: () => DetectionServiceResultSchema,
   DlpReportSchema: () => DlpReportSchema,
   ErrorResponseSchema: () => ErrorResponseSchema,
@@ -57,9 +67,22 @@ __export(index_exports, {
   MAX_SESSION_ID_STR_LENGTH: () => MAX_SESSION_ID_STR_LENGTH,
   MAX_TOKEN_LENGTH: () => MAX_TOKEN_LENGTH,
   MAX_TRANSACTION_ID_STR_LENGTH: () => MAX_TRANSACTION_ID_STR_LENGTH,
+  MGMT_CLIENT_ID: () => MGMT_CLIENT_ID,
+  MGMT_CLIENT_SECRET: () => MGMT_CLIENT_SECRET,
+  MGMT_ENDPOINT: () => MGMT_ENDPOINT,
+  MGMT_PROFILES_TSG_PATH: () => MGMT_PROFILES_TSG_PATH,
+  MGMT_PROFILE_PATH: () => MGMT_PROFILE_PATH,
+  MGMT_TOKEN_ENDPOINT: () => MGMT_TOKEN_ENDPOINT,
+  MGMT_TOPICS_TSG_PATH: () => MGMT_TOPICS_TSG_PATH,
+  MGMT_TOPIC_FORCE_PATH: () => MGMT_TOPIC_FORCE_PATH,
+  MGMT_TOPIC_PATH: () => MGMT_TOPIC_PATH,
+  MGMT_TSG_ID: () => MGMT_TSG_ID,
+  ManagementClient: () => ManagementClient,
   MaskedDataSchema: () => MaskedDataSchema,
   MetadataSchema: () => MetadataSchema,
   PAYLOAD_HASH: () => PAYLOAD_HASH,
+  PolicySchema: () => PolicySchema,
+  ProfilesClient: () => ProfilesClient,
   PromptDetectedSchema: () => PromptDetectedSchema,
   PromptDetectionDetailsSchema: () => PromptDetectionDetailsSchema,
   ResponseDetectedSchema: () => ResponseDetectedSchema,
@@ -74,10 +97,13 @@ __export(index_exports, {
   ScanResponseSchema: () => ScanResponseSchema,
   ScanSummarySchema: () => ScanSummarySchema,
   Scanner: () => Scanner,
+  SecurityProfileListResponseSchema: () => SecurityProfileListResponseSchema,
+  SecurityProfileSchema: () => SecurityProfileSchema,
   ThreatScanReportSchema: () => ThreatScanReportSchema,
   ToolDetectedSchema: () => ToolDetectedSchema,
   ToolEventMetadataSchema: () => ToolEventMetadataSchema,
   ToolEventSchema: () => ToolEventSchema,
+  TopicsClient: () => TopicsClient,
   USER_AGENT: () => USER_AGENT,
   UrlfEntrySchema: () => UrlfEntrySchema,
   globalConfiguration: () => globalConfiguration,
@@ -110,12 +136,24 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.1.0";
+var SDK_VERSION = "0.1.2";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
+var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
+var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
+var MGMT_CLIENT_ID = "PANW_MGMT_CLIENT_ID";
+var MGMT_CLIENT_SECRET = "PANW_MGMT_CLIENT_SECRET";
+var MGMT_TSG_ID = "PANW_MGMT_TSG_ID";
+var MGMT_ENDPOINT = "PANW_MGMT_ENDPOINT";
+var MGMT_TOKEN_ENDPOINT = "PANW_MGMT_TOKEN_ENDPOINT";
 var SYNC_SCAN_PATH = "/v1/scan/sync/request";
 var ASYNC_SCAN_PATH = "/v1/scan/async/request";
 var SCAN_RESULTS_PATH = "/v1/scan/results";
 var SCAN_REPORTS_PATH = "/v1/scan/reports";
+var MGMT_PROFILE_PATH = "/v1/mgmt/profile";
+var MGMT_PROFILES_TSG_PATH = "/v1/mgmt/profiles/tsg";
+var MGMT_TOPIC_PATH = "/v1/mgmt/topic";
+var MGMT_TOPICS_TSG_PATH = "/v1/mgmt/topics/tsg";
+var MGMT_TOPIC_FORCE_PATH = "/v1/mgmt/topic/force";
 
 // src/errors.ts
 var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
@@ -124,6 +162,7 @@ var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
   ErrorType2["USER_REQUEST_PAYLOAD_ERROR"] = "AISEC_USER_REQUEST_PAYLOAD_ERROR";
   ErrorType2["MISSING_VARIABLE"] = "AISEC_MISSING_VARIABLE";
   ErrorType2["AISEC_SDK_ERROR"] = "AISEC_SDK_ERROR";
+  ErrorType2["OAUTH_ERROR"] = "AISEC_OAUTH_ERROR";
   return ErrorType2;
 })(ErrorType || {});
 var AISecSDKException = class _AISecSDKException extends Error {
@@ -744,6 +783,494 @@ var ErrorResponseSchema = import_zod14.z.object({
     unit: import_zod14.z.string().optional()
   }).optional()
 });
+
+// src/models/mgmt-security-profile.ts
+var import_zod15 = require("zod");
+var DlpDataProfileSchema = import_zod15.z.object({
+  profile_name: import_zod15.z.string(),
+  active: import_zod15.z.boolean().optional()
+}).passthrough();
+var DlpSchema = import_zod15.z.object({
+  dlp_status: import_zod15.z.string().optional(),
