@cdot65/prisma-airs-sdk 0.12.0 → 0.13.1

package/dist/index.js

@@ -29,7 +29,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.12.0";
+var SDK_VERSION = "0.13.1";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -75,17 +75,21 @@ var MODEL_SEC_TOKEN_ENDPOINT = "PANW_MODEL_SEC_TOKEN_ENDPOINT";
 var MODEL_SEC_SCANS_PATH = "/v1/scans";
 var MODEL_SEC_EVALUATIONS_PATH = "/v1/evaluations";
 var MODEL_SEC_VIOLATIONS_PATH = "/v1/violations";
+var MODEL_SEC_MODELS_PATH = "/v1/models";
+var MODEL_SEC_MODEL_VERSIONS_PATH = "/v1/model-versions";
 var MODEL_SEC_SECURITY_GROUPS_PATH = "/v1/security-groups";
 var MODEL_SEC_SECURITY_RULES_PATH = "/v1/security-rules";
 var MODEL_SEC_PYPI_AUTH_PATH = "/v1/pypi/authenticate";
 var DEFAULT_RED_TEAM_DATA_ENDPOINT = "https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane";
 var DEFAULT_RED_TEAM_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/ai-red-teaming/mgmt-plane";
+var DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT = "https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane/network-broker";
 var RED_TEAM_CLIENT_ID = "PANW_RED_TEAM_CLIENT_ID";
 var RED_TEAM_CLIENT_SECRET = "PANW_RED_TEAM_CLIENT_SECRET";
 var RED_TEAM_TSG_ID = "PANW_RED_TEAM_TSG_ID";
 var RED_TEAM_DATA_ENDPOINT = "PANW_RED_TEAM_DATA_ENDPOINT";
 var RED_TEAM_MGMT_ENDPOINT = "PANW_RED_TEAM_MGMT_ENDPOINT";
 var RED_TEAM_TOKEN_ENDPOINT = "PANW_RED_TEAM_TOKEN_ENDPOINT";
+var RED_TEAM_NETWORK_BROKER_ENDPOINT = "PANW_RED_TEAM_NETWORK_BROKER_ENDPOINT";
 var RED_TEAM_SCAN_PATH = "/v1/scan";
 var RED_TEAM_CATEGORIES_PATH = "/v1/categories";
 var RED_TEAM_REPORT_STATIC_PATH = "/v1/report/static";
@@ -96,6 +100,8 @@ var RED_TEAM_DASHBOARD_PATH = "/v1/dashboard";
 var RED_TEAM_QUOTA_PATH = "/v1/metering/quota";
 var RED_TEAM_ERROR_LOG_PATH = "/v1/error-log/job";
 var RED_TEAM_SENTIMENT_PATH = "/v1/sentiment";
+var RED_TEAM_LANGUAGES_PATH = "/v1/languages";
+var RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH = "/v1/error-log/target-profile";
 var RED_TEAM_TARGET_PATH = "/v1/target";
 var RED_TEAM_TARGET_VALIDATE_AUTH_PATH = "/v1/target/validate-auth";
 var RED_TEAM_TEMPLATE_PATH = "/v1/template";
@@ -104,6 +110,8 @@ var RED_TEAM_INSTANCES_PATH = "/v1/instances";
 var RED_TEAM_REGISTRY_CREDENTIALS_PATH = "/v1/registry-credentials";
 var RED_TEAM_CUSTOM_ATTACK_PATH = "/v1/custom-attack";
 var RED_TEAM_MGMT_DASHBOARD_PATH = "/v1/dashboard/overview";
+var RED_TEAM_CHANNELS_PATH = "/v1/channels";
+var RED_TEAM_CHANNELS_STATS_PATH = "/v1/channels/stats";
 
 // src/errors.ts
 var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
@@ -121,11 +129,15 @@ var AISecSDKException = class _AISecSDKException extends Error {
   /**
    * @param message - Human-readable error description.
    * @param errorType - Classification of the error.
+   * @param metadata - Optional transport failure metadata.
    */
-  constructor(message, errorType) {
+  constructor(message, errorType, metadata = {}) {
     super(errorType ? `${errorType}:${message}` : message);
     this.name = "AISecSDKException";
     this.errorType = errorType;
+    if (metadata.failureKind !== void 0) this.failureKind = metadata.failureKind;
+    if (metadata.statusCode !== void 0) this.statusCode = metadata.statusCode;
+    if (metadata.retryAfterMs !== void 0) this.retryAfterMs = metadata.retryAfterMs;
     if (Error.captureStackTrace) {
       Error.captureStackTrace(this, _AISecSDKException);
     }
@@ -267,6 +279,59 @@ function extractErrorMessage(body, status) {
     return body ? `API error ${status}: ${body}` : `API error ${status}`;
   }
 }
+function parseRetryAfterHeader(value) {
+  if (value === null) return void 0;
+  const normalized = value.trim();
+  if (/^\d+$/.test(normalized)) {
+    const milliseconds = Number(normalized) * 1e3;
+    return Number.isFinite(milliseconds) ? milliseconds : void 0;
+  }
+  const weekday = "(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)";
+  const longWeekday = "(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday)";
+  const month = "(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)";
+  const httpDatePatterns = [
+    new RegExp(`^${weekday}, \\d{2} ${month} \\d{4} \\d{2}:\\d{2}:\\d{2} GMT$`),
+    new RegExp(`^${longWeekday}, \\d{2}-${month}-\\d{2} \\d{2}:\\d{2}:\\d{2} GMT$`),
+    new RegExp(`^${weekday} ${month} [ \\d]\\d \\d{2}:\\d{2}:\\d{2} \\d{4}$`)
+  ];
+  if (!httpDatePatterns.some((pattern) => pattern.test(normalized))) return void 0;
+  const timestamp = Date.parse(normalized);
+  if (!Number.isFinite(timestamp)) return void 0;
+  return Math.max(0, timestamp - Date.now());
+}
+function parseRetryAfterBody(body) {
+  try {
+    const parsed = JSON.parse(body);
+    const interval = parsed.retry_after?.interval;
+    const unit = parsed.retry_after?.unit;
+    if (typeof interval !== "number" || !Number.isFinite(interval) || interval < 0)
+      return void 0;
+    if (typeof unit !== "string") return void 0;
+    const unitMultipliers = {
+      ms: 1,
+      msec: 1,
+      msecs: 1,
+      millisecond: 1,
+      milliseconds: 1,
+      s: 1e3,
+      sec: 1e3,
+      secs: 1e3,
+      second: 1e3,
+      seconds: 1e3,
+      m: 6e4,
+      min: 6e4,
+      mins: 6e4,
+      minute: 6e4,
+      minutes: 6e4
+    };
+    const multiplier = unitMultipliers[unit.toLowerCase()];
+    if (multiplier === void 0) return void 0;
+    const milliseconds = interval * multiplier;
+    return Number.isFinite(milliseconds) ? milliseconds : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function executeWithRetry(opts) {
   const { maxRetries, execute, onRetryableFailure } = opts;
   let lastError;
@@ -283,7 +348,8 @@ async function executeWithRetry(opts) {
       }
       throw new AISecSDKException(
         lastError.message ?? "Network error",
-        "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */
+        "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */,
+        { failureKind: "network" }
       );
     }
     if (response.ok) return response;
@@ -300,17 +366,53 @@ async function executeWithRetry(opts) {
     }
     const errorText = await response.text();
     const errorMessage = extractErrorMessage(errorText, response.status);
-    throw new AISecSDKException(errorMessage, classifyErrorType(response.status));
+    const retryAfterHeader = response.headers?.get?.("Retry-After") ?? null;
+    const headerRetryAfterMs = parseRetryAfterHeader(retryAfterHeader);
+    throw new AISecSDKException(errorMessage, classifyErrorType(response.status), {
+      failureKind: "http",
+      statusCode: response.status,
+      retryAfterMs: headerRetryAfterMs ?? parseRetryAfterBody(errorText)
+    });
   }
   throw new AISecSDKException(
     lastError?.message ?? "Max retries exceeded",
-    "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */
+    "AISEC_CLIENT_SIDE_ERROR" /* CLIENT_SIDE_ERROR */,
+    lastError ? { failureKind: "network" } : {}
   );
 }
 
