npm - @cdot65/prisma-airs-sdk - Versions diffs - 0.19.0 → 0.20.1 - Mend

@cdot65/prisma-airs-sdk 0.19.0 → 0.20.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/dist/index.cjs CHANGED Viewed

@@ -35,6 +35,18 @@ __export(index_exports, {
   AIGatewayWorkspacesClient: () => AIGatewayWorkspacesClient,
   AIRS_ENDPOINTS: () => AIRS_ENDPOINTS,
   AISecSDKException: () => AISecSDKException,
+  AI_GATEWAY_DEPLOYMENT_STATUSES: () => AI_GATEWAY_DEPLOYMENT_STATUSES,
+  AI_GATEWAY_DEPLOYMENT_TYPES: () => AI_GATEWAY_DEPLOYMENT_TYPES,
+  AI_GATEWAY_KNOWN_API_KEY_SCOPES: () => AI_GATEWAY_KNOWN_API_KEY_SCOPES,
+  AI_GATEWAY_KNOWN_CACHE_MODES: () => AI_GATEWAY_KNOWN_CACHE_MODES,
+  AI_GATEWAY_KNOWN_CONFIG_STRATEGIES: () => AI_GATEWAY_KNOWN_CONFIG_STRATEGIES,
+  AI_GATEWAY_KNOWN_MCP_AUTH_TYPES: () => AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
+  AI_GATEWAY_KNOWN_MCP_TRANSPORTS: () => AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
+  AI_GATEWAY_KNOWN_RATE_LIMIT_TYPES: () => AI_GATEWAY_KNOWN_RATE_LIMIT_TYPES,
+  AI_GATEWAY_KNOWN_RATE_LIMIT_UNITS: () => AI_GATEWAY_KNOWN_RATE_LIMIT_UNITS,
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES: () => AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
+  AI_GATEWAY_REDACTED: () => AI_GATEWAY_REDACTED,
+  AI_GATEWAY_SECRET_FIELDS: () => AI_GATEWAY_SECRET_FIELDS,
   AI_GW_ADMIN_ENDPOINT: () => AI_GW_ADMIN_ENDPOINT,
   AI_GW_API_KEYS_SERVICE_PATH: () => AI_GW_API_KEYS_SERVICE_PATH,
   AI_GW_API_KEYS_USER_PATH: () => AI_GW_API_KEYS_USER_PATH,
@@ -286,39 +298,100 @@ __export(index_exports, {
   FileScanDataSchema: () => FileScanDataSchema,
   FileScanResult: () => FileScanResult,
   FileType: () => FileType,
+  GatewayApiKeyCreateRequestSchema: () => GatewayApiKeyCreateRequestSchema,
+  GatewayApiKeyRotateRequestSchema: () => GatewayApiKeyRotateRequestSchema,
   GatewayApiKeyRotateResponseSchema: () => GatewayApiKeyRotateResponseSchema,
+  GatewayApiKeyRotationPolicySchema: () => GatewayApiKeyRotationPolicySchema,
   GatewayApiKeySchema: () => GatewayApiKeySchema,
+  GatewayApiKeyScopeSchema: () => GatewayApiKeyScopeSchema,
+  GatewayApiKeyUpdateRequestSchema: () => GatewayApiKeyUpdateRequestSchema,
   GatewayAuditLogRecordSchema: () => GatewayAuditLogRecordSchema,
   GatewayAuditLogsResponseSchema: () => GatewayAuditLogsResponseSchema,
+  GatewayAzureAIConfigurationSchema: () => GatewayAzureAIConfigurationSchema,
+  GatewayAzureDeploymentConfigurationSchema: () => GatewayAzureDeploymentConfigurationSchema,
+  GatewayAzureOpenAIConfigurationSchema: () => GatewayAzureOpenAIConfigurationSchema,
+  GatewayBedrockConfigurationSchema: () => GatewayBedrockConfigurationSchema,
   GatewayChartRecordSchema: () => GatewayChartRecordSchema,
+  GatewayConfigCacheModeSchema: () => GatewayConfigCacheModeSchema,
+  GatewayConfigCreateRequestSchema: () => GatewayConfigCreateRequestSchema,
   GatewayConfigCreateResponseSchema: () => GatewayConfigCreateResponseSchema,
   GatewayConfigDetailSchema: () => GatewayConfigDetailSchema,
   GatewayConfigSchema: () => GatewayConfigSchema,
+  GatewayConfigStrategySchema: () => GatewayConfigStrategySchema,
+  GatewayConfigUpdateRequestSchema: () => GatewayConfigUpdateRequestSchema,
   GatewayConfigVersionSchema: () => GatewayConfigVersionSchema,
+  GatewayCortexConfigurationSchema: () => GatewayCortexConfigurationSchema,
+  GatewayCustomHostConfigurationSchema: () => GatewayCustomHostConfigurationSchema,
+  GatewayDefaultsInputSchema: () => GatewayDefaultsInputSchema,
+  GatewayDeploymentAuthSettingsInputSchema: () => GatewayDeploymentAuthSettingsInputSchema,
+  GatewayDeploymentCreateRequestSchema: () => GatewayDeploymentCreateRequestSchema,
   GatewayDeploymentCreateResponseSchema: () => GatewayDeploymentCreateResponseSchema,
   GatewayDeploymentDetailSchema: () => GatewayDeploymentDetailSchema,
   GatewayDeploymentPingResponseSchema: () => GatewayDeploymentPingResponseSchema,
   GatewayDeploymentSchema: () => GatewayDeploymentSchema,
+  GatewayDeploymentStatusSchema: () => GatewayDeploymentStatusSchema,
+  GatewayDeploymentTypeSchema: () => GatewayDeploymentTypeSchema,
+  GatewayDeploymentUpdateRequestSchema: () => GatewayDeploymentUpdateRequestSchema,
+  GatewayGlobalWorkspaceAccessInputSchema: () => GatewayGlobalWorkspaceAccessInputSchema,
   GatewayGlobalWorkspaceAccessSchema: () => GatewayGlobalWorkspaceAccessSchema,
   GatewayGroupRowSchema: () => GatewayGroupRowSchema,
+  GatewayGuardrailActionsSchema: () => GatewayGuardrailActionsSchema,
+  GatewayGuardrailCheckSchema: () => GatewayGuardrailCheckSchema,
+  GatewayGuardrailCreateRequestSchema: () => GatewayGuardrailCreateRequestSchema,
   GatewayGuardrailCreateResponseSchema: () => GatewayGuardrailCreateResponseSchema,
   GatewayGuardrailDetailSchema: () => GatewayGuardrailDetailSchema,
   GatewayGuardrailSchema: () => GatewayGuardrailSchema,
+  GatewayGuardrailUpdateRequestSchema: () => GatewayGuardrailUpdateRequestSchema,
+  GatewayHuggingFaceConfigurationSchema: () => GatewayHuggingFaceConfigurationSchema,
+  GatewayIntegrationCreateRequestSchema: () => GatewayIntegrationCreateRequestSchema,
+  GatewayIntegrationModelUpdateSchema: () => GatewayIntegrationModelUpdateSchema,
+  GatewayIntegrationModelsBulkUpdateRequestSchema: () => GatewayIntegrationModelsBulkUpdateRequestSchema,
   GatewayIntegrationModelsResponseSchema: () => GatewayIntegrationModelsResponseSchema,
   GatewayIntegrationSchema: () => GatewayIntegrationSchema,
+  GatewayIntegrationUpdateRequestSchema: () => GatewayIntegrationUpdateRequestSchema,
   GatewayIntegrationWorkspaceSchema: () => GatewayIntegrationWorkspaceSchema,
+  GatewayIntegrationWorkspacesBulkUpdateRequestSchema: () => GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
   GatewayIntegrationWorkspacesResponseSchema: () => GatewayIntegrationWorkspacesResponseSchema,
+  GatewayJsonObjectSchema: () => GatewayJsonObjectSchema,
+  GatewayJsonValueSchema: () => GatewayJsonValueSchema,
   GatewayLogRecordSchema: () => GatewayLogRecordSchema,
   GatewayLogsResponseSchema: () => GatewayLogsResponseSchema,
+  GatewayMcpAuthTypeSchema: () => GatewayMcpAuthTypeSchema,
+  GatewayMcpTransportSchema: () => GatewayMcpTransportSchema,
+  GatewayMutableMcpCapabilityTypeSchema: () => GatewayMutableMcpCapabilityTypeSchema,
+  GatewayOpenAIConfigurationSchema: () => GatewayOpenAIConfigurationSchema,
+  GatewayOrganisationAuthSettingsUpdateRequestSchema: () => GatewayOrganisationAuthSettingsUpdateRequestSchema,
+  GatewayOrganisationUpdateRequestSchema: () => GatewayOrganisationUpdateRequestSchema,
+  GatewayPluginCreateRequestSchema: () => GatewayPluginCreateRequestSchema,
   GatewayPluginSchema: () => GatewayPluginSchema,
+  GatewayProviderCreateRequestSchema: () => GatewayProviderCreateRequestSchema,
   GatewayProviderCreateResponseSchema: () => GatewayProviderCreateResponseSchema,
   GatewayProviderDetailSchema: () => GatewayProviderDetailSchema,
   GatewayProviderSchema: () => GatewayProviderSchema,
+  GatewayProviderUpdateRequestSchema: () => GatewayProviderUpdateRequestSchema,
+  GatewayRateLimitInputSchema: () => GatewayRateLimitInputSchema,
   GatewayRateLimitSchema: () => GatewayRateLimitSchema,
+  GatewayRateLimitTypeSchema: () => GatewayRateLimitTypeSchema,
+  GatewayRateLimitUnitSchema: () => GatewayRateLimitUnitSchema,
+  GatewayRoutingCacheSchema: () => GatewayRoutingCacheSchema,
+  GatewayRoutingConfigSchema: () => GatewayRoutingConfigSchema,
+  GatewayRoutingRetrySchema: () => GatewayRoutingRetrySchema,
+  GatewayRoutingStrategySchema: () => GatewayRoutingStrategySchema,
+  GatewayRoutingTargetSchema: () => GatewayRoutingTargetSchema,
+  GatewaySageMakerConfigurationSchema: () => GatewaySageMakerConfigurationSchema,
+  GatewaySecretMappingSchema: () => GatewaySecretMappingSchema,
+  GatewayServiceApiKeyCreateRequestSchema: () => GatewayServiceApiKeyCreateRequestSchema,
+  GatewayUsageLimitInputSchema: () => GatewayUsageLimitInputSchema,
   GatewayUsageLimitSchema: () => GatewayUsageLimitSchema,
+  GatewayUserApiKeyCreateRequestSchema: () => GatewayUserApiKeyCreateRequestSchema,
+  GatewayVertexAIConfigurationSchema: () => GatewayVertexAIConfigurationSchema,
+  GatewayWorkersAIConfigurationSchema: () => GatewayWorkersAIConfigurationSchema,
+  GatewayWorkspaceBindingSchema: () => GatewayWorkspaceBindingSchema,
+  GatewayWorkspaceCreateRequestSchema: () => GatewayWorkspaceCreateRequestSchema,
   GatewayWorkspaceCreateResponseSchema: () => GatewayWorkspaceCreateResponseSchema,
   GatewayWorkspaceDetailSchema: () => GatewayWorkspaceDetailSchema,
   GatewayWorkspaceSchema: () => GatewayWorkspaceSchema,
+  GatewayWorkspaceUpdateRequestSchema: () => GatewayWorkspaceUpdateRequestSchema,
   GatewayWriteResponseSchema: () => GatewayWriteResponseSchema,
   GoalListResponseSchema: () => GoalListResponseSchema,
   GoalSchema: () => GoalSchema,
@@ -422,12 +495,17 @@ __export(index_exports, {
   MaskedDataSchema: () => MaskedDataSchema,
   McEntrySchema: () => McEntrySchema,
   McReportSchema: () => McReportSchema,
+  McpIntegrationCapabilitiesBulkUpdateRequestSchema: () => McpIntegrationCapabilitiesBulkUpdateRequestSchema,
   McpIntegrationCapabilitiesResponseSchema: () => McpIntegrationCapabilitiesResponseSchema,
   McpIntegrationCapabilitiesUpdateResponseSchema: () => McpIntegrationCapabilitiesUpdateResponseSchema,
   McpIntegrationCapabilitySchema: () => McpIntegrationCapabilitySchema,
+  McpIntegrationCapabilityUpdateSchema: () => McpIntegrationCapabilityUpdateSchema,
+  McpIntegrationCreateRequestSchema: () => McpIntegrationCreateRequestSchema,
   McpIntegrationDetailSchema: () => McpIntegrationDetailSchema,
   McpIntegrationMetadataSchema: () => McpIntegrationMetadataSchema,
   McpIntegrationSchema: () => McpIntegrationSchema,
+  McpIntegrationUpdateRequestSchema: () => McpIntegrationUpdateRequestSchema,
+  McpIntegrationWorkspacesBulkUpdateRequestSchema: () => McpIntegrationWorkspacesBulkUpdateRequestSchema,
   McpIntegrationWorkspacesUpdateResponseSchema: () => McpIntegrationWorkspacesUpdateResponseSchema,
   MetadataCriterionSchema: () => MetadataCriterionSchema,
   MetadataSchema: () => MetadataSchema,
@@ -671,6 +749,7 @@ __export(index_exports, {
   WebSocketConnectionParamsSchema: () => WebSocketConnectionParamsSchema,
   WeightedRegexSchema: () => WeightedRegexSchema,
   aiGwOrganisationsAuthSettingsPath: () => aiGwOrganisationsAuthSettingsPath,
+  buildDottedObject: () => buildDottedObject,
   collectAll: () => collectAll,
   collectSkipPages: () => collectSkipPages,
   collectSpringPages: () => collectSpringPages,
@@ -679,7 +758,9 @@ __export(index_exports, {
   jsonNullable: () => jsonNullable,
   pageSchema: () => pageSchema,
   paginate: () => paginate,
-  serializeListing: () => serializeListing
+  redactAIGatewaySecrets: () => redactAIGatewaySecrets,
+  serializeListing: () => serializeListing,
+  setDottedValue: () => setDottedValue
 });
 module.exports = __toCommonJS(index_exports);