+  data_profiles: import_zod15.z.array(DlpDataProfileSchema).optional()
+}).passthrough();
+var DataLeakDetectionSchema = import_zod15.z.object({
+  "data-leak-detection-status": import_zod15.z.string().optional(),
+  dlp: DlpSchema.optional()
+}).passthrough();
+var AppProtectionSchema = import_zod15.z.object({
+  "prompt-injection": import_zod15.z.string().optional(),
+  "jailbreak-detection": import_zod15.z.string().optional()
+}).passthrough();
+var ModelProtectionSchema = import_zod15.z.object({
+  "model-denial-of-service": import_zod15.z.string().optional()
+}).passthrough();
+var AgentProtectionSchema = import_zod15.z.object({
+  "malicious-agent-activity": import_zod15.z.string().optional()
+}).passthrough();
+var LatencySchema = import_zod15.z.object({
+  status: import_zod15.z.string().optional(),
+  max_latency_ms: import_zod15.z.number().optional()
+}).passthrough();
+var ModelConfigurationSchema = import_zod15.z.object({
+  latency: LatencySchema.optional()
+}).passthrough();
+var PolicySchema = import_zod15.z.object({
+  "data-leak-detection": DataLeakDetectionSchema.optional(),
+  "app-protection": AppProtectionSchema.optional(),
+  "model-protection": ModelProtectionSchema.optional(),
+  "agent-protection": AgentProtectionSchema.optional(),
+  "model-configuration": ModelConfigurationSchema.optional()
+}).passthrough();
+var SecurityProfileSchema = import_zod15.z.object({
+  profile_id: import_zod15.z.string().optional(),
+  profile_name: import_zod15.z.string(),
+  revision: import_zod15.z.number().optional(),
+  active: import_zod15.z.boolean().optional(),
+  policy: PolicySchema.optional(),
+  created_by: import_zod15.z.string().optional(),
+  updated_by: import_zod15.z.string().optional(),
+  last_modified_ts: import_zod15.z.string().optional()
+}).passthrough();
+var CreateSecurityProfileRequestSchema = import_zod15.z.object({
+  profile_id: import_zod15.z.string().optional(),
+  profile_name: import_zod15.z.string(),
+  revision: import_zod15.z.number().optional(),
+  active: import_zod15.z.boolean().optional(),
+  policy: PolicySchema.optional(),
+  created_by: import_zod15.z.string().optional(),
+  updated_by: import_zod15.z.string().optional(),
+  last_modified_ts: import_zod15.z.string().optional()
+}).passthrough();
+var SecurityProfileListResponseSchema = import_zod15.z.object({
+  ai_profiles: import_zod15.z.array(SecurityProfileSchema),
+  next_offset: import_zod15.z.number().optional()
+}).passthrough();
+var DeleteProfileResponseSchema = import_zod15.z.object({
+  message: import_zod15.z.string()
+}).passthrough();
+var DeleteProfileConflictSchema = import_zod15.z.object({
+  message: import_zod15.z.string(),
+  payload: import_zod15.z.array(
+    import_zod15.z.object({
+      policy_id: import_zod15.z.string(),
+      policy_name: import_zod15.z.string(),
+      priority: import_zod15.z.number()
+    }).passthrough()
+  )
+}).passthrough();
+
+// src/models/mgmt-custom-topic.ts
+var import_zod16 = require("zod");
+var CustomTopicSchema = import_zod16.z.object({
+  topic_id: import_zod16.z.string().optional(),
+  topic_name: import_zod16.z.string(),
+  revision: import_zod16.z.number().optional(),
+  active: import_zod16.z.boolean().optional(),
+  description: import_zod16.z.string().optional(),
+  examples: import_zod16.z.array(import_zod16.z.string()).optional(),
+  created_by: import_zod16.z.string().optional(),
+  updated_by: import_zod16.z.string().optional(),
+  last_modified_ts: import_zod16.z.string().optional(),
+  created_ts: import_zod16.z.string().optional()
+}).passthrough();
+var CreateCustomTopicRequestSchema = import_zod16.z.object({
+  topic_id: import_zod16.z.string().optional(),
+  topic_name: import_zod16.z.string(),
+  revision: import_zod16.z.number().optional(),
+  active: import_zod16.z.boolean().optional(),