+// src/http/debug.ts
+import { createHash } from "crypto";
+var TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+var SENSITIVE_HEADERS = /* @__PURE__ */ new Set([HEADER_AUTH_TOKEN.toLowerCase(), HEADER_API_KEY.toLowerCase()]);
+var PREFIX = "[airs-sdk]";
+function isDebugEnabled() {
+  const raw = process.env.PANW_AI_SEC_DEBUG;
+  return raw !== void 0 && TRUTHY.has(raw.trim().toLowerCase());
+}
+function hashToken(value) {
+  return "sha256:" + createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+function sanitizeHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? hashToken(value) : value;
+  }
+  return out;
+}
+function logRequest(method, url, headers, body) {
+  console.error(`${PREFIX} \u2192 ${method} ${url}`);
+  console.error(`${PREFIX}   headers ${JSON.stringify(sanitizeHeaders(headers))}`);
+  if (body !== void 0) console.error(`${PREFIX}   body ${body}`);
+}
+function logResponse(status, ms, body) {
+  console.error(`${PREFIX} \u2190 ${status} (${ms}ms)${body !== void 0 ? ` ${body}` : ""}`);
+}
+
 // src/http/request.ts
 async function request(spec) {
   let hasRetriedAuth = false;
+  const debug = isDebugEnabled();
   const response = await executeWithRetry({
     maxRetries: spec.numRetries,
     execute: async () => {
@@ -340,11 +442,25 @@ async function request(spec) {
       }
       const prepared = { method: spec.method, url, headers, bodyText };
       const final = await spec.auth.prepare(prepared);
-      return fetch(final.url.toString(), {
+      const startedAt = debug ? Date.now() : 0;
+      if (debug) {
+        const logBody = spec.formData !== void 0 ? "[multipart/form-data]" : final.bodyText;
+        logRequest(final.method, final.url.toString(), final.headers, logBody);
+      }
+      const res = await fetch(final.url.toString(), {
         method: final.method,
         headers: final.headers,
         body: spec.formData !== void 0 ? bodyForFetch : final.bodyText
       });
+      if (debug) {
+        let respBody;
+        try {
+          respBody = await res.clone().text();
+        } catch {
+        }
+        logResponse(res.status, Date.now() - startedAt, respBody);
+      }
+      return res;
     },
     onRetryableFailure: async (res) => {
       if (hasRetriedAuth) return false;
@@ -394,6 +510,7 @@ var PromptDetectedSchema = z.object({
   injection: z.boolean().optional(),
   toxic_content: z.boolean().optional(),
   malicious_code: z.boolean().optional(),
+  source_code: z.boolean().optional(),
   agent: z.boolean().optional(),
   topic_violation: z.boolean().optional()
 }).passthrough();
@@ -698,6 +815,16 @@ var ThreatScanReportSchema = z14.object({
 }).passthrough();
 
