@cdot65/prisma-airs-sdk 0.1.2 → 0.2.1

package/dist/index.cjs

@@ -25,15 +25,27 @@ __export(index_exports, {
   AI_SEC_API_KEY: () => AI_SEC_API_KEY,
   AI_SEC_API_TOKEN: () => AI_SEC_API_TOKEN,
   ASYNC_SCAN_PATH: () => ASYNC_SCAN_PATH,
+  Action: () => Action,
   AgentMetaSchema: () => AgentMetaSchema,
   AiProfileSchema: () => AiProfileSchema,
   AsyncScanObjectSchema: () => AsyncScanObjectSchema,
   AsyncScanResponseSchema: () => AsyncScanResponseSchema,
   BEARER: () => BEARER,
+  Category: () => Category,
   Content: () => Content,
+  CreateCustomTopicRequestSchema: () => CreateCustomTopicRequestSchema,
+  CreateSecurityProfileRequestSchema: () => CreateSecurityProfileRequestSchema,
+  CustomTopicListResponseSchema: () => CustomTopicListResponseSchema,
+  CustomTopicSchema: () => CustomTopicSchema,
   DEFAULT_ENDPOINT: () => DEFAULT_ENDPOINT,
+  DEFAULT_MGMT_ENDPOINT: () => DEFAULT_MGMT_ENDPOINT,
+  DEFAULT_TOKEN_ENDPOINT: () => DEFAULT_TOKEN_ENDPOINT,
   DSDetailResultSchema: () => DSDetailResultSchema,
   DSResultMetadataSchema: () => DSResultMetadataSchema,
+  DeleteProfileConflictSchema: () => DeleteProfileConflictSchema,
+  DeleteProfileResponseSchema: () => DeleteProfileResponseSchema,
+  DeleteTopicConflictSchema: () => DeleteTopicConflictSchema,
+  DeleteTopicResponseSchema: () => DeleteTopicResponseSchema,
   DetectionServiceResultSchema: () => DetectionServiceResultSchema,
   DlpReportSchema: () => DlpReportSchema,
   ErrorResponseSchema: () => ErrorResponseSchema,
@@ -57,9 +69,22 @@ __export(index_exports, {
   MAX_SESSION_ID_STR_LENGTH: () => MAX_SESSION_ID_STR_LENGTH,
   MAX_TOKEN_LENGTH: () => MAX_TOKEN_LENGTH,
   MAX_TRANSACTION_ID_STR_LENGTH: () => MAX_TRANSACTION_ID_STR_LENGTH,
+  MGMT_CLIENT_ID: () => MGMT_CLIENT_ID,
+  MGMT_CLIENT_SECRET: () => MGMT_CLIENT_SECRET,
+  MGMT_ENDPOINT: () => MGMT_ENDPOINT,
+  MGMT_PROFILES_TSG_PATH: () => MGMT_PROFILES_TSG_PATH,
+  MGMT_PROFILE_PATH: () => MGMT_PROFILE_PATH,
+  MGMT_TOKEN_ENDPOINT: () => MGMT_TOKEN_ENDPOINT,
+  MGMT_TOPICS_TSG_PATH: () => MGMT_TOPICS_TSG_PATH,
+  MGMT_TOPIC_FORCE_PATH: () => MGMT_TOPIC_FORCE_PATH,
+  MGMT_TOPIC_PATH: () => MGMT_TOPIC_PATH,
+  MGMT_TSG_ID: () => MGMT_TSG_ID,
+  ManagementClient: () => ManagementClient,
   MaskedDataSchema: () => MaskedDataSchema,
   MetadataSchema: () => MetadataSchema,
   PAYLOAD_HASH: () => PAYLOAD_HASH,
+  PolicySchema: () => PolicySchema,
+  ProfilesClient: () => ProfilesClient,
