@cdot65/prisma-airs-sdk 0.14.1 → 0.17.0

package/dist/index.js

@@ -29,7 +29,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 20;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.14.1";
+var SDK_VERSION = "0.17.0";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -104,6 +104,8 @@ var RED_TEAM_LANGUAGES_PATH = "/v1/languages";
 var RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH = "/v1/error-log/target-profile";
 var RED_TEAM_TARGET_PATH = "/v1/target";
 var RED_TEAM_TARGET_VALIDATE_AUTH_PATH = "/v1/target/validate-auth";
+var RED_TEAM_ADAPTER_PATH = "/v1/adapters";
+var RED_TEAM_ADAPTER_VALIDATE_PATH = "/v1/adapters/validate";
 var RED_TEAM_TEMPLATE_PATH = "/v1/template";
 var RED_TEAM_EULA_PATH = "/v1/eula";
 var RED_TEAM_INSTANCES_PATH = "/v1/instances";
@@ -3619,6 +3621,76 @@ var TenantLanguagesResponseSchema = z33.object({
   supported_job_types: z33.array(z33.string()),
   languages: z33.array(LanguageOptionSchema)
 }).passthrough();
+var AdapterVarTypeSchema = z33.enum(["VAR", "SECRET"]);
+var AdapterVarSchema = z33.object({
+  key: z33.string().max(255),
+  value: z33.string().nullable().optional(),
+  type: AdapterVarTypeSchema
+});
+var AdapterVarResponseSchema = AdapterVarSchema.extend({
+  is_redacted: z33.boolean().optional()
+}).passthrough();
+var AdapterCreateRequestSchema = z33.object({
+  name: z33.string().max(255),
+  description: z33.string().nullable().optional(),
+  script_b64: z33.string(),
+  /** Optional while the adapter is a DRAFT; required to activate (`validate: true`). */
+  network_broker_channel_uuid: z33.string().uuid().nullable().optional(),
+  variables: z33.array(AdapterVarSchema).optional(),
+  /** Sample prompt used to exercise the adapter end-to-end during validation. Not stored. */
+  prompt: z33.string()
+}).strict();
+var AdapterUpdateRequestSchema = z33.object({
+  name: z33.string().max(255),
+  description: z33.string().nullable().optional(),
+  script_b64: z33.string(),
+  network_broker_channel_uuid: z33.string().uuid().nullable().optional(),
+  variables: z33.array(AdapterVarSchema).optional(),
+  prompt: z33.string()
+}).strict();
+var AdapterResponseSchema = z33.object({
+  uuid: z33.string().uuid(),
+  tsg_id: z33.string(),
+  name: z33.string(),
+  script_b64: z33.string(),
+  status: z33.string(),
+  description: z33.string().nullable().optional(),
+  network_broker_channel_uuid: z33.string().uuid().nullable().optional(),
+  variables: z33.array(AdapterVarResponseSchema).optional(),
+  /** Number of targets currently referencing this adapter. */
+  target_count: z33.number().int().optional(),
+  created_at: z33.string().nullable().optional(),
+  updated_at: z33.string().nullable().optional(),
+  created_by_user_id: z33.string().uuid().nullable().optional(),
+  updated_by_user_id: z33.string().uuid().nullable().optional()
+}).passthrough();
+var AdapterListItemSchema = z33.object({
+  uuid: z33.string().uuid(),
+  name: z33.string(),
+  status: z33.string(),
+  created_at: z33.string(),
+  updated_at: z33.string(),
+  created_by_user_id: z33.string().uuid().nullable().optional(),
+  target_count: z33.number().int().nullable().optional()
+}).passthrough();
+var AdapterListSchema = z33.object({
+  pagination: RedTeamPaginationSchema,
+  data: z33.array(AdapterListItemSchema).optional()
+}).passthrough();
+var AdapterValidateRequestSchema = z33.object({
+  script_b64: z33.string(),
+  network_broker_channel_uuid: z33.string().uuid(),
+  prompt: z33.string(),
+  variables: z33.array(AdapterVarSchema).optional(),
+  /** Omit when validating a brand-new adapter. */
+  adapter_uuid: z33.string().uuid().nullable().optional()
+}).strict();
+var AdapterValidateResponseSchema = z33.object({
