@cdot65/prisma-airs-sdk 0.14.1 → 0.18.0

package/dist/index.js

@@ -29,7 +29,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 20;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.14.1";
+var SDK_VERSION = "0.17.0";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -104,6 +104,8 @@ var RED_TEAM_LANGUAGES_PATH = "/v1/languages";
 var RED_TEAM_ERROR_LOG_TARGET_PROFILE_PATH = "/v1/error-log/target-profile";
 var RED_TEAM_TARGET_PATH = "/v1/target";
 var RED_TEAM_TARGET_VALIDATE_AUTH_PATH = "/v1/target/validate-auth";
+var RED_TEAM_ADAPTER_PATH = "/v1/adapters";
+var RED_TEAM_ADAPTER_VALIDATE_PATH = "/v1/adapters/validate";
 var RED_TEAM_TEMPLATE_PATH = "/v1/template";
 var RED_TEAM_EULA_PATH = "/v1/eula";
 var RED_TEAM_INSTANCES_PATH = "/v1/instances";
@@ -1359,6 +1361,60 @@ var Content = class _Content {
   }
 };
 
+// src/listing.ts
+async function* paginate(fetchPage, initialCursor) {
+  let cursor = initialCursor;
+  const seen = /* @__PURE__ */ new Set();
+  while (true) {
+    if (seen.has(cursor)) throw new Error("Pagination returned a repeated cursor");
+    seen.add(cursor);
+    const page = await fetchPage(cursor);
+    yield* page.items;
+    if (page.next === void 0) return;
+    cursor = page.next;
+  }
+}
+async function collectAll(iterable, opts = {}) {
+  const max = opts.max ?? 1e4;
+  if (!Number.isSafeInteger(max) || max < 0)
+    throw new RangeError("max must be a non-negative integer");
+  const items = [];
+  for await (const item of iterable) {
+    if (max > 0 && items.length >= max) break;
+    items.push(item);
+  }
+  return items;
+}
+function collectSkipPages(fetchPage, opts = {}) {
+  const limit = opts.limit ?? 50;
+  return collectAll(
+    paginate(async (skip) => {
+      const page = await fetchPage(skip, limit);
+      const next = skip + page.items.length;
+      const hasMore = page.items.length > 0 && (page.total == null ? page.items.length === limit : next < page.total);
+      return { items: page.items, next: hasMore ? next : void 0 };
+    }, 0),
+    { max: opts.max }
+  );
+}
+function collectSpringPages(fetchPage, opts = {}) {
+  const size = opts.size ?? 50;
+  return collectAll(
+    paginate(async (page) => {
+      const result = await fetchPage(page, size);
+      return { items: result.items, next: result.last ? void 0 : page + 1 };
+    }, 0),
+    { max: opts.max }
+  );
+}
+function serializeListing(opts) {
+  const params = {};
+  if (opts?.skip !== void 0) params.skip = String(opts.skip);
+  if (opts?.limit !== void 0) params.limit = String(opts.limit);
+  if (opts?.search !== void 0) params.search = opts.search;
+  return params;
+}
+
 // src/models/enums.ts
 var Verdict = {
   BENIGN: "benign",
@@ -3619,6 +3675,76 @@ var TenantLanguagesResponseSchema = z33.object({
   supported_job_types: z33.array(z33.string()),
   languages: z33.array(LanguageOptionSchema)
 }).passthrough();
+var AdapterVarTypeSchema = z33.enum(["VAR", "SECRET"]);
+var AdapterVarSchema = z33.object({
+  key: z33.string().max(255),
+  value: z33.string().nullable().optional(),
+  type: AdapterVarTypeSchema
+});
+var AdapterVarResponseSchema = AdapterVarSchema.extend({
+  is_redacted: z33.boolean().optional()
+}).passthrough();
+var AdapterCreateRequestSchema = z33.object({
+  name: z33.string().max(255),
+  description: z33.string().nullable().optional(),
+  script_b64: z33.string(),
+  /** Optional while the adapter is a DRAFT; required to activate (`validate: true`). */
+  network_broker_channel_uuid: z33.string().uuid().nullable().optional(),
+  variables: z33.array(AdapterVarSchema).optional(),
+  /** Sample prompt used to exercise the adapter end-to-end during validation. Not stored. */
+  prompt: z33.string()
+}).strict();
+var AdapterUpdateRequestSchema = z33.object({
+  name: z33.string().max(255),
+  description: z33.string().nullable().optional(),
+  script_b64: z33.string(),
+  network_broker_channel_uuid: z33.string().uuid().nullable().optional(),
+  variables: z33.array(AdapterVarSchema).optional(),
+  prompt: z33.string()
+}).strict();
+var AdapterResponseSchema = z33.object({
+  uuid: z33.string().uuid(),
+  tsg_id: z33.string(),
+  name: z33.string(),
+  script_b64: z33.string(),
+  status: z33.string(),
+  description: z33.string().nullable().optional(),
+  network_broker_channel_uuid: z33.string().uuid().nullable().optional(),
+  variables: z33.array(AdapterVarResponseSchema).optional(),
+  /** Number of targets currently referencing this adapter. */
+  target_count: z33.number().int().optional(),
+  created_at: z33.string().nullable().optional(),
+  updated_at: z33.string().nullable().optional(),
+  created_by_user_id: z33.string().uuid().nullable().optional(),