   PromptDetectedSchema: () => PromptDetectedSchema,
   PromptDetectionDetailsSchema: () => PromptDetectionDetailsSchema,
   ResponseDetectedSchema: () => ResponseDetectedSchema,
@@ -74,12 +99,16 @@ __export(index_exports, {
   ScanResponseSchema: () => ScanResponseSchema,
   ScanSummarySchema: () => ScanSummarySchema,
   Scanner: () => Scanner,
+  SecurityProfileListResponseSchema: () => SecurityProfileListResponseSchema,
+  SecurityProfileSchema: () => SecurityProfileSchema,
   ThreatScanReportSchema: () => ThreatScanReportSchema,
   ToolDetectedSchema: () => ToolDetectedSchema,
   ToolEventMetadataSchema: () => ToolEventMetadataSchema,
   ToolEventSchema: () => ToolEventSchema,
+  TopicsClient: () => TopicsClient,
   USER_AGENT: () => USER_AGENT,
   UrlfEntrySchema: () => UrlfEntrySchema,
+  Verdict: () => Verdict,
   globalConfiguration: () => globalConfiguration,
   init: () => init
 });
@@ -110,12 +139,24 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.1.2";
+var SDK_VERSION = "0.2.1";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
+var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
+var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
+var MGMT_CLIENT_ID = "PANW_MGMT_CLIENT_ID";
+var MGMT_CLIENT_SECRET = "PANW_MGMT_CLIENT_SECRET";
+var MGMT_TSG_ID = "PANW_MGMT_TSG_ID";
+var MGMT_ENDPOINT = "PANW_MGMT_ENDPOINT";
+var MGMT_TOKEN_ENDPOINT = "PANW_MGMT_TOKEN_ENDPOINT";
 var SYNC_SCAN_PATH = "/v1/scan/sync/request";
 var ASYNC_SCAN_PATH = "/v1/scan/async/request";
 var SCAN_RESULTS_PATH = "/v1/scan/results";
 var SCAN_REPORTS_PATH = "/v1/scan/reports";
+var MGMT_PROFILE_PATH = "/v1/mgmt/profile";
+var MGMT_PROFILES_TSG_PATH = "/v1/mgmt/profiles/tsg";
+var MGMT_TOPIC_PATH = "/v1/mgmt/topic";
+var MGMT_TOPICS_TSG_PATH = "/v1/mgmt/topics/tsg";
+var MGMT_TOPIC_FORCE_PATH = "/v1/mgmt/topic/force";
 
 // src/errors.ts
 var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
@@ -124,10 +165,15 @@ var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
   ErrorType2["USER_REQUEST_PAYLOAD_ERROR"] = "AISEC_USER_REQUEST_PAYLOAD_ERROR";
   ErrorType2["MISSING_VARIABLE"] = "AISEC_MISSING_VARIABLE";
   ErrorType2["AISEC_SDK_ERROR"] = "AISEC_SDK_ERROR";
+  ErrorType2["OAUTH_ERROR"] = "AISEC_OAUTH_ERROR";
   return ErrorType2;
 })(ErrorType || {});
 var AISecSDKException = class _AISecSDKException extends Error {
   errorType;
+  /**
+   * @param message - Human-readable error description.
+   * @param errorType - Classification of the error.
