@cdot65/prisma-airs-sdk 0.12.0 → 0.13.0

package/dist/index.js

@@ -29,7 +29,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.12.0";
+var SDK_VERSION = "0.13.0";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -75,17 +75,21 @@ var MODEL_SEC_TOKEN_ENDPOINT = "PANW_MODEL_SEC_TOKEN_ENDPOINT";
 var MODEL_SEC_SCANS_PATH = "/v1/scans";
 var MODEL_SEC_EVALUATIONS_PATH = "/v1/evaluations";
 var MODEL_SEC_VIOLATIONS_PATH = "/v1/violations";
+var MODEL_SEC_MODELS_PATH = "/v1/models";
+var MODEL_SEC_MODEL_VERSIONS_PATH = "/v1/model-versions";
 var MODEL_SEC_SECURITY_GROUPS_PATH = "/v1/security-groups";
 var MODEL_SEC_SECURITY_RULES_PATH = "/v1/security-rules";
 var MODEL_SEC_PYPI_AUTH_PATH = "/v1/pypi/authenticate";
 var DEFAULT_RED_TEAM_DATA_ENDPOINT = "https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane";
 var DEFAULT_RED_TEAM_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/ai-red-teaming/mgmt-plane";
+var DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT = "https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane/network-broker";
 var RED_TEAM_CLIENT_ID = "PANW_RED_TEAM_CLIENT_ID";
 var RED_TEAM_CLIENT_SECRET = "PANW_RED_TEAM_CLIENT_SECRET";
 var RED_TEAM_TSG_ID = "PANW_RED_TEAM_TSG_ID";
 var RED_TEAM_DATA_ENDPOINT = "PANW_RED_TEAM_DATA_ENDPOINT";
 var RED_TEAM_MGMT_ENDPOINT = "PANW_RED_TEAM_MGMT_ENDPOINT";
 var RED_TEAM_TOKEN_ENDPOINT = "PANW_RED_TEAM_TOKEN_ENDPOINT";
+var RED_TEAM_NETWORK_BROKER_ENDPOINT = "PANW_RED_TEAM_NETWORK_BROKER_ENDPOINT";
 var RED_TEAM_SCAN_PATH = "/v1/scan";
 var RED_TEAM_CATEGORIES_PATH = "/v1/categories";
 var RED_TEAM_REPORT_STATIC_PATH = "/v1/report/static";
@@ -96,6 +100,8 @@ var RED_TEAM_DASHBOARD_PATH = "/v1/dashboard";
 var RED_TEAM_QUOTA_PATH = "/v1/metering/quota";
 var RED_TEAM_ERROR_LOG_PATH = "/v1/error-log/job";
 var RED_TEAM_SENTIMENT_PATH = "/v1/sentiment";
+var RED_TEAM_LANGUAGES_PATH = "/v1/languages";
+var RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH = "/v1/error-log/target-profile";
 var RED_TEAM_TARGET_PATH = "/v1/target";
 var RED_TEAM_TARGET_VALIDATE_AUTH_PATH = "/v1/target/validate-auth";
 var RED_TEAM_TEMPLATE_PATH = "/v1/template";
@@ -104,6 +110,8 @@ var RED_TEAM_INSTANCES_PATH = "/v1/instances";
 var RED_TEAM_REGISTRY_CREDENTIALS_PATH = "/v1/registry-credentials";
 var RED_TEAM_CUSTOM_ATTACK_PATH = "/v1/custom-attack";
 var RED_TEAM_MGMT_DASHBOARD_PATH = "/v1/dashboard/overview";
+var RED_TEAM_CHANNELS_PATH = "/v1/channels";
+var RED_TEAM_CHANNELS_STATS_PATH = "/v1/channels/stats";
 
 // src/errors.ts
 var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
@@ -308,9 +316,38 @@ async function executeWithRetry(opts) {
   );
 }
 
+// src/http/debug.ts
+import { createHash } from "crypto";
+var TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+var SENSITIVE_HEADERS = /* @__PURE__ */ new Set([HEADER_AUTH_TOKEN.toLowerCase(), HEADER_API_KEY.toLowerCase()]);
+var PREFIX = "[airs-sdk]";
+function isDebugEnabled() {
+  const raw = process.env.PANW_AI_SEC_DEBUG;
+  return raw !== void 0 && TRUTHY.has(raw.trim().toLowerCase());
+}
+function hashToken(value) {
+  return "sha256:" + createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+function sanitizeHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? hashToken(value) : value;
+  }
+  return out;
+}
+function logRequest(method, url, headers, body) {
+  console.error(`${PREFIX} \u2192 ${method} ${url}`);
+  console.error(`${PREFIX}   headers ${JSON.stringify(sanitizeHeaders(headers))}`);
+  if (body !== void 0) console.error(`${PREFIX}   body ${body}`);
+}
+function logResponse(status, ms, body) {
+  console.error(`${PREFIX} \u2190 ${status} (${ms}ms)${body !== void 0 ? ` ${body}` : ""}`);
+}
+
 // src/http/request.ts
 async function request(spec) {
   let hasRetriedAuth = false;
+  const debug = isDebugEnabled();
   const response = await executeWithRetry({
     maxRetries: spec.numRetries,
     execute: async () => {
@@ -340,11 +377,25 @@ async function request(spec) {
       }