+  description: import_zod16.z.string().optional(),
+  examples: import_zod16.z.array(import_zod16.z.string()).optional(),
+  created_by: import_zod16.z.string().optional(),
+  updated_by: import_zod16.z.string().optional(),
+  last_modified_ts: import_zod16.z.string().optional(),
+  created_ts: import_zod16.z.string().optional()
+}).passthrough();
+var CustomTopicListResponseSchema = import_zod16.z.object({
+  custom_topics: import_zod16.z.array(CustomTopicSchema),
+  next_offset: import_zod16.z.number().optional()
+}).passthrough();
+var DeleteTopicResponseSchema = import_zod16.z.object({
+  message: import_zod16.z.string()
+}).passthrough();
+var DeleteTopicConflictSchema = import_zod16.z.object({
+  message: import_zod16.z.string(),
+  payload: import_zod16.z.array(
+    import_zod16.z.object({
+      profile_id: import_zod16.z.string(),
+      profile_name: import_zod16.z.string(),
+      revision: import_zod16.z.number()
+    }).passthrough()
+  )
+}).passthrough();
+
+// src/models/oauth-token.ts
+var import_zod17 = require("zod");
+var OAuthTokenResponseSchema = import_zod17.z.object({
+  access_token: import_zod17.z.string(),
+  token_type: import_zod17.z.string().optional(),
+  expires_in: import_zod17.z.number(),
+  scope: import_zod17.z.string().optional()
+});
+
+// src/management/oauth-client.ts
+var TOKEN_BUFFER_MS = 3e4;
+var OAuthClient = class {
+  tokenEndpoint;
+  clientId;
+  clientSecret;
+  tsgId;
+  accessToken = null;
+  expiresAt = 0;
+  pendingFetch = null;
+  constructor(opts) {
+    this.clientId = opts.clientId;
+    this.clientSecret = opts.clientSecret;
+    this.tsgId = opts.tsgId;
+    this.tokenEndpoint = opts.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT;
+  }
+  async getToken() {
+    if (this.accessToken && Date.now() < this.expiresAt - TOKEN_BUFFER_MS) {
+      return this.accessToken;
+    }
+    if (this.pendingFetch) {
+      return this.pendingFetch;
+    }
+    this.pendingFetch = this.fetchToken().finally(() => {
+      this.pendingFetch = null;
+    });
+    return this.pendingFetch;
+  }
+  clearToken() {
+    this.accessToken = null;
+    this.expiresAt = 0;
+  }
+  async fetchToken() {
+    const credentials = btoa(`${this.clientId}:${this.clientSecret}`);
+    const body = new URLSearchParams({
+      grant_type: "client_credentials",
+      scope: `tsg_id:${this.tsgId}`
+    });
+    let response;
+    try {
+      response = await fetch(this.tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Authorization: `Basic ${credentials}`
+        },
+        body: body.toString()
+      });
+    } catch (err) {
+      throw new AISecSDKException(
+        `Token request failed: ${err.message}`,
+        "AISEC_OAUTH_ERROR" /* OAUTH_ERROR */
+      );
+    }
+    if (!response.ok) {
+      let errorMsg;
+      try {
+        const errorBody = await response.json();
+        errorMsg = errorBody.error_description ?? errorBody.error ?? `Token request failed with status ${response.status}`;
+      } catch {
+        errorMsg = `Token request failed with status ${response.status}`;
+      }
+      throw new AISecSDKException(errorMsg, "AISEC_OAUTH_ERROR" /* OAUTH_ERROR */);
+    }
+    const data = OAuthTokenResponseSchema.parse(await response.json());
+    this.accessToken = data.access_token;
+    this.expiresAt = Date.now() + data.expires_in * 1e3;
+    return this.accessToken;
+  }
+};
+
+// src/management/management-http-client.ts
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function extractError(body, status) {
+  try {
+    const parsed = JSON.parse(body);
+    return parsed.error_message ?? parsed.message ?? `API error ${status}: ${body}`;
+  } catch {
+    return body ? `API error ${status}: ${body}` : `API error ${status}`;
+  }
+}
+async function managementHttpRequest(opts) {
+  const { method, baseUrl, path, body, params, oauthClient, numRetries } = opts;
