@cdot65/prisma-airs-sdk 0.1.2 → 0.2.1

package/dist/index.js

@@ -23,12 +23,24 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.1.2";
+var SDK_VERSION = "0.2.1";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
+var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
+var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
+var MGMT_CLIENT_ID = "PANW_MGMT_CLIENT_ID";
+var MGMT_CLIENT_SECRET = "PANW_MGMT_CLIENT_SECRET";
+var MGMT_TSG_ID = "PANW_MGMT_TSG_ID";
+var MGMT_ENDPOINT = "PANW_MGMT_ENDPOINT";
+var MGMT_TOKEN_ENDPOINT = "PANW_MGMT_TOKEN_ENDPOINT";
 var SYNC_SCAN_PATH = "/v1/scan/sync/request";
 var ASYNC_SCAN_PATH = "/v1/scan/async/request";
 var SCAN_RESULTS_PATH = "/v1/scan/results";
 var SCAN_REPORTS_PATH = "/v1/scan/reports";
+var MGMT_PROFILE_PATH = "/v1/mgmt/profile";
+var MGMT_PROFILES_TSG_PATH = "/v1/mgmt/profiles/tsg";
+var MGMT_TOPIC_PATH = "/v1/mgmt/topic";
+var MGMT_TOPICS_TSG_PATH = "/v1/mgmt/topics/tsg";
+var MGMT_TOPIC_FORCE_PATH = "/v1/mgmt/topic/force";
 
 // src/errors.ts
 var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
@@ -37,10 +49,15 @@ var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
   ErrorType2["USER_REQUEST_PAYLOAD_ERROR"] = "AISEC_USER_REQUEST_PAYLOAD_ERROR";
   ErrorType2["MISSING_VARIABLE"] = "AISEC_MISSING_VARIABLE";
   ErrorType2["AISEC_SDK_ERROR"] = "AISEC_SDK_ERROR";
+  ErrorType2["OAUTH_ERROR"] = "AISEC_OAUTH_ERROR";
   return ErrorType2;
 })(ErrorType || {});
 var AISecSDKException = class _AISecSDKException extends Error {
   errorType;
+  /**
+   * @param message - Human-readable error description.
+   * @param errorType - Classification of the error.
+   */
   constructor(message, errorType) {
     super(errorType ? `${errorType}:${message}` : message);
     this.name = "AISecSDKException";
@@ -122,6 +139,68 @@ function init(opts = {}) {
   globalConfiguration.init(opts);
 }
 
+// src/http-retry.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function backoffDelay(attempt) {
+  return Math.pow(2, attempt) * 1e3;
+}
+function isRetryableStatus(status) {
+  return HTTP_FORCE_RETRY_STATUS_CODES.includes(status);
+}
+function classifyErrorType(status) {
+  return status >= 500 ? "AISEC_SERVER_SIDE_ERROR" /* SERVER_SIDE_ERROR */ : "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */;
+}
+function extractErrorMessage(body, status) {
+  try {
+    const parsed = JSON.parse(body);
+    return parsed.error_message ?? parsed.message ?? parsed.error?.message ?? `API error ${status}`;
+  } catch {
+    return body ? `API error ${status}: ${body}` : `API error ${status}`;
+  }
+}
+async function executeWithRetry(opts) {
+  const { maxRetries, execute, onRetryableFailure } = opts;
+  let lastError;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    let response;
+    try {
+      response = await execute(attempt);
+    } catch (err) {
+      if (err instanceof AISecSDKException) throw err;
+      lastError = err;
+      if (attempt < maxRetries) {
+        await sleep(backoffDelay(attempt));
+        continue;
+      }
+      throw new AISecSDKException(
+        lastError.message ?? "Network error",
+        "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */
+      );
+    }
+    if (response.ok) return response;
+    if (onRetryableFailure) {
+      const handled = await onRetryableFailure(response, attempt);
+      if (handled) {
+        attempt--;
+        continue;
+      }
+    }
+    if (isRetryableStatus(response.status) && attempt < maxRetries) {
+      await sleep(backoffDelay(attempt));
+      continue;
+    }
+    const errorText = await response.text();
+    const errorMessage = extractErrorMessage(errorText, response.status);
+    throw new AISecSDKException(errorMessage, classifyErrorType(response.status));
+  }
+  throw new AISecSDKException(
+    lastError?.message ?? "Max retries exceeded",
+    "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */
+  );
+}
+
 // src/utils.ts
 import { createHmac } from "crypto";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -147,9 +226,6 @@ function buildHeaders() {
   }
   return headers;
 }
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
 async function httpRequest(opts) {
   if (!globalConfiguration.initialized) {
     throw new AISecSDKException(