       const prepared = { method: spec.method, url, headers, bodyText };
       const final = await spec.auth.prepare(prepared);
-      return fetch(final.url.toString(), {
+      const startedAt = debug ? Date.now() : 0;
+      if (debug) {
+        const logBody = spec.formData !== void 0 ? "[multipart/form-data]" : final.bodyText;
+        logRequest(final.method, final.url.toString(), final.headers, logBody);
+      }
+      const res = await fetch(final.url.toString(), {
         method: final.method,
         headers: final.headers,
         body: spec.formData !== void 0 ? bodyForFetch : final.bodyText
       });
+      if (debug) {
+        let respBody;
+        try {
+          respBody = await res.clone().text();
+        } catch {
+        }
+        logResponse(res.status, Date.now() - startedAt, respBody);
+      }
+      return res;
     },
     onRetryableFailure: async (res) => {
       if (hasRetriedAuth) return false;
@@ -2306,7 +2357,8 @@ var ScanDetailsSchema = z32.object({
 var ScanCreateRequestSchema = z32.object({
   model_uri: z32.string(),
   security_group_uuid: z32.string(),
-  scan_origin: z32.string(),
+  // Optional per the OpenAPI spec (server defaults it); the scans-client example still sets it.
+  scan_origin: z32.string().optional(),
   allow_patterns: z32.array(z32.string()).nullable().optional(),
   ignore_patterns: z32.array(z32.string()).nullable().optional(),
   labels: z32.array(LabelSchema).nullable().optional(),
@@ -2325,7 +2377,8 @@ var ScanBaseResponseSchema = z32.object({
   scan_origin: z32.string(),
   security_group_uuid: z32.string(),
   security_group_name: z32.string(),
-  model_version_uuid: z32.string(),
+  // Optional per the OpenAPI spec — a scan may not have a resolved model version yet.
+  model_version_uuid: z32.string().nullable().optional(),
   eval_outcome: z32.string(),
   source_type: z32.string(),
   created_by: z32.string().nullable().optional(),
@@ -2362,6 +2415,50 @@ var FileListSchema = z32.object({
   pagination: ModelSecurityPaginationSchema,
   files: z32.array(FileResponseSchema)
 }).passthrough();
+var ModelResponseSchema = z32.object({
+  uuid: z32.string(),
+  tsg_id: z32.string(),
+  created_at: z32.string(),
+  updated_at: z32.string(),
+  name: z32.string(),
+  latest_version_uuid: z32.string().nullable().optional(),
+  latest_version_fingerprint: z32.string().nullable().optional(),
+  latest_version_revision: z32.string().nullable().optional(),
+  latest_version_hf_commit_sha: z32.string().nullable().optional(),
+  latest_version_outcome: z32.string().nullable().optional(),
+  latest_version_formats: z32.array(z32.string()).nullable().optional(),
+  latest_version_source_types: z32.array(z32.string()).nullable().optional(),
+  latest_version_scan_time: z32.string().nullable().optional()
+}).passthrough();
+var ModelListSchema = z32.object({
+  pagination: ModelSecurityPaginationSchema,
+  models: z32.array(ModelResponseSchema)
+}).passthrough();
+var ModelVersionResponseSchema = z32.object({
+  uuid: z32.string(),
+  tsg_id: z32.string(),
+  created_at: z32.string(),
+  updated_at: z32.string(),
+  revision: z32.string(),
+  model_uuid: z32.string(),
+  fingerprint: z32.string().nullable().optional(),
+  file_count: z32.number().int().nullable().optional(),
+  license: z32.string().nullable().optional(),
+  latest_scan_time: z32.string().nullable().optional(),
+  hf_commit_sha: z32.string().nullable().optional(),
+  hf_commit_title: z32.string().nullable().optional(),
+  hf_commit_authors: z32.array(z32.string()).nullable().optional(),
+  hf_model_name: z32.string().nullable().optional(),
+  hf_organization: z32.string().nullable().optional(),
+  model_formats: z32.array(z32.string()).nullable().optional(),
+  source_types: z32.array(z32.string()).nullable().optional(),
+  last_eval_outcome: z32.string().nullable().optional(),
+  last_eval_summary: EvalSummarySchema.nullable().optional()
+}).passthrough();
+var ModelVersionListSchema = z32.object({