 // src/scan/scanner.ts
+function resolveNumRetries(opts) {
+  const numRetries = opts.numRetries ?? globalConfiguration.numRetries;
+  if (!Number.isFinite(numRetries) || !Number.isInteger(numRetries) || numRetries < 0 || numRetries > MAX_NUMBER_OF_RETRIES) {
+    throw new AISecSDKException(
+      `numRetries must be a finite integer between 0 and ${MAX_NUMBER_OF_RETRIES}`,
+      "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+    );
+  }
+  return numRetries;
+}
 var Scanner = class {
   /**
    * @internal
@@ -718,7 +845,7 @@ var Scanner = class {
    * Perform a synchronous content scan.
    * @param aiProfile - AI security profile to scan against.
    * @param content - Content to scan.
-   * @param opts - Optional transaction/session IDs and metadata.
+   * @param opts - Optional transaction/session IDs, metadata, and per-call retry override.
    * @returns Scan response with verdict, action, and detection details.
    * @example
    * ```ts
@@ -737,6 +864,7 @@ var Scanner = class {
    * ```
    */
   async syncScan(aiProfile, content, opts = {}) {
+    const numRetries = resolveNumRetries(opts);
     if (opts.trId && opts.trId.length > MAX_TRANSACTION_ID_STR_LENGTH) {
       throw new AISecSDKException(
         `trId exceeds max length of ${MAX_TRANSACTION_ID_STR_LENGTH}`,
@@ -763,33 +891,52 @@ var Scanner = class {
       body,
       responseSchema: ScanResponseSchema,
       auth: this.buildAuth(),
-      numRetries: globalConfiguration.numRetries
+      numRetries
     });
   }
   /**
-   * Submit content for asynchronous scanning.
-   * @param scanObjects - Array of scan objects (1–5 items).
-   * @returns Response containing scan IDs for later querying.
+   * Submit one batch of content for asynchronous scanning.
+   *
+   * The call accepts 1–5 request objects and returns one batch receipt. A batch `scan_id` can fan
+   * out to several unordered result rows. Correlate each row by `(scan_id, req_id)`, never array
+   * position or `scan_id` alone. The SDK preserves the server's row order and cardinality.
+   *
+   * Setting `numRetries: 0` guarantees one SDK fetch attempt, but cannot guarantee exactly-once
+   * server submission after an ambiguous network or 5xx failure.
+   * @param scanObjects - Array of scan objects (1–5 items), each with its own `req_id`.
+   * @param opts - Optional per-call retry override.
+   * @returns One batch receipt containing the shared scan ID for later querying.
    * @example
    * ```ts
    * import { init, Scanner } from '@cdot65/prisma-airs-sdk';
    * init();
    * const scanner = new Scanner();
    *
-   * const result = await scanner.asyncScan([
-   *   {
-   *     req_id: 1,
-   *     scan_req: {
-   *       ai_profile: { profile_name: 'my-profile' },
-   *       contents: [{ prompt: 'Tell me about machine learning.' }],
+   * const receipt = await scanner.asyncScan(
+   *   [
+   *     {
+   *       req_id: 1,
+   *       scan_req: {
+   *         ai_profile: { profile_name: 'my-profile' },
+   *         contents: [{ prompt: 'Tell me about machine learning.' }],
+   *       },
    *     },
-   *   },
-   * ]);
-   * // result =>
+   *     {
+   *       req_id: 2,
+   *       scan_req: {
+   *         ai_profile: { profile_name: 'my-profile' },
+   *         contents: [{ prompt: 'What are neural networks?' }],
+   *       },
+   *     },
+   *   ],
+   *   { numRetries: 0 },
+   * );
+   * // receipt =>
    * // { received: '2024-01-01T00:00:00Z', scan_id: '550e...' }
    * ```
    */
-  async asyncScan(scanObjects) {
+  async asyncScan(scanObjects, opts = {}) {
+    const numRetries = resolveNumRetries(opts);
     if (scanObjects.length < 1) {
       throw new AISecSDKException(
         "At least 1 scan object is required",
@@ -809,13 +956,17 @@ var Scanner = class {
       body: scanObjects,
       responseSchema: AsyncScanResponseSchema,
       auth: this.buildAuth(),
-      numRetries: globalConfiguration.numRetries
+      numRetries
     });
   }
   /**
    * Query scan results by scan IDs.
+   *
+   * One scan ID can return several unordered rows. Correlate them using `(scan_id, req_id)`. The
+   * SDK does not sort, deduplicate, or collapse the response.
    * @param scanIds - Array of scan UUIDs (1–5 items).
-   * @returns Array of scan results with status and response data.
+   * @param opts - Optional per-call retry override.
+   * @returns Every scan-result row in server order, with status and response data.
    * @example
    * ```ts
    * import { init, Scanner } from '@cdot65/prisma-airs-sdk';
@@ -825,12 +976,14 @@ var Scanner = class {
    * const results = await scanner.queryByScanIds([
    *   '550e8400-e29b-41d4-a716-446655440000',
    * ]);
-   * // results =>
-   * // [{ scan_id: '550e8400-e29b-41d4-a716-446655440000', status: 'complete',
-   * //    result: { category: 'benign', action: 'allow', ... } }]
+   * // A single scan ID may produce multiple rows, for example req_id 2 then req_id 1.
+   * for (const row of results) {
+   *   console.log(`${row.scan_id}:${row.req_id}`, row.status, row.result?.action);
+   * }
    * ```
    */
-  async queryByScanIds(scanIds) {
+  async queryByScanIds(scanIds, opts = {}) {
+    const numRetries = resolveNumRetries(opts);
     if (scanIds.length < 1) {
       throw new AISecSDKException(
         "At least 1 scan_id is required",
@@ -855,13 +1008,17 @@ var Scanner = class {
       params: { scan_ids: scanIds.join(",") },
       responseSchema: z15.array(ScanIdResultSchema),
       auth: this.buildAuth(),
-      numRetries: globalConfiguration.numRetries
+      numRetries
     });
   }
   /**
    * Query detailed threat reports by report IDs.
+   *
+   * One report ID can return several rows. Correlate them using `(report_id, req_id)`. The SDK
+   * preserves server order and cardinality without sorting or deduplicating.
    * @param reportIds - Array of report IDs (1–5 items).
-   * @returns Array of threat scan reports with detection details.
+   * @param opts - Optional per-call retry override.
+   * @returns Every report row in server order, with detection details.
    * @example
    * ```ts