@@ -172,48 +248,27 @@ async function httpRequest(opts) {
       headers[PAYLOAD_HASH] = generatePayloadHash(bodyStr, globalConfiguration.apiKey);
     }
   }
-  const maxRetries = globalConfiguration.numRetries;
-  let lastError;
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    try {
-      const response = await fetch(url.toString(), {
-        method: opts.method,
-        headers,
-        body: bodyStr
-      });
-      if (response.ok) {
-        const data = await response.json();
-        return { status: response.status, data };
-      }
-      if (HTTP_FORCE_RETRY_STATUS_CODES.includes(response.status) && attempt < maxRetries) {
-        await sleep(Math.pow(2, attempt) * 1e3);
-        continue;
-      }
-      let errorMessage;
-      try {
-        const errorBody = await response.json();
-        errorMessage = errorBody.message ?? errorBody.error?.message ?? `API error ${response.status}`;
-      } catch {
-        errorMessage = `API error ${response.status}`;
-      }
-      const errorType = response.status >= 500 ? "AISEC_SERVER_SIDE_ERROR" /* SERVER_SIDE_ERROR */ : "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */;
-      throw new AISecSDKException(errorMessage, errorType);
-    } catch (err) {
-      if (err instanceof AISecSDKException) {
-        throw err;
-      }
-      lastError = err;
-      if (attempt < maxRetries) {
-        await sleep(Math.pow(2, attempt) * 1e3);
-        continue;
-      }
-    }
-  }
-  throw new AISecSDKException(lastError?.message ?? "Network error", "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */);
+  const response = await executeWithRetry({
+    maxRetries: globalConfiguration.numRetries,
+    execute: () => fetch(url.toString(), {
+      method: opts.method,
+      headers,
+      body: bodyStr
+    })
+  });
+  const data = await response.json();
+  return { status: response.status, data };
 }
 
 // src/scan/scanner.ts
 var Scanner = class {
+  /**
+   * Perform a synchronous content scan.
+   * @param aiProfile - AI security profile to scan against.
+   * @param content - Content to scan.
+   * @param opts - Optional transaction/session IDs and metadata.
+   * @returns Scan response with verdict, action, and detection details.
+   */
   async syncScan(aiProfile, content, opts = {}) {
     if (opts.trId && opts.trId.length > MAX_TRANSACTION_ID_STR_LENGTH) {
       throw new AISecSDKException(
@@ -241,6 +296,11 @@ var Scanner = class {
     });
     return res.data;
   }
+  /**
+   * Submit content for asynchronous scanning.
+   * @param scanObjects - Array of scan objects (1–5 items).
+   * @returns Response containing scan IDs for later querying.
+   */
   async asyncScan(scanObjects) {
     if (scanObjects.length < 1) {
       throw new AISecSDKException(
@@ -261,6 +321,11 @@ var Scanner = class {
     });
     return res.data;
   }
+  /**
+   * Query scan results by scan IDs.
+   * @param scanIds - Array of scan UUIDs (1–5 items).
+   * @returns Array of scan results with status and response data.
+   */
   async queryByScanIds(scanIds) {
     if (scanIds.length < 1) {
       throw new AISecSDKException(
@@ -286,6 +351,11 @@ var Scanner = class {
     });
     return res.data;
   }
+  /**
+   * Query detailed threat reports by report IDs.
+   * @param reportIds - Array of report IDs (1–5 items).
+   * @returns Array of threat scan reports with detection details.
+   */
   async queryByReportIds(reportIds) {
     if (reportIds.length < 1) {
       throw new AISecSDKException(
@@ -397,6 +467,7 @@ var Content = class _Content {
   set toolEvent(value) {
     this._toolEvent = value;
   }
+  /** Total byte length of all text content fields. */
   get length() {
     let total = 0;
     if (this._prompt) total += Buffer.byteLength(this._prompt);
@@ -406,6 +477,7 @@ var Content = class _Content {
     if (this._codeResponse) total += Buffer.byteLength(this._codeResponse);
     return total;
   }
+  /** Serialize to the API request format. */
   toJSON() {
     const obj = {};
     if (this._prompt !== void 0) obj.prompt = this._prompt;
@@ -416,6 +488,10 @@ var Content = class _Content {
     if (this._toolEvent !== void 0) obj.tool_event = this._toolEvent;
     return obj;
   }
+  /**
+   * Create a Content instance from an API response object.
