@cdot65/prisma-airs-sdk 0.14.1 → 0.17.0

package/dist/index.cjs

@@ -60,6 +60,16 @@ __export(index_exports, {
   AI_SEC_API_TOKEN: () => AI_SEC_API_TOKEN,
   ASYNC_SCAN_PATH: () => ASYNC_SCAN_PATH,
   Action: () => Action,
+  AdapterCreateRequestSchema: () => AdapterCreateRequestSchema,
+  AdapterListItemSchema: () => AdapterListItemSchema,
+  AdapterListSchema: () => AdapterListSchema,
+  AdapterResponseSchema: () => AdapterResponseSchema,
+  AdapterUpdateRequestSchema: () => AdapterUpdateRequestSchema,
+  AdapterValidateRequestSchema: () => AdapterValidateRequestSchema,
+  AdapterValidateResponseSchema: () => AdapterValidateResponseSchema,
+  AdapterVarResponseSchema: () => AdapterVarResponseSchema,
+  AdapterVarSchema: () => AdapterVarSchema,
+  AdapterVarTypeSchema: () => AdapterVarTypeSchema,
   AdvancedDataProfileRequestSchema: () => AdvancedDataProfileRequestSchema,
   AgentEntrySchema: () => AgentEntrySchema,
   AgentMetaSchema: () => AgentMetaSchema,
@@ -300,6 +310,9 @@ __export(index_exports, {
   GatewayPluginSchema: () => GatewayPluginSchema,
   GatewayProviderCreateResponseSchema: () => GatewayProviderCreateResponseSchema,
   GatewayProviderSchema: () => GatewayProviderSchema,
+  GatewayRateLimitSchema: () => GatewayRateLimitSchema,
+  GatewayUsageLimitSchema: () => GatewayUsageLimitSchema,
+  GatewayWorkspaceCreateResponseSchema: () => GatewayWorkspaceCreateResponseSchema,
   GatewayWorkspaceDetailSchema: () => GatewayWorkspaceDetailSchema,
   GatewayWorkspaceSchema: () => GatewayWorkspaceSchema,
   GatewayWriteResponseSchema: () => GatewayWriteResponseSchema,
@@ -472,6 +485,8 @@ __export(index_exports, {
   PyPIAuthResponseSchema: () => PyPIAuthResponseSchema,
   QuotaDetailsSchema: () => QuotaDetailsSchema,
   QuotaSummarySchema: () => QuotaSummarySchema,
+  RED_TEAM_ADAPTER_PATH: () => RED_TEAM_ADAPTER_PATH,
+  RED_TEAM_ADAPTER_VALIDATE_PATH: () => RED_TEAM_ADAPTER_VALIDATE_PATH,
   RED_TEAM_CATEGORIES_PATH: () => RED_TEAM_CATEGORIES_PATH,
   RED_TEAM_CHANNELS_PATH: () => RED_TEAM_CHANNELS_PATH,
   RED_TEAM_CHANNELS_STATS_PATH: () => RED_TEAM_CHANNELS_STATS_PATH,
@@ -501,6 +516,7 @@ __export(index_exports, {
   RED_TEAM_TEMPLATE_PATH: () => RED_TEAM_TEMPLATE_PATH,
   RED_TEAM_TOKEN_ENDPOINT: () => RED_TEAM_TOKEN_ENDPOINT,
   RED_TEAM_TSG_ID: () => RED_TEAM_TSG_ID,
+  RedTeamAdaptersClient: () => RedTeamAdaptersClient,
   RedTeamCategory: () => RedTeamCategory,
   RedTeamClient: () => RedTeamClient,
   RedTeamCustomAttackReportsClient: () => RedTeamCustomAttackReportsClient,
@@ -682,7 +698,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 20;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.14.1";
+var SDK_VERSION = "0.17.0";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -757,6 +773,8 @@ var RED_TEAM_LANGUAGES_PATH = "/v1/languages";
 var RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH = "/v1/error-log/target-profile";
 var RED_TEAM_TARGET_PATH = "/v1/target";
 var RED_TEAM_TARGET_VALIDATE_AUTH_PATH = "/v1/target/validate-auth";
+var RED_TEAM_ADAPTER_PATH = "/v1/adapters";
+var RED_TEAM_ADAPTER_VALIDATE_PATH = "/v1/adapters/validate";
 var RED_TEAM_TEMPLATE_PATH = "/v1/template";
 var RED_TEAM_EULA_PATH = "/v1/eula";