+  let hadTokenRefresh = false;
+  for (let attempt = 0; attempt <= numRetries; attempt++) {
+    const token = await oauthClient.getToken();
+    const stripped = baseUrl.replace(/\/+$/, "");
+    const url = new URL(`${stripped}${path}`);
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        url.searchParams.set(key, value);
+      }
+    }
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      "User-Agent": USER_AGENT
+    };
+    let bodyStr;
+    if (body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      bodyStr = JSON.stringify(body);
+    }
+    let response;
+    try {
+      response = await fetch(url.toString(), {
+        method,
+        headers,
+        body: bodyStr
+      });
+    } catch (err) {
+      if (attempt < numRetries) {
+        await sleep2(Math.pow(2, attempt) * 1e3);
+        continue;
+      }
+      throw new AISecSDKException(
+        err.message ?? "Network error",
+        "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */
+      );
+    }
+    if (response.ok) {
+      const text = await response.text();
+      const data = text ? JSON.parse(text) : {};
+      return { status: response.status, data };
+    }
+    if (response.status === 401 && !hadTokenRefresh) {
+      hadTokenRefresh = true;
+      oauthClient.clearToken();
+      attempt--;
+      continue;
+    }
+    if (HTTP_FORCE_RETRY_STATUS_CODES.includes(response.status) && attempt < numRetries) {
+      await sleep2(Math.pow(2, attempt) * 1e3);
+      continue;
+    }
+    const errorText = await response.text();
+    const errorMessage = extractError(errorText, response.status);
+    const errorType = response.status >= 500 ? "AISEC_SERVER_SIDE_ERROR" /* SERVER_SIDE_ERROR */ : "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */;
+    throw new AISecSDKException(errorMessage, errorType);
+  }
+  throw new AISecSDKException("Max retries exceeded", "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */);
+}
+
+// src/management/profiles.ts
+var ProfilesClient = class {
+  baseUrl;
+  oauthClient;
+  tsgId;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.oauthClient = opts.oauthClient;
+    this.tsgId = opts.tsgId;
+    this.numRetries = opts.numRetries;
+  }
+  async create(request) {
+    const res = await managementHttpRequest({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: MGMT_PROFILE_PATH,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async list(opts) {
+    const params = {
+      offset: String(opts?.offset ?? 0),
+      limit: String(opts?.limit ?? 100)
+    };
+    const res = await managementHttpRequest({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILES_TSG_PATH}/${this.tsgId}`,
+      params,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async update(profileId, request) {
+    if (!isValidUuid(profileId)) {
+      throw new AISecSDKException(
+        `Invalid profile_id: ${profileId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILE_PATH}/uuid/${profileId}`,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async delete(profileId) {
+    if (!isValidUuid(profileId)) {
+      throw new AISecSDKException(
+        `Invalid profile_id: ${profileId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILE_PATH}/${profileId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+};
+
+// src/management/topics.ts
+var TopicsClient = class {
+  baseUrl;
+  oauthClient;
+  tsgId;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.oauthClient = opts.oauthClient;
+    this.tsgId = opts.tsgId;
+    this.numRetries = opts.numRetries;
+  }
+  async create(request) {
+    const res = await managementHttpRequest({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: MGMT_TOPIC_PATH,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async list(opts) {
+    const params = {
+      offset: String(opts?.offset ?? 0),