@@ -714,7 +795,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 20;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.17.0";
+var SDK_VERSION = "0.20.1";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -957,8 +1038,8 @@ var import_zod15 = require("zod");
 // src/utils.ts
 var import_node_crypto = require("crypto");
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function isValidUuid(value) {
-  return UUID_RE.test(value);
+function isValidUuid(value2) {
+  return UUID_RE.test(value2);
 }
 function generatePayloadHash(payload, secret) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(payload).digest("hex");
@@ -1018,9 +1099,9 @@ function extractErrorMessage(body, status) {
     return body ? `API error ${status}: ${body}` : `API error ${status}`;
   }
 }
-function parseRetryAfterHeader(value) {
-  if (value === null) return void 0;
-  const normalized = value.trim();
+function parseRetryAfterHeader(value2) {
+  if (value2 === null) return void 0;
+  const normalized = value2.trim();
   if (/^\d+$/.test(normalized)) {
     const milliseconds = Number(normalized) * 1e3;
     return Number.isFinite(milliseconds) ? milliseconds : void 0;
@@ -1122,6 +1203,120 @@ async function executeWithRetry(opts) {
 // src/http/debug.ts
 var import_node_crypto2 = require("crypto");
+// src/ai-gateway/secret-fields.ts
+var AI_GATEWAY_REDACTED = "[REDACTED]";
+var value = (...path) => ({
+  path,
+  redact: "value"
+});
+var subtree = (...path) => ({
+  path,
+  redact: "subtree"
+});
+var oneTime = (...path) => ({
+  path,
+  redact: "value",
+  oneTime: true
+});
+var providerRequestSecrets = [
+  value("key"),
+  value("configurations", "azure_entra_client_secret"),
+  value("configurations", "aws_secret_access_key"),
+  subtree("configurations", "vertex_service_account_json"),
+  value("configurations", "custom_headers", "*")
+];
+var mcpRequestSecrets = [
+  value("configurations", "custom_headers", "*"),
+  value("configurations", "client_secret"),
+  value("configurations", "oauth_client_secret"),
+  subtree("configurations", "oauth_metadata")
+];
+var empty = [];
+var AI_GATEWAY_SECRET_FIELDS = {
+  "apiKeys.createService": { request: empty, response: [oneTime("key")] },
+  "apiKeys.createUser": { request: empty, response: [oneTime("key")] },
+  "apiKeys.rotateService": { request: empty, response: [oneTime("key")] },
+  "apiKeys.rotateUser": { request: empty, response: [oneTime("key")] },
+  "deployments.create": {
+    request: empty,
+    response: [oneTime("client_auth"), oneTime("credentials", "password")]
+  },
+  "deployments.update": {
+    request: empty,
+    response: [oneTime("client_auth"), oneTime("credentials", "password")]
+  },
+  "integrations.create": { request: providerRequestSecrets, response: empty },
+  "integrations.update": { request: providerRequestSecrets, response: empty },
+  "mcpIntegrations.create": { request: mcpRequestSecrets, response: empty },
+  "mcpIntegrations.update": { request: mcpRequestSecrets, response: empty },
+  "organisations.getAuthSettings": {
+    request: empty,
+    response: [value("scim_token"), value("data", "scim_token")]
+  },
+  "organisations.updateAuthSettings": {
+    request: [value("scim_token"), value("auth_settings", "client_secret")],
+    response: [value("scim_token"), value("data", "scim_token")]
+  },
+  "plugins.create": { request: [value("credentials", "*")], response: empty },
+  "providers.get": {
+    request: empty,
+    response: [
+      value("key"),
+      subtree("model_config"),
+      subtree("credentials"),
+      value("configurations", "azure_entra_client_secret"),
+      value("configurations", "aws_secret_access_key"),
+      subtree("configurations", "vertex_service_account_json"),
+      value("configurations", "custom_headers", "*")
+    ]
+  }
+};
+function cloneValue(input, seen = /* @__PURE__ */ new WeakMap()) {
+  if (typeof input !== "object" || input === null) return input;
+  const cached = seen.get(input);
+  if (cached !== void 0) return cached;
+  const output = Array.isArray(input) ? [] : {};
+  seen.set(input, output);
+  if (Array.isArray(input)) {
+    for (const item of input) output.push(cloneValue(item, seen));
+  } else {
+    for (const [key, item] of Object.entries(input)) {
+      Object.defineProperty(output, key, {
+        value: cloneValue(item, seen),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+  }
+  return output;
+}
+function applyRule(current, path, index) {
+  if (index === path.length) return AI_GATEWAY_REDACTED;
+  if (typeof current !== "object" || current === null) return current;
+  const segment = path[index];
+  if (Array.isArray(current)) {
+    if (segment !== "*") return current;
+    for (let i = 0; i < current.length; i++) current[i] = applyRule(current[i], path, index + 1);
+    return current;
+  }
+  const record = current;
+  if (segment === "*") {
+    for (const key of Object.keys(record)) record[key] = applyRule(record[key], path, index + 1);
+  } else if (Object.prototype.hasOwnProperty.call(record, segment)) {
+    record[segment] = applyRule(record[segment], path, index + 1);
+  }
+  return record;
+}
+function redactAIGatewaySecrets(operation, input, direction = "request") {
+  const output = cloneValue(input);
+  const metadata = AI_GATEWAY_SECRET_FIELDS[operation];
+  for (const rule of metadata[direction]) applyRule(output, rule.path, 0);
+  return output;
+}
+// src/http/debug.ts
 var TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
 var SENSITIVE_HEADERS = /* @__PURE__ */ new Set([HEADER_AUTH_TOKEN.toLowerCase(), HEADER_API_KEY.toLowerCase()]);
 var PREFIX = "[airs-sdk]";
@@ -1129,16 +1324,23 @@ function isDebugEnabled() {
   const raw = process.env.PANW_AI_SEC_DEBUG;
   return raw !== void 0 && TRUTHY.has(raw.trim().toLowerCase());
 }
-function hashToken(value) {
-  return "sha256:" + (0, import_node_crypto2.createHash)("sha256").update(value).digest("hex").slice(0, 12);
+function hashToken(value2) {
+  return "sha256:" + (0, import_node_crypto2.createHash)("sha256").update(value2).digest("hex").slice(0, 12);
 }
 function sanitizeHeaders(headers) {
   const out = {};
-  for (const [key, value] of Object.entries(headers)) {
-    out[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? hashToken(value) : value;
+  for (const [key, value2] of Object.entries(headers)) {
+    out[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? hashToken(value2) : value2;
   }
   return out;
 }
+function sanitizeAIGatewayDebugBody(body, operation, direction) {
+  try {
+    return JSON.stringify(redactAIGatewaySecrets(operation, JSON.parse(body), direction));
+  } catch {
+    return "[BODY OMITTED: REDACTION FAILED]";
+  }
+}
 function logRequest(method, url, headers, body) {
   console.error(`${PREFIX} \u2192 ${method} ${url}`);
   console.error(`${PREFIX}   headers ${JSON.stringify(sanitizeHeaders(headers))}`);
@@ -1150,6 +1352,20 @@ function logResponse(status, ms, body) {
 // src/http/request.ts
 async function request(spec) {
+  let validatedBody = spec.body;
+  if (spec.requestSchema !== void 0) {
+    const result2 = spec.requestSchema.safeParse(spec.body);
+    if (!result2.success) {
+      const issues = result2.error.issues.map(
+        (issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<root>"}: ${issue.message}`
+      ).join("; ");
+      throw new AISecSDKException(
+        `Request body for ${spec.method} ${spec.path} did not match schema: ${issues}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    validatedBody = result2.data;
+  }
   let hasRetriedAuth = false;
   const debug = isDebugEnabled();
   const response = await executeWithRetry({
@@ -1158,11 +1374,11 @@ async function request(spec) {
       const baseUrl = spec.baseUrl.replace(/\/+$/, "");
       const url = new URL(`${baseUrl}${spec.path}`);
       if (spec.params) {
-        for (const [key, value] of Object.entries(spec.params)) {
-          if (Array.isArray(value)) {
-            for (const v of value) url.searchParams.append(key, v);
+        for (const [key, value2] of Object.entries(spec.params)) {
+          if (Array.isArray(value2)) {
+            for (const v of value2) url.searchParams.append(key, v);
           } else {
-            url.searchParams.set(key, value);
+            url.searchParams.set(key, value2);
           }
         }
       }
@@ -1174,16 +1390,19 @@ async function request(spec) {
       let bodyForFetch;
       if (spec.formData !== void 0) {
         bodyForFetch = spec.formData;
-      } else if (spec.body !== void 0) {
+      } else if (validatedBody !== void 0) {
         headers["Content-Type"] = spec.contentType ?? "application/json";
-        bodyText = JSON.stringify(spec.body);
+        bodyText = JSON.stringify(validatedBody);
         bodyForFetch = bodyText;
       }
       const prepared = { method: spec.method, url, headers, bodyText };
       const final = await spec.auth.prepare(prepared);
       const startedAt = debug ? Date.now() : 0;
       if (debug) {
-        const logBody = spec.formData !== void 0 ? "[multipart/form-data]" : final.bodyText;
+        let logBody = spec.formData !== void 0 ? "[multipart/form-data]" : final.bodyText;
+        if (logBody !== void 0 && spec.secretOperation !== void 0) {
+          logBody = sanitizeAIGatewayDebugBody(logBody, spec.secretOperation, "request");
+        }
         logRequest(final.method, final.url.toString(), final.headers, logBody);
       }
       const res = await fetch(final.url.toString(), {
@@ -1195,6 +1414,9 @@ async function request(spec) {
         let respBody;
         try {
           respBody = await res.clone().text();
+          if (respBody && spec.secretOperation !== void 0) {
+            respBody = sanitizeAIGatewayDebugBody(respBody, spec.secretOperation, "response");
+          }
         } catch {
         }
         logResponse(res.status, Date.now() - startedAt, respBody);
@@ -1848,14 +2070,14 @@ var Content = class _Content {
   get prompt() {
     return this._prompt;
   }
-  set prompt(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_PROMPT_LENGTH) {
+  set prompt(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_PROMPT_LENGTH) {
       throw new AISecSDKException(
         `prompt exceeds max length of ${MAX_CONTENT_PROMPT_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._prompt = value;
+    this._prompt = value2;
   }
   /**
    * AI model response text. Setting a value validates its byte length (max 2 MB).
@@ -1870,14 +2092,14 @@ var Content = class _Content {
   get response() {
     return this._response;
   }
-  set response(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_RESPONSE_LENGTH) {
+  set response(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_RESPONSE_LENGTH) {
       throw new AISecSDKException(
         `response exceeds max length of ${MAX_CONTENT_RESPONSE_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._response = value;
+    this._response = value2;
   }
   /**
    * Conversation context. Setting a value validates its byte length (max 100 MB).