 var RED_TEAM_INSTANCES_PATH = "/v1/instances";
@@ -4272,6 +4290,76 @@ var TenantLanguagesResponseSchema = import_zod33.z.object({
   supported_job_types: import_zod33.z.array(import_zod33.z.string()),
   languages: import_zod33.z.array(LanguageOptionSchema)
 }).passthrough();
+var AdapterVarTypeSchema = import_zod33.z.enum(["VAR", "SECRET"]);
+var AdapterVarSchema = import_zod33.z.object({
+  key: import_zod33.z.string().max(255),
+  value: import_zod33.z.string().nullable().optional(),
+  type: AdapterVarTypeSchema
+});
+var AdapterVarResponseSchema = AdapterVarSchema.extend({
+  is_redacted: import_zod33.z.boolean().optional()
+}).passthrough();
+var AdapterCreateRequestSchema = import_zod33.z.object({
+  name: import_zod33.z.string().max(255),
+  description: import_zod33.z.string().nullable().optional(),
+  script_b64: import_zod33.z.string(),
+  /** Optional while the adapter is a DRAFT; required to activate (`validate: true`). */
+  network_broker_channel_uuid: import_zod33.z.string().uuid().nullable().optional(),
+  variables: import_zod33.z.array(AdapterVarSchema).optional(),
+  /** Sample prompt used to exercise the adapter end-to-end during validation. Not stored. */
+  prompt: import_zod33.z.string()
+}).strict();
+var AdapterUpdateRequestSchema = import_zod33.z.object({
+  name: import_zod33.z.string().max(255),
+  description: import_zod33.z.string().nullable().optional(),
+  script_b64: import_zod33.z.string(),
+  network_broker_channel_uuid: import_zod33.z.string().uuid().nullable().optional(),
+  variables: import_zod33.z.array(AdapterVarSchema).optional(),
+  prompt: import_zod33.z.string()
+}).strict();
+var AdapterResponseSchema = import_zod33.z.object({
+  uuid: import_zod33.z.string().uuid(),
+  tsg_id: import_zod33.z.string(),
+  name: import_zod33.z.string(),
+  script_b64: import_zod33.z.string(),
+  status: import_zod33.z.string(),
+  description: import_zod33.z.string().nullable().optional(),
+  network_broker_channel_uuid: import_zod33.z.string().uuid().nullable().optional(),
+  variables: import_zod33.z.array(AdapterVarResponseSchema).optional(),
+  /** Number of targets currently referencing this adapter. */
+  target_count: import_zod33.z.number().int().optional(),
+  created_at: import_zod33.z.string().nullable().optional(),
+  updated_at: import_zod33.z.string().nullable().optional(),
+  created_by_user_id: import_zod33.z.string().uuid().nullable().optional(),
+  updated_by_user_id: import_zod33.z.string().uuid().nullable().optional()
+}).passthrough();
+var AdapterListItemSchema = import_zod33.z.object({
+  uuid: import_zod33.z.string().uuid(),
+  name: import_zod33.z.string(),
+  status: import_zod33.z.string(),
+  created_at: import_zod33.z.string(),
+  updated_at: import_zod33.z.string(),
+  created_by_user_id: import_zod33.z.string().uuid().nullable().optional(),
+  target_count: import_zod33.z.number().int().nullable().optional()
+}).passthrough();
+var AdapterListSchema = import_zod33.z.object({
+  pagination: RedTeamPaginationSchema,
+  data: import_zod33.z.array(AdapterListItemSchema).optional()
+}).passthrough();
+var AdapterValidateRequestSchema = import_zod33.z.object({
+  script_b64: import_zod33.z.string(),