    * import { init, Scanner } from '@cdot65/prisma-airs-sdk';
@@ -869,12 +1026,13 @@ var Scanner = class {
    * const scanner = new Scanner();
    *
    * const reports = await scanner.queryByReportIds(['R000...']);
-   * // reports =>
-   * // [{ report_id: 'R000...', scan_id: '550e...',
-   * //    detection_results: [{ detection_service: 'pi', verdict: 'benign', action: 'allow' }] }]
+   * for (const report of reports) {
+   *   console.log(`${report.report_id}:${report.req_id}`, report.detection_results);
+   * }
    * ```
    */
-  async queryByReportIds(reportIds) {
+  async queryByReportIds(reportIds, opts = {}) {
+    const numRetries = resolveNumRetries(opts);
     if (reportIds.length < 1) {
       throw new AISecSDKException(
         "At least 1 report_id is required",
@@ -894,7 +1052,7 @@ var Scanner = class {
       params: { report_ids: reportIds.join(",") },
       responseSchema: z15.array(ThreatScanReportSchema),
       auth: this.buildAuth(),
-      numRetries: globalConfiguration.numRetries
+      numRetries
     });
   }
 };
@@ -2306,7 +2464,8 @@ var ScanDetailsSchema = z32.object({
 var ScanCreateRequestSchema = z32.object({
   model_uri: z32.string(),
   security_group_uuid: z32.string(),
-  scan_origin: z32.string(),
+  // Optional per the OpenAPI spec (server defaults it); the scans-client example still sets it.
+  scan_origin: z32.string().optional(),
   allow_patterns: z32.array(z32.string()).nullable().optional(),
   ignore_patterns: z32.array(z32.string()).nullable().optional(),
   labels: z32.array(LabelSchema).nullable().optional(),
@@ -2325,7 +2484,8 @@ var ScanBaseResponseSchema = z32.object({
   scan_origin: z32.string(),
   security_group_uuid: z32.string(),
   security_group_name: z32.string(),
-  model_version_uuid: z32.string(),
+  // Optional per the OpenAPI spec — a scan may not have a resolved model version yet.
+  model_version_uuid: z32.string().nullable().optional(),
   eval_outcome: z32.string(),
   source_type: z32.string(),
   created_by: z32.string().nullable().optional(),
@@ -2362,6 +2522,50 @@ var FileListSchema = z32.object({
   pagination: ModelSecurityPaginationSchema,
   files: z32.array(FileResponseSchema)
 }).passthrough();
+var ModelResponseSchema = z32.object({
+  uuid: z32.string(),
+  tsg_id: z32.string(),
+  created_at: z32.string(),
+  updated_at: z32.string(),
+  name: z32.string(),
+  latest_version_uuid: z32.string().nullable().optional(),
+  latest_version_fingerprint: z32.string().nullable().optional(),
+  latest_version_revision: z32.string().nullable().optional(),
+  latest_version_hf_commit_sha: z32.string().nullable().optional(),
+  latest_version_outcome: z32.string().nullable().optional(),
+  latest_version_formats: z32.array(z32.string()).nullable().optional(),
+  latest_version_source_types: z32.array(z32.string()).nullable().optional(),
+  latest_version_scan_time: z32.string().nullable().optional()
+}).passthrough();
+var ModelListSchema = z32.object({
+  pagination: ModelSecurityPaginationSchema,
+  models: z32.array(ModelResponseSchema)
+}).passthrough();
+var ModelVersionResponseSchema = z32.object({
+  uuid: z32.string(),
+  tsg_id: z32.string(),
+  created_at: z32.string(),
+  updated_at: z32.string(),
+  revision: z32.string(),
+  model_uuid: z32.string(),
+  fingerprint: z32.string().nullable().optional(),
+  file_count: z32.number().int().nullable().optional(),
+  license: z32.string().nullable().optional(),
+  latest_scan_time: z32.string().nullable().optional(),
+  hf_commit_sha: z32.string().nullable().optional(),
+  hf_commit_title: z32.string().nullable().optional(),
+  hf_commit_authors: z32.array(z32.string()).nullable().optional(),
+  hf_model_name: z32.string().nullable().optional(),
+  hf_organization: z32.string().nullable().optional(),
+  model_formats: z32.array(z32.string()).nullable().optional(),
+  source_types: z32.array(z32.string()).nullable().optional(),
+  last_eval_outcome: z32.string().nullable().optional(),
+  last_eval_summary: EvalSummarySchema.nullable().optional()
+}).passthrough();
+var ModelVersionListSchema = z32.object({
+  pagination: ModelSecurityPaginationSchema,
+  model_versions: z32.array(ModelVersionResponseSchema)
+}).passthrough();
 var RuleEvaluationResponseSchema = z32.object({
   uuid: z32.string(),
   tsg_id: z32.string(),
@@ -2379,6 +2583,10 @@ var RuleEvaluationListSchema = z32.object({
   pagination: ModelSecurityPaginationSchema,
   evaluations: z32.array(RuleEvaluationResponseSchema)
 }).passthrough();
+var ViolationRemediationSchema = z32.object({
+  steps: z32.array(z32.string()),
+  url: z32.string()
+}).passthrough();
 var ViolationResponseSchema = z32.object({
   uuid: z32.string(),
   tsg_id: z32.string(),
@@ -2389,6 +2597,7 @@ var ViolationResponseSchema = z32.object({
   rule_name: z32.string(),
   rule_description: z32.string(),
   rule_instance_state: z32.string(),
+  remediation: ViolationRemediationSchema,
   file: z32.string().nullable().optional(),
   hash: z32.string().nullable().optional(),
   module: z32.string().nullable().optional(),
@@ -2524,6 +2733,11 @@ var BrandSubCategory = {
   DISCRIMINATING_CLAIMS: "DISCRIMINATING_CLAIMS",
   POLITICAL_ENDORSEMENTS: "POLITICAL_ENDORSEMENTS"
 };
+var ChannelStatus = {
+  ONLINE: "ONLINE",
+  OFFLINE: "OFFLINE",
+  DRAFT: "DRAFT"
+};
 var ComplianceSubCategory = {
   OWASP: "OWASP",
   MITRE_ATLAS: "MITRE_ATLAS",
@@ -3347,6 +3561,12 @@ var ErrorLogSchema = z33.object({
   version: z33.number().int().optional()
 }).passthrough();
 var ErrorLogListResponseSchema = z33.object({ pagination: RedTeamPaginationSchema, data: z33.array(ErrorLogSchema) }).passthrough();
+var LanguageOptionSchema = z33.object({ code: z33.string(), name: z33.string() }).passthrough();
+var TenantLanguagesResponseSchema = z33.object({
+  multilingual_enabled: z33.boolean(),
+  supported_job_types: z33.array(z33.string()),
+  languages: z33.array(LanguageOptionSchema)
+}).passthrough();
 var TargetRequestBaseFields = {
   name: z33.string(),
   description: z33.string().nullable().optional(),
@@ -3701,6 +3921,48 @@ var RegistryCredentialsSchema = z33.object({
   expiry: z33.string()
 }).passthrough();
 
