@cdot65/prisma-airs-sdk 0.13.2 → 0.14.1

package/dist/index.js

@@ -29,7 +29,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 20;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.13.2";
+var SDK_VERSION = "0.14.1";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -112,6 +112,55 @@ var RED_TEAM_CUSTOM_ATTACK_PATH = "/v1/custom-attack";
 var RED_TEAM_MGMT_DASHBOARD_PATH = "/v1/dashboard/overview";
 var RED_TEAM_CHANNELS_PATH = "/v1/channels";
 var RED_TEAM_CHANNELS_STATS_PATH = "/v1/channels/stats";
+var DEFAULT_AI_GW_DATA_ENDPOINT = "https://api.apps.paloaltonetworks.com/ai_gw/v2";
+var DEFAULT_AI_GW_ADMIN_ENDPOINT = "https://api.apps.paloaltonetworks.com/ai_gw/admin/v2";
+var AI_GW_DATA_ENDPOINT = "PANW_AI_GW_DATA_ENDPOINT";
+var AI_GW_ADMIN_ENDPOINT = "PANW_AI_GW_ADMIN_ENDPOINT";
+var TSG_ID_HEADER = "x-tsg-id";
+var AI_GW_WORKSPACES_PATH = "/workspaces";
+var AI_GW_CONFIGS_PATH = "/configs";
+var AI_GW_GUARDRAILS_PATH = "/guardrails";
+var AI_GW_PROVIDERS_PATH = "/providers";
+var AI_GW_API_KEYS_SERVICE_PATH = "/api-keys/service";
+var AI_GW_API_KEYS_USER_PATH = "/api-keys/user";
+var AI_GW_LOGS_PATH = "/logs";
+var AI_GW_CHARTS_PATH = "/logs/charts";
+var AI_GW_GROUPS_PATH = "/logs/groups";
+var AI_GW_INTEGRATIONS_PATH = "/integrations";
+var AI_GW_MCP_INTEGRATIONS_PATH = "/mcp-integrations";
+var AI_GW_DEPLOYMENTS_PATH = "/deployments";
+var AI_GW_PLUGINS_PATH = "/plugins";
+var AI_GW_ORGANISATIONS_SELF_PATH = "/organisations/self";
+var AI_GW_AUDIT_LOGS_PATH = "/audit-logs";
+function aiGwOrganisationsAuthSettingsPath(tsgId) {
+  return `/organisations/${tsgId}/auth-settings`;
+}
+var AI_GW_CHART_METRICS = [
+  "cost",
+  "requests",
+  "latency",
+  "tokens",
+  "errors",
+  "users",
+  "cache-summary",
+  "cache-hit-trend",
+  "user-trends",
+  "error-trends",
+  "rescued-retries",
+  "feedback-trend",
+  "feedback-weighted",
+  "feedback-score-distribution",
+  "feedback-models"
+];
+var AI_GW_GROUP_DIMENSIONS = ["ai_service", "model", "api_key", "provider"];
+var AI_GW_GROUP_COLUMNS = [
+  "cost",
+  "avg_latency",
+  "avg_tokens",
+  "total_tokens",
+  "success_rate",
+  "last_seen"
+];
 
 // src/errors.ts
 var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
@@ -274,7 +323,10 @@ function classifyErrorType(status) {
 function extractErrorMessage(body, status) {
   try {
     const parsed = JSON.parse(body);
-    return parsed.error_message ?? parsed.message ?? parsed.error?.message ?? `API error ${status}`;
+    const data = parsed.data;
+    const code = data?.errorCode ?? void 0;
+    const base = parsed.error_message ?? parsed.message ?? data?.message ?? parsed.error?.message ?? parsed.msg ?? `API error ${status}`;
+    return code ? `${base} (errorCode: ${code})` : base;
   } catch {
     return body ? `API error ${status}: ${body}` : `API error ${status}`;
   }
@@ -3963,6 +4015,469 @@ var ChannelStatsSchema = z34.object({
   client_version: z34.string().nullable().optional()
 }).passthrough();
 
+// src/models/ai-gateway.ts
+import { z as z35 } from "zod";
+var aiGatewayEnvelope = (data) => z35.object({ success: z35.boolean(), data }).passthrough();
+var aiGatewayList = (item) => z35.object({
+  object: z35.string(),
+  total: z35.number(),
+  has_more: z35.boolean().optional(),
+  data: z35.array(item)
+}).passthrough();
+var aiGatewayGroupList = (item) => z35.object({
+  object: z35.string(),
+  is_quota_exceeded: z35.boolean(),
+  total: z35.number(),
+  data: z35.array(item)
+}).passthrough();
+var quotaFlag = { isQuotaExceeded: z35.boolean() };
+var GatewayChartRecordSchema = z35.object({ x: z35.string(), y: z35.number(), avg: z35.number().optional() }).passthrough();
+var CostChartResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    records: z35.array(GatewayChartRecordSchema),
+    total: z35.number(),
+    avg: z35.number(),
+    ...quotaFlag
+  }).passthrough()
+);
+var CountChartResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    records: z35.array(GatewayChartRecordSchema),
+    total: z35.number().nullable(),
+    ...quotaFlag
+  }).passthrough()
+);
+var LatencyChartResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    records: z35.array(
+      z35.object({
+        x: z35.string(),
+        y: z35.number(),
+        p50: z35.number(),
+        p90: z35.number(),
+        p99: z35.number()
+      }).passthrough()
+    ),
+    total: z35.number(),
+    p50: z35.number(),
+    p90: z35.number(),
+    p99: z35.number(),
+    ...quotaFlag
+  }).passthrough()
+);
+var TokensChartResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    records: z35.array(
+      z35.object({
+        x: z35.string(),
+        y: z35.number(),
+        total_request_units: z35.number(),
+        total_response_units: z35.number(),
+        avg: z35.number()
+      }).passthrough()
+    ),
+    total: z35.number(),
+    avg: z35.number(),
+    total_request_units: z35.number(),
+    total_response_units: z35.number(),
+    ...quotaFlag
+  }).passthrough()
+);
+var CacheSummaryResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    summary: z35.object({
+      cacheHits: z35.number(),
+      avgCacheLatency: z35.number().nullable(),
+      totalRequests: z35.number(),
+      cacheSpeedup: z35.number()
+    }).passthrough(),
+    ...quotaFlag
+  }).passthrough()
+);
+var CacheHitTrendResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    trend: z35.array(
+      z35.object({
+        x: z35.string(),
+        simpleHits: z35.number(),
+        semanticHits: z35.number(),
+        hitRate: z35.number(),
+        cumulativeSimpleHitSavings: z35.number(),
+        cumulativeSemanticHitSavings: z35.number()
+      }).passthrough()
+    ),
+    total: z35.number(),
+    summary: z35.object({ totalCacheHits: z35.number(), hitRate: z35.number() }).passthrough(),
+    ...quotaFlag
+  }).passthrough()
+);
+var UserTrendsResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    summary: z35.object({ total: z35.number(), unique: z35.number(), avg: z35.number() }).passthrough(),
+    trend: z35.array(GatewayChartRecordSchema),
+    ...quotaFlag
+  }).passthrough()
+);
+var ErrorTrendsResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    summary: z35.object({ errorPercent: z35.number() }).passthrough(),
+    trend: z35.array(GatewayChartRecordSchema),
+    ...quotaFlag
+  }).passthrough()
+);
+var RescuedRetriesResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    trend: z35.array(
+      z35.object({
+        x: z35.string(),
+        // Element shape unobserved — sample tenants only ever produced an empty array.
+        // Treated like the sibling trends[].retry/fallback below until a tenant with
+        // actual gateway retries lets us confirm the real shape. See open questions in
+        // PRD-ai-gateway-client.md.