+   */
   constructor(message, errorType) {
     super(errorType ? `${errorType}:${message}` : message);
     this.name = "AISecSDKException";
@@ -209,6 +255,68 @@ function init(opts = {}) {
   globalConfiguration.init(opts);
 }
 
+// src/http-retry.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function backoffDelay(attempt) {
+  return Math.pow(2, attempt) * 1e3;
+}
+function isRetryableStatus(status) {
+  return HTTP_FORCE_RETRY_STATUS_CODES.includes(status);
+}
+function classifyErrorType(status) {
+  return status >= 500 ? "AISEC_SERVER_SIDE_ERROR" /* SERVER_SIDE_ERROR */ : "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */;
+}
+function extractErrorMessage(body, status) {
+  try {
+    const parsed = JSON.parse(body);
+    return parsed.error_message ?? parsed.message ?? parsed.error?.message ?? `API error ${status}`;
+  } catch {
+    return body ? `API error ${status}: ${body}` : `API error ${status}`;
+  }
+}
+async function executeWithRetry(opts) {
+  const { maxRetries, execute, onRetryableFailure } = opts;
+  let lastError;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    let response;
+    try {
+      response = await execute(attempt);
+    } catch (err) {
+      if (err instanceof AISecSDKException) throw err;
+      lastError = err;
+      if (attempt < maxRetries) {
+        await sleep(backoffDelay(attempt));
+        continue;
+      }
+      throw new AISecSDKException(
+        lastError.message ?? "Network error",
+        "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */
+      );
+    }
+    if (response.ok) return response;
+    if (onRetryableFailure) {
+      const handled = await onRetryableFailure(response, attempt);
+      if (handled) {
+        attempt--;
+        continue;
+      }
+    }
+    if (isRetryableStatus(response.status) && attempt < maxRetries) {
+      await sleep(backoffDelay(attempt));
+      continue;
+    }
+    const errorText = await response.text();
+    const errorMessage = extractErrorMessage(errorText, response.status);
+    throw new AISecSDKException(errorMessage, classifyErrorType(response.status));
+  }
+  throw new AISecSDKException(
+    lastError?.message ?? "Max retries exceeded",
+    "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */
+  );
+}
+
 // src/utils.ts
 var import_node_crypto = require("crypto");
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -234,9 +342,6 @@ function buildHeaders() {
   }
   return headers;
 }
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
 async function httpRequest(opts) {
   if (!globalConfiguration.initialized) {
     throw new AISecSDKException(
@@ -259,48 +364,27 @@ async function httpRequest(opts) {
       headers[PAYLOAD_HASH] = generatePayloadHash(bodyStr, globalConfiguration.apiKey);
     }
   }
-  const maxRetries = globalConfiguration.numRetries;
-  let lastError;
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    try {
-      const response = await fetch(url.toString(), {
-        method: opts.method,
-        headers,
-        body: bodyStr
-      });
-      if (response.ok) {
-        const data = await response.json();
-        return { status: response.status, data };
-      }
-      if (HTTP_FORCE_RETRY_STATUS_CODES.includes(response.status) && attempt < maxRetries) {
-        await sleep(Math.pow(2, attempt) * 1e3);
-        continue;
-      }
-      let errorMessage;
-      try {
-        const errorBody = await response.json();
-        errorMessage = errorBody.message ?? errorBody.error?.message ?? `API error ${response.status}`;
-      } catch {
-        errorMessage = `API error ${response.status}`;
-      }
-      const errorType = response.status >= 500 ? "AISEC_SERVER_SIDE_ERROR" /* SERVER_SIDE_ERROR */ : "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */;
-      throw new AISecSDKException(errorMessage, errorType);
-    } catch (err) {
-      if (err instanceof AISecSDKException) {
-        throw err;
-      }
-      lastError = err;
-      if (attempt < maxRetries) {
-        await sleep(Math.pow(2, attempt) * 1e3);
-        continue;
-      }
-    }
-  }
-  throw new AISecSDKException(lastError?.message ?? "Network error", "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */);
+  const response = await executeWithRetry({
+    maxRetries: globalConfiguration.numRetries,
+    execute: () => fetch(url.toString(), {
+      method: opts.method,
+      headers,
+      body: bodyStr
+    })
+  });
+  const data = await response.json();
+  return { status: response.status, data };
 }
 
 // src/scan/scanner.ts
 var Scanner = class {
+  /**
+   * Perform a synchronous content scan.
+   * @param aiProfile - AI security profile to scan against.
+   * @param content - Content to scan.
+   * @param opts - Optional transaction/session IDs and metadata.
+   * @returns Scan response with verdict, action, and detection details.
+   */
   async syncScan(aiProfile, content, opts = {}) {
     if (opts.trId && opts.trId.length > MAX_TRANSACTION_ID_STR_LENGTH) {
       throw new AISecSDKException(
@@ -328,6 +412,11 @@ var Scanner = class {
     });
     return res.data;
   }
+  /**
+   * Submit content for asynchronous scanning.
+   * @param scanObjects - Array of scan objects (1–5 items).
+   * @returns Response containing scan IDs for later querying.