+  network_broker_channel_uuid: import_zod33.z.string().uuid(),
+  prompt: import_zod33.z.string(),
+  variables: import_zod33.z.array(AdapterVarSchema).optional(),
+  /** Omit when validating a brand-new adapter. */
+  adapter_uuid: import_zod33.z.string().uuid().nullable().optional()
+}).strict();
+var AdapterValidateResponseSchema = import_zod33.z.object({
+  validated: import_zod33.z.boolean(),
+  stdout: import_zod33.z.string().nullable().optional(),
+  stderr: import_zod33.z.string().nullable().optional(),
+  traceback: import_zod33.z.string().nullable().optional()
+}).passthrough();
 var TargetRequestBaseFields = {
   name: import_zod33.z.string(),
   description: import_zod33.z.string().nullable().optional(),
@@ -4285,7 +4373,11 @@ var TargetRequestBaseFields = {
   target_background: TargetBackgroundSchema.nullable().optional(),
   additional_context: TargetAdditionalContextSchema.nullable().optional(),
   extra_info: import_zod33.z.record(import_zod33.z.unknown()).nullable().optional(),
-  network_broker_channel_uuid: import_zod33.z.string().nullable().optional()
+  network_broker_channel_uuid: import_zod33.z.string().nullable().optional(),
+  /** UUID of the custom target adapter to use. Required when connection_type is CUSTOM_TARGET_ADAPTER. */
+  adapter_uuid: import_zod33.z.string().uuid().nullable().optional(),
+  /** Per-target overrides for the adapter's variables. Array of AdapterVar objects. */
+  adapter_variable_overrides: import_zod33.z.array(AdapterVarSchema).nullable().optional()
 };
 var TargetCreateRequestSchema = import_zod33.z.object(TargetRequestBaseFields).strict();
 var TargetUpdateRequestSchema = import_zod33.z.object(TargetRequestBaseFields).strict();
@@ -4677,6 +4769,20 @@ var aiGatewayList = (item) => import_zod35.z.object({
   has_more: import_zod35.z.boolean().optional(),
   data: import_zod35.z.array(item)
 }).passthrough();
+var GatewayUsageLimitSchema = import_zod35.z.object({
+  credit_limit: import_zod35.z.number().optional(),
+  type: import_zod35.z.string().optional(),
+  alert_threshold: import_zod35.z.number().optional(),
+  periodic_reset: import_zod35.z.string().nullable().optional(),
+  periodic_reset_days: import_zod35.z.number().nullable().optional(),
+  next_usage_reset_at: import_zod35.z.string().nullable().optional()
+}).passthrough();
+var GatewayRateLimitSchema = import_zod35.z.object({
+  type: import_zod35.z.string().optional(),
+  unit: import_zod35.z.string().optional(),
+  value: import_zod35.z.number().optional()
+}).passthrough();
+var limitsField = (policy) => import_zod35.z.union([import_zod35.z.array(policy), import_zod35.z.record(import_zod35.z.unknown())]).nullable();
 var aiGatewayGroupList = (item) => import_zod35.z.object({
   object: import_zod35.z.string(),
   is_quota_exceeded: import_zod35.z.boolean(),
@@ -4883,7 +4989,9 @@ var GatewayWorkspaceSchema = import_zod35.z.object({
   slug: import_zod35.z.string(),
   name: import_zod35.z.string(),
   icon: import_zod35.z.string().nullable(),
-  description: import_zod35.z.string(),
+  // Nullable: a workspace created without one returns null, and upstream declares it
+  // `nullable: true`. Observed on an archived workspace (#213).