+  pagination: ModelSecurityPaginationSchema,
+  model_versions: z32.array(ModelVersionResponseSchema)
+}).passthrough();
 var RuleEvaluationResponseSchema = z32.object({
   uuid: z32.string(),
   tsg_id: z32.string(),
@@ -2379,6 +2476,10 @@ var RuleEvaluationListSchema = z32.object({
   pagination: ModelSecurityPaginationSchema,
   evaluations: z32.array(RuleEvaluationResponseSchema)
 }).passthrough();
+var ViolationRemediationSchema = z32.object({
+  steps: z32.array(z32.string()),
+  url: z32.string()
+}).passthrough();
 var ViolationResponseSchema = z32.object({
   uuid: z32.string(),
   tsg_id: z32.string(),
@@ -2389,6 +2490,7 @@ var ViolationResponseSchema = z32.object({
   rule_name: z32.string(),
   rule_description: z32.string(),
   rule_instance_state: z32.string(),
+  remediation: ViolationRemediationSchema,
   file: z32.string().nullable().optional(),
   hash: z32.string().nullable().optional(),
   module: z32.string().nullable().optional(),
@@ -2524,6 +2626,11 @@ var BrandSubCategory = {
   DISCRIMINATING_CLAIMS: "DISCRIMINATING_CLAIMS",
   POLITICAL_ENDORSEMENTS: "POLITICAL_ENDORSEMENTS"
 };
+var ChannelStatus = {
+  ONLINE: "ONLINE",
+  OFFLINE: "OFFLINE",
+  DRAFT: "DRAFT"
+};
 var ComplianceSubCategory = {
   OWASP: "OWASP",
   MITRE_ATLAS: "MITRE_ATLAS",
@@ -3347,6 +3454,12 @@ var ErrorLogSchema = z33.object({
   version: z33.number().int().optional()
 }).passthrough();
 var ErrorLogListResponseSchema = z33.object({ pagination: RedTeamPaginationSchema, data: z33.array(ErrorLogSchema) }).passthrough();
+var LanguageOptionSchema = z33.object({ code: z33.string(), name: z33.string() }).passthrough();
+var TenantLanguagesResponseSchema = z33.object({
+  multilingual_enabled: z33.boolean(),
+  supported_job_types: z33.array(z33.string()),
+  languages: z33.array(LanguageOptionSchema)
+}).passthrough();
 var TargetRequestBaseFields = {
   name: z33.string(),
   description: z33.string().nullable().optional(),
@@ -3701,6 +3814,48 @@ var RegistryCredentialsSchema = z33.object({
   expiry: z33.string()
 }).passthrough();
 
+// src/models/red-team-network-broker.ts
+import { z as z34 } from "zod";
+var ChannelStatusSchema = z34.nativeEnum(ChannelStatus);
+var CreateChannelRequestSchema = z34.object({
+  name: z34.string(),
+  description: z34.string().optional()
+}).passthrough();
+var UpdateChannelRequestSchema = z34.object({
+  name: z34.string().optional(),
+  description: z34.string().optional()
+}).passthrough();
+var ChannelSchema = z34.object({
+  uuid: z34.string().optional(),
+  name: z34.string().nullable().optional(),
+  description: z34.string().nullable().optional(),
+  // Kept as a plain string (not the enum) so unknown upstream statuses never fail parsing.
+  status: z34.string().nullable().optional(),
+  added_by: z34.string().nullable().optional(),
+  created_at: z34.string().nullable().optional(),
+  updated_at: z34.string().nullable().optional(),
+  last_online_at: z34.string().nullable().optional(),
+  // Present on live responses (not in the base OpenAPI Channel schema).
+  connected_clients_count: z34.number().int().nullable().optional(),
+  outdated_clients_count: z34.number().int().nullable().optional(),
+  features: z34.record(z34.boolean()).nullable().optional()
+}).passthrough();
+var ChannelListPaginationSchema = z34.object({ total_items: z34.number().int().nullable().optional() }).passthrough();
+var ChannelListResponseSchema = z34.object({
+  pagination: ChannelListPaginationSchema.optional(),
+  data: z34.array(ChannelSchema).default([])
+}).passthrough();
+var ChannelStatsSchema = z34.object({
+  network_channels_server_domain: z34.string().nullable().optional(),
+  docker_registry: z34.string().nullable().optional(),
+  helm_chart: z34.string().nullable().optional(),
+  docker_image: z34.string().nullable().optional(),
+  online_channels: z34.number().int().nullable().optional(),
+  total_channels: z34.number().int().nullable().optional(),
+  // Present on live responses (not in the base OpenAPI ChannelStats schema).