@@ -1892,14 +2114,14 @@ var Content = class _Content {
   get context() {
     return this._context;
   }
-  set context(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_CONTEXT_LENGTH) {
+  set context(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_CONTEXT_LENGTH) {
       throw new AISecSDKException(
         `context exceeds max length of ${MAX_CONTENT_CONTEXT_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._context = value;
+    this._context = value2;
   }
   /**
    * Code prompt text. Setting a value validates its byte length (max 2 MB).
@@ -1914,14 +2136,14 @@ var Content = class _Content {
   get codePrompt() {
     return this._codePrompt;
   }
-  set codePrompt(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_PROMPT_LENGTH) {
+  set codePrompt(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_PROMPT_LENGTH) {
       throw new AISecSDKException(
         `codePrompt exceeds max length of ${MAX_CONTENT_PROMPT_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._codePrompt = value;
+    this._codePrompt = value2;
   }
   /**
    * Code response text. Setting a value validates its byte length (max 2 MB).
@@ -1936,14 +2158,14 @@ var Content = class _Content {
   get codeResponse() {
     return this._codeResponse;
   }
-  set codeResponse(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_RESPONSE_LENGTH) {
+  set codeResponse(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_RESPONSE_LENGTH) {
       throw new AISecSDKException(
         `codeResponse exceeds max length of ${MAX_CONTENT_RESPONSE_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._codeResponse = value;
+    this._codeResponse = value2;
   }
   /**
    * Tool/function call event data attached to the content.
@@ -1961,8 +2183,8 @@ var Content = class _Content {
   get toolEvent() {
     return this._toolEvent;
   }
-  set toolEvent(value) {
-    this._toolEvent = value;
+  set toolEvent(value2) {
+    this._toolEvent = value2;
   }
   /**
    * Total byte length of all text content fields.
@@ -3378,7 +3600,7 @@ var RuleEvaluationListSchema = import_zod32.z.object({
 }).passthrough();
 var ViolationRemediationSchema = import_zod32.z.object({
   steps: import_zod32.z.array(import_zod32.z.string()),
-  url: import_zod32.z.string()
+  url: import_zod32.z.string().optional()
 }).passthrough();
 var ViolationResponseSchema = import_zod32.z.object({
   uuid: import_zod32.z.string(),
@@ -3390,7 +3612,7 @@ var ViolationResponseSchema = import_zod32.z.object({
   rule_name: import_zod32.z.string(),
   rule_description: import_zod32.z.string(),
   rule_instance_state: import_zod32.z.string(),
-  remediation: ViolationRemediationSchema,
+  remediation: ViolationRemediationSchema.optional(),
   file: import_zod32.z.string().nullable().optional(),
   hash: import_zod32.z.string().nullable().optional(),
   module: import_zod32.z.string().nullable().optional(),
@@ -3442,12 +3664,12 @@ var ListModelSecurityRulesResponseSchema = import_zod32.z.object({
 var ModelSecurityRuleInstanceResponseSchema = import_zod32.z.object({
   uuid: import_zod32.z.string(),
   tsg_id: import_zod32.z.string(),
-  created_at: import_zod32.z.string(),
-  updated_at: import_zod32.z.string(),
+  created_at: import_zod32.z.string().optional(),
+  updated_at: import_zod32.z.string().optional(),
   security_group_uuid: import_zod32.z.string(),
-  security_rule_uuid: import_zod32.z.string(),
+  security_rule_uuid: import_zod32.z.string().optional(),
   state: import_zod32.z.string(),
-  rule: ModelSecurityRuleResponseSchema,
+  rule: ModelSecurityRuleResponseSchema.optional(),
   field_values: import_zod32.z.record(import_zod32.z.unknown()).optional()
 }).passthrough();
 var ModelSecurityRuleInstanceUpdateRequestSchema = import_zod32.z.object({
@@ -5436,6 +5658,472 @@ var GatewayAuditLogRecordSchema = import_zod35.z.object({
 }).passthrough();
 var GatewayAuditLogsResponseSchema = import_zod35.z.object({ records: import_zod35.z.array(GatewayAuditLogRecordSchema) }).passthrough();
+// src/models/ai-gateway-routing.ts
+var import_zod36 = require("zod");
+var AI_GATEWAY_DEPLOYMENT_TYPES = ["non_production", "production"];
+var GatewayDeploymentTypeSchema = import_zod36.z.enum(AI_GATEWAY_DEPLOYMENT_TYPES);
+var AI_GATEWAY_DEPLOYMENT_STATUSES = ["active", "archived"];
+var GatewayDeploymentStatusSchema = import_zod36.z.enum(AI_GATEWAY_DEPLOYMENT_STATUSES);
+var AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES = ["prompt", "resource", "tool"];
+var GatewayMutableMcpCapabilityTypeSchema = import_zod36.z.enum(
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES
+);
+var AI_GATEWAY_KNOWN_API_KEY_SCOPES = [
+  "agents.invoke",
+  "completions.write",
+  "logs.write",
+  "mcp.invoke",
+  "prompts.render"
+];
+var AI_GATEWAY_KNOWN_CACHE_MODES = ["semantic", "simple"];
+var AI_GATEWAY_KNOWN_CONFIG_STRATEGIES = ["fallback", "loadbalance", "single"];
+var AI_GATEWAY_KNOWN_MCP_AUTH_TYPES = [
+  "headers",
+  "none",
+  "oauth_auto",
+  "oauth_client_credentials"
+];
+var AI_GATEWAY_KNOWN_MCP_TRANSPORTS = ["http", "interactive", "sse"];
+var AI_GATEWAY_KNOWN_RATE_LIMIT_TYPES = ["requests", "tokens"];
+var AI_GATEWAY_KNOWN_RATE_LIMIT_UNITS = ["rpd", "rph", "rpm", "rps", "rpw"];
+var openValue = () => import_zod36.z.string().min(1);
+var GatewayApiKeyScopeSchema = openValue();
+var GatewayConfigCacheModeSchema = openValue();
+var GatewayConfigStrategySchema = openValue();
+var GatewayMcpAuthTypeSchema = openValue();
+var GatewayMcpTransportSchema = openValue();
+var GatewayRateLimitTypeSchema = openValue();
+var GatewayRateLimitUnitSchema = openValue();
+var unsafeJsonKeys = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isFiniteJsonValue(value2, ancestors = /* @__PURE__ */ new WeakSet()) {
+  if (value2 === null || typeof value2 === "string" || typeof value2 === "boolean" || typeof value2 === "number" && Number.isFinite(value2)) {
+    return true;
+  }
+  if (typeof value2 !== "object" || ancestors.has(value2)) return false;
+  if (Array.isArray(value2)) {
+    const keys = Object.keys(value2);
+    if (keys.length !== value2.length || keys.some((key, index) => key !== String(index)) || Object.getOwnPropertySymbols(value2).length > 0) {
+      return false;
+    }
+    ancestors.add(value2);
+    const valid2 = value2.every((item) => isFiniteJsonValue(item, ancestors));
+    ancestors.delete(value2);
+    return valid2;
+  }
+  const prototype = Object.getPrototypeOf(value2);
+  if (prototype !== Object.prototype && prototype !== null) return false;
+  if (Object.getOwnPropertySymbols(value2).length > 0) return false;
+  ancestors.add(value2);
+  const valid = Object.entries(Object.getOwnPropertyDescriptors(value2)).every(
+    ([key, descriptor]) => descriptor.enumerable === true && "value" in descriptor && !unsafeJsonKeys.has(key) && isFiniteJsonValue(descriptor.value, ancestors)
+  );
+  ancestors.delete(value2);
+  return valid;
+}
+var GatewayJsonValueSchema = import_zod36.z.custom(
+  (value2) => isFiniteJsonValue(value2),
+  "Expected a finite, prototype-safe JSON value"
+);
+var GatewayJsonObjectSchema = import_zod36.z.custom(
+  (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2) && isFiniteJsonValue(value2),
+  "Expected a finite, prototype-safe JSON object"
+);
+var GatewayRoutingRetrySchema = import_zod36.z.object({
+  attempts: import_zod36.z.number().int().min(0).optional(),
+  on_status_codes: import_zod36.z.array(import_zod36.z.number().int().min(100).max(599)).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayRoutingCacheSchema = import_zod36.z.object({
+  mode: GatewayConfigCacheModeSchema.optional(),
+  max_age: import_zod36.z.number().int().min(0).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayRoutingStrategySchema = import_zod36.z.object({ mode: GatewayConfigStrategySchema }).catchall(GatewayJsonValueSchema);
+var GatewayRoutingTargetSchema = import_zod36.z.object({
+  provider: import_zod36.z.string().min(1).optional(),
+  virtual_key: import_zod36.z.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayRoutingConfigSchema = import_zod36.z.object({
+  retry: GatewayRoutingRetrySchema.optional(),
+  cache: GatewayRoutingCacheSchema.optional(),
+  strategy: GatewayRoutingStrategySchema.optional(),
+  targets: import_zod36.z.array(GatewayRoutingTargetSchema).optional(),
+  provider: import_zod36.z.string().min(1).optional(),
+  virtual_key: import_zod36.z.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayOpenAIConfigurationSchema = import_zod36.z.object({
+  openai_organization: import_zod36.z.string().min(1).optional(),
+  openai_project: import_zod36.z.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayAzureDeploymentConfigurationSchema = import_zod36.z.object({
+  alias: import_zod36.z.string().min(1).optional(),
+  azure_api_version: import_zod36.z.string().min(1).max(30),
+  azure_deployment_name: import_zod36.z.string().min(1),
+  is_default: import_zod36.z.boolean().optional(),
+  azure_model_slug: import_zod36.z.string().min(1)
+}).catchall(GatewayJsonValueSchema);
+var azureAuthModeSchema = import_zod36.z.enum(["default", "entra", "managed"]);
+var GatewayAzureOpenAIConfigurationSchema = import_zod36.z.object({
+  azure_auth_mode: azureAuthModeSchema,
+  azure_resource_name: import_zod36.z.string().min(1),
+  azure_deployment_config: import_zod36.z.array(GatewayAzureDeploymentConfigurationSchema).min(1),
+  azure_entra_tenant_id: import_zod36.z.string().min(1).optional(),
+  azure_entra_client_id: import_zod36.z.string().min(1).optional(),
+  azure_entra_client_secret: import_zod36.z.string().min(1).optional(),
+  azure_managed_client_id: import_zod36.z.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayBedrockConfigurationSchema = import_zod36.z.object({
+  aws_auth_type: import_zod36.z.enum(["accessKey", "assumedRole"]),
+  aws_region: import_zod36.z.string().min(1),
+  aws_access_key_id: import_zod36.z.string().min(1).optional(),
+  aws_secret_access_key: import_zod36.z.string().min(1).optional(),
+  aws_role_arn: import_zod36.z.string().min(1).optional(),
+  aws_external_id: import_zod36.z.string().min(1).nullable().optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewaySageMakerConfigurationSchema = GatewayBedrockConfigurationSchema.extend({
+  amzn_sagemaker_custom_attributes: import_zod36.z.string().optional(),
+  amzn_sagemaker_target_model: import_zod36.z.string().optional(),
+  amzn_sagemaker_target_variant: import_zod36.z.string().optional(),
+  amzn_sagemaker_target_container_hostname: import_zod36.z.string().optional(),
+  amzn_sagemaker_inference_id: import_zod36.z.string().optional(),
+  amzn_sagemaker_enable_explanations: import_zod36.z.string().optional(),
+  amzn_sagemaker_inference_component: import_zod36.z.string().optional(),
+  amzn_sagemaker_session_id: import_zod36.z.string().optional(),
+  amzn_sagemaker_model_name: import_zod36.z.string().optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayVertexAIConfigurationSchema = import_zod36.z.object({
+  vertex_auth_type: import_zod36.z.enum(["basic", "serviceAccount"]),
+  vertex_region: import_zod36.z.string().min(1),
+  vertex_project_id: import_zod36.z.string().min(1).optional(),
+  vertex_service_account_json: GatewayJsonObjectSchema.optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayAzureAIConfigurationSchema = import_zod36.z.object({
+  azure_auth_mode: azureAuthModeSchema,
+  azure_foundry_url: import_zod36.z.string().url(),
+  azure_api_version: import_zod36.z.string().min(1).max(30).optional(),
+  azure_deployment_name: import_zod36.z.string().min(1).optional(),
+  azure_entra_tenant_id: import_zod36.z.string().min(1).optional(),
+  azure_entra_client_id: import_zod36.z.string().min(1).optional(),
+  azure_entra_client_secret: import_zod36.z.string().min(1).optional(),
+  azure_managed_client_id: import_zod36.z.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayWorkersAIConfigurationSchema = import_zod36.z.object({ workers_ai_account_id: import_zod36.z.string().min(1) }).catchall(GatewayJsonValueSchema);
+var GatewayHuggingFaceConfigurationSchema = import_zod36.z.object({ huggingface_base_url: import_zod36.z.string().url().optional() }).catchall(GatewayJsonValueSchema);
+var GatewayCortexConfigurationSchema = import_zod36.z.object({ snowflake_account: import_zod36.z.string().min(1) }).catchall(GatewayJsonValueSchema);
+var GatewayCustomHostConfigurationSchema = import_zod36.z.object({
+  custom_host: import_zod36.z.string().url().optional(),
+  custom_headers: import_zod36.z.record(import_zod36.z.string()).optional()
+}).catchall(GatewayJsonValueSchema);
+// src/models/ai-gateway-requests.ts
+var import_zod37 = require("zod");
+var nonEmptyString = import_zod37.z.string().min(1);
+var uuid = import_zod37.z.string().uuid();
+var numericId = import_zod37.z.string().regex(/^\d+$/, "Expected a numeric-string TSG id");
