@cdot65/prisma-airs-sdk 0.18.0 → 0.20.0

package/dist/index.cjs

@@ -35,6 +35,18 @@ __export(index_exports, {
   AIGatewayWorkspacesClient: () => AIGatewayWorkspacesClient,
   AIRS_ENDPOINTS: () => AIRS_ENDPOINTS,
   AISecSDKException: () => AISecSDKException,
+  AI_GATEWAY_DEPLOYMENT_STATUSES: () => AI_GATEWAY_DEPLOYMENT_STATUSES,
+  AI_GATEWAY_DEPLOYMENT_TYPES: () => AI_GATEWAY_DEPLOYMENT_TYPES,
+  AI_GATEWAY_KNOWN_API_KEY_SCOPES: () => AI_GATEWAY_KNOWN_API_KEY_SCOPES,
+  AI_GATEWAY_KNOWN_CACHE_MODES: () => AI_GATEWAY_KNOWN_CACHE_MODES,
+  AI_GATEWAY_KNOWN_CONFIG_STRATEGIES: () => AI_GATEWAY_KNOWN_CONFIG_STRATEGIES,
+  AI_GATEWAY_KNOWN_MCP_AUTH_TYPES: () => AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
+  AI_GATEWAY_KNOWN_MCP_TRANSPORTS: () => AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
+  AI_GATEWAY_KNOWN_RATE_LIMIT_TYPES: () => AI_GATEWAY_KNOWN_RATE_LIMIT_TYPES,
+  AI_GATEWAY_KNOWN_RATE_LIMIT_UNITS: () => AI_GATEWAY_KNOWN_RATE_LIMIT_UNITS,
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES: () => AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
+  AI_GATEWAY_REDACTED: () => AI_GATEWAY_REDACTED,
+  AI_GATEWAY_SECRET_FIELDS: () => AI_GATEWAY_SECRET_FIELDS,
   AI_GW_ADMIN_ENDPOINT: () => AI_GW_ADMIN_ENDPOINT,
   AI_GW_API_KEYS_SERVICE_PATH: () => AI_GW_API_KEYS_SERVICE_PATH,
   AI_GW_API_KEYS_USER_PATH: () => AI_GW_API_KEYS_USER_PATH,
@@ -286,35 +298,100 @@ __export(index_exports, {
   FileScanDataSchema: () => FileScanDataSchema,
   FileScanResult: () => FileScanResult,
   FileType: () => FileType,
+  GatewayApiKeyCreateRequestSchema: () => GatewayApiKeyCreateRequestSchema,
+  GatewayApiKeyRotateRequestSchema: () => GatewayApiKeyRotateRequestSchema,
+  GatewayApiKeyRotateResponseSchema: () => GatewayApiKeyRotateResponseSchema,
+  GatewayApiKeyRotationPolicySchema: () => GatewayApiKeyRotationPolicySchema,
   GatewayApiKeySchema: () => GatewayApiKeySchema,
+  GatewayApiKeyScopeSchema: () => GatewayApiKeyScopeSchema,
+  GatewayApiKeyUpdateRequestSchema: () => GatewayApiKeyUpdateRequestSchema,
   GatewayAuditLogRecordSchema: () => GatewayAuditLogRecordSchema,
   GatewayAuditLogsResponseSchema: () => GatewayAuditLogsResponseSchema,
+  GatewayAzureAIConfigurationSchema: () => GatewayAzureAIConfigurationSchema,
+  GatewayAzureDeploymentConfigurationSchema: () => GatewayAzureDeploymentConfigurationSchema,
+  GatewayAzureOpenAIConfigurationSchema: () => GatewayAzureOpenAIConfigurationSchema,
+  GatewayBedrockConfigurationSchema: () => GatewayBedrockConfigurationSchema,
   GatewayChartRecordSchema: () => GatewayChartRecordSchema,
+  GatewayConfigCacheModeSchema: () => GatewayConfigCacheModeSchema,
+  GatewayConfigCreateRequestSchema: () => GatewayConfigCreateRequestSchema,
   GatewayConfigCreateResponseSchema: () => GatewayConfigCreateResponseSchema,
   GatewayConfigDetailSchema: () => GatewayConfigDetailSchema,
   GatewayConfigSchema: () => GatewayConfigSchema,
+  GatewayConfigStrategySchema: () => GatewayConfigStrategySchema,
+  GatewayConfigUpdateRequestSchema: () => GatewayConfigUpdateRequestSchema,
+  GatewayConfigVersionSchema: () => GatewayConfigVersionSchema,
+  GatewayCortexConfigurationSchema: () => GatewayCortexConfigurationSchema,
+  GatewayCustomHostConfigurationSchema: () => GatewayCustomHostConfigurationSchema,
+  GatewayDefaultsInputSchema: () => GatewayDefaultsInputSchema,
+  GatewayDeploymentAuthSettingsInputSchema: () => GatewayDeploymentAuthSettingsInputSchema,
+  GatewayDeploymentCreateRequestSchema: () => GatewayDeploymentCreateRequestSchema,
   GatewayDeploymentCreateResponseSchema: () => GatewayDeploymentCreateResponseSchema,
   GatewayDeploymentDetailSchema: () => GatewayDeploymentDetailSchema,
+  GatewayDeploymentPingResponseSchema: () => GatewayDeploymentPingResponseSchema,
   GatewayDeploymentSchema: () => GatewayDeploymentSchema,
+  GatewayDeploymentStatusSchema: () => GatewayDeploymentStatusSchema,
+  GatewayDeploymentTypeSchema: () => GatewayDeploymentTypeSchema,
+  GatewayDeploymentUpdateRequestSchema: () => GatewayDeploymentUpdateRequestSchema,
+  GatewayGlobalWorkspaceAccessInputSchema: () => GatewayGlobalWorkspaceAccessInputSchema,
   GatewayGlobalWorkspaceAccessSchema: () => GatewayGlobalWorkspaceAccessSchema,
   GatewayGroupRowSchema: () => GatewayGroupRowSchema,
+  GatewayGuardrailActionsSchema: () => GatewayGuardrailActionsSchema,
+  GatewayGuardrailCheckSchema: () => GatewayGuardrailCheckSchema,
+  GatewayGuardrailCreateRequestSchema: () => GatewayGuardrailCreateRequestSchema,
   GatewayGuardrailCreateResponseSchema: () => GatewayGuardrailCreateResponseSchema,
   GatewayGuardrailDetailSchema: () => GatewayGuardrailDetailSchema,
   GatewayGuardrailSchema: () => GatewayGuardrailSchema,
+  GatewayGuardrailUpdateRequestSchema: () => GatewayGuardrailUpdateRequestSchema,
+  GatewayHuggingFaceConfigurationSchema: () => GatewayHuggingFaceConfigurationSchema,
+  GatewayIntegrationCreateRequestSchema: () => GatewayIntegrationCreateRequestSchema,
+  GatewayIntegrationModelUpdateSchema: () => GatewayIntegrationModelUpdateSchema,
+  GatewayIntegrationModelsBulkUpdateRequestSchema: () => GatewayIntegrationModelsBulkUpdateRequestSchema,
   GatewayIntegrationModelsResponseSchema: () => GatewayIntegrationModelsResponseSchema,
   GatewayIntegrationSchema: () => GatewayIntegrationSchema,
+  GatewayIntegrationUpdateRequestSchema: () => GatewayIntegrationUpdateRequestSchema,
   GatewayIntegrationWorkspaceSchema: () => GatewayIntegrationWorkspaceSchema,
+  GatewayIntegrationWorkspacesBulkUpdateRequestSchema: () => GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
   GatewayIntegrationWorkspacesResponseSchema: () => GatewayIntegrationWorkspacesResponseSchema,
+  GatewayJsonObjectSchema: () => GatewayJsonObjectSchema,
+  GatewayJsonValueSchema: () => GatewayJsonValueSchema,
   GatewayLogRecordSchema: () => GatewayLogRecordSchema,
   GatewayLogsResponseSchema: () => GatewayLogsResponseSchema,
+  GatewayMcpAuthTypeSchema: () => GatewayMcpAuthTypeSchema,
+  GatewayMcpTransportSchema: () => GatewayMcpTransportSchema,
+  GatewayMutableMcpCapabilityTypeSchema: () => GatewayMutableMcpCapabilityTypeSchema,
+  GatewayOpenAIConfigurationSchema: () => GatewayOpenAIConfigurationSchema,
+  GatewayOrganisationAuthSettingsUpdateRequestSchema: () => GatewayOrganisationAuthSettingsUpdateRequestSchema,
+  GatewayOrganisationUpdateRequestSchema: () => GatewayOrganisationUpdateRequestSchema,
+  GatewayPluginCreateRequestSchema: () => GatewayPluginCreateRequestSchema,
   GatewayPluginSchema: () => GatewayPluginSchema,
+  GatewayProviderCreateRequestSchema: () => GatewayProviderCreateRequestSchema,
   GatewayProviderCreateResponseSchema: () => GatewayProviderCreateResponseSchema,
+  GatewayProviderDetailSchema: () => GatewayProviderDetailSchema,
   GatewayProviderSchema: () => GatewayProviderSchema,
+  GatewayProviderUpdateRequestSchema: () => GatewayProviderUpdateRequestSchema,
+  GatewayRateLimitInputSchema: () => GatewayRateLimitInputSchema,
   GatewayRateLimitSchema: () => GatewayRateLimitSchema,
+  GatewayRateLimitTypeSchema: () => GatewayRateLimitTypeSchema,
+  GatewayRateLimitUnitSchema: () => GatewayRateLimitUnitSchema,
+  GatewayRoutingCacheSchema: () => GatewayRoutingCacheSchema,
+  GatewayRoutingConfigSchema: () => GatewayRoutingConfigSchema,
+  GatewayRoutingRetrySchema: () => GatewayRoutingRetrySchema,
+  GatewayRoutingStrategySchema: () => GatewayRoutingStrategySchema,
+  GatewayRoutingTargetSchema: () => GatewayRoutingTargetSchema,
+  GatewaySageMakerConfigurationSchema: () => GatewaySageMakerConfigurationSchema,
+  GatewaySecretMappingSchema: () => GatewaySecretMappingSchema,
+  GatewayServiceApiKeyCreateRequestSchema: () => GatewayServiceApiKeyCreateRequestSchema,
+  GatewayUsageLimitInputSchema: () => GatewayUsageLimitInputSchema,
   GatewayUsageLimitSchema: () => GatewayUsageLimitSchema,
+  GatewayUserApiKeyCreateRequestSchema: () => GatewayUserApiKeyCreateRequestSchema,
+  GatewayVertexAIConfigurationSchema: () => GatewayVertexAIConfigurationSchema,
+  GatewayWorkersAIConfigurationSchema: () => GatewayWorkersAIConfigurationSchema,
+  GatewayWorkspaceBindingSchema: () => GatewayWorkspaceBindingSchema,
+  GatewayWorkspaceCreateRequestSchema: () => GatewayWorkspaceCreateRequestSchema,
   GatewayWorkspaceCreateResponseSchema: () => GatewayWorkspaceCreateResponseSchema,
   GatewayWorkspaceDetailSchema: () => GatewayWorkspaceDetailSchema,
   GatewayWorkspaceSchema: () => GatewayWorkspaceSchema,
+  GatewayWorkspaceUpdateRequestSchema: () => GatewayWorkspaceUpdateRequestSchema,
   GatewayWriteResponseSchema: () => GatewayWriteResponseSchema,
   GoalListResponseSchema: () => GoalListResponseSchema,
   GoalSchema: () => GoalSchema,
@@ -349,6 +426,7 @@ __export(index_exports, {
   LanguageOptionSchema: () => LanguageOptionSchema,
   LatencyChartResponseSchema: () => LatencyChartResponseSchema,
   ListApiKeysResponseSchema: () => ListApiKeysResponseSchema,
+  ListConfigVersionsResponseSchema: () => ListConfigVersionsResponseSchema,
   ListConfigsResponseSchema: () => ListConfigsResponseSchema,
   ListDeploymentsResponseSchema: () => ListDeploymentsResponseSchema,
   ListGuardrailsResponseSchema: () => ListGuardrailsResponseSchema,
@@ -417,7 +495,18 @@ __export(index_exports, {
   MaskedDataSchema: () => MaskedDataSchema,
   McEntrySchema: () => McEntrySchema,
   McReportSchema: () => McReportSchema,
+  McpIntegrationCapabilitiesBulkUpdateRequestSchema: () => McpIntegrationCapabilitiesBulkUpdateRequestSchema,
+  McpIntegrationCapabilitiesResponseSchema: () => McpIntegrationCapabilitiesResponseSchema,
+  McpIntegrationCapabilitiesUpdateResponseSchema: () => McpIntegrationCapabilitiesUpdateResponseSchema,
+  McpIntegrationCapabilitySchema: () => McpIntegrationCapabilitySchema,
+  McpIntegrationCapabilityUpdateSchema: () => McpIntegrationCapabilityUpdateSchema,
+  McpIntegrationCreateRequestSchema: () => McpIntegrationCreateRequestSchema,
+  McpIntegrationDetailSchema: () => McpIntegrationDetailSchema,
+  McpIntegrationMetadataSchema: () => McpIntegrationMetadataSchema,
   McpIntegrationSchema: () => McpIntegrationSchema,
+  McpIntegrationUpdateRequestSchema: () => McpIntegrationUpdateRequestSchema,
+  McpIntegrationWorkspacesBulkUpdateRequestSchema: () => McpIntegrationWorkspacesBulkUpdateRequestSchema,
+  McpIntegrationWorkspacesUpdateResponseSchema: () => McpIntegrationWorkspacesUpdateResponseSchema,
   MetadataCriterionSchema: () => MetadataCriterionSchema,
   MetadataSchema: () => MetadataSchema,
   ModelConfigurationSchema: () => ModelConfigurationSchema,
@@ -660,6 +749,7 @@ __export(index_exports, {
   WebSocketConnectionParamsSchema: () => WebSocketConnectionParamsSchema,
   WeightedRegexSchema: () => WeightedRegexSchema,
   aiGwOrganisationsAuthSettingsPath: () => aiGwOrganisationsAuthSettingsPath,
+  buildDottedObject: () => buildDottedObject,
   collectAll: () => collectAll,
   collectSkipPages: () => collectSkipPages,
   collectSpringPages: () => collectSpringPages,
@@ -668,7 +758,9 @@ __export(index_exports, {
   jsonNullable: () => jsonNullable,
   pageSchema: () => pageSchema,
   paginate: () => paginate,
-  serializeListing: () => serializeListing
+  redactAIGatewaySecrets: () => redactAIGatewaySecrets,
+  serializeListing: () => serializeListing,
+  setDottedValue: () => setDottedValue
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -703,7 +795,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 20;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.17.0";
+var SDK_VERSION = "0.20.0";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -946,8 +1038,8 @@ var import_zod15 = require("zod");
 // src/utils.ts
 var import_node_crypto = require("crypto");
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function isValidUuid(value) {
-  return UUID_RE.test(value);
+function isValidUuid(value2) {
+  return UUID_RE.test(value2);
 }
 function generatePayloadHash(payload, secret) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(payload).digest("hex");
@@ -1007,9 +1099,9 @@ function extractErrorMessage(body, status) {
     return body ? `API error ${status}: ${body}` : `API error ${status}`;
   }
 }
-function parseRetryAfterHeader(value) {
-  if (value === null) return void 0;