+   * @param json - Scan request contents inner object.
+   */
   static fromJSON(json) {
     return new _Content({
       prompt: json.prompt,
@@ -426,6 +502,10 @@ var Content = class _Content {
       toolEvent: json.tool_event
     });
   }
+  /**
+   * Load content from a JSON file.
+   * @param filePath - Path to JSON file containing scan request contents.
+   */
   static fromJSONFile(filePath) {
     const raw = readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
@@ -433,6 +513,23 @@ var Content = class _Content {
   }
 };
 
+// src/models/enums.ts
+var Verdict = {
+  BENIGN: "benign",
+  MALICIOUS: "malicious",
+  UNKNOWN: "unknown"
+};
+var Action = {
+  ALLOW: "allow",
+  BLOCK: "block",
+  ALERT: "alert"
+};
+var Category = {
+  BENIGN: "benign",
+  MALICIOUS: "malicious",
+  UNKNOWN: "unknown"
+};
+
 // src/models/ai-profile.ts
 import { z } from "zod";
 var AiProfileSchema = z.object({
@@ -657,21 +754,540 @@ var ErrorResponseSchema = z14.object({
     unit: z14.string().optional()
   }).optional()
 });
+
+// src/models/mgmt-security-profile.ts
+import { z as z15 } from "zod";
+var DlpDataProfileSchema = z15.object({
+  profile_name: z15.string(),
+  active: z15.boolean().optional()
+}).passthrough();
+var DlpSchema = z15.object({
+  dlp_status: z15.string().optional(),
+  data_profiles: z15.array(DlpDataProfileSchema).optional()
+}).passthrough();
+var DataLeakDetectionSchema = z15.object({
+  "data-leak-detection-status": z15.string().optional(),
+  dlp: DlpSchema.optional()
+}).passthrough();
+var AppProtectionSchema = z15.object({
+  "prompt-injection": z15.string().optional(),
+  "jailbreak-detection": z15.string().optional()
+}).passthrough();
+var ModelProtectionSchema = z15.object({
+  "model-denial-of-service": z15.string().optional()
+}).passthrough();
+var AgentProtectionSchema = z15.object({
+  "malicious-agent-activity": z15.string().optional()
+}).passthrough();
+var LatencySchema = z15.object({
+  status: z15.string().optional(),
+  max_latency_ms: z15.number().optional()
+}).passthrough();
+var ModelConfigurationSchema = z15.object({
+  latency: LatencySchema.optional()
+}).passthrough();
+var PolicySchema = z15.object({
+  "data-leak-detection": DataLeakDetectionSchema.optional(),
+  "app-protection": AppProtectionSchema.optional(),
+  "model-protection": ModelProtectionSchema.optional(),
+  "agent-protection": AgentProtectionSchema.optional(),
+  "model-configuration": ModelConfigurationSchema.optional()
+}).passthrough();
+var SecurityProfileSchema = z15.object({
+  profile_id: z15.string().optional(),
+  profile_name: z15.string(),
+  revision: z15.number().optional(),
+  active: z15.boolean().optional(),
+  policy: PolicySchema.optional(),
+  created_by: z15.string().optional(),
+  updated_by: z15.string().optional(),
+  last_modified_ts: z15.string().optional()
+}).passthrough();
+var CreateSecurityProfileRequestSchema = z15.object({
+  profile_id: z15.string().optional(),
+  profile_name: z15.string(),
+  revision: z15.number().optional(),
+  active: z15.boolean().optional(),
+  policy: PolicySchema.optional(),
+  created_by: z15.string().optional(),
+  updated_by: z15.string().optional(),
+  last_modified_ts: z15.string().optional()
+}).passthrough();
+var SecurityProfileListResponseSchema = z15.object({
+  ai_profiles: z15.array(SecurityProfileSchema),
+  next_offset: z15.number().optional()
+}).passthrough();
+var DeleteProfileResponseSchema = z15.object({
+  message: z15.string()
+}).passthrough();
+var DeleteProfileConflictSchema = z15.object({
+  message: z15.string(),
+  payload: z15.array(
+    z15.object({
+      policy_id: z15.string(),
+      policy_name: z15.string(),
+      priority: z15.number()
+    }).passthrough()
+  )
+}).passthrough();
+
+// src/models/mgmt-custom-topic.ts
+import { z as z16 } from "zod";
+var CustomTopicSchema = z16.object({
+  topic_id: z16.string().optional(),
+  topic_name: z16.string(),
+  revision: z16.number().optional(),
+  active: z16.boolean().optional(),
+  description: z16.string().optional(),
+  examples: z16.array(z16.string()).optional(),
+  created_by: z16.string().optional(),
+  updated_by: z16.string().optional(),
+  last_modified_ts: z16.string().optional(),
+  created_ts: z16.string().optional()
+}).passthrough();
+var CreateCustomTopicRequestSchema = z16.object({