+  updated_by_user_id: z33.string().uuid().nullable().optional()
+}).passthrough();
+var AdapterListItemSchema = z33.object({
+  uuid: z33.string().uuid(),
+  name: z33.string(),
+  status: z33.string(),
+  created_at: z33.string(),
+  updated_at: z33.string(),
+  created_by_user_id: z33.string().uuid().nullable().optional(),
+  target_count: z33.number().int().nullable().optional()
+}).passthrough();
+var AdapterListSchema = z33.object({
+  pagination: RedTeamPaginationSchema,
+  data: z33.array(AdapterListItemSchema).optional()
+}).passthrough();
+var AdapterValidateRequestSchema = z33.object({
+  script_b64: z33.string(),
+  network_broker_channel_uuid: z33.string().uuid(),
+  prompt: z33.string(),
+  variables: z33.array(AdapterVarSchema).optional(),
+  /** Omit when validating a brand-new adapter. */
+  adapter_uuid: z33.string().uuid().nullable().optional()
+}).strict();
+var AdapterValidateResponseSchema = z33.object({
+  validated: z33.boolean(),
+  stdout: z33.string().nullable().optional(),
+  stderr: z33.string().nullable().optional(),
+  traceback: z33.string().nullable().optional()
+}).passthrough();
 var TargetRequestBaseFields = {
   name: z33.string(),
   description: z33.string().nullable().optional(),
@@ -3632,7 +3758,11 @@ var TargetRequestBaseFields = {
   target_background: TargetBackgroundSchema.nullable().optional(),
   additional_context: TargetAdditionalContextSchema.nullable().optional(),
   extra_info: z33.record(z33.unknown()).nullable().optional(),
-  network_broker_channel_uuid: z33.string().nullable().optional()
+  network_broker_channel_uuid: z33.string().nullable().optional(),
+  /** UUID of the custom target adapter to use. Required when connection_type is CUSTOM_TARGET_ADAPTER. */
+  adapter_uuid: z33.string().uuid().nullable().optional(),
+  /** Per-target overrides for the adapter's variables. Array of AdapterVar objects. */
+  adapter_variable_overrides: z33.array(AdapterVarSchema).nullable().optional()
 };
 var TargetCreateRequestSchema = z33.object(TargetRequestBaseFields).strict();
 var TargetUpdateRequestSchema = z33.object(TargetRequestBaseFields).strict();
@@ -4024,6 +4154,20 @@ var aiGatewayList = (item) => z35.object({
   has_more: z35.boolean().optional(),
   data: z35.array(item)
 }).passthrough();
+var GatewayUsageLimitSchema = z35.object({
+  credit_limit: z35.number().optional(),
+  type: z35.string().optional(),
+  alert_threshold: z35.number().optional(),
+  periodic_reset: z35.string().nullable().optional(),
+  periodic_reset_days: z35.number().nullable().optional(),
+  next_usage_reset_at: z35.string().nullable().optional()
+}).passthrough();
+var GatewayRateLimitSchema = z35.object({
+  type: z35.string().optional(),
+  unit: z35.string().optional(),
+  value: z35.number().optional()
+}).passthrough();
+var limitsField = (policy) => z35.union([z35.array(policy), z35.record(z35.unknown())]).nullable();
 var aiGatewayGroupList = (item) => z35.object({
   object: z35.string(),
   is_quota_exceeded: z35.boolean(),
@@ -4230,7 +4374,9 @@ var GatewayWorkspaceSchema = z35.object({
   slug: z35.string(),
   name: z35.string(),
   icon: z35.string().nullable(),
-  description: z35.string(),
+  // Nullable: a workspace created without one returns null, and upstream declares it
+  // `nullable: true`. Observed on an archived workspace (#213).
+  description: z35.string().nullable(),
   created_at: z35.string(),
   last_updated_at: z35.string(),
   is_default: z35.number(),
@@ -4241,18 +4387,38 @@ var GatewayWorkspaceSchema = z35.object({
 var GatewayWorkspaceDetailSchema = z35.object({
   id: z35.string(),
   name: z35.string(),
-  description: z35.string(),
+  /** Nullable — see `GatewayWorkspaceSchema.description`. */
+  description: z35.string().nullable(),
   created_at: z35.string(),
   last_updated_at: z35.string(),
   is_default: z35.number(),
   slug: z35.string(),
   icon: z35.string().nullable(),
   defaults: z35.record(z35.unknown()).nullable(),
-  usage_limits: z35.record(z35.unknown()).nullable(),
-  rate_limits: z35.record(z35.unknown()).nullable(),
+  usage_limits: limitsField(GatewayUsageLimitSchema),
+  rate_limits: limitsField(GatewayRateLimitSchema),
   security_settings: z35.record(z35.boolean()).optional(),
   data_plane_security_settings: z35.record(z35.unknown()).optional(),
-  settings: z35.record(z35.unknown()).optional()
+  settings: z35.record(z35.unknown()).optional(),
+  /**
+   * Lifecycle state. **Diverges from the list row**: `list()` reports `'active'` for a
+   * workspace whose `get()` reports `null` (observed live 2026-08-01). Prefer the list value,
+   * or treat a `null` here as "unknown", not as "inactive".