-  const normalized = value.trim();
+function parseRetryAfterHeader(value2) {
+  if (value2 === null) return void 0;
+  const normalized = value2.trim();
   if (/^\d+$/.test(normalized)) {
     const milliseconds = Number(normalized) * 1e3;
     return Number.isFinite(milliseconds) ? milliseconds : void 0;
@@ -1111,6 +1203,120 @@ async function executeWithRetry(opts) {
 
 // src/http/debug.ts
 var import_node_crypto2 = require("crypto");
+
+// src/ai-gateway/secret-fields.ts
+var AI_GATEWAY_REDACTED = "[REDACTED]";
+var value = (...path) => ({
+  path,
+  redact: "value"
+});
+var subtree = (...path) => ({
+  path,
+  redact: "subtree"
+});
+var oneTime = (...path) => ({
+  path,
+  redact: "value",
+  oneTime: true
+});
+var providerRequestSecrets = [
+  value("key"),
+  value("configurations", "azure_entra_client_secret"),
+  value("configurations", "aws_secret_access_key"),
+  subtree("configurations", "vertex_service_account_json"),
+  value("configurations", "custom_headers", "*")
+];
+var mcpRequestSecrets = [
+  value("configurations", "custom_headers", "*"),
+  value("configurations", "client_secret"),
+  value("configurations", "oauth_client_secret"),
+  subtree("configurations", "oauth_metadata")
+];
+var empty = [];
+var AI_GATEWAY_SECRET_FIELDS = {
+  "apiKeys.createService": { request: empty, response: [oneTime("key")] },
+  "apiKeys.createUser": { request: empty, response: [oneTime("key")] },
+  "apiKeys.rotateService": { request: empty, response: [oneTime("key")] },
+  "apiKeys.rotateUser": { request: empty, response: [oneTime("key")] },
+  "deployments.create": {
+    request: empty,
+    response: [oneTime("client_auth"), oneTime("credentials", "password")]
+  },
+  "deployments.update": {
+    request: empty,
+    response: [oneTime("client_auth"), oneTime("credentials", "password")]
+  },
+  "integrations.create": { request: providerRequestSecrets, response: empty },
+  "integrations.update": { request: providerRequestSecrets, response: empty },
+  "mcpIntegrations.create": { request: mcpRequestSecrets, response: empty },
+  "mcpIntegrations.update": { request: mcpRequestSecrets, response: empty },
+  "organisations.getAuthSettings": {
+    request: empty,
+    response: [value("scim_token"), value("data", "scim_token")]
+  },
+  "organisations.updateAuthSettings": {
+    request: [value("scim_token"), value("auth_settings", "client_secret")],
+    response: [value("scim_token"), value("data", "scim_token")]
+  },
+  "plugins.create": { request: [value("credentials", "*")], response: empty },
+  "providers.get": {
+    request: empty,
+    response: [
+      value("key"),
+      subtree("model_config"),
+      subtree("credentials"),
+      value("configurations", "azure_entra_client_secret"),
+      value("configurations", "aws_secret_access_key"),
+      subtree("configurations", "vertex_service_account_json"),
+      value("configurations", "custom_headers", "*")
+    ]
+  }
+};
+function cloneValue(input, seen = /* @__PURE__ */ new WeakMap()) {
+  if (typeof input !== "object" || input === null) return input;
+  const cached = seen.get(input);
+  if (cached !== void 0) return cached;
+  const output = Array.isArray(input) ? [] : {};
+  seen.set(input, output);
+  if (Array.isArray(input)) {
+    for (const item of input) output.push(cloneValue(item, seen));
+  } else {
+    for (const [key, item] of Object.entries(input)) {
+      Object.defineProperty(output, key, {
+        value: cloneValue(item, seen),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+  }
+  return output;
+}
+function applyRule(current, path, index) {
+  if (index === path.length) return AI_GATEWAY_REDACTED;
+  if (typeof current !== "object" || current === null) return current;
+  const segment = path[index];
+  if (Array.isArray(current)) {
+    if (segment !== "*") return current;
+    for (let i = 0; i < current.length; i++) current[i] = applyRule(current[i], path, index + 1);
+    return current;
+  }
+  const record = current;
+  if (segment === "*") {
+    for (const key of Object.keys(record)) record[key] = applyRule(record[key], path, index + 1);
+  } else if (Object.prototype.hasOwnProperty.call(record, segment)) {
+    record[segment] = applyRule(record[segment], path, index + 1);
+  }
+  return record;
+}
+function redactAIGatewaySecrets(operation, input, direction = "request") {
+  const output = cloneValue(input);
+  const metadata = AI_GATEWAY_SECRET_FIELDS[operation];
+  for (const rule of metadata[direction]) applyRule(output, rule.path, 0);
+  return output;
+}
+
+// src/http/debug.ts
 var TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
 var SENSITIVE_HEADERS = /* @__PURE__ */ new Set([HEADER_AUTH_TOKEN.toLowerCase(), HEADER_API_KEY.toLowerCase()]);
 var PREFIX = "[airs-sdk]";
@@ -1118,16 +1324,23 @@ function isDebugEnabled() {
   const raw = process.env.PANW_AI_SEC_DEBUG;
   return raw !== void 0 && TRUTHY.has(raw.trim().toLowerCase());
 }
-function hashToken(value) {
-  return "sha256:" + (0, import_node_crypto2.createHash)("sha256").update(value).digest("hex").slice(0, 12);
+function hashToken(value2) {
+  return "sha256:" + (0, import_node_crypto2.createHash)("sha256").update(value2).digest("hex").slice(0, 12);
 }
 function sanitizeHeaders(headers) {
   const out = {};
-  for (const [key, value] of Object.entries(headers)) {
-    out[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? hashToken(value) : value;
+  for (const [key, value2] of Object.entries(headers)) {
+    out[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? hashToken(value2) : value2;
   }
   return out;
 }
+function sanitizeAIGatewayDebugBody(body, operation, direction) {
+  try {
+    return JSON.stringify(redactAIGatewaySecrets(operation, JSON.parse(body), direction));
+  } catch {
+    return "[BODY OMITTED: REDACTION FAILED]";
+  }
+}
 function logRequest(method, url, headers, body) {
   console.error(`${PREFIX} \u2192 ${method} ${url}`);
   console.error(`${PREFIX}   headers ${JSON.stringify(sanitizeHeaders(headers))}`);
@@ -1139,6 +1352,20 @@ function logResponse(status, ms, body) {
 
 // src/http/request.ts
 async function request(spec) {
+  let validatedBody = spec.body;
+  if (spec.requestSchema !== void 0) {
+    const result2 = spec.requestSchema.safeParse(spec.body);
+    if (!result2.success) {
+      const issues = result2.error.issues.map(
+        (issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<root>"}: ${issue.message}`
+      ).join("; ");
+      throw new AISecSDKException(
+        `Request body for ${spec.method} ${spec.path} did not match schema: ${issues}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    validatedBody = result2.data;
+  }
   let hasRetriedAuth = false;
   const debug = isDebugEnabled();
   const response = await executeWithRetry({
@@ -1147,11 +1374,11 @@ async function request(spec) {
       const baseUrl = spec.baseUrl.replace(/\/+$/, "");
       const url = new URL(`${baseUrl}${spec.path}`);
       if (spec.params) {
-        for (const [key, value] of Object.entries(spec.params)) {
-          if (Array.isArray(value)) {
-            for (const v of value) url.searchParams.append(key, v);
+        for (const [key, value2] of Object.entries(spec.params)) {
+          if (Array.isArray(value2)) {
+            for (const v of value2) url.searchParams.append(key, v);
           } else {
-            url.searchParams.set(key, value);
+            url.searchParams.set(key, value2);
           }
         }
       }
@@ -1163,16 +1390,19 @@ async function request(spec) {
       let bodyForFetch;
       if (spec.formData !== void 0) {
         bodyForFetch = spec.formData;
-      } else if (spec.body !== void 0) {
+      } else if (validatedBody !== void 0) {
         headers["Content-Type"] = spec.contentType ?? "application/json";
-        bodyText = JSON.stringify(spec.body);
+        bodyText = JSON.stringify(validatedBody);
         bodyForFetch = bodyText;
       }
       const prepared = { method: spec.method, url, headers, bodyText };
       const final = await spec.auth.prepare(prepared);
       const startedAt = debug ? Date.now() : 0;
       if (debug) {
-        const logBody = spec.formData !== void 0 ? "[multipart/form-data]" : final.bodyText;
+        let logBody = spec.formData !== void 0 ? "[multipart/form-data]" : final.bodyText;
+        if (logBody !== void 0 && spec.secretOperation !== void 0) {
+          logBody = sanitizeAIGatewayDebugBody(logBody, spec.secretOperation, "request");
+        }
         logRequest(final.method, final.url.toString(), final.headers, logBody);
       }
       const res = await fetch(final.url.toString(), {
@@ -1184,6 +1414,9 @@ async function request(spec) {
         let respBody;
         try {
           respBody = await res.clone().text();
+          if (respBody && spec.secretOperation !== void 0) {
+            respBody = sanitizeAIGatewayDebugBody(respBody, spec.secretOperation, "response");
+          }
         } catch {
         }
         logResponse(res.status, Date.now() - startedAt, respBody);
@@ -1837,14 +2070,14 @@ var Content = class _Content {
   get prompt() {
     return this._prompt;
   }
-  set prompt(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_PROMPT_LENGTH) {
+  set prompt(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_PROMPT_LENGTH) {
       throw new AISecSDKException(
         `prompt exceeds max length of ${MAX_CONTENT_PROMPT_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._prompt = value;
+    this._prompt = value2;
   }
   /**
    * AI model response text. Setting a value validates its byte length (max 2 MB).
@@ -1859,14 +2092,14 @@ var Content = class _Content {
   get response() {
     return this._response;
   }
-  set response(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_RESPONSE_LENGTH) {
+  set response(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_RESPONSE_LENGTH) {
       throw new AISecSDKException(
         `response exceeds max length of ${MAX_CONTENT_RESPONSE_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._response = value;
+    this._response = value2;
   }
   /**
    * Conversation context. Setting a value validates its byte length (max 100 MB).
@@ -1881,14 +2114,14 @@ var Content = class _Content {
   get context() {
     return this._context;
   }
-  set context(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_CONTEXT_LENGTH) {
+  set context(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_CONTEXT_LENGTH) {
       throw new AISecSDKException(
         `context exceeds max length of ${MAX_CONTENT_CONTEXT_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._context = value;
+    this._context = value2;
   }
   /**
    * Code prompt text. Setting a value validates its byte length (max 2 MB).
@@ -1903,14 +2136,14 @@ var Content = class _Content {
   get codePrompt() {
     return this._codePrompt;
   }
-  set codePrompt(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_PROMPT_LENGTH) {
+  set codePrompt(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_PROMPT_LENGTH) {
       throw new AISecSDKException(
         `codePrompt exceeds max length of ${MAX_CONTENT_PROMPT_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._codePrompt = value;
+    this._codePrompt = value2;
   }
   /**
    * Code response text. Setting a value validates its byte length (max 2 MB).
@@ -1925,14 +2158,14 @@ var Content = class _Content {
   get codeResponse() {
     return this._codeResponse;
   }
-  set codeResponse(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_RESPONSE_LENGTH) {
+  set codeResponse(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_RESPONSE_LENGTH) {
       throw new AISecSDKException(
         `codeResponse exceeds max length of ${MAX_CONTENT_RESPONSE_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._codeResponse = value;
+    this._codeResponse = value2;
   }
   /**
    * Tool/function call event data attached to the content.
@@ -1950,8 +2183,8 @@ var Content = class _Content {
   get toolEvent() {
     return this._toolEvent;
   }
-  set toolEvent(value) {
-    this._toolEvent = value;
+  set toolEvent(value2) {
+    this._toolEvent = value2;
   }
   /**
    * Total byte length of all text content fields.