+  topic_id: z16.string().optional(),
+  topic_name: z16.string(),
+  revision: z16.number().optional(),
+  active: z16.boolean().optional(),
+  description: z16.string().optional(),
+  examples: z16.array(z16.string()).optional(),
+  created_by: z16.string().optional(),
+  updated_by: z16.string().optional(),
+  last_modified_ts: z16.string().optional(),
+  created_ts: z16.string().optional()
+}).passthrough();
+var CustomTopicListResponseSchema = z16.object({
+  custom_topics: z16.array(CustomTopicSchema),
+  next_offset: z16.number().optional()
+}).passthrough();
+var DeleteTopicResponseSchema = z16.object({
+  message: z16.string()
+}).passthrough();
+var DeleteTopicConflictSchema = z16.object({
+  message: z16.string(),
+  payload: z16.array(
+    z16.object({
+      profile_id: z16.string(),
+      profile_name: z16.string(),
+      revision: z16.number()
+    }).passthrough()
+  )
+}).passthrough();
+
+// src/models/oauth-token.ts
+import { z as z17 } from "zod";
+var OAuthTokenResponseSchema = z17.object({
+  access_token: z17.string(),
+  token_type: z17.string().optional(),
+  expires_in: z17.number(),
+  scope: z17.string().optional()
+});
+
+// src/management/oauth-client.ts
+var TOKEN_BUFFER_MS = 3e4;
+var OAuthClient = class {
+  tokenEndpoint;
+  clientId;
+  clientSecret;
+  tsgId;
+  accessToken = null;
+  expiresAt = 0;
+  pendingFetch = null;
+  constructor(opts) {
+    this.clientId = opts.clientId;
+    this.clientSecret = opts.clientSecret;
+    this.tsgId = opts.tsgId;
+    this.tokenEndpoint = opts.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT;
+  }
+  /**
+   * Get a valid access token, refreshing if needed.
+   * @returns Bearer access token string.
+   */
+  async getToken() {
+    if (this.accessToken && Date.now() < this.expiresAt - TOKEN_BUFFER_MS) {
+      return this.accessToken;
+    }
+    if (this.pendingFetch) {
+      return this.pendingFetch;
+    }
+    this.pendingFetch = this.fetchToken().finally(() => {
+      this.pendingFetch = null;
+    });
+    return this.pendingFetch;
+  }
+  /** Clear the cached token, forcing a fresh fetch on next call. */
+  clearToken() {
+    this.accessToken = null;
+    this.expiresAt = 0;
+  }
+  async fetchToken() {
+    const credentials = btoa(`${this.clientId}:${this.clientSecret}`);
+    const body = new URLSearchParams({
+      grant_type: "client_credentials",
+      scope: `tsg_id:${this.tsgId}`
+    });
+    let response;
+    try {
+      response = await fetch(this.tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Authorization: `Basic ${credentials}`
+        },
+        body: body.toString()
+      });
+    } catch (err) {
+      throw new AISecSDKException(
+        `Token request failed: ${err.message}`,
+        "AISEC_OAUTH_ERROR" /* OAUTH_ERROR */
+      );
+    }
+    if (!response.ok) {
+      let errorMsg;
+      try {
+        const errorBody = await response.json();
+        errorMsg = errorBody.error_description ?? errorBody.error ?? `Token request failed with status ${response.status}`;
+      } catch {
+        errorMsg = `Token request failed with status ${response.status}`;
+      }
+      throw new AISecSDKException(errorMsg, "AISEC_OAUTH_ERROR" /* OAUTH_ERROR */);
+    }
+    const data = OAuthTokenResponseSchema.parse(await response.json());
+    this.accessToken = data.access_token;
+    this.expiresAt = Date.now() + data.expires_in * 1e3;
+    return this.accessToken;
+  }
+};
+
+// src/management/management-http-client.ts
+async function managementHttpRequest(opts) {
+  const { method, baseUrl, path, body, params, oauthClient, numRetries } = opts;
+  let hadTokenRefresh = false;
+  const response = await executeWithRetry({
+    maxRetries: numRetries,
+    execute: async () => {
+      const token = await oauthClient.getToken();
+      const stripped = baseUrl.replace(/\/+$/, "");
+      const url = new URL(`${stripped}${path}`);
+      if (params) {
+        for (const [key, value] of Object.entries(params)) {
+          url.searchParams.set(key, value);
+        }
+      }
+      const headers = {
+        Authorization: `Bearer ${token}`,
+        "User-Agent": USER_AGENT
+      };
+      let bodyStr;
+      if (body !== void 0) {
+        headers["Content-Type"] = "application/json";
+        bodyStr = JSON.stringify(body);
+      }