+   */
   async asyncScan(scanObjects) {
     if (scanObjects.length < 1) {
       throw new AISecSDKException(
@@ -348,6 +437,11 @@ var Scanner = class {
     });
     return res.data;
   }
+  /**
+   * Query scan results by scan IDs.
+   * @param scanIds - Array of scan UUIDs (1–5 items).
+   * @returns Array of scan results with status and response data.
+   */
   async queryByScanIds(scanIds) {
     if (scanIds.length < 1) {
       throw new AISecSDKException(
@@ -373,6 +467,11 @@ var Scanner = class {
     });
     return res.data;
   }
+  /**
+   * Query detailed threat reports by report IDs.
+   * @param reportIds - Array of report IDs (1–5 items).
+   * @returns Array of threat scan reports with detection details.
+   */
   async queryByReportIds(reportIds) {
     if (reportIds.length < 1) {
       throw new AISecSDKException(
@@ -484,6 +583,7 @@ var Content = class _Content {
   set toolEvent(value) {
     this._toolEvent = value;
   }
+  /** Total byte length of all text content fields. */
   get length() {
     let total = 0;
     if (this._prompt) total += Buffer.byteLength(this._prompt);
@@ -493,6 +593,7 @@ var Content = class _Content {
     if (this._codeResponse) total += Buffer.byteLength(this._codeResponse);
     return total;
   }
+  /** Serialize to the API request format. */
   toJSON() {
     const obj = {};
     if (this._prompt !== void 0) obj.prompt = this._prompt;
@@ -503,6 +604,10 @@ var Content = class _Content {
     if (this._toolEvent !== void 0) obj.tool_event = this._toolEvent;
     return obj;
   }
+  /**
+   * Create a Content instance from an API response object.
+   * @param json - Scan request contents inner object.
+   */
   static fromJSON(json) {
     return new _Content({
       prompt: json.prompt,
@@ -513,6 +618,10 @@ var Content = class _Content {
       toolEvent: json.tool_event
     });
   }
+  /**
+   * Load content from a JSON file.
+   * @param filePath - Path to JSON file containing scan request contents.
+   */
   static fromJSONFile(filePath) {
     const raw = (0, import_node_fs.readFileSync)(filePath, "utf-8");
     const parsed = JSON.parse(raw);
@@ -520,6 +629,23 @@ var Content = class _Content {
   }
 };
 
+// src/models/enums.ts
+var Verdict = {
+  BENIGN: "benign",
+  MALICIOUS: "malicious",
+  UNKNOWN: "unknown"
+};
+var Action = {
+  ALLOW: "allow",
+  BLOCK: "block",
+  ALERT: "alert"
+};
+var Category = {
+  BENIGN: "benign",
+  MALICIOUS: "malicious",
+  UNKNOWN: "unknown"
+};
+
 // src/models/ai-profile.ts
 var import_zod = require("zod");
 var AiProfileSchema = import_zod.z.object({
@@ -744,6 +870,513 @@ var ErrorResponseSchema = import_zod14.z.object({
     unit: import_zod14.z.string().optional()
   }).optional()
 });
+
+// src/models/mgmt-security-profile.ts
+var import_zod15 = require("zod");
+var DlpDataProfileSchema = import_zod15.z.object({
+  profile_name: import_zod15.z.string(),
+  active: import_zod15.z.boolean().optional()
+}).passthrough();
+var DlpSchema = import_zod15.z.object({
+  dlp_status: import_zod15.z.string().optional(),
+  data_profiles: import_zod15.z.array(DlpDataProfileSchema).optional()
+}).passthrough();
+var DataLeakDetectionSchema = import_zod15.z.object({
+  "data-leak-detection-status": import_zod15.z.string().optional(),
+  dlp: DlpSchema.optional()
+}).passthrough();
+var AppProtectionSchema = import_zod15.z.object({
+  "prompt-injection": import_zod15.z.string().optional(),
+  "jailbreak-detection": import_zod15.z.string().optional()
+}).passthrough();
+var ModelProtectionSchema = import_zod15.z.object({
+  "model-denial-of-service": import_zod15.z.string().optional()
+}).passthrough();
+var AgentProtectionSchema = import_zod15.z.object({
+  "malicious-agent-activity": import_zod15.z.string().optional()
+}).passthrough();
+var LatencySchema = import_zod15.z.object({
+  status: import_zod15.z.string().optional(),
+  max_latency_ms: import_zod15.z.number().optional()
+}).passthrough();
+var ModelConfigurationSchema = import_zod15.z.object({
+  latency: LatencySchema.optional()