@@ -3367,7 +3600,7 @@ var RuleEvaluationListSchema = import_zod32.z.object({
 }).passthrough();
 var ViolationRemediationSchema = import_zod32.z.object({
   steps: import_zod32.z.array(import_zod32.z.string()),
-  url: import_zod32.z.string()
+  url: import_zod32.z.string().optional()
 }).passthrough();
 var ViolationResponseSchema = import_zod32.z.object({
   uuid: import_zod32.z.string(),
@@ -3379,7 +3612,7 @@ var ViolationResponseSchema = import_zod32.z.object({
   rule_name: import_zod32.z.string(),
   rule_description: import_zod32.z.string(),
   rule_instance_state: import_zod32.z.string(),
-  remediation: ViolationRemediationSchema,
+  remediation: ViolationRemediationSchema.optional(),
   file: import_zod32.z.string().nullable().optional(),
   hash: import_zod32.z.string().nullable().optional(),
   module: import_zod32.z.string().nullable().optional(),
@@ -3431,12 +3664,12 @@ var ListModelSecurityRulesResponseSchema = import_zod32.z.object({
 var ModelSecurityRuleInstanceResponseSchema = import_zod32.z.object({
   uuid: import_zod32.z.string(),
   tsg_id: import_zod32.z.string(),
-  created_at: import_zod32.z.string(),
-  updated_at: import_zod32.z.string(),
+  created_at: import_zod32.z.string().optional(),
+  updated_at: import_zod32.z.string().optional(),
   security_group_uuid: import_zod32.z.string(),
-  security_rule_uuid: import_zod32.z.string(),
+  security_rule_uuid: import_zod32.z.string().optional(),
   state: import_zod32.z.string(),
-  rule: ModelSecurityRuleResponseSchema,
+  rule: ModelSecurityRuleResponseSchema.optional(),
   field_values: import_zod32.z.record(import_zod32.z.unknown()).optional()
 }).passthrough();
 var ModelSecurityRuleInstanceUpdateRequestSchema = import_zod32.z.object({
@@ -5117,6 +5350,11 @@ var GatewayConfigDetailSchema = GatewayConfigSchema.extend({
   type: import_zod35.z.string(),
   version_id: import_zod35.z.string()
 }).passthrough();
+var GatewayConfigVersionSchema = GatewayConfigDetailSchema.extend({
+  version_created_at: import_zod35.z.string(),
+  version_owner_id: import_zod35.z.string()
+}).passthrough();
+var ListConfigVersionsResponseSchema = aiGatewayList(GatewayConfigVersionSchema);
 var GatewayConfigCreateResponseSchema = import_zod35.z.object({
   id: import_zod35.z.string(),
   version_id: import_zod35.z.string(),
@@ -5154,8 +5392,8 @@ var GatewayGuardrailDetailSchema = GatewayGuardrailSchema.extend({
     async: import_zod35.z.boolean(),
     sequential: import_zod35.z.boolean(),
     /** Absent when the guardrail was created without a pass/fail feedback action. */
-    on_success: guardrailFeedbackActionSchema.optional(),
-    on_fail: guardrailFeedbackActionSchema.optional()
+    on_success: guardrailFeedbackActionSchema.nullable().optional(),
+    on_fail: guardrailFeedbackActionSchema.nullable().optional()
   }).passthrough(),
   version_id: import_zod35.z.string()
 }).passthrough();
@@ -5172,6 +5410,27 @@ var GatewayProviderSchema = import_zod35.z.object({
   object: import_zod35.z.string().optional()
 }).passthrough();
 var ListProvidersResponseSchema = aiGatewayList(GatewayProviderSchema);
+var GatewayProviderDetailSchema = import_zod35.z.object({
+  id: import_zod35.z.string(),
+  ai_provider_name: import_zod35.z.string(),
+  model_config: import_zod35.z.record(import_zod35.z.unknown()),
+  /** Potentially secret-bearing. Never log or persist this field. */
+  key: import_zod35.z.string(),
+  masked_api_key: import_zod35.z.string(),
+  slug: import_zod35.z.string(),
+  name: import_zod35.z.string(),
+  usage_limits: import_zod35.z.unknown().nullable(),
+  status: import_zod35.z.string(),
+  note: import_zod35.z.string().nullable(),
+  created_at: import_zod35.z.string(),
+  expires_at: import_zod35.z.string().nullable(),
+  last_reset_at: import_zod35.z.string().nullable(),
+  rate_limits: import_zod35.z.array(import_zod35.z.unknown()),
+  integration_id: import_zod35.z.string(),
+  tags: import_zod35.z.unknown().nullable(),
+  secret_mappings: import_zod35.z.array(import_zod35.z.unknown()).optional(),
+  object: import_zod35.z.string()
+}).passthrough();
 var GatewayProviderCreateResponseSchema = import_zod35.z.object({
   id: import_zod35.z.string(),
   slug: import_zod35.z.string(),
@@ -5183,6 +5442,11 @@ var GatewayApiKeySchema = import_zod35.z.object({
   object: import_zod35.z.string().optional()
 }).passthrough();
 var ListApiKeysResponseSchema = aiGatewayList(GatewayApiKeySchema);
+var GatewayApiKeyRotateResponseSchema = import_zod35.z.object({
+  id: import_zod35.z.string(),
+  key: import_zod35.z.string(),
+  key_transition_expires_at: import_zod35.z.string()
+}).passthrough();
 var GatewayIntegrationSchema = import_zod35.z.object({
   id: import_zod35.z.string(),
   organisation_id: import_zod35.z.string().optional(),
@@ -5213,7 +5477,7 @@ var GatewayIntegrationWorkspaceSchema = import_zod35.z.object({
   enabled: import_zod35.z.boolean(),
   status: import_zod35.z.string(),
   created_at: import_zod35.z.string(),
-  last_updated_at: import_zod35.z.string(),
+  last_updated_at: import_zod35.z.string().nullable(),
   last_reset_at: import_zod35.z.string().nullable()
 }).passthrough();
 var GatewayGlobalWorkspaceAccessSchema = import_zod35.z.object({
@@ -5246,6 +5510,70 @@ var McpIntegrationSchema = import_zod35.z.object({
   last_updated_at: import_zod35.z.string()
 }).passthrough();
 var ListMcpIntegrationsResponseSchema = aiGatewayList(McpIntegrationSchema);
+var McpIntegrationDetailSchema = import_zod35.z.object({
+  id: import_zod35.z.string(),
+  name: import_zod35.z.string(),
+  description: import_zod35.z.string().nullable(),
+  owner_id: import_zod35.z.string(),
+  status: import_zod35.z.string(),
+  created_at: import_zod35.z.string(),
+  last_updated_at: import_zod35.z.string(),
+  configurations: import_zod35.z.record(import_zod35.z.unknown()),
+  global_workspace_access: import_zod35.z.object({ enabled: import_zod35.z.boolean() }).passthrough().nullable(),
+  workspace_id: import_zod35.z.string().nullable(),
+  slug: import_zod35.z.string(),
+  url: import_zod35.z.string(),
+  auth_type: import_zod35.z.string(),
+  transport: import_zod35.z.string(),
+  type: import_zod35.z.string(),
+  secret_mappings: import_zod35.z.array(import_zod35.z.unknown()).nullable(),
+  object: import_zod35.z.string()
+}).passthrough();
+var McpCapabilityCountSchema = import_zod35.z.object({ total: import_zod35.z.number(), enabled: import_zod35.z.number() }).passthrough();
+var McpIntegrationCapabilitySchema = import_zod35.z.object({
+  name: import_zod35.z.string(),
+  type: import_zod35.z.string(),
+  title: import_zod35.z.string().nullable(),
+  description: import_zod35.z.string().nullable(),
+  icons: import_zod35.z.unknown().nullable(),
+  enabled: import_zod35.z.boolean(),
+  created_at: import_zod35.z.string(),
+  last_updated_at: import_zod35.z.string(),
+  input_schema: import_zod35.z.record(import_zod35.z.unknown()).nullable(),
+  output_schema: import_zod35.z.record(import_zod35.z.unknown()).nullable(),
+  execution: import_zod35.z.unknown().nullable(),
+  annotations: import_zod35.z.record(import_zod35.z.unknown()).nullable(),
+  object: import_zod35.z.string()
+}).passthrough();
+var McpIntegrationCapabilitiesResponseSchema = import_zod35.z.object({
+  object: import_zod35.z.string(),
+  counts: import_zod35.z.object({
+    tools: McpCapabilityCountSchema.optional(),
+    prompts: McpCapabilityCountSchema.optional(),
+    resources: McpCapabilityCountSchema.optional(),
+    resource_templates: McpCapabilityCountSchema.optional()
+  }).passthrough(),
+  total: import_zod35.z.number(),
+  has_more: import_zod35.z.boolean(),
+  data: import_zod35.z.array(McpIntegrationCapabilitySchema)
+}).passthrough();
+var McpIntegrationCapabilitiesUpdateResponseSchema = import_zod35.z.object({ success: import_zod35.z.boolean() }).passthrough();
+var McpIntegrationWorkspacesUpdateResponseSchema = import_zod35.z.object({}).strict();
+var McpIntegrationMetadataSchema = import_zod35.z.object({
+  server_name: import_zod35.z.string(),
+  server_version: import_zod35.z.string(),
+  title: import_zod35.z.string().nullable(),
+  description: import_zod35.z.string().nullable(),
+  website_url: import_zod35.z.string().nullable(),
+  icons: import_zod35.z.unknown().nullable(),
+  protocol_version: import_zod35.z.string().nullable(),
+  capability_flags: import_zod35.z.record(import_zod35.z.unknown()),
+  instructions: import_zod35.z.string().nullable(),
+  sync_status: import_zod35.z.string(),
+  last_synced_at: import_zod35.z.string().nullable(),
+  sync_error: import_zod35.z.string().nullable(),
+  object: import_zod35.z.string()
+}).passthrough();
 var GatewayDeploymentSchema = import_zod35.z.object({
   id: import_zod35.z.string(),
   name: import_zod35.z.string(),
@@ -5281,6 +5609,18 @@ var GatewayDeploymentCreateResponseSchema = import_zod35.z.object({
   organisation_id: import_zod35.z.string(),
   object: import_zod35.z.string()
 }).passthrough();
+var GatewayDeploymentPingResponseSchema = import_zod35.z.object({
+  status: import_zod35.z.string(),
+  gateway_base_url: import_zod35.z.string(),
+  outbound: import_zod35.z.object({
+    status: import_zod35.z.string(),
+    status_code: import_zod35.z.number().optional(),
+    version: import_zod35.z.string().optional(),
+    error: import_zod35.z.string().optional()
+  }).passthrough(),
+  inbound: import_zod35.z.object({ status: import_zod35.z.string(), error: import_zod35.z.string().optional() }).passthrough(),
+  object: import_zod35.z.string()
+}).passthrough();
 var ListDeploymentsResponseSchema = aiGatewayList(GatewayDeploymentSchema);
 var GatewayPluginSchema = import_zod35.z.object({
   id: import_zod35.z.string(),
@@ -5318,6 +5658,472 @@ var GatewayAuditLogRecordSchema = import_zod35.z.object({
 }).passthrough();
 var GatewayAuditLogsResponseSchema = import_zod35.z.object({ records: import_zod35.z.array(GatewayAuditLogRecordSchema) }).passthrough();
 
+// src/models/ai-gateway-routing.ts
+var import_zod36 = require("zod");
+var AI_GATEWAY_DEPLOYMENT_TYPES = ["non_production", "production"];
+var GatewayDeploymentTypeSchema = import_zod36.z.enum(AI_GATEWAY_DEPLOYMENT_TYPES);
+var AI_GATEWAY_DEPLOYMENT_STATUSES = ["active", "archived"];
+var GatewayDeploymentStatusSchema = import_zod36.z.enum(AI_GATEWAY_DEPLOYMENT_STATUSES);
+var AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES = ["prompt", "resource", "tool"];
+var GatewayMutableMcpCapabilityTypeSchema = import_zod36.z.enum(
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES
+);
+var AI_GATEWAY_KNOWN_API_KEY_SCOPES = [
+  "agents.invoke",
+  "completions.write",
+  "logs.write",
+  "mcp.invoke",
+  "prompts.render"
+];
+var AI_GATEWAY_KNOWN_CACHE_MODES = ["semantic", "simple"];
+var AI_GATEWAY_KNOWN_CONFIG_STRATEGIES = ["fallback", "loadbalance", "single"];
+var AI_GATEWAY_KNOWN_MCP_AUTH_TYPES = [
+  "headers",
+  "none",
+  "oauth_auto",
+  "oauth_client_credentials"
+];
+var AI_GATEWAY_KNOWN_MCP_TRANSPORTS = ["http", "interactive", "sse"];
+var AI_GATEWAY_KNOWN_RATE_LIMIT_TYPES = ["requests", "tokens"];
+var AI_GATEWAY_KNOWN_RATE_LIMIT_UNITS = ["rpd", "rph", "rpm", "rps", "rpw"];
+var openValue = () => import_zod36.z.string().min(1);
+var GatewayApiKeyScopeSchema = openValue();
+var GatewayConfigCacheModeSchema = openValue();
+var GatewayConfigStrategySchema = openValue();
+var GatewayMcpAuthTypeSchema = openValue();
+var GatewayMcpTransportSchema = openValue();
+var GatewayRateLimitTypeSchema = openValue();
+var GatewayRateLimitUnitSchema = openValue();
+var unsafeJsonKeys = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isFiniteJsonValue(value2, ancestors = /* @__PURE__ */ new WeakSet()) {
+  if (value2 === null || typeof value2 === "string" || typeof value2 === "boolean" || typeof value2 === "number" && Number.isFinite(value2)) {
+    return true;
+  }
+  if (typeof value2 !== "object" || ancestors.has(value2)) return false;
+  if (Array.isArray(value2)) {
+    const keys = Object.keys(value2);
+    if (keys.length !== value2.length || keys.some((key, index) => key !== String(index)) || Object.getOwnPropertySymbols(value2).length > 0) {
+      return false;
+    }
+    ancestors.add(value2);
+    const valid2 = value2.every((item) => isFiniteJsonValue(item, ancestors));
+    ancestors.delete(value2);
+    return valid2;
+  }
+  const prototype = Object.getPrototypeOf(value2);
+  if (prototype !== Object.prototype && prototype !== null) return false;
+  if (Object.getOwnPropertySymbols(value2).length > 0) return false;
+  ancestors.add(value2);
+  const valid = Object.entries(Object.getOwnPropertyDescriptors(value2)).every(
+    ([key, descriptor]) => descriptor.enumerable === true && "value" in descriptor && !unsafeJsonKeys.has(key) && isFiniteJsonValue(descriptor.value, ancestors)
+  );
+  ancestors.delete(value2);
+  return valid;
+}
+var GatewayJsonValueSchema = import_zod36.z.custom(
+  (value2) => isFiniteJsonValue(value2),
+  "Expected a finite, prototype-safe JSON value"
+);
+var GatewayJsonObjectSchema = import_zod36.z.custom(
+  (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2) && isFiniteJsonValue(value2),
+  "Expected a finite, prototype-safe JSON object"
+);
+var GatewayRoutingRetrySchema = import_zod36.z.object({
+  attempts: import_zod36.z.number().int().min(0).optional(),
+  on_status_codes: import_zod36.z.array(import_zod36.z.number().int().min(100).max(599)).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayRoutingCacheSchema = import_zod36.z.object({
+  mode: GatewayConfigCacheModeSchema.optional(),
+  max_age: import_zod36.z.number().int().min(0).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayRoutingStrategySchema = import_zod36.z.object({ mode: GatewayConfigStrategySchema }).catchall(GatewayJsonValueSchema);
+var GatewayRoutingTargetSchema = import_zod36.z.object({
+  provider: import_zod36.z.string().min(1).optional(),
+  virtual_key: import_zod36.z.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayRoutingConfigSchema = import_zod36.z.object({
+  retry: GatewayRoutingRetrySchema.optional(),
+  cache: GatewayRoutingCacheSchema.optional(),
+  strategy: GatewayRoutingStrategySchema.optional(),
+  targets: import_zod36.z.array(GatewayRoutingTargetSchema).optional(),
+  provider: import_zod36.z.string().min(1).optional(),
+  virtual_key: import_zod36.z.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayOpenAIConfigurationSchema = import_zod36.z.object({
+  openai_organization: import_zod36.z.string().min(1).optional(),
+  openai_project: import_zod36.z.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayAzureDeploymentConfigurationSchema = import_zod36.z.object({
+  alias: import_zod36.z.string().min(1).optional(),
+  azure_api_version: import_zod36.z.string().min(1).max(30),
+  azure_deployment_name: import_zod36.z.string().min(1),
+  is_default: import_zod36.z.boolean().optional(),
+  azure_model_slug: import_zod36.z.string().min(1)
+}).catchall(GatewayJsonValueSchema);