+  client_version: z34.string().nullable().optional()
+}).passthrough();
+
 // src/http/auth/oauth.ts
 var OAuthAuth = class {
   constructor(oauthClient) {
@@ -3723,12 +3878,12 @@ var OAuthAuth = class {
 };
 
 // src/models/oauth-token.ts
-import { z as z34 } from "zod";
-var OAuthTokenResponseSchema = z34.object({
-  access_token: z34.string(),
-  token_type: z34.string().optional(),
-  expires_in: z34.number(),
-  scope: z34.string().optional()
+import { z as z35 } from "zod";
+var OAuthTokenResponseSchema = z35.object({
+  access_token: z35.string(),
+  token_type: z35.string().optional(),
+  expires_in: z35.number(),
+  scope: z35.string().optional()
 }).passthrough();
 
 // src/management/oauth-client.ts
@@ -4519,7 +4674,7 @@ var CustomerAppsClient = class {
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MGMT_CUSTOMER_APPS_TSG_PATH}/${this.tsgId}`,
+      path: `${MGMT_CUSTOMER_APPS_TSG_PATH}/${encodeURIComponent(this.tsgId)}`,
       params,
       responseSchema: CustomerAppListResponseSchema,
       auth: this.auth,
@@ -4713,7 +4868,7 @@ var ScanLogsClient = class {
 };
 
 // src/management/oauth-management.ts
-import { z as z35 } from "zod";
+import { z as z36 } from "zod";
 var OAuthManagementClient = class {
   baseUrl;
   auth;
@@ -4747,7 +4902,7 @@ var OAuthManagementClient = class {
       path: MGMT_OAUTH_INVALIDATE_PATH,
       params: { token },
       body,
-      responseSchema: z35.string(),
+      responseSchema: z36.string(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6375,6 +6530,170 @@ var ModelSecurityRulesClient = class {
   }
 };
 
+// src/model-security/models-client.ts
+function buildModelListParams(opts) {
+  const params = serializeListing(opts);
+  if (opts?.search_query !== void 0) params.search_query = opts.search_query;
+  if (opts?.sort_field !== void 0) params.sort_field = opts.sort_field;
+  if (opts?.sort_order !== void 0) params.sort_order = opts.sort_order;
+  if (opts?.latest_version_outcomes !== void 0)
+    params.latest_version_outcomes = opts.latest_version_outcomes;
+  if (opts?.latest_version_formats !== void 0)
+    params.latest_version_formats = opts.latest_version_formats;
+  if (opts?.latest_version_source_types !== void 0)
+    params.latest_version_source_types = opts.latest_version_source_types;
+  if (opts?.latest_version_scan_time_before !== void 0)
+    params.latest_version_scan_time_before = opts.latest_version_scan_time_before;
+  if (opts?.start_time !== void 0) params.start_time = opts.start_time;
+  if (opts?.end_time !== void 0) params.end_time = opts.end_time;
+  return params;
+}
+var ModelSecurityModelsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List models with optional search, sort, and latest-version filters.
+   * @param opts - Pagination and filter options.
+   * @returns Paginated list of models.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const models = await ms.models.listModels({ limit: 10, search_query: 'llama' });
+   * // models =>
+   * // { pagination: { total_items: 3 }, models: [{ uuid: '550e8400-...', name: 'org/llama', latest_version_outcome: 'PASSED' }] }
+   * ```
+   */
+  async listModels(opts) {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: MODEL_SEC_MODELS_PATH,
+      params: buildModelListParams(opts),
+      responseSchema: ModelListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a single model by UUID.
+   * @param uuid - Model UUID.
+   * @returns The model.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const model = await ms.models.getModel('550e8400-e29b-41d4-a716-446655440000');
+   * // model =>
+   * // { uuid: '550e8400-...', name: 'org/model', latest_version_uuid: '660e8400-...', latest_version_outcome: 'PASSED' }
+   * ```
+   */
+  async getModel(uuid) {
+    assertUuid(uuid, "model uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODELS_PATH}/${uuid}`,
+      responseSchema: ModelResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List the versions of a model.
+   * @param modelUuid - Model UUID.
+   * @param opts - Pagination and sort options.