+        y: z35.array(z35.unknown())
+      }).passthrough()
+    ),
+    total: z35.number(),
+    trends: z35.array(
+      z35.object({ x: z35.string(), retry: z35.array(z35.unknown()), fallback: z35.array(z35.unknown()) }).passthrough()
+    ),
+    retryTotal: z35.number(),
+    fallbackTotal: z35.number(),
+    ...quotaFlag
+  }).passthrough()
+);
+var FeedbackScoreDistributionResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    records: z35.array(z35.object({ x: z35.number(), y: z35.number() }).passthrough()),
+    total: z35.number().nullable(),
+    ...quotaFlag
+  }).passthrough()
+);
+var FeedbackModelsResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    records: z35.array(
+      z35.object({
+        x: z35.string(),
+        y: z35.object({ avgWeightedFeedback: z35.number(), feedbackCount: z35.number() }).passthrough()
+      }).passthrough()
+    ),
+    ...quotaFlag
+  }).passthrough()
+);
+var GatewayGroupRowSchema = z35.object({
+  requests: z35.number(),
+  cost: z35.number().optional(),
+  avg_latency: z35.number().optional(),
+  avg_tokens: z35.number().optional(),
+  total_tokens: z35.number().optional(),
+  success_rate: z35.number().optional(),
+  last_seen: z35.string().optional(),
+  object: z35.string()
+}).passthrough();
+var GroupListResponseSchema = aiGatewayGroupList(GatewayGroupRowSchema);
+var UserGroupResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    records: z35.array(
+      z35.object({ _user: z35.string(), count: z35.number(), cost: z35.number() }).passthrough()
+    ),
+    total: z35.number(),
+    ...quotaFlag
+  }).passthrough()
+);
+var GatewayLogRecordSchema = z35.object({
+  id: z35.string(),
+  workspace_slug: z35.string(),
+  ai_model: z35.string(),
+  _user: z35.string(),
+  total_units: z35.number(),
+  /** Cents. */
+  cost: z35.number(),
+  trace_id: z35.string(),
+  /** 0/1, not boolean. */
+  is_proxy_call: z35.number(),
+  created_at: z35.string(),
+  /** 0/1, not boolean. */
+  is_success: z35.number(),
+  /** `HIT` | `MISS` | `DISABLED`. */
+  cache_status: z35.string(),
+  retry_success_count: z35.number(),
+  mode: z35.string(),
+  last_used_option_index: z35.number(),
+  /** 200 success, 446 AIRS security block (cost 0), 400 validation. */
+  response_status_code: z35.number(),
+  request_url: z35.string(),
+  request_method: z35.string(),
+  ai_org: z35.string(),
+  api_key_id: z35.string(),
+  license_id: z35.string(),
+  log_store_file_path_format: z35.string(),
+  metadataKey: z35.array(z35.string()),
+  metadataValue: z35.array(z35.string()),
+  prompt_slug: z35.string(),
+  feedback: z35.array(z35.unknown())
+}).passthrough();
+var GatewayLogsResponseSchema = aiGatewayEnvelope(
+  z35.object({
+    records: z35.array(GatewayLogRecordSchema),
+    total: z35.number(),
+    capturedTotal: z35.number(),
+    ...quotaFlag
+  }).passthrough()
+);
+var GatewayWriteResponseSchema = z35.object({}).passthrough();
+var GatewayWorkspaceSchema = z35.object({
+  id: z35.string(),
+  slug: z35.string(),
+  name: z35.string(),
+  icon: z35.string().nullable(),
+  description: z35.string(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  is_default: z35.number(),
+  status: z35.string(),
+  scope_name: z35.string(),
+  object: z35.string()
+}).passthrough();
+var GatewayWorkspaceDetailSchema = z35.object({
+  id: z35.string(),
+  name: z35.string(),
+  description: z35.string(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  is_default: z35.number(),
+  slug: z35.string(),
+  icon: z35.string().nullable(),
+  defaults: z35.record(z35.unknown()).nullable(),
+  usage_limits: z35.record(z35.unknown()).nullable(),
+  rate_limits: z35.record(z35.unknown()).nullable(),
+  security_settings: z35.record(z35.boolean()).optional(),
+  data_plane_security_settings: z35.record(z35.unknown()).optional(),
+  settings: z35.record(z35.unknown()).optional()
+}).passthrough();
+var ListWorkspacesResponseSchema = aiGatewayList(GatewayWorkspaceSchema);
+var GatewayConfigSchema = z35.object({
+  id: z35.string(),
+  name: z35.string(),
+  slug: z35.string(),
+  /** Internal organisation UUID — NOT the TSG that write requests take. */
+  organisation_id: z35.string(),
+  is_default: z35.number(),
+  status: z35.string(),
+  owner_id: z35.string(),
+  updated_by: z35.string(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  workspace_id: z35.string(),
+  object: z35.string()
+}).passthrough();
+var ListConfigsResponseSchema = aiGatewayList(GatewayConfigSchema);
+var GatewayConfigDetailSchema = GatewayConfigSchema.extend({
+  config: z35.string(),
+  format: z35.string(),
+  type: z35.string(),
+  version_id: z35.string()
+}).passthrough();
+var GatewayConfigCreateResponseSchema = z35.object({
+  id: z35.string(),
+  version_id: z35.string(),
+  slug: z35.string(),
+  object: z35.string()
+}).passthrough();
+var GatewayGuardrailSchema = z35.object({
+  id: z35.string(),
+  name: z35.string(),
+  slug: z35.string(),
+  organisation_id: z35.string(),
+  status: z35.string(),
+  owner_id: z35.string(),
+  updated_by: z35.string().nullable(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  workspace_id: z35.string(),
+  object: z35.string()
+}).passthrough();
+var ListGuardrailsResponseSchema = aiGatewayList(GatewayGuardrailSchema);
+var guardrailFeedbackActionSchema = z35.object({
+  feedback: z35.object({ value: z35.number(), weight: z35.number(), metadata: z35.string() }).passthrough()
+}).passthrough();
+var GatewayGuardrailDetailSchema = GatewayGuardrailSchema.extend({
+  checks: z35.array(
+    z35.object({
+      /** e.g. `panw-prisma-airs.intercept`, the Prisma AIRS intercept check. */
+      id: z35.string(),
+      parameters: z35.record(z35.unknown()),
+      is_enabled: z35.boolean()
+    }).passthrough()
+  ),
+  actions: z35.object({
+    deny: z35.boolean(),
+    async: z35.boolean(),
+    sequential: z35.boolean(),
+    /** Absent when the guardrail was created without a pass/fail feedback action. */
+    on_success: guardrailFeedbackActionSchema.optional(),
+    on_fail: guardrailFeedbackActionSchema.optional()
+  }).passthrough(),
+  version_id: z35.string()
+}).passthrough();
+var GatewayGuardrailCreateResponseSchema = z35.object({
+  id: z35.string(),
+  version_id: z35.string(),
+  slug: z35.string(),
+  object: z35.string()
+}).passthrough();
+var GatewayProviderSchema = z35.object({
+  id: z35.string(),
+  name: z35.string().optional(),
+  slug: z35.string().optional(),
+  object: z35.string().optional()
+}).passthrough();
+var ListProvidersResponseSchema = aiGatewayList(GatewayProviderSchema);
+var GatewayProviderCreateResponseSchema = z35.object({
+  id: z35.string(),
+  slug: z35.string(),
+  object: z35.string()
+}).passthrough();
+var GatewayApiKeySchema = z35.object({
+  id: z35.string(),
+  name: z35.string().optional(),
+  object: z35.string().optional()
+}).passthrough();
+var ListApiKeysResponseSchema = aiGatewayList(GatewayApiKeySchema);
+var GatewayIntegrationSchema = z35.object({
+  id: z35.string(),
+  organisation_id: z35.string().optional(),
+  name: z35.string(),
+  owner_id: z35.string(),
+  status: z35.string(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  slug: z35.string(),
+  tags: z35.unknown().nullable(),
+  description: z35.string().nullable(),
+  workspaces_count: z35.number().optional(),
+  type: z35.string().optional(),
+  workspace_id: z35.string().nullable(),
+  ai_provider_id: z35.string(),
+  object: z35.string()
+}).passthrough();
+var ListIntegrationsResponseSchema = aiGatewayList(GatewayIntegrationSchema);
+var GatewayIntegrationModelsResponseSchema = z35.object({
+  models: z35.array(z35.object({ slug: z35.string(), enabled: z35.boolean() }).passthrough()),
+  allow_all_models: z35.boolean(),
+  object: z35.string()
+}).passthrough();
+var GatewayIntegrationWorkspaceSchema = z35.object({
+  id: z35.string(),
+  usage_limits: z35.record(z35.unknown()).nullable(),
+  rate_limits: z35.record(z35.unknown()).nullable(),
+  enabled: z35.boolean(),
+  status: z35.string(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  last_reset_at: z35.string().nullable()
+}).passthrough();
+var GatewayGlobalWorkspaceAccessSchema = z35.object({
+  enabled: z35.boolean(),
+  rate_limits: z35.record(z35.unknown()).nullable(),
+  usage_limits: z35.record(z35.unknown()).nullable()
+}).passthrough();
+var GatewayIntegrationWorkspacesResponseSchema = z35.object({
+  workspaces: z35.array(GatewayIntegrationWorkspaceSchema),
+  global_workspace_access: GatewayGlobalWorkspaceAccessSchema,
+  object: z35.string()
+}).passthrough();
+var McpIntegrationSchema = z35.object({
+  id: z35.string(),
+  organisation_id: z35.string(),
+  name: z35.string(),
+  owner_id: z35.string(),
+  status: z35.string(),
+  type: z35.string(),
+  url: z35.string(),
+  auth_type: z35.string(),
+  transport: z35.string(),
+  /**
+   * JSON-encoded STRING on reads — the same request/response asymmetry as
+   * `configs.config` (see {@link GatewayConfigDetailSchema}). The CREATE request
+   * (`McpIntegrationCreateRequest.configurations`) sends an object; this is the read shape.