+      return fetch(url.toString(), { method, headers, body: bodyStr });
+    },
+    onRetryableFailure: async (response2) => {
+      if (response2.status === 401 && !hadTokenRefresh) {
+        hadTokenRefresh = true;
+        oauthClient.clearToken();
+        return true;
+      }
+      return false;
+    }
+  });
+  const text = await response.text();
+  const data = text ? JSON.parse(text) : {};
+  return { status: response.status, data };
+}
+
+// src/management/profiles.ts
+var ProfilesClient = class {
+  baseUrl;
+  oauthClient;
+  tsgId;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.oauthClient = opts.oauthClient;
+    this.tsgId = opts.tsgId;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * Create a new security profile.
+   * @param request - Profile configuration.
+   * @returns The created security profile.
+   */
+  async create(request) {
+    const res = await managementHttpRequest({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: MGMT_PROFILE_PATH,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * List security profiles for the TSG.
+   * @param opts - Pagination options.
+   * @returns Paginated list of security profiles.
+   */
+  async list(opts) {
+    const params = {
+      offset: String(opts?.offset ?? 0),
+      limit: String(opts?.limit ?? 100)
+    };
+    const res = await managementHttpRequest({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILES_TSG_PATH}/${this.tsgId}`,
+      params,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * Update an existing security profile.
+   * @param profileId - UUID of the profile to update.
+   * @param request - Updated profile configuration.
+   * @returns The updated security profile.
+   */
+  async update(profileId, request) {
+    if (!isValidUuid(profileId)) {
+      throw new AISecSDKException(
+        `Invalid profile_id: ${profileId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILE_PATH}/uuid/${profileId}`,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * Delete a security profile.
+   * @param profileId - UUID of the profile to delete.
+   * @returns Deletion confirmation message.
+   */
+  async delete(profileId) {
+    if (!isValidUuid(profileId)) {
+      throw new AISecSDKException(
+        `Invalid profile_id: ${profileId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_PROFILE_PATH}/${profileId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+};
+
+// src/management/topics.ts
+var TopicsClient = class {
+  baseUrl;
+  oauthClient;
+  tsgId;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.oauthClient = opts.oauthClient;
+    this.tsgId = opts.tsgId;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * Create a new custom topic.
+   * @param request - Topic definition with name, description, and examples.
+   * @returns The created custom topic.
+   */
+  async create(request) {
+    const res = await managementHttpRequest({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: MGMT_TOPIC_PATH,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * List custom topics for the TSG.
+   * @param opts - Pagination options.
+   * @returns Paginated list of custom topics.
+   */
+  async list(opts) {
+    const params = {
+      offset: String(opts?.offset ?? 0),
+      limit: String(opts?.limit ?? 100)
+    };
+    const res = await managementHttpRequest({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPICS_TSG_PATH}/${this.tsgId}`,
+      params,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * Update an existing custom topic.
+   * @param topicId - UUID of the topic to update.
+   * @param request - Updated topic definition.
+   * @returns The updated custom topic.
+   */
+  async update(topicId, request) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_PATH}/uuid/${topicId}`,
+      body: request,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * Delete a custom topic. Fails if topic is referenced by a profile.
+   * @param topicId - UUID of the topic to delete.
+   * @returns Deletion confirmation message.
+   */
+  async delete(topicId) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_PATH}/${topicId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+  /**
+   * Force-delete a custom topic, removing it from any referencing profiles.
+   * @param topicId - UUID of the topic to force-delete.
+   * @returns Deletion confirmation message.