+  validated: z33.boolean(),
+  stdout: z33.string().nullable().optional(),
+  stderr: z33.string().nullable().optional(),
+  traceback: z33.string().nullable().optional()
+}).passthrough();
 var TargetRequestBaseFields = {
   name: z33.string(),
   description: z33.string().nullable().optional(),
@@ -3632,7 +3704,11 @@ var TargetRequestBaseFields = {
   target_background: TargetBackgroundSchema.nullable().optional(),
   additional_context: TargetAdditionalContextSchema.nullable().optional(),
   extra_info: z33.record(z33.unknown()).nullable().optional(),
-  network_broker_channel_uuid: z33.string().nullable().optional()
+  network_broker_channel_uuid: z33.string().nullable().optional(),
+  /** UUID of the custom target adapter to use. Required when connection_type is CUSTOM_TARGET_ADAPTER. */
+  adapter_uuid: z33.string().uuid().nullable().optional(),
+  /** Per-target overrides for the adapter's variables. Array of AdapterVar objects. */
+  adapter_variable_overrides: z33.array(AdapterVarSchema).nullable().optional()
 };
 var TargetCreateRequestSchema = z33.object(TargetRequestBaseFields).strict();
 var TargetUpdateRequestSchema = z33.object(TargetRequestBaseFields).strict();
@@ -4024,6 +4100,20 @@ var aiGatewayList = (item) => z35.object({
   has_more: z35.boolean().optional(),
   data: z35.array(item)
 }).passthrough();
+var GatewayUsageLimitSchema = z35.object({
+  credit_limit: z35.number().optional(),
+  type: z35.string().optional(),
+  alert_threshold: z35.number().optional(),
+  periodic_reset: z35.string().nullable().optional(),
+  periodic_reset_days: z35.number().nullable().optional(),
+  next_usage_reset_at: z35.string().nullable().optional()
+}).passthrough();
+var GatewayRateLimitSchema = z35.object({
+  type: z35.string().optional(),
+  unit: z35.string().optional(),
+  value: z35.number().optional()
+}).passthrough();
+var limitsField = (policy) => z35.union([z35.array(policy), z35.record(z35.unknown())]).nullable();
 var aiGatewayGroupList = (item) => z35.object({
   object: z35.string(),
   is_quota_exceeded: z35.boolean(),
@@ -4230,7 +4320,9 @@ var GatewayWorkspaceSchema = z35.object({
   slug: z35.string(),
   name: z35.string(),
   icon: z35.string().nullable(),
-  description: z35.string(),
+  // Nullable: a workspace created without one returns null, and upstream declares it
+  // `nullable: true`. Observed on an archived workspace (#213).
+  description: z35.string().nullable(),
   created_at: z35.string(),
   last_updated_at: z35.string(),
   is_default: z35.number(),
@@ -4241,18 +4333,38 @@ var GatewayWorkspaceSchema = z35.object({
 var GatewayWorkspaceDetailSchema = z35.object({
   id: z35.string(),
   name: z35.string(),
-  description: z35.string(),
+  /** Nullable — see `GatewayWorkspaceSchema.description`. */
+  description: z35.string().nullable(),
   created_at: z35.string(),
   last_updated_at: z35.string(),
   is_default: z35.number(),
   slug: z35.string(),
   icon: z35.string().nullable(),
   defaults: z35.record(z35.unknown()).nullable(),
-  usage_limits: z35.record(z35.unknown()).nullable(),
-  rate_limits: z35.record(z35.unknown()).nullable(),
+  usage_limits: limitsField(GatewayUsageLimitSchema),
+  rate_limits: limitsField(GatewayRateLimitSchema),
   security_settings: z35.record(z35.boolean()).optional(),
   data_plane_security_settings: z35.record(z35.unknown()).optional(),
-  settings: z35.record(z35.unknown()).optional()
+  settings: z35.record(z35.unknown()).optional(),
+  /**
+   * Lifecycle state. **Diverges from the list row**: `list()` reports `'active'` for a
+   * workspace whose `get()` reports `null` (observed live 2026-08-01). Prefer the list value,
+   * or treat a `null` here as "unknown", not as "inactive".