+var azureAuthModeSchema = import_zod36.z.enum(["default", "entra", "managed"]);
+var GatewayAzureOpenAIConfigurationSchema = import_zod36.z.object({
+  azure_auth_mode: azureAuthModeSchema,
+  azure_resource_name: import_zod36.z.string().min(1),
+  azure_deployment_config: import_zod36.z.array(GatewayAzureDeploymentConfigurationSchema).min(1),
+  azure_entra_tenant_id: import_zod36.z.string().min(1).optional(),
+  azure_entra_client_id: import_zod36.z.string().min(1).optional(),
+  azure_entra_client_secret: import_zod36.z.string().min(1).optional(),
+  azure_managed_client_id: import_zod36.z.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayBedrockConfigurationSchema = import_zod36.z.object({
+  aws_auth_type: import_zod36.z.enum(["accessKey", "assumedRole"]),
+  aws_region: import_zod36.z.string().min(1),
+  aws_access_key_id: import_zod36.z.string().min(1).optional(),
+  aws_secret_access_key: import_zod36.z.string().min(1).optional(),
+  aws_role_arn: import_zod36.z.string().min(1).optional(),
+  aws_external_id: import_zod36.z.string().min(1).nullable().optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewaySageMakerConfigurationSchema = GatewayBedrockConfigurationSchema.extend({
+  amzn_sagemaker_custom_attributes: import_zod36.z.string().optional(),
+  amzn_sagemaker_target_model: import_zod36.z.string().optional(),
+  amzn_sagemaker_target_variant: import_zod36.z.string().optional(),
+  amzn_sagemaker_target_container_hostname: import_zod36.z.string().optional(),
+  amzn_sagemaker_inference_id: import_zod36.z.string().optional(),
+  amzn_sagemaker_enable_explanations: import_zod36.z.string().optional(),
+  amzn_sagemaker_inference_component: import_zod36.z.string().optional(),
+  amzn_sagemaker_session_id: import_zod36.z.string().optional(),
+  amzn_sagemaker_model_name: import_zod36.z.string().optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayVertexAIConfigurationSchema = import_zod36.z.object({
+  vertex_auth_type: import_zod36.z.enum(["basic", "serviceAccount"]),
+  vertex_region: import_zod36.z.string().min(1),
+  vertex_project_id: import_zod36.z.string().min(1).optional(),
+  vertex_service_account_json: GatewayJsonObjectSchema.optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayAzureAIConfigurationSchema = import_zod36.z.object({
+  azure_auth_mode: azureAuthModeSchema,
+  azure_foundry_url: import_zod36.z.string().url(),
+  azure_api_version: import_zod36.z.string().min(1).max(30).optional(),
+  azure_deployment_name: import_zod36.z.string().min(1).optional(),
+  azure_entra_tenant_id: import_zod36.z.string().min(1).optional(),
+  azure_entra_client_id: import_zod36.z.string().min(1).optional(),
+  azure_entra_client_secret: import_zod36.z.string().min(1).optional(),
+  azure_managed_client_id: import_zod36.z.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayWorkersAIConfigurationSchema = import_zod36.z.object({ workers_ai_account_id: import_zod36.z.string().min(1) }).catchall(GatewayJsonValueSchema);
+var GatewayHuggingFaceConfigurationSchema = import_zod36.z.object({ huggingface_base_url: import_zod36.z.string().url().optional() }).catchall(GatewayJsonValueSchema);
+var GatewayCortexConfigurationSchema = import_zod36.z.object({ snowflake_account: import_zod36.z.string().min(1) }).catchall(GatewayJsonValueSchema);
+var GatewayCustomHostConfigurationSchema = import_zod36.z.object({
+  custom_host: import_zod36.z.string().url().optional(),
+  custom_headers: import_zod36.z.record(import_zod36.z.string()).optional()
+}).catchall(GatewayJsonValueSchema);
+
+// src/models/ai-gateway-requests.ts
+var import_zod37 = require("zod");
+var nonEmptyString = import_zod37.z.string().min(1);
+var uuid = import_zod37.z.string().uuid();
+var numericId = import_zod37.z.string().regex(/^\d+$/, "Expected a numeric-string TSG id");
+var workspaceRef = import_zod37.z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/);
+var dateTime = import_zod37.z.string().datetime({ offset: true });
+var nonEmptyObject = (schema, message = "Provide at least one field") => schema.refine((body) => Object.keys(body).length > 0, { message });
+var GatewayRateLimitInputSchema = import_zod37.z.object({
+  type: GatewayRateLimitTypeSchema,
+  unit: GatewayRateLimitUnitSchema,
+  value: import_zod37.z.number().int().min(0)
+}).strict();
+var GatewayUsageLimitInputSchema = nonEmptyObject(
+  import_zod37.z.object({
+    credit_limit: import_zod37.z.number().min(0).optional(),
+    type: import_zod37.z.enum(["cost", "tokens"]).optional(),
+    alert_threshold: import_zod37.z.number().min(0).optional(),
+    periodic_reset: import_zod37.z.enum(["monthly", "weekly"]).nullable().optional(),
+    periodic_reset_days: import_zod37.z.number().int().min(1).max(365).nullable().optional(),
+    next_usage_reset_at: dateTime.nullable().optional()
+  }).strict()
+).refine(
+  (value2) => value2.periodic_reset == null || value2.periodic_reset_days == null,
+  "periodic_reset and periodic_reset_days are mutually exclusive"
+);
+var GatewayDefaultsInputSchema = import_zod37.z.object({
+  metadata: import_zod37.z.record(GatewayJsonValueSchema).optional(),
+  config_id: nonEmptyString.optional(),
+  allow_config_override: import_zod37.z.boolean().optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewaySecretMappingSchema = import_zod37.z.object({
+  target_field: nonEmptyString,
+  secret_reference_id: nonEmptyString,
+  secret_key: nonEmptyString.nullable().optional(),
+  value_format: import_zod37.z.enum(["json", "string"]).nullable().optional()
+}).strict();
+var GatewayGlobalWorkspaceAccessInputSchema = import_zod37.z.object({
+  enabled: import_zod37.z.boolean(),
+  usage_limits: import_zod37.z.array(GatewayUsageLimitInputSchema).max(1).nullable().optional(),
+  rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).max(1).nullable().optional()
+}).strict();
+var GatewayWorkspaceBindingSchema = import_zod37.z.object({
+  id: workspaceRef,
+  enabled: import_zod37.z.boolean(),
+  usage_limits: import_zod37.z.array(GatewayUsageLimitInputSchema).max(1).nullable().optional(),
+  rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).max(1).nullable().optional(),
+  reset_usage: import_zod37.z.boolean().optional(),
+  create_default_provider: import_zod37.z.boolean().optional(),
+  default_provider_slug: nonEmptyString.optional()
+}).strict();
+var GatewayWorkspaceCreateRequestSchema = import_zod37.z.object({
+  name: nonEmptyString,
+  scope_name: nonEmptyString,
+  description: import_zod37.z.string().optional(),
+  icon: import_zod37.z.string().optional(),
+  defaults: GatewayDefaultsInputSchema.optional(),
+  users: import_zod37.z.array(nonEmptyString).optional(),
+  usage_limits: import_zod37.z.array(GatewayUsageLimitInputSchema).optional(),
+  rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).optional()
+}).strict();
+var GatewayWorkspaceUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    description: import_zod37.z.string().optional(),
+    icon: import_zod37.z.string().optional(),
+    defaults: GatewayDefaultsInputSchema.optional(),
+    usage_limits: import_zod37.z.array(GatewayUsageLimitInputSchema).optional(),
+    rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).optional()
+  }).strict()
+);
+var GatewayConfigCreateRequestSchema = import_zod37.z.object({
+  name: nonEmptyString,
+  workspace_id: uuid,
+  config: GatewayRoutingConfigSchema
+}).strict();
+var GatewayConfigUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    workspace_id: uuid.optional(),
+    config: GatewayRoutingConfigSchema.optional(),
+    status: nonEmptyString.optional()
+  }).strict()
+);
+var GatewayGuardrailCheckSchema = import_zod37.z.object({
+  id: nonEmptyString,
+  parameters: GatewayJsonObjectSchema.optional(),
+  is_enabled: import_zod37.z.boolean().optional(),
+  name: nonEmptyString.optional()
+}).strict();
+var feedbackSchema = import_zod37.z.object({
+  value: import_zod37.z.number(),
+  weight: import_zod37.z.number(),
+  metadata: import_zod37.z.string()
+}).catchall(GatewayJsonValueSchema);
+var actionResultSchema = import_zod37.z.object({ feedback: feedbackSchema.optional() }).catchall(GatewayJsonValueSchema);
+var GatewayGuardrailActionsSchema = nonEmptyObject(
+  import_zod37.z.object({
+    deny: import_zod37.z.boolean().optional(),
+    async: import_zod37.z.boolean().optional(),
+    on_success: actionResultSchema.optional(),
+    on_fail: actionResultSchema.optional()
+  }).catchall(GatewayJsonValueSchema)
+);
+var GatewayGuardrailCreateRequestSchema = import_zod37.z.object({
+  workspace_id: uuid,
+  name: nonEmptyString,
+  checks: import_zod37.z.array(GatewayGuardrailCheckSchema).min(1),
+  actions: GatewayGuardrailActionsSchema
+}).strict();
+var GatewayGuardrailUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    checks: import_zod37.z.array(GatewayGuardrailCheckSchema).min(1).optional(),
+    actions: GatewayGuardrailActionsSchema.optional()
+  }).strict()
+);
+var GatewayProviderCreateRequestSchema = import_zod37.z.object({
+  workspace_id: uuid,
+  ai_provider_id: uuid,
+  name: nonEmptyString,
+  integration_id: uuid,
+  slug: nonEmptyString,
+  note: import_zod37.z.string().nullable().optional(),
+  usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+  rate_limits: GatewayRateLimitInputSchema.nullable().optional(),
+  expires_at: dateTime.nullable().optional()
+}).strict();
+var GatewayProviderUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    note: import_zod37.z.string().nullable().optional(),
+    usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+    rate_limits: GatewayRateLimitInputSchema.nullable().optional(),
+    expires_at: dateTime.nullable().optional(),
+    reset_usage: import_zod37.z.boolean().optional()
+  }).strict()
+);
+var GatewayApiKeyRotationPolicySchema = nonEmptyObject(
+  import_zod37.z.object({
+    rotation_period: import_zod37.z.enum(["monthly", "weekly"]).nullable().optional(),
+    next_rotation_at: dateTime.nullable().optional(),
+    key_transition_period_ms: import_zod37.z.number().int().min(18e5).optional()
+  }).strict()
+).refine(
+  (value2) => value2.rotation_period == null || value2.next_rotation_at == null,
+  "rotation_period and next_rotation_at are mutually exclusive"
+);
+var apiKeyMutableFields = {
+  name: nonEmptyString,
+  description: import_zod37.z.string().optional(),
+  scopes: import_zod37.z.array(GatewayApiKeyScopeSchema).min(1),
+  rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).nullable().optional(),
+  usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+  defaults: GatewayDefaultsInputSchema.nullable().optional(),
+  alert_emails: import_zod37.z.array(import_zod37.z.string().email()).optional(),
+  expires_at: dateTime.nullable().optional(),
+  rotation_policy: GatewayApiKeyRotationPolicySchema.nullable().optional()
+};
+var serviceApiKeyCreateFields = {
+  ...apiKeyMutableFields,
+  organisation_id: numericId,
+  workspace_id: uuid,
+  type: nonEmptyString
+};
+var GatewayServiceApiKeyCreateRequestSchema = import_zod37.z.object(serviceApiKeyCreateFields).strict();
+var GatewayUserApiKeyCreateRequestSchema = import_zod37.z.object({ ...serviceApiKeyCreateFields, user_id: uuid }).strict();
+var GatewayApiKeyCreateRequestSchema = import_zod37.z.union([
+  GatewayUserApiKeyCreateRequestSchema,
+  GatewayServiceApiKeyCreateRequestSchema
+]);
+var GatewayApiKeyUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    description: import_zod37.z.string().optional(),
+    scopes: import_zod37.z.array(GatewayApiKeyScopeSchema).min(1).optional(),
+    rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).nullable().optional(),
+    usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+    reset_usage: import_zod37.z.boolean().optional(),
+    defaults: GatewayDefaultsInputSchema.nullable().optional(),
+    alert_emails: import_zod37.z.array(import_zod37.z.string().email()).optional(),
+    expires_at: dateTime.nullable().optional(),
+    rotation_policy: GatewayApiKeyRotationPolicySchema.nullable().optional()
+  }).strict()
+);
+var GatewayApiKeyRotateRequestSchema = import_zod37.z.object({ key_transition_period_ms: import_zod37.z.number().int().min(18e5).optional() }).strict();
+var GatewayIntegrationCreateRequestSchema = import_zod37.z.object({
+  organisation_id: numericId,
+  ai_provider_id: uuid,
+  name: nonEmptyString,
+  slug: nonEmptyString,
+  description: import_zod37.z.string().optional(),
+  configurations: GatewayJsonObjectSchema.optional(),
+  key: nonEmptyString.optional(),
+  secret_mappings: import_zod37.z.array(GatewaySecretMappingSchema).optional()
+}).strict();
+var GatewayIntegrationUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    description: import_zod37.z.string().optional(),
+    configurations: GatewayJsonObjectSchema.optional(),
+    key: nonEmptyString.optional(),
+    secret_mappings: import_zod37.z.array(GatewaySecretMappingSchema).optional()
+  }).strict()
+);
+var GatewayIntegrationModelUpdateSchema = import_zod37.z.object({
+  slug: nonEmptyString,
+  enabled: import_zod37.z.boolean(),
+  is_custom: import_zod37.z.boolean().nullable().optional(),
+  is_finetune: import_zod37.z.boolean().nullable().optional(),
+  base_model_slug: nonEmptyString.nullable().optional(),
+  configurations: GatewayJsonObjectSchema.optional(),
+  pricing_config: GatewayJsonObjectSchema.optional()
+}).strict();
+var GatewayIntegrationModelsBulkUpdateRequestSchema = import_zod37.z.object({
+  models: import_zod37.z.array(GatewayIntegrationModelUpdateSchema).min(1),
+  allow_all_models: import_zod37.z.boolean().optional()
+}).strict();
+var GatewayIntegrationWorkspacesBulkUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    workspaces: import_zod37.z.array(GatewayWorkspaceBindingSchema).optional(),
+    global_workspace_access: GatewayGlobalWorkspaceAccessInputSchema.optional(),
+    override_existing_workspace_access: import_zod37.z.boolean().optional(),
+    create_default_provider: import_zod37.z.boolean().optional(),
+    default_provider_slug: nonEmptyString.optional()
+  }).strict()
+);
+var McpIntegrationCreateRequestSchema = import_zod37.z.object({
+  name: nonEmptyString,
+  organisation_id: numericId,
+  slug: nonEmptyString,
+  url: import_zod37.z.string().url(),
+  auth_type: GatewayMcpAuthTypeSchema,
+  transport: GatewayMcpTransportSchema,
+  description: import_zod37.z.string().nullable().optional(),
+  configurations: GatewayJsonObjectSchema.optional(),
+  secret_mappings: import_zod37.z.array(GatewaySecretMappingSchema).optional()
+}).strict();
+var McpIntegrationUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    description: import_zod37.z.string().nullable().optional(),
+    configurations: GatewayJsonObjectSchema.optional(),
+    url: import_zod37.z.string().url().optional(),
+    auth_type: GatewayMcpAuthTypeSchema.optional(),
+    transport: GatewayMcpTransportSchema.optional(),
+    secret_mappings: import_zod37.z.array(GatewaySecretMappingSchema).optional()