+// src/models/red-team-network-broker.ts
+import { z as z34 } from "zod";
+var ChannelStatusSchema = z34.nativeEnum(ChannelStatus);
+var CreateChannelRequestSchema = z34.object({
+  name: z34.string(),
+  description: z34.string().optional()
+}).passthrough();
+var UpdateChannelRequestSchema = z34.object({
+  name: z34.string().optional(),
+  description: z34.string().optional()
+}).passthrough();
+var ChannelSchema = z34.object({
+  uuid: z34.string().optional(),
+  name: z34.string().nullable().optional(),
+  description: z34.string().nullable().optional(),
+  // Kept as a plain string (not the enum) so unknown upstream statuses never fail parsing.
+  status: z34.string().nullable().optional(),
+  added_by: z34.string().nullable().optional(),
+  created_at: z34.string().nullable().optional(),
+  updated_at: z34.string().nullable().optional(),
+  last_online_at: z34.string().nullable().optional(),
+  // Present on live responses (not in the base OpenAPI Channel schema).
+  connected_clients_count: z34.number().int().nullable().optional(),
+  outdated_clients_count: z34.number().int().nullable().optional(),
+  features: z34.record(z34.boolean()).nullable().optional()
+}).passthrough();
+var ChannelListPaginationSchema = z34.object({ total_items: z34.number().int().nullable().optional() }).passthrough();
+var ChannelListResponseSchema = z34.object({
+  pagination: ChannelListPaginationSchema.optional(),
+  data: z34.array(ChannelSchema).default([])
+}).passthrough();
+var ChannelStatsSchema = z34.object({
+  network_channels_server_domain: z34.string().nullable().optional(),
+  docker_registry: z34.string().nullable().optional(),
+  helm_chart: z34.string().nullable().optional(),
+  docker_image: z34.string().nullable().optional(),
+  online_channels: z34.number().int().nullable().optional(),
+  total_channels: z34.number().int().nullable().optional(),
+  // Present on live responses (not in the base OpenAPI ChannelStats schema).
+  client_version: z34.string().nullable().optional()
+}).passthrough();
+
 // src/http/auth/oauth.ts
 var OAuthAuth = class {
   constructor(oauthClient) {
@@ -3723,12 +3985,12 @@ var OAuthAuth = class {
 };
 
