@cdot65/prisma-airs-sdk 0.12.0 → 0.13.1

package/dist/index.cjs

@@ -66,6 +66,12 @@ __export(index_exports, {
   CategoryModelSchema: () => CategoryModelSchema,
   CategoryReportSchema: () => CategoryReportSchema,
   CgReportSchema: () => CgReportSchema,
+  ChannelListPaginationSchema: () => ChannelListPaginationSchema,
+  ChannelListResponseSchema: () => ChannelListResponseSchema,
+  ChannelSchema: () => ChannelSchema,
+  ChannelStatsSchema: () => ChannelStatsSchema,
+  ChannelStatus: () => ChannelStatus,
+  ChannelStatusSchema: () => ChannelStatusSchema,
   ClientIdAndCustomerAppSchema: () => ClientIdAndCustomerAppSchema,
   CmdEntrySchema: () => CmdEntrySchema,
   CmdInjectReportSchema: () => CmdInjectReportSchema,
@@ -79,6 +85,7 @@ __export(index_exports, {
   ContentErrorType: () => ContentErrorType,
   CountByNameSchema: () => CountByNameSchema,
   CountedQuotaEnum: () => CountedQuotaEnum,
+  CreateChannelRequestSchema: () => CreateChannelRequestSchema,
   CreateCustomTopicRequestSchema: () => CreateCustomTopicRequestSchema,
   CreateSecurityProfileRequestSchema: () => CreateSecurityProfileRequestSchema,
   CustomAttackOutputSchema: () => CustomAttackOutputSchema,
@@ -113,6 +120,7 @@ __export(index_exports, {
   DEFAULT_MODEL_SEC_MGMT_ENDPOINT: () => DEFAULT_MODEL_SEC_MGMT_ENDPOINT,
   DEFAULT_RED_TEAM_DATA_ENDPOINT: () => DEFAULT_RED_TEAM_DATA_ENDPOINT,
   DEFAULT_RED_TEAM_MGMT_ENDPOINT: () => DEFAULT_RED_TEAM_MGMT_ENDPOINT,
+  DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT: () => DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT,
   DEFAULT_TOKEN_ENDPOINT: () => DEFAULT_TOKEN_ENDPOINT,
   DLP_DATA_FILTERING_PROFILES_PATH: () => DLP_DATA_FILTERING_PROFILES_PATH,
   DLP_DATA_PATTERNS_PATH: () => DLP_DATA_PATTERNS_PATH,
@@ -254,6 +262,7 @@ __export(index_exports, {
   LabelValueListSchema: () => LabelValueListSchema,
   LabelsCreateRequestSchema: () => LabelsCreateRequestSchema,
   LabelsResponseSchema: () => LabelsResponseSchema,
+  LanguageOptionSchema: () => LanguageOptionSchema,
   ListModelSecurityGroupsResponseSchema: () => ListModelSecurityGroupsResponseSchema,
   ListModelSecurityRuleInstancesResponseSchema: () => ListModelSecurityRuleInstancesResponseSchema,
   ListModelSecurityRulesResponseSchema: () => ListModelSecurityRulesResponseSchema,
@@ -299,6 +308,8 @@ __export(index_exports, {
   MODEL_SEC_DATA_ENDPOINT: () => MODEL_SEC_DATA_ENDPOINT,
   MODEL_SEC_EVALUATIONS_PATH: () => MODEL_SEC_EVALUATIONS_PATH,
   MODEL_SEC_MGMT_ENDPOINT: () => MODEL_SEC_MGMT_ENDPOINT,
+  MODEL_SEC_MODELS_PATH: () => MODEL_SEC_MODELS_PATH,
+  MODEL_SEC_MODEL_VERSIONS_PATH: () => MODEL_SEC_MODEL_VERSIONS_PATH,
   MODEL_SEC_PYPI_AUTH_PATH: () => MODEL_SEC_PYPI_AUTH_PATH,
   MODEL_SEC_SCANS_PATH: () => MODEL_SEC_SCANS_PATH,
   MODEL_SEC_SECURITY_GROUPS_PATH: () => MODEL_SEC_SECURITY_GROUPS_PATH,
@@ -315,7 +326,9 @@ __export(index_exports, {
   MetadataCriterionSchema: () => MetadataCriterionSchema,
   MetadataSchema: () => MetadataSchema,
   ModelConfigurationSchema: () => ModelConfigurationSchema,
+  ModelListSchema: () => ModelListSchema,
   ModelProtectionItemSchema: () => ModelProtectionItemSchema,
+  ModelResponseSchema: () => ModelResponseSchema,
   ModelScanIssueSchema: () => ModelScanIssueSchema,
   ModelScanStatus: () => ModelScanStatus,
   ModelSecurityClient: () => ModelSecurityClient,
@@ -324,12 +337,15 @@ __export(index_exports, {
   ModelSecurityGroupState: () => ModelSecurityGroupState,
   ModelSecurityGroupUpdateRequestSchema: () => ModelSecurityGroupUpdateRequestSchema,
   ModelSecurityGroupsClient: () => ModelSecurityGroupsClient,
+  ModelSecurityModelsClient: () => ModelSecurityModelsClient,
   ModelSecurityPaginationSchema: () => ModelSecurityPaginationSchema,
   ModelSecurityRuleInstanceResponseSchema: () => ModelSecurityRuleInstanceResponseSchema,
   ModelSecurityRuleInstanceUpdateRequestSchema: () => ModelSecurityRuleInstanceUpdateRequestSchema,
   ModelSecurityRuleResponseSchema: () => ModelSecurityRuleResponseSchema,
   ModelSecurityRulesClient: () => ModelSecurityRulesClient,
   ModelSecurityScansClient: () => ModelSecurityScansClient,
+  ModelVersionListSchema: () => ModelVersionListSchema,
+  ModelVersionResponseSchema: () => ModelVersionResponseSchema,
   MultiProfileDataNodeSchema: () => MultiProfileDataNodeSchema,
   MultiProfileDetectionRuleSchema: () => MultiProfileDetectionRuleSchema,
   MultiTurnStatefulConfigSchema: () => MultiTurnStatefulConfigSchema,
@@ -374,6 +390,8 @@ __export(index_exports, {
   QuotaDetailsSchema: () => QuotaDetailsSchema,
   QuotaSummarySchema: () => QuotaSummarySchema,
   RED_TEAM_CATEGORIES_PATH: () => RED_TEAM_CATEGORIES_PATH,
+  RED_TEAM_CHANNELS_PATH: () => RED_TEAM_CHANNELS_PATH,
+  RED_TEAM_CHANNELS_STATS_PATH: () => RED_TEAM_CHANNELS_STATS_PATH,
   RED_TEAM_CLIENT_ID: () => RED_TEAM_CLIENT_ID,
   RED_TEAM_CLIENT_SECRET: () => RED_TEAM_CLIENT_SECRET,
   RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH: () => RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH,
@@ -381,10 +399,13 @@ __export(index_exports, {
   RED_TEAM_DASHBOARD_PATH: () => RED_TEAM_DASHBOARD_PATH,
   RED_TEAM_DATA_ENDPOINT: () => RED_TEAM_DATA_ENDPOINT,
   RED_TEAM_ERROR_LOG_PATH: () => RED_TEAM_ERROR_LOG_PATH,
+  RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH: () => RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH,
   RED_TEAM_EULA_PATH: () => RED_TEAM_EULA_PATH,
   RED_TEAM_INSTANCES_PATH: () => RED_TEAM_INSTANCES_PATH,
+  RED_TEAM_LANGUAGES_PATH: () => RED_TEAM_LANGUAGES_PATH,
   RED_TEAM_MGMT_DASHBOARD_PATH: () => RED_TEAM_MGMT_DASHBOARD_PATH,
   RED_TEAM_MGMT_ENDPOINT: () => RED_TEAM_MGMT_ENDPOINT,
+  RED_TEAM_NETWORK_BROKER_ENDPOINT: () => RED_TEAM_NETWORK_BROKER_ENDPOINT,
   RED_TEAM_QUOTA_PATH: () => RED_TEAM_QUOTA_PATH,
   RED_TEAM_REGISTRY_CREDENTIALS_PATH: () => RED_TEAM_REGISTRY_CREDENTIALS_PATH,
   RED_TEAM_REPORT_DYNAMIC_PATH: () => RED_TEAM_REPORT_DYNAMIC_PATH,
@@ -404,6 +425,7 @@ __export(index_exports, {
   RedTeamErrorType: () => RedTeamErrorType,
   RedTeamEulaClient: () => RedTeamEulaClient,
   RedTeamInstancesClient: () => RedTeamInstancesClient,
+  RedTeamNetworkBrokerClient: () => RedTeamNetworkBrokerClient,
   RedTeamPaginationSchema: () => RedTeamPaginationSchema,
   RedTeamReportsClient: () => RedTeamReportsClient,
   RedTeamScansClient: () => RedTeamScansClient,
@@ -506,6 +528,7 @@ __export(index_exports, {
   TargetType: () => TargetType,
   TargetUpdateRequestSchema: () => TargetUpdateRequestSchema,
   TcReportSchema: () => TcReportSchema,
+  TenantLanguagesResponseSchema: () => TenantLanguagesResponseSchema,
   TgReportSchema: () => TgReportSchema,
   ThreatCategory: () => ThreatCategory,
   ThreatScanReportSchema: () => ThreatScanReportSchema,
@@ -521,11 +544,13 @@ __export(index_exports, {
   TopicsClient: () => TopicsClient,
   URLExclusionSchema: () => URLExclusionSchema,
   USER_AGENT: () => USER_AGENT,
+  UpdateChannelRequestSchema: () => UpdateChannelRequestSchema,
   UrlCategorySchema: () => UrlCategorySchema,
   UrlfEntrySchema: () => UrlfEntrySchema,
   ValidationErrorSchema: () => ValidationErrorSchema,
   Verdict: () => Verdict,
   ViolationListSchema: () => ViolationListSchema,
+  ViolationRemediationSchema: () => ViolationRemediationSchema,
   ViolationResponseSchema: () => ViolationResponseSchema,
   ViolationSeverityCountsSchema: () => ViolationSeverityCountsSchema,
   WebSocketConnectionParamsSchema: () => WebSocketConnectionParamsSchema,
@@ -568,7 +593,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.12.0";
+var SDK_VERSION = "0.13.1";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -614,17 +639,21 @@ var MODEL_SEC_TOKEN_ENDPOINT = "PANW_MODEL_SEC_TOKEN_ENDPOINT";
 var MODEL_SEC_SCANS_PATH = "/v1/scans";
 var MODEL_SEC_EVALUATIONS_PATH = "/v1/evaluations";
 var MODEL_SEC_VIOLATIONS_PATH = "/v1/violations";
+var MODEL_SEC_MODELS_PATH = "/v1/models";
+var MODEL_SEC_MODEL_VERSIONS_PATH = "/v1/model-versions";
 var MODEL_SEC_SECURITY_GROUPS_PATH = "/v1/security-groups";
 var MODEL_SEC_SECURITY_RULES_PATH = "/v1/security-rules";
 var MODEL_SEC_PYPI_AUTH_PATH = "/v1/pypi/authenticate";
 var DEFAULT_RED_TEAM_DATA_ENDPOINT = "https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane";
 var DEFAULT_RED_TEAM_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/ai-red-teaming/mgmt-plane";
+var DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT = "https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane/network-broker";
 var RED_TEAM_CLIENT_ID = "PANW_RED_TEAM_CLIENT_ID";
 var RED_TEAM_CLIENT_SECRET = "PANW_RED_TEAM_CLIENT_SECRET";
 var RED_TEAM_TSG_ID = "PANW_RED_TEAM_TSG_ID";
 var RED_TEAM_DATA_ENDPOINT = "PANW_RED_TEAM_DATA_ENDPOINT";
 var RED_TEAM_MGMT_ENDPOINT = "PANW_RED_TEAM_MGMT_ENDPOINT";
 var RED_TEAM_TOKEN_ENDPOINT = "PANW_RED_TEAM_TOKEN_ENDPOINT";
+var RED_TEAM_NETWORK_BROKER_ENDPOINT = "PANW_RED_TEAM_NETWORK_BROKER_ENDPOINT";
 var RED_TEAM_SCAN_PATH = "/v1/scan";
 var RED_TEAM_CATEGORIES_PATH = "/v1/categories";
 var RED_TEAM_REPORT_STATIC_PATH = "/v1/report/static";
@@ -635,6 +664,8 @@ var RED_TEAM_DASHBOARD_PATH = "/v1/dashboard";
 var RED_TEAM_QUOTA_PATH = "/v1/metering/quota";
 var RED_TEAM_ERROR_LOG_PATH = "/v1/error-log/job";
 var RED_TEAM_SENTIMENT_PATH = "/v1/sentiment";
+var RED_TEAM_LANGUAGES_PATH = "/v1/languages";
+var RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH = "/v1/error-log/target-profile";
 var RED_TEAM_TARGET_PATH = "/v1/target";
 var RED_TEAM_TARGET_VALIDATE_AUTH_PATH = "/v1/target/validate-auth";
 var RED_TEAM_TEMPLATE_PATH = "/v1/template";
@@ -643,6 +674,8 @@ var RED_TEAM_INSTANCES_PATH = "/v1/instances";
 var RED_TEAM_REGISTRY_CREDENTIALS_PATH = "/v1/registry-credentials";
 var RED_TEAM_CUSTOM_ATTACK_PATH = "/v1/custom-attack";
 var RED_TEAM_MGMT_DASHBOARD_PATH = "/v1/dashboard/overview";
+var RED_TEAM_CHANNELS_PATH = "/v1/channels";
+var RED_TEAM_CHANNELS_STATS_PATH = "/v1/channels/stats";
 