+}).passthrough();
+var PolicySchema = import_zod15.z.object({
+  "data-leak-detection": DataLeakDetectionSchema.optional(),
+  "app-protection": AppProtectionSchema.optional(),
+  "model-protection": ModelProtectionSchema.optional(),
+  "agent-protection": AgentProtectionSchema.optional(),
+  "model-configuration": ModelConfigurationSchema.optional()
+}).passthrough();
+var SecurityProfileSchema = import_zod15.z.object({
+  profile_id: import_zod15.z.string().optional(),
+  profile_name: import_zod15.z.string(),
+  revision: import_zod15.z.number().optional(),
+  active: import_zod15.z.boolean().optional(),
+  policy: PolicySchema.optional(),
+  created_by: import_zod15.z.string().optional(),
+  updated_by: import_zod15.z.string().optional(),
+  last_modified_ts: import_zod15.z.string().optional()
+}).passthrough();
+var CreateSecurityProfileRequestSchema = import_zod15.z.object({
+  profile_id: import_zod15.z.string().optional(),
+  profile_name: import_zod15.z.string(),
+  revision: import_zod15.z.number().optional(),
+  active: import_zod15.z.boolean().optional(),
+  policy: PolicySchema.optional(),
+  created_by: import_zod15.z.string().optional(),
+  updated_by: import_zod15.z.string().optional(),
+  last_modified_ts: import_zod15.z.string().optional()
+}).passthrough();
+var SecurityProfileListResponseSchema = import_zod15.z.object({
+  ai_profiles: import_zod15.z.array(SecurityProfileSchema),
+  next_offset: import_zod15.z.number().optional()
+}).passthrough();
+var DeleteProfileResponseSchema = import_zod15.z.object({
+  message: import_zod15.z.string()
+}).passthrough();
+var DeleteProfileConflictSchema = import_zod15.z.object({
+  message: import_zod15.z.string(),
+  payload: import_zod15.z.array(
+    import_zod15.z.object({
+      policy_id: import_zod15.z.string(),
+      policy_name: import_zod15.z.string(),
+      priority: import_zod15.z.number()
+    }).passthrough()
+  )
+}).passthrough();
+
+// src/models/mgmt-custom-topic.ts
+var import_zod16 = require("zod");
+var CustomTopicSchema = import_zod16.z.object({
+  topic_id: import_zod16.z.string().optional(),
+  topic_name: import_zod16.z.string(),
+  revision: import_zod16.z.number().optional(),
+  active: import_zod16.z.boolean().optional(),
+  description: import_zod16.z.string().optional(),
+  examples: import_zod16.z.array(import_zod16.z.string()).optional(),
+  created_by: import_zod16.z.string().optional(),
+  updated_by: import_zod16.z.string().optional(),
+  last_modified_ts: import_zod16.z.string().optional(),
+  created_ts: import_zod16.z.string().optional()
+}).passthrough();
+var CreateCustomTopicRequestSchema = import_zod16.z.object({
+  topic_id: import_zod16.z.string().optional(),
+  topic_name: import_zod16.z.string(),
+  revision: import_zod16.z.number().optional(),
+  active: import_zod16.z.boolean().optional(),
+  description: import_zod16.z.string().optional(),
+  examples: import_zod16.z.array(import_zod16.z.string()).optional(),
+  created_by: import_zod16.z.string().optional(),
+  updated_by: import_zod16.z.string().optional(),
+  last_modified_ts: import_zod16.z.string().optional(),
+  created_ts: import_zod16.z.string().optional()
+}).passthrough();
+var CustomTopicListResponseSchema = import_zod16.z.object({
+  custom_topics: import_zod16.z.array(CustomTopicSchema),
+  next_offset: import_zod16.z.number().optional()
+}).passthrough();
+var DeleteTopicResponseSchema = import_zod16.z.object({
+  message: import_zod16.z.string()
+}).passthrough();
+var DeleteTopicConflictSchema = import_zod16.z.object({
+  message: import_zod16.z.string(),
+  payload: import_zod16.z.array(
+    import_zod16.z.object({
+      profile_id: import_zod16.z.string(),
+      profile_name: import_zod16.z.string(),
+      revision: import_zod16.z.number()
+    }).passthrough()
+  )
+}).passthrough();
+
+// src/models/oauth-token.ts
+var import_zod17 = require("zod");
+var OAuthTokenResponseSchema = import_zod17.z.object({
+  access_token: import_zod17.z.string(),