 // src/models/oauth-token.ts
-import { z as z34 } from "zod";
-var OAuthTokenResponseSchema = z34.object({
-  access_token: z34.string(),
-  token_type: z34.string().optional(),
-  expires_in: z34.number(),
-  scope: z34.string().optional()
+import { z as z35 } from "zod";
+var OAuthTokenResponseSchema = z35.object({
+  access_token: z35.string(),
+  token_type: z35.string().optional(),
+  expires_in: z35.number(),
+  scope: z35.string().optional()
 }).passthrough();
 
 // src/management/oauth-client.ts
@@ -4519,7 +4781,7 @@ var CustomerAppsClient = class {
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MGMT_CUSTOMER_APPS_TSG_PATH}/${this.tsgId}`,
+      path: `${MGMT_CUSTOMER_APPS_TSG_PATH}/${encodeURIComponent(this.tsgId)}`,
       params,
       responseSchema: CustomerAppListResponseSchema,
       auth: this.auth,
@@ -4713,7 +4975,7 @@ var ScanLogsClient = class {
 };
 
 // src/management/oauth-management.ts
-import { z as z35 } from "zod";
+import { z as z36 } from "zod";
 var OAuthManagementClient = class {
   baseUrl;
   auth;
@@ -4747,7 +5009,7 @@ var OAuthManagementClient = class {
       path: MGMT_OAUTH_INVALIDATE_PATH,
       params: { token },
       body,
-      responseSchema: z35.string(),
+      responseSchema: z36.string(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6375,6 +6637,170 @@ var ModelSecurityRulesClient = class {
   }
 };
 