 // src/errors.ts
 var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
@@ -660,11 +693,15 @@ var AISecSDKException = class _AISecSDKException extends Error {
   /**
    * @param message - Human-readable error description.
    * @param errorType - Classification of the error.
+   * @param metadata - Optional transport failure metadata.
    */
-  constructor(message, errorType) {
+  constructor(message, errorType, metadata = {}) {
     super(errorType ? `${errorType}:${message}` : message);
     this.name = "AISecSDKException";
     this.errorType = errorType;
+    if (metadata.failureKind !== void 0) this.failureKind = metadata.failureKind;
+    if (metadata.statusCode !== void 0) this.statusCode = metadata.statusCode;
+    if (metadata.retryAfterMs !== void 0) this.retryAfterMs = metadata.retryAfterMs;
     if (Error.captureStackTrace) {
       Error.captureStackTrace(this, _AISecSDKException);
     }
@@ -806,6 +843,59 @@ function extractErrorMessage(body, status) {
     return body ? `API error ${status}: ${body}` : `API error ${status}`;
   }
 }
+function parseRetryAfterHeader(value) {
+  if (value === null) return void 0;
+  const normalized = value.trim();
+  if (/^\d+$/.test(normalized)) {
+    const milliseconds = Number(normalized) * 1e3;
+    return Number.isFinite(milliseconds) ? milliseconds : void 0;
+  }
+  const weekday = "(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)";
+  const longWeekday = "(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday)";
+  const month = "(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)";
+  const httpDatePatterns = [
+    new RegExp(`^${weekday}, \\d{2} ${month} \\d{4} \\d{2}:\\d{2}:\\d{2} GMT$`),
+    new RegExp(`^${longWeekday}, \\d{2}-${month}-\\d{2} \\d{2}:\\d{2}:\\d{2} GMT$`),
+    new RegExp(`^${weekday} ${month} [ \\d]\\d \\d{2}:\\d{2}:\\d{2} \\d{4}$`)
+  ];
+  if (!httpDatePatterns.some((pattern) => pattern.test(normalized))) return void 0;
+  const timestamp = Date.parse(normalized);
+  if (!Number.isFinite(timestamp)) return void 0;
+  return Math.max(0, timestamp - Date.now());
+}
+function parseRetryAfterBody(body) {
+  try {
+    const parsed = JSON.parse(body);
+    const interval = parsed.retry_after?.interval;
+    const unit = parsed.retry_after?.unit;
+    if (typeof interval !== "number" || !Number.isFinite(interval) || interval < 0)
+      return void 0;
+    if (typeof unit !== "string") return void 0;
+    const unitMultipliers = {
+      ms: 1,
+      msec: 1,
+      msecs: 1,
+      millisecond: 1,
+      milliseconds: 1,
+      s: 1e3,
+      sec: 1e3,
+      secs: 1e3,
+      second: 1e3,
+      seconds: 1e3,
+      m: 6e4,
+      min: 6e4,
+      mins: 6e4,
+      minute: 6e4,
+      minutes: 6e4
+    };
+    const multiplier = unitMultipliers[unit.toLowerCase()];
+    if (multiplier === void 0) return void 0;
+    const milliseconds = interval * multiplier;
+    return Number.isFinite(milliseconds) ? milliseconds : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function executeWithRetry(opts) {
   const { maxRetries, execute, onRetryableFailure } = opts;
   let lastError;
@@ -822,7 +912,8 @@ async function executeWithRetry(opts) {
       }
       throw new AISecSDKException(
         lastError.message ?? "Network error",
-        "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */
+        "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */,
+        { failureKind: "network" }
       );
     }
     if (response.ok) return response;
@@ -839,17 +930,53 @@ async function executeWithRetry(opts) {
     }
     const errorText = await response.text();
     const errorMessage = extractErrorMessage(errorText, response.status);
-    throw new AISecSDKException(errorMessage, classifyErrorType(response.status));
+    const retryAfterHeader = response.headers?.get?.("Retry-After") ?? null;
+    const headerRetryAfterMs = parseRetryAfterHeader(retryAfterHeader);
+    throw new AISecSDKException(errorMessage, classifyErrorType(response.status), {
+      failureKind: "http",
+      statusCode: response.status,
+      retryAfterMs: headerRetryAfterMs ?? parseRetryAfterBody(errorText)
+    });
   }
   throw new AISecSDKException(
     lastError?.message ?? "Max retries exceeded",
-    "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */
+    "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */,
+    lastError ? { failureKind: "network" } : {}
   );
 }
 