+  }).strict()
+);
+var McpIntegrationCapabilityUpdateSchema = import_zod37.z.object({
+  name: nonEmptyString,
+  type: GatewayMutableMcpCapabilityTypeSchema,
+  enabled: import_zod37.z.boolean()
+}).strict();
+var McpIntegrationCapabilitiesBulkUpdateRequestSchema = import_zod37.z.object({ capabilities: import_zod37.z.array(McpIntegrationCapabilityUpdateSchema).min(1) }).strict();
+var McpIntegrationWorkspacesBulkUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    workspaces: import_zod37.z.array(import_zod37.z.object({ id: workspaceRef, enabled: import_zod37.z.boolean() }).strict()).optional(),
+    global_workspace_access: import_zod37.z.object({ enabled: import_zod37.z.boolean() }).strict().nullable().optional(),
+    override_existing_workspace_access: import_zod37.z.boolean().optional()
+  }).strict()
+);
+var GatewayDeploymentAuthSettingsInputSchema = import_zod37.z.object({
+  gateway_base_url: import_zod37.z.string().url().optional(),
+  mcp_gateway_base_url: import_zod37.z.string().url().optional(),
+  is_dataservice_hosted: import_zod37.z.union([import_zod37.z.literal(0), import_zod37.z.literal(1)]).optional(),
+  is_playground_proxy_allowed: import_zod37.z.union([import_zod37.z.literal(0), import_zod37.z.literal(1)]).optional(),
+  workspaces_allowed: import_zod37.z.array(workspaceRef).optional(),
+  jwt_subs_allowed: import_zod37.z.array(nonEmptyString).optional(),
+  jwt_sub_workspace_mapping: import_zod37.z.record(workspaceRef).optional(),
+  allow_all_workspaces: import_zod37.z.boolean().optional(),
+  remove_workspaces_allowed: import_zod37.z.array(workspaceRef).optional(),
+  remove_subs_allowed: import_zod37.z.array(nonEmptyString).optional()
+}).strict();
+var GatewayDeploymentCreateRequestSchema = import_zod37.z.object({
+  name: nonEmptyString,
+  type: GatewayDeploymentTypeSchema,
+  organisation_id: numericId,
+  auth_settings: GatewayDeploymentAuthSettingsInputSchema.optional(),
+  deployment_config: GatewayJsonObjectSchema.optional(),
+  is_default: import_zod37.z.boolean().optional(),
+  slug: nonEmptyString.optional()
+}).strict();
+var GatewayDeploymentUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    type: GatewayDeploymentTypeSchema.optional(),
+    status: GatewayDeploymentStatusSchema.optional(),
+    deployment_config: GatewayJsonObjectSchema.nullable().optional(),
+    is_default: import_zod37.z.boolean().optional(),
+    rotate_auth: import_zod37.z.boolean().optional(),
+    override_existing: import_zod37.z.boolean().optional(),
+    auth_settings: GatewayDeploymentAuthSettingsInputSchema.optional()
+  }).strict()
+);
+var GatewayPluginCreateRequestSchema = import_zod37.z.object({
+  organisation_id: numericId,
+  integration_id: uuid,
+  credentials: import_zod37.z.record(import_zod37.z.string().min(1)).refine((value2) => Object.keys(value2).length > 0)
+}).strict();
+var GatewayOrganisationUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({ name: nonEmptyString.optional() }).catchall(GatewayJsonValueSchema)
+);
+var GatewayOrganisationAuthSettingsUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    auth_settings: GatewayJsonObjectSchema.optional(),
+    domains: import_zod37.z.array(nonEmptyString).optional(),
+    scim_token: nonEmptyString.optional()
+  }).catchall(GatewayJsonValueSchema)
+);
+
 // src/http/auth/oauth.ts
 var OAuthAuth = class {
   constructor(oauthClient) {
@@ -5340,12 +6146,12 @@ var OAuthAuth = class {
 };
 
 // src/models/oauth-token.ts
-var import_zod36 = require("zod");
-var OAuthTokenResponseSchema = import_zod36.z.object({
-  access_token: import_zod36.z.string(),
-  token_type: import_zod36.z.string().optional(),
-  expires_in: import_zod36.z.number(),
-  scope: import_zod36.z.string().optional()
+var import_zod38 = require("zod");
+var OAuthTokenResponseSchema = import_zod38.z.object({
+  access_token: import_zod38.z.string(),
+  token_type: import_zod38.z.string().optional(),
+  expires_in: import_zod38.z.number(),
+  scope: import_zod38.z.string().optional()
 }).passthrough();
 
 // src/management/oauth-client.ts
@@ -5563,26 +6369,26 @@ function resolveOAuthConfig(opts) {
 }
 
 // src/validators.ts
-function assertUuid(value, fieldName) {
-  if (!isValidUuid(value)) {
+function assertUuid(value2, fieldName) {
+  if (!isValidUuid(value2)) {
     throw new AISecSDKException(
-      `Invalid ${fieldName}: ${value}`,
+      `Invalid ${fieldName}: ${value2}`,
       "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
     );
   }
 }
-function assertWorkspaceRef(value, fieldName) {
-  if (!isValidUuid(value) && !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value)) {
+function assertWorkspaceRef(value2, fieldName) {
+  if (!isValidUuid(value2) && !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value2)) {
     throw new AISecSDKException(
-      `Invalid ${fieldName}: ${value} (expected a workspace UUID or slug)`,
+      `Invalid ${fieldName}: ${value2} (expected a workspace UUID or slug)`,
       "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
     );
   }
 }
-function assertNumericId(value, fieldName) {
-  if (!/^\d+$/.test(value)) {
+function assertNumericId(value2, fieldName) {
+  if (!/^\d+$/.test(value2)) {
     throw new AISecSDKException(
-      `Invalid ${fieldName}: ${value}`,
+      `Invalid ${fieldName}: ${value2}`,
       "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
     );
   }
@@ -6451,7 +7257,7 @@ var ScanLogsClient = class {
 };
 
 // src/management/oauth-management.ts
-var import_zod37 = require("zod");
+var import_zod39 = require("zod");
 var OAuthManagementClient = class {
   baseUrl;
   auth;
@@ -6485,7 +7291,7 @@ var OAuthManagementClient = class {
       path: MGMT_OAUTH_INVALIDATE_PATH,
       params: { token },
       body,
-      responseSchema: import_zod37.z.string(),
+      responseSchema: import_zod39.z.string(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7549,12 +8355,12 @@ var ModelSecurityScansClient = class {
    * // { uuid: '550e8400-...', eval_outcome: 'ALLOWED', model_uri: 'hf://org/model', ... }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "scan uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "scan uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SCANS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SCANS_PATH}/${uuid2}`,
       responseSchema: ScanBaseResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7791,12 +8597,12 @@ var ModelSecurityScansClient = class {
    * // { uuid: '660e8400-...', rule_name: 'Pickle Scan', result: 'FAILED', violation_count: 2, ... }
    * ```
    */
-  async getEvaluation(uuid) {
-    assertUuid(uuid, "evaluation uuid");
+  async getEvaluation(uuid2) {
+    assertUuid(uuid2, "evaluation uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_EVALUATIONS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_EVALUATIONS_PATH}/${uuid2}`,
       responseSchema: RuleEvaluationResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7816,12 +8622,12 @@ var ModelSecurityScansClient = class {
    * // { uuid: '660e8400-...', rule_name: 'Pickle Scan', description: 'Unsafe pickle opcode', ... }
    * ```
    */
-  async getViolation(uuid) {
-    assertUuid(uuid, "violation uuid");
+  async getViolation(uuid2) {
+    assertUuid(uuid2, "violation uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_VIOLATIONS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_VIOLATIONS_PATH}/${uuid2}`,
       responseSchema: ViolationResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7934,12 +8740,12 @@ var ModelSecurityGroupsClient = class {
    * // { uuid: '550e8400-...', name: 'hf-strict', source_type: 'HUGGING_FACE', state: 'ACTIVE', ... }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "security group uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "security group uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid2}`,
       responseSchema: ModelSecurityGroupResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7963,12 +8769,12 @@ var ModelSecurityGroupsClient = class {
    * // { uuid: '550e8400-...', name: 'hf-strict-v2', state: 'ACTIVE', ... }
    * ```
    */
-  async update(uuid, body) {
-    assertUuid(uuid, "security group uuid");
+  async update(uuid2, body) {
+    assertUuid(uuid2, "security group uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid2}`,
       body,
       responseSchema: ModelSecurityGroupResponseSchema,
       auth: this.auth,
@@ -7988,12 +8794,12 @@ var ModelSecurityGroupsClient = class {
    * // resolves to undefined on success
    * ```
    */
-  async delete(uuid) {
-    assertUuid(uuid, "security group uuid");
+  async delete(uuid2) {
+    assertUuid(uuid2, "security group uuid");
     await request({
       method: "DELETE",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid2}`,
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8156,12 +8962,12 @@ var ModelSecurityRulesClient = class {
    * // { uuid: '550e8400-...', name: 'Pickle Scan', rule_type: 'ARTIFACT', default_state: 'BLOCKING', ... }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "security rule uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "security rule uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_RULES_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_RULES_PATH}/${uuid2}`,
       responseSchema: ModelSecurityRuleResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8242,12 +9048,12 @@ var ModelSecurityModelsClient = class {
    * // { uuid: '550e8400-...', name: 'org/model', latest_version_uuid: '660e8400-...', latest_version_outcome: 'PASSED' }
    * ```
    */
-  async getModel(uuid) {
-    assertUuid(uuid, "model uuid");
+  async getModel(uuid2) {
+    assertUuid(uuid2, "model uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_MODELS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_MODELS_PATH}/${uuid2}`,
       responseSchema: ModelResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8305,12 +9111,12 @@ var ModelSecurityModelsClient = class {
    * // { uuid: '660e8400-...', revision: 'main', model_uuid: '550e8400-...', last_eval_outcome: 'PASSED' }
    * ```
    */
-  async getModelVersion(uuid) {
-    assertUuid(uuid, "model version uuid");
+  async getModelVersion(uuid2) {
+    assertUuid(uuid2, "model version uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${uuid2}`,
       responseSchema: ModelVersionResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8423,7 +9229,7 @@ var ModelSecurityClient = class {
 };
 
 // src/red-team/scans-client.ts
-var import_zod38 = require("zod");
+var import_zod40 = require("zod");
 var RedTeamScansClient = class {
   baseUrl;
   auth;
@@ -8567,7 +9373,7 @@ var RedTeamScansClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: RED_TEAM_CATEGORIES_PATH,
-      responseSchema: import_zod38.z.array(CategoryModelSchema),
+      responseSchema: import_zod40.z.array(CategoryModelSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8575,7 +9381,7 @@ var RedTeamScansClient = class {
 };
 
 // src/red-team/reports-client.ts
-var import_zod39 = require("zod");
+var import_zod41 = require("zod");
 var RedTeamReportsClient = class {
   baseUrl;
   auth;
@@ -8950,7 +9756,7 @@ var RedTeamReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/download`,
       params: { file_format: format },
-      responseSchema: import_zod39.z.unknown(),
+      responseSchema: import_zod41.z.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8974,7 +9780,7 @@ var RedTeamReportsClient = class {
       method: "POST",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/generate-partial-report`,
-      responseSchema: import_zod39.z.unknown(),
+      responseSchema: import_zod41.z.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8982,7 +9788,7 @@ var RedTeamReportsClient = class {
 };
 
 // src/red-team/custom-attack-reports-client.ts
-var import_zod40 = require("zod");
+var import_zod42 = require("zod");
 var RedTeamCustomAttackReportsClient = class {
   baseUrl;
   auth;
@@ -9072,7 +9878,7 @@ var RedTeamCustomAttackReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/report/${jobId}/prompt-set/${promptSetId}/prompts`,
       params,
-      responseSchema: import_zod40.z.array(PromptDetailResponseSchema),
+      responseSchema: import_zod42.z.array(PromptDetailResponseSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9166,7 +9972,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/attack/${attackId}/list-outputs`,
-      responseSchema: import_zod40.z.array(CustomAttackOutputSchema),
+      responseSchema: import_zod42.z.array(CustomAttackOutputSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9191,7 +9997,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/property-stats`,
-      responseSchema: import_zod40.z.array(PropertyStatisticSchema),
+      responseSchema: import_zod42.z.array(PropertyStatisticSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9199,7 +10005,7 @@ var RedTeamCustomAttackReportsClient = class {
 };
 
 // src/red-team/targets-client.ts
-var import_zod41 = require("zod");
+var import_zod43 = require("zod");
 var RedTeamTargetsClient = class {
   baseUrl;
   auth;
@@ -9313,12 +10119,12 @@ var RedTeamTargetsClient = class {
    * // { uuid: '550e8400-...', name: 'prod-chatbot', status: 'READY', active: true, validated: true }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "target uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}`,
       responseSchema: TargetResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -9344,14 +10150,14 @@ var RedTeamTargetsClient = class {
    * // { uuid: '550e8400-...', name: 'prod-chatbot-v2', status: 'READY', updated_at: '2026-03-08T10:00:00Z' }
    * ```
    */
-  async update(uuid, body, opts) {
-    assertUuid(uuid, "target uuid");
+  async update(uuid2, body, opts) {
+    assertUuid(uuid2, "target uuid");
     const params = {};
     if (opts?.validate !== void 0) params.validate = String(opts.validate);
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}`,
       body,
       params: Object.keys(params).length > 0 ? params : void 0,
       responseSchema: TargetResponseSchema,
@@ -9373,12 +10179,12 @@ var RedTeamTargetsClient = class {
    * // { message: 'ok', status: 200 }
    * ```
    */
-  async delete(uuid) {
-    assertUuid(uuid, "target uuid");
+  async delete(uuid2) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "DELETE",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}`,
       responseSchema: BaseResponseSchema.optional(),
       allowEmptyBody: true,
       auth: this.auth,
@@ -9428,12 +10234,12 @@ var RedTeamTargetsClient = class {
    * // { target_id: '550e8400-...', target_version: 1, status: 'READY' }
    * ```
    */
-  async getProfile(uuid) {
-    assertUuid(uuid, "target uuid");
+  async getProfile(uuid2) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}/profile`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}/profile`,
       responseSchema: TargetProfileResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -9457,12 +10263,12 @@ var RedTeamTargetsClient = class {