+  description: import_zod35.z.string().nullable(),
   created_at: import_zod35.z.string(),
   last_updated_at: import_zod35.z.string(),
   is_default: import_zod35.z.number(),
@@ -4894,18 +5002,38 @@ var GatewayWorkspaceSchema = import_zod35.z.object({
 var GatewayWorkspaceDetailSchema = import_zod35.z.object({
   id: import_zod35.z.string(),
   name: import_zod35.z.string(),
-  description: import_zod35.z.string(),
+  /** Nullable — see `GatewayWorkspaceSchema.description`. */
+  description: import_zod35.z.string().nullable(),
   created_at: import_zod35.z.string(),
   last_updated_at: import_zod35.z.string(),
   is_default: import_zod35.z.number(),
   slug: import_zod35.z.string(),
   icon: import_zod35.z.string().nullable(),
   defaults: import_zod35.z.record(import_zod35.z.unknown()).nullable(),
-  usage_limits: import_zod35.z.record(import_zod35.z.unknown()).nullable(),
-  rate_limits: import_zod35.z.record(import_zod35.z.unknown()).nullable(),
+  usage_limits: limitsField(GatewayUsageLimitSchema),
+  rate_limits: limitsField(GatewayRateLimitSchema),
   security_settings: import_zod35.z.record(import_zod35.z.boolean()).optional(),
   data_plane_security_settings: import_zod35.z.record(import_zod35.z.unknown()).optional(),
-  settings: import_zod35.z.record(import_zod35.z.unknown()).optional()
+  settings: import_zod35.z.record(import_zod35.z.unknown()).optional(),
+  /**
+   * Lifecycle state. **Diverges from the list row**: `list()` reports `'active'` for a
+   * workspace whose `get()` reports `null` (observed live 2026-08-01). Prefer the list value,
+   * or treat a `null` here as "unknown", not as "inactive".
+   */
+  status: import_zod35.z.string().nullable().optional()
+}).passthrough();
+var GatewayWorkspaceCreateResponseSchema = import_zod35.z.object({
+  id: import_zod35.z.string(),
+  name: import_zod35.z.string(),
+  slug: import_zod35.z.string(),
+  description: import_zod35.z.string().nullable(),
+  created_at: import_zod35.z.string(),
+  last_updated_at: import_zod35.z.string(),
+  scope_name: import_zod35.z.string(),
+  object: import_zod35.z.string(),
+  defaults: import_zod35.z.record(import_zod35.z.unknown()).nullable().optional(),
+  /** Seeded workspace members. Present on create only. */
+  users: import_zod35.z.array(import_zod35.z.unknown()).optional()
 }).passthrough();
 var ListWorkspacesResponseSchema = aiGatewayList(GatewayWorkspaceSchema);
 var GatewayConfigSchema = import_zod35.z.object({
@@ -5021,8 +5149,8 @@ var GatewayIntegrationModelsResponseSchema = import_zod35.z.object({
 }).passthrough();
 var GatewayIntegrationWorkspaceSchema = import_zod35.z.object({
   id: import_zod35.z.string(),
-  usage_limits: import_zod35.z.record(import_zod35.z.unknown()).nullable(),
-  rate_limits: import_zod35.z.record(import_zod35.z.unknown()).nullable(),
+  usage_limits: limitsField(GatewayUsageLimitSchema),
+  rate_limits: limitsField(GatewayRateLimitSchema),
   enabled: import_zod35.z.boolean(),
   status: import_zod35.z.string(),
   created_at: import_zod35.z.string(),
@@ -5031,8 +5159,8 @@ var GatewayIntegrationWorkspaceSchema = import_zod35.z.object({
 }).passthrough();
 var GatewayGlobalWorkspaceAccessSchema = import_zod35.z.object({
   enabled: import_zod35.z.boolean(),
-  rate_limits: import_zod35.z.record(import_zod35.z.unknown()).nullable(),
-  usage_limits: import_zod35.z.record(import_zod35.z.unknown()).nullable()
+  rate_limits: limitsField(GatewayRateLimitSchema),
+  usage_limits: limitsField(GatewayUsageLimitSchema)
 }).passthrough();
 var GatewayIntegrationWorkspacesResponseSchema = import_zod35.z.object({
   workspaces: import_zod35.z.array(GatewayIntegrationWorkspaceSchema),
@@ -5384,6 +5512,14 @@ function assertUuid(value, fieldName) {
     );
   }
 }
+function assertWorkspaceRef(value, fieldName) {
+  if (!isValidUuid(value) && !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value)) {
+    throw new AISecSDKException(
+      `Invalid ${fieldName}: ${value} (expected a workspace UUID or slug)`,
+      "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+    );
+  }
+}
 function assertNumericId(value, fieldName) {
   if (!/^\d+$/.test(value)) {
     throw new AISecSDKException(
@@ -10206,6 +10342,176 @@ var RedTeamNetworkBrokerClient = class {
   }
 };
 
+// src/red-team/adapters-client.ts
+var RedTeamAdaptersClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * Create a new custom target adapter.