+// src/http/debug.ts
+var import_node_crypto2 = require("crypto");
+var TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+var SENSITIVE_HEADERS = /* @__PURE__ */ new Set([HEADER_AUTH_TOKEN.toLowerCase(), HEADER_API_KEY.toLowerCase()]);
+var PREFIX = "[airs-sdk]";
+function isDebugEnabled() {
+  const raw = process.env.PANW_AI_SEC_DEBUG;
+  return raw !== void 0 && TRUTHY.has(raw.trim().toLowerCase());
+}
+function hashToken(value) {
+  return "sha256:" + (0, import_node_crypto2.createHash)("sha256").update(value).digest("hex").slice(0, 12);
+}
+function sanitizeHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? hashToken(value) : value;
+  }
+  return out;
+}
+function logRequest(method, url, headers, body) {
+  console.error(`${PREFIX} \u2192 ${method} ${url}`);
+  console.error(`${PREFIX}   headers ${JSON.stringify(sanitizeHeaders(headers))}`);
+  if (body !== void 0) console.error(`${PREFIX}   body ${body}`);
+}
+function logResponse(status, ms, body) {
+  console.error(`${PREFIX} \u2190 ${status} (${ms}ms)${body !== void 0 ? ` ${body}` : ""}`);
+}
+
 // src/http/request.ts
 async function request(spec) {
   let hasRetriedAuth = false;
+  const debug = isDebugEnabled();
   const response = await executeWithRetry({
     maxRetries: spec.numRetries,
     execute: async () => {
@@ -879,11 +1006,25 @@ async function request(spec) {
       }
       const prepared = { method: spec.method, url, headers, bodyText };
       const final = await spec.auth.prepare(prepared);
-      return fetch(final.url.toString(), {
+      const startedAt = debug ? Date.now() : 0;
+      if (debug) {
+        const logBody = spec.formData !== void 0 ? "[multipart/form-data]" : final.bodyText;
+        logRequest(final.method, final.url.toString(), final.headers, logBody);
+      }
+      const res = await fetch(final.url.toString(), {
         method: final.method,
         headers: final.headers,
         body: spec.formData !== void 0 ? bodyForFetch : final.bodyText
       });
+      if (debug) {
+        let respBody;
+        try {
+          respBody = await res.clone().text();
+        } catch {
+        }
+        logResponse(res.status, Date.now() - startedAt, respBody);
+      }
+      return res;
     },
     onRetryableFailure: async (res) => {
       if (hasRetriedAuth) return false;
@@ -933,6 +1074,7 @@ var PromptDetectedSchema = import_zod.z.object({
   injection: import_zod.z.boolean().optional(),
   toxic_content: import_zod.z.boolean().optional(),
   malicious_code: import_zod.z.boolean().optional(),
+  source_code: import_zod.z.boolean().optional(),
   agent: import_zod.z.boolean().optional(),
   topic_violation: import_zod.z.boolean().optional()
 }).passthrough();
@@ -1237,6 +1379,16 @@ var ThreatScanReportSchema = import_zod14.z.object({
 }).passthrough();
 