+   */
+  status: z35.string().nullable().optional()
+}).passthrough();
+var GatewayWorkspaceCreateResponseSchema = z35.object({
+  id: z35.string(),
+  name: z35.string(),
+  slug: z35.string(),
+  description: z35.string().nullable(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  scope_name: z35.string(),
+  object: z35.string(),
+  defaults: z35.record(z35.unknown()).nullable().optional(),
+  /** Seeded workspace members. Present on create only. */
+  users: z35.array(z35.unknown()).optional()
 }).passthrough();
 var ListWorkspacesResponseSchema = aiGatewayList(GatewayWorkspaceSchema);
 var GatewayConfigSchema = z35.object({
@@ -4368,8 +4480,8 @@ var GatewayIntegrationModelsResponseSchema = z35.object({
 }).passthrough();
 var GatewayIntegrationWorkspaceSchema = z35.object({
   id: z35.string(),
-  usage_limits: z35.record(z35.unknown()).nullable(),
-  rate_limits: z35.record(z35.unknown()).nullable(),
+  usage_limits: limitsField(GatewayUsageLimitSchema),
+  rate_limits: limitsField(GatewayRateLimitSchema),
   enabled: z35.boolean(),
   status: z35.string(),
   created_at: z35.string(),
@@ -4378,8 +4490,8 @@ var GatewayIntegrationWorkspaceSchema = z35.object({
 }).passthrough();
 var GatewayGlobalWorkspaceAccessSchema = z35.object({
   enabled: z35.boolean(),
-  rate_limits: z35.record(z35.unknown()).nullable(),
-  usage_limits: z35.record(z35.unknown()).nullable()
+  rate_limits: limitsField(GatewayRateLimitSchema),
+  usage_limits: limitsField(GatewayUsageLimitSchema)
 }).passthrough();
 var GatewayIntegrationWorkspacesResponseSchema = z35.object({
   workspaces: z35.array(GatewayIntegrationWorkspaceSchema),
@@ -4731,6 +4843,14 @@ function assertUuid(value, fieldName) {
     );
   }
 }
+function assertWorkspaceRef(value, fieldName) {
+  if (!isValidUuid(value) && !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value)) {
+    throw new AISecSDKException(
+      `Invalid ${fieldName}: ${value} (expected a workspace UUID or slug)`,
+      "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+    );
+  }
+}
 function assertNumericId(value, fieldName) {
   if (!/^\d+$/.test(value)) {
     throw new AISecSDKException(
@@ -9553,6 +9673,176 @@ var RedTeamNetworkBrokerClient = class {
   }
 };
 
+// src/red-team/adapters-client.ts
+var RedTeamAdaptersClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * Create a new custom target adapter.
+   * @param body - Adapter creation request (name, base64 script, variables, validation prompt).
+   * @param opts - Set validate: false to save as DRAFT without running the script.
+   * @returns The created adapter.
+   * @example
+   * ```ts
+   * const adapter = await rt.adapters.create({
+   *   name: 'my-adapter',
+   *   script_b64: Buffer.from(script).toString('base64'),
+   *   network_broker_channel_uuid: '550e8400-...',
+   *   variables: [{ key: 'endpoint', value: 'http://...', type: 'VAR' }],
+   *   prompt: 'Hello',
+   * }, { validate: true });
+   * ```
+   */
+  async create(body, opts) {
+    const validate = opts?.validate ?? true;
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_ADAPTER_PATH,
+      params: { validate: String(validate) },
+      body,
+      responseSchema: AdapterResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List adapters with optional pagination.