+   * @param body - Adapter creation request (name, base64 script, variables, validation prompt).
+   * @param opts - Set validate: false to save as DRAFT without running the script.
+   * @returns The created adapter.
+   * @example
+   * ```ts
+   * const adapter = await rt.adapters.create({
+   *   name: 'my-adapter',
+   *   script_b64: Buffer.from(script).toString('base64'),
+   *   network_broker_channel_uuid: '550e8400-...',
+   *   variables: [{ key: 'endpoint', value: 'http://...', type: 'VAR' }],
+   *   prompt: 'Hello',
+   * }, { validate: true });
+   * ```
+   */
+  async create(body, opts) {
+    const validate = opts?.validate ?? true;
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_ADAPTER_PATH,
+      params: { validate: String(validate) },
+      body,
+      responseSchema: AdapterResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List adapters with optional pagination.
+   * @param opts - Optional limit/skip/search.
+   * @returns Paginated list of adapters.
+   * @example
+   * ```ts
+   * const { data } = await rt.adapters.list({ limit: 20 });
+   * // data => [{ uuid: '...', name: 'my-adapter', status: 'ACTIVE' }]
+   * ```
+   */
+  async list(opts) {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_ADAPTER_PATH,
+      params: serializeListing(opts),
+      responseSchema: AdapterListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a single adapter by UUID.
+   * @param uuid - Adapter UUID.
+   * @returns The adapter detail.
+   * @example
+   * ```ts
+   * const adapter = await rt.adapters.get('550e8400-e29b-41d4-a716-446655440000');
+   * // adapter.status => 'ACTIVE'
+   * ```
+   */
+  async get(uuid) {
+    assertUuid(uuid, "adapter uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      responseSchema: AdapterResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update an adapter. **Full replacement (PUT), not a patch** — `name`, `script_b64`, and
+   * `prompt` are required just as on create. For `variables`, the list defines the complete
+   * desired key set: a provided value sets it, `null` keeps the stored value (unchanged
+   * secrets), and omitting a key **deletes** that variable.
+   * @param uuid - Adapter UUID.
+   * @param body - The complete adapter definition.
+   * @param opts - Set validate: false to save as DRAFT without re-running the script.
+   * @returns The updated adapter.
+   * @example
+   * ```ts
+   * const updated = await rt.adapters.update('550e8400-...', {
+   *   name: 'my-keycloak-agent',
+   *   script_b64: Buffer.from(newScript).toString('base64'),
+   *   prompt: 'What is the capital of France?',
+   *   variables: [
+   *     { key: 'endpoint', value: 'http://agent.svc:8080', type: 'VAR' },
+   *     { key: 'client_secret', value: null, type: 'SECRET' }, // null keeps stored secret
+   *   ],
+   * });
+   * ```
+   */
+  async update(uuid, body, opts) {
+    assertUuid(uuid, "adapter uuid");
+    const validate = opts?.validate ?? true;
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      params: { validate: String(validate) },
+      body,
+      responseSchema: AdapterResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Delete an adapter.
+   * @param uuid - Adapter UUID.
+   * @example
+   * ```ts
+   * await rt.adapters.delete('550e8400-e29b-41d4-a716-446655440000');
+   * ```
+   */
+  async delete(uuid) {
+    assertUuid(uuid, "adapter uuid");
+    return request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      responseSchema: BaseResponseSchema.optional(),
+      allowEmptyBody: true,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Validate an adapter script without saving anything. Runs the script end-to-end through the
+   * network broker channel using the sample prompt, and returns the execution outcome —
+   * `validated` plus the script's `stdout` / `stderr` / `traceback` — not an adapter record.
+   *
+   * This endpoint has its own request shape: no `name`, `network_broker_channel_uuid` is
+   * required, and `adapter_uuid` may reference an existing adapter so `null` variable values
+   * are resolved from its stored secrets before the run.