+  token_type: import_zod17.z.string().optional(),
+  expires_in: import_zod17.z.number(),
+  scope: import_zod17.z.string().optional()
+});
+
+// src/management/oauth-client.ts
+var TOKEN_BUFFER_MS = 3e4;
+var OAuthClient = class {
+  tokenEndpoint;
+  clientId;
+  clientSecret;
+  tsgId;
+  accessToken = null;
+  expiresAt = 0;
+  pendingFetch = null;
+  constructor(opts) {
+    this.clientId = opts.clientId;
+    this.clientSecret = opts.clientSecret;
+    this.tsgId = opts.tsgId;
+    this.tokenEndpoint = opts.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT;
+  }
+  /**
+   * Get a valid access token, refreshing if needed.
+   * @returns Bearer access token string.
+   */
+  async getToken() {
+    if (this.accessToken && Date.now() < this.expiresAt - TOKEN_BUFFER_MS) {
+      return this.accessToken;
+    }
+    if (this.pendingFetch) {
+      return this.pendingFetch;
+    }
+    this.pendingFetch = this.fetchToken().finally(() => {
+      this.pendingFetch = null;
+    });
+    return this.pendingFetch;
+  }
+  /** Clear the cached token, forcing a fresh fetch on next call. */
+  clearToken() {
+    this.accessToken = null;
+    this.expiresAt = 0;
+  }
+  async fetchToken() {
+    const credentials = btoa(`${this.clientId}:${this.clientSecret}`);
+    const body = new URLSearchParams({
+      grant_type: "client_credentials",
+      scope: `tsg_id:${this.tsgId}`
+    });
+    let response;
+    try {
+      response = await fetch(this.tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Authorization: `Basic ${credentials}`
+        },
+        body: body.toString()
+      });
+    } catch (err) {
+      throw new AISecSDKException(
+        `Token request failed: ${err.message}`,
+        "AISEC_OAUTH_ERROR" /* OAUTH_ERROR */
+      );
+    }
+    if (!response.ok) {
+      let errorMsg;
+      try {
+        const errorBody = await response.json();
+        errorMsg = errorBody.error_description ?? errorBody.error ?? `Token request failed with status ${response.status}`;
+      } catch {
+        errorMsg = `Token request failed with status ${response.status}`;
+      }
+      throw new AISecSDKException(errorMsg, "AISEC_OAUTH_ERROR" /* OAUTH_ERROR */);
+    }
+    const data = OAuthTokenResponseSchema.parse(await response.json());
+    this.accessToken = data.access_token;
+    this.expiresAt = Date.now() + data.expires_in * 1e3;
+    return this.accessToken;
+  }
+};
+
+// src/management/management-http-client.ts
+async function managementHttpRequest(opts) {
+  const { method, baseUrl, path, body, params, oauthClient, numRetries } = opts;
+  let hadTokenRefresh = false;
+  const response = await executeWithRetry({
+    maxRetries: numRetries,
+    execute: async () => {
+      const token = await oauthClient.getToken();
+      const stripped = baseUrl.replace(/\/+$/, "");
+      const url = new URL(`${stripped}${path}`);
+      if (params) {
+        for (const [key, value] of Object.entries(params)) {
+          url.searchParams.set(key, value);
+        }
+      }
+      const headers = {
+        Authorization: `Bearer ${token}`,
+        "User-Agent": USER_AGENT
+      };
+      let bodyStr;
+      if (body !== void 0) {
+        headers["Content-Type"] = "application/json";
+        bodyStr = JSON.stringify(body);
+      }
+      return fetch(url.toString(), { method, headers, body: bodyStr });
+    },
+    onRetryableFailure: async (response2) => {
+      if (response2.status === 401 && !hadTokenRefresh) {
+        hadTokenRefresh = true;
+        oauthClient.clearToken();
+        return true;
+      }
+      return false;
+    }
+  });
+  const text = await response.text();
+  const data = text ? JSON.parse(text) : {};
+  return { status: response.status, data };
+}
+
+// src/management/profiles.ts
+var ProfilesClient = class {
+  baseUrl;
+  oauthClient;
+  tsgId;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.oauthClient = opts.oauthClient;
+    this.tsgId = opts.tsgId;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * Create a new security profile.