+   */
+  configurations: z35.string(),
+  created_at: z35.string(),
+  last_updated_at: z35.string()
+}).passthrough();
+var ListMcpIntegrationsResponseSchema = aiGatewayList(McpIntegrationSchema);
+var GatewayDeploymentSchema = z35.object({
+  id: z35.string(),
+  name: z35.string(),
+  slug: z35.string(),
+  type: z35.string(),
+  /** `active` | `archived`. DELETE archives rather than removes. */
+  status: z35.string(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  last_synced_at: z35.string().nullable(),
+  last_resynced_at: z35.string().nullable(),
+  is_default: z35.number(),
+  created_by: z35.string(),
+  object: z35.string()
+}).passthrough();
+var GatewayDeploymentDetailSchema = GatewayDeploymentSchema.extend({
+  credentials: z35.object({ username: z35.string(), password: z35.string() }).passthrough().optional(),
+  deployment_config: z35.record(z35.unknown()).nullable(),
+  auth_settings: z35.object({
+    /** 0/1, not boolean — the create REQUEST sends a real boolean here. */
+    disable_portkey_gateway: z35.number(),
+    workspaces_allowed: z35.array(z35.string()),
+    allow_all_workspaces: z35.number()
+  }).passthrough().optional(),
+  client_auth: z35.string().optional(),
+  workspaces: z35.array(z35.object({ id: z35.string(), slug: z35.string() }).passthrough()).optional()
+}).passthrough();
+var GatewayDeploymentCreateResponseSchema = z35.object({
+  id: z35.string(),
+  client_auth: z35.string(),
+  credentials: z35.object({ username: z35.string(), password: z35.string() }).passthrough(),
+  /** Internal organisation UUID — NOT the TSG sent in the request. */
+  organisation_id: z35.string(),
+  object: z35.string()
+}).passthrough();
+var ListDeploymentsResponseSchema = aiGatewayList(GatewayDeploymentSchema);
+var GatewayPluginSchema = z35.object({
+  id: z35.string(),
+  integration_id: z35.string(),
+  credentials: z35.record(z35.string()),
+  owner_id: z35.string(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  status: z35.string(),
+  integration_slug: z35.string(),
+  plugin_provider_id: z35.string(),
+  plugin_provider_slug: z35.string(),
+  object: z35.string()
+}).passthrough();
+var ListPluginsResponseSchema = aiGatewayList(GatewayPluginSchema);
+var OrganisationSelfResponseSchema = z35.object({ success: z35.boolean(), data: z35.record(z35.unknown()) }).passthrough();
+var AuthSettingsResponseSchema = z35.object({ success: z35.boolean(), data: z35.record(z35.unknown()) }).passthrough();
+var GatewayAuditLogRecordSchema = z35.object({
+  timestamp: z35.string(),
+  method: z35.string(),
+  uri: z35.string(),
+  request_id: z35.string(),
+  request_body: z35.string(),
+  query_params: z35.string(),
+  request_headers: z35.string(),
+  user_id: z35.string(),
+  user_type: z35.string(),
+  organisation_id: z35.string(),
+  workspace_id: z35.string(),
+  response_status_code: z35.number(),
+  resource_type: z35.string(),
+  action: z35.string(),
+  client_ip: z35.string(),
+  country: z35.string()
+}).passthrough();
+var GatewayAuditLogsResponseSchema = z35.object({ records: z35.array(GatewayAuditLogRecordSchema) }).passthrough();
+
 // src/http/auth/oauth.ts
 var OAuthAuth = class {
   constructor(oauthClient) {
@@ -3985,12 +4500,12 @@ var OAuthAuth = class {
 };
 
 // src/models/oauth-token.ts
-import { z as z35 } from "zod";
-var OAuthTokenResponseSchema = z35.object({
-  access_token: z35.string(),
-  token_type: z35.string().optional(),
-  expires_in: z35.number(),
-  scope: z35.string().optional()
+import { z as z36 } from "zod";
+var OAuthTokenResponseSchema = z36.object({
+  access_token: z36.string(),
+  token_type: z36.string().optional(),
+  expires_in: z36.number(),
+  scope: z36.string().optional()
 }).passthrough();
 
 // src/management/oauth-client.ts
@@ -4216,6 +4731,14 @@ function assertUuid(value, fieldName) {
     );
   }
 }
+function assertNumericId(value, fieldName) {
+  if (!/^\d+$/.test(value)) {
+    throw new AISecSDKException(
+      `Invalid ${fieldName}: ${value}`,
+      "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+    );
+  }
+}
 
 // src/management/profiles.ts
 var ProfilesClient = class {
@@ -4975,7 +5498,7 @@ var ScanLogsClient = class {
 };
 
 // src/management/oauth-management.ts
-import { z as z36 } from "zod";
+import { z as z37 } from "zod";
 var OAuthManagementClient = class {
   baseUrl;
   auth;
@@ -5009,7 +5532,7 @@ var OAuthManagementClient = class {
       path: MGMT_OAUTH_INVALIDATE_PATH,
       params: { token },
       body,
-      responseSchema: z36.string(),
+      responseSchema: z37.string(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6870,7 +7393,7 @@ var ModelSecurityClient = class {
 };
 
 // src/red-team/scans-client.ts
-import { z as z37 } from "zod";
+import { z as z38 } from "zod";
 var RedTeamScansClient = class {
   baseUrl;
   auth;
@@ -7007,7 +7530,7 @@ var RedTeamScansClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: RED_TEAM_CATEGORIES_PATH,
-      responseSchema: z37.array(CategoryModelSchema),
+      responseSchema: z38.array(CategoryModelSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7015,7 +7538,7 @@ var RedTeamScansClient = class {
 };
 
 // src/red-team/reports-client.ts
-import { z as z38 } from "zod";
+import { z as z39 } from "zod";
 var RedTeamReportsClient = class {
   baseUrl;
   auth;
@@ -7390,7 +7913,7 @@ var RedTeamReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/download`,
       params: { file_format: format },
-      responseSchema: z38.unknown(),
+      responseSchema: z39.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7414,7 +7937,7 @@ var RedTeamReportsClient = class {
       method: "POST",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/generate-partial-report`,
-      responseSchema: z38.unknown(),
+      responseSchema: z39.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7422,7 +7945,7 @@ var RedTeamReportsClient = class {
 };
 
 // src/red-team/custom-attack-reports-client.ts
-import { z as z39 } from "zod";
+import { z as z40 } from "zod";
 var RedTeamCustomAttackReportsClient = class {
   baseUrl;
   auth;
@@ -7512,7 +8035,7 @@ var RedTeamCustomAttackReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/report/${jobId}/prompt-set/${promptSetId}/prompts`,
       params,
-      responseSchema: z39.array(PromptDetailResponseSchema),
+      responseSchema: z40.array(PromptDetailResponseSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7606,7 +8129,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/attack/${attackId}/list-outputs`,
-      responseSchema: z39.array(CustomAttackOutputSchema),
+      responseSchema: z40.array(CustomAttackOutputSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7631,7 +8154,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/property-stats`,
-      responseSchema: z39.array(PropertyStatisticSchema),
+      responseSchema: z40.array(PropertyStatisticSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7639,7 +8162,7 @@ var RedTeamCustomAttackReportsClient = class {
 };
 
 // src/red-team/targets-client.ts
-import { z as z40 } from "zod";
+import { z as z41 } from "zod";
 var RedTeamTargetsClient = class {
   baseUrl;
   auth;
@@ -7932,7 +8455,7 @@ var RedTeamTargetsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_TEMPLATE_PATH}/target-metadata`,
-      responseSchema: z40.record(z40.unknown()),
+      responseSchema: z41.record(z41.unknown()),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9355,9 +9878,1857 @@ var RedTeamClient = class {
     });
   }
 };
+
+// src/http/auth/tsg-header.ts
+var TsgHeaderAuth = class {
+  constructor(inner, tsgId) {
+    this.inner = inner;
+    this.tsgId = tsgId;
+  }
+  async prepare(req) {
+    const prepared = await this.inner.prepare(req);
+    return {
+      ...prepared,
+      headers: { ...prepared.headers, [TSG_ID_HEADER]: this.tsgId }
+    };
+  }
+  async onUnauthorized(res) {
+    return await this.inner.onUnauthorized?.(res) ?? false;
+  }
+};
+
+// src/ai-gateway/window.ts
+function toOffsetIso(d) {
+  const pad = (n) => String(Math.floor(Math.abs(n))).padStart(2, "0");
+  const offsetMin = -d.getTimezoneOffset();
+  const sign = offsetMin >= 0 ? "+" : "-";
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}T${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}${sign}${pad(offsetMin / 60)}:${pad(offsetMin % 60)}`;
+}
+function serializeWindow(tsgId, opts) {
+  const end = opts.end ?? /* @__PURE__ */ new Date();
+  const start = opts.start ?? new Date(end.getTime() - (opts.days ?? 7) * 864e5);
+  return {
+    organisationId: tsgId,
+    workspaceSlug: opts.workspaceSlug,
+    timeOfGenerationMin: toOffsetIso(start),
+    timeOfGenerationMax: toOffsetIso(end)
+  };
+}
+
+// src/ai-gateway/telemetry-client.ts
+var AIGatewayTelemetryClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  tsgId;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+    this.tsgId = opts.tsgId;
+  }
+  /** @internal Shared GET for every `logs/charts/*` endpoint. */
+  chart(metric, opts, schema) {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_CHARTS_PATH}/${metric}`,
+      params: serializeWindow(this.tsgId, opts),
+      responseSchema: schema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Total and per-day spend. **Values are in cents.**
+   * @param opts - Workspace slug and time window.
+   * @returns Cost series plus the period total, in cents.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const cost = await gw.telemetry.cost({ workspaceSlug: 'ws-main-a-349e0e', days: 7 });
+   * console.log(`$${(cost.data.total / 100).toFixed(2)}`); // => "$4110.83"
+   * ```
+   */
+  async cost(opts) {
+    return this.chart("cost", opts, CostChartResponseSchema);
+  }
+  /**
+   * Per-day request counts.
+   * @param opts - Workspace slug and time window.
+   * @returns Request-count series plus the period total.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const r = await gw.telemetry.requests({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // r.data.total => 25746
+   * ```
+   */
+  async requests(opts) {
+    return this.chart("requests", opts, CountChartResponseSchema);
+  }
+  /**
+   * Latency in milliseconds. Percentiles are returned per-bucket and for the period.
+   * @param opts - Workspace slug and time window.
+   * @returns Latency series with p50/p90/p99; `data.total` is the period mean, not a sum.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const l = await gw.telemetry.latency({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // l.data.p99 => 8329.14
+   * ```
+   */
+  async latency(opts) {
+    return this.chart("latency", opts, LatencyChartResponseSchema);
+  }
+  /**
+   * Token usage, split into request and response units.
+   * @param opts - Workspace slug and time window.
+   * @returns Token series plus request/response unit totals.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const t = await gw.telemetry.tokens({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // t.data.total_request_units => 4919015459
+   * ```
+   */
+  async tokens(opts) {
+    return this.chart("tokens", opts, TokensChartResponseSchema);
+  }
+  /**
+   * Per-day error counts.
+   * @param opts - Workspace slug and time window.
+   * @returns Error-count series plus the period total.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const e = await gw.telemetry.errors({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // e.data.total => 125
+   * ```
+   */
+  async errors(opts) {
+    return this.chart("errors", opts, CountChartResponseSchema);
+  }
+  /**
+   * Per-day distinct end-user counts.