 // src/scan/scanner.ts
+function resolveNumRetries(opts) {
+  const numRetries = opts.numRetries ?? globalConfiguration.numRetries;
+  if (!Number.isFinite(numRetries) || !Number.isInteger(numRetries) || numRetries < 0 || numRetries > MAX_NUMBER_OF_RETRIES) {
+    throw new AISecSDKException(
+      `numRetries must be a finite integer between 0 and ${MAX_NUMBER_OF_RETRIES}`,
+      "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+    );
+  }
+  return numRetries;
+}
 var Scanner = class {
   /**
    * @internal
@@ -1257,7 +1409,7 @@ var Scanner = class {
    * Perform a synchronous content scan.
    * @param aiProfile - AI security profile to scan against.
    * @param content - Content to scan.
-   * @param opts - Optional transaction/session IDs and metadata.
+   * @param opts - Optional transaction/session IDs, metadata, and per-call retry override.
    * @returns Scan response with verdict, action, and detection details.
    * @example
    * ```ts
@@ -1276,6 +1428,7 @@ var Scanner = class {
    * ```
    */
   async syncScan(aiProfile, content, opts = {}) {
+    const numRetries = resolveNumRetries(opts);
     if (opts.trId && opts.trId.length > MAX_TRANSACTION_ID_STR_LENGTH) {
       throw new AISecSDKException(
         `trId exceeds max length of ${MAX_TRANSACTION_ID_STR_LENGTH}`,
@@ -1302,33 +1455,52 @@ var Scanner = class {
       body,
       responseSchema: ScanResponseSchema,
       auth: this.buildAuth(),
-      numRetries: globalConfiguration.numRetries
+      numRetries
     });
   }
   /**
-   * Submit content for asynchronous scanning.
-   * @param scanObjects - Array of scan objects (1–5 items).
-   * @returns Response containing scan IDs for later querying.
+   * Submit one batch of content for asynchronous scanning.
+   *
+   * The call accepts 1–5 request objects and returns one batch receipt. A batch `scan_id` can fan
+   * out to several unordered result rows. Correlate each row by `(scan_id, req_id)`, never array
+   * position or `scan_id` alone. The SDK preserves the server's row order and cardinality.
+   *
+   * Setting `numRetries: 0` guarantees one SDK fetch attempt, but cannot guarantee exactly-once
+   * server submission after an ambiguous network or 5xx failure.
+   * @param scanObjects - Array of scan objects (1–5 items), each with its own `req_id`.
+   * @param opts - Optional per-call retry override.
+   * @returns One batch receipt containing the shared scan ID for later querying.
    * @example
    * ```ts
    * import { init, Scanner } from '@cdot65/prisma-airs-sdk';
    * init();
    * const scanner = new Scanner();
    *
-   * const result = await scanner.asyncScan([
-   *   {
-   *     req_id: 1,
-   *     scan_req: {
-   *       ai_profile: { profile_name: 'my-profile' },
-   *       contents: [{ prompt: 'Tell me about machine learning.' }],
+   * const receipt = await scanner.asyncScan(
+   *   [
+   *     {
+   *       req_id: 1,
+   *       scan_req: {
+   *         ai_profile: { profile_name: 'my-profile' },
+   *         contents: [{ prompt: 'Tell me about machine learning.' }],
+   *       },
    *     },
-   *   },
-   * ]);
-   * // result =>
+   *     {
+   *       req_id: 2,
+   *       scan_req: {
+   *         ai_profile: { profile_name: 'my-profile' },
+   *         contents: [{ prompt: 'What are neural networks?' }],
+   *       },
+   *     },
+   *   ],
+   *   { numRetries: 0 },
+   * );
+   * // receipt =>
    * // { received: '2024-01-01T00:00:00Z', scan_id: '550e...' }
    * ```
    */
-  async asyncScan(scanObjects) {
+  async asyncScan(scanObjects, opts = {}) {
+    const numRetries = resolveNumRetries(opts);
     if (scanObjects.length < 1) {
       throw new AISecSDKException(
         "At least 1 scan object is required",
@@ -1348,13 +1520,17 @@ var Scanner = class {
       body: scanObjects,
       responseSchema: AsyncScanResponseSchema,
       auth: this.buildAuth(),
-      numRetries: globalConfiguration.numRetries
+      numRetries
     });
   }
   /**
    * Query scan results by scan IDs.
+   *
+   * One scan ID can return several unordered rows. Correlate them using `(scan_id, req_id)`. The
+   * SDK does not sort, deduplicate, or collapse the response.
    * @param scanIds - Array of scan UUIDs (1–5 items).
-   * @returns Array of scan results with status and response data.
+   * @param opts - Optional per-call retry override.
+   * @returns Every scan-result row in server order, with status and response data.
    * @example
    * ```ts
    * import { init, Scanner } from '@cdot65/prisma-airs-sdk';
@@ -1364,12 +1540,14 @@ var Scanner = class {
    * const results = await scanner.queryByScanIds([
    *   '550e8400-e29b-41d4-a716-446655440000',
    * ]);
-   * // results =>
-   * // [{ scan_id: '550e8400-e29b-41d4-a716-446655440000', status: 'complete',
-   * //    result: { category: 'benign', action: 'allow', ... } }]
+   * // A single scan ID may produce multiple rows, for example req_id 2 then req_id 1.
+   * for (const row of results) {
+   *   console.log(`${row.scan_id}:${row.req_id}`, row.status, row.result?.action);
+   * }
    * ```
    */
-  async queryByScanIds(scanIds) {
+  async queryByScanIds(scanIds, opts = {}) {
+    const numRetries = resolveNumRetries(opts);
     if (scanIds.length < 1) {
       throw new AISecSDKException(
         "At least 1 scan_id is required",
@@ -1394,13 +1572,17 @@ var Scanner = class {
       params: { scan_ids: scanIds.join(",") },
       responseSchema: import_zod15.z.array(ScanIdResultSchema),
       auth: this.buildAuth(),
-      numRetries: globalConfiguration.numRetries
+      numRetries
     });
   }
   /**
    * Query detailed threat reports by report IDs.
+   *
+   * One report ID can return several rows. Correlate them using `(report_id, req_id)`. The SDK
+   * preserves server order and cardinality without sorting or deduplicating.
    * @param reportIds - Array of report IDs (1–5 items).
-   * @returns Array of threat scan reports with detection details.
+   * @param opts - Optional per-call retry override.
+   * @returns Every report row in server order, with detection details.
    * @example
    * ```ts
    * import { init, Scanner } from '@cdot65/prisma-airs-sdk';
@@ -1408,12 +1590,13 @@ var Scanner = class {
    * const scanner = new Scanner();
    *
    * const reports = await scanner.queryByReportIds(['R000...']);
-   * // reports =>
-   * // [{ report_id: 'R000...', scan_id: '550e...',
-   * //    detection_results: [{ detection_service: 'pi', verdict: 'benign', action: 'allow' }] }]
+   * for (const report of reports) {
+   *   console.log(`${report.report_id}:${report.req_id}`, report.detection_results);
+   * }
    * ```
    */
-  async queryByReportIds(reportIds) {
+  async queryByReportIds(reportIds, opts = {}) {
+    const numRetries = resolveNumRetries(opts);
     if (reportIds.length < 1) {
       throw new AISecSDKException(
         "At least 1 report_id is required",
@@ -1433,7 +1616,7 @@ var Scanner = class {
       params: { report_ids: reportIds.join(",") },
       responseSchema: import_zod15.z.array(ThreatScanReportSchema),
       auth: this.buildAuth(),
-      numRetries: globalConfiguration.numRetries
+      numRetries
     });
   }
 };
@@ -2845,7 +3028,8 @@ var ScanDetailsSchema = import_zod32.z.object({
 var ScanCreateRequestSchema = import_zod32.z.object({
   model_uri: import_zod32.z.string(),
   security_group_uuid: import_zod32.z.string(),
-  scan_origin: import_zod32.z.string(),
+  // Optional per the OpenAPI spec (server defaults it); the scans-client example still sets it.
+  scan_origin: import_zod32.z.string().optional(),
   allow_patterns: import_zod32.z.array(import_zod32.z.string()).nullable().optional(),
   ignore_patterns: import_zod32.z.array(import_zod32.z.string()).nullable().optional(),
   labels: import_zod32.z.array(LabelSchema).nullable().optional(),
@@ -2864,7 +3048,8 @@ var ScanBaseResponseSchema = import_zod32.z.object({
   scan_origin: import_zod32.z.string(),
   security_group_uuid: import_zod32.z.string(),
   security_group_name: import_zod32.z.string(),
-  model_version_uuid: import_zod32.z.string(),
+  // Optional per the OpenAPI spec — a scan may not have a resolved model version yet.
+  model_version_uuid: import_zod32.z.string().nullable().optional(),
   eval_outcome: import_zod32.z.string(),
   source_type: import_zod32.z.string(),
   created_by: import_zod32.z.string().nullable().optional(),
@@ -2901,6 +3086,50 @@ var FileListSchema = import_zod32.z.object({
   pagination: ModelSecurityPaginationSchema,
   files: import_zod32.z.array(FileResponseSchema)
 }).passthrough();
+var ModelResponseSchema = import_zod32.z.object({
+  uuid: import_zod32.z.string(),
+  tsg_id: import_zod32.z.string(),
+  created_at: import_zod32.z.string(),
+  updated_at: import_zod32.z.string(),
+  name: import_zod32.z.string(),
+  latest_version_uuid: import_zod32.z.string().nullable().optional(),
+  latest_version_fingerprint: import_zod32.z.string().nullable().optional(),
+  latest_version_revision: import_zod32.z.string().nullable().optional(),
+  latest_version_hf_commit_sha: import_zod32.z.string().nullable().optional(),
+  latest_version_outcome: import_zod32.z.string().nullable().optional(),
+  latest_version_formats: import_zod32.z.array(import_zod32.z.string()).nullable().optional(),
+  latest_version_source_types: import_zod32.z.array(import_zod32.z.string()).nullable().optional(),
+  latest_version_scan_time: import_zod32.z.string().nullable().optional()
+}).passthrough();
+var ModelListSchema = import_zod32.z.object({
+  pagination: ModelSecurityPaginationSchema,
+  models: import_zod32.z.array(ModelResponseSchema)
+}).passthrough();
+var ModelVersionResponseSchema = import_zod32.z.object({
+  uuid: import_zod32.z.string(),
+  tsg_id: import_zod32.z.string(),
+  created_at: import_zod32.z.string(),
+  updated_at: import_zod32.z.string(),
+  revision: import_zod32.z.string(),
+  model_uuid: import_zod32.z.string(),
+  fingerprint: import_zod32.z.string().nullable().optional(),
+  file_count: import_zod32.z.number().int().nullable().optional(),
+  license: import_zod32.z.string().nullable().optional(),
+  latest_scan_time: import_zod32.z.string().nullable().optional(),
+  hf_commit_sha: import_zod32.z.string().nullable().optional(),
+  hf_commit_title: import_zod32.z.string().nullable().optional(),
+  hf_commit_authors: import_zod32.z.array(import_zod32.z.string()).nullable().optional(),
+  hf_model_name: import_zod32.z.string().nullable().optional(),
+  hf_organization: import_zod32.z.string().nullable().optional(),
+  model_formats: import_zod32.z.array(import_zod32.z.string()).nullable().optional(),
+  source_types: import_zod32.z.array(import_zod32.z.string()).nullable().optional(),
+  last_eval_outcome: import_zod32.z.string().nullable().optional(),
+  last_eval_summary: EvalSummarySchema.nullable().optional()
+}).passthrough();
+var ModelVersionListSchema = import_zod32.z.object({
+  pagination: ModelSecurityPaginationSchema,
+  model_versions: import_zod32.z.array(ModelVersionResponseSchema)
+}).passthrough();
 var RuleEvaluationResponseSchema = import_zod32.z.object({
   uuid: import_zod32.z.string(),
   tsg_id: import_zod32.z.string(),
@@ -2918,6 +3147,10 @@ var RuleEvaluationListSchema = import_zod32.z.object({
   pagination: ModelSecurityPaginationSchema,
   evaluations: import_zod32.z.array(RuleEvaluationResponseSchema)
 }).passthrough();
+var ViolationRemediationSchema = import_zod32.z.object({
+  steps: import_zod32.z.array(import_zod32.z.string()),
+  url: import_zod32.z.string()
+}).passthrough();
 var ViolationResponseSchema = import_zod32.z.object({
   uuid: import_zod32.z.string(),
   tsg_id: import_zod32.z.string(),
@@ -2928,6 +3161,7 @@ var ViolationResponseSchema = import_zod32.z.object({
   rule_name: import_zod32.z.string(),
   rule_description: import_zod32.z.string(),
   rule_instance_state: import_zod32.z.string(),
+  remediation: ViolationRemediationSchema,
   file: import_zod32.z.string().nullable().optional(),
   hash: import_zod32.z.string().nullable().optional(),
   module: import_zod32.z.string().nullable().optional(),
@@ -3063,6 +3297,11 @@ var BrandSubCategory = {
   DISCRIMINATING_CLAIMS: "DISCRIMINATING_CLAIMS",
   POLITICAL_ENDORSEMENTS: "POLITICAL_ENDORSEMENTS"
 };
+var ChannelStatus = {
+  ONLINE: "ONLINE",
+  OFFLINE: "OFFLINE",
+  DRAFT: "DRAFT"
+};
 var ComplianceSubCategory = {
   OWASP: "OWASP",
   MITRE_ATLAS: "MITRE_ATLAS",
@@ -3886,6 +4125,12 @@ var ErrorLogSchema = import_zod33.z.object({
   version: import_zod33.z.number().int().optional()
 }).passthrough();
 var ErrorLogListResponseSchema = import_zod33.z.object({ pagination: RedTeamPaginationSchema, data: import_zod33.z.array(ErrorLogSchema) }).passthrough();
+var LanguageOptionSchema = import_zod33.z.object({ code: import_zod33.z.string(), name: import_zod33.z.string() }).passthrough();
+var TenantLanguagesResponseSchema = import_zod33.z.object({
+  multilingual_enabled: import_zod33.z.boolean(),
+  supported_job_types: import_zod33.z.array(import_zod33.z.string()),
+  languages: import_zod33.z.array(LanguageOptionSchema)
+}).passthrough();
 var TargetRequestBaseFields = {
   name: import_zod33.z.string(),
   description: import_zod33.z.string().nullable().optional(),
@@ -4240,6 +4485,48 @@ var RegistryCredentialsSchema = import_zod33.z.object({
   expiry: import_zod33.z.string()
 }).passthrough();
 