+   * @returns Paginated list of model versions.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const versions = await ms.models.listModelVersions('550e8400-e29b-41d4-a716-446655440000', {
+   *   sort_order: 'desc',
+   * });
+   * // versions =>
+   * // { pagination: { total_items: 2 }, model_versions: [{ uuid: '660e8400-...', revision: 'main', file_count: 12 }] }
+   * ```
+   */
+  async listModelVersions(modelUuid, opts) {
+    assertUuid(modelUuid, "model uuid");
+    const params = serializeListing(opts);
+    if (opts?.sort_order !== void 0) params.sort_order = opts.sort_order;
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODELS_PATH}/${modelUuid}/model-versions`,
+      params,
+      responseSchema: ModelVersionListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a single model version by UUID.
+   * @param uuid - Model version UUID.
+   * @returns The model version.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const version = await ms.models.getModelVersion('660e8400-e29b-41d4-a716-446655440000');
+   * // version =>
+   * // { uuid: '660e8400-...', revision: 'main', model_uuid: '550e8400-...', last_eval_outcome: 'PASSED' }
+   * ```
+   */
+  async getModelVersion(uuid) {
+    assertUuid(uuid, "model version uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${uuid}`,
+      responseSchema: ModelVersionResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List the files of a model version.
+   * @param modelVersionUuid - Model version UUID.
+   * @param opts - Pagination options.
+   * @returns Paginated list of files (same shape as scan files).
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const files = await ms.models.listModelVersionFiles('660e8400-e29b-41d4-a716-446655440000', {
+   *   limit: 50,
+   * });
+   * // files =>
+   * // { pagination: { total_items: 12 }, files: [{ uuid: '770e8400-...', path: '/model.safetensors', type: 'FILE', result: 'SUCCESS' }] }
+   * ```
+   */
+  async listModelVersionFiles(modelVersionUuid, opts) {
+    assertUuid(modelVersionUuid, "model version uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${modelVersionUuid}/files`,
+      params: serializeListing(opts),
+      responseSchema: FileListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
 // src/model-security/client.ts
 var ModelSecurityClient = class {
   /** Data plane scan operations. */
@@ -6383,6 +6702,8 @@ var ModelSecurityClient = class {
   securityGroups;
   /** Management plane security rule operations (read-only). */
   securityRules;
+  /** Data plane model and model-version operations (read-only). */
+  models;
   mgmtEndpoint;
   auth;
   numRetries;
@@ -6404,6 +6725,7 @@ var ModelSecurityClient = class {
     this.mgmtEndpoint = mgmtEndpoint;
     this.numRetries = numRetries;
     this.scans = new ModelSecurityScansClient({ baseUrl: dataEndpoint, auth, numRetries });
+    this.models = new ModelSecurityModelsClient({ baseUrl: dataEndpoint, auth, numRetries });
     this.securityGroups = new ModelSecurityGroupsClient({
       baseUrl: mgmtEndpoint,
       auth,
@@ -6441,7 +6763,7 @@ var ModelSecurityClient = class {
 };
 
 // src/red-team/scans-client.ts
-import { z as z36 } from "zod";
+import { z as z37 } from "zod";
 var RedTeamScansClient = class {
   baseUrl;
   auth;
@@ -6578,7 +6900,7 @@ var RedTeamScansClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: RED_TEAM_CATEGORIES_PATH,
-      responseSchema: z36.array(CategoryModelSchema),
+      responseSchema: z37.array(CategoryModelSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6586,7 +6908,7 @@ var RedTeamScansClient = class {
 };
 
 // src/red-team/reports-client.ts
-import { z as z37 } from "zod";
+import { z as z38 } from "zod";
 var RedTeamReportsClient = class {
   baseUrl;
   auth;
@@ -6961,7 +7283,7 @@ var RedTeamReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/download`,
       params: { file_format: format },
-      responseSchema: z37.unknown(),
+      responseSchema: z38.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6985,7 +7307,7 @@ var RedTeamReportsClient = class {
       method: "POST",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/generate-partial-report`,
-      responseSchema: z37.unknown(),
+      responseSchema: z38.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6993,7 +7315,7 @@ var RedTeamReportsClient = class {
 };
 
 // src/red-team/custom-attack-reports-client.ts
-import { z as z38 } from "zod";
+import { z as z39 } from "zod";
 var RedTeamCustomAttackReportsClient = class {
   baseUrl;
   auth;
@@ -7083,7 +7405,7 @@ var RedTeamCustomAttackReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/report/${jobId}/prompt-set/${promptSetId}/prompts`,
       params,
-      responseSchema: z38.array(PromptDetailResponseSchema),
+      responseSchema: z39.array(PromptDetailResponseSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7177,7 +7499,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/attack/${attackId}/list-outputs`,
-      responseSchema: z38.array(CustomAttackOutputSchema),
+      responseSchema: z39.array(CustomAttackOutputSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7202,7 +7524,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/property-stats`,
-      responseSchema: z38.array(PropertyStatisticSchema),
+      responseSchema: z39.array(PropertyStatisticSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7210,7 +7532,7 @@ var RedTeamCustomAttackReportsClient = class {
 };
 
 // src/red-team/targets-client.ts
-import { z as z39 } from "zod";
+import { z as z40 } from "zod";
 var RedTeamTargetsClient = class {
   baseUrl;
   auth;
@@ -7503,7 +7825,7 @@ var RedTeamTargetsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_TEMPLATE_PATH}/target-metadata`,
-      responseSchema: z39.record(z39.unknown()),
+      responseSchema: z40.record(z40.unknown()),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8452,6 +8774,155 @@ var RedTeamInstancesClient = class {
   }
 };
 
+// src/red-team/network-broker-client.ts
+var RedTeamNetworkBrokerClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List network broker channels with optional filters.