+   * @param body - Script, channel, prompt, and optionally variables / an existing adapter UUID.
+   * @returns The validation outcome.
+   * @example
+   * ```ts
+   * const result = await rt.adapters.validate({
+   *   script_b64: Buffer.from(script).toString('base64'),
+   *   network_broker_channel_uuid: '550e8400-...',
+   *   prompt: 'Hello',
+   * });
+   * if (!result.validated) console.error(result.stderr ?? result.traceback);
+   * ```
+   */
+  async validate(body) {
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_ADAPTER_VALIDATE_PATH,
+      body,
+      responseSchema: AdapterValidateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
 // src/red-team/client.ts
 var RedTeamClient = class {
   /** Data plane scan operations. */
@@ -10224,6 +10530,8 @@ var RedTeamClient = class {
   instances;
   /** Network broker channel operations (distinct network broker base URL). */
   networkBroker;
+  /** Management plane custom target adapter operations. */
+  adapters;
   dataEndpoint;
   mgmtEndpoint;
   auth;
@@ -10262,6 +10570,7 @@ var RedTeamClient = class {
     });
     this.eula = new RedTeamEulaClient({ baseUrl: mgmtEndpoint, auth, numRetries });
     this.instances = new RedTeamInstancesClient({ baseUrl: mgmtEndpoint, auth, numRetries });
+    this.adapters = new RedTeamAdaptersClient({ baseUrl: mgmtEndpoint, auth, numRetries });
     this.networkBroker = new RedTeamNetworkBrokerClient({
       baseUrl: networkBrokerEndpoint,
       auth,
@@ -10959,30 +11268,49 @@ var AIGatewayTelemetryClient = class {
 // src/ai-gateway/workspaces-client.ts
 var AIGatewayWorkspacesClient = class {
   baseUrl;
+  adminBaseUrl;
   auth;
   numRetries;
   constructor(opts) {
     this.baseUrl = opts.baseUrl;
+    this.adminBaseUrl = opts.adminBaseUrl;
     this.auth = opts.auth;
     this.numRetries = opts.numRetries;
   }
+  urlFor(plane) {
+    return plane === "admin" ? this.adminBaseUrl : this.baseUrl;
+  }
   /**
-   * List workspaces visible to the caller.
-   * @returns All workspaces, each with the `scope_name` that grants data-plane access to it.
+   * List workspaces.
+   *
+   * Two defaults worth knowing, because each one hides rows:
+   *
+   * 1. **Active only.** Without `status`, archived workspaces are omitted. Pass
+   *    `{ status: 'archived' }` to see them — that is where {@link AIGatewayWorkspacesClient.delete}
+   *    leaves a workspace.
+   * 2. **Your scope only.** The data plane returns just the workspaces your service account holds a
+   *    workspace-scope grant on. Pass `{ plane: 'admin' }` to enumerate the whole tenant.
+   *
+   * @param options - Optional status filter and plane selection.
+   * @returns Workspaces, each with the `scope_name` that grants data-plane access to it.
    * @example
    * ```ts
    * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
    * const gw = new AIGatewayClient();
    *
-   * const ws = await gw.workspaces.list();
-   * // ws.data[0] => { slug: 'ws-main-a-349e0e', scope_name: 'main_airs_workspace_1852583913', ... }
+   * const mine = await gw.workspaces.list();
+   * // mine.data[0] => { slug: 'ws-main-a-349e0e', scope_name: 'main_airs_workspace_1852583913', ... }
+   *
+   * const everything = await gw.workspaces.list({ plane: 'admin' });
+   * const archived = await gw.workspaces.list({ plane: 'admin', status: 'archived' });
    * ```
    */
-  async list() {
+  async list(options = {}) {
     return request({
       method: "GET",
-      baseUrl: this.baseUrl,
+      baseUrl: this.urlFor(options.plane),
       path: AI_GW_WORKSPACES_PATH,
+      params: options.status ? { status: options.status } : void 0,
       responseSchema: ListWorkspacesResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -10990,7 +11318,16 @@ var AIGatewayWorkspacesClient = class {
   }
   /**
    * Fetch one workspace, including its security and rate-limit settings.