+// src/models/red-team-network-broker.ts
+var import_zod34 = require("zod");
+var ChannelStatusSchema = import_zod34.z.nativeEnum(ChannelStatus);
+var CreateChannelRequestSchema = import_zod34.z.object({
+  name: import_zod34.z.string(),
+  description: import_zod34.z.string().optional()
+}).passthrough();
+var UpdateChannelRequestSchema = import_zod34.z.object({
+  name: import_zod34.z.string().optional(),
+  description: import_zod34.z.string().optional()
+}).passthrough();
+var ChannelSchema = import_zod34.z.object({
+  uuid: import_zod34.z.string().optional(),
+  name: import_zod34.z.string().nullable().optional(),
+  description: import_zod34.z.string().nullable().optional(),
+  // Kept as a plain string (not the enum) so unknown upstream statuses never fail parsing.
+  status: import_zod34.z.string().nullable().optional(),
+  added_by: import_zod34.z.string().nullable().optional(),
+  created_at: import_zod34.z.string().nullable().optional(),
+  updated_at: import_zod34.z.string().nullable().optional(),
+  last_online_at: import_zod34.z.string().nullable().optional(),
+  // Present on live responses (not in the base OpenAPI Channel schema).
+  connected_clients_count: import_zod34.z.number().int().nullable().optional(),
+  outdated_clients_count: import_zod34.z.number().int().nullable().optional(),
+  features: import_zod34.z.record(import_zod34.z.boolean()).nullable().optional()
+}).passthrough();
+var ChannelListPaginationSchema = import_zod34.z.object({ total_items: import_zod34.z.number().int().nullable().optional() }).passthrough();
+var ChannelListResponseSchema = import_zod34.z.object({
+  pagination: ChannelListPaginationSchema.optional(),
+  data: import_zod34.z.array(ChannelSchema).default([])
+}).passthrough();
+var ChannelStatsSchema = import_zod34.z.object({
+  network_channels_server_domain: import_zod34.z.string().nullable().optional(),
+  docker_registry: import_zod34.z.string().nullable().optional(),
+  helm_chart: import_zod34.z.string().nullable().optional(),
+  docker_image: import_zod34.z.string().nullable().optional(),
+  online_channels: import_zod34.z.number().int().nullable().optional(),
+  total_channels: import_zod34.z.number().int().nullable().optional(),
+  // Present on live responses (not in the base OpenAPI ChannelStats schema).
+  client_version: import_zod34.z.string().nullable().optional()
+}).passthrough();
+
 // src/http/auth/oauth.ts
 var OAuthAuth = class {
   constructor(oauthClient) {
@@ -4262,12 +4549,12 @@ var OAuthAuth = class {
 };
 