+   * @param opts - Workspace slug and time window.
+   * @returns Unique-user series plus the period total.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const u = await gw.telemetry.users({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // u.data.total => 1
+   * ```
+   */
+  async users(opts) {
+    return this.chart("users", opts, CountChartResponseSchema);
+  }
+  /**
+   * Cache hit count, speedup, and average cached-response latency.
+   * @param opts - Workspace slug and time window.
+   * @returns Cache summary; `avgCacheLatency` is null when there were no hits.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const c = await gw.telemetry.cacheSummary({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // c.data.summary => { cacheHits: 0, avgCacheLatency: null, totalRequests: 25621, cacheSpeedup: 0 }
+   * ```
+   */
+  async cacheSummary(opts) {
+    return this.chart("cache-summary", opts, CacheSummaryResponseSchema);
+  }
+  /**
+   * Cache hit-rate trend and cumulative savings.
+   * @param opts - Workspace slug and time window.
+   * @returns Per-bucket hits and **cumulative** savings in cents — the last non-zero bucket is the period total.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const t = await gw.telemetry.cacheHitTrend({ workspaceSlug: 'ws-main-a-349e0e' });
+   * const last = t.data.trend.at(-1);
+   * const savedUsd = ((last?.cumulativeSimpleHitSavings ?? 0) + (last?.cumulativeSemanticHitSavings ?? 0)) / 100;
+   * ```
+   */
+  async cacheHitTrend(opts) {
+    return this.chart("cache-hit-trend", opts, CacheHitTrendResponseSchema);
+  }
+  /**
+   * Requests-per-user trend.
+   * @param opts - Workspace slug and time window.
+   * @returns Daily request counts plus `summary.avg` (requests per user).
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const t = await gw.telemetry.userTrends({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // t.data.summary => { total: 25748, unique: 1, avg: 25748 }
+   * ```
+   */
+  async userTrends(opts) {
+    return this.chart("user-trends", opts, UserTrendsResponseSchema);
+  }
+  /**
+   * Error-rate trend as a percentage.
+   * @param opts - Workspace slug and time window.
+   * @returns Daily error percentages plus `summary.errorPercent` for the period.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const t = await gw.telemetry.errorTrends({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // t.data.summary.errorPercent => 0.485
+   * ```
+   */
+  async errorTrends(opts) {
+    return this.chart("error-trends", opts, ErrorTrendsResponseSchema);
+  }
+  /**
+   * Gateway auto-retry and fallback resilience. Sparse — only populated on upstream failures.
+   * @param opts - Workspace slug and time window.
+   * @returns Retry/fallback trends; note `trend[].y` is an **array**, not a scalar.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const r = await gw.telemetry.rescuedRetries({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // r.data.retryTotal => 0
+   * ```
+   */
+  async rescuedRetries(opts) {
+    return this.chart("rescued-retries", opts, RescuedRetriesResponseSchema);
+  }
+  /**
+   * Daily count of feedback submissions.
+   * @param opts - Workspace slug and time window.
+   * @returns Feedback-count series plus the period total.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const f = await gw.telemetry.feedbackTrend({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // f.data.total => 61
+   * ```
+   */
+  async feedbackTrend(opts) {
+    return this.chart("feedback-trend", opts, CountChartResponseSchema);
+  }
+  /**
+   * Weighted average feedback score, averaged over days.
+   * @param opts - Workspace slug and time window.
+   * @returns Weighted score series; `data.total` is null when there is no feedback.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const f = await gw.telemetry.feedbackWeighted({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // f.data.total => -2.58
+   * ```
+   */
+  async feedbackWeighted(opts) {
+    return this.chart("feedback-weighted", opts, CountChartResponseSchema);
+  }
+  /**
+   * Distribution of feedback scores. Feedback is binary: +5 (thumbs up) or -5 (thumbs down).
+   * @param opts - Workspace slug and time window.
+   * @returns Score histogram as `{x: score, y: count}` records.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const d = await gw.telemetry.feedbackScoreDistribution({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // d.data.records => [{ x: 5, y: 30 }, { x: -5, y: 33 }]
+   * ```
+   */
+  async feedbackScoreDistribution(opts) {
+    return this.chart("feedback-score-distribution", opts, FeedbackScoreDistributionResponseSchema);
+  }
+  /**
+   * Feedback broken down by AI model.
+   * @param opts - Workspace slug and time window.
+   * @returns Records where `x` is the model and `y` is an object, not a number.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const m = await gw.telemetry.feedbackModels({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // m.data.records[0] => { x: 'claude-sonnet-5', y: { avgWeightedFeedback: 4.2, feedbackCount: 12 } }
+   * ```
+   */
+  async feedbackModels(opts) {
+    return this.chart("feedback-models", opts, FeedbackModelsResponseSchema);
+  }
+  /**
+   * Aggregate requests by a dimension.
+   * @param dimension - One of {@link AI_GW_GROUP_DIMENSIONS}. Underscore names only.
+   * @param opts - Window plus optional extra columns.
+   * @returns One row per distinct dimension value.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const byModel = await gw.telemetry.groupBy('model', {
+   *   workspaceSlug: 'ws-main-a-349e0e',
+   *   columns: ['cost', 'total_tokens'],
+   * });
+   * // byModel.data[0] => { model: 'claude-sonnet-5', requests: 10506, cost: 29704.16, ... }
+   * ```
+   */
+  async groupBy(dimension, opts) {
+    const params = serializeWindow(this.tsgId, opts);
+    if (opts.columns?.length) params.columns = opts.columns.join(",");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_GROUPS_PATH}/${dimension}`,
+      params,
+      responseSchema: GroupListResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Requests and cost per end user.
+   * @param opts - Workspace slug and time window.
+   * @returns One record per user; `_user: ''` means calls with no end-user id. Costs in cents.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const users = await gw.telemetry.byUser({ workspaceSlug: 'ws-main-a-349e0e' });
+   * // users.data.records[0] => { _user: '', count: 25748, cost: 411060.85 }
+   * ```
+   */
+  async byUser(opts) {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_GROUPS_PATH}/users`,
+      params: serializeWindow(this.tsgId, opts),
+      responseSchema: UserGroupResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Requests grouped by HTTP status code.
+   * @param opts - Window plus optional extra columns.
+   * @returns One row per status. **446 = AIRS security block** (cost 0, never reached the LLM).
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const codes = await gw.telemetry.byStatusCode({
+   *   workspaceSlug: 'ws-main-a-349e0e',
+   *   columns: ['cost', 'avg_latency'],
+   * });
+   * // codes.data => [{ status_code: 200, requests: 25623, ... }, { status_code: 446, ... }]
+   * ```
+   */
+  async byStatusCode(opts) {
+    const params = serializeWindow(this.tsgId, opts);
+    if (opts.columns?.length) params.columns = opts.columns.join(",");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_GROUPS_PATH}/status_code`,
+      params,
+      responseSchema: GroupListResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Raw per-request log rows — the deepest granularity this API offers.
+   *
+   * @remarks
+   * Upstream pagination is broken: only `pageSize` works, and an unfiltered call always
+   * returns the same most-recent batch (~50 rows) regardless of offset. To read beyond that,
+   * filter by `statusCode`, which bypasses the cap and returns every match in the window.
+   *
+   * @param opts - Window plus `pageSize` / `traceId` / `statusCode` filters.
+   * @returns Log records plus the full-period `total` (which you cannot page to).
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * // Every AIRS security block in the window, not just the most recent page.
+   * const blocked = await gw.telemetry.logs({
+   *   workspaceSlug: 'ws-main-a-349e0e',
+   *   statusCode: 446,
+   * });
+   * // blocked.data.records[0] => { response_status_code: 446, cost: 0, is_success: 0, ... }
+   * ```
+   */
+  async logs(opts) {
+    const params = serializeWindow(this.tsgId, opts);
+    if (opts.pageSize !== void 0) params.pageSize = String(opts.pageSize);
+    if (opts.traceId !== void 0) params.traceId = opts.traceId;
+    if (opts.statusCode !== void 0) params.statusCode = String(opts.statusCode);
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_LOGS_PATH,
+      params,
+      responseSchema: GatewayLogsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/workspaces-client.ts
+var AIGatewayWorkspacesClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List workspaces visible to the caller.
+   * @returns All workspaces, each with the `scope_name` that grants data-plane access to it.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const ws = await gw.workspaces.list();
+   * // ws.data[0] => { slug: 'ws-main-a-349e0e', scope_name: 'main_airs_workspace_1852583913', ... }
+   * ```
+   */
+  async list() {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_WORKSPACES_PATH,
+      responseSchema: ListWorkspacesResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Fetch one workspace, including its security and rate-limit settings.
+   * @param workspaceId - Workspace UUID.
+   * @returns Workspace detail; list rows do not carry the settings blocks.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const ws = await gw.workspaces.get('16f7e90d-382a-4e78-b577-1b01eb5f8297');
+   * // ws.security_settings?.membersViewLogs => true
+   * ```
+   */
+  async get(workspaceId) {
+    assertUuid(workspaceId, "workspaceId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceId}`,
+      responseSchema: GatewayWorkspaceDetailSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/configs-client.ts
+var AIGatewayConfigsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List configs in a workspace.
+   *
+   * @remarks
+   * List rows are a strict 12-field subset of the detail read — they do NOT carry `config`,
+   * `format`, `type`, or `version_id`. Call {@link get} for those.
+   *
+   * @param opts - Must include the workspace UUID.
+   * @returns Config list rows.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const cfgs = await gw.configs.list({ workspaceId: '16f7e90d-382a-4e78-b577-1b01eb5f8297' });
+   * // cfgs.data[0] => { name: 'claude-code', slug: 'pc-claude-e46fe6', status: 'active', ... }
+   * ```
+   */
+  async list(opts) {
+    assertUuid(opts.workspaceId, "workspaceId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_CONFIGS_PATH,
+      params: { workspace_id: opts.workspaceId },
+      responseSchema: ListConfigsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Fetch one config.