+// src/model-security/models-client.ts
+function buildModelListParams(opts) {
+  const params = serializeListing(opts);
+  if (opts?.search_query !== void 0) params.search_query = opts.search_query;
+  if (opts?.sort_field !== void 0) params.sort_field = opts.sort_field;
+  if (opts?.sort_order !== void 0) params.sort_order = opts.sort_order;
+  if (opts?.latest_version_outcomes !== void 0)
+    params.latest_version_outcomes = opts.latest_version_outcomes;
+  if (opts?.latest_version_formats !== void 0)
+    params.latest_version_formats = opts.latest_version_formats;
+  if (opts?.latest_version_source_types !== void 0)
+    params.latest_version_source_types = opts.latest_version_source_types;
+  if (opts?.latest_version_scan_time_before !== void 0)
+    params.latest_version_scan_time_before = opts.latest_version_scan_time_before;
+  if (opts?.start_time !== void 0) params.start_time = opts.start_time;
+  if (opts?.end_time !== void 0) params.end_time = opts.end_time;
+  return params;
+}
+var ModelSecurityModelsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List models with optional search, sort, and latest-version filters.
+   * @param opts - Pagination and filter options.
+   * @returns Paginated list of models.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const models = await ms.models.listModels({ limit: 10, search_query: 'llama' });
+   * // models =>
+   * // { pagination: { total_items: 3 }, models: [{ uuid: '550e8400-...', name: 'org/llama', latest_version_outcome: 'PASSED' }] }
+   * ```
+   */
+  async listModels(opts) {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: MODEL_SEC_MODELS_PATH,
+      params: buildModelListParams(opts),
+      responseSchema: ModelListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a single model by UUID.
+   * @param uuid - Model UUID.
+   * @returns The model.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const model = await ms.models.getModel('550e8400-e29b-41d4-a716-446655440000');
+   * // model =>
+   * // { uuid: '550e8400-...', name: 'org/model', latest_version_uuid: '660e8400-...', latest_version_outcome: 'PASSED' }
+   * ```
+   */
+  async getModel(uuid) {
+    assertUuid(uuid, "model uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODELS_PATH}/${uuid}`,
+      responseSchema: ModelResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List the versions of a model.
+   * @param modelUuid - Model UUID.
+   * @param opts - Pagination and sort options.
+   * @returns Paginated list of model versions.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const versions = await ms.models.listModelVersions('550e8400-e29b-41d4-a716-446655440000', {
+   *   sort_order: 'desc',
+   * });
+   * // versions =>
+   * // { pagination: { total_items: 2 }, model_versions: [{ uuid: '660e8400-...', revision: 'main', file_count: 12 }] }
+   * ```
+   */
+  async listModelVersions(modelUuid, opts) {
+    assertUuid(modelUuid, "model uuid");
+    const params = serializeListing(opts);
+    if (opts?.sort_order !== void 0) params.sort_order = opts.sort_order;
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODELS_PATH}/${modelUuid}/model-versions`,
+      params,
+      responseSchema: ModelVersionListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a single model version by UUID.
+   * @param uuid - Model version UUID.
+   * @returns The model version.
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const version = await ms.models.getModelVersion('660e8400-e29b-41d4-a716-446655440000');
+   * // version =>
+   * // { uuid: '660e8400-...', revision: 'main', model_uuid: '550e8400-...', last_eval_outcome: 'PASSED' }
+   * ```
+   */
+  async getModelVersion(uuid) {
+    assertUuid(uuid, "model version uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${uuid}`,
+      responseSchema: ModelVersionResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List the files of a model version.
+   * @param modelVersionUuid - Model version UUID.
+   * @param opts - Pagination options.
+   * @returns Paginated list of files (same shape as scan files).
+   * @example
+   * ```ts
+   * import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';
+   * const ms = new ModelSecurityClient();
+   *
+   * const files = await ms.models.listModelVersionFiles('660e8400-e29b-41d4-a716-446655440000', {
+   *   limit: 50,
+   * });
+   * // files =>
+   * // { pagination: { total_items: 12 }, files: [{ uuid: '770e8400-...', path: '/model.safetensors', type: 'FILE', result: 'SUCCESS' }] }
+   * ```
+   */
+  async listModelVersionFiles(modelVersionUuid, opts) {
+    assertUuid(modelVersionUuid, "model version uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${modelVersionUuid}/files`,
+      params: serializeListing(opts),
+      responseSchema: FileListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
 // src/model-security/client.ts
 var ModelSecurityClient = class {
   /** Data plane scan operations. */
@@ -6383,6 +6809,8 @@ var ModelSecurityClient = class {
   securityGroups;
   /** Management plane security rule operations (read-only). */
   securityRules;
+  /** Data plane model and model-version operations (read-only). */
+  models;
   mgmtEndpoint;
   auth;
   numRetries;
@@ -6404,6 +6832,7 @@ var ModelSecurityClient = class {
     this.mgmtEndpoint = mgmtEndpoint;
     this.numRetries = numRetries;
     this.scans = new ModelSecurityScansClient({ baseUrl: dataEndpoint, auth, numRetries });
+    this.models = new ModelSecurityModelsClient({ baseUrl: dataEndpoint, auth, numRetries });
     this.securityGroups = new ModelSecurityGroupsClient({
       baseUrl: mgmtEndpoint,
       auth,
@@ -6441,7 +6870,7 @@ var ModelSecurityClient = class {
 };
 
 // src/red-team/scans-client.ts
-import { z as z36 } from "zod";
+import { z as z37 } from "zod";
 var RedTeamScansClient = class {
   baseUrl;
   auth;
@@ -6578,7 +7007,7 @@ var RedTeamScansClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: RED_TEAM_CATEGORIES_PATH,
-      responseSchema: z36.array(CategoryModelSchema),
+      responseSchema: z37.array(CategoryModelSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6586,7 +7015,7 @@ var RedTeamScansClient = class {
 };
 
 // src/red-team/reports-client.ts
-import { z as z37 } from "zod";
+import { z as z38 } from "zod";
 var RedTeamReportsClient = class {
   baseUrl;
   auth;
@@ -6961,7 +7390,7 @@ var RedTeamReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/download`,
       params: { file_format: format },
-      responseSchema: z37.unknown(),
+      responseSchema: z38.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6985,7 +7414,7 @@ var RedTeamReportsClient = class {
       method: "POST",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/generate-partial-report`,
-      responseSchema: z37.unknown(),
+      responseSchema: z38.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6993,7 +7422,7 @@ var RedTeamReportsClient = class {
 };
 
 // src/red-team/custom-attack-reports-client.ts
-import { z as z38 } from "zod";
+import { z as z39 } from "zod";
 var RedTeamCustomAttackReportsClient = class {
   baseUrl;
   auth;
@@ -7083,7 +7512,7 @@ var RedTeamCustomAttackReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/report/${jobId}/prompt-set/${promptSetId}/prompts`,
       params,
-      responseSchema: z38.array(PromptDetailResponseSchema),
+      responseSchema: z39.array(PromptDetailResponseSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7177,7 +7606,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/attack/${attackId}/list-outputs`,
-      responseSchema: z38.array(CustomAttackOutputSchema),
+      responseSchema: z39.array(CustomAttackOutputSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7202,7 +7631,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/property-stats`,
-      responseSchema: z38.array(PropertyStatisticSchema),
+      responseSchema: z39.array(PropertyStatisticSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7210,7 +7639,7 @@ var RedTeamCustomAttackReportsClient = class {
 };
 
 // src/red-team/targets-client.ts
-import { z as z39 } from "zod";
+import { z as z40 } from "zod";
 var RedTeamTargetsClient = class {
   baseUrl;
   auth;
@@ -7503,7 +7932,7 @@ var RedTeamTargetsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_TEMPLATE_PATH}/target-metadata`,
-      responseSchema: z39.record(z39.unknown()),
+      responseSchema: z40.record(z40.unknown()),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8452,6 +8881,155 @@ var RedTeamInstancesClient = class {
   }
 };
 