 // src/models/oauth-token.ts
-var import_zod34 = require("zod");
-var OAuthTokenResponseSchema = import_zod34.z.object({
-  access_token: import_zod34.z.string(),
-  token_type: import_zod34.z.string().optional(),
-  expires_in: import_zod34.z.number(),
-  scope: import_zod34.z.string().optional()
+var import_zod35 = require("zod");
+var OAuthTokenResponseSchema = import_zod35.z.object({
+  access_token: import_zod35.z.string(),
+  token_type: import_zod35.z.string().optional(),
+  expires_in: import_zod35.z.number(),
+  scope: import_zod35.z.string().optional()
 }).passthrough();
 
 // src/management/oauth-client.ts
@@ -5058,7 +5345,7 @@ var CustomerAppsClient = class {
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MGMT_CUSTOMER_APPS_TSG_PATH}/${this.tsgId}`,
+      path: `${MGMT_CUSTOMER_APPS_TSG_PATH}/${encodeURIComponent(this.tsgId)}`,
       params,
       responseSchema: CustomerAppListResponseSchema,
       auth: this.auth,
@@ -5252,7 +5539,7 @@ var ScanLogsClient = class {
 };
 
 // src/management/oauth-management.ts
-var import_zod35 = require("zod");
+var import_zod36 = require("zod");
 var OAuthManagementClient = class {
   baseUrl;
   auth;
@@ -5286,7 +5573,7 @@ var OAuthManagementClient = class {
       path: MGMT_OAUTH_INVALIDATE_PATH,
       params: { token },
       body,
-      responseSchema: import_zod35.z.string(),
+      responseSchema: import_zod36.z.string(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6914,6 +7201,170 @@ var ModelSecurityRulesClient = class {
   }
 };
 
+// src/model-security/models-client.ts
+function buildModelListParams(opts) {
+  const params = serializeListing(opts);
+  if (opts?.search_query !== void 0) params.search_query = opts.search_query;
+  if (opts?.sort_field !== void 0) params.sort_field = opts.sort_field;
+  if (opts?.sort_order !== void 0) params.sort_order = opts.sort_order;
+  if (opts?.latest_version_outcomes !== void 0)
+    params.latest_version_outcomes = opts.latest_version_outcomes;
+  if (opts?.latest_version_formats !== void 0)
+    params.latest_version_formats = opts.latest_version_formats;
+  if (opts?.latest_version_source_types !== void 0)
+    params.latest_version_source_types = opts.latest_version_source_types;
+  if (opts?.latest_version_scan_time_before !== void 0)
+    params.latest_version_scan_time_before = opts.latest_version_scan_time_before;
+  if (opts?.start_time !== void 0) params.start_time = opts.start_time;
+  if (opts?.end_time !== void 0) params.end_time = opts.end_time;
+  return params;
+}
+var ModelSecurityModelsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List models with optional search, sort, and latest-version filters.
+   * @param opts - Pagination and filter options.
+   * @returns Paginated list of models.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const models = await ms.models.listModels({ limit: 10, search_query: 'llama' });
+   * // models =>
+   * // { pagination: { total_items: 3 }, models: [{ uuid: '550e8400-...', name: 'org/llama', latest_version_outcome: 'PASSED' }] }
+   * ```
+   */
+  async listModels(opts) {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: MODEL_SEC_MODELS_PATH,
+      params: buildModelListParams(opts),
+      responseSchema: ModelListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a single model by UUID.
+   * @param uuid - Model UUID.
+   * @returns The model.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const model = await ms.models.getModel('550e8400-e29b-41d4-a716-446655440000');
+   * // model =>
+   * // { uuid: '550e8400-...', name: 'org/model', latest_version_uuid: '660e8400-...', latest_version_outcome: 'PASSED' }
+   * ```
+   */
+  async getModel(uuid) {
+    assertUuid(uuid, "model uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODELS_PATH}/${uuid}`,
+      responseSchema: ModelResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List the versions of a model.
+   * @param modelUuid - Model UUID.
+   * @param opts - Pagination and sort options.
+   * @returns Paginated list of model versions.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const versions = await ms.models.listModelVersions('550e8400-e29b-41d4-a716-446655440000', {
+   *   sort_order: 'desc',
+   * });
+   * // versions =>
+   * // { pagination: { total_items: 2 }, model_versions: [{ uuid: '660e8400-...', revision: 'main', file_count: 12 }] }
+   * ```
+   */
+  async listModelVersions(modelUuid, opts) {
+    assertUuid(modelUuid, "model uuid");
+    const params = serializeListing(opts);
+    if (opts?.sort_order !== void 0) params.sort_order = opts.sort_order;
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODELS_PATH}/${modelUuid}/model-versions`,
+      params,
+      responseSchema: ModelVersionListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a single model version by UUID.
+   * @param uuid - Model version UUID.
+   * @returns The model version.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const version = await ms.models.getModelVersion('660e8400-e29b-41d4-a716-446655440000');
+   * // version =>
+   * // { uuid: '660e8400-...', revision: 'main', model_uuid: '550e8400-...', last_eval_outcome: 'PASSED' }
+   * ```
+   */
+  async getModelVersion(uuid) {
+    assertUuid(uuid, "model version uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${uuid}`,
+      responseSchema: ModelVersionResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List the files of a model version.
+   * @param modelVersionUuid - Model version UUID.
+   * @param opts - Pagination options.
+   * @returns Paginated list of files (same shape as scan files).
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const files = await ms.models.listModelVersionFiles('660e8400-e29b-41d4-a716-446655440000', {
+   *   limit: 50,
+   * });
+   * // files =>
+   * // { pagination: { total_items: 12 }, files: [{ uuid: '770e8400-...', path: '/model.safetensors', type: 'FILE', result: 'SUCCESS' }] }
+   * ```
+   */
+  async listModelVersionFiles(modelVersionUuid, opts) {
+    assertUuid(modelVersionUuid, "model version uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${modelVersionUuid}/files`,
+      params: serializeListing(opts),
+      responseSchema: FileListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
 // src/model-security/client.ts
 var ModelSecurityClient = class {
   /** Data plane scan operations. */
@@ -6922,6 +7373,8 @@ var ModelSecurityClient = class {
   securityGroups;
   /** Management plane security rule operations (read-only). */
   securityRules;
+  /** Data plane model and model-version operations (read-only). */
+  models;
   mgmtEndpoint;
   auth;
   numRetries;
@@ -6943,6 +7396,7 @@ var ModelSecurityClient = class {
     this.mgmtEndpoint = mgmtEndpoint;
     this.numRetries = numRetries;
     this.scans = new ModelSecurityScansClient({ baseUrl: dataEndpoint, auth, numRetries });
+    this.models = new ModelSecurityModelsClient({ baseUrl: dataEndpoint, auth, numRetries });
     this.securityGroups = new ModelSecurityGroupsClient({
       baseUrl: mgmtEndpoint,
       auth,
@@ -6980,7 +7434,7 @@ var ModelSecurityClient = class {
 };
 
 // src/red-team/scans-client.ts
-var import_zod36 = require("zod");
+var import_zod37 = require("zod");
 var RedTeamScansClient = class {
   baseUrl;
   auth;
@@ -7117,7 +7571,7 @@ var RedTeamScansClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: RED_TEAM_CATEGORIES_PATH,
-      responseSchema: import_zod36.z.array(CategoryModelSchema),
+      responseSchema: import_zod37.z.array(CategoryModelSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7125,7 +7579,7 @@ var RedTeamScansClient = class {
 };
 