+   * @param configId - Config UUID.
+   * @returns The config detail — adds `config` (a JSON-encoded string, not an object),
+   * `format`, `type`, and `version_id` on top of the list row.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const cfg = await gw.configs.get('764cf9cd-4ebf-449e-b669-08149b0fbbbc');
+   * const routing = JSON.parse(cfg.config) as Record<string, unknown>;
+   * // routing.provider => '@anthropic-prod'
+   * ```
+   */
+  async get(configId) {
+    assertUuid(configId, "configId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_CONFIGS_PATH}/${configId}`,
+      responseSchema: GatewayConfigDetailSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Create a config.
+   *
+   * @remarks
+   * The response is a **creation receipt** — `{ id, version_id, slug, object }` — not a
+   * {@link GatewayConfigDetail}. Call {@link get} for the full record. Verified live
+   * 2026-07-28.
+   *
+   * @param body - Name, workspace UUID, and the routing config object.
+   * @returns The creation receipt.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const receipt = await gw.configs.create({
+   *   name: 'vertex-airs',
+   *   workspace_id: '16f7e90d-382a-4e78-b577-1b01eb5f8297',
+   *   config: { retry: { attempts: 3 }, cache: { mode: 'simple' } },
+   * });
+   * // receipt => { id: '...', version_id: '...', slug: 'pc-sdk-ve-14620d', object: 'config' }
+   * ```
+   */
+  async create(body) {
+    assertUuid(body.workspace_id, "workspace_id");
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: AI_GW_CONFIGS_PATH,
+      body,
+      responseSchema: GatewayConfigCreateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update a config.
+   * @param configId - Config UUID.
+   * @param body - Replacement fields.
+   * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.configs.update('764cf9cd-4ebf-449e-b669-08149b0fbbbc', {
+   *   name: 'claude-code',
+   *   workspace_id: '16f7e90d-382a-4e78-b577-1b01eb5f8297',
+   *   config: { retry: { attempts: 5 } },
+   * });
+   * ```
+   */
+  async update(configId, body) {
+    assertUuid(configId, "configId");
+    assertUuid(body.workspace_id, "workspace_id");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_CONFIGS_PATH}/${configId}`,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Delete a config.
+   *
+   * @remarks
+   * This is a **hard delete** — unlike {@link AIGatewayDeploymentsClient.delete | deployments.delete}
+   * (which archives), the config disappears from {@link list} entirely. Verified live
+   * 2026-07-28. No `organisation_id` query param is required, unlike deployments/integrations.
+   *
+   * @param configId - Config UUID.
+   * @returns Nothing.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.configs.delete('764cf9cd-4ebf-449e-b669-08149b0fbbbc');
+   * // the config no longer appears in gw.configs.list()
+   * ```
+   */
+  async delete(configId) {
+    assertUuid(configId, "configId");
+    await request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_CONFIGS_PATH}/${configId}`,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/guardrails-client.ts
+var AIGatewayGuardrailsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List guardrails in a workspace.
+   * @param opts - Must include the workspace UUID.
+   * @returns Guardrails defined on that workspace.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const g = await gw.guardrails.list({ workspaceId: '16f7e90d-382a-4e78-b577-1b01eb5f8297' });
+   * // g.data[0].id => 'pg-prisma-099a16'
+   * ```
+   */
+  async list(opts) {
+    assertUuid(opts.workspaceId, "workspaceId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_GUARDRAILS_PATH,
+      params: { workspace_id: opts.workspaceId },
+      responseSchema: ListGuardrailsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Fetch one guardrail.
+   * @param guardrailId - Guardrail UUID.
+   * @returns Guardrail detail — adds `checks`, `actions`, and `version_id` on top of the list
+   * row.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const g = await gw.guardrails.get('9f6c2a8e-2b3d-4e5f-8a9b-0c1d2e3f4a5b');
+   * // g.checks[0].id => 'panw-prisma-airs.intercept'
+   * ```
+   */
+  async get(guardrailId) {
+    assertUuid(guardrailId, "guardrailId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_GUARDRAILS_PATH}/${guardrailId}`,
+      responseSchema: GatewayGuardrailDetailSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Create a guardrail.
+   *
+   * @remarks
+   * The response is a **creation receipt** — `{ id, version_id, slug, object }` — not a
+   * {@link GatewayGuardrailDetail}. Call {@link get} for the full record. Verified live
+   * 2026-07-28.
+   *
+   * @param body - Workspace UUID, name, checks, and pass/fail actions.
+   * @returns The creation receipt.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const receipt = await gw.guardrails.create({
+   *   workspace_id: '16f7e90d-382a-4e78-b577-1b01eb5f8297',
+   *   name: 'PrismaAIRS',
+   *   checks: [{ id: 'panw-prisma-airs.intercept', parameters: { profile_name: 'AI Gateway - Strict' }, is_enabled: true }],
+   *   actions: { deny: false, async: false, sequential: false },
+   * });
+   * // receipt => { id: '...', version_id: '...', slug: 'pg-sdk-ve-874b62', object: 'guardrail' }
+   * ```
+   */
+  async create(body) {
+    assertUuid(body.workspace_id, "workspace_id");
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: AI_GW_GUARDRAILS_PATH,
+      body,
+      responseSchema: GatewayGuardrailCreateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Delete a guardrail.
+   *
+   * @remarks
+   * This is a **hard delete** — unlike {@link AIGatewayDeploymentsClient.delete | deployments.delete}
+   * (which archives), the guardrail disappears from {@link list} entirely. Verified live
+   * 2026-07-28. No `organisation_id` query param is required, unlike deployments/integrations.
+   *
+   * @param guardrailId - Guardrail UUID.
+   * @returns Nothing.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.guardrails.delete('9f6c2a8e-2b3d-4e5f-8a9b-0c1d2e3f4a5b');
+   * // the guardrail no longer appears in gw.guardrails.list()
+   * ```
+   */
+  async delete(guardrailId) {
+    assertUuid(guardrailId, "guardrailId");
+    await request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_GUARDRAILS_PATH}/${guardrailId}`,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/providers-client.ts
+var AIGatewayProvidersClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List providers in a workspace.
+   * @param opts - Must include the workspace UUID.
+   * @returns Providers bound into that workspace.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const p = await gw.providers.list({ workspaceId: '16f7e90d-382a-4e78-b577-1b01eb5f8297' });
+   * // p.data[0].slug => 'openai-calvin'
+   * ```
+   */
+  async list(opts) {
+    assertUuid(opts.workspaceId, "workspaceId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_PROVIDERS_PATH,
+      params: { workspace_id: opts.workspaceId },
+      responseSchema: ListProvidersResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Create a provider.
+   *
+   * @remarks
+   * The response is a **creation receipt** — `{ id, slug, object }` — not a {@link
+   * GatewayProvider}. Note it has **no `version_id`**, unlike the sibling receipts for
+   * {@link AIGatewayConfigsClient.create | configs.create} and {@link
+   * AIGatewayGuardrailsClient.create | guardrails.create}. Verified live 2026-07-28.
+   *
+   * @param body - Workspace UUID, upstream provider id, integration id, name, and slug.
+   * @returns The creation receipt.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const receipt = await gw.providers.create({
+   *   workspace_id: '16f7e90d-382a-4e78-b577-1b01eb5f8297',
+   *   ai_provider_id: 'de7d7d50-31cd-11ee-b93b-0e06f1aa7f7c',
+   *   integration_id: 'f6692544-3265-49be-9711-bbdcebc079e4',
+   *   name: 'openai-calvin',
+   *   slug: 'openai-calvin',
+   * });
+   * // receipt => { id: '...', slug: 'sdk-verify-delete-me-provider', object: 'provider' }
+   * ```
+   */
+  async create(body) {
+    assertUuid(body.workspace_id, "workspace_id");
+    assertUuid(body.ai_provider_id, "ai_provider_id");
+    assertUuid(body.integration_id, "integration_id");
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: AI_GW_PROVIDERS_PATH,
+      body,
+      responseSchema: GatewayProviderCreateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Delete a provider.
+   *
+   * @remarks
+   * This is a **hard delete** — unlike {@link AIGatewayDeploymentsClient.delete | deployments.delete}
+   * (which archives), the provider disappears from {@link list} entirely. Verified live
+   * 2026-07-28. No `organisation_id` query param is required, unlike deployments/integrations.
+   *
+   * @param providerId - Provider UUID.
+   * @returns Nothing.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.providers.delete('f6692544-3265-49be-9711-bbdcebc079e4');
+   * // the provider no longer appears in gw.providers.list()
+   * ```
+   */
+  async delete(providerId) {
+    assertUuid(providerId, "providerId");
+    await request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_PROVIDERS_PATH}/${providerId}`,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/api-keys-client.ts
+var AIGatewayApiKeysClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /** @internal */
+  listAt(path, opts) {
+    assertUuid(opts.workspaceId, "workspaceId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path,
+      params: { workspace_id: opts.workspaceId },
+      responseSchema: ListApiKeysResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /** @internal */
+  writeAt(method, path, body) {
+    assertUuid(body.workspace_id, "workspace_id");
+    return request({
+      method,
+      baseUrl: this.baseUrl,
+      path,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List service API keys in a workspace.
+   * @param opts - Must include the workspace UUID.
+   * @returns Service keys; the secret itself is only ever returned at creation.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const keys = await gw.apiKeys.listService({ workspaceId: '16f7e90d-382a-4e78-b577-1b01eb5f8297' });
+   * // keys.total => 1
+   * ```
+   */
+  async listService(opts) {
+    return this.listAt(AI_GW_API_KEYS_SERVICE_PATH, opts);
+  }
+  /**
+   * List user API keys in a workspace.