    * // { uuid: '550e8400-...', name: 'prod-chatbot', status: 'READY' }
    * ```
    */
-  async updateProfile(uuid, body) {
-    assertUuid(uuid, "target uuid");
+  async updateProfile(uuid2, body) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}/profile`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}/profile`,
       body,
       responseSchema: TargetResponseSchema,
       auth: this.auth,
@@ -9515,7 +10321,7 @@ var RedTeamTargetsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_TEMPLATE_PATH}/target-metadata`,
-      responseSchema: import_zod41.z.record(import_zod41.z.unknown()),
+      responseSchema: import_zod43.z.record(import_zod43.z.unknown()),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9636,12 +10442,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks', status: 'READY', active: true, archive: false }
    * ```
    */
-  async getPromptSet(uuid) {
-    assertUuid(uuid, "prompt set uuid");
+  async getPromptSet(uuid2) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}`,
       responseSchema: CustomPromptSetResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -9664,12 +10470,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks-v2', status: 'READY', active: true }
    * ```
    */
-  async updatePromptSet(uuid, body) {
-    assertUuid(uuid, "prompt set uuid");
+  async updatePromptSet(uuid2, body) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}`,
       body,
       responseSchema: CustomPromptSetResponseSchema,
       auth: this.auth,
@@ -9693,12 +10499,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks', status: 'READY', archive: true }
    * ```
    */
-  async archivePromptSet(uuid, body) {
-    assertUuid(uuid, "prompt set uuid");
+  async archivePromptSet(uuid2, body) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}/archive`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}/archive`,
       body,
       responseSchema: CustomPromptSetResponseSchema,
       auth: this.auth,
@@ -9719,12 +10525,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks', status: 'READY', active: true, tsg_id: 'tsg-1' }
    * ```
    */
-  async getPromptSetReference(uuid) {
-    assertUuid(uuid, "prompt set uuid");
+  async getPromptSetReference(uuid2) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}/reference`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}/reference`,
       responseSchema: CustomPromptSetReferenceSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -9745,14 +10551,14 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', status: 'READY', is_latest: true, version: 'gen-12345' }
    * ```
    */
-  async getPromptSetVersionInfo(uuid, opts) {
-    assertUuid(uuid, "prompt set uuid");
+  async getPromptSetVersionInfo(uuid2, opts) {
+    assertUuid(uuid2, "prompt set uuid");
     const params = {};
     if (opts?.version !== void 0) params.version = opts.version;
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}/version-info`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}/version-info`,
       params: Object.keys(params).length > 0 ? params : void 0,
       responseSchema: CustomPromptSetVersionInfoSchema,
       auth: this.auth,
@@ -9800,10 +10606,10 @@ var RedTeamCustomAttacksClient = class {
    * // 'prompt,goal,category,severity\n'
    * ```
    */
-  async downloadTemplate(uuid) {
-    assertUuid(uuid, "prompt set uuid");
+  async downloadTemplate(uuid2) {
+    assertUuid(uuid2, "prompt set uuid");
     const url = new URL(
-      `${this.baseUrl.replace(/\/+$/, "")}${RED_TEAM_CUSTOM_ATTACK_PATH}/download-template/${uuid}`
+      `${this.baseUrl.replace(/\/+$/, "")}${RED_TEAM_CUSTOM_ATTACK_PATH}/download-template/${uuid2}`
     );
     const stub = {
       method: "GET",
@@ -10704,12 +11510,12 @@ var RedTeamAdaptersClient = class {
    * // adapter.status => 'ACTIVE'
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "adapter uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "adapter uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid2}`,
       responseSchema: AdapterResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -10737,13 +11543,13 @@ var RedTeamAdaptersClient = class {
    * });
    * ```
    */
-  async update(uuid, body, opts) {
-    assertUuid(uuid, "adapter uuid");
+  async update(uuid2, body, opts) {
+    assertUuid(uuid2, "adapter uuid");
     const validate = opts?.validate ?? true;
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid2}`,
       params: { validate: String(validate) },
       body,
       responseSchema: AdapterResponseSchema,
@@ -10759,12 +11565,12 @@ var RedTeamAdaptersClient = class {
    * await rt.adapters.delete('550e8400-e29b-41d4-a716-446655440000');
    * ```
    */
-  async delete(uuid) {
-    assertUuid(uuid, "adapter uuid");
+  async delete(uuid2) {
+    assertUuid(uuid2, "adapter uuid");
     return request({
       method: "DELETE",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid2}`,
       responseSchema: BaseResponseSchema.optional(),
       allowEmptyBody: true,
       auth: this.auth,
@@ -11633,12 +12439,12 @@ var AIGatewayWorkspacesClient = class {
    * const other = await gw.workspaces.get('ws-produc-985697', { plane: 'admin' });
    * ```
    */
-  async get(workspaceRef, options = {}) {
-    assertWorkspaceRef(workspaceRef, "workspaceRef");
+  async get(workspaceRef2, options = {}) {
+    assertWorkspaceRef(workspaceRef2, "workspaceRef");
     return request({
       method: "GET",
       baseUrl: this.urlFor(options.plane),
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef2}`,
       responseSchema: GatewayWorkspaceDetailSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11667,17 +12473,12 @@ var AIGatewayWorkspacesClient = class {
    * ```
    */
   async create(body) {
-    if (!body.name) {
-      throw new AISecSDKException("Missing name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
-    }
-    if (!body.scope_name) {
-      throw new AISecSDKException("Missing scope_name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
-    }
     return request({
       method: "POST",
       baseUrl: this.adminBaseUrl,
       path: AI_GW_WORKSPACES_PATH,
       body,
+      requestSchema: GatewayWorkspaceCreateRequestSchema,
       responseSchema: GatewayWorkspaceCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11702,19 +12503,14 @@ var AIGatewayWorkspacesClient = class {
    * });
    * ```
    */
-  async update(workspaceRef, body) {
-    assertWorkspaceRef(workspaceRef, "workspaceRef");
-    if (Object.keys(body).length === 0) {
-      throw new AISecSDKException(
-        "Empty update: provide at least one of name, description, icon, defaults, usage_limits, rate_limits",
-        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
-      );
-    }
+  async update(workspaceRef2, body) {
+    assertWorkspaceRef(workspaceRef2, "workspaceRef");
     return request({
       method: "PUT",
       baseUrl: this.adminBaseUrl,
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef2}`,
       body,
+      requestSchema: GatewayWorkspaceUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11745,12 +12541,12 @@ var AIGatewayWorkspacesClient = class {
    * const gone = await gw.workspaces.list({ plane: 'admin', status: 'archived' });
    * ```
    */
-  async delete(workspaceRef) {
-    assertWorkspaceRef(workspaceRef, "workspaceRef");
+  async delete(workspaceRef2) {
+    assertWorkspaceRef(workspaceRef2, "workspaceRef");
     return request({
       method: "DELETE",
       baseUrl: this.adminBaseUrl,
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef2}`,
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -11823,6 +12619,29 @@ var AIGatewayConfigsClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * List the immutable version history for one config. Verified live 2026-08-29.
+   * @param configId - Config UUID.
+   * @returns Config versions, including version ownership and creation timestamps.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const versions = await gw.configs.listVersions('764cf9cd-4ebf-449e-b669-08149b0fbbbc');
+   * console.log(versions.data[0].version_id);
+   * ```
+   */
+  async listVersions(configId) {
+    assertUuid(configId, "configId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_CONFIGS_PATH}/${configId}/versions`,
+      responseSchema: ListConfigVersionsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Create a config.
    *
@@ -11853,6 +12672,7 @@ var AIGatewayConfigsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_CONFIGS_PATH,
       body,
+      requestSchema: GatewayConfigCreateRequestSchema,
       responseSchema: GatewayConfigCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11861,7 +12681,7 @@ var AIGatewayConfigsClient = class {
   /**
    * Update a config.
    * @param configId - Config UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update. A supplied `config` replaces the routing document.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -11877,12 +12697,12 @@ var AIGatewayConfigsClient = class {
    */
   async update(configId, body) {
     assertUuid(configId, "configId");
-    assertUuid(body.workspace_id, "workspace_id");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
       path: `${AI_GW_CONFIGS_PATH}/${configId}`,
       body,
+      requestSchema: GatewayConfigUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12010,11 +12830,39 @@ var AIGatewayGuardrailsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_GUARDRAILS_PATH,
       body,
+      requestSchema: GatewayGuardrailCreateRequestSchema,
       responseSchema: GatewayGuardrailCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /**
+   * Update a guardrail. Verified live 2026-08-29.
+   * @param guardrailId - Guardrail UUID.
+   * @param body - Fields to update.
+   * @returns The gateway write response.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * await gw.guardrails.update('9f6c2a8e-2b3d-4e5f-8a9b-0c1d2e3f4a5b', {
+   *   name: 'Updated guardrail',
+   * });
+   * ```
+   */
+  async update(guardrailId, body) {
+    assertUuid(guardrailId, "guardrailId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_GUARDRAILS_PATH}/${guardrailId}`,
+      body,
+      requestSchema: GatewayGuardrailUpdateRequestSchema,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Delete a guardrail.
    *
@@ -12081,6 +12929,34 @@ var AIGatewayProvidersClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * Fetch one provider binding. Verified live 2026-08-29.
+   *
+   * @remarks The response can contain provider credential material. Do not log or persist it,
+   * and avoid logging the complete returned object. SDK debug logs redact the known credential
+   * fields for this operation.
+   * @param providerId - Provider UUID.
+   * @returns Provider configuration and lifecycle detail.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const provider = await gw.providers.get('f6692544-3265-49be-9711-bbdcebc079e4');
+   * console.log(provider.name);
+   * ```
+   */
+  async get(providerId) {
+    assertUuid(providerId, "providerId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_PROVIDERS_PATH}/${providerId}`,
+      secretOperation: "providers.get",
+      responseSchema: GatewayProviderDetailSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Create a provider.
    *
@@ -12116,11 +12992,40 @@ var AIGatewayProvidersClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_PROVIDERS_PATH,
       body,
+      requestSchema: GatewayProviderCreateRequestSchema,
       responseSchema: GatewayProviderCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /**
+   * Update a provider binding. Verified live 2026-08-29.
+   * @param providerId - Provider UUID.
+   * @param body - Fields to update.
+   * @returns The gateway write response.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * await gw.providers.update('f6692544-3265-49be-9711-bbdcebc079e4', {
+   *   name: 'Vertex production',
+   *   note: 'Updated by automation',
+   * });
+   * ```
+   */
+  async update(providerId, body) {
+    assertUuid(providerId, "providerId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_PROVIDERS_PATH}/${providerId}`,
+      body,
+      requestSchema: GatewayProviderUpdateRequestSchema,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Delete a provider.
    *
@@ -12176,13 +13081,14 @@ var AIGatewayApiKeysClient = class {
     });
   }
   /** @internal */
-  writeAt(method, path, body) {
-    assertUuid(body.workspace_id, "workspace_id");
+  writeAt(method, path, body, requestSchema, secretOperation) {
     return request({
       method,
       baseUrl: this.baseUrl,
       path,
       body,
+      requestSchema,
+      secretOperation,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12220,6 +13126,65 @@ var AIGatewayApiKeysClient = class {
   async listUser(opts) {
     return this.listAt(AI_GW_API_KEYS_USER_PATH, opts);
   }
+  getAt(path, keyId) {
+    assertUuid(keyId, "keyId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${path}/${keyId}`,
+      responseSchema: GatewayApiKeySchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  async deleteAt(path, keyId) {
+    assertUuid(keyId, "keyId");
+    await request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${path}/${keyId}`,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  rotateAt(path, keyId, body, secretOperation) {
+    assertUuid(keyId, "keyId");
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: `${path}/${keyId}/rotate`,
+      body,
+      requestSchema: GatewayApiKeyRotateRequestSchema,
+      secretOperation,
+      responseSchema: GatewayApiKeyRotateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /** Get a service key. @example `await gw.apiKeys.getService(keyId);` */
+  async getService(keyId) {
+    return this.getAt(AI_GW_API_KEYS_SERVICE_PATH, keyId);
+  }
+  /** Get a user key. @example `await gw.apiKeys.getUser(keyId);` */
+  async getUser(keyId) {
+    return this.getAt(AI_GW_API_KEYS_USER_PATH, keyId);
+  }
+  /** Permanently delete a service key. @example `await gw.apiKeys.deleteService(keyId);` */
+  async deleteService(keyId) {
+    return this.deleteAt(AI_GW_API_KEYS_SERVICE_PATH, keyId);
+  }
+  /** Permanently delete a user key. @example `await gw.apiKeys.deleteUser(keyId);` */
+  async deleteUser(keyId) {
+    return this.deleteAt(AI_GW_API_KEYS_USER_PATH, keyId);
+  }
+  /** Rotate a service key; capture the returned secret. @example `const rotated = await gw.apiKeys.rotateService(keyId);` */
+  async rotateService(keyId, body = {}) {
+    return this.rotateAt(AI_GW_API_KEYS_SERVICE_PATH, keyId, body, "apiKeys.rotateService");
+  }
+  /** Rotate a user key; capture the returned secret. @example `const rotated = await gw.apiKeys.rotateUser(keyId);` */
+  async rotateUser(keyId, body = {}) {
+    return this.rotateAt(AI_GW_API_KEYS_USER_PATH, keyId, body, "apiKeys.rotateUser");
+  }
   /**
    * Create a service API key.