+   * @param opts - Optional pagination, search, and status filter options.
+   * @returns The paginated list of channels.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channels = await rt.networkBroker.listChannels({ status: ['ONLINE', 'DRAFT'], limit: 10 });
+   * // channels =>
+   * // { pagination: { total_items: 2 }, data: [{ uuid: '550e8400-...', name: 'prod-broker', status: 'ONLINE' }] }
+   * ```
+   */
+  async listChannels(opts) {
+    const params = serializeListing(opts);
+    if (opts?.status !== void 0) {
+      params.status = Array.isArray(opts.status) ? opts.status : [opts.status];
+    }
+    if (opts?.include_all_if_empty !== void 0) {
+      params.include_all_if_empty = String(opts.include_all_if_empty);
+    }
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_CHANNELS_PATH,
+      params,
+      responseSchema: ChannelListResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Create a network broker channel.
+   * @param body - Channel creation request body (requires `name`).
+   * @returns The created channel.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channel = await rt.networkBroker.createChannel({
+   *   name: 'prod-broker',
+   *   description: 'Production network broker channel',
+   * });
+   * // channel =>
+   * // { uuid: '550e8400-...', name: 'prod-broker', status: 'DRAFT' }
+   * ```
+   */
+  async createChannel(body) {
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_CHANNELS_PATH,
+      body,
+      responseSchema: ChannelSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get network broker channel stats.
+   * @returns The channel stats (broker server, registry, chart, image, channel counts).
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const stats = await rt.networkBroker.getChannelStats();
+   * // stats =>
+   * // { network_channels_server_domain: 'broker.example.com', online_channels: 3, total_channels: 5, client_version: '1.4.0' }
+   * ```
+   */
+  async getChannelStats() {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_CHANNELS_STATS_PATH,
+      responseSchema: ChannelStatsSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a network broker channel by UUID.
+   * @param channelId - The channel UUID.
+   * @returns The channel.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channel = await rt.networkBroker.getChannel('550e8400-e29b-41d4-a716-446655440000');
+   * // channel =>
+   * // { uuid: '550e8400-...', name: 'prod-broker', status: 'ONLINE' }
+   * ```
+   */
+  async getChannel(channelId) {
+    assertUuid(channelId, "channel id");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_CHANNELS_PATH}/${channelId}`,
+      responseSchema: ChannelSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update a network broker channel's name or description.
+   * @param channelId - The channel UUID.
+   * @param body - Channel update request body.