+   * @param opts - Optional limit/skip/search.
+   * @returns Paginated list of adapters.
+   * @example
+   * ```ts
+   * const { data } = await rt.adapters.list({ limit: 20 });
+   * // data => [{ uuid: '...', name: 'my-adapter', status: 'ACTIVE' }]
+   * ```
+   */
+  async list(opts) {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_ADAPTER_PATH,
+      params: serializeListing(opts),
+      responseSchema: AdapterListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Get a single adapter by UUID.
+   * @param uuid - Adapter UUID.
+   * @returns The adapter detail.
+   * @example
+   * ```ts
+   * const adapter = await rt.adapters.get('550e8400-e29b-41d4-a716-446655440000');
+   * // adapter.status => 'ACTIVE'
+   * ```
+   */
+  async get(uuid) {
+    assertUuid(uuid, "adapter uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      responseSchema: AdapterResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update an adapter. **Full replacement (PUT), not a patch** — `name`, `script_b64`, and
+   * `prompt` are required just as on create. For `variables`, the list defines the complete
+   * desired key set: a provided value sets it, `null` keeps the stored value (unchanged
+   * secrets), and omitting a key **deletes** that variable.
+   * @param uuid - Adapter UUID.
+   * @param body - The complete adapter definition.
+   * @param opts - Set validate: false to save as DRAFT without re-running the script.
+   * @returns The updated adapter.
+   * @example
+   * ```ts
+   * const updated = await rt.adapters.update('550e8400-...', {
+   *   name: 'my-keycloak-agent',
+   *   script_b64: Buffer.from(newScript).toString('base64'),
+   *   prompt: 'What is the capital of France?',
+   *   variables: [
+   *     { key: 'endpoint', value: 'http://agent.svc:8080', type: 'VAR' },
+   *     { key: 'client_secret', value: null, type: 'SECRET' }, // null keeps stored secret
+   *   ],
+   * });
+   * ```
+   */
+  async update(uuid, body, opts) {
+    assertUuid(uuid, "adapter uuid");
+    const validate = opts?.validate ?? true;
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      params: { validate: String(validate) },
+      body,
+      responseSchema: AdapterResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Delete an adapter.
+   * @param uuid - Adapter UUID.
+   * @example
+   * ```ts
+   * await rt.adapters.delete('550e8400-e29b-41d4-a716-446655440000');
+   * ```
+   */
+  async delete(uuid) {
+    assertUuid(uuid, "adapter uuid");
+    return request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      responseSchema: BaseResponseSchema.optional(),
+      allowEmptyBody: true,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Validate an adapter script without saving anything. Runs the script end-to-end through the
+   * network broker channel using the sample prompt, and returns the execution outcome —
+   * `validated` plus the script's `stdout` / `stderr` / `traceback` — not an adapter record.
+   *
+   * This endpoint has its own request shape: no `name`, `network_broker_channel_uuid` is
+   * required, and `adapter_uuid` may reference an existing adapter so `null` variable values
+   * are resolved from its stored secrets before the run.
+   * @param body - Script, channel, prompt, and optionally variables / an existing adapter UUID.
+   * @returns The validation outcome.