 // src/red-team/reports-client.ts
-var import_zod37 = require("zod");
+var import_zod38 = require("zod");
 var RedTeamReportsClient = class {
   baseUrl;
   auth;
@@ -7500,7 +7954,7 @@ var RedTeamReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/download`,
       params: { file_format: format },
-      responseSchema: import_zod37.z.unknown(),
+      responseSchema: import_zod38.z.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7524,7 +7978,7 @@ var RedTeamReportsClient = class {
       method: "POST",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/generate-partial-report`,
-      responseSchema: import_zod37.z.unknown(),
+      responseSchema: import_zod38.z.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7532,7 +7986,7 @@ var RedTeamReportsClient = class {
 };
 
 // src/red-team/custom-attack-reports-client.ts
-var import_zod38 = require("zod");
+var import_zod39 = require("zod");
 var RedTeamCustomAttackReportsClient = class {
   baseUrl;
   auth;
@@ -7622,7 +8076,7 @@ var RedTeamCustomAttackReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/report/${jobId}/prompt-set/${promptSetId}/prompts`,
       params,
-      responseSchema: import_zod38.z.array(PromptDetailResponseSchema),
+      responseSchema: import_zod39.z.array(PromptDetailResponseSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7716,7 +8170,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/attack/${attackId}/list-outputs`,
-      responseSchema: import_zod38.z.array(CustomAttackOutputSchema),
+      responseSchema: import_zod39.z.array(CustomAttackOutputSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7741,7 +8195,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/property-stats`,
-      responseSchema: import_zod38.z.array(PropertyStatisticSchema),
+      responseSchema: import_zod39.z.array(PropertyStatisticSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7749,7 +8203,7 @@ var RedTeamCustomAttackReportsClient = class {
 };
 
 // src/red-team/targets-client.ts
-var import_zod39 = require("zod");
+var import_zod40 = require("zod");
 var RedTeamTargetsClient = class {
   baseUrl;
   auth;
@@ -8042,7 +8496,7 @@ var RedTeamTargetsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_TEMPLATE_PATH}/target-metadata`,
-      responseSchema: import_zod39.z.record(import_zod39.z.unknown()),
+      responseSchema: import_zod40.z.record(import_zod40.z.unknown()),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8991,6 +9445,155 @@ var RedTeamInstancesClient = class {
   }
 };
 