    * @param body - Name, scopes, TSG, workspace UUID, and type.
@@ -12239,7 +13204,13 @@ var AIGatewayApiKeysClient = class {
    * ```
    */
   async createService(body) {
-    return this.writeAt("POST", AI_GW_API_KEYS_SERVICE_PATH, body);
+    return this.writeAt(
+      "POST",
+      AI_GW_API_KEYS_SERVICE_PATH,
+      body,
+      GatewayServiceApiKeyCreateRequestSchema,
+      "apiKeys.createService"
+    );
   }
   /**
    * Create a user API key.
@@ -12261,12 +13232,18 @@ var AIGatewayApiKeysClient = class {
    * ```
    */
   async createUser(body) {
-    return this.writeAt("POST", AI_GW_API_KEYS_USER_PATH, body);
+    return this.writeAt(
+      "POST",
+      AI_GW_API_KEYS_USER_PATH,
+      body,
+      GatewayUserApiKeyCreateRequestSchema,
+      "apiKeys.createUser"
+    );
   }
   /**
    * Update a service API key.
    * @param keyId - Key UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12284,12 +13261,17 @@ var AIGatewayApiKeysClient = class {
    */
   async updateService(keyId, body) {
     assertUuid(keyId, "keyId");
-    return this.writeAt("PUT", `${AI_GW_API_KEYS_SERVICE_PATH}/${keyId}`, body);
+    return this.writeAt(
+      "PUT",
+      `${AI_GW_API_KEYS_SERVICE_PATH}/${keyId}`,
+      body,
+      GatewayApiKeyUpdateRequestSchema
+    );
   }
   /**
    * Update a user API key.
    * @param keyId - Key UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12308,7 +13290,12 @@ var AIGatewayApiKeysClient = class {
    */
   async updateUser(keyId, body) {
     assertUuid(keyId, "keyId");
-    return this.writeAt("PUT", `${AI_GW_API_KEYS_USER_PATH}/${keyId}`, body);
+    return this.writeAt(
+      "PUT",
+      `${AI_GW_API_KEYS_USER_PATH}/${keyId}`,
+      body,
+      GatewayApiKeyUpdateRequestSchema
+    );
   }
 };
 
@@ -12372,8 +13359,8 @@ var AIGatewayIntegrationsClient = class {
    * Create an integration.
    *
    * @remarks
-   * `body.key` (the provider API key) is a live secret. Setting `PANW_AI_SEC_DEBUG` will
-   * print it, unredacted, to the SDK's own debug log.
+   * `body.key` (the provider API key) is a live secret. SDK debug logs replace known
+   * credential fields with `[REDACTED]`, but callers must still avoid logging the input object.
    *
    * @param body - Provider id, name, slug, and provider-specific configuration.
    * @returns The raw create response. Shape unverified against a live tenant — see the PRD.
@@ -12398,6 +13385,8 @@ var AIGatewayIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_INTEGRATIONS_PATH,
       body,
+      requestSchema: GatewayIntegrationCreateRequestSchema,
+      secretOperation: "integrations.create",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12406,7 +13395,7 @@ var AIGatewayIntegrationsClient = class {
   /**
    * Update an integration.
    * @param integrationId - Integration UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12421,12 +13410,13 @@ var AIGatewayIntegrationsClient = class {
    */
   async update(integrationId, body) {
     assertUuid(integrationId, "integrationId");
-    if (body.ai_provider_id !== void 0) assertUuid(body.ai_provider_id, "ai_provider_id");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
       path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}`,
       body,
+      requestSchema: GatewayIntegrationUpdateRequestSchema,
+      secretOperation: "integrations.update",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12482,9 +13472,9 @@ var AIGatewayIntegrationsClient = class {
     });
   }
   /**
-   * Replace which models this integration exposes.
+   * Bulk-update model enablement for this integration.
    * @param integrationId - Integration UUID.
-   * @param body - Full model list; this is a replace, not a merge.
+   * @param body - One or more model entries to update; omission is not documented as deletion.
    * @returns The raw response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12503,6 +13493,7 @@ var AIGatewayIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}/models`,
       body,
+      requestSchema: GatewayIntegrationModelsBulkUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12514,7 +13505,7 @@ var AIGatewayIntegrationsClient = class {
    * @remarks
    * `global_workspace_access` is an **object** on this read, not a boolean, despite the
    * field name — `{ enabled, rate_limits, usage_limits }`. The corresponding write
-   * ({@link setWorkspaces}) DOES send a plain boolean; the two are not symmetric.
+   * ({@link setWorkspaces}) uses the same object shape.
    *
    * @param integrationId - Integration UUID.
    * @returns Bound workspaces plus the `global_workspace_access` object.
@@ -12539,9 +13530,9 @@ var AIGatewayIntegrationsClient = class {
     });
   }
   /**
-   * Replace which workspaces may use this integration.
+   * Bulk-update which workspaces may use this integration.
    * @param integrationId - Integration UUID.
-   * @param body - Workspace bindings or a global-access flag.
+   * @param body - Workspace bindings, global-access settings, or explicit override behavior.
    * @returns The raw response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12549,7 +13540,7 @@ var AIGatewayIntegrationsClient = class {
    * const gw = new AIGatewayClient();
    *
    * await gw.integrations.setWorkspaces('f6692544-3265-49be-9711-bbdcebc079e4', {
-   *   global_workspace_access: true,
+   *   global_workspace_access: { enabled: true },
    * });
    * ```
    */
@@ -12560,6 +13551,7 @@ var AIGatewayIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}/workspaces`,
       body,
+      requestSchema: GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12599,6 +13591,75 @@ var AIGatewayMcpIntegrationsClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * Fetch one MCP integration. Verified live 2026-08-29.
+   * @param mcpIntegrationId - MCP integration UUID.
+   * @returns Integration detail; unlike list rows, `configurations` is an object.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const integration = await gw.mcpIntegrations.get('2a6f4e2e-6f5a-4a1f-9d0e-9b2b6f6c3a11');
+   * console.log(integration.url);
+   * ```
+   */
+  async get(mcpIntegrationId) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}`,
+      responseSchema: McpIntegrationDetailSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List capabilities discovered from an MCP integration. Verified live 2026-08-29.
+   * @param mcpIntegrationId - MCP integration UUID.
+   * @returns Tools, prompts, resources, and resource templates with enablement counts.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const capabilities = await gw.mcpIntegrations.getCapabilities('2a6f4e2e-6f5a-4a1f-9d0e-9b2b6f6c3a11');
+   * console.log(capabilities.data.map((capability) => capability.name));
+   * ```
+   */
+  async getCapabilities(mcpIntegrationId) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/capabilities`,
+      responseSchema: McpIntegrationCapabilitiesResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Fetch metadata discovered from an MCP server. Verified live 2026-08-29.
+   * @param mcpIntegrationId - MCP integration UUID.
+   * @returns Server identity, protocol, capability flags, and sync state.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const metadata = await gw.mcpIntegrations.getMetadata('2a6f4e2e-6f5a-4a1f-9d0e-9b2b6f6c3a11');
+   * console.log(metadata.sync_status);
+   * ```
+   */
+  async getMetadata(mcpIntegrationId) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/metadata`,
+      responseSchema: McpIntegrationMetadataSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Register an MCP server.
    * @param body - Name, server URL, auth type, transport, and provider-specific configuration.
@@ -12624,23 +13685,68 @@ var AIGatewayMcpIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_MCP_INTEGRATIONS_PATH,
       body,
+      requestSchema: McpIntegrationCreateRequestSchema,
+      secretOperation: "mcpIntegrations.create",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /** Update an MCP integration. @example `await gw.mcpIntegrations.update(id, { name: 'Docs MCP' });` */
+  async update(mcpIntegrationId, body) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}`,
+      body,
+      requestSchema: McpIntegrationUpdateRequestSchema,
+      secretOperation: "mcpIntegrations.update",
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /** Permanently delete an MCP integration. @example `await gw.mcpIntegrations.delete(id);` */
+  async delete(mcpIntegrationId) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    await request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}`,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /** Bulk-update capability enablement values. @example `await gw.mcpIntegrations.setCapabilities(id, { capabilities: [{ name: 'lookup', type: 'tool', enabled: true }] });` */
+  async setCapabilities(mcpIntegrationId, body) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/capabilities`,
+      body,
+      requestSchema: McpIntegrationCapabilitiesBulkUpdateRequestSchema,
+      responseSchema: McpIntegrationCapabilitiesUpdateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
-   * Replace which workspaces may use this MCP integration.
+   * Bulk-update which workspaces may use this MCP integration.
    * @param mcpIntegrationId - MCP integration UUID.
-   * @param body - Workspace bindings or a global-access flag; this is a replace, not a merge.
-   * @returns The raw response. Shape unverified against a live tenant — see the PRD.
+   * @param body - Workspace bindings or global-access settings. Use the explicit override flag
+   * to request replacement behavior.
+   * @returns An empty object. Verified live 2026-08-30.
    * @example
    * ```ts
    * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
    * const gw = new AIGatewayClient();
    *
    * await gw.mcpIntegrations.setWorkspaces('f6692544-3265-49be-9711-bbdcebc079e4', {
-   *   global_workspace_access: true,
+   *   workspaces: [{ id: 'ws-development', enabled: true }],
+   *   global_workspace_access: { enabled: false },
+   *   override_existing_workspace_access: true,
    * });
    * ```
    */
@@ -12651,7 +13757,8 @@ var AIGatewayMcpIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/workspaces`,
       body,
-      responseSchema: GatewayWriteResponseSchema,
+      requestSchema: McpIntegrationWorkspacesBulkUpdateRequestSchema,
+      responseSchema: McpIntegrationWorkspacesUpdateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -12729,8 +13836,8 @@ var AIGatewayDeploymentsClient = class {
    *
    * This is the **only** time `credentials.password` and `client_auth` are readable; the
    * detail read masks them. Capture them here or they are unrecoverable. Never log them.
-   * Note that setting `PANW_AI_SEC_DEBUG` will print the raw request/response, including
-   * `credentials.password`, to the SDK's own debug log regardless of this warning.
+   * SDK debug logs redact returned one-time `client_auth` and registry passwords. Callers
+   * must still capture the create response once and store it securely.
    *
    * @param body - Name, type, TSG, and auth settings.
    * @returns The creation receipt including the deployment's gateway credentials.
@@ -12755,11 +13862,67 @@ var AIGatewayDeploymentsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_DEPLOYMENTS_PATH,
       body,
+      requestSchema: GatewayDeploymentCreateRequestSchema,
+      secretOperation: "deployments.create",
       responseSchema: GatewayDeploymentCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /**
+   * Update deployment settings, including its externally deployed gateway URL and workspace scope.
+   * @param deploymentId - Deployment UUID.
+   * @param body - Fields to update.
+   * @returns The gateway write response.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * await gw.deployments.update('21414819-485e-4ba3-b3d3-3e1815580e43', {
+   *   auth_settings: {
+   *     gateway_base_url: 'https://gateway.example.com',
+   *     workspaces_allowed: ['ws-develo-71f8d8'],
+   *   },
+   * });
+   * ```
+   */
+  async update(deploymentId, body) {
+    assertUuid(deploymentId, "deploymentId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_DEPLOYMENTS_PATH}/${deploymentId}`,
+      body,
+      requestSchema: GatewayDeploymentUpdateRequestSchema,
+      secretOperation: "deployments.update",
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Run SCM's outbound and inbound connectivity checks against a configured gateway.
+   * @param deploymentId - Deployment UUID.
+   * @returns Health of both connectivity directions.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const health = await gw.deployments.ping('21414819-485e-4ba3-b3d3-3e1815580e43');
+   * console.log(health.status, health.outbound.status, health.inbound.status);
+   * ```
+   */
+  async ping(deploymentId) {
+    assertUuid(deploymentId, "deploymentId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_DEPLOYMENTS_PATH}/${deploymentId}/ping`,
+      responseSchema: GatewayDeploymentPingResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Archive a deployment.
    *
@@ -12834,8 +13997,8 @@ var AIGatewayPluginsClient = class {
    * Bind a plugin to the organisation.
    *
    * @remarks
-   * `body.credentials` (e.g. `AIRS_API_KEY`) is a live secret. Setting `PANW_AI_SEC_DEBUG`
-   * will print it, unredacted, to the SDK's own debug log.
+   * `body.credentials` (e.g. `AIRS_API_KEY`) is a live secret. SDK debug logs replace each
+   * credential value with `[REDACTED]`, but callers must still avoid logging the input object.
    *
    * @param body - Integration id and provider-specific credentials.
    * @returns The raw create response. Shape unverified against a live tenant — see the PRD.
@@ -12858,6 +14021,8 @@ var AIGatewayPluginsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_PLUGINS_PATH,
       body,
+      requestSchema: GatewayPluginCreateRequestSchema,
+      secretOperation: "plugins.create",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12899,7 +14064,7 @@ var AIGatewayOrganisationsClient = class {
   }
   /**
    * Update the calling organisation's settings.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12915,6 +14080,7 @@ var AIGatewayOrganisationsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_ORGANISATIONS_SELF_PATH,
       body,
+      requestSchema: GatewayOrganisationUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12925,8 +14091,8 @@ var AIGatewayOrganisationsClient = class {
    *
    * @remarks
    * The response includes a `scim_token` — a live secret. Never log the returned object.
-   * Note that setting `PANW_AI_SEC_DEBUG` will print it (unredacted) to the SDK's own debug
-   * log regardless of this warning, since debug logging only sanitizes header values.
+   * SDK debug logs redact `scim_token` and known nested client-secret fields. Callers must
+   * still avoid logging the input object or returned auth settings directly.
    *
    * @param tsgId - The TSG as a numeric string, not a UUID.
    * @returns Auth settings, including domains and the SCIM token.