+   */
+  status: z35.string().nullable().optional()
+}).passthrough();
+var GatewayWorkspaceCreateResponseSchema = z35.object({
+  id: z35.string(),
+  name: z35.string(),
+  slug: z35.string(),
+  description: z35.string().nullable(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  scope_name: z35.string(),
+  object: z35.string(),
+  defaults: z35.record(z35.unknown()).nullable().optional(),
+  /** Seeded workspace members. Present on create only. */
+  users: z35.array(z35.unknown()).optional()
 }).passthrough();
 var ListWorkspacesResponseSchema = aiGatewayList(GatewayWorkspaceSchema);
 var GatewayConfigSchema = z35.object({
@@ -4368,8 +4534,8 @@ var GatewayIntegrationModelsResponseSchema = z35.object({
 }).passthrough();
 var GatewayIntegrationWorkspaceSchema = z35.object({
   id: z35.string(),
-  usage_limits: z35.record(z35.unknown()).nullable(),
-  rate_limits: z35.record(z35.unknown()).nullable(),
+  usage_limits: limitsField(GatewayUsageLimitSchema),
+  rate_limits: limitsField(GatewayRateLimitSchema),
   enabled: z35.boolean(),
   status: z35.string(),
   created_at: z35.string(),
@@ -4378,8 +4544,8 @@ var GatewayIntegrationWorkspaceSchema = z35.object({
 }).passthrough();
 var GatewayGlobalWorkspaceAccessSchema = z35.object({
   enabled: z35.boolean(),
-  rate_limits: z35.record(z35.unknown()).nullable(),
-  usage_limits: z35.record(z35.unknown()).nullable()
+  rate_limits: limitsField(GatewayRateLimitSchema),
+  usage_limits: limitsField(GatewayUsageLimitSchema)
 }).passthrough();
 var GatewayIntegrationWorkspacesResponseSchema = z35.object({
   workspaces: z35.array(GatewayIntegrationWorkspaceSchema),
@@ -4731,6 +4897,14 @@ function assertUuid(value, fieldName) {
     );
   }
 }
+function assertWorkspaceRef(value, fieldName) {
+  if (!isValidUuid(value) && !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value)) {
+    throw new AISecSDKException(
+      `Invalid ${fieldName}: ${value} (expected a workspace UUID or slug)`,
+      "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+    );
+  }
+}
 function assertNumericId(value, fieldName) {
   if (!/^\d+$/.test(value)) {
     throw new AISecSDKException(
@@ -4802,6 +4976,7 @@ var ProfilesClient = class {
       offset: String(opts?.offset ?? 0),
       limit: String(opts?.limit ?? 100)
     };
+    if (opts?.latest !== void 0) params.latest = String(opts.latest);
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
@@ -4812,6 +4987,23 @@ var ProfilesClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * List security profiles across every response page.
+   * @example
+   * ```ts
+   * const profiles = await mgmt.profiles.listAll({ latest: true });
+   * ```
+   */
+  async listAll(opts = {}) {
+    const limit = opts.limit ?? 100;
+    return collectAll(
+      paginate(async (offset) => {
+        const page = await this.list({ offset, limit, latest: opts.latest });
+        return { items: page.ai_profiles, next: page.next_offset || void 0 };
+      }, 0),
+      { max: opts.max }
+    );
+  }
   /**
    * Get a security profile by UUID.
    * Fetches all profiles and filters — no dedicated API endpoint exists.
@@ -4829,7 +5021,7 @@ var ProfilesClient = class {
    * ```
    */
   async get(profileId) {
-    const { ai_profiles } = await this.list();
+    const ai_profiles = await this.listAll();
     const profile = ai_profiles.find((p) => p.profile_id === profileId);
     if (!profile) {
       throw new AISecSDKException(
@@ -4855,7 +5047,7 @@ var ProfilesClient = class {
    * ```
    */
   async getByName(profileName) {
-    const { ai_profiles } = await this.list();
+    const ai_profiles = await this.listAll();
     const matches = ai_profiles.filter((p) => p.profile_name === profileName);
     if (matches.length === 0) {
       throw new AISecSDKException(
@@ -5010,6 +5202,22 @@ var TopicsClient = class {
    * ```
    */
   async list(opts) {
+    if (opts?.latestOnly) {
+      const all = await this.listAll({ limit: 200 });
+      const latest = /* @__PURE__ */ new Map();
+      for (const topic of all) {
+        const current = latest.get(topic.topic_name);
+        if (!current || topic.revision > current.revision) latest.set(topic.topic_name, topic);
+      }
+      const custom_topics = [...latest.values()];
+      const offset = opts.offset ?? 0;
+      const limit = opts.limit ?? 100;
+      const nextOffset = offset + limit;
+      return {
+        custom_topics: custom_topics.slice(offset, nextOffset),
+        next_offset: nextOffset < custom_topics.length ? nextOffset : void 0
+      };
+    }
     const params = {
       offset: String(opts?.offset ?? 0),
       limit: String(opts?.limit ?? 100)
@@ -5024,6 +5232,55 @@ var TopicsClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * List custom topics across every response page.
+   * @example
+   * ```ts
+   * const topics = await mgmt.topics.listAll({ limit: 200 });
+   * ```
+   */
+  async listAll(opts = {}) {
+    const limit = opts.limit ?? 100;
+    return collectAll(
+      paginate(async (offset) => {
+        const page = await this.list({ offset, limit });
+        return { items: page.custom_topics, next: page.next_offset || void 0 };
+      }, 0),
+      { max: opts.max }
+    );
+  }
+  /**
+   * Get an exact custom-topic revision by UUID.
+   * @example
+   * ```ts
+   * const topic = await mgmt.topics.get('550e8400-e29b-41d4-a716-446655440000');
+   * ```
+   */
+  async get(topicId) {
+    const topic = (await this.listAll()).find((item) => item.topic_id === topicId);
+    if (!topic)
+      throw new AISecSDKException(
+        `Topic not found: ${topicId}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    return topic;
+  }
+  /**
+   * Get the highest revision of a custom topic by name.