+var workspaceRef = import_zod37.z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/);
+var dateTime = import_zod37.z.string().datetime({ offset: true });
+var nonEmptyObject = (schema, message = "Provide at least one field") => schema.refine((body) => Object.keys(body).length > 0, { message });
+var GatewayRateLimitInputSchema = import_zod37.z.object({
+  type: GatewayRateLimitTypeSchema,
+  unit: GatewayRateLimitUnitSchema,
+  value: import_zod37.z.number().int().min(0)
+}).strict();
+var GatewayUsageLimitInputSchema = nonEmptyObject(
+  import_zod37.z.object({
+    credit_limit: import_zod37.z.number().min(0).optional(),
+    type: import_zod37.z.enum(["cost", "tokens"]).optional(),
+    alert_threshold: import_zod37.z.number().min(0).optional(),
+    periodic_reset: import_zod37.z.enum(["monthly", "weekly"]).nullable().optional(),
+    periodic_reset_days: import_zod37.z.number().int().min(1).max(365).nullable().optional(),
+    next_usage_reset_at: dateTime.nullable().optional()
+  }).strict()
+).refine(
+  (value2) => value2.periodic_reset == null || value2.periodic_reset_days == null,
+  "periodic_reset and periodic_reset_days are mutually exclusive"
+);
+var GatewayDefaultsInputSchema = import_zod37.z.object({
+  metadata: import_zod37.z.record(GatewayJsonValueSchema).optional(),
+  config_id: nonEmptyString.optional(),
+  allow_config_override: import_zod37.z.boolean().optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewaySecretMappingSchema = import_zod37.z.object({
+  target_field: nonEmptyString,
+  secret_reference_id: nonEmptyString,
+  secret_key: nonEmptyString.nullable().optional(),
+  value_format: import_zod37.z.enum(["json", "string"]).nullable().optional()
+}).strict();
+var GatewayGlobalWorkspaceAccessInputSchema = import_zod37.z.object({
+  enabled: import_zod37.z.boolean(),
+  usage_limits: import_zod37.z.array(GatewayUsageLimitInputSchema).max(1).nullable().optional(),
+  rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).max(1).nullable().optional()
+}).strict();
+var GatewayWorkspaceBindingSchema = import_zod37.z.object({
+  id: workspaceRef,
+  enabled: import_zod37.z.boolean(),
+  usage_limits: import_zod37.z.array(GatewayUsageLimitInputSchema).max(1).nullable().optional(),
+  rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).max(1).nullable().optional(),
+  reset_usage: import_zod37.z.boolean().optional(),
+  create_default_provider: import_zod37.z.boolean().optional(),
+  default_provider_slug: nonEmptyString.optional()
+}).strict();
+var GatewayWorkspaceCreateRequestSchema = import_zod37.z.object({
+  name: nonEmptyString,
+  scope_name: nonEmptyString,
+  description: import_zod37.z.string().optional(),
+  icon: import_zod37.z.string().optional(),
+  defaults: GatewayDefaultsInputSchema.optional(),
+  users: import_zod37.z.array(nonEmptyString).optional(),
+  usage_limits: import_zod37.z.array(GatewayUsageLimitInputSchema).optional(),
+  rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).optional()
+}).strict();
+var GatewayWorkspaceUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    description: import_zod37.z.string().optional(),
+    icon: import_zod37.z.string().optional(),
+    defaults: GatewayDefaultsInputSchema.optional(),
+    usage_limits: import_zod37.z.array(GatewayUsageLimitInputSchema).optional(),
+    rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).optional()
+  }).strict()
+);
+var GatewayConfigCreateRequestSchema = import_zod37.z.object({
+  name: nonEmptyString,
+  workspace_id: uuid,
+  config: GatewayRoutingConfigSchema
+}).strict();
+var GatewayConfigUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    workspace_id: uuid.optional(),
+    config: GatewayRoutingConfigSchema.optional(),
+    status: nonEmptyString.optional()
+  }).strict()
+);
+var GatewayGuardrailCheckSchema = import_zod37.z.object({
+  id: nonEmptyString,
+  parameters: GatewayJsonObjectSchema.optional(),
+  is_enabled: import_zod37.z.boolean().optional(),
+  name: nonEmptyString.optional()
+}).strict();
+var feedbackSchema = import_zod37.z.object({
+  value: import_zod37.z.number(),
+  weight: import_zod37.z.number(),
+  metadata: import_zod37.z.string()
+}).catchall(GatewayJsonValueSchema);
+var actionResultSchema = import_zod37.z.object({ feedback: feedbackSchema.optional() }).catchall(GatewayJsonValueSchema);
+var GatewayGuardrailActionsSchema = nonEmptyObject(
+  import_zod37.z.object({
+    deny: import_zod37.z.boolean().optional(),
+    async: import_zod37.z.boolean().optional(),
+    on_success: actionResultSchema.optional(),
+    on_fail: actionResultSchema.optional()
+  }).catchall(GatewayJsonValueSchema)
+);
+var GatewayGuardrailCreateRequestSchema = import_zod37.z.object({
+  workspace_id: uuid,
+  name: nonEmptyString,
+  checks: import_zod37.z.array(GatewayGuardrailCheckSchema).min(1),
+  actions: GatewayGuardrailActionsSchema
+}).strict();
+var GatewayGuardrailUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    checks: import_zod37.z.array(GatewayGuardrailCheckSchema).min(1).optional(),
+    actions: GatewayGuardrailActionsSchema.optional()
+  }).strict()
+);
+var GatewayProviderCreateRequestSchema = import_zod37.z.object({
+  workspace_id: uuid,
+  ai_provider_id: uuid,
+  name: nonEmptyString,
+  integration_id: uuid,
+  slug: nonEmptyString,
+  note: import_zod37.z.string().nullable().optional(),
+  usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+  rate_limits: GatewayRateLimitInputSchema.nullable().optional(),
+  expires_at: dateTime.nullable().optional()
+}).strict();
+var GatewayProviderUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    note: import_zod37.z.string().nullable().optional(),
+    usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+    rate_limits: GatewayRateLimitInputSchema.nullable().optional(),
+    expires_at: dateTime.nullable().optional(),
+    reset_usage: import_zod37.z.boolean().optional()
+  }).strict()
+);
+var GatewayApiKeyRotationPolicySchema = nonEmptyObject(
+  import_zod37.z.object({
+    rotation_period: import_zod37.z.enum(["monthly", "weekly"]).nullable().optional(),
+    next_rotation_at: dateTime.nullable().optional(),
+    key_transition_period_ms: import_zod37.z.number().int().min(18e5).optional()
+  }).strict()
+).refine(
+  (value2) => value2.rotation_period == null || value2.next_rotation_at == null,
+  "rotation_period and next_rotation_at are mutually exclusive"
+);
+var apiKeyMutableFields = {
+  name: nonEmptyString,
+  description: import_zod37.z.string().optional(),
+  scopes: import_zod37.z.array(GatewayApiKeyScopeSchema).min(1),
+  rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).nullable().optional(),
+  usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+  defaults: GatewayDefaultsInputSchema.nullable().optional(),
+  alert_emails: import_zod37.z.array(import_zod37.z.string().email()).optional(),
+  expires_at: dateTime.nullable().optional(),
+  rotation_policy: GatewayApiKeyRotationPolicySchema.nullable().optional()
+};
+var serviceApiKeyCreateFields = {
+  ...apiKeyMutableFields,
+  organisation_id: numericId,
+  workspace_id: uuid,
+  type: nonEmptyString
+};
+var GatewayServiceApiKeyCreateRequestSchema = import_zod37.z.object(serviceApiKeyCreateFields).strict();
+var GatewayUserApiKeyCreateRequestSchema = import_zod37.z.object({ ...serviceApiKeyCreateFields, user_id: uuid }).strict();
+var GatewayApiKeyCreateRequestSchema = import_zod37.z.union([
+  GatewayUserApiKeyCreateRequestSchema,
+  GatewayServiceApiKeyCreateRequestSchema
+]);
+var GatewayApiKeyUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    description: import_zod37.z.string().optional(),
+    scopes: import_zod37.z.array(GatewayApiKeyScopeSchema).min(1).optional(),
+    rate_limits: import_zod37.z.array(GatewayRateLimitInputSchema).nullable().optional(),
+    usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+    reset_usage: import_zod37.z.boolean().optional(),
+    defaults: GatewayDefaultsInputSchema.nullable().optional(),
+    alert_emails: import_zod37.z.array(import_zod37.z.string().email()).optional(),
+    expires_at: dateTime.nullable().optional(),
+    rotation_policy: GatewayApiKeyRotationPolicySchema.nullable().optional()
+  }).strict()
+);
+var GatewayApiKeyRotateRequestSchema = import_zod37.z.object({ key_transition_period_ms: import_zod37.z.number().int().min(18e5).optional() }).strict();
+var GatewayIntegrationCreateRequestSchema = import_zod37.z.object({
+  organisation_id: numericId,
+  ai_provider_id: uuid,
+  name: nonEmptyString,
+  slug: nonEmptyString,
+  description: import_zod37.z.string().optional(),
+  configurations: GatewayJsonObjectSchema.optional(),
+  key: nonEmptyString.optional(),
+  secret_mappings: import_zod37.z.array(GatewaySecretMappingSchema).optional()
+}).strict();
+var GatewayIntegrationUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    description: import_zod37.z.string().optional(),
+    configurations: GatewayJsonObjectSchema.optional(),
+    key: nonEmptyString.optional(),
+    secret_mappings: import_zod37.z.array(GatewaySecretMappingSchema).optional()
+  }).strict()
+);
+var GatewayIntegrationModelUpdateSchema = import_zod37.z.object({
+  slug: nonEmptyString,
+  enabled: import_zod37.z.boolean(),
+  is_custom: import_zod37.z.boolean().nullable().optional(),
+  is_finetune: import_zod37.z.boolean().nullable().optional(),
+  base_model_slug: nonEmptyString.nullable().optional(),
+  configurations: GatewayJsonObjectSchema.optional(),
+  pricing_config: GatewayJsonObjectSchema.optional()
+}).strict();
+var GatewayIntegrationModelsBulkUpdateRequestSchema = import_zod37.z.object({
+  models: import_zod37.z.array(GatewayIntegrationModelUpdateSchema).min(1),
+  allow_all_models: import_zod37.z.boolean().optional()
+}).strict();
+var GatewayIntegrationWorkspacesBulkUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    workspaces: import_zod37.z.array(GatewayWorkspaceBindingSchema).optional(),
+    global_workspace_access: GatewayGlobalWorkspaceAccessInputSchema.optional(),
+    override_existing_workspace_access: import_zod37.z.boolean().optional(),
+    create_default_provider: import_zod37.z.boolean().optional(),
+    default_provider_slug: nonEmptyString.optional()
+  }).strict()
+);
+var McpIntegrationCreateRequestSchema = import_zod37.z.object({
+  name: nonEmptyString,
+  organisation_id: numericId,
+  slug: nonEmptyString,
+  url: import_zod37.z.string().url(),
+  auth_type: GatewayMcpAuthTypeSchema,
+  transport: GatewayMcpTransportSchema,
+  description: import_zod37.z.string().nullable().optional(),
+  configurations: GatewayJsonObjectSchema.optional(),
+  secret_mappings: import_zod37.z.array(GatewaySecretMappingSchema).optional()
+}).strict();
+var McpIntegrationUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    description: import_zod37.z.string().nullable().optional(),
+    configurations: GatewayJsonObjectSchema.optional(),
+    url: import_zod37.z.string().url().optional(),
+    auth_type: GatewayMcpAuthTypeSchema.optional(),
+    transport: GatewayMcpTransportSchema.optional(),
+    secret_mappings: import_zod37.z.array(GatewaySecretMappingSchema).optional()
+  }).strict()
+);
+var McpIntegrationCapabilityUpdateSchema = import_zod37.z.object({
+  name: nonEmptyString,
+  type: GatewayMutableMcpCapabilityTypeSchema,
+  enabled: import_zod37.z.boolean()
+}).strict();
+var McpIntegrationCapabilitiesBulkUpdateRequestSchema = import_zod37.z.object({ capabilities: import_zod37.z.array(McpIntegrationCapabilityUpdateSchema).min(1) }).strict();
+var McpIntegrationWorkspacesBulkUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    workspaces: import_zod37.z.array(import_zod37.z.object({ id: workspaceRef, enabled: import_zod37.z.boolean() }).strict()).optional(),
+    global_workspace_access: import_zod37.z.object({ enabled: import_zod37.z.boolean() }).strict().nullable().optional(),
+    override_existing_workspace_access: import_zod37.z.boolean().optional()
+  }).strict()
+);
+var GatewayDeploymentAuthSettingsInputSchema = import_zod37.z.object({
+  gateway_base_url: import_zod37.z.string().url().optional(),
+  mcp_gateway_base_url: import_zod37.z.string().url().optional(),
+  is_dataservice_hosted: import_zod37.z.union([import_zod37.z.literal(0), import_zod37.z.literal(1)]).optional(),
+  is_playground_proxy_allowed: import_zod37.z.union([import_zod37.z.literal(0), import_zod37.z.literal(1)]).optional(),
+  workspaces_allowed: import_zod37.z.array(workspaceRef).optional(),
+  jwt_subs_allowed: import_zod37.z.array(nonEmptyString).optional(),
+  jwt_sub_workspace_mapping: import_zod37.z.record(workspaceRef).optional(),
+  allow_all_workspaces: import_zod37.z.boolean().optional(),
+  remove_workspaces_allowed: import_zod37.z.array(workspaceRef).optional(),