+// src/red-team/network-broker-client.ts
+var RedTeamNetworkBrokerClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List network broker channels with optional filters.
+   * @param opts - Optional pagination, search, and status filter options.
+   * @returns The paginated list of channels.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channels = await rt.networkBroker.listChannels({ status: ['ONLINE', 'DRAFT'], limit: 10 });
+   * // channels =>
+   * // { pagination: { total_items: 2 }, data: [{ uuid: '550e8400-...', name: 'prod-broker', status: 'ONLINE' }] }
+   * ```
+   */
+  async listChannels(opts) {
+    const params = serializeListing(opts);
+    if (opts?.status !== void 0) {
+      params.status = Array.isArray(opts.status) ? opts.status : [opts.status];
+    }
+    if (opts?.include_all_if_empty !== void 0) {
+      params.include_all_if_empty = String(opts.include_all_if_empty);
+    }
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_CHANNELS_PATH,
+      params,
+      responseSchema: ChannelListResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Create a network broker channel.
+   * @param body - Channel creation request body (requires `name`).
+   * @returns The created channel.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channel = await rt.networkBroker.createChannel({
+   *   name: 'prod-broker',
+   *   description: 'Production network broker channel',
+   * });
+   * // channel =>
+   * // { uuid: '550e8400-...', name: 'prod-broker', status: 'DRAFT' }
+   * ```
+   */
+  async createChannel(body) {
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_CHANNELS_PATH,
+      body,
+      responseSchema: ChannelSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get network broker channel stats.
+   * @returns The channel stats (broker server, registry, chart, image, channel counts).
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const stats = await rt.networkBroker.getChannelStats();
+   * // stats =>
+   * // { network_channels_server_domain: 'broker.example.com', online_channels: 3, total_channels: 5, client_version: '1.4.0' }
+   * ```
+   */
+  async getChannelStats() {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_CHANNELS_STATS_PATH,
+      responseSchema: ChannelStatsSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a network broker channel by UUID.
+   * @param channelId - The channel UUID.
+   * @returns The channel.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channel = await rt.networkBroker.getChannel('550e8400-e29b-41d4-a716-446655440000');
+   * // channel =>
+   * // { uuid: '550e8400-...', name: 'prod-broker', status: 'ONLINE' }
+   * ```
+   */
+  async getChannel(channelId) {
+    assertUuid(channelId, "channel id");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_CHANNELS_PATH}/${channelId}`,
+      responseSchema: ChannelSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update a network broker channel's name or description.
+   * @param channelId - The channel UUID.
+   * @param body - Channel update request body.
+   * @returns The updated channel.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const channel = await rt.networkBroker.updateChannel('550e8400-e29b-41d4-a716-446655440000', {
+   *   description: 'Updated description',
+   * });
+   * // channel =>
+   * // { uuid: '550e8400-...', name: 'prod-broker', description: 'Updated description', status: 'ONLINE' }
+   * ```
+   */
+  async updateChannel(channelId, body) {
+    assertUuid(channelId, "channel id");
+    return request({
+      method: "PATCH",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_CHANNELS_PATH}/${channelId}`,
+      body,
+      responseSchema: ChannelSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
 // src/red-team/client.ts
 var RedTeamClient = class {
   /** Data plane scan operations. */
@@ -8468,6 +9046,8 @@ var RedTeamClient = class {
   eula;
   /** Management plane instance/licensing operations. */
   instances;
+  /** Network broker channel operations (distinct network broker base URL). */
+  networkBroker;
   dataEndpoint;
   mgmtEndpoint;
   auth;
@@ -8475,6 +9055,7 @@ var RedTeamClient = class {
   constructor(opts = {}) {
     const dataEndpoint = opts.dataEndpoint ?? process.env[RED_TEAM_DATA_ENDPOINT] ?? DEFAULT_RED_TEAM_DATA_ENDPOINT;
     const mgmtEndpoint = opts.mgmtEndpoint ?? process.env[RED_TEAM_MGMT_ENDPOINT] ?? DEFAULT_RED_TEAM_MGMT_ENDPOINT;
+    const networkBrokerEndpoint = opts.networkBrokerEndpoint ?? process.env[RED_TEAM_NETWORK_BROKER_ENDPOINT] ?? DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT;
     const { oauthClient, numRetries } = resolveOAuthConfig({
       clientId: opts.clientId,
       clientSecret: opts.clientSecret,
@@ -8505,6 +9086,11 @@ var RedTeamClient = class {
     });
     this.eula = new RedTeamEulaClient({ baseUrl: mgmtEndpoint, auth, numRetries });
     this.instances = new RedTeamInstancesClient({ baseUrl: mgmtEndpoint, auth, numRetries });
+    this.networkBroker = new RedTeamNetworkBrokerClient({
+      baseUrl: networkBrokerEndpoint,
+      auth,
+      numRetries
+    });
   }
   // -----------------------------------------------------------------------
   // Data plane convenience methods
@@ -8613,6 +9199,82 @@ var RedTeamClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * List profiling error logs for a target (data plane).
+   * @param targetId - The target UUID.
+   * @param opts - Optional pagination/search options (the endpoint honors `limit`).
+   * @returns The paginated list of target-profile error logs.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const logs = await rt.getTargetProfileErrorLogs('550e8400-e29b-41d4-a716-446655440000', { limit: 10 });
+   * // logs =>
+   * // { pagination: { total_items: 1 }, data: [{ target_id: '550e8400-...', error_type: 'PROBE', error_message: '...', created_at: '2025-01-01T00:00:00Z' }] }
+   * ```
+   */
+  async getTargetProfileErrorLogs(targetId, opts) {
+    assertUuid(targetId, "target id");
+    return request({
+      method: "GET",
+      baseUrl: this.dataEndpoint,
+      path: `${RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH}/${targetId}`,
+      params: serializeListing(opts),
+      responseSchema: ErrorLogListResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get the tenant's allowed languages for Red Team scans (data plane).
+   * @returns The supported-languages response.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const langs = await rt.getLanguages();
+   * // langs =>
+   * // { multilingual_enabled: true, supported_job_types: ['STATIC', 'DYNAMIC'],
+   * //   languages: [{ code: 'en', name: 'English' }, { code: 'es', name: 'Spanish' }] }
+   * ```
+   */
+  async getLanguages() {
+    return request({
+      method: "GET",
+      baseUrl: this.dataEndpoint,
+      path: RED_TEAM_LANGUAGES_PATH,
+      responseSchema: TenantLanguagesResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get the tenant's allowed languages from the management plane.
+   * Same response shape as {@link RedTeamClient.getLanguages}, served from the management endpoint.
+   * @returns The supported-languages response.
+   * @example
+   * ```ts
+   * import { RedTeamClient } from '@cdot65/prisma-airs-sdk';
+   * const rt = new RedTeamClient();
+   *
+   * const langs = await rt.getManagementLanguages();
+   * // langs =>
+   * // { multilingual_enabled: true, supported_job_types: ['STATIC', 'DYNAMIC'],
+   * //   languages: [{ code: 'en', name: 'English' }] }
+   * ```
+   */
+  async getManagementLanguages() {
+    return request({
+      method: "GET",
+      baseUrl: this.mgmtEndpoint,
+      path: RED_TEAM_LANGUAGES_PATH,
+      responseSchema: TenantLanguagesResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Update sentiment for a scan report.
    * @param body - The sentiment request body.
@@ -8740,6 +9402,12 @@ export {
   CategoryModelSchema,
   CategoryReportSchema,
   CgReportSchema,
+  ChannelListPaginationSchema,
+  ChannelListResponseSchema,
+  ChannelSchema,
+  ChannelStatsSchema,
+  ChannelStatus,
+  ChannelStatusSchema,
   ClientIdAndCustomerAppSchema,
   CmdEntrySchema,
   CmdInjectReportSchema,
@@ -8753,6 +9421,7 @@ export {
   ContentErrorType,
   CountByNameSchema,
   CountedQuotaEnum,
+  CreateChannelRequestSchema,
   CreateCustomTopicRequestSchema,
   CreateSecurityProfileRequestSchema,
   CustomAttackOutputSchema,
@@ -8787,6 +9456,7 @@ export {
   DEFAULT_MODEL_SEC_MGMT_ENDPOINT,
   DEFAULT_RED_TEAM_DATA_ENDPOINT,
   DEFAULT_RED_TEAM_MGMT_ENDPOINT,
+  DEFAULT_RED_TEAM_NETWORK_BROKER_ENDPOINT,
   DEFAULT_TOKEN_ENDPOINT,
   DLP_DATA_FILTERING_PROFILES_PATH,
   DLP_DATA_PATTERNS_PATH,
@@ -8928,6 +9598,7 @@ export {
   LabelValueListSchema,
   LabelsCreateRequestSchema,
   LabelsResponseSchema,
+  LanguageOptionSchema,
   ListModelSecurityGroupsResponseSchema,
   ListModelSecurityRuleInstancesResponseSchema,
   ListModelSecurityRulesResponseSchema,
@@ -8973,6 +9644,8 @@ export {
   MODEL_SEC_DATA_ENDPOINT,
   MODEL_SEC_EVALUATIONS_PATH,
   MODEL_SEC_MGMT_ENDPOINT,
+  MODEL_SEC_MODELS_PATH,
+  MODEL_SEC_MODEL_VERSIONS_PATH,
   MODEL_SEC_PYPI_AUTH_PATH,
   MODEL_SEC_SCANS_PATH,
   MODEL_SEC_SECURITY_GROUPS_PATH,
@@ -8989,7 +9662,9 @@ export {
   MetadataCriterionSchema,
   MetadataSchema,
   ModelConfigurationSchema,
+  ModelListSchema,
   ModelProtectionItemSchema,
+  ModelResponseSchema,
   ModelScanIssueSchema,
   ModelScanStatus,
   ModelSecurityClient,
@@ -8998,12 +9673,15 @@ export {
   ModelSecurityGroupState,
   ModelSecurityGroupUpdateRequestSchema,
   ModelSecurityGroupsClient,
+  ModelSecurityModelsClient,
   ModelSecurityPaginationSchema,
   ModelSecurityRuleInstanceResponseSchema,
   ModelSecurityRuleInstanceUpdateRequestSchema,
   ModelSecurityRuleResponseSchema,
   ModelSecurityRulesClient,
   ModelSecurityScansClient,
+  ModelVersionListSchema,
+  ModelVersionResponseSchema,
   MultiProfileDataNodeSchema,
   MultiProfileDetectionRuleSchema,
   MultiTurnStatefulConfigSchema,
@@ -9048,6 +9726,8 @@ export {
   QuotaDetailsSchema,
   QuotaSummarySchema,
   RED_TEAM_CATEGORIES_PATH,
+  RED_TEAM_CHANNELS_PATH,
+  RED_TEAM_CHANNELS_STATS_PATH,
   RED_TEAM_CLIENT_ID,
   RED_TEAM_CLIENT_SECRET,
   RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH,
@@ -9055,10 +9735,13 @@ export {
   RED_TEAM_DASHBOARD_PATH,
   RED_TEAM_DATA_ENDPOINT,
   RED_TEAM_ERROR_LOG_PATH,
+  RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH,
   RED_TEAM_EULA_PATH,
   RED_TEAM_INSTANCES_PATH,
+  RED_TEAM_LANGUAGES_PATH,
   RED_TEAM_MGMT_DASHBOARD_PATH,
   RED_TEAM_MGMT_ENDPOINT,
+  RED_TEAM_NETWORK_BROKER_ENDPOINT,
   RED_TEAM_QUOTA_PATH,
   RED_TEAM_REGISTRY_CREDENTIALS_PATH,
   RED_TEAM_REPORT_DYNAMIC_PATH,
@@ -9078,6 +9761,7 @@ export {
   RedTeamErrorType,
   RedTeamEulaClient,
   RedTeamInstancesClient,
+  RedTeamNetworkBrokerClient,
   RedTeamPaginationSchema,
   RedTeamReportsClient,
   RedTeamScansClient,
@@ -9180,6 +9864,7 @@ export {
   TargetType,
   TargetUpdateRequestSchema,
   TcReportSchema,
+  TenantLanguagesResponseSchema,
   TgReportSchema,
   ThreatCategory,
   ThreatScanReportSchema,
@@ -9195,11 +9880,13 @@ export {
   TopicsClient,
   URLExclusionSchema,
   USER_AGENT,
+  UpdateChannelRequestSchema,
   UrlCategorySchema,
   UrlfEntrySchema,
   ValidationErrorSchema,
   Verdict,
   ViolationListSchema,
+  ViolationRemediationSchema,
   ViolationResponseSchema,
   ViolationSeverityCountsSchema,
   WebSocketConnectionParamsSchema,