+   * @example
+   * ```ts
+   * const topic = await mgmt.topics.getByName('credit-cards');
+   * ```
+   */
+  async getByName(topicName) {
+    const matches = (await this.listAll()).filter((item) => item.topic_name === topicName);
+    if (matches.length === 0)
+      throw new AISecSDKException(
+        `Topic not found: ${topicName}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    return matches.reduce((best, topic) => topic.revision > best.revision ? topic : best);
+  }
   /**
    * Update an existing custom topic.
    * @param topicId - UUID of the topic to update.
@@ -5187,6 +5444,17 @@ var ApiKeysClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List all API keys. @example `const keys = await mgmt.apiKeys.listAll();` */
+  async listAll(opts = {}) {
+    const limit = opts.limit ?? 100;
+    return collectAll(
+      paginate(async (offset) => {
+        const page = await this.list({ offset, limit });
+        return { items: page.api_keys ?? [], next: page.next_offset || void 0 };
+      }, 0),
+      { max: opts.max }
+    );
+  }
   /**
    * Delete an API key by name.
    * @param apiKeyName - Name of the API key to delete.
@@ -5311,6 +5579,17 @@ var CustomerAppsClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List all customer applications. @example `const apps = await mgmt.customerApps.listAll();` */
+  async listAll(opts = {}) {
+    const limit = opts.limit ?? 100;
+    return collectAll(
+      paginate(async (offset) => {
+        const page = await this.list({ offset, limit });
+        return { items: page.customer_apps ?? [], next: page.next_offset || void 0 };
+      }, 0),
+      { max: opts.max }
+    );
+  }
   /**
    * Update a customer app.
    * @param customerAppId - UUID of the customer app to update.
@@ -5758,6 +6037,17 @@ var DataFilteringProfilesClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List all filtering profiles. @example `const profiles = await mgmt.dlp.dataFilteringProfiles.listAll();` */
+  async listAll(params = {}) {
+    return collectSpringPages(
+      async (page, size) => {
+        const result = await this.list({ ...params, page, size });
+        const last = result.last ?? (result.totalPages !== void 0 ? page + 1 >= result.totalPages : result.content.length < size);
+        return { items: result.content, last };
+      },
+      { size: params.size, max: params.max }
+    );
+  }
   /**
    * Get a single data filtering profile by resource ID.
    * @example
@@ -5851,6 +6141,17 @@ var DataPatternsClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List all data patterns. @example `const patterns = await mgmt.dlp.dataPatterns.listAll();` */
+  async listAll(params = {}) {
+    return collectSpringPages(
+      async (page, size) => {
+        const result = await this.list({ ...params, page, size });
+        const last = result.last ?? (result.totalPages !== void 0 ? page + 1 >= result.totalPages : result.content.length < size);
+        return { items: result.content, last };
+      },
+      { size: params.size, max: params.max }
+    );
+  }
   /**
    * Create a new custom data pattern.
    * @example
@@ -6024,6 +6325,17 @@ var DataProfilesClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List all data profiles. @example `const profiles = await mgmt.dlp.dataProfiles.listAll();` */
+  async listAll(params = {}) {
+    return collectSpringPages(
+      async (page, size) => {
+        const result = await this.list({ ...params, page, size });
+        const last = result.last ?? (result.totalPages !== void 0 ? page + 1 >= result.totalPages : result.content.length < size);
+        return { items: result.content, last };
+      },
+      { size: params.size, max: params.max }
+    );
+  }
   /**
    * Create a new data profile.
    * @example
@@ -6204,6 +6516,17 @@ var DictionariesClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List all dictionaries. @example `const dictionaries = await mgmt.dlp.dictionaries.listAll();` */
+  async listAll(params = {}) {
+    return collectSpringPages(
+      async (page, size) => {
+        const result = await this.list({ ...params, page, size });
+        const last = result.last ?? (result.totalPages !== void 0 ? page + 1 >= result.totalPages : result.content.length < size);
+        return { items: result.content, last };
+      },
+      { size: params.size, max: params.max }
+    );
+  }
   /**
    * Create a dictionary by uploading a keyword file. Sends a multipart body — the SDK does
    * not set Content-Type so the runtime can write the correct boundary.
@@ -6436,15 +6759,6 @@ var ManagementClient = class {
   }
 };
 
-// src/listing.ts
-function serializeListing(opts) {
-  const params = {};
-  if (opts?.skip !== void 0) params.skip = String(opts.skip);
-  if (opts?.limit !== void 0) params.limit = String(opts.limit);
-  if (opts?.search !== void 0) params.search = opts.search;
-  return params;
-}
-
 // src/model-security/scans-client.ts
 function buildScanListParams(opts) {
   const params = serializeListing(opts);
@@ -6540,6 +6854,13 @@ var ModelSecurityScansClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List every model-security scan page. @example `const scans = await ms.scans.listAll();` */
+  async listAll(opts = {}) {
+    return collectSkipPages(async (skip, limit) => {
+      const page = await this.list({ ...opts, skip, limit });
+      return { items: page.scans, total: page.pagination.total_items };
+    }, opts);
+  }
   /**
    * Get a single scan by UUID.
    * @param uuid - Scan UUID.
@@ -6918,6 +7239,13 @@ var ModelSecurityGroupsClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List every security-group page. @example `const groups = await ms.securityGroups.listAll();` */
+  async listAll(opts = {}) {
+    return collectSkipPages(async (skip, limit) => {
+      const page = await this.list({ ...opts, skip, limit });
+      return { items: page.security_groups, total: page.pagination.total_items };
+    }, opts);
+  }
   /**
    * Get a single security group by UUID.