+  remove_subs_allowed: import_zod37.z.array(nonEmptyString).optional()
+}).strict();
+var GatewayDeploymentCreateRequestSchema = import_zod37.z.object({
+  name: nonEmptyString,
+  type: GatewayDeploymentTypeSchema,
+  organisation_id: numericId,
+  auth_settings: GatewayDeploymentAuthSettingsInputSchema.optional(),
+  deployment_config: GatewayJsonObjectSchema.optional(),
+  is_default: import_zod37.z.boolean().optional(),
+  slug: nonEmptyString.optional()
+}).strict();
+var GatewayDeploymentUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    name: nonEmptyString.optional(),
+    type: GatewayDeploymentTypeSchema.optional(),
+    status: GatewayDeploymentStatusSchema.optional(),
+    deployment_config: GatewayJsonObjectSchema.nullable().optional(),
+    is_default: import_zod37.z.boolean().optional(),
+    rotate_auth: import_zod37.z.boolean().optional(),
+    override_existing: import_zod37.z.boolean().optional(),
+    auth_settings: GatewayDeploymentAuthSettingsInputSchema.optional()
+  }).strict()
+);
+var GatewayPluginCreateRequestSchema = import_zod37.z.object({
+  organisation_id: numericId,
+  integration_id: uuid,
+  credentials: import_zod37.z.record(import_zod37.z.string().min(1)).refine((value2) => Object.keys(value2).length > 0)
+}).strict();
+var GatewayOrganisationUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({ name: nonEmptyString.optional() }).catchall(GatewayJsonValueSchema)
+);
+var GatewayOrganisationAuthSettingsUpdateRequestSchema = nonEmptyObject(
+  import_zod37.z.object({
+    auth_settings: GatewayJsonObjectSchema.optional(),
+    domains: import_zod37.z.array(nonEmptyString).optional(),
+    scim_token: nonEmptyString.optional()
+  }).catchall(GatewayJsonValueSchema)
+);
 // src/http/auth/oauth.ts
 var OAuthAuth = class {
   constructor(oauthClient) {
@@ -5458,12 +6146,12 @@ var OAuthAuth = class {
 };
 // src/models/oauth-token.ts
-var import_zod36 = require("zod");
-var OAuthTokenResponseSchema = import_zod36.z.object({
-  access_token: import_zod36.z.string(),
-  token_type: import_zod36.z.string().optional(),
-  expires_in: import_zod36.z.number(),
-  scope: import_zod36.z.string().optional()
+var import_zod38 = require("zod");
+var OAuthTokenResponseSchema = import_zod38.z.object({
+  access_token: import_zod38.z.string(),
+  token_type: import_zod38.z.string().optional(),
+  expires_in: import_zod38.z.number(),
+  scope: import_zod38.z.string().optional()
 }).passthrough();
 // src/management/oauth-client.ts
@@ -5681,26 +6369,26 @@ function resolveOAuthConfig(opts) {
 }
 // src/validators.ts
-function assertUuid(value, fieldName) {
-  if (!isValidUuid(value)) {
+function assertUuid(value2, fieldName) {
+  if (!isValidUuid(value2)) {
     throw new AISecSDKException(
-      `Invalid ${fieldName}: ${value}`,
+      `Invalid ${fieldName}: ${value2}`,
       "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
     );
   }
 }
-function assertWorkspaceRef(value, fieldName) {
-  if (!isValidUuid(value) && !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value)) {
+function assertWorkspaceRef(value2, fieldName) {
+  if (!isValidUuid(value2) && !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value2)) {
     throw new AISecSDKException(
-      `Invalid ${fieldName}: ${value} (expected a workspace UUID or slug)`,
+      `Invalid ${fieldName}: ${value2} (expected a workspace UUID or slug)`,
       "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
     );
   }
 }
-function assertNumericId(value, fieldName) {
-  if (!/^\d+$/.test(value)) {
+function assertNumericId(value2, fieldName) {
+  if (!/^\d+$/.test(value2)) {
     throw new AISecSDKException(
-      `Invalid ${fieldName}: ${value}`,
+      `Invalid ${fieldName}: ${value2}`,
       "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
     );
   }
@@ -6569,7 +7257,7 @@ var ScanLogsClient = class {
 };
 // src/management/oauth-management.ts
-var import_zod37 = require("zod");
+var import_zod39 = require("zod");
 var OAuthManagementClient = class {
   baseUrl;
   auth;
@@ -6603,7 +7291,7 @@ var OAuthManagementClient = class {
       path: MGMT_OAUTH_INVALIDATE_PATH,
       params: { token },
       body,
-      responseSchema: import_zod37.z.string(),
+      responseSchema: import_zod39.z.string(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7667,12 +8355,12 @@ var ModelSecurityScansClient = class {
    * // { uuid: '550e8400-...', eval_outcome: 'ALLOWED', model_uri: 'hf://org/model', ... }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "scan uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "scan uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SCANS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SCANS_PATH}/${uuid2}`,
       responseSchema: ScanBaseResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7909,12 +8597,12 @@ var ModelSecurityScansClient = class {
    * // { uuid: '660e8400-...', rule_name: 'Pickle Scan', result: 'FAILED', violation_count: 2, ... }
    * ```
    */
-  async getEvaluation(uuid) {
-    assertUuid(uuid, "evaluation uuid");
+  async getEvaluation(uuid2) {
+    assertUuid(uuid2, "evaluation uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_EVALUATIONS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_EVALUATIONS_PATH}/${uuid2}`,
       responseSchema: RuleEvaluationResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7934,12 +8622,12 @@ var ModelSecurityScansClient = class {
    * // { uuid: '660e8400-...', rule_name: 'Pickle Scan', description: 'Unsafe pickle opcode', ... }
    * ```
    */
-  async getViolation(uuid) {
-    assertUuid(uuid, "violation uuid");
+  async getViolation(uuid2) {
+    assertUuid(uuid2, "violation uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_VIOLATIONS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_VIOLATIONS_PATH}/${uuid2}`,
       responseSchema: ViolationResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8052,12 +8740,12 @@ var ModelSecurityGroupsClient = class {
    * // { uuid: '550e8400-...', name: 'hf-strict', source_type: 'HUGGING_FACE', state: 'ACTIVE', ... }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "security group uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "security group uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid2}`,
       responseSchema: ModelSecurityGroupResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8081,12 +8769,12 @@ var ModelSecurityGroupsClient = class {
    * // { uuid: '550e8400-...', name: 'hf-strict-v2', state: 'ACTIVE', ... }
    * ```
    */
-  async update(uuid, body) {
-    assertUuid(uuid, "security group uuid");
+  async update(uuid2, body) {
+    assertUuid(uuid2, "security group uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid2}`,
       body,
       responseSchema: ModelSecurityGroupResponseSchema,
       auth: this.auth,
@@ -8106,12 +8794,12 @@ var ModelSecurityGroupsClient = class {
    * // resolves to undefined on success
    * ```
    */
-  async delete(uuid) {
-    assertUuid(uuid, "security group uuid");
+  async delete(uuid2) {
+    assertUuid(uuid2, "security group uuid");
     await request({
       method: "DELETE",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid2}`,
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8274,12 +8962,12 @@ var ModelSecurityRulesClient = class {
    * // { uuid: '550e8400-...', name: 'Pickle Scan', rule_type: 'ARTIFACT', default_state: 'BLOCKING', ... }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "security rule uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "security rule uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_RULES_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_RULES_PATH}/${uuid2}`,
       responseSchema: ModelSecurityRuleResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8360,12 +9048,12 @@ var ModelSecurityModelsClient = class {
    * // { uuid: '550e8400-...', name: 'org/model', latest_version_uuid: '660e8400-...', latest_version_outcome: 'PASSED' }
    * ```
    */
-  async getModel(uuid) {
-    assertUuid(uuid, "model uuid");
+  async getModel(uuid2) {
+    assertUuid(uuid2, "model uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_MODELS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_MODELS_PATH}/${uuid2}`,
       responseSchema: ModelResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8423,12 +9111,12 @@ var ModelSecurityModelsClient = class {
    * // { uuid: '660e8400-...', revision: 'main', model_uuid: '550e8400-...', last_eval_outcome: 'PASSED' }
    * ```
    */
-  async getModelVersion(uuid) {
-    assertUuid(uuid, "model version uuid");
+  async getModelVersion(uuid2) {
+    assertUuid(uuid2, "model version uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${uuid2}`,
       responseSchema: ModelVersionResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8541,7 +9229,7 @@ var ModelSecurityClient = class {
 };
 // src/red-team/scans-client.ts
-var import_zod38 = require("zod");
+var import_zod40 = require("zod");
 var RedTeamScansClient = class {
   baseUrl;
   auth;
@@ -8685,7 +9373,7 @@ var RedTeamScansClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: RED_TEAM_CATEGORIES_PATH,
-      responseSchema: import_zod38.z.array(CategoryModelSchema),
+      responseSchema: import_zod40.z.array(CategoryModelSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8693,7 +9381,7 @@ var RedTeamScansClient = class {
 };
 // src/red-team/reports-client.ts
-var import_zod39 = require("zod");
+var import_zod41 = require("zod");
 var RedTeamReportsClient = class {
   baseUrl;
   auth;
@@ -9068,7 +9756,7 @@ var RedTeamReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/download`,
       params: { file_format: format },
-      responseSchema: import_zod39.z.unknown(),
+      responseSchema: import_zod41.z.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9092,7 +9780,7 @@ var RedTeamReportsClient = class {
       method: "POST",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/generate-partial-report`,
-      responseSchema: import_zod39.z.unknown(),
+      responseSchema: import_zod41.z.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9100,7 +9788,7 @@ var RedTeamReportsClient = class {
 };
 // src/red-team/custom-attack-reports-client.ts
-var import_zod40 = require("zod");
+var import_zod42 = require("zod");
 var RedTeamCustomAttackReportsClient = class {
   baseUrl;
   auth;
@@ -9190,7 +9878,7 @@ var RedTeamCustomAttackReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/report/${jobId}/prompt-set/${promptSetId}/prompts`,
       params,
-      responseSchema: import_zod40.z.array(PromptDetailResponseSchema),
+      responseSchema: import_zod42.z.array(PromptDetailResponseSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9284,7 +9972,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/attack/${attackId}/list-outputs`,
-      responseSchema: import_zod40.z.array(CustomAttackOutputSchema),
+      responseSchema: import_zod42.z.array(CustomAttackOutputSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9309,7 +9997,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/property-stats`,
-      responseSchema: import_zod40.z.array(PropertyStatisticSchema),
+      responseSchema: import_zod42.z.array(PropertyStatisticSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9317,7 +10005,7 @@ var RedTeamCustomAttackReportsClient = class {
 };
 // src/red-team/targets-client.ts
-var import_zod41 = require("zod");
+var import_zod43 = require("zod");
 var RedTeamTargetsClient = class {
   baseUrl;
   auth;
@@ -9431,12 +10119,12 @@ var RedTeamTargetsClient = class {
    * // { uuid: '550e8400-...', name: 'prod-chatbot', status: 'READY', active: true, validated: true }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "target uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}`,
       responseSchema: TargetResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -9462,14 +10150,14 @@ var RedTeamTargetsClient = class {
    * // { uuid: '550e8400-...', name: 'prod-chatbot-v2', status: 'READY', updated_at: '2026-03-08T10:00:00Z' }
    * ```
    */
-  async update(uuid, body, opts) {
-    assertUuid(uuid, "target uuid");
+  async update(uuid2, body, opts) {
+    assertUuid(uuid2, "target uuid");
     const params = {};
     if (opts?.validate !== void 0) params.validate = String(opts.validate);
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}`,
       body,
       params: Object.keys(params).length > 0 ? params : void 0,
       responseSchema: TargetResponseSchema,
@@ -9491,12 +10179,12 @@ var RedTeamTargetsClient = class {
    * // { message: 'ok', status: 200 }
    * ```
    */
-  async delete(uuid) {
-    assertUuid(uuid, "target uuid");
+  async delete(uuid2) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "DELETE",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}`,