+   * @param request - Profile configuration.
+   * @returns The created security profile.
+   */
+  async create(request) {
+    const res = await managementHttpRequest({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: MGMT_PROFILE_PATH,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * List security profiles for the TSG.
+   * @param opts - Pagination options.
+   * @returns Paginated list of security profiles.
+   */
+  async list(opts) {
+    const params = {
+      offset: String(opts?.offset ?? 0),
+      limit: String(opts?.limit ?? 100)
+    };
+    const res = await managementHttpRequest({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILES_TSG_PATH}/${this.tsgId}`,
+      params,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * Update an existing security profile.
+   * @param profileId - UUID of the profile to update.
+   * @param request - Updated profile configuration.
+   * @returns The updated security profile.
+   */
+  async update(profileId, request) {
+    if (!isValidUuid(profileId)) {
+      throw new AISecSDKException(
+        `Invalid profile_id: ${profileId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILE_PATH}/uuid/${profileId}`,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * Delete a security profile.
+   * @param profileId - UUID of the profile to delete.
+   * @returns Deletion confirmation message.
+   */
+  async delete(profileId) {
+    if (!isValidUuid(profileId)) {
+      throw new AISecSDKException(
+        `Invalid profile_id: ${profileId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILE_PATH}/${profileId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+};
+
+// src/management/topics.ts
+var TopicsClient = class {
+  baseUrl;
+  oauthClient;
+  tsgId;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.oauthClient = opts.oauthClient;
+    this.tsgId = opts.tsgId;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * Create a new custom topic.
+   * @param request - Topic definition with name, description, and examples.
+   * @returns The created custom topic.
+   */
+  async create(request) {
+    const res = await managementHttpRequest({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: MGMT_TOPIC_PATH,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * List custom topics for the TSG.
+   * @param opts - Pagination options.
+   * @returns Paginated list of custom topics.
+   */
+  async list(opts) {
+    const params = {
+      offset: String(opts?.offset ?? 0),
+      limit: String(opts?.limit ?? 100)
+    };
+    const res = await managementHttpRequest({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPICS_TSG_PATH}/${this.tsgId}`,
+      params,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * Update an existing custom topic.
+   * @param topicId - UUID of the topic to update.
+   * @param request - Updated topic definition.
+   * @returns The updated custom topic.
+   */
+  async update(topicId, request) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_PATH}/uuid/${topicId}`,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * Delete a custom topic. Fails if topic is referenced by a profile.
+   * @param topicId - UUID of the topic to delete.
+   * @returns Deletion confirmation message.
+   */
+  async delete(topicId) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_PATH}/${topicId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * Force-delete a custom topic, removing it from any referencing profiles.
+   * @param topicId - UUID of the topic to force-delete.
+   * @returns Deletion confirmation message.