    * @param uuid - Security group UUID.
@@ -7133,6 +7461,13 @@ var ModelSecurityRulesClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List every security-rule page. @example `const rules = await ms.securityRules.listAll();` */
+  async listAll(opts = {}) {
+    return collectSkipPages(async (skip, limit) => {
+      const page = await this.list({ ...opts, skip, limit });
+      return { items: page.rules, total: page.pagination.total_items };
+    }, opts);
+  }
   /**
    * Get a single security rule by UUID.
    * @param uuid - Security rule UUID.
@@ -7212,6 +7547,13 @@ var ModelSecurityModelsClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List every model page. @example `const models = await ms.models.listAllModels();` */
+  async listAllModels(opts = {}) {
+    return collectSkipPages(async (skip, limit) => {
+      const page = await this.listModels({ ...opts, skip, limit });
+      return { items: page.models, total: page.pagination.total_items };
+    }, opts);
+  }
   /**
    * Get a single model by UUID.
    * @param uuid - Model UUID.
@@ -7268,6 +7610,13 @@ var ModelSecurityModelsClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List every version of a model. @example `const versions = await ms.models.listAllModelVersions(modelUuid);` */
+  async listAllModelVersions(modelUuid, opts = {}) {
+    return collectSkipPages(async (skip, limit) => {
+      const page = await this.listModelVersions(modelUuid, { ...opts, skip, limit });
+      return { items: page.model_versions, total: page.pagination.total_items };
+    }, opts);
+  }
   /**
    * Get a single model version by UUID.
    * @param uuid - Model version UUID.
@@ -7322,6 +7671,13 @@ var ModelSecurityModelsClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List every file in a model version. @example `const files = await ms.models.listAllModelVersionFiles(versionUuid);` */
+  async listAllModelVersionFiles(modelVersionUuid, opts = {}) {
+    return collectSkipPages(async (skip, limit) => {
+      const page = await this.listModelVersionFiles(modelVersionUuid, { ...opts, skip, limit });
+      return { items: page.files, total: page.pagination.total_items };
+    }, opts);
+  }
 };
 
 // src/model-security/client.ts
@@ -7462,6 +7818,13 @@ var RedTeamScansClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List every scan page. @example `const scans = await rt.scans.listAll({ status: 'COMPLETED' });` */
+  async listAll(opts = {}) {
+    return collectSkipPages(async (skip, limit) => {
+      const page = await this.list({ ...opts, skip, limit });
+      return { items: page.data, total: page.pagination.total_items };
+    }, opts);
+  }
   /**
    * Get a single scan job by ID.
    * @param jobId - The job UUID.
@@ -8239,6 +8602,29 @@ var RedTeamTargetsClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * List targets across every page while preserving the supplied filters.
+   * @example
+   * ```ts
+   * const targets = await rt.targets.listAll({ limit: 100, status: 'READY' });
+   * ```
+   */
+  async listAll(opts = {}) {
+    const limit = opts.limit ?? 50;
+    return collectAll(
+      paginate(async (skip) => {
+        const page = await this.list({ ...opts, skip, limit });
+        const items = page.data ?? [];
+        const next = skip + items.length;
+        const total = page.pagination.total_items;
+        return {
+          items,
+          next: items.length > 0 && (total == null ? items.length === limit : next < total) ? next : void 0
+        };
+      }, 0),
+      { max: opts.max }
+    );
+  }
   /**
    * Get a target by UUID.
    * @param uuid - The target UUID.
@@ -8555,6 +8941,13 @@ var RedTeamCustomAttacksClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List every custom prompt-set page. @example `const sets = await rt.customAttacks.listAllPromptSets();` */
+  async listAllPromptSets(opts = {}) {
+    return collectSkipPages(async (skip, limit) => {
+      const page = await this.listPromptSets({ ...opts, skip, limit });
+      return { items: page.data ?? [], total: page.pagination.total_items };
+    }, opts);
+  }
   /**
    * Get a prompt set by UUID.
    * @param uuid - The prompt set UUID.
@@ -8867,6 +9260,13 @@ var RedTeamCustomAttacksClient = class {
       numRetries: this.numRetries
     });
   }
+  /** List every prompt page for a set. @example `const prompts = await rt.customAttacks.listAllPrompts(promptSetUuid);` */
+  async listAllPrompts(promptSetUuid, opts = {}) {
+    return collectSkipPages(async (skip, limit) => {
+      const page = await this.listPrompts(promptSetUuid, { ...opts, skip, limit });
+      return { items: page.data ?? [], total: page.pagination.total_items };
+    }, opts);
+  }
   /**
    * Get a prompt by UUID.
    * @param promptSetUuid - The prompt set UUID.
@@ -9553,6 +9953,183 @@ var RedTeamNetworkBrokerClient = class {
   }
 };
 
+// src/red-team/adapters-client.ts
+var RedTeamAdaptersClient = class {
+  baseUrl;
+  auth;
+  numRetries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl;
+    this.auth = opts.auth;
+    this.numRetries = opts.numRetries;
+  }
+  /**
+   * Create a new custom target adapter.
+   * @param body - Adapter creation request (name, base64 script, variables, validation prompt).
+   * @param opts - Set validate: false to save as DRAFT without running the script.
+   * @returns The created adapter.