+   * @example
+   * ```ts
+   * const result = await rt.adapters.validate({
+   *   script_b64: Buffer.from(script).toString('base64'),
+   *   network_broker_channel_uuid: '550e8400-...',
+   *   prompt: 'Hello',
+   * });
+   * if (!result.validated) console.error(result.stderr ?? result.traceback);
+   * ```
+   */
+  async validate(body) {
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_ADAPTER_VALIDATE_PATH,
+      body,
+      responseSchema: AdapterValidateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
 // src/red-team/client.ts
 var RedTeamClient = class {
   /** Data plane scan operations. */
@@ -9571,6 +9861,8 @@ var RedTeamClient = class {
   instances;
   /** Network broker channel operations (distinct network broker base URL). */
   networkBroker;
+  /** Management plane custom target adapter operations. */
+  adapters;
   dataEndpoint;
   mgmtEndpoint;
   auth;
@@ -9609,6 +9901,7 @@ var RedTeamClient = class {
     });
     this.eula = new RedTeamEulaClient({ baseUrl: mgmtEndpoint, auth, numRetries });
     this.instances = new RedTeamInstancesClient({ baseUrl: mgmtEndpoint, auth, numRetries });
+    this.adapters = new RedTeamAdaptersClient({ baseUrl: mgmtEndpoint, auth, numRetries });
     this.networkBroker = new RedTeamNetworkBrokerClient({
       baseUrl: networkBrokerEndpoint,
       auth,
@@ -10306,30 +10599,49 @@ var AIGatewayTelemetryClient = class {
 // src/ai-gateway/workspaces-client.ts
 var AIGatewayWorkspacesClient = class {
   baseUrl;
+  adminBaseUrl;
   auth;
   numRetries;
   constructor(opts) {
     this.baseUrl = opts.baseUrl;
+    this.adminBaseUrl = opts.adminBaseUrl;
     this.auth = opts.auth;
     this.numRetries = opts.numRetries;
   }
+  urlFor(plane) {
+    return plane === "admin" ? this.adminBaseUrl : this.baseUrl;
+  }
   /**
-   * List workspaces visible to the caller.
-   * @returns All workspaces, each with the `scope_name` that grants data-plane access to it.
+   * List workspaces.
+   *
+   * Two defaults worth knowing, because each one hides rows:
+   *
+   * 1. **Active only.** Without `status`, archived workspaces are omitted. Pass
+   *    `{ status: 'archived' }` to see them — that is where {@link AIGatewayWorkspacesClient.delete}
+   *    leaves a workspace.
+   * 2. **Your scope only.** The data plane returns just the workspaces your service account holds a
+   *    workspace-scope grant on. Pass `{ plane: 'admin' }` to enumerate the whole tenant.
+   *
+   * @param options - Optional status filter and plane selection.
+   * @returns Workspaces, each with the `scope_name` that grants data-plane access to it.
    * @example
    * ```ts
    * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
    * const gw = new AIGatewayClient();
    *
-   * const ws = await gw.workspaces.list();
-   * // ws.data[0] => { slug: 'ws-main-a-349e0e', scope_name: 'main_airs_workspace_1852583913', ... }
+   * const mine = await gw.workspaces.list();
+   * // mine.data[0] => { slug: 'ws-main-a-349e0e', scope_name: 'main_airs_workspace_1852583913', ... }
+   *
+   * const everything = await gw.workspaces.list({ plane: 'admin' });
+   * const archived = await gw.workspaces.list({ plane: 'admin', status: 'archived' });
    * ```
    */
-  async list() {
+  async list(options = {}) {
     return request({
       method: "GET",
-      baseUrl: this.baseUrl,
+      baseUrl: this.urlFor(options.plane),
       path: AI_GW_WORKSPACES_PATH,
+      params: options.status ? { status: options.status } : void 0,
       responseSchema: ListWorkspacesResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -10337,7 +10649,16 @@ var AIGatewayWorkspacesClient = class {
   }
   /**
    * Fetch one workspace, including its security and rate-limit settings.
-   * @param workspaceId - Workspace UUID.
+   *
+   * @param workspaceRef - Workspace UUID **or** slug; the API accepts both.
+   * @param options - Plane selection. A workspace outside your workspace scope answers `403 AB03`
+   * on the data plane, not `404`; re-read it with `{ plane: 'admin' }`.