+   * @param opts - Must include the workspace UUID.
+   * @returns User-scoped keys.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const keys = await gw.apiKeys.listUser({ workspaceId: '16f7e90d-382a-4e78-b577-1b01eb5f8297' });
+   * // keys.total => 0
+   * ```
+   */
+  async listUser(opts) {
+    return this.listAt(AI_GW_API_KEYS_USER_PATH, opts);
+  }
+  /**
+   * Create a service API key.
+   * @param body - Name, scopes, TSG, workspace UUID, and type.
+   * @returns The raw create response — the only place the key secret appears. Capture it.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.apiKeys.createService({
+   *   name: 'ci-runner',
+   *   scopes: ['completions.write', 'logs.write'],
+   *   organisation_id: '1852583913',
+   *   workspace_id: '16f7e90d-382a-4e78-b577-1b01eb5f8297',
+   *   type: 'workspace',
+   * });
+   * ```
+   */
+  async createService(body) {
+    return this.writeAt("POST", AI_GW_API_KEYS_SERVICE_PATH, body);
+  }
+  /**
+   * Create a user API key.
+   * @param body - As {@link createService}, plus `user_id`.
+   * @returns The raw create response — the only place the key secret appears. Capture it.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.apiKeys.createUser({
+   *   name: 'calvin-laptop',
+   *   scopes: ['completions.write'],
+   *   organisation_id: '1852583913',
+   *   workspace_id: '16f7e90d-382a-4e78-b577-1b01eb5f8297',
+   *   type: 'workspace',
+   *   user_id: 'fad91538-65a9-41f7-8b9c-6e4c0e8b9c5f',
+   * });
+   * ```
+   */
+  async createUser(body) {
+    return this.writeAt("POST", AI_GW_API_KEYS_USER_PATH, body);
+  }
+  /**
+   * Update a service API key.
+   * @param keyId - Key UUID.
+   * @param body - Replacement fields.
+   * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.apiKeys.updateService('11111111-1111-4111-8111-111111111111', {
+   *   name: 'ci-runner',
+   *   scopes: ['completions.write'],
+   *   organisation_id: '1852583913',
+   *   workspace_id: '16f7e90d-382a-4e78-b577-1b01eb5f8297',
+   *   type: 'workspace',
+   * });
+   * ```
+   */
+  async updateService(keyId, body) {
+    assertUuid(keyId, "keyId");
+    return this.writeAt("PUT", `${AI_GW_API_KEYS_SERVICE_PATH}/${keyId}`, body);
+  }
+  /**
+   * Update a user API key.
+   * @param keyId - Key UUID.
+   * @param body - Replacement fields.
+   * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.apiKeys.updateUser('11111111-1111-4111-8111-111111111111', {
+   *   name: 'calvin-laptop',
+   *   scopes: ['completions.write'],
+   *   organisation_id: '1852583913',
+   *   workspace_id: '16f7e90d-382a-4e78-b577-1b01eb5f8297',
+   *   type: 'workspace',
+   *   user_id: 'fad91538-65a9-41f7-8b9c-6e4c0e8b9c5f',
+   * });
+   * ```
+   */
+  async updateUser(keyId, body) {
+    assertUuid(keyId, "keyId");
+    return this.writeAt("PUT", `${AI_GW_API_KEYS_USER_PATH}/${keyId}`, body);
+  }
+};
+
+// src/ai-gateway/integrations-client.ts
+var AIGatewayIntegrationsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List organisation integrations.
+   * @returns All provider integrations defined on the organisation.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const ints = await gw.integrations.list();
+   * // ints.data[0] => { name: 'openai-calvin', slug: 'openai-calvin', ... }
+   * ```
+   */
+  async list() {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_INTEGRATIONS_PATH,
+      responseSchema: ListIntegrationsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Fetch one integration.
+   * @param integrationId - Integration UUID.
+   * @returns The integration record.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const i = await gw.integrations.get('f6692544-3265-49be-9711-bbdcebc079e4');
+   * // i.name => 'openai-calvin'
+   * ```
+   */
+  async get(integrationId) {
+    assertUuid(integrationId, "integrationId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}`,
+      responseSchema: GatewayIntegrationSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Create an integration.
+   *
+   * @remarks
+   * `body.key` (the provider API key) is a live secret. Setting `PANW_AI_SEC_DEBUG` will
+   * print it, unredacted, to the SDK's own debug log.
+   *
+   * @param body - Provider id, name, slug, and provider-specific configuration.
+   * @returns The raw create response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.integrations.create({
+   *   organisation_id: '1852583913',
+   *   ai_provider_id: 'de7d7d50-31cd-11ee-b93b-0e06f1aa7f7c',
+   *   name: 'openai-prod',
+   *   slug: 'openai-prod',
+   *   key: process.env.OPENAI_API_KEY,
+   * });
+   * ```
+   */
+  async create(body) {
+    assertUuid(body.ai_provider_id, "ai_provider_id");
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: AI_GW_INTEGRATIONS_PATH,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update an integration.
+   * @param integrationId - Integration UUID.
+   * @param body - Replacement fields.
+   * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.integrations.update('f6692544-3265-49be-9711-bbdcebc079e4', {
+   *   name: 'openai-prod',
+   *   description: 'Production OpenAI',
+   * });
+   * ```
+   */
+  async update(integrationId, body) {
+    assertUuid(integrationId, "integrationId");
+    if (body.ai_provider_id !== void 0) assertUuid(body.ai_provider_id, "ai_provider_id");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}`,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Delete an integration.
+   * @param integrationId - Integration UUID.
+   * @param organisationId - The TSG as a numeric string; sent as a query param.
+   * @returns Nothing — the API replies 200 with an empty body.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.integrations.delete('f6692544-3265-49be-9711-bbdcebc079e4', '1852583913');
+   * ```
+   */
+  async delete(integrationId, organisationId) {
+    assertUuid(integrationId, "integrationId");
+    assertNumericId(organisationId, "organisationId");
+    await request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}`,
+      params: { organisation_id: organisationId },
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Read which models this integration exposes.
+   * @param integrationId - Integration UUID.
+   * @returns Per-model enablement plus the `allow_all_models` flag.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const m = await gw.integrations.getModels('f6692544-3265-49be-9711-bbdcebc079e4');
+   * // m.models[0] => { slug: 'gpt-4', enabled: true }
+   * ```
+   */
+  async getModels(integrationId) {
+    assertUuid(integrationId, "integrationId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}/models`,
+      responseSchema: GatewayIntegrationModelsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Replace which models this integration exposes.
+   * @param integrationId - Integration UUID.
+   * @param body - Full model list; this is a replace, not a merge.
+   * @returns The raw response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.integrations.setModels('f6692544-3265-49be-9711-bbdcebc079e4', {
+   *   models: [{ slug: 'gpt-4', enabled: true }, { slug: 'gpt-4-32k', enabled: false }],
+   * });
+   * ```
+   */
+  async setModels(integrationId, body) {
+    assertUuid(integrationId, "integrationId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}/models`,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Read which workspaces may use this integration.
+   *
+   * @remarks
+   * `global_workspace_access` is an **object** on this read, not a boolean, despite the
+   * field name — `{ enabled, rate_limits, usage_limits }`. The corresponding write
+   * ({@link setWorkspaces}) DOES send a plain boolean; the two are not symmetric.
+   *
+   * @param integrationId - Integration UUID.
+   * @returns Bound workspaces plus the `global_workspace_access` object.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const w = await gw.integrations.getWorkspaces('f6692544-3265-49be-9711-bbdcebc079e4');
+   * // w.global_workspace_access => { enabled: false, rate_limits: null, usage_limits: null }
+   * ```
+   */
+  async getWorkspaces(integrationId) {
+    assertUuid(integrationId, "integrationId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}/workspaces`,
+      responseSchema: GatewayIntegrationWorkspacesResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Replace which workspaces may use this integration.
+   * @param integrationId - Integration UUID.
+   * @param body - Workspace bindings or a global-access flag.
+   * @returns The raw response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.integrations.setWorkspaces('f6692544-3265-49be-9711-bbdcebc079e4', {
+   *   global_workspace_access: true,
+   * });
+   * ```
+   */
+  async setWorkspaces(integrationId, body) {
+    assertUuid(integrationId, "integrationId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}/workspaces`,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/mcp-integrations-client.ts
+var AIGatewayMcpIntegrationsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List organisation MCP integrations.
+   * @returns All MCP server integrations defined on the organisation.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const mcp = await gw.mcpIntegrations.list();
+   * // mcp.data[0] => { name: 'Context 7', url: 'https://mcp.context7.com/mcp', transport: 'http', ... }
+   * ```
+   */
+  async list() {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_MCP_INTEGRATIONS_PATH,
+      responseSchema: ListMcpIntegrationsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Register an MCP server.
+   * @param body - Name, server URL, auth type, transport, and provider-specific configuration.
+   * @returns The raw create response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.mcpIntegrations.create({
+   *   name: 'Context 7',
+   *   organisation_id: '1852583913',
+   *   slug: 'context-7',
+   *   url: 'https://mcp.context7.com/mcp',
+   *   auth_type: 'none',
+   *   transport: 'http',
+   * });
+   * ```
+   */
+  async create(body) {
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: AI_GW_MCP_INTEGRATIONS_PATH,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Replace which workspaces may use this MCP integration.
+   * @param mcpIntegrationId - MCP integration UUID.
+   * @param body - Workspace bindings or a global-access flag; this is a replace, not a merge.
+   * @returns The raw response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.mcpIntegrations.setWorkspaces('f6692544-3265-49be-9711-bbdcebc079e4', {
+   *   global_workspace_access: true,
+   * });
+   * ```
+   */
+  async setWorkspaces(mcpIntegrationId, body) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/workspaces`,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/deployments-client.ts
+var AIGatewayDeploymentsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List deployments.