+// src/red-team/network-broker-client.ts
+var RedTeamNetworkBrokerClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List network broker channels with optional filters.
+   * @param opts - Optional pagination, search, and status filter options.
+   * @returns The paginated list of channels.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channels = await rt.networkBroker.listChannels({ status: ['ONLINE', 'DRAFT'], limit: 10 });
+   * // channels =>
+   * // { pagination: { total_items: 2 }, data: [{ uuid: '550e8400-...', name: 'prod-broker', status: 'ONLINE' }] }
+   * ```
+   */
+  async listChannels(opts) {
+    const params = serializeListing(opts);
+    if (opts?.status !== void 0) {
+      params.status = Array.isArray(opts.status) ? opts.status : [opts.status];
+    }
+    if (opts?.include_all_if_empty !== void 0) {
+      params.include_all_if_empty = String(opts.include_all_if_empty);
+    }
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_CHANNELS_PATH,
+      params,
+      responseSchema: ChannelListResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Create a network broker channel.
+   * @param body - Channel creation request body (requires `name`).
+   * @returns The created channel.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channel = await rt.networkBroker.createChannel({
+   *   name: 'prod-broker',
+   *   description: 'Production network broker channel',
+   * });
+   * // channel =>
+   * // { uuid: '550e8400-...', name: 'prod-broker', status: 'DRAFT' }
+   * ```
+   */
+  async createChannel(body) {
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_CHANNELS_PATH,
+      body,
+      responseSchema: ChannelSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get network broker channel stats.
+   * @returns The channel stats (broker server, registry, chart, image, channel counts).
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const stats = await rt.networkBroker.getChannelStats();
+   * // stats =>
+   * // { network_channels_server_domain: 'broker.example.com', online_channels: 3, total_channels: 5, client_version: '1.4.0' }
+   * ```
+   */
+  async getChannelStats() {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_CHANNELS_STATS_PATH,
+      responseSchema: ChannelStatsSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a network broker channel by UUID.
+   * @param channelId - The channel UUID.
+   * @returns The channel.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channel = await rt.networkBroker.getChannel('550e8400-e29b-41d4-a716-446655440000');
+   * // channel =>
+   * // { uuid: '550e8400-...', name: 'prod-broker', status: 'ONLINE' }
+   * ```
+   */
+  async getChannel(channelId) {
+    assertUuid(channelId, "channel id");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_CHANNELS_PATH}/${channelId}`,
+      responseSchema: ChannelSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update a network broker channel's name or description.
+   * @param channelId - The channel UUID.
+   * @param body - Channel update request body.
+   * @returns The updated channel.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channel = await rt.networkBroker.updateChannel('550e8400-e29b-41d4-a716-446655440000', {
+   *   description: 'Updated description',
+   * });
+   * // channel =>
+   * // { uuid: '550e8400-...', name: 'prod-broker', description: 'Updated description', status: 'ONLINE' }
+   * ```
+   */
+  async updateChannel(channelId, body) {
+    assertUuid(channelId, "channel id");
+    return request({
+      method: "PATCH",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_CHANNELS_PATH}/${channelId}`,
+      body,
+      responseSchema: ChannelSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
 // src/red-team/client.ts
 var RedTeamClient = class {
   /** Data plane scan operations. */
@@ -9007,6 +9610,8 @@ var RedTeamClient = class {
   eula;
   /** Management plane instance/licensing operations. */
   instances;
+  /** Network broker channel operations (distinct network broker base URL). */
+  networkBroker;
   dataEndpoint;
   mgmtEndpoint;
   auth;
@@ -9014,6 +9619,7 @@ var RedTeamClient = class {
   constructor(opts = {}) {
     const dataEndpoint = opts.dataEndpoint ?? process.env[RED_TEAM_DATA_ENDPOINT] ?? DEFAULT_RED_TEAM_DATA_ENDPOINT;
     const mgmtEndpoint = opts.mgmtEndpoint ?? process.env[RED_TEAM_MGMT_ENDPOINT] ?? DEFAULT_RED_TEAM_MGMT_ENDPOINT;
+    const networkBrokerEndpoint = opts.networkBrokerEndpoint ?? process.env[RED_TEAM_NETWORK_BROKER_ENDPOINT] ?? DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT;
     const { oauthClient, numRetries } = resolveOAuthConfig({
       clientId: opts.clientId,
       clientSecret: opts.clientSecret,
@@ -9044,6 +9650,11 @@ var RedTeamClient = class {
     });
     this.eula = new RedTeamEulaClient({ baseUrl: mgmtEndpoint, auth, numRetries });
     this.instances = new RedTeamInstancesClient({ baseUrl: mgmtEndpoint, auth, numRetries });
+    this.networkBroker = new RedTeamNetworkBrokerClient({
+      baseUrl: networkBrokerEndpoint,
+      auth,
+      numRetries
+    });
   }
   // -----------------------------------------------------------------------
   // Data plane convenience methods
@@ -9152,6 +9763,82 @@ var RedTeamClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * List profiling error logs for a target (data plane).
+   * @param targetId - The target UUID.
+   * @param opts - Optional pagination/search options (the endpoint honors `limit`).
+   * @returns The paginated list of target-profile error logs.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const logs = await rt.getTargetProfileErrorLogs('550e8400-e29b-41d4-a716-446655440000', { limit: 10 });
+   * // logs =>
+   * // { pagination: { total_items: 1 }, data: [{ target_id: '550e8400-...', error_type: 'PROBE', error_message: '...', created_at: '2025-01-01T00:00:00Z' }] }
+   * ```
+   */
+  async getTargetProfileErrorLogs(targetId, opts) {
+    assertUuid(targetId, "target id");
+    return request({
+      method: "GET",
+      baseUrl: this.dataEndpoint,
+      path: `${RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH}/${targetId}`,
+      params: serializeListing(opts),
+      responseSchema: ErrorLogListResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get the tenant's allowed languages for Red Team scans (data plane).
+   * @returns The supported-languages response.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const langs = await rt.getLanguages();
+   * // langs =>
+   * // { multilingual_enabled: true, supported_job_types: ['STATIC', 'DYNAMIC'],
+   * //   languages: [{ code: 'en', name: 'English' }, { code: 'es', name: 'Spanish' }] }
+   * ```
+   */
+  async getLanguages() {
+    return request({
+      method: "GET",
+      baseUrl: this.dataEndpoint,
+      path: RED_TEAM_LANGUAGES_PATH,
+      responseSchema: TenantLanguagesResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get the tenant's allowed languages from the management plane.
+   * Same response shape as {@link RedTeamClient.getLanguages}, served from the management endpoint.
+   * @returns The supported-languages response.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const langs = await rt.getManagementLanguages();
+   * // langs =>
+   * // { multilingual_enabled: true, supported_job_types: ['STATIC', 'DYNAMIC'],
+   * //   languages: [{ code: 'en', name: 'English' }] }
+   * ```
+   */
+  async getManagementLanguages() {
+    return request({
+      method: "GET",
+      baseUrl: this.mgmtEndpoint,
+      path: RED_TEAM_LANGUAGES_PATH,
+      responseSchema: TenantLanguagesResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Update sentiment for a scan report.
    * @param body - The sentiment request body.
@@ -9280,6 +9967,12 @@ var RedTeamClient = class {
   CategoryModelSchema,
   CategoryReportSchema,
   CgReportSchema,
+  ChannelListPaginationSchema,
+  ChannelListResponseSchema,
+  ChannelSchema,
+  ChannelStatsSchema,
+  ChannelStatus,
+  ChannelStatusSchema,
   ClientIdAndCustomerAppSchema,
   CmdEntrySchema,
   CmdInjectReportSchema,
@@ -9293,6 +9986,7 @@ var RedTeamClient = class {
   ContentErrorType,
   CountByNameSchema,
   CountedQuotaEnum,
+  CreateChannelRequestSchema,
   CreateCustomTopicRequestSchema,
   CreateSecurityProfileRequestSchema,
   CustomAttackOutputSchema,
@@ -9327,6 +10021,7 @@ var RedTeamClient = class {
   DEFAULT_MODEL_SEC_MGMT_ENDPOINT,
   DEFAULT_RED_TEAM_DATA_ENDPOINT,
   DEFAULT_RED_TEAM_MGMT_ENDPOINT,
+  DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT,
   DEFAULT_TOKEN_ENDPOINT,
   DLP_DATA_FILTERING_PROFILES_PATH,
   DLP_DATA_PATTERNS_PATH,
@@ -9468,6 +10163,7 @@ var RedTeamClient = class {
   LabelValueListSchema,
   LabelsCreateRequestSchema,
   LabelsResponseSchema,
+  LanguageOptionSchema,
   ListModelSecurityGroupsResponseSchema,
   ListModelSecurityRuleInstancesResponseSchema,
   ListModelSecurityRulesResponseSchema,
@@ -9513,6 +10209,8 @@ var RedTeamClient = class {
   MODEL_SEC_DATA_ENDPOINT,
   MODEL_SEC_EVALUATIONS_PATH,
   MODEL_SEC_MGMT_ENDPOINT,
+  MODEL_SEC_MODELS_PATH,
+  MODEL_SEC_MODEL_VERSIONS_PATH,
   MODEL_SEC_PYPI_AUTH_PATH,
   MODEL_SEC_SCANS_PATH,
   MODEL_SEC_SECURITY_GROUPS_PATH,
@@ -9529,7 +10227,9 @@ var RedTeamClient = class {
   MetadataCriterionSchema,
   MetadataSchema,
   ModelConfigurationSchema,
+  ModelListSchema,
   ModelProtectionItemSchema,
+  ModelResponseSchema,
   ModelScanIssueSchema,
   ModelScanStatus,
   ModelSecurityClient,
@@ -9538,12 +10238,15 @@ var RedTeamClient = class {
   ModelSecurityGroupState,
   ModelSecurityGroupUpdateRequestSchema,
   ModelSecurityGroupsClient,
+  ModelSecurityModelsClient,
   ModelSecurityPaginationSchema,
   ModelSecurityRuleInstanceResponseSchema,
   ModelSecurityRuleInstanceUpdateRequestSchema,
   ModelSecurityRuleResponseSchema,
   ModelSecurityRulesClient,
   ModelSecurityScansClient,
+  ModelVersionListSchema,
+  ModelVersionResponseSchema,
   MultiProfileDataNodeSchema,
   MultiProfileDetectionRuleSchema,
   MultiTurnStatefulConfigSchema,
@@ -9588,6 +10291,8 @@ var RedTeamClient = class {
   QuotaDetailsSchema,
   QuotaSummarySchema,
   RED_TEAM_CATEGORIES_PATH,
+  RED_TEAM_CHANNELS_PATH,
+  RED_TEAM_CHANNELS_STATS_PATH,
   RED_TEAM_CLIENT_ID,
   RED_TEAM_CLIENT_SECRET,
   RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH,
@@ -9595,10 +10300,13 @@ var RedTeamClient = class {
   RED_TEAM_DASHBOARD_PATH,
   RED_TEAM_DATA_ENDPOINT,
   RED_TEAM_ERROR_LOG_PATH,
+  RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH,
   RED_TEAM_EULA_PATH,
   RED_TEAM_INSTANCES_PATH,
+  RED_TEAM_LANGUAGES_PATH,
   RED_TEAM_MGMT_DASHBOARD_PATH,
   RED_TEAM_MGMT_ENDPOINT,
+  RED_TEAM_NETWORK_BROKER_ENDPOINT,
   RED_TEAM_QUOTA_PATH,
   RED_TEAM_REGISTRY_CREDENTIALS_PATH,
   RED_TEAM_REPORT_DYNAMIC_PATH,
@@ -9618,6 +10326,7 @@ var RedTeamClient = class {
   RedTeamErrorType,
   RedTeamEulaClient,
   RedTeamInstancesClient,
+  RedTeamNetworkBrokerClient,
   RedTeamPaginationSchema,
   RedTeamReportsClient,
   RedTeamScansClient,
@@ -9720,6 +10429,7 @@ var RedTeamClient = class {
   TargetType,
   TargetUpdateRequestSchema,
   TcReportSchema,
+  TenantLanguagesResponseSchema,
   TgReportSchema,
   ThreatCategory,
   ThreatScanReportSchema,
@@ -9735,11 +10445,13 @@ var RedTeamClient = class {
   TopicsClient,
   URLExclusionSchema,
   USER_AGENT,
+  UpdateChannelRequestSchema,
   UrlCategorySchema,
   UrlfEntrySchema,
   ValidationErrorSchema,
   Verdict,
   ViolationListSchema,
+  ViolationRemediationSchema,
   ViolationResponseSchema,
   ViolationSeverityCountsSchema,
   WebSocketConnectionParamsSchema,