+   *
+   * **Archived workspaces are not retrievable here.** Once
+   * {@link AIGatewayWorkspacesClient.delete} has archived a workspace, this returns `404 AB08`
+   * for both its UUID and its slug, on either plane (verified live 2026-08-01) — even though the
+   * row is still listed by `list({ status: 'archived' })`. Treat a 404 after a delete as expected,
+   * and use the list filter to inspect archived workspaces.
    * @returns Workspace detail; list rows do not carry the settings blocks.
    * @example
    * ```ts
@@ -10346,19 +10667,133 @@ var AIGatewayWorkspacesClient = class {
    *
    * const ws = await gw.workspaces.get('16f7e90d-382a-4e78-b577-1b01eb5f8297');
    * // ws.security_settings?.membersViewLogs => true
+   *
+   * // Slugs work too, and the admin plane reaches workspaces you aren't scoped to:
+   * const other = await gw.workspaces.get('ws-produc-985697', { plane: 'admin' });
    * ```
    */
-  async get(workspaceId) {
-    assertUuid(workspaceId, "workspaceId");
+  async get(workspaceRef, options = {}) {
+    assertWorkspaceRef(workspaceRef, "workspaceRef");
     return request({
       method: "GET",
-      baseUrl: this.baseUrl,
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceId}`,
+      baseUrl: this.urlFor(options.plane),
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
       responseSchema: GatewayWorkspaceDetailSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /**
+   * Create a workspace. **Admin plane** — needs a tenant-root admin role.
+   *
+   * @param body - `name` and `scope_name` are both required; the API rejects a body missing either.
+   * @returns The created workspace. Unlike `configs`/`guardrails`/`providers`/`deployments`,
+   * which return short receipts, this returns most of the record — but not `status`,
+   * `is_default`, `icon`, `usage_limits`, `rate_limits`, or the settings blocks. Call
+   * {@link AIGatewayWorkspacesClient.get} when you need those.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const created = await gw.workspaces.create({
+   *   name: 'Production',
+   *   scope_name: 'ws_production_bx7qw0', // the SCM scope, not derived from name
+   *   description: 'All production applications',
+   *   defaults: { metadata: { env: 'production' } },
+   *   rate_limits: [{ type: 'requests', unit: 'rpm', value: 100 }],
+   * });
+   * ```
+   */
+  async create(body) {
+    if (!body.name) {
+      throw new AISecSDKException("Missing name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
+    }
+    if (!body.scope_name) {
+      throw new AISecSDKException("Missing scope_name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
+    }
+    return request({
+      method: "POST",
+      baseUrl: this.adminBaseUrl,
+      path: AI_GW_WORKSPACES_PATH,
+      body,
+      responseSchema: GatewayWorkspaceCreateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update a workspace. **Admin plane.** Partial patch — send only the fields that change.
+   *
+   * @param workspaceRef - Workspace UUID or slug.
+   * @param body - At least one field. An empty patch is rejected locally, mirroring the API's own
+   * "No update fields provided" rejection, so a typo'd caller fails without a round trip.
+   * @returns An **empty object** — the API acknowledges the write without echoing the record
+   * (verified live 2026-08-01). The change does persist; re-read with
+   * {@link AIGatewayWorkspacesClient.get} to see it.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.workspaces.update('ws-produc-985697', {
+   *   description: 'Production workloads, us-east',
+   * });
+   * ```
+   */
+  async update(workspaceRef, body) {
+    assertWorkspaceRef(workspaceRef, "workspaceRef");
+    if (Object.keys(body).length === 0) {
+      throw new AISecSDKException(
+        "Empty update: provide at least one of name, description, icon, defaults, usage_limits, rate_limits",
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    return request({
+      method: "PUT",
+      baseUrl: this.adminBaseUrl,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Delete a workspace. **Admin plane.**
+   *
+   * This is a **soft delete**: the workspace is archived, not destroyed. It vanishes from a default
+   * {@link AIGatewayWorkspacesClient.list} but stays visible via `list({ status: 'archived' })`.