+      limit: String(opts?.limit ?? 100)
+    };
+    const res = await managementHttpRequest({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPICS_TSG_PATH}/${this.tsgId}`,
+      params,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async update(topicId, request) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_PATH}/uuid/${topicId}`,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async delete(topicId) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_PATH}/${topicId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  async forceDelete(topicId) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_FORCE_PATH}/${topicId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+};
+
+// src/management/client.ts
+var ManagementClient = class {
+  profiles;
+  topics;
+  constructor(opts = {}) {
+    const clientId = opts.clientId ?? process.env[MGMT_CLIENT_ID];
+    const clientSecret = opts.clientSecret ?? process.env[MGMT_CLIENT_SECRET];
+    const tsgId = opts.tsgId ?? process.env[MGMT_TSG_ID];
+    const apiEndpoint = opts.apiEndpoint ?? process.env[MGMT_ENDPOINT] ?? DEFAULT_MGMT_ENDPOINT;
+    const tokenEndpoint = opts.tokenEndpoint ?? process.env[MGMT_TOKEN_ENDPOINT];
+    const numRetries = Math.min(
+      Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
+      MAX_NUMBER_OF_RETRIES
+    );
+    if (!clientId) {
+      throw new AISecSDKException(
+        "clientId is required (option or PANW_MGMT_CLIENT_ID env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    if (!clientSecret) {
+      throw new AISecSDKException(
+        "clientSecret is required (option or PANW_MGMT_CLIENT_SECRET env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    if (!tsgId) {
+      throw new AISecSDKException(
+        "tsgId is required (option or PANW_MGMT_TSG_ID env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    const oauthClient = new OAuthClient({
+      clientId,
+      clientSecret,
+      tsgId,
+      tokenEndpoint
+    });
+    this.profiles = new ProfilesClient({
+      baseUrl: apiEndpoint,
+      oauthClient,
+      tsgId,
+      numRetries
+    });
+    this.topics = new TopicsClient({
+      baseUrl: apiEndpoint,
+      oauthClient,
+      tsgId,
+      numRetries
+    });
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AISecSDKException,
@@ -757,9 +1284,19 @@ var ErrorResponseSchema = import_zod14.z.object({
   AsyncScanResponseSchema,
   BEARER,
   Content,
+  CreateCustomTopicRequestSchema,
+  CreateSecurityProfileRequestSchema,
+  CustomTopicListResponseSchema,
+  CustomTopicSchema,
   DEFAULT_ENDPOINT,
+  DEFAULT_MGMT_ENDPOINT,
+  DEFAULT_TOKEN_ENDPOINT,
   DSDetailResultSchema,
   DSResultMetadataSchema,
+  DeleteProfileConflictSchema,
+  DeleteProfileResponseSchema,
+  DeleteTopicConflictSchema,
+  DeleteTopicResponseSchema,
   DetectionServiceResultSchema,
   DlpReportSchema,
   ErrorResponseSchema,
@@ -783,9 +1320,22 @@ var ErrorResponseSchema = import_zod14.z.object({
   MAX_SESSION_ID_STR_LENGTH,
   MAX_TOKEN_LENGTH,
   MAX_TRANSACTION_ID_STR_LENGTH,
+  MGMT_CLIENT_ID,
+  MGMT_CLIENT_SECRET,
+  MGMT_ENDPOINT,
+  MGMT_PROFILES_TSG_PATH,
+  MGMT_PROFILE_PATH,
+  MGMT_TOKEN_ENDPOINT,
+  MGMT_TOPICS_TSG_PATH,
+  MGMT_TOPIC_FORCE_PATH,
+  MGMT_TOPIC_PATH,
+  MGMT_TSG_ID,
+  ManagementClient,
   MaskedDataSchema,
   MetadataSchema,
   PAYLOAD_HASH,
+  PolicySchema,
+  ProfilesClient,
   PromptDetectedSchema,
   PromptDetectionDetailsSchema,
   ResponseDetectedSchema,
@@ -800,10 +1350,13 @@ var ErrorResponseSchema = import_zod14.z.object({
   ScanResponseSchema,
   ScanSummarySchema,
   Scanner,
+  SecurityProfileListResponseSchema,
+  SecurityProfileSchema,
   ThreatScanReportSchema,
   ToolDetectedSchema,
   ToolEventMetadataSchema,
   ToolEventSchema,
+  TopicsClient,
   USER_AGENT,
   UrlfEntrySchema,
   globalConfiguration,