@@ -12945,6 +14111,7 @@ var AIGatewayOrganisationsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: aiGwOrganisationsAuthSettingsPath(tsgId),
+      secretOperation: "organisations.getAuthSettings",
       responseSchema: AuthSettingsResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12953,7 +14120,7 @@ var AIGatewayOrganisationsClient = class {
   /**
    * Update an organisation's auth settings.
    * @param tsgId - The TSG as a numeric string, not a UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more auth-setting fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12972,6 +14139,8 @@ var AIGatewayOrganisationsClient = class {
       baseUrl: this.baseUrl,
       path: aiGwOrganisationsAuthSettingsPath(tsgId),
       body,
+      requestSchema: GatewayOrganisationAuthSettingsUpdateRequestSchema,
+      secretOperation: "organisations.updateAuthSettings",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -13089,6 +14258,165 @@ var AIGatewayClient = class {
     this.auditLogs = new AIGatewayAuditLogsClient(adminOpts);
   }
 };
+
+// src/ai-gateway/nested-values.ts
+var FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var ESCAPABLE = /* @__PURE__ */ new Set([".", "[", "]", "\\"]);
+function invalid(message) {
+  throw new AISecSDKException(message, "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
+}
+function pushProperty(tokens, value2, path) {
+  if (!value2) invalid(`Invalid dotted path: ${path}`);
+  if (FORBIDDEN_SEGMENTS.has(value2)) invalid(`Unsafe dotted path segment: ${value2}`);
+  tokens.push(value2);
+}
+function parsePath(path) {
+  if (!path) invalid("Dotted path must not be empty");
+  const tokens = [];
+  let property = "";
+  let afterDot = false;
+  let afterIndex = false;
+  for (let i = 0; i < path.length; i++) {
+    const char = path[i];
+    if (char === "\\") {
+      const escaped = path[++i];
+      if (escaped === void 0 || !ESCAPABLE.has(escaped)) {
+        invalid(`Invalid escape in dotted path: ${path}`);
+      }
+      if (afterIndex) invalid(`Missing dot after array index in path: ${path}`);
+      property += escaped;
+      afterDot = false;
+      continue;
+    }
+    if (char === ".") {
+      if (property) {
+        pushProperty(tokens, property, path);
+        property = "";
+      } else if (!afterIndex) {
+        invalid(`Invalid empty segment in dotted path: ${path}`);
+      }
+      afterDot = true;
+      afterIndex = false;
+      continue;
+    }
+    if (char === "[") {
+      if (afterDot) invalid(`Invalid array segment in dotted path: ${path}`);
+      if (property) {
+        pushProperty(tokens, property, path);
+        property = "";
+      } else if (tokens.length === 0) {
+        invalid(`Dotted paths must start with an object property: ${path}`);
+      }
+      const close = path.indexOf("]", i + 1);
+      if (close === -1) invalid(`Unclosed array index in dotted path: ${path}`);
+      const rawIndex = path.slice(i + 1, close);
+      if (!/^(0|[1-9]\d*)$/.test(rawIndex)) invalid(`Invalid array index in dotted path: ${path}`);
+      tokens.push(Number(rawIndex));
+      i = close;
+      afterIndex = true;
+      afterDot = false;
+      continue;
+    }
+    if (char === "]") invalid(`Unexpected ] in dotted path: ${path}`);
+    if (afterIndex) invalid(`Missing dot after array index in path: ${path}`);
+    property += char;
+    afterDot = false;
+  }
+  if (property) pushProperty(tokens, property, path);
+  else if (afterDot) invalid(`Dotted path must not end with a dot: ${path}`);
+  if (tokens.length === 0) invalid(`Invalid dotted path: ${path}`);
+  return tokens;
+}
+function isContainerFor(value2, expectArray) {
+  return expectArray ? Array.isArray(value2) : typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function readSegment(container, segment) {
+  return typeof segment === "number" ? container[segment] : container[segment];
+}
+function writeSegment(container, segment, value2) {
+  if (typeof segment === "number") container[segment] = value2;
+  else container[segment] = value2;
+}
+function assign(root, tokens, value2, replaceExisting) {
+  let current = root;
+  for (let i = 0; i < tokens.length; i++) {
+    const segment = tokens[i];
+    const final = i === tokens.length - 1;
+    if (typeof segment === "number" && !Array.isArray(current)) {
+      invalid("Array index conflicts with an object path");
+    }
+    if (typeof segment === "string" && Array.isArray(current)) {
+      invalid("Object property conflicts with an array path");
+    }
+    const hasValue = Object.prototype.hasOwnProperty.call(current, segment);
+    if (final) {
+      if (hasValue && !replaceExisting) invalid("Duplicate dotted path");
+      writeSegment(current, segment, value2);
+      return;
+    }
+    const expectArray = typeof tokens[i + 1] === "number";
+    if (!hasValue) {
+      writeSegment(current, segment, expectArray ? [] : {});
+    } else {
+      const existing = readSegment(current, segment);
+      if (!isContainerFor(existing, expectArray)) invalid("Dotted path shape conflict");
+    }
+    current = readSegment(current, segment);
+  }
+}
+function assertDenseArrays(value2) {
+  if (Array.isArray(value2)) {
+    for (let i = 0; i < value2.length; i++) {
+      if (!Object.prototype.hasOwnProperty.call(value2, i))
+        invalid("Sparse arrays are not supported");
+      assertDenseArrays(value2[i]);
+    }
+    return;
+  }
+  if (typeof value2 === "object" && value2 !== null) {
+    for (const nested of Object.values(value2)) assertDenseArrays(nested);
+  }
+}
+function cloneJson(value2) {
+  if (Array.isArray(value2)) {
+    return value2.map((item) => cloneJson(item));
+  }
+  if (typeof value2 === "object" && value2 !== null) {
+    return Object.fromEntries(
+      Object.entries(value2).map(([key, item]) => [key, cloneJson(item)])
+    );
+  }
+  return value2;
+}
+function parseJsonValue(value2) {
+  const result = GatewayJsonValueSchema.safeParse(value2);
+  if (!result.success) invalid("Dotted value must be finite JSON");
+  return cloneJson(result.data);
+}
+function buildDottedObject(entries) {
+  const parsed = entries.map((entry) => ({
+    tokens: parsePath(entry.path),
+    value: parseJsonValue(entry.value)
+  }));
+  const identities = /* @__PURE__ */ new Set();
+  for (const entry of parsed) {
+    const identity = JSON.stringify(entry.tokens);
+    if (identities.has(identity)) invalid("Duplicate dotted path");
+    identities.add(identity);
+  }
+  const result = {};
+  for (const entry of parsed) assign(result, entry.tokens, entry.value, false);
+  assertDenseArrays(result);
+  return result;
+}
+function setDottedValue(input, path, value2) {
+  const parsedInput = GatewayJsonObjectSchema.safeParse(input);
+  if (!parsedInput.success) invalid("Input must be a finite JSON object");
+  const result = cloneJson(parsedInput.data);
+  assign(result, parsePath(path), parseJsonValue(value2), true);
+  assertDenseArrays(result);
+  return result;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AIGatewayApiKeysClient,
@@ -13106,6 +14434,18 @@ var AIGatewayClient = class {
   AIGatewayWorkspacesClient,
   AIRS_ENDPOINTS,
   AISecSDKException,
+  AI_GATEWAY_DEPLOYMENT_STATUSES,
+  AI_GATEWAY_DEPLOYMENT_TYPES,
+  AI_GATEWAY_KNOWN_API_KEY_SCOPES,
+  AI_GATEWAY_KNOWN_CACHE_MODES,
+  AI_GATEWAY_KNOWN_CONFIG_STRATEGIES,
+  AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
+  AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
+  AI_GATEWAY_KNOWN_RATE_LIMIT_TYPES,
+  AI_GATEWAY_KNOWN_RATE_LIMIT_UNITS,
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
+  AI_GATEWAY_REDACTED,
+  AI_GATEWAY_SECRET_FIELDS,
   AI_GW_ADMIN_ENDPOINT,
   AI_GW_API_KEYS_SERVICE_PATH,
   AI_GW_API_KEYS_USER_PATH,
@@ -13357,35 +14697,100 @@ var AIGatewayClient = class {
   FileScanDataSchema,
   FileScanResult,
   FileType,
+  GatewayApiKeyCreateRequestSchema,
+  GatewayApiKeyRotateRequestSchema,
+  GatewayApiKeyRotateResponseSchema,
+  GatewayApiKeyRotationPolicySchema,
   GatewayApiKeySchema,
+  GatewayApiKeyScopeSchema,
+  GatewayApiKeyUpdateRequestSchema,
   GatewayAuditLogRecordSchema,
   GatewayAuditLogsResponseSchema,
+  GatewayAzureAIConfigurationSchema,
+  GatewayAzureDeploymentConfigurationSchema,
+  GatewayAzureOpenAIConfigurationSchema,
+  GatewayBedrockConfigurationSchema,
   GatewayChartRecordSchema,
+  GatewayConfigCacheModeSchema,
+  GatewayConfigCreateRequestSchema,
   GatewayConfigCreateResponseSchema,
   GatewayConfigDetailSchema,
   GatewayConfigSchema,
+  GatewayConfigStrategySchema,
+  GatewayConfigUpdateRequestSchema,
+  GatewayConfigVersionSchema,
+  GatewayCortexConfigurationSchema,
+  GatewayCustomHostConfigurationSchema,
+  GatewayDefaultsInputSchema,
+  GatewayDeploymentAuthSettingsInputSchema,
+  GatewayDeploymentCreateRequestSchema,
   GatewayDeploymentCreateResponseSchema,
   GatewayDeploymentDetailSchema,
+  GatewayDeploymentPingResponseSchema,
   GatewayDeploymentSchema,
+  GatewayDeploymentStatusSchema,
+  GatewayDeploymentTypeSchema,
+  GatewayDeploymentUpdateRequestSchema,
+  GatewayGlobalWorkspaceAccessInputSchema,
   GatewayGlobalWorkspaceAccessSchema,
   GatewayGroupRowSchema,
+  GatewayGuardrailActionsSchema,
+  GatewayGuardrailCheckSchema,
+  GatewayGuardrailCreateRequestSchema,
   GatewayGuardrailCreateResponseSchema,
   GatewayGuardrailDetailSchema,
   GatewayGuardrailSchema,
+  GatewayGuardrailUpdateRequestSchema,
+  GatewayHuggingFaceConfigurationSchema,
+  GatewayIntegrationCreateRequestSchema,
+  GatewayIntegrationModelUpdateSchema,
+  GatewayIntegrationModelsBulkUpdateRequestSchema,
   GatewayIntegrationModelsResponseSchema,
   GatewayIntegrationSchema,
+  GatewayIntegrationUpdateRequestSchema,
   GatewayIntegrationWorkspaceSchema,
+  GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
   GatewayIntegrationWorkspacesResponseSchema,
+  GatewayJsonObjectSchema,
+  GatewayJsonValueSchema,
   GatewayLogRecordSchema,
   GatewayLogsResponseSchema,
+  GatewayMcpAuthTypeSchema,
+  GatewayMcpTransportSchema,
+  GatewayMutableMcpCapabilityTypeSchema,
+  GatewayOpenAIConfigurationSchema,
+  GatewayOrganisationAuthSettingsUpdateRequestSchema,
+  GatewayOrganisationUpdateRequestSchema,
+  GatewayPluginCreateRequestSchema,
   GatewayPluginSchema,
+  GatewayProviderCreateRequestSchema,
   GatewayProviderCreateResponseSchema,
+  GatewayProviderDetailSchema,
   GatewayProviderSchema,
+  GatewayProviderUpdateRequestSchema,
+  GatewayRateLimitInputSchema,
   GatewayRateLimitSchema,
+  GatewayRateLimitTypeSchema,
+  GatewayRateLimitUnitSchema,
+  GatewayRoutingCacheSchema,
+  GatewayRoutingConfigSchema,
+  GatewayRoutingRetrySchema,
+  GatewayRoutingStrategySchema,
+  GatewayRoutingTargetSchema,
+  GatewaySageMakerConfigurationSchema,
+  GatewaySecretMappingSchema,
+  GatewayServiceApiKeyCreateRequestSchema,
+  GatewayUsageLimitInputSchema,
   GatewayUsageLimitSchema,
+  GatewayUserApiKeyCreateRequestSchema,
+  GatewayVertexAIConfigurationSchema,
+  GatewayWorkersAIConfigurationSchema,
+  GatewayWorkspaceBindingSchema,
+  GatewayWorkspaceCreateRequestSchema,
   GatewayWorkspaceCreateResponseSchema,
   GatewayWorkspaceDetailSchema,
   GatewayWorkspaceSchema,
+  GatewayWorkspaceUpdateRequestSchema,
   GatewayWriteResponseSchema,
   GoalListResponseSchema,
   GoalSchema,
@@ -13420,6 +14825,7 @@ var AIGatewayClient = class {
   LanguageOptionSchema,
   LatencyChartResponseSchema,
   ListApiKeysResponseSchema,
+  ListConfigVersionsResponseSchema,
   ListConfigsResponseSchema,
   ListDeploymentsResponseSchema,
   ListGuardrailsResponseSchema,
@@ -13488,7 +14894,18 @@ var AIGatewayClient = class {
   MaskedDataSchema,
   McEntrySchema,
   McReportSchema,
+  McpIntegrationCapabilitiesBulkUpdateRequestSchema,
+  McpIntegrationCapabilitiesResponseSchema,
+  McpIntegrationCapabilitiesUpdateResponseSchema,
+  McpIntegrationCapabilitySchema,
+  McpIntegrationCapabilityUpdateSchema,
+  McpIntegrationCreateRequestSchema,
+  McpIntegrationDetailSchema,
+  McpIntegrationMetadataSchema,
   McpIntegrationSchema,
+  McpIntegrationUpdateRequestSchema,
+  McpIntegrationWorkspacesBulkUpdateRequestSchema,
+  McpIntegrationWorkspacesUpdateResponseSchema,
   MetadataCriterionSchema,
   MetadataSchema,
   ModelConfigurationSchema,
@@ -13731,6 +15148,7 @@ var AIGatewayClient = class {
   WebSocketConnectionParamsSchema,
   WeightedRegexSchema,
   aiGwOrganisationsAuthSettingsPath,
+  buildDottedObject,
   collectAll,
   collectSkipPages,
   collectSpringPages,
@@ -13739,6 +15157,8 @@ var AIGatewayClient = class {
   jsonNullable,
   pageSchema,
   paginate,
-  serializeListing
+  redactAIGatewaySecrets,
+  serializeListing,
+  setDottedValue
 });
 //# sourceMappingURL=index.cjs.map