@binalyze/air-sdk 5.22.4 → 5.24.3

package/dist/sdk/typescript-axios/sdk.gen.js

@@ -2,20 +2,21 @@
 // @ts-nocheck
 // This file is auto-generated by @hey-api/openapi-ts
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.endpointExportCasesByEndpointId0 = exports.endpointGetCasesById1 = exports.endpointGetCasesById0 = exports.endpointSearch1 = exports.endpointSearch0 = exports.endpointFilterByPolicyFilter1 = exports.endpointFilterByPolicyFilter0 = exports.endpointFilterDisks1 = exports.endpointFilterDisks0 = exports.assetsSetMitreAttackDatabaseVersion2 = exports.assetsSetMitreAttackDatabaseVersion = exports.assetsAddTags2 = exports.assetsRemoveTags2 = exports.assetsAddTags = exports.assetsRemoveTags = exports.endpointPurgeAssetDataByFilter1 = exports.endpointPurgeAssetDataByFilter0 = exports.endpointUninstallEndpointsByFilter1 = exports.endpointUninstallEndpointsByFilter0 = exports.endpointUninstallAgentsAndPurgeByFilter2 = exports.endpointUninstallAgentsAndPurgeByFilter1 = exports.endpointUninstallAgentsAndPurgeByFilter0 = exports.endpointImportPpcToExistedEndpoint1 = exports.endpointImportPpcToExistedEndpoint0 = exports.endpointImportPpcAsEndpoint1 = exports.endpointImportPpcAsEndpoint0 = exports.assetsGetMany4 = exports.assetsGetMany3 = exports.endpointGetDeviceNameConflicts1 = exports.endpointGetDeviceNameConflicts0 = exports.endpointGetEndpointsStats1 = exports.endpointGetEndpointsStats0 = exports.endpointGetEndpointsWithTaskCount = exports.assetsGetManyByFilter2 = exports.assetsGetManyByFilter = exports.assetsGetMany2 = exports.assetsGetMany = exports.assetsUpdateLabel2 = exports.assetsUpdateLabel = exports.assetsUpdateTags2 = exports.assetsUpdateTags = exports.endpointExportEndpoints1 = exports.endpointExportEndpoints0 = exports.paramsGetMitreAttackTactics = exports.paramsEvidenceList = exports.paramsEventLogRecordTypes = exports.paramsEDiscoveryPatterns = exports.paramsGetDroneAnalyzers = exports.loggerDownloadLogsDir = exports.appGetBasicInfo = void 0;
-exports.endpointTaskRetryUpload1 = exports.endpointTaskRetryUpload0 = exports.endpointTaskPurgeLocalData1 = exports.endpointTaskPurgeLocalData0 = exports.assetsGetTasks2 = exports.assetsGetTasks = exports.assetsAssignIsolationTask2 = exports.assetsAssignIsolationTask = exports.assetsAssignVersionUpdateTask2 = exports.assetsAssignVersionUpdateTask = exports.endpointTaskAssignRetrieveLogTask1 = exports.endpointTaskAssignRetrieveLogTask0 = exports.assetsAssignShutdownTask2 = exports.assetsAssignShutdownTask = exports.assetsAssignRebootTask2 = exports.assetsAssignRebootTask = exports.taskGenerateOffNetworkZipPassword = exports.taskDownloadOffNetworkTask = exports.taskImportOffNetworkCollectionToTask = exports.taskCreateOffNetworkTask = exports.taskCancel = exports.taskCancelByFilter = exports.taskDeleteAndPurgeByFilter = exports.taskDeleteByFilter = exports.tasksGetData = exports.taskRenameTask = exports.tasksGetMany = exports.tasksGetById = exports.taskDelete = exports.getTaskDisplayTypes = exports.endpointGroupGetRootGroups = exports.endpointGroupGetChildGroupsOfGroup = exports.endpointTagDeleteTag = exports.endpointTagDeleteAllTags = exports.endpointTagFilterTags = exports.endpointSetMaintenanceMode1 = exports.endpointSetMaintenanceMode0 = exports.endpointUpdateEndpointConnectionRoute1 = exports.endpointUpdateEndpointConnectionRoute0 = exports.endpointDeployCloudAssetsByFilter1 = exports.endpointDeployCloudAssetsByFilter0 = exports.endpointGetCloudAssetDetails1 = exports.endpointGetCloudAssetDetails0 = exports.endpointSyncLdap1 = exports.endpointSyncLdap0 = exports.endpointDownloadLogFile1 = exports.endpointDownloadLogFile0 = exports.endpointSetExcludeFromUpdatesToEndpointsByFilter1 = exports.endpointSetExcludeFromUpdatesToEndpointsByFilter0 = exports.endpointExportCasesByEndpointId1 = void 0;
