fix: default STATIC scan categories; fix target init scaffold schema

[thresh97]

Summary

Two bugs found while building red-team scan automation against private EKS endpoints using the CUSTOM_TARGET_ADAPTER + NETWORK_BROKER pattern. Both verified against the live API.

Bug 1: airs redteam scan fails with 422 when --categories is omitted

Root cause: createScan() builds job_metadata: {} for STATIC scans when no categories are provided. The API rejects an empty object with a generic 422 — no useful error message, hard to debug.

Fix: When jobType === 'STATIC' and no categories are specified, fetch all available categories via getCategories() and use them as the default. MULTI_TURN is excluded from defaults because it requires multi_turn_supported: true on the target — most targets don't have it, and the API returns 400 if requested for an unsupported target.

A bare airs redteam scan --target <uuid> --name foo now works as expected.

Bug 2: airs redteam targets init <provider> generates stale schema

Root cause: The scaffold embedded the raw getTargetTemplates() response (url, no response_key) directly as connection_params. The current API expects RestConnectionParamsBase fields and requires several top-level fields that were missing. Generated JSON fails on POST /v1/target without manual correction.

Fix:

• REST/HUGGING_FACE/STREAMING/WEBSOCKET: scaffold now uses correct RestConnectionParamsBase fields (api_endpoint promoted from template url, request_headers, response_key) with all required top-level fields (connection_type, api_endpoint_type, response_mode, auth_type, auth_config)
• OPENAI/BEDROCK/DATABRICKS: scaffold uses NativeConnectionParamsBase with target_connection_config
• Add CUSTOM_TARGET_ADAPTER provider: scaffolds an AGENT target with NETWORK_BROKER endpoint type, adapter_uuid placeholder, and adapter_variable_overrides as an empty array — the correct shape (a dict causes 422)
• Add WEBSOCKET to valid providers list
• Remove stale target_metadata field (not accepted on create)

Test plan

• All 870 existing tests pass
• Updated redteam-init.spec.ts to assert new schema shapes; added 4 new cases
• Live tested: airs redteam scan --target <uuid> --name test --no-wait (STATIC, no --categories) → scan QUEUED, not 422
• Live tested: airs redteam targets init REST → api_endpoint, response_key, correct auth_config shape
• Live tested: airs redteam targets init CUSTOM_TARGET_ADAPTER → AGENT type, NETWORK_BROKER, adapter_variable_overrides: []

🤖 Generated with Claude Code

[cdot65]

Maintainer follow-up is complete on 988f648:

• Moved bare STATIC default-category resolution into the CLI via exported buildDefaultCategories; all current subcategories are selected except MULTI_TURN, with a --quiet-aware status notice.
• Restored the service boundary: library callers must provide STATIC categories, receive a descriptive local error when omitted, and no hidden category/API request occurs.
• Added the missing helper/service coverage while preserving CUSTOM and DYNAMIC behavior.
• Kept the contributor's target scaffold fixes, applied Biome formatting, added a patch changeset, and documented scan defaults plus the WEBSOCKET/custom-adapter scaffold shapes.
• Merged current main normally (no force-push) and regenerated the API reference.

Validation:

• Local: TypeScript, Biome, 75 test files / 941 tests, and Docusaurus production build all pass.
• Live: bare STATIC scan a7785491-9f31-481a-9333-faa00e6f64d4 defaulted to 27 categories with MULTI_TURN excluded, remained RUNNING for five minutes, then aborted successfully with final status ABORTED.
• GitHub Actions run 31051750233: test, lint, typecheck, and docs-build all green.