+   * Note that `list` is the *only* way to see it afterwards —
+   * {@link AIGatewayWorkspacesClient.get} answers `404 AB08` for an archived workspace.
+   * Same semantics as `deployments.delete()`, and the opposite of `configs`/`guardrails`/`providers`,
+   * which hard delete. There is no hard delete for workspaces.
+   *
+   * Takes no query parameters — unlike `integrations.delete()` and `deployments.delete()`, which
+   * both require `organisation_id`.
+   *
+   * @param workspaceRef - Workspace UUID or slug.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.workspaces.delete('ws-produc-985697');
+   *
+   * // Still there, archived:
+   * const gone = await gw.workspaces.list({ plane: 'admin', status: 'archived' });
+   * ```
+   */
+  async delete(workspaceRef) {
+    assertWorkspaceRef(workspaceRef, "workspaceRef");
+    return request({
+      method: "DELETE",
+      baseUrl: this.adminBaseUrl,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
 };
 
 // src/ai-gateway/configs-client.ts
@@ -11680,7 +12115,7 @@ var AIGatewayClient = class {
     const dataOpts = { baseUrl: dataEndpoint, auth, numRetries };
     const adminOpts = { baseUrl: adminEndpoint, auth, numRetries };
     this.telemetry = new AIGatewayTelemetryClient({ ...dataOpts, tsgId });
-    this.workspaces = new AIGatewayWorkspacesClient(dataOpts);
+    this.workspaces = new AIGatewayWorkspacesClient({ ...dataOpts, adminBaseUrl: adminEndpoint });
     this.configs = new AIGatewayConfigsClient(dataOpts);
     this.guardrails = new AIGatewayGuardrailsClient(dataOpts);
     this.providers = new AIGatewayProvidersClient(dataOpts);
@@ -11734,6 +12169,16 @@ export {
   AI_SEC_API_TOKEN,
   ASYNC_SCAN_PATH,
   Action,
+  AdapterCreateRequestSchema,
+  AdapterListItemSchema,
+  AdapterListSchema,
+  AdapterResponseSchema,
+  AdapterUpdateRequestSchema,
+  AdapterValidateRequestSchema,
+  AdapterValidateResponseSchema,
+  AdapterVarResponseSchema,
+  AdapterVarSchema,
+  AdapterVarTypeSchema,
   AdvancedDataProfileRequestSchema,
   AgentEntrySchema,
   AgentMetaSchema,
@@ -11974,6 +12419,9 @@ export {
   GatewayPluginSchema,
   GatewayProviderCreateResponseSchema,
   GatewayProviderSchema,
+  GatewayRateLimitSchema,
+  GatewayUsageLimitSchema,
+  GatewayWorkspaceCreateResponseSchema,
   GatewayWorkspaceDetailSchema,
   GatewayWorkspaceSchema,
   GatewayWriteResponseSchema,
@@ -12146,6 +12594,8 @@ export {
   PyPIAuthResponseSchema,
   QuotaDetailsSchema,
   QuotaSummarySchema,
+  RED_TEAM_ADAPTER_PATH,
+  RED_TEAM_ADAPTER_VALIDATE_PATH,
   RED_TEAM_CATEGORIES_PATH,
   RED_TEAM_CHANNELS_PATH,
   RED_TEAM_CHANNELS_STATS_PATH,
@@ -12175,6 +12625,7 @@ export {
   RED_TEAM_TEMPLATE_PATH,
   RED_TEAM_TOKEN_ENDPOINT,
   RED_TEAM_TSG_ID,
+  RedTeamAdaptersClient,
   RedTeamCategory,
   RedTeamClient,
   RedTeamCustomAttackReportsClient,