       responseSchema: BaseResponseSchema.optional(),
       allowEmptyBody: true,
       auth: this.auth,
@@ -9546,12 +10234,12 @@ var RedTeamTargetsClient = class {
    * // { target_id: '550e8400-...', target_version: 1, status: 'READY' }
    * ```
    */
-  async getProfile(uuid) {
-    assertUuid(uuid, "target uuid");
+  async getProfile(uuid2) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}/profile`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}/profile`,
       responseSchema: TargetProfileResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -9575,12 +10263,12 @@ var RedTeamTargetsClient = class {
    * // { uuid: '550e8400-...', name: 'prod-chatbot', status: 'READY' }
    * ```
    */
-  async updateProfile(uuid, body) {
-    assertUuid(uuid, "target uuid");
+  async updateProfile(uuid2, body) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}/profile`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}/profile`,
       body,
       responseSchema: TargetResponseSchema,
       auth: this.auth,
@@ -9633,7 +10321,7 @@ var RedTeamTargetsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_TEMPLATE_PATH}/target-metadata`,
-      responseSchema: import_zod41.z.record(import_zod41.z.unknown()),
+      responseSchema: import_zod43.z.record(import_zod43.z.unknown()),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -9754,12 +10442,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks', status: 'READY', active: true, archive: false }
    * ```
    */
-  async getPromptSet(uuid) {
-    assertUuid(uuid, "prompt set uuid");
+  async getPromptSet(uuid2) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}`,
       responseSchema: CustomPromptSetResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -9782,12 +10470,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks-v2', status: 'READY', active: true }
    * ```
    */
-  async updatePromptSet(uuid, body) {
-    assertUuid(uuid, "prompt set uuid");
+  async updatePromptSet(uuid2, body) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}`,
       body,
       responseSchema: CustomPromptSetResponseSchema,
       auth: this.auth,
@@ -9811,12 +10499,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks', status: 'READY', archive: true }
    * ```
    */
-  async archivePromptSet(uuid, body) {
-    assertUuid(uuid, "prompt set uuid");
+  async archivePromptSet(uuid2, body) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}/archive`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}/archive`,
       body,
       responseSchema: CustomPromptSetResponseSchema,
       auth: this.auth,
@@ -9837,12 +10525,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks', status: 'READY', active: true, tsg_id: 'tsg-1' }
    * ```
    */
-  async getPromptSetReference(uuid) {
-    assertUuid(uuid, "prompt set uuid");
+  async getPromptSetReference(uuid2) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}/reference`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}/reference`,
       responseSchema: CustomPromptSetReferenceSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -9863,14 +10551,14 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', status: 'READY', is_latest: true, version: 'gen-12345' }
    * ```
    */
-  async getPromptSetVersionInfo(uuid, opts) {
-    assertUuid(uuid, "prompt set uuid");
+  async getPromptSetVersionInfo(uuid2, opts) {
+    assertUuid(uuid2, "prompt set uuid");
     const params = {};
     if (opts?.version !== void 0) params.version = opts.version;
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}/version-info`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}/version-info`,
       params: Object.keys(params).length > 0 ? params : void 0,
       responseSchema: CustomPromptSetVersionInfoSchema,
       auth: this.auth,
@@ -9918,10 +10606,10 @@ var RedTeamCustomAttacksClient = class {
    * // 'prompt,goal,category,severity\n'
    * ```
    */
-  async downloadTemplate(uuid) {
-    assertUuid(uuid, "prompt set uuid");
+  async downloadTemplate(uuid2) {
+    assertUuid(uuid2, "prompt set uuid");
     const url = new URL(
-      `${this.baseUrl.replace(/\/+$/, "")}${RED_TEAM_CUSTOM_ATTACK_PATH}/download-template/${uuid}`
+      `${this.baseUrl.replace(/\/+$/, "")}${RED_TEAM_CUSTOM_ATTACK_PATH}/download-template/${uuid2}`
     );
     const stub = {
       method: "GET",
@@ -10822,12 +11510,12 @@ var RedTeamAdaptersClient = class {
    * // adapter.status => 'ACTIVE'
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "adapter uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "adapter uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid2}`,
       responseSchema: AdapterResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -10855,13 +11543,13 @@ var RedTeamAdaptersClient = class {
    * });
    * ```
    */
-  async update(uuid, body, opts) {
-    assertUuid(uuid, "adapter uuid");
+  async update(uuid2, body, opts) {
+    assertUuid(uuid2, "adapter uuid");
     const validate = opts?.validate ?? true;
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid2}`,
       params: { validate: String(validate) },
       body,
       responseSchema: AdapterResponseSchema,
@@ -10877,12 +11565,12 @@ var RedTeamAdaptersClient = class {
    * await rt.adapters.delete('550e8400-e29b-41d4-a716-446655440000');
    * ```
    */
-  async delete(uuid) {
-    assertUuid(uuid, "adapter uuid");
+  async delete(uuid2) {
+    assertUuid(uuid2, "adapter uuid");
     return request({
       method: "DELETE",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid2}`,
       responseSchema: BaseResponseSchema.optional(),
       allowEmptyBody: true,
       auth: this.auth,
@@ -11751,12 +12439,12 @@ var AIGatewayWorkspacesClient = class {
    * const other = await gw.workspaces.get('ws-produc-985697', { plane: 'admin' });
    * ```
    */
-  async get(workspaceRef, options = {}) {
-    assertWorkspaceRef(workspaceRef, "workspaceRef");
+  async get(workspaceRef2, options = {}) {
+    assertWorkspaceRef(workspaceRef2, "workspaceRef");
     return request({
       method: "GET",
       baseUrl: this.urlFor(options.plane),
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef2}`,
       responseSchema: GatewayWorkspaceDetailSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11785,17 +12473,12 @@ var AIGatewayWorkspacesClient = class {
    * ```
    */
   async create(body) {
-    if (!body.name) {
-      throw new AISecSDKException("Missing name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
-    }
-    if (!body.scope_name) {
-      throw new AISecSDKException("Missing scope_name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
-    }
     return request({
       method: "POST",
       baseUrl: this.adminBaseUrl,
       path: AI_GW_WORKSPACES_PATH,
       body,
+      requestSchema: GatewayWorkspaceCreateRequestSchema,
       responseSchema: GatewayWorkspaceCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11820,19 +12503,14 @@ var AIGatewayWorkspacesClient = class {
    * });
    * ```
    */
-  async update(workspaceRef, body) {
-    assertWorkspaceRef(workspaceRef, "workspaceRef");
-    if (Object.keys(body).length === 0) {
-      throw new AISecSDKException(
-        "Empty update: provide at least one of name, description, icon, defaults, usage_limits, rate_limits",
-        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
-      );
-    }
+  async update(workspaceRef2, body) {
+    assertWorkspaceRef(workspaceRef2, "workspaceRef");
     return request({
       method: "PUT",
       baseUrl: this.adminBaseUrl,
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef2}`,
       body,
+      requestSchema: GatewayWorkspaceUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11863,12 +12541,12 @@ var AIGatewayWorkspacesClient = class {
    * const gone = await gw.workspaces.list({ plane: 'admin', status: 'archived' });
    * ```
    */
-  async delete(workspaceRef) {
-    assertWorkspaceRef(workspaceRef, "workspaceRef");
+  async delete(workspaceRef2) {
+    assertWorkspaceRef(workspaceRef2, "workspaceRef");
     return request({
       method: "DELETE",
       baseUrl: this.adminBaseUrl,
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef2}`,
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -11994,6 +12672,7 @@ var AIGatewayConfigsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_CONFIGS_PATH,
       body,
+      requestSchema: GatewayConfigCreateRequestSchema,
       responseSchema: GatewayConfigCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12002,7 +12681,7 @@ var AIGatewayConfigsClient = class {
   /**
    * Update a config.
    * @param configId - Config UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update. A supplied `config` replaces the routing document.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12018,12 +12697,12 @@ var AIGatewayConfigsClient = class {
    */
   async update(configId, body) {
     assertUuid(configId, "configId");
-    assertUuid(body.workspace_id, "workspace_id");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
       path: `${AI_GW_CONFIGS_PATH}/${configId}`,
       body,
+      requestSchema: GatewayConfigUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12151,6 +12830,7 @@ var AIGatewayGuardrailsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_GUARDRAILS_PATH,
       body,
+      requestSchema: GatewayGuardrailCreateRequestSchema,
       responseSchema: GatewayGuardrailCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12177,6 +12857,7 @@ var AIGatewayGuardrailsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_GUARDRAILS_PATH}/${guardrailId}`,
       body,
+      requestSchema: GatewayGuardrailUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12252,7 +12933,8 @@ var AIGatewayProvidersClient = class {
    * Fetch one provider binding. Verified live 2026-08-29.
    *
    * @remarks The response can contain provider credential material. Do not log or persist it,
-   * and do not enable SDK debug logging around this call in production.
+   * and avoid logging the complete returned object. SDK debug logs redact the known credential
+   * fields for this operation.
    * @param providerId - Provider UUID.
    * @returns Provider configuration and lifecycle detail.
    * @example
@@ -12269,6 +12951,7 @@ var AIGatewayProvidersClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${AI_GW_PROVIDERS_PATH}/${providerId}`,
+      secretOperation: "providers.get",
       responseSchema: GatewayProviderDetailSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12309,6 +12992,7 @@ var AIGatewayProvidersClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_PROVIDERS_PATH,
       body,
+      requestSchema: GatewayProviderCreateRequestSchema,
       responseSchema: GatewayProviderCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12336,6 +13020,7 @@ var AIGatewayProvidersClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_PROVIDERS_PATH}/${providerId}`,
       body,
+      requestSchema: GatewayProviderUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12396,13 +13081,14 @@ var AIGatewayApiKeysClient = class {
     });
   }
   /** @internal */
-  writeAt(method, path, body) {
-    assertUuid(body.workspace_id, "workspace_id");
+  writeAt(method, path, body, requestSchema, secretOperation) {
     return request({
       method,
       baseUrl: this.baseUrl,
       path,
       body,
+      requestSchema,
+      secretOperation,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12461,13 +13147,15 @@ var AIGatewayApiKeysClient = class {
       numRetries: this.numRetries
     });
   }
-  rotateAt(path, keyId, body = {}) {
+  rotateAt(path, keyId, body, secretOperation) {
     assertUuid(keyId, "keyId");
     return request({
       method: "POST",
       baseUrl: this.baseUrl,
       path: `${path}/${keyId}/rotate`,
       body,
+      requestSchema: GatewayApiKeyRotateRequestSchema,
+      secretOperation,
       responseSchema: GatewayApiKeyRotateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12491,11 +13179,11 @@ var AIGatewayApiKeysClient = class {
   }
   /** Rotate a service key; capture the returned secret. @example `const rotated = await gw.apiKeys.rotateService(keyId);` */
   async rotateService(keyId, body = {}) {
-    return this.rotateAt(AI_GW_API_KEYS_SERVICE_PATH, keyId, body);
+    return this.rotateAt(AI_GW_API_KEYS_SERVICE_PATH, keyId, body, "apiKeys.rotateService");
   }
   /** Rotate a user key; capture the returned secret. @example `const rotated = await gw.apiKeys.rotateUser(keyId);` */
   async rotateUser(keyId, body = {}) {
-    return this.rotateAt(AI_GW_API_KEYS_USER_PATH, keyId, body);
+    return this.rotateAt(AI_GW_API_KEYS_USER_PATH, keyId, body, "apiKeys.rotateUser");
   }
   /**
    * Create a service API key.