+   *
+   * @remarks
+   * Archived deployments are included — `delete()` is a soft-delete. Filter on
+   * `status === 'active'` if you only want live ones.
+   *
+   * @returns All deployments, active and archived.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const all = await gw.deployments.list();
+   * const live = all.data.filter((d) => d.status === 'active');
+   * // live[0] => { name: 'talos', slug: 'dp-talos-f3b74e', status: 'active', ... }
+   * ```
+   */
+  async list() {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_DEPLOYMENTS_PATH,
+      responseSchema: ListDeploymentsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Fetch one deployment.
+   * @param deploymentId - Deployment UUID.
+   * @returns Deployment detail, including bound workspaces and masked credentials.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const d = await gw.deployments.get('32e8314e-7e68-4384-aacb-a476f6c3f91d');
+   * // d.auth_settings?.allow_all_workspaces => 1   (a number, not a boolean)
+   * ```
+   */
+  async get(deploymentId) {
+    assertUuid(deploymentId, "deploymentId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_DEPLOYMENTS_PATH}/${deploymentId}`,
+      responseSchema: GatewayDeploymentDetailSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Create a deployment.
+   *
+   * @remarks
+   * The response is a **creation receipt**, not a deployment record — it has 5 fields and
+   * carries no `name`, `slug`, or `status`. Call {@link get} for the full record.
+   *
+   * This is the **only** time `credentials.password` and `client_auth` are readable; the
+   * detail read masks them. Capture them here or they are unrecoverable. Never log them.
+   * Note that setting `PANW_AI_SEC_DEBUG` will print the raw request/response, including
+   * `credentials.password`, to the SDK's own debug log regardless of this warning.
+   *
+   * @param body - Name, type, TSG, and auth settings.
+   * @returns The creation receipt including the deployment's gateway credentials.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const receipt = await gw.deployments.create({
+   *   name: 'prod-us',
+   *   type: 'production',
+   *   organisation_id: '1852583913',
+   *   auth_settings: { allow_all_workspaces: true },
+   * });
+   * // receipt => { id: '2141...', client_auth: 'client-auth-...', credentials: { username, password }, ... }
+   * const full = await gw.deployments.get(receipt.id);
+   * ```
+   */
+  async create(body) {
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: AI_GW_DEPLOYMENTS_PATH,
+      body,
+      responseSchema: GatewayDeploymentCreateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Archive a deployment.
+   *
+   * @remarks
+   * This is a **soft delete** — the one exception to the gateway's usual delete semantics.
+   * The API returns 200 with an empty body and the record persists with `status:
+   * 'archived'`, still visible in {@link list}. There is no observed hard-delete for
+   * deployments specifically. Contrast with {@link AIGatewayConfigsClient.delete |
+   * configs.delete}, {@link AIGatewayGuardrailsClient.delete | guardrails.delete}, and
+   * {@link AIGatewayProvidersClient.delete | providers.delete}, all of which hard-delete —
+   * do not assume archive-on-delete is a gateway-wide convention.
+   *
+   * @param deploymentId - Deployment UUID.
+   * @param organisationId - The TSG as a numeric string; sent as a query param.
+   * @returns Nothing.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.deployments.delete('21414819-485e-4ba3-b3d3-3e1815580e43', '1852583913');
+   * // the record remains in list() with status 'archived'
+   * ```
+   */
+  async delete(deploymentId, organisationId) {
+    assertUuid(deploymentId, "deploymentId");
+    assertNumericId(organisationId, "organisationId");
+    await request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_DEPLOYMENTS_PATH}/${deploymentId}`,
+      params: { organisation_id: organisationId },
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/plugins-client.ts
+var AIGatewayPluginsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * List organisation plugin bindings.
+   * @returns All plugins bound to the organisation, with masked credentials.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const p = await gw.plugins.list();
+   * // p.data[0] => { integration_slug: 'panw-prisma-airs', credentials: { AIRS_API_KEY: 'sn*****Gul' }, ... }
+   * ```
+   */
+  async list() {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_PLUGINS_PATH,
+      responseSchema: ListPluginsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Bind a plugin to the organisation.
+   *
+   * @remarks
+   * `body.credentials` (e.g. `AIRS_API_KEY`) is a live secret. Setting `PANW_AI_SEC_DEBUG`
+   * will print it, unredacted, to the SDK's own debug log.
+   *
+   * @param body - Integration id and provider-specific credentials.
+   * @returns The raw create response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.plugins.create({
+   *   organisation_id: '1852583913',
+   *   integration_id: '232e45c4-809a-11f1-af60-2ca2a760eb7b',
+   *   credentials: { AIRS_API_KEY: process.env.PANW_AI_SEC_API_KEY ?? '' },
+   * });
+   * ```
+   */
+  async create(body) {
+    assertUuid(body.integration_id, "integration_id");
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: AI_GW_PLUGINS_PATH,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/organisations-client.ts
+var AIGatewayOrganisationsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * Fetch the calling organisation's settings.
+   * @returns The organisation record.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const org = await gw.organisations.getSelf();
+   * // org.data.name => 'Acme Corp'
+   * ```
+   */
+  async getSelf() {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_ORGANISATIONS_SELF_PATH,
+      responseSchema: OrganisationSelfResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update the calling organisation's settings.
+   * @param body - Replacement fields.
+   * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.organisations.updateSelf({ name: 'Acme Corp' });
+   * ```
+   */
+  async updateSelf(body) {
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: AI_GW_ORGANISATIONS_SELF_PATH,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Fetch an organisation's auth settings.
+   *
+   * @remarks
+   * The response includes a `scim_token` — a live secret. Never log the returned object.
+   * Note that setting `PANW_AI_SEC_DEBUG` will print it (unredacted) to the SDK's own debug
+   * log regardless of this warning, since debug logging only sanitizes header values.
+   *
+   * @param tsgId - The TSG as a numeric string, not a UUID.
+   * @returns Auth settings, including domains and the SCIM token.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const auth = await gw.organisations.getAuthSettings('1852583913');
+   * // Object.keys(auth.data) => ['auth_settings', 'domains', 'scim_token', ...]
+   * ```
+   */
+  async getAuthSettings(tsgId) {
+    assertNumericId(tsgId, "tsgId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: aiGwOrganisationsAuthSettingsPath(tsgId),
+      responseSchema: AuthSettingsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update an organisation's auth settings.
+   * @param tsgId - The TSG as a numeric string, not a UUID.
+   * @param body - Replacement fields.
+   * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.organisations.updateAuthSettings('1852583913', {
+   *   domains: ['acme.com'],
+   * });
+   * ```
+   */
+  async updateAuthSettings(tsgId, body) {
+    assertNumericId(tsgId, "tsgId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: aiGwOrganisationsAuthSettingsPath(tsgId),
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/audit-logs-client.ts
+var AIGatewayAuditLogsClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * Read organisation audit logs.
+   *
+   * @remarks
+   * **Handle the result as sensitive.** The API returns each entry's `request_body`
+   * **unredacted**, so records for credential-bearing calls (integrations, plugins) can
+   * contain live secrets — private keys, provider API keys — in plaintext. The sibling
+   * `request_headers` field is masked, but `request_body` is not. The SDK returns the
+   * response faithfully rather than altering it; never log these records wholesale, and
+   * never forward them to a third-party sink. Note that setting `PANW_AI_SEC_DEBUG` will
+   * print the raw response — including these unredacted secrets — to the SDK's own debug
+   * log regardless of this warning.
+   *
+   * @param opts - Inclusive start and end of the window.
+   * @returns Audit records, newest first.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const logs = await gw.auditLogs.list({
+   *   start: new Date('2026-07-20T00:00:00Z'),
+   *   end: new Date(),
+   * });
+   * // Safe projection — never log the whole record.