+   */
+  async forceDelete(topicId) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_FORCE_PATH}/${topicId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+};
+
+// src/management/client.ts
+var ManagementClient = class {
+  profiles;
+  topics;
+  constructor(opts = {}) {
+    const clientId = opts.clientId ?? process.env[MGMT_CLIENT_ID];
+    const clientSecret = opts.clientSecret ?? process.env[MGMT_CLIENT_SECRET];
+    const tsgId = opts.tsgId ?? process.env[MGMT_TSG_ID];
+    const apiEndpoint = opts.apiEndpoint ?? process.env[MGMT_ENDPOINT] ?? DEFAULT_MGMT_ENDPOINT;
+    const tokenEndpoint = opts.tokenEndpoint ?? process.env[MGMT_TOKEN_ENDPOINT];
+    const numRetries = Math.min(
+      Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
+      MAX_NUMBER_OF_RETRIES
+    );
+    if (!clientId) {
+      throw new AISecSDKException(
+        "clientId is required (option or PANW_MGMT_CLIENT_ID env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    if (!clientSecret) {
+      throw new AISecSDKException(
+        "clientSecret is required (option or PANW_MGMT_CLIENT_SECRET env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    if (!tsgId) {
+      throw new AISecSDKException(
+        "tsgId is required (option or PANW_MGMT_TSG_ID env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    const oauthClient = new OAuthClient({
+      clientId,
+      clientSecret,
+      tsgId,
+      tokenEndpoint
+    });
+    this.profiles = new ProfilesClient({
+      baseUrl: apiEndpoint,
+      oauthClient,
+      tsgId,
+      numRetries
+    });
+    this.topics = new TopicsClient({
+      baseUrl: apiEndpoint,
+      oauthClient,
+      tsgId,
+      numRetries
+    });
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AISecSDKException,
@@ -751,15 +1384,27 @@ var ErrorResponseSchema = import_zod14.z.object({
   AI_SEC_API_KEY,
   AI_SEC_API_TOKEN,
   ASYNC_SCAN_PATH,
+  Action,
   AgentMetaSchema,
   AiProfileSchema,
   AsyncScanObjectSchema,
   AsyncScanResponseSchema,
   BEARER,
+  Category,
   Content,
+  CreateCustomTopicRequestSchema,
+  CreateSecurityProfileRequestSchema,
+  CustomTopicListResponseSchema,
+  CustomTopicSchema,
   DEFAULT_ENDPOINT,
+  DEFAULT_MGMT_ENDPOINT,
+  DEFAULT_TOKEN_ENDPOINT,
   DSDetailResultSchema,
   DSResultMetadataSchema,
+  DeleteProfileConflictSchema,
+  DeleteProfileResponseSchema,
+  DeleteTopicConflictSchema,
+  DeleteTopicResponseSchema,
   DetectionServiceResultSchema,
   DlpReportSchema,
   ErrorResponseSchema,
@@ -783,9 +1428,22 @@ var ErrorResponseSchema = import_zod14.z.object({
   MAX_SESSION_ID_STR_LENGTH,
   MAX_TOKEN_LENGTH,
   MAX_TRANSACTION_ID_STR_LENGTH,
+  MGMT_CLIENT_ID,
+  MGMT_CLIENT_SECRET,
+  MGMT_ENDPOINT,
+  MGMT_PROFILES_TSG_PATH,
+  MGMT_PROFILE_PATH,
+  MGMT_TOKEN_ENDPOINT,
+  MGMT_TOPICS_TSG_PATH,
+  MGMT_TOPIC_FORCE_PATH,
+  MGMT_TOPIC_PATH,
+  MGMT_TSG_ID,
+  ManagementClient,
   MaskedDataSchema,
   MetadataSchema,
   PAYLOAD_HASH,
+  PolicySchema,
+  ProfilesClient,
   PromptDetectedSchema,
   PromptDetectionDetailsSchema,
   ResponseDetectedSchema,
@@ -800,12 +1458,16 @@ var ErrorResponseSchema = import_zod14.z.object({
   ScanResponseSchema,
   ScanSummarySchema,
   Scanner,
+  SecurityProfileListResponseSchema,
+  SecurityProfileSchema,
   ThreatScanReportSchema,
   ToolDetectedSchema,
   ToolEventMetadataSchema,
   ToolEventSchema,
+  TopicsClient,
   USER_AGENT,
   UrlfEntrySchema,
+  Verdict,
   globalConfiguration,
   init
 });