+   * @example
+   * ```ts
+   * const adapter = await rt.adapters.create({
+   *   name: 'my-adapter',
+   *   script_b64: Buffer.from(script).toString('base64'),
+   *   network_broker_channel_uuid: '550e8400-...',
+   *   variables: [{ key: 'endpoint', value: 'http://...', type: 'VAR' }],
+   *   prompt: 'Hello',
+   * }, { validate: true });
+   * ```
+   */
+  async create(body, opts) {
+    const validate = opts?.validate ?? true;
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_ADAPTER_PATH,
+      params: { validate: String(validate) },
+      body,
+      responseSchema: AdapterResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List adapters with optional pagination.
+   * @param opts - Optional limit/skip/search.
+   * @returns Paginated list of adapters.
+   * @example
+   * ```ts
+   * const { data } = await rt.adapters.list({ limit: 20 });
+   * // data => [{ uuid: '...', name: 'my-adapter', status: 'ACTIVE' }]
+   * ```
+   */
+  async list(opts) {
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_ADAPTER_PATH,
+      params: serializeListing(opts),
+      responseSchema: AdapterListSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /** List every adapter page. @example `const adapters = await rt.adapters.listAll();` */
+  async listAll(opts = {}) {
+    return collectSkipPages(async (skip, limit) => {
+      const page = await this.list({ ...opts, skip, limit });
+      return { items: page.data ?? [], total: page.pagination.total_items };
+    }, opts);
+  }
+  /**
+   * Get a single adapter by UUID.
+   * @param uuid - Adapter UUID.
+   * @returns The adapter detail.
+   * @example
+   * ```ts
+   * const adapter = await rt.adapters.get('550e8400-e29b-41d4-a716-446655440000');
+   * // adapter.status => 'ACTIVE'
+   * ```
+   */
+  async get(uuid) {
+    assertUuid(uuid, "adapter uuid");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      responseSchema: AdapterResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update an adapter. **Full replacement (PUT), not a patch** — `name`, `script_b64`, and
+   * `prompt` are required just as on create. For `variables`, the list defines the complete
+   * desired key set: a provided value sets it, `null` keeps the stored value (unchanged
+   * secrets), and omitting a key **deletes** that variable.
+   * @param uuid - Adapter UUID.
+   * @param body - The complete adapter definition.
+   * @param opts - Set validate: false to save as DRAFT without re-running the script.
+   * @returns The updated adapter.
+   * @example
+   * ```ts
+   * const updated = await rt.adapters.update('550e8400-...', {
+   *   name: 'my-keycloak-agent',
+   *   script_b64: Buffer.from(newScript).toString('base64'),
+   *   prompt: 'What is the capital of France?',
+   *   variables: [
+   *     { key: 'endpoint', value: 'http://agent.svc:8080', type: 'VAR' },
+   *     { key: 'client_secret', value: null, type: 'SECRET' }, // null keeps stored secret
+   *   ],
+   * });
+   * ```
+   */
+  async update(uuid, body, opts) {
+    assertUuid(uuid, "adapter uuid");
+    const validate = opts?.validate ?? true;
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      params: { validate: String(validate) },
+      body,
+      responseSchema: AdapterResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Delete an adapter.
+   * @param uuid - Adapter UUID.
+   * @example
+   * ```ts
+   * await rt.adapters.delete('550e8400-e29b-41d4-a716-446655440000');
+   * ```
+   */
+  async delete(uuid) {
+    assertUuid(uuid, "adapter uuid");
+    return request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      responseSchema: BaseResponseSchema.optional(),
+      allowEmptyBody: true,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Validate an adapter script without saving anything. Runs the script end-to-end through the
+   * network broker channel using the sample prompt, and returns the execution outcome —
+   * `validated` plus the script's `stdout` / `stderr` / `traceback` — not an adapter record.
+   *
+   * This endpoint has its own request shape: no `name`, `network_broker_channel_uuid` is
+   * required, and `adapter_uuid` may reference an existing adapter so `null` variable values
+   * are resolved from its stored secrets before the run.
+   * @param body - Script, channel, prompt, and optionally variables / an existing adapter UUID.
+   * @returns The validation outcome.
+   * @example
+   * ```ts
+   * const result = await rt.adapters.validate({
+   *   script_b64: Buffer.from(script).toString('base64'),
+   *   network_broker_channel_uuid: '550e8400-...',
+   *   prompt: 'Hello',
+   * });
+   * if (!result.validated) console.error(result.stderr ?? result.traceback);
+   * ```
+   */
+  async validate(body) {
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: RED_TEAM_ADAPTER_VALIDATE_PATH,
+      body,
+      responseSchema: AdapterValidateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+};
+
 // src/red-team/client.ts
 var RedTeamClient = class {
   /** Data plane scan operations. */
@@ -9571,6 +10148,8 @@ var RedTeamClient = class {
   instances;
   /** Network broker channel operations (distinct network broker base URL). */
   networkBroker;
+  /** Management plane custom target adapter operations. */
+  adapters;
   dataEndpoint;
   mgmtEndpoint;
   auth;
@@ -9609,6 +10188,7 @@ var RedTeamClient = class {
     });
     this.eula = new RedTeamEulaClient({ baseUrl: mgmtEndpoint, auth, numRetries });
     this.instances = new RedTeamInstancesClient({ baseUrl: mgmtEndpoint, auth, numRetries });
+    this.adapters = new RedTeamAdaptersClient({ baseUrl: mgmtEndpoint, auth, numRetries });
     this.networkBroker = new RedTeamNetworkBrokerClient({
       baseUrl: networkBrokerEndpoint,
       auth,
@@ -10306,30 +10886,49 @@ var AIGatewayTelemetryClient = class {
 // src/ai-gateway/workspaces-client.ts
 var AIGatewayWorkspacesClient = class {
   baseUrl;
+  adminBaseUrl;
   auth;
   numRetries;
   constructor(opts) {
     this.baseUrl = opts.baseUrl;
+    this.adminBaseUrl = opts.adminBaseUrl;
     this.auth = opts.auth;
     this.numRetries = opts.numRetries;
   }
+  urlFor(plane) {
+    return plane === "admin" ? this.adminBaseUrl : this.baseUrl;
+  }
   /**
-   * List workspaces visible to the caller.