+   * const summary = logs.records.map((r) => `${r.timestamp} ${r.method} ${r.uri}`);
+   * ```
+   */
+  async list(opts) {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: AI_GW_AUDIT_LOGS_PATH,
+      params: {
+        start_time: opts.start.toISOString(),
+        end_time: opts.end.toISOString()
+      },
+      responseSchema: GatewayAuditLogsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
+// src/ai-gateway/client.ts
+var AIGatewayClient = class {
+  /** Runtime telemetry: charts, group-bys, and raw request logs. */
+  telemetry;
+  /** Workspace reads (data plane). */
+  workspaces;
+  /** Gateway routing configs. */
+  configs;
+  /** Workspace guardrails. */
+  guardrails;
+  /** Workspace-scoped provider bindings. */
+  providers;
+  /** Service and user API keys. */
+  apiKeys;
+  /** Organisation-level provider integrations (admin plane). */
+  integrations;
+  /** MCP server integrations (admin plane). */
+  mcpIntegrations;
+  /** Gateway deployments (admin plane). */
+  deployments;
+  /** Plugin bindings such as the Prisma AIRS scanner (admin plane). */
+  plugins;
+  /** Organisation and auth settings (admin plane). */
+  organisations;
+  /** Organisation audit logs (admin plane). */
+  auditLogs;
+  constructor(opts = {}) {
+    const dataEndpoint = opts.dataEndpoint ?? process.env[AI_GW_DATA_ENDPOINT] ?? DEFAULT_AI_GW_DATA_ENDPOINT;
+    const adminEndpoint = opts.adminEndpoint ?? process.env[AI_GW_ADMIN_ENDPOINT] ?? DEFAULT_AI_GW_ADMIN_ENDPOINT;
+    const { oauthClient, numRetries, tsgId } = resolveOAuthConfig({
+      clientId: opts.clientId,
+      clientSecret: opts.clientSecret,
+      tsgId: opts.tsgId,
+      baseUrl: dataEndpoint,
+      numRetries: opts.numRetries,
+      tokenEndpoint: opts.tokenEndpoint,
+      primaryEnvPrefix: "PANW_AI_GW",
+      fallbackEnvPrefix: "PANW_MGMT"
+    });
+    const auth = new TsgHeaderAuth(new OAuthAuth(oauthClient), tsgId);
+    const dataOpts = { baseUrl: dataEndpoint, auth, numRetries };
+    const adminOpts = { baseUrl: adminEndpoint, auth, numRetries };
+    this.telemetry = new AIGatewayTelemetryClient({ ...dataOpts, tsgId });
+    this.workspaces = new AIGatewayWorkspacesClient(dataOpts);
+    this.configs = new AIGatewayConfigsClient(dataOpts);
+    this.guardrails = new AIGatewayGuardrailsClient(dataOpts);
+    this.providers = new AIGatewayProvidersClient(dataOpts);
+    this.apiKeys = new AIGatewayApiKeysClient(dataOpts);
+    this.integrations = new AIGatewayIntegrationsClient(adminOpts);
+    this.mcpIntegrations = new AIGatewayMcpIntegrationsClient(adminOpts);
+    this.deployments = new AIGatewayDeploymentsClient(adminOpts);
+    this.plugins = new AIGatewayPluginsClient(adminOpts);
+    this.organisations = new AIGatewayOrganisationsClient(adminOpts);
+    this.auditLogs = new AIGatewayAuditLogsClient(adminOpts);
+  }
+};
 export {
+  AIGatewayApiKeysClient,
+  AIGatewayAuditLogsClient,
+  AIGatewayClient,
+  AIGatewayConfigsClient,
+  AIGatewayDeploymentsClient,
+  AIGatewayGuardrailsClient,
+  AIGatewayIntegrationsClient,
+  AIGatewayMcpIntegrationsClient,
+  AIGatewayOrganisationsClient,
+  AIGatewayPluginsClient,
+  AIGatewayProvidersClient,
+  AIGatewayTelemetryClient,
+  AIGatewayWorkspacesClient,
   AIRS_ENDPOINTS,
   AISecSDKException,
+  AI_GW_ADMIN_ENDPOINT,
+  AI_GW_API_KEYS_SERVICE_PATH,
+  AI_GW_API_KEYS_USER_PATH,
+  AI_GW_AUDIT_LOGS_PATH,
+  AI_GW_CHARTS_PATH,
+  AI_GW_CHART_METRICS,
+  AI_GW_CONFIGS_PATH,
+  AI_GW_DATA_ENDPOINT,
+  AI_GW_DEPLOYMENTS_PATH,
+  AI_GW_GROUPS_PATH,
+  AI_GW_GROUP_COLUMNS,
+  AI_GW_GROUP_DIMENSIONS,
+  AI_GW_GUARDRAILS_PATH,
+  AI_GW_INTEGRATIONS_PATH,
+  AI_GW_LOGS_PATH,
+  AI_GW_MCP_INTEGRATIONS_PATH,
+  AI_GW_ORGANISATIONS_SELF_PATH,
+  AI_GW_PLUGINS_PATH,
+  AI_GW_PROVIDERS_PATH,
+  AI_GW_WORKSPACES_PATH,
   AI_SEC_API_ENDPOINT,
   AI_SEC_API_KEY,
   AI_SEC_API_TOKEN,
@@ -9391,6 +11762,7 @@ export {
   AttackType,
   AuditResponseSchema,
   AuthConfigSchema,
+  AuthSettingsResponseSchema,
   AuthType,
   BEARER,
   BaseResponseSchema,
@@ -9398,6 +11770,8 @@ export {
   BasicAuthLocation,
   BedrockAccessConnectionParamsSchema,
   BrandSubCategory,
+  CacheHitTrendResponseSchema,
+  CacheSummaryResponseSchema,
   Category,
   CategoryModelSchema,
   CategoryReportSchema,
@@ -9419,7 +11793,9 @@ export {
   Content,
   ContentErrorSchema,
   ContentErrorType,
+  CostChartResponseSchema,
   CountByNameSchema,
+  CountChartResponseSchema,
   CountedQuotaEnum,
   CreateChannelRequestSchema,
   CreateCustomTopicRequestSchema,
@@ -9449,6 +11825,8 @@ export {
   CustomerAppSchema,
   CustomerAppWithKeysSchema,
   CustomerAppsClient,
+  DEFAULT_AI_GW_ADMIN_ENDPOINT,
+  DEFAULT_AI_GW_DATA_ENDPOINT,
   DEFAULT_DLP_ENDPOINT,
   DEFAULT_ENDPOINT,
   DEFAULT_MGMT_ENDPOINT,
@@ -9553,6 +11931,7 @@ export {
   ErrorResponseSchema,
   ErrorSource,
   ErrorStatus,
+  ErrorTrendsResponseSchema,
   ErrorType,
   EulaAcceptRequestSchema,
   EulaContentResponseSchema,
@@ -9563,16 +11942,46 @@ export {
   ExclusionsSchema,
   ExpressionOperatorTypeSchema,
   ExpressionTreeNodeSchema,
+  FeedbackModelsResponseSchema,
+  FeedbackScoreDistributionResponseSchema,
   FileFormat,
   FileListSchema,
   FileResponseSchema,
   FileScanDataSchema,
   FileScanResult,
   FileType,
+  GatewayApiKeySchema,
+  GatewayAuditLogRecordSchema,
+  GatewayAuditLogsResponseSchema,
+  GatewayChartRecordSchema,
+  GatewayConfigCreateResponseSchema,
+  GatewayConfigDetailSchema,
+  GatewayConfigSchema,
+  GatewayDeploymentCreateResponseSchema,
+  GatewayDeploymentDetailSchema,
+  GatewayDeploymentSchema,
+  GatewayGlobalWorkspaceAccessSchema,
+  GatewayGroupRowSchema,
+  GatewayGuardrailCreateResponseSchema,
+  GatewayGuardrailDetailSchema,
+  GatewayGuardrailSchema,
+  GatewayIntegrationModelsResponseSchema,
+  GatewayIntegrationSchema,
+  GatewayIntegrationWorkspaceSchema,
+  GatewayIntegrationWorkspacesResponseSchema,
+  GatewayLogRecordSchema,
+  GatewayLogsResponseSchema,
+  GatewayPluginSchema,
+  GatewayProviderCreateResponseSchema,
+  GatewayProviderSchema,
+  GatewayWorkspaceDetailSchema,
+  GatewayWorkspaceSchema,
+  GatewayWriteResponseSchema,
   GoalListResponseSchema,
   GoalSchema,
   GoalType,
   GoalTypeQueryParam,
+  GroupListResponseSchema,
   GuardrailAction,
   HEADER_API_KEY,
   HEADER_AUTH_TOKEN,
@@ -9599,9 +12008,19 @@ export {
   LabelsCreateRequestSchema,
   LabelsResponseSchema,
   LanguageOptionSchema,
+  LatencyChartResponseSchema,
+  ListApiKeysResponseSchema,
+  ListConfigsResponseSchema,
+  ListDeploymentsResponseSchema,
+  ListGuardrailsResponseSchema,
+  ListIntegrationsResponseSchema,
+  ListMcpIntegrationsResponseSchema,
   ListModelSecurityGroupsResponseSchema,
   ListModelSecurityRuleInstancesResponseSchema,
   ListModelSecurityRulesResponseSchema,
+  ListPluginsResponseSchema,
+  ListProvidersResponseSchema,
+  ListWorkspacesResponseSchema,
   MAX_AI_PROFILE_NAME_LENGTH,
   MAX_API_KEY_LENGTH,
   MAX_CONNECTION_POOL_SIZE,
@@ -9659,6 +12078,7 @@ export {
   MaskedDataSchema,
   McEntrySchema,
   McReportSchema,
+  McpIntegrationSchema,
   MetadataCriterionSchema,
   MetadataSchema,
   ModelConfigurationSchema,
@@ -9692,6 +12112,7 @@ export {
   Oauth2TokenSchema,
   OffsetSchema,
   OpenAIConnectionParamsSchema,
+  OrganisationSelfResponseSchema,
   PAYLOAD_HASH,
   PageDataFilteringProfileResponseSchema,
   PageDataPatternResponseSchema,
@@ -9769,6 +12190,7 @@ export {
   RegistryCredentialsSchema,
   RemediationDetailSchema,
   RemediationResponseSchema,
+  RescuedRetriesResponseSchema,
   ResourceModelExtensionSchema,
   ResponseDetectedSchema,
   ResponseDetectionDetailsSchema,
@@ -9843,6 +12265,7 @@ export {
   StreamingConnectionParamsSchema,
   SubCategoryModelSchema,
   SubCategoryStatsSchema,
+  TSG_ID_HEADER,
   TargetAdditionalContextSchema,
   TargetAuthType,
   TargetAuthValidationRequestSchema,
@@ -9869,6 +12292,7 @@ export {
   ThreatCategory,
   ThreatScanReportSchema,
   TokenStatsSchema,
+  TokensChartResponseSchema,
   ToolDetectedSchema,
   ToolDetectionDetailsSchema,
   ToolDetectionEntrySchema,
@@ -9883,6 +12307,8 @@ export {
   UpdateChannelRequestSchema,
   UrlCategorySchema,
   UrlfEntrySchema,
+  UserGroupResponseSchema,
+  UserTrendsResponseSchema,
   ValidationErrorSchema,
   Verdict,
   ViolationListSchema,
@@ -9891,6 +12317,7 @@ export {
   ViolationSeverityCountsSchema,
   WebSocketConnectionParamsSchema,
   WeightedRegexSchema,
+  aiGwOrganisationsAuthSettingsPath,
   globalConfiguration,
   init,
   jsonNullable,