+   * @returns The updated channel.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channel = await rt.networkBroker.updateChannel('550e8400-e29b-41d4-a716-446655440000', {
+   *   description: 'Updated description',
+   * });
+   * // channel =>
+   * // { uuid: '550e8400-...', name: 'prod-broker', description: 'Updated description', status: 'ONLINE' }
+   * ```
+   */
+  async updateChannel(channelId, body) {
+    assertUuid(channelId, "channel id");
+    return request({
+      method: "PATCH",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_CHANNELS_PATH}/${channelId}`,
+      body,
+      responseSchema: ChannelSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
 // src/red-team/client.ts
 var RedTeamClient = class {
   /** Data plane scan operations. */
@@ -8468,6 +8939,8 @@ var RedTeamClient = class {
   eula;
   /** Management plane instance/licensing operations. */
   instances;
+  /** Network broker channel operations (distinct network broker base URL). */
+  networkBroker;
   dataEndpoint;
   mgmtEndpoint;
   auth;
@@ -8475,6 +8948,7 @@ var RedTeamClient = class {
   constructor(opts = {}) {
     const dataEndpoint = opts.dataEndpoint ?? process.env[RED_TEAM_DATA_ENDPOINT] ?? DEFAULT_RED_TEAM_DATA_ENDPOINT;
     const mgmtEndpoint = opts.mgmtEndpoint ?? process.env[RED_TEAM_MGMT_ENDPOINT] ?? DEFAULT_RED_TEAM_MGMT_ENDPOINT;
+    const networkBrokerEndpoint = opts.networkBrokerEndpoint ?? process.env[RED_TEAM_NETWORK_BROKER_ENDPOINT] ?? DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT;
     const { oauthClient, numRetries } = resolveOAuthConfig({
       clientId: opts.clientId,
       clientSecret: opts.clientSecret,
@@ -8505,6 +8979,11 @@ var RedTeamClient = class {
     });
     this.eula = new RedTeamEulaClient({ baseUrl: mgmtEndpoint, auth, numRetries });
     this.instances = new RedTeamInstancesClient({ baseUrl: mgmtEndpoint, auth, numRetries });
+    this.networkBroker = new RedTeamNetworkBrokerClient({
+      baseUrl: networkBrokerEndpoint,
+      auth,
+      numRetries
+    });
   }
   // -----------------------------------------------------------------------
   // Data plane convenience methods
@@ -8613,6 +9092,82 @@ var RedTeamClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * List profiling error logs for a target (data plane).
+   * @param targetId - The target UUID.
+   * @param opts - Optional pagination/search options (the endpoint honors `limit`).
+   * @returns The paginated list of target-profile error logs.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const logs = await rt.getTargetProfileErrorLogs('550e8400-e29b-41d4-a716-446655440000', { limit: 10 });
+   * // logs =>
+   * // { pagination: { total_items: 1 }, data: [{ target_id: '550e8400-...', error_type: 'PROBE', error_message: '...', created_at: '2025-01-01T00:00:00Z' }] }
+   * ```
+   */
+  async getTargetProfileErrorLogs(targetId, opts) {
+    assertUuid(targetId, "target id");
+    return request({
+      method: "GET",
+      baseUrl: this.dataEndpoint,
+      path: `${RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH}/${targetId}`,
+      params: serializeListing(opts),
+      responseSchema: ErrorLogListResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get the tenant's allowed languages for Red Team scans (data plane).
+   * @returns The supported-languages response.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const langs = await rt.getLanguages();
+   * // langs =>
+   * // { multilingual_enabled: true, supported_job_types: ['STATIC', 'DYNAMIC'],
+   * //   languages: [{ code: 'en', name: 'English' }, { code: 'es', name: 'Spanish' }] }
+   * ```
+   */
+  async getLanguages() {
+    return request({
+      method: "GET",
+      baseUrl: this.dataEndpoint,
+      path: RED_TEAM_LANGUAGES_PATH,
+      responseSchema: TenantLanguagesResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get the tenant's allowed languages from the management plane.
+   * Same response shape as {@link RedTeamClient.getLanguages}, served from the management endpoint.
+   * @returns The supported-languages response.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const langs = await rt.getManagementLanguages();
+   * // langs =>
+   * // { multilingual_enabled: true, supported_job_types: ['STATIC', 'DYNAMIC'],
+   * //   languages: [{ code: 'en', name: 'English' }] }
+   * ```
+   */
+  async getManagementLanguages() {
+    return request({
+      method: "GET",
+      baseUrl: this.mgmtEndpoint,
+      path: RED_TEAM_LANGUAGES_PATH,
+      responseSchema: TenantLanguagesResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Update sentiment for a scan report.
    * @param body - The sentiment request body.