-   * @returns All workspaces, each with the `scope_name` that grants data-plane access to it.
+   * List workspaces.
+   *
+   * Two defaults worth knowing, because each one hides rows:
+   *
+   * 1. **Active only.** Without `status`, archived workspaces are omitted. Pass
+   *    `{ status: 'archived' }` to see them — that is where {@link AIGatewayWorkspacesClient.delete}
+   *    leaves a workspace.
+   * 2. **Your scope only.** The data plane returns just the workspaces your service account holds a
+   *    workspace-scope grant on. Pass `{ plane: 'admin' }` to enumerate the whole tenant.
+   *
+   * @param options - Optional status filter and plane selection.
+   * @returns Workspaces, each with the `scope_name` that grants data-plane access to it.
    * @example
    * ```ts
    * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
    * const gw = new AIGatewayClient();
    *
-   * const ws = await gw.workspaces.list();
-   * // ws.data[0] => { slug: 'ws-main-a-349e0e', scope_name: 'main_airs_workspace_1852583913', ... }
+   * const mine = await gw.workspaces.list();
+   * // mine.data[0] => { slug: 'ws-main-a-349e0e', scope_name: 'main_airs_workspace_1852583913', ... }
+   *
+   * const everything = await gw.workspaces.list({ plane: 'admin' });
+   * const archived = await gw.workspaces.list({ plane: 'admin', status: 'archived' });
    * ```
    */
-  async list() {
+  async list(options = {}) {
     return request({
       method: "GET",
-      baseUrl: this.baseUrl,
+      baseUrl: this.urlFor(options.plane),
       path: AI_GW_WORKSPACES_PATH,
+      params: options.status ? { status: options.status } : void 0,
       responseSchema: ListWorkspacesResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -10337,7 +10936,16 @@ var AIGatewayWorkspacesClient = class {
   }
   /**
    * Fetch one workspace, including its security and rate-limit settings.
-   * @param workspaceId - Workspace UUID.
+   *
+   * @param workspaceRef - Workspace UUID **or** slug; the API accepts both.
+   * @param options - Plane selection. A workspace outside your workspace scope answers `403 AB03`
+   * on the data plane, not `404`; re-read it with `{ plane: 'admin' }`.
+   *
+   * **Archived workspaces are not retrievable here.** Once
+   * {@link AIGatewayWorkspacesClient.delete} has archived a workspace, this returns `404 AB08`
+   * for both its UUID and its slug, on either plane (verified live 2026-08-01) — even though the
+   * row is still listed by `list({ status: 'archived' })`. Treat a 404 after a delete as expected,
+   * and use the list filter to inspect archived workspaces.
    * @returns Workspace detail; list rows do not carry the settings blocks.
    * @example
    * ```ts
@@ -10346,19 +10954,133 @@ var AIGatewayWorkspacesClient = class {
    *
    * const ws = await gw.workspaces.get('16f7e90d-382a-4e78-b577-1b01eb5f8297');
    * // ws.security_settings?.membersViewLogs => true
+   *
+   * // Slugs work too, and the admin plane reaches workspaces you aren't scoped to:
+   * const other = await gw.workspaces.get('ws-produc-985697', { plane: 'admin' });
    * ```
    */
-  async get(workspaceId) {
-    assertUuid(workspaceId, "workspaceId");
+  async get(workspaceRef, options = {}) {
+    assertWorkspaceRef(workspaceRef, "workspaceRef");
     return request({
       method: "GET",
-      baseUrl: this.baseUrl,
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceId}`,
+      baseUrl: this.urlFor(options.plane),
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
       responseSchema: GatewayWorkspaceDetailSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /**
+   * Create a workspace. **Admin plane** — needs a tenant-root admin role.
+   *
+   * @param body - `name` and `scope_name` are both required; the API rejects a body missing either.
+   * @returns The created workspace. Unlike `configs`/`guardrails`/`providers`/`deployments`,
+   * which return short receipts, this returns most of the record — but not `status`,
+   * `is_default`, `icon`, `usage_limits`, `rate_limits`, or the settings blocks. Call
+   * {@link AIGatewayWorkspacesClient.get} when you need those.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * const created = await gw.workspaces.create({
+   *   name: 'Production',
+   *   scope_name: 'ws_production_bx7qw0', // the SCM scope, not derived from name
+   *   description: 'All production applications',
+   *   defaults: { metadata: { env: 'production' } },
+   *   rate_limits: [{ type: 'requests', unit: 'rpm', value: 100 }],
+   * });
+   * ```
+   */
+  async create(body) {
+    if (!body.name) {
+      throw new AISecSDKException("Missing name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
+    }
+    if (!body.scope_name) {
+      throw new AISecSDKException("Missing scope_name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
+    }
+    return request({
+      method: "POST",
+      baseUrl: this.adminBaseUrl,
+      path: AI_GW_WORKSPACES_PATH,
+      body,
+      responseSchema: GatewayWorkspaceCreateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Update a workspace. **Admin plane.** Partial patch — send only the fields that change.