@@ -12516,7 +13204,13 @@ var AIGatewayApiKeysClient = class {
    * ```
    */
   async createService(body) {
-    return this.writeAt("POST", AI_GW_API_KEYS_SERVICE_PATH, body);
+    return this.writeAt(
+      "POST",
+      AI_GW_API_KEYS_SERVICE_PATH,
+      body,
+      GatewayServiceApiKeyCreateRequestSchema,
+      "apiKeys.createService"
+    );
   }
   /**
    * Create a user API key.
@@ -12538,12 +13232,18 @@ var AIGatewayApiKeysClient = class {
    * ```
    */
   async createUser(body) {
-    return this.writeAt("POST", AI_GW_API_KEYS_USER_PATH, body);
+    return this.writeAt(
+      "POST",
+      AI_GW_API_KEYS_USER_PATH,
+      body,
+      GatewayUserApiKeyCreateRequestSchema,
+      "apiKeys.createUser"
+    );
   }
   /**
    * Update a service API key.
    * @param keyId - Key UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12561,12 +13261,17 @@ var AIGatewayApiKeysClient = class {
    */
   async updateService(keyId, body) {
     assertUuid(keyId, "keyId");
-    return this.writeAt("PUT", `${AI_GW_API_KEYS_SERVICE_PATH}/${keyId}`, body);
+    return this.writeAt(
+      "PUT",
+      `${AI_GW_API_KEYS_SERVICE_PATH}/${keyId}`,
+      body,
+      GatewayApiKeyUpdateRequestSchema
+    );
   }
   /**
    * Update a user API key.
    * @param keyId - Key UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12585,7 +13290,12 @@ var AIGatewayApiKeysClient = class {
    */
   async updateUser(keyId, body) {
     assertUuid(keyId, "keyId");
-    return this.writeAt("PUT", `${AI_GW_API_KEYS_USER_PATH}/${keyId}`, body);
+    return this.writeAt(
+      "PUT",
+      `${AI_GW_API_KEYS_USER_PATH}/${keyId}`,
+      body,
+      GatewayApiKeyUpdateRequestSchema
+    );
   }
 };
@@ -12649,8 +13359,8 @@ var AIGatewayIntegrationsClient = class {
    * Create an integration.
    *
    * @remarks
-   * `body.key` (the provider API key) is a live secret. Setting `PANW_AI_SEC_DEBUG` will
-   * print it, unredacted, to the SDK's own debug log.
+   * `body.key` (the provider API key) is a live secret. SDK debug logs replace known
+   * credential fields with `[REDACTED]`, but callers must still avoid logging the input object.
    *
    * @param body - Provider id, name, slug, and provider-specific configuration.
    * @returns The raw create response. Shape unverified against a live tenant — see the PRD.
@@ -12675,6 +13385,8 @@ var AIGatewayIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_INTEGRATIONS_PATH,
       body,
+      requestSchema: GatewayIntegrationCreateRequestSchema,
+      secretOperation: "integrations.create",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12683,7 +13395,7 @@ var AIGatewayIntegrationsClient = class {
   /**
    * Update an integration.
    * @param integrationId - Integration UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12698,12 +13410,13 @@ var AIGatewayIntegrationsClient = class {
    */
   async update(integrationId, body) {
     assertUuid(integrationId, "integrationId");
-    if (body.ai_provider_id !== void 0) assertUuid(body.ai_provider_id, "ai_provider_id");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
       path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}`,
       body,
+      requestSchema: GatewayIntegrationUpdateRequestSchema,
+      secretOperation: "integrations.update",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12759,9 +13472,9 @@ var AIGatewayIntegrationsClient = class {
     });
   }
   /**
-   * Replace which models this integration exposes.
+   * Bulk-update model enablement for this integration.
    * @param integrationId - Integration UUID.
-   * @param body - Full model list; this is a replace, not a merge.
+   * @param body - One or more model entries to update; omission is not documented as deletion.
    * @returns The raw response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12780,6 +13493,7 @@ var AIGatewayIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}/models`,
       body,
+      requestSchema: GatewayIntegrationModelsBulkUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12791,7 +13505,7 @@ var AIGatewayIntegrationsClient = class {
    * @remarks
    * `global_workspace_access` is an **object** on this read, not a boolean, despite the
    * field name — `{ enabled, rate_limits, usage_limits }`. The corresponding write
-   * ({@link setWorkspaces}) DOES send a plain boolean; the two are not symmetric.
+   * ({@link setWorkspaces}) uses the same object shape.
    *
    * @param integrationId - Integration UUID.
    * @returns Bound workspaces plus the `global_workspace_access` object.
@@ -12816,9 +13530,9 @@ var AIGatewayIntegrationsClient = class {
     });
   }
   /**
-   * Replace which workspaces may use this integration.
+   * Bulk-update which workspaces may use this integration.
    * @param integrationId - Integration UUID.
-   * @param body - Workspace bindings or a global-access flag.
+   * @param body - Workspace bindings, global-access settings, or explicit override behavior.
    * @returns The raw response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12826,7 +13540,7 @@ var AIGatewayIntegrationsClient = class {
    * const gw = new AIGatewayClient();
    *
    * await gw.integrations.setWorkspaces('f6692544-3265-49be-9711-bbdcebc079e4', {
-   *   global_workspace_access: true,
+   *   global_workspace_access: { enabled: true },
    * });
    * ```
    */
@@ -12837,6 +13551,7 @@ var AIGatewayIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}/workspaces`,
       body,
+      requestSchema: GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12970,6 +13685,8 @@ var AIGatewayMcpIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_MCP_INTEGRATIONS_PATH,
       body,
+      requestSchema: McpIntegrationCreateRequestSchema,
+      secretOperation: "mcpIntegrations.create",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12983,6 +13700,8 @@ var AIGatewayMcpIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}`,
       body,
+      requestSchema: McpIntegrationUpdateRequestSchema,
+      secretOperation: "mcpIntegrations.update",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12999,7 +13718,7 @@ var AIGatewayMcpIntegrationsClient = class {
       numRetries: this.numRetries
     });
   }
-  /** Replace capability enablement values. @example `await gw.mcpIntegrations.setCapabilities(id, { capabilities: [{ name: 'lookup', type: 'tool', enabled: true }] });` */
+  /** Bulk-update capability enablement values. @example `await gw.mcpIntegrations.setCapabilities(id, { capabilities: [{ name: 'lookup', type: 'tool', enabled: true }] });` */
   async setCapabilities(mcpIntegrationId, body) {
     assertUuid(mcpIntegrationId, "mcpIntegrationId");
     return request({
@@ -13007,15 +13726,17 @@ var AIGatewayMcpIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/capabilities`,
       body,
+      requestSchema: McpIntegrationCapabilitiesBulkUpdateRequestSchema,
       responseSchema: McpIntegrationCapabilitiesUpdateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
   /**
-   * Replace which workspaces may use this MCP integration.
+   * Bulk-update which workspaces may use this MCP integration.
    * @param mcpIntegrationId - MCP integration UUID.
-   * @param body - Workspace bindings or a global-access flag; this is a replace, not a merge.
+   * @param body - Workspace bindings or global-access settings. Use the explicit override flag
+   * to request replacement behavior.
    * @returns An empty object. Verified live 2026-08-30.
    * @example
    * ```ts
@@ -13036,6 +13757,7 @@ var AIGatewayMcpIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/workspaces`,
       body,
+      requestSchema: McpIntegrationWorkspacesBulkUpdateRequestSchema,
       responseSchema: McpIntegrationWorkspacesUpdateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -13114,8 +13836,8 @@ var AIGatewayDeploymentsClient = class {
    *
    * This is the **only** time `credentials.password` and `client_auth` are readable; the
    * detail read masks them. Capture them here or they are unrecoverable. Never log them.
-   * Note that setting `PANW_AI_SEC_DEBUG` will print the raw request/response, including
-   * `credentials.password`, to the SDK's own debug log regardless of this warning.
+   * SDK debug logs redact returned one-time `client_auth` and registry passwords. Callers
+   * must still capture the create response once and store it securely.
    *
    * @param body - Name, type, TSG, and auth settings.
    * @returns The creation receipt including the deployment's gateway credentials.
@@ -13140,6 +13862,8 @@ var AIGatewayDeploymentsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_DEPLOYMENTS_PATH,
       body,
+      requestSchema: GatewayDeploymentCreateRequestSchema,
+      secretOperation: "deployments.create",
       responseSchema: GatewayDeploymentCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -13169,6 +13893,8 @@ var AIGatewayDeploymentsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_DEPLOYMENTS_PATH}/${deploymentId}`,
       body,
+      requestSchema: GatewayDeploymentUpdateRequestSchema,
+      secretOperation: "deployments.update",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -13271,8 +13997,8 @@ var AIGatewayPluginsClient = class {
    * Bind a plugin to the organisation.
    *
    * @remarks
-   * `body.credentials` (e.g. `AIRS_API_KEY`) is a live secret. Setting `PANW_AI_SEC_DEBUG`
-   * will print it, unredacted, to the SDK's own debug log.
+   * `body.credentials` (e.g. `AIRS_API_KEY`) is a live secret. SDK debug logs replace each
+   * credential value with `[REDACTED]`, but callers must still avoid logging the input object.
    *
    * @param body - Integration id and provider-specific credentials.
    * @returns The raw create response. Shape unverified against a live tenant — see the PRD.
@@ -13295,6 +14021,8 @@ var AIGatewayPluginsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_PLUGINS_PATH,
       body,
+      requestSchema: GatewayPluginCreateRequestSchema,
+      secretOperation: "plugins.create",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -13336,7 +14064,7 @@ var AIGatewayOrganisationsClient = class {
   }
   /**
    * Update the calling organisation's settings.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -13352,6 +14080,7 @@ var AIGatewayOrganisationsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_ORGANISATIONS_SELF_PATH,
       body,
+      requestSchema: GatewayOrganisationUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -13362,8 +14091,8 @@ var AIGatewayOrganisationsClient = class {
    *
    * @remarks
    * The response includes a `scim_token` — a live secret. Never log the returned object.
-   * Note that setting `PANW_AI_SEC_DEBUG` will print it (unredacted) to the SDK's own debug
-   * log regardless of this warning, since debug logging only sanitizes header values.
+   * SDK debug logs redact `scim_token` and known nested client-secret fields. Callers must
+   * still avoid logging the input object or returned auth settings directly.
    *
    * @param tsgId - The TSG as a numeric string, not a UUID.
    * @returns Auth settings, including domains and the SCIM token.
@@ -13382,6 +14111,7 @@ var AIGatewayOrganisationsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: aiGwOrganisationsAuthSettingsPath(tsgId),
+      secretOperation: "organisations.getAuthSettings",
       responseSchema: AuthSettingsResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -13390,7 +14120,7 @@ var AIGatewayOrganisationsClient = class {
   /**
    * Update an organisation's auth settings.