-   * @param workspaceId - Workspace UUID.
+   *
+   * @param workspaceRef - Workspace UUID **or** slug; the API accepts both.
+   * @param options - Plane selection. A workspace outside your workspace scope answers `403 AB03`
+   * on the data plane, not `404`; re-read it with `{ plane: 'admin' }`.
+   *
+   * **Archived workspaces are not retrievable here.** Once
+   * {@link AIGatewayWorkspacesClient.delete} has archived a workspace, this returns `404 AB08`
+   * for both its UUID and its slug, on either plane (verified live 2026-08-01) — even though the
+   * row is still listed by `list({ status: 'archived' })`. Treat a 404 after a delete as expected,
+   * and use the list filter to inspect archived workspaces.
    * @returns Workspace detail; list rows do not carry the settings blocks.
    * @example
    * ```ts
@@ -10999,19 +11336,133 @@ var AIGatewayWorkspacesClient = class {
    *
    * const ws = await gw.workspaces.get('16f7e90d-382a-4e78-b577-1b01eb5f8297');
    * // ws.security_settings?.membersViewLogs => true
+   *
+   * // Slugs work too, and the admin plane reaches workspaces you aren't scoped to:
+   * const other = await gw.workspaces.get('ws-produc-985697', { plane: 'admin' });
    * ```
    */
-  async get(workspaceId) {
-    assertUuid(workspaceId, "workspaceId");
+  async get(workspaceRef, options = {}) {
+    assertWorkspaceRef(workspaceRef, "workspaceRef");
     return request({
       method: "GET",
-      baseUrl: this.baseUrl,
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceId}`,
+      baseUrl: this.urlFor(options.plane),
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
       responseSchema: GatewayWorkspaceDetailSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /**
+   * Create a workspace. **Admin plane** — needs a tenant-root admin role.
+   *
+   * @param body - `name` and `scope_name` are both required; the API rejects a body missing either.
+   * @returns The created workspace. Unlike `configs`/`guardrails`/`providers`/`deployments`,
+   * which return short receipts, this returns most of the record — but not `status`,
+   * `is_default`, `icon`, `usage_limits`, `rate_limits`, or the settings blocks. Call
+   * {@link AIGatewayWorkspacesClient.get} when you need those.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const created = await gw.workspaces.create({
+   *   name: 'Production',
+   *   scope_name: 'ws_production_bx7qw0', // the SCM scope, not derived from name
+   *   description: 'All production applications',
+   *   defaults: { metadata: { env: 'production' } },
+   *   rate_limits: [{ type: 'requests', unit: 'rpm', value: 100 }],
+   * });
+   * ```
+   */
+  async create(body) {
+    if (!body.name) {
+      throw new AISecSDKException("Missing name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
+    }
+    if (!body.scope_name) {
+      throw new AISecSDKException("Missing scope_name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
+    }
+    return request({
+      method: "POST",
+      baseUrl: this.adminBaseUrl,
+      path: AI_GW_WORKSPACES_PATH,
+      body,
+      responseSchema: GatewayWorkspaceCreateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update a workspace. **Admin plane.** Partial patch — send only the fields that change.
+   *
+   * @param workspaceRef - Workspace UUID or slug.
+   * @param body - At least one field. An empty patch is rejected locally, mirroring the API's own
+   * "No update fields provided" rejection, so a typo'd caller fails without a round trip.
+   * @returns An **empty object** — the API acknowledges the write without echoing the record
+   * (verified live 2026-08-01). The change does persist; re-read with
+   * {@link AIGatewayWorkspacesClient.get} to see it.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.workspaces.update('ws-produc-985697', {
+   *   description: 'Production workloads, us-east',
+   * });
+   * ```
+   */
+  async update(workspaceRef, body) {
+    assertWorkspaceRef(workspaceRef, "workspaceRef");
+    if (Object.keys(body).length === 0) {
+      throw new AISecSDKException(
+        "Empty update: provide at least one of name, description, icon, defaults, usage_limits, rate_limits",
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    return request({
+      method: "PUT",
+      baseUrl: this.adminBaseUrl,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Delete a workspace. **Admin plane.**
+   *
+   * This is a **soft delete**: the workspace is archived, not destroyed. It vanishes from a default
+   * {@link AIGatewayWorkspacesClient.list} but stays visible via `list({ status: 'archived' })`.