+   *
+   * @param workspaceRef - Workspace UUID or slug.
+   * @param body - At least one field. An empty patch is rejected locally, mirroring the API's own
+   * "No update fields provided" rejection, so a typo'd caller fails without a round trip.
+   * @returns An **empty object** — the API acknowledges the write without echoing the record
+   * (verified live 2026-08-01). The change does persist; re-read with
+   * {@link AIGatewayWorkspacesClient.get} to see it.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.workspaces.update('ws-produc-985697', {
+   *   description: 'Production workloads, us-east',
+   * });
+   * ```
+   */
+  async update(workspaceRef, body) {
+    assertWorkspaceRef(workspaceRef, "workspaceRef");
+    if (Object.keys(body).length === 0) {
+      throw new AISecSDKException(
+        "Empty update: provide at least one of name, description, icon, defaults, usage_limits, rate_limits",
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    return request({
+      method: "PUT",
+      baseUrl: this.adminBaseUrl,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      body,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Delete a workspace. **Admin plane.**
+   *
+   * This is a **soft delete**: the workspace is archived, not destroyed. It vanishes from a default
+   * {@link AIGatewayWorkspacesClient.list} but stays visible via `list({ status: 'archived' })`.
+   * Note that `list` is the *only* way to see it afterwards —
+   * {@link AIGatewayWorkspacesClient.get} answers `404 AB08` for an archived workspace.
+   * Same semantics as `deployments.delete()`, and the opposite of `configs`/`guardrails`/`providers`,
+   * which hard delete. There is no hard delete for workspaces.
+   *
+   * Takes no query parameters — unlike `integrations.delete()` and `deployments.delete()`, which
+   * both require `organisation_id`.
+   *
+   * @param workspaceRef - Workspace UUID or slug.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   *
+   * await gw.workspaces.delete('ws-produc-985697');
+   *
+   * // Still there, archived:
+   * const gone = await gw.workspaces.list({ plane: 'admin', status: 'archived' });
+   * ```
+   */
+  async delete(workspaceRef) {
+    assertWorkspaceRef(workspaceRef, "workspaceRef");
+    return request({
+      method: "DELETE",
+      baseUrl: this.adminBaseUrl,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
 };
 
 // src/ai-gateway/configs-client.ts
@@ -11680,7 +12402,7 @@ var AIGatewayClient = class {
     const dataOpts = { baseUrl: dataEndpoint, auth, numRetries };
     const adminOpts = { baseUrl: adminEndpoint, auth, numRetries };
     this.telemetry = new AIGatewayTelemetryClient({ ...dataOpts, tsgId });
-    this.workspaces = new AIGatewayWorkspacesClient(dataOpts);
+    this.workspaces = new AIGatewayWorkspacesClient({ ...dataOpts, adminBaseUrl: adminEndpoint });
     this.configs = new AIGatewayConfigsClient(dataOpts);
     this.guardrails = new AIGatewayGuardrailsClient(dataOpts);
     this.providers = new AIGatewayProvidersClient(dataOpts);
@@ -11734,6 +12456,16 @@ export {
   AI_SEC_API_TOKEN,
   ASYNC_SCAN_PATH,
   Action,
+  AdapterCreateRequestSchema,
+  AdapterListItemSchema,
+  AdapterListSchema,
+  AdapterResponseSchema,
+  AdapterUpdateRequestSchema,
+  AdapterValidateRequestSchema,
+  AdapterValidateResponseSchema,
+  AdapterVarResponseSchema,
+  AdapterVarSchema,
+  AdapterVarTypeSchema,
   AdvancedDataProfileRequestSchema,
   AgentEntrySchema,
   AgentMetaSchema,
@@ -11974,6 +12706,9 @@ export {
   GatewayPluginSchema,
   GatewayProviderCreateResponseSchema,
   GatewayProviderSchema,
+  GatewayRateLimitSchema,
+  GatewayUsageLimitSchema,
+  GatewayWorkspaceCreateResponseSchema,
   GatewayWorkspaceDetailSchema,
   GatewayWorkspaceSchema,
   GatewayWriteResponseSchema,
@@ -12146,6 +12881,8 @@ export {
   PyPIAuthResponseSchema,
   QuotaDetailsSchema,
   QuotaSummarySchema,
+  RED_TEAM_ADAPTER_PATH,
+  RED_TEAM_ADAPTER_VALIDATE_PATH,
   RED_TEAM_CATEGORIES_PATH,
   RED_TEAM_CHANNELS_PATH,
   RED_TEAM_CHANNELS_STATS_PATH,
@@ -12175,6 +12912,7 @@ export {
   RED_TEAM_TEMPLATE_PATH,
   RED_TEAM_TOKEN_ENDPOINT,
   RED_TEAM_TSG_ID,
+  RedTeamAdaptersClient,
   RedTeamCategory,
   RedTeamClient,
   RedTeamCustomAttackReportsClient,
@@ -12318,9 +13056,14 @@ export {
   WebSocketConnectionParamsSchema,
   WeightedRegexSchema,
   aiGwOrganisationsAuthSettingsPath,
+  collectAll,
+  collectSkipPages,
+  collectSpringPages,
   globalConfiguration,
   init,
   jsonNullable,
-  pageSchema
+  pageSchema,
+  paginate,
+  serializeListing
 };
 //# sourceMappingURL=index.js.map