    * @param tsgId - The TSG as a numeric string, not a UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more auth-setting fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -13409,6 +14139,8 @@ var AIGatewayOrganisationsClient = class {
       baseUrl: this.baseUrl,
       path: aiGwOrganisationsAuthSettingsPath(tsgId),
       body,
+      requestSchema: GatewayOrganisationAuthSettingsUpdateRequestSchema,
+      secretOperation: "organisations.updateAuthSettings",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -13526,6 +14258,165 @@ var AIGatewayClient = class {
     this.auditLogs = new AIGatewayAuditLogsClient(adminOpts);
   }
 };
+// src/ai-gateway/nested-values.ts
+var FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var ESCAPABLE = /* @__PURE__ */ new Set([".", "[", "]", "\\"]);
+function invalid(message) {
+  throw new AISecSDKException(message, "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
+}
+function pushProperty(tokens, value2, path) {
+  if (!value2) invalid(`Invalid dotted path: ${path}`);
+  if (FORBIDDEN_SEGMENTS.has(value2)) invalid(`Unsafe dotted path segment: ${value2}`);
+  tokens.push(value2);
+}
+function parsePath(path) {
+  if (!path) invalid("Dotted path must not be empty");
+  const tokens = [];
+  let property = "";
+  let afterDot = false;
+  let afterIndex = false;
+  for (let i = 0; i < path.length; i++) {
+    const char = path[i];
+    if (char === "\\") {
+      const escaped = path[++i];
+      if (escaped === void 0 || !ESCAPABLE.has(escaped)) {
+        invalid(`Invalid escape in dotted path: ${path}`);
+      }
+      if (afterIndex) invalid(`Missing dot after array index in path: ${path}`);
+      property += escaped;
+      afterDot = false;
+      continue;
+    }
+    if (char === ".") {
+      if (property) {
+        pushProperty(tokens, property, path);
+        property = "";
+      } else if (!afterIndex) {
+        invalid(`Invalid empty segment in dotted path: ${path}`);
+      }
+      afterDot = true;
+      afterIndex = false;
+      continue;
+    }
+    if (char === "[") {
+      if (afterDot) invalid(`Invalid array segment in dotted path: ${path}`);
+      if (property) {
+        pushProperty(tokens, property, path);
+        property = "";
+      } else if (tokens.length === 0) {
+        invalid(`Dotted paths must start with an object property: ${path}`);
+      }
+      const close = path.indexOf("]", i + 1);
+      if (close === -1) invalid(`Unclosed array index in dotted path: ${path}`);
+      const rawIndex = path.slice(i + 1, close);
+      if (!/^(0|[1-9]\d*)$/.test(rawIndex)) invalid(`Invalid array index in dotted path: ${path}`);
+      tokens.push(Number(rawIndex));
+      i = close;
+      afterIndex = true;
+      afterDot = false;
+      continue;
+    }
+    if (char === "]") invalid(`Unexpected ] in dotted path: ${path}`);
+    if (afterIndex) invalid(`Missing dot after array index in path: ${path}`);
+    property += char;
+    afterDot = false;
+  }
+  if (property) pushProperty(tokens, property, path);
+  else if (afterDot) invalid(`Dotted path must not end with a dot: ${path}`);
+  if (tokens.length === 0) invalid(`Invalid dotted path: ${path}`);
+  return tokens;
+}
+function isContainerFor(value2, expectArray) {
+  return expectArray ? Array.isArray(value2) : typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function readSegment(container, segment) {
+  return typeof segment === "number" ? container[segment] : container[segment];
+}
+function writeSegment(container, segment, value2) {
+  if (typeof segment === "number") container[segment] = value2;
+  else container[segment] = value2;
+}
+function assign(root, tokens, value2, replaceExisting) {
+  let current = root;
+  for (let i = 0; i < tokens.length; i++) {
+    const segment = tokens[i];
+    const final = i === tokens.length - 1;
+    if (typeof segment === "number" && !Array.isArray(current)) {
+      invalid("Array index conflicts with an object path");
+    }
+    if (typeof segment === "string" && Array.isArray(current)) {
+      invalid("Object property conflicts with an array path");
+    }
+    const hasValue = Object.prototype.hasOwnProperty.call(current, segment);
+    if (final) {
+      if (hasValue && !replaceExisting) invalid("Duplicate dotted path");
+      writeSegment(current, segment, value2);
+      return;
+    }
+    const expectArray = typeof tokens[i + 1] === "number";
+    if (!hasValue) {
+      writeSegment(current, segment, expectArray ? [] : {});
+    } else {
+      const existing = readSegment(current, segment);
+      if (!isContainerFor(existing, expectArray)) invalid("Dotted path shape conflict");
+    }
+    current = readSegment(current, segment);
+  }
+}
+function assertDenseArrays(value2) {
+  if (Array.isArray(value2)) {
+    for (let i = 0; i < value2.length; i++) {
+      if (!Object.prototype.hasOwnProperty.call(value2, i))
+        invalid("Sparse arrays are not supported");
+      assertDenseArrays(value2[i]);
+    }
+    return;
+  }
+  if (typeof value2 === "object" && value2 !== null) {
+    for (const nested of Object.values(value2)) assertDenseArrays(nested);
+  }
+}
+function cloneJson(value2) {
+  if (Array.isArray(value2)) {
+    return value2.map((item) => cloneJson(item));
+  }
+  if (typeof value2 === "object" && value2 !== null) {
+    return Object.fromEntries(
+      Object.entries(value2).map(([key, item]) => [key, cloneJson(item)])
+    );
+  }
+  return value2;
+}
+function parseJsonValue(value2) {
+  const result = GatewayJsonValueSchema.safeParse(value2);
+  if (!result.success) invalid("Dotted value must be finite JSON");
+  return cloneJson(result.data);
+}
+function buildDottedObject(entries) {
+  const parsed = entries.map((entry) => ({
+    tokens: parsePath(entry.path),
+    value: parseJsonValue(entry.value)
+  }));
+  const identities = /* @__PURE__ */ new Set();
+  for (const entry of parsed) {
+    const identity = JSON.stringify(entry.tokens);
+    if (identities.has(identity)) invalid("Duplicate dotted path");
+    identities.add(identity);
+  }
+  const result = {};
+  for (const entry of parsed) assign(result, entry.tokens, entry.value, false);
+  assertDenseArrays(result);
+  return result;
+}
+function setDottedValue(input, path, value2) {
+  const parsedInput = GatewayJsonObjectSchema.safeParse(input);
+  if (!parsedInput.success) invalid("Input must be a finite JSON object");
+  const result = cloneJson(parsedInput.data);
+  assign(result, parsePath(path), parseJsonValue(value2), true);
+  assertDenseArrays(result);
+  return result;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AIGatewayApiKeysClient,
@@ -13543,6 +14434,18 @@ var AIGatewayClient = class {
   AIGatewayWorkspacesClient,
   AIRS_ENDPOINTS,
   AISecSDKException,
+  AI_GATEWAY_DEPLOYMENT_STATUSES,
+  AI_GATEWAY_DEPLOYMENT_TYPES,
+  AI_GATEWAY_KNOWN_API_KEY_SCOPES,
+  AI_GATEWAY_KNOWN_CACHE_MODES,
+  AI_GATEWAY_KNOWN_CONFIG_STRATEGIES,
+  AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
+  AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
+  AI_GATEWAY_KNOWN_RATE_LIMIT_TYPES,
+  AI_GATEWAY_KNOWN_RATE_LIMIT_UNITS,
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
+  AI_GATEWAY_REDACTED,
+  AI_GATEWAY_SECRET_FIELDS,
   AI_GW_ADMIN_ENDPOINT,
   AI_GW_API_KEYS_SERVICE_PATH,
   AI_GW_API_KEYS_USER_PATH,
@@ -13794,39 +14697,100 @@ var AIGatewayClient = class {
   FileScanDataSchema,
   FileScanResult,
   FileType,
+  GatewayApiKeyCreateRequestSchema,
+  GatewayApiKeyRotateRequestSchema,
   GatewayApiKeyRotateResponseSchema,
+  GatewayApiKeyRotationPolicySchema,
   GatewayApiKeySchema,
+  GatewayApiKeyScopeSchema,
+  GatewayApiKeyUpdateRequestSchema,
   GatewayAuditLogRecordSchema,
   GatewayAuditLogsResponseSchema,
+  GatewayAzureAIConfigurationSchema,
+  GatewayAzureDeploymentConfigurationSchema,
+  GatewayAzureOpenAIConfigurationSchema,
+  GatewayBedrockConfigurationSchema,
   GatewayChartRecordSchema,
+  GatewayConfigCacheModeSchema,
+  GatewayConfigCreateRequestSchema,
   GatewayConfigCreateResponseSchema,
   GatewayConfigDetailSchema,
   GatewayConfigSchema,
+  GatewayConfigStrategySchema,
+  GatewayConfigUpdateRequestSchema,
   GatewayConfigVersionSchema,
+  GatewayCortexConfigurationSchema,
+  GatewayCustomHostConfigurationSchema,
+  GatewayDefaultsInputSchema,
+  GatewayDeploymentAuthSettingsInputSchema,
+  GatewayDeploymentCreateRequestSchema,
   GatewayDeploymentCreateResponseSchema,
   GatewayDeploymentDetailSchema,
   GatewayDeploymentPingResponseSchema,
   GatewayDeploymentSchema,
+  GatewayDeploymentStatusSchema,
+  GatewayDeploymentTypeSchema,
+  GatewayDeploymentUpdateRequestSchema,
+  GatewayGlobalWorkspaceAccessInputSchema,
   GatewayGlobalWorkspaceAccessSchema,
   GatewayGroupRowSchema,
+  GatewayGuardrailActionsSchema,
+  GatewayGuardrailCheckSchema,
+  GatewayGuardrailCreateRequestSchema,
   GatewayGuardrailCreateResponseSchema,
   GatewayGuardrailDetailSchema,
   GatewayGuardrailSchema,
+  GatewayGuardrailUpdateRequestSchema,
+  GatewayHuggingFaceConfigurationSchema,
+  GatewayIntegrationCreateRequestSchema,
+  GatewayIntegrationModelUpdateSchema,
+  GatewayIntegrationModelsBulkUpdateRequestSchema,
   GatewayIntegrationModelsResponseSchema,
   GatewayIntegrationSchema,
+  GatewayIntegrationUpdateRequestSchema,
   GatewayIntegrationWorkspaceSchema,
+  GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
   GatewayIntegrationWorkspacesResponseSchema,
+  GatewayJsonObjectSchema,
+  GatewayJsonValueSchema,
   GatewayLogRecordSchema,
   GatewayLogsResponseSchema,
+  GatewayMcpAuthTypeSchema,
+  GatewayMcpTransportSchema,
+  GatewayMutableMcpCapabilityTypeSchema,
+  GatewayOpenAIConfigurationSchema,
+  GatewayOrganisationAuthSettingsUpdateRequestSchema,
+  GatewayOrganisationUpdateRequestSchema,
+  GatewayPluginCreateRequestSchema,
   GatewayPluginSchema,
+  GatewayProviderCreateRequestSchema,
   GatewayProviderCreateResponseSchema,
   GatewayProviderDetailSchema,
   GatewayProviderSchema,
+  GatewayProviderUpdateRequestSchema,
+  GatewayRateLimitInputSchema,
   GatewayRateLimitSchema,
+  GatewayRateLimitTypeSchema,
+  GatewayRateLimitUnitSchema,
+  GatewayRoutingCacheSchema,
+  GatewayRoutingConfigSchema,
+  GatewayRoutingRetrySchema,
+  GatewayRoutingStrategySchema,
+  GatewayRoutingTargetSchema,
+  GatewaySageMakerConfigurationSchema,
+  GatewaySecretMappingSchema,
+  GatewayServiceApiKeyCreateRequestSchema,
+  GatewayUsageLimitInputSchema,
   GatewayUsageLimitSchema,
+  GatewayUserApiKeyCreateRequestSchema,
+  GatewayVertexAIConfigurationSchema,
+  GatewayWorkersAIConfigurationSchema,
+  GatewayWorkspaceBindingSchema,
+  GatewayWorkspaceCreateRequestSchema,
   GatewayWorkspaceCreateResponseSchema,
   GatewayWorkspaceDetailSchema,
   GatewayWorkspaceSchema,
+  GatewayWorkspaceUpdateRequestSchema,
   GatewayWriteResponseSchema,
   GoalListResponseSchema,
   GoalSchema,
@@ -13930,12 +14894,17 @@ var AIGatewayClient = class {
   MaskedDataSchema,
   McEntrySchema,
   McReportSchema,
+  McpIntegrationCapabilitiesBulkUpdateRequestSchema,
   McpIntegrationCapabilitiesResponseSchema,
   McpIntegrationCapabilitiesUpdateResponseSchema,
   McpIntegrationCapabilitySchema,
+  McpIntegrationCapabilityUpdateSchema,
+  McpIntegrationCreateRequestSchema,
   McpIntegrationDetailSchema,
   McpIntegrationMetadataSchema,
   McpIntegrationSchema,
+  McpIntegrationUpdateRequestSchema,
+  McpIntegrationWorkspacesBulkUpdateRequestSchema,
   McpIntegrationWorkspacesUpdateResponseSchema,
   MetadataCriterionSchema,
   MetadataSchema,
@@ -14179,6 +15148,7 @@ var AIGatewayClient = class {
   WebSocketConnectionParamsSchema,
   WeightedRegexSchema,
   aiGwOrganisationsAuthSettingsPath,
+  buildDottedObject,
   collectAll,
   collectSkipPages,
   collectSpringPages,
@@ -14187,6 +15157,8 @@ var AIGatewayClient = class {
   jsonNullable,
   pageSchema,
   paginate,
-  serializeListing
+  redactAIGatewaySecrets,
+  serializeListing,
+  setDottedValue
 });
 //# sourceMappingURL=index.cjs.map