+   */
+  async forceDelete(topicId) {
+    if (!isValidUuid(topicId)) {
+      throw new AISecSDKException(
+        `Invalid topic_id: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    const res = await managementHttpRequest({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${MGMT_TOPIC_FORCE_PATH}/${topicId}`,
+      oauthClient: this.oauthClient,
+      numRetries: this.numRetries
+    });
+    return res.data;
+  }
+};
+
+// src/management/client.ts
+var ManagementClient = class {
+  profiles;
+  topics;
+  constructor(opts = {}) {
+    const clientId = opts.clientId ?? process.env[MGMT_CLIENT_ID];
+    const clientSecret = opts.clientSecret ?? process.env[MGMT_CLIENT_SECRET];
+    const tsgId = opts.tsgId ?? process.env[MGMT_TSG_ID];
+    const apiEndpoint = opts.apiEndpoint ?? process.env[MGMT_ENDPOINT] ?? DEFAULT_MGMT_ENDPOINT;
+    const tokenEndpoint = opts.tokenEndpoint ?? process.env[MGMT_TOKEN_ENDPOINT];
+    const numRetries = Math.min(
+      Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
+      MAX_NUMBER_OF_RETRIES
+    );
+    if (!clientId) {
+      throw new AISecSDKException(
+        "clientId is required (option or PANW_MGMT_CLIENT_ID env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    if (!clientSecret) {
+      throw new AISecSDKException(
+        "clientSecret is required (option or PANW_MGMT_CLIENT_SECRET env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    if (!tsgId) {
+      throw new AISecSDKException(
+        "tsgId is required (option or PANW_MGMT_TSG_ID env var)",
+        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+      );
+    }
+    const oauthClient = new OAuthClient({
+      clientId,
+      clientSecret,
+      tsgId,
+      tokenEndpoint
+    });
+    this.profiles = new ProfilesClient({
+      baseUrl: apiEndpoint,
+      oauthClient,
+      tsgId,
+      numRetries
+    });
+    this.topics = new TopicsClient({
+      baseUrl: apiEndpoint,
+      oauthClient,
+      tsgId,
+      numRetries
+    });
+  }
+};
 export {
   AISecSDKException,
   AI_SEC_API_ENDPOINT,
   AI_SEC_API_KEY,
   AI_SEC_API_TOKEN,
   ASYNC_SCAN_PATH,
+  Action,
   AgentMetaSchema,
   AiProfileSchema,
   AsyncScanObjectSchema,
   AsyncScanResponseSchema,
   BEARER,
+  Category,
   Content,
+  CreateCustomTopicRequestSchema,
+  CreateSecurityProfileRequestSchema,
+  CustomTopicListResponseSchema,
+  CustomTopicSchema,
   DEFAULT_ENDPOINT,
+  DEFAULT_MGMT_ENDPOINT,
+  DEFAULT_TOKEN_ENDPOINT,
   DSDetailResultSchema,
   DSResultMetadataSchema,
+  DeleteProfileConflictSchema,
+  DeleteProfileResponseSchema,
+  DeleteTopicConflictSchema,
+  DeleteTopicResponseSchema,
   DetectionServiceResultSchema,
   DlpReportSchema,
   ErrorResponseSchema,
@@ -695,9 +1311,22 @@ export {
   MAX_SESSION_ID_STR_LENGTH,
   MAX_TOKEN_LENGTH,
   MAX_TRANSACTION_ID_STR_LENGTH,
+  MGMT_CLIENT_ID,
+  MGMT_CLIENT_SECRET,
+  MGMT_ENDPOINT,
+  MGMT_PROFILES_TSG_PATH,
+  MGMT_PROFILE_PATH,
+  MGMT_TOKEN_ENDPOINT,
+  MGMT_TOPICS_TSG_PATH,
+  MGMT_TOPIC_FORCE_PATH,
+  MGMT_TOPIC_PATH,
+  MGMT_TSG_ID,
+  ManagementClient,
   MaskedDataSchema,
   MetadataSchema,
   PAYLOAD_HASH,
+  PolicySchema,
+  ProfilesClient,
   PromptDetectedSchema,
   PromptDetectionDetailsSchema,
   ResponseDetectedSchema,
@@ -712,12 +1341,16 @@ export {
   ScanResponseSchema,
   ScanSummarySchema,
   Scanner,
+  SecurityProfileListResponseSchema,
+  SecurityProfileSchema,
   ThreatScanReportSchema,
   ToolDetectedSchema,
   ToolEventMetadataSchema,
   ToolEventSchema,
+  TopicsClient,
   USER_AGENT,
   UrlfEntrySchema,
+  Verdict,
   globalConfiguration,
   init
 };