+   * Note that `list` is the *only* way to see it afterwards —
+   * {@link AIGatewayWorkspacesClient.get} answers `404 AB08` for an archived workspace.
+   * Same semantics as `deployments.delete()`, and the opposite of `configs`/`guardrails`/`providers`,
+   * which hard delete. There is no hard delete for workspaces.
+   *
+   * Takes no query parameters — unlike `integrations.delete()` and `deployments.delete()`, which
+   * both require `organisation_id`.
+   *
+   * @param workspaceRef - Workspace UUID or slug.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.workspaces.delete('ws-produc-985697');
+   *
+   * // Still there, archived:
+   * const gone = await gw.workspaces.list({ plane: 'admin', status: 'archived' });
+   * ```
+   */
+  async delete(workspaceRef) {
+    assertWorkspaceRef(workspaceRef, "workspaceRef");
+    return request({
+      method: "DELETE",
+      baseUrl: this.adminBaseUrl,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
 };
 
 // src/ai-gateway/configs-client.ts
@@ -12333,7 +12784,7 @@ var AIGatewayClient = class {
     const dataOpts = { baseUrl: dataEndpoint, auth, numRetries };
     const adminOpts = { baseUrl: adminEndpoint, auth, numRetries };
     this.telemetry = new AIGatewayTelemetryClient({ ...dataOpts, tsgId });
-    this.workspaces = new AIGatewayWorkspacesClient(dataOpts);
+    this.workspaces = new AIGatewayWorkspacesClient({ ...dataOpts, adminBaseUrl: adminEndpoint });
     this.configs = new AIGatewayConfigsClient(dataOpts);
     this.guardrails = new AIGatewayGuardrailsClient(dataOpts);
     this.providers = new AIGatewayProvidersClient(dataOpts);
@@ -12388,6 +12839,16 @@ var AIGatewayClient = class {
   AI_SEC_API_TOKEN,
   ASYNC_SCAN_PATH,
   Action,
+  AdapterCreateRequestSchema,
+  AdapterListItemSchema,
+  AdapterListSchema,
+  AdapterResponseSchema,
+  AdapterUpdateRequestSchema,
+  AdapterValidateRequestSchema,
+  AdapterValidateResponseSchema,
+  AdapterVarResponseSchema,
+  AdapterVarSchema,
+  AdapterVarTypeSchema,
   AdvancedDataProfileRequestSchema,
   AgentEntrySchema,
   AgentMetaSchema,
@@ -12628,6 +13089,9 @@ var AIGatewayClient = class {
   GatewayPluginSchema,
   GatewayProviderCreateResponseSchema,
   GatewayProviderSchema,
+  GatewayRateLimitSchema,
+  GatewayUsageLimitSchema,
+  GatewayWorkspaceCreateResponseSchema,
   GatewayWorkspaceDetailSchema,
   GatewayWorkspaceSchema,
   GatewayWriteResponseSchema,
@@ -12800,6 +13264,8 @@ var AIGatewayClient = class {
   PyPIAuthResponseSchema,
   QuotaDetailsSchema,
   QuotaSummarySchema,
+  RED_TEAM_ADAPTER_PATH,
+  RED_TEAM_ADAPTER_VALIDATE_PATH,
   RED_TEAM_CATEGORIES_PATH,
   RED_TEAM_CHANNELS_PATH,
   RED_TEAM_CHANNELS_STATS_PATH,
@@ -12829,6 +13295,7 @@ var AIGatewayClient = class {
   RED_TEAM_TEMPLATE_PATH,
   RED_TEAM_TOKEN_ENDPOINT,
   RED_TEAM_TSG_ID,
+  RedTeamAdaptersClient,
   RedTeamCategory,
   RedTeamClient,
   RedTeamCustomAttackReportsClient,