@@ -8740,6 +9295,12 @@ export {
   CategoryModelSchema,
   CategoryReportSchema,
   CgReportSchema,
+  ChannelListPaginationSchema,
+  ChannelListResponseSchema,
+  ChannelSchema,
+  ChannelStatsSchema,
+  ChannelStatus,
+  ChannelStatusSchema,
   ClientIdAndCustomerAppSchema,
   CmdEntrySchema,
   CmdInjectReportSchema,
@@ -8753,6 +9314,7 @@ export {
   ContentErrorType,
   CountByNameSchema,
   CountedQuotaEnum,
+  CreateChannelRequestSchema,
   CreateCustomTopicRequestSchema,
   CreateSecurityProfileRequestSchema,
   CustomAttackOutputSchema,
@@ -8787,6 +9349,7 @@ export {
   DEFAULT_MODEL_SEC_MGMT_ENDPOINT,
   DEFAULT_RED_TEAM_DATA_ENDPOINT,
   DEFAULT_RED_TEAM_MGMT_ENDPOINT,
+  DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT,
   DEFAULT_TOKEN_ENDPOINT,
   DLP_DATA_FILTERING_PROFILES_PATH,
   DLP_DATA_PATTERNS_PATH,
@@ -8928,6 +9491,7 @@ export {
   LabelValueListSchema,
   LabelsCreateRequestSchema,
   LabelsResponseSchema,
+  LanguageOptionSchema,
   ListModelSecurityGroupsResponseSchema,
   ListModelSecurityRuleInstancesResponseSchema,
   ListModelSecurityRulesResponseSchema,
@@ -8973,6 +9537,8 @@ export {
   MODEL_SEC_DATA_ENDPOINT,
   MODEL_SEC_EVALUATIONS_PATH,
   MODEL_SEC_MGMT_ENDPOINT,
+  MODEL_SEC_MODELS_PATH,
+  MODEL_SEC_MODEL_VERSIONS_PATH,
   MODEL_SEC_PYPI_AUTH_PATH,
   MODEL_SEC_SCANS_PATH,
   MODEL_SEC_SECURITY_GROUPS_PATH,
@@ -8989,7 +9555,9 @@ export {
   MetadataCriterionSchema,
   MetadataSchema,
   ModelConfigurationSchema,
+  ModelListSchema,
   ModelProtectionItemSchema,
+  ModelResponseSchema,
   ModelScanIssueSchema,
   ModelScanStatus,
   ModelSecurityClient,
@@ -8998,12 +9566,15 @@ export {
   ModelSecurityGroupState,
   ModelSecurityGroupUpdateRequestSchema,
   ModelSecurityGroupsClient,
+  ModelSecurityModelsClient,
   ModelSecurityPaginationSchema,
   ModelSecurityRuleInstanceResponseSchema,
   ModelSecurityRuleInstanceUpdateRequestSchema,
   ModelSecurityRuleResponseSchema,
   ModelSecurityRulesClient,
   ModelSecurityScansClient,
+  ModelVersionListSchema,
+  ModelVersionResponseSchema,
   MultiProfileDataNodeSchema,
   MultiProfileDetectionRuleSchema,
   MultiTurnStatefulConfigSchema,
@@ -9048,6 +9619,8 @@ export {
   QuotaDetailsSchema,
   QuotaSummarySchema,
   RED_TEAM_CATEGORIES_PATH,
+  RED_TEAM_CHANNELS_PATH,
+  RED_TEAM_CHANNELS_STATS_PATH,
   RED_TEAM_CLIENT_ID,
   RED_TEAM_CLIENT_SECRET,
   RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH,
@@ -9055,10 +9628,13 @@ export {
   RED_TEAM_DASHBOARD_PATH,
   RED_TEAM_DATA_ENDPOINT,
   RED_TEAM_ERROR_LOG_PATH,
+  RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH,
   RED_TEAM_EULA_PATH,
   RED_TEAM_INSTANCES_PATH,
+  RED_TEAM_LANGUAGES_PATH,
   RED_TEAM_MGMT_DASHBOARD_PATH,
   RED_TEAM_MGMT_ENDPOINT,
+  RED_TEAM_NETWORK_BROKER_ENDPOINT,
   RED_TEAM_QUOTA_PATH,
   RED_TEAM_REGISTRY_CREDENTIALS_PATH,
   RED_TEAM_REPORT_DYNAMIC_PATH,
@@ -9078,6 +9654,7 @@ export {
   RedTeamErrorType,
   RedTeamEulaClient,
   RedTeamInstancesClient,
+  RedTeamNetworkBrokerClient,
   RedTeamPaginationSchema,
   RedTeamReportsClient,
   RedTeamScansClient,
@@ -9180,6 +9757,7 @@ export {
   TargetType,
   TargetUpdateRequestSchema,
   TcReportSchema,
+  TenantLanguagesResponseSchema,
   TgReportSchema,
   ThreatCategory,
   ThreatScanReportSchema,
@@ -9195,11 +9773,13 @@ export {
   TopicsClient,
   URLExclusionSchema,
   USER_AGENT,
+  UpdateChannelRequestSchema,
   UrlCategorySchema,
   UrlfEntrySchema,
   ValidationErrorSchema,
   Verdict,
   ViolationListSchema,
+  ViolationRemediationSchema,
   ViolationResponseSchema,
   ViolationSeverityCountsSchema,
   WebSocketConnectionParamsSchema,