-exports.settingsSaveConsoleAddress = exports.settingsValidateConsoleAddress = exports.settingsSaveRfc3161 = exports.settingsSaveLocard = exports.settingsSaveIpRestriction = exports.settingsValidateIpRestriction = exports.settingsSaveCaseAutoClose = exports.settingsSaveFleetAi = exports.settingsSaveInterAct = exports.settingsSaveAutoAssetTagging = exports.settingsSaveEnforceTfa = exports.settingsSaveAgent = exports.settingsValidateS3 = exports.settingsValidateSftp = exports.settingsSaveBackupRestore = exports.settingsSavePolicy = exports.settingsValidateSsl = exports.settingsSaveSsl = exports.settingsValidateSmtp = exports.settingsSaveSmtp = exports.settingsValidateSyslog = exports.settingsSaveSyslog = exports.settingsGetSyslogEventTypes = exports.settingsValidateActiveDirectory = exports.settingsSaveActiveDirectory = exports.settingsValidateTrustedCertificate = exports.settingsDeleteTrustedCertificate = exports.settingsAddTrustedCertificateWithoutValidation = exports.settingsAddTrustedCertificate = exports.settingsGetTrustedCertificates = exports.settingsTestProxy1 = exports.settingsTestProxy0 = exports.settingsSaveProxy = exports.settingsSaveGeneralSettings = exports.settingsGetSettings = exports.tasksTriageV2ApiControllerDeleteOne = exports.tasksTriageV2ApiControllerCancelOne = exports.tasksTriageV2ApiControllerDelete = exports.tasksTriageV2ApiControllerCancel = exports.tasksTriageV2ApiControllerListHuntTasks = exports.tasksV2ApiControllerListTaskAssignments = exports.tasksV2ApiControllerListTaskAssets = exports.tasksV2ApiControllerUpdateTask = exports.tasksV2ApiControllerGetTaskById = exports.taskAssignmentGenerateTaskAssignmentReport = exports.taskAssignmentGet = exports.taskAssignmentDelete = exports.taskAssignmentCancel = exports.tasksAssignmentsGetMany = exports.endpointTaskGetComparableTasksByVendorDeviceId = void 0;
-exports.licenseSetLicense = exports.licenseGetLicense = exports.userPatTokensDelete = exports.userPatTokensRotate = exports.userPatTokensCreate = exports.userPatTokensGetMany = exports.userGroupUpdateGroup = exports.userGroupGetGroup = exports.userGroupDeleteGroup = exports.userGroupCreateGroup = exports.userGroupFilterGroups = exports.userRolesUpdateRole = exports.userRolesGetRole = exports.userRolesDeleteRole = exports.userRolesCreateRole = exports.userRolesGetRoles = exports.userRolesGetPrivileges = exports.userCreateApiUser = exports.userResetUserPassword = exports.userChangePassword = exports.userResetTfa = exports.userManagementUsersPurgeAndDelete = exports.userUpdateUser = exports.userPatchUser = exports.userManagementUsersGet = exports.userDelete = exports.userCreate = exports.userManagementUsersGetMany = exports.authGetUserSessionHistory = exports.authRegeneratePatToken = exports.authRenewOneClickLoginUrl = exports.authGenerateOneClickLoginUrl = exports.authLogin = exports.authOneClickLogin = exports.authUpdateProfile = exports.authCheckAuth = exports.settingsUpdateSsoProvider = exports.settingsDeleteSsoProvider = exports.settingsCreateSsoProvider = exports.settingsGetSsoProviders = exports.settingsSingleSignOnCallback = exports.settingsSaveMandatoryCaseSelection = exports.settingsGetMitreAttackDatabaseReleaseNotes = exports.settingsGetMitreAttackDatabaseVersions = exports.settingsSaveMitreAttackDatabaseSettings = exports.settingsGetAutoUpdateWindows = exports.settingsSaveAutoUpdateSettings = exports.settingsGetAutoUpdateSettings = exports.settingsSaveUninstallationPasswordProtection = exports.settingsSaveBanner = void 0;
-exports.triageLibraryV2ApiControllerValidate = exports.triageLibraryV2ApiControllerBulkDelete = exports.triageLibraryV2ApiControllerCreate = exports.triageLibraryV2ApiControllerList = exports.deleteTriageRuleTag = exports.createTriageRuleTag = exports.filterTriageRuleTags = exports.createOffNetworkTriageTaskFile = exports.updateScheduledTriageTask = exports.assignTriageTask = exports.validateTriageRule = exports.deleteBulkTriageRules = exports.updateTriageRule = exports.getTriageRule = exports.deleteTriageRule = exports.createTriageRule = exports.getManyTriageRules = exports.gitRepositoriesGetRepositoryBranches = exports.gitRepositoriesTestConnection = exports.gitRepositoriesBrowseTree = exports.gitRepositoriesGetSyncLogs = exports.gitRepositoriesTriggerSync = exports.gitRepositoriesBulkDelete = exports.gitRepositoriesUpdate = exports.gitRepositoriesGetOne = exports.gitRepositoriesDelete = exports.gitRepositoriesCreate = exports.gitRepositoriesGetMany = exports.acquisitionLibraryDeviceV2ApiControllerUpdate = exports.acquisitionLibraryDeviceV2ApiControllerGet = exports.acquisitionLibraryDeviceV2ApiControllerDelete = exports.acquisitionLibraryDeviceV2ApiControllerBulkDelete = exports.acquisitionLibraryDeviceV2ApiControllerCreate = exports.acquisitionLibraryDeviceV2ApiControllerList = exports.acquisitionValidateOsQueries = exports.acquisitionUpdateScheduledImageAcquisition = exports.acquisitionUpdateScheduledEvidenceAcquisition = exports.acquisitionAcquireImage = exports.createOffNetworkAcquisitionTaskFile = exports.acquisitionAssignEvidenceTask2 = exports.acquisitionAssignEvidenceTask = exports.acquisitionDeleteBulk = exports.acquisitionUpdate = exports.acquisitionGet = exports.acquisitionDelete = exports.acquisitionCreate = exports.acquisitionProfilesGetOne = exports.licenseGetQuota = exports.licenseGetSubscriptionDetails = exports.licenseRefreshLicense = void 0;
-exports.policyUpdate = exports.policyGet = exports.policyDelete = exports.policyUpdatePriorities = exports.policyCreate = exports.policyFilter = exports.policyGetMatchStats = exports.auditLogsUpdateEventFilter = exports.auditLogsGetEventFilter = exports.auditLogsGetEventTypes = exports.auditLogExport = exports.auditLogsGetMany = exports.notificationMarkAsRead = exports.notificationMarkAllAsRead = exports.notificationFilter = exports.notificationDeleteAll = exports.evidenceRepositoryUpdateGoogleCloudStorage = exports.evidenceRepositoryCreateGoogleCloudStorage = exports.evidenceRepositoryValidateGoogleCloudStorage = exports.evidenceRepositoryValidateSftpRepository = exports.evidenceRepositoryValidateFtpsRepository = exports.evidenceRepositoryValidateAzureStorage = exports.evidenceRepositoryValidateS3Compatible = exports.evidenceRepositoryValidateAmazonS3 = exports.evidenceRepositoryValidateById = exports.evidenceRepositoriesGetMany = exports.evidenceRepositoriesGet = exports.evidenceRepositoryDelete = exports.evidenceRepositoryUpdateS3Compatible = exports.evidenceRepositoryCreateS3Compatible = exports.evidenceRepositoryUpdateAmazonS3 = exports.evidenceRepositoryCreateAmazonS3 = exports.evidenceRepositoryUpdateAzureStorage = exports.evidenceRepositoryCreateAzureStorage = exports.evidenceRepositoryUpdateFtps = exports.evidenceRepositoryCreateFtps = exports.evidenceRepositoryUpdateSftp = exports.evidenceRepositoryCreateSftp = exports.evidenceRepositoryUpdateSmb = exports.evidenceRepositoryCreateSmb = exports.evidenceGetCasePpcFile = exports.evidenceGetCaseReportFileInfo = exports.evidenceDownloadExternalEvidence = exports.evidenceGetCaseReport1 = exports.evidenceGetCaseReport0 = exports.triageLibraryExportV2ApiControllerDownload = exports.triageLibraryExportV2ApiControllerExport = exports.triageLibraryV2ApiControllerUpdate = exports.triageLibraryV2ApiControllerGet = exports.triageLibraryV2ApiControllerDelete = void 0;
-exports.caseDeleteCaseNote = exports.caseAddCaseNote = exports.caseExportActivities = exports.casesGetActivities = exports.casesGetEndpoints2 = exports.casesGetEndpoints = exports.caseFilterTaskAssignments = exports.casesGetTasks = exports.casesChangeOwner = exports.casesArchiveByFilter = exports.casesCloseByFilter = exports.caseArchiveCase = exports.caseReopenCase = exports.casesClose = exports.casesCreate = exports.casesGetMany = exports.caseUpdateCase = exports.casesGet = exports.caseExportCaseEndpoints1 = exports.caseExportCaseEndpoints0 = exports.caseExportCaseNotes = exports.caseExportCases = exports.casesCheckName = exports.autoAssetTagUpdateScheduledAatTask = exports.autoAssetTagAssignAutoAssetTaggingTask = exports.autoAssetTagDeleteBulk = exports.autoAssetTagUpdateStatus = exports.autoAssetTagUpdateAutoAssetTag = exports.autoAssetTagGetById = exports.autoAssetTagDelete = exports.autoAssetTagSaveAutoAssetTag = exports.autoAssetTagFilter = exports.organizationGetUsers = exports.organizationAddTags = exports.organizationRemoveTags = exports.organizationUpdateDeploymentToken = exports.organizationUpdateShareableDeploymentStatus = exports.organizationGetOrganizationIdByToken = exports.organizationAssignGroups = exports.organizationRemoveGroups = exports.organizationAssignUsers = exports.organizationRemoveUsers = exports.organizationUpdate = exports.organizationGet = exports.organizationDelete = exports.organizationCheckNameExists = exports.organizationCreate = exports.organizationsGetMany = exports.policyCheckNameExists = exports.policyUpdateStatus = void 0;
+exports.endpointGetCasesById0 = exports.endpointSearch1 = exports.endpointSearch0 = exports.endpointFilterByPolicyFilter1 = exports.endpointFilterByPolicyFilter0 = exports.endpointFilterDisks1 = exports.endpointFilterDisks0 = exports.assetsSetMitreAttackDatabaseVersion2 = exports.assetsSetMitreAttackDatabaseVersion = exports.assetsAddTags2 = exports.assetsRemoveTags2 = exports.assetsAddTags = exports.assetsRemoveTags = exports.endpointPurgeAssetDataByFilter1 = exports.endpointPurgeAssetDataByFilter0 = exports.endpointUninstallEndpointsByFilter1 = exports.endpointUninstallEndpointsByFilter0 = exports.endpointUninstallAgentsAndPurgeByFilter2 = exports.endpointUninstallAgentsAndPurgeByFilter1 = exports.endpointUninstallAgentsAndPurgeByFilter0 = exports.endpointImportPpcToExistedEndpoint1 = exports.endpointImportPpcToExistedEndpoint0 = exports.endpointImportPpcAsEndpoint1 = exports.endpointImportPpcAsEndpoint0 = exports.assetsGetMany4 = exports.assetsGetMany3 = exports.endpointGetDeviceNameConflicts1 = exports.endpointGetDeviceNameConflicts0 = exports.endpointGetEndpointsWithTaskCount = exports.assetsGetManyByFilterExpression2 = exports.assetsGetManyByFilterExpression = exports.assetsGetManyByFilter2 = exports.assetsGetManyByFilter = exports.assetsGetMany2 = exports.assetsGetMany = exports.assetsUpdateLabel2 = exports.assetsUpdateLabel = exports.assetsUpdateTags2 = exports.assetsUpdateTags = exports.endpointExportEndpoints1 = exports.endpointExportEndpoints0 = exports.openApiAliasV2ApiControllerGet = exports.capabilitiesV2ApiControllerGet = exports.paramsGetMitreAttackTactics = exports.paramsEvidenceList = exports.paramsEventLogRecordTypes = exports.paramsEDiscoveryPatterns = exports.paramsGetDroneAnalyzers = exports.loggerDownloadLogsDir = exports.appGetBasicInfo = void 0;
+exports.assetsGetTasks2 = exports.assetsGetTasks = exports.assetsAssignIsolationTask2 = exports.assetsAssignIsolationTask = exports.assetsAssignVersionUpdateTask2 = exports.assetsAssignVersionUpdateTask = exports.endpointTaskAssignRetrieveLogTask1 = exports.endpointTaskAssignRetrieveLogTask0 = exports.assetsAssignShutdownTask2 = exports.assetsAssignShutdownTask = exports.assetsAssignRebootTask2 = exports.assetsAssignRebootTask = exports.taskGenerateOffNetworkZipPassword = exports.taskDownloadOffNetworkTask = exports.taskImportOffNetworkCollectionToTask = exports.taskCreateOffNetworkTask = exports.taskCancel = exports.taskCancelByFilter = exports.taskDeleteAndPurgeByFilter = exports.taskDeleteByFilter = exports.tasksGetData = exports.taskRenameTask = exports.tasksGetMany = exports.tasksGetById = exports.taskDelete = exports.getTaskDisplayTypes = exports.endpointGroupGetRootGroups = exports.endpointGroupGetChildGroupsOfGroup = exports.endpointTagRenameAssetTag = exports.endpointTagDeleteAssetTag = exports.endpointTagDeleteAllAssetTags = exports.endpointTagCreateAssetTag = exports.endpointTagFilterAssetTags = exports.endpointSetMaintenanceMode1 = exports.endpointSetMaintenanceMode0 = exports.endpointUpdateEndpointConnectionRoute1 = exports.endpointUpdateEndpointConnectionRoute0 = exports.endpointDeployCloudAssetsByFilter1 = exports.endpointDeployCloudAssetsByFilter0 = exports.endpointGetCloudAssetDetails1 = exports.endpointGetCloudAssetDetails0 = exports.endpointSyncLdap1 = exports.endpointSyncLdap0 = exports.endpointDownloadLogFile1 = exports.endpointDownloadLogFile0 = exports.endpointSetExcludeFromUpdatesToEndpointsByFilter1 = exports.endpointSetExcludeFromUpdatesToEndpointsByFilter0 = exports.endpointExportCasesByEndpointId1 = exports.endpointExportCasesByEndpointId0 = exports.endpointGetCasesById1 = void 0;
+exports.settingsSaveIpRestriction = exports.settingsValidateIpRestriction = exports.settingsSaveCaseAutoClose = exports.settingsSaveFleetAi = exports.settingsSaveInterAct = exports.settingsSaveAutoAssetTagging = exports.settingsSaveEnforceTfa = exports.settingsSaveAgent = exports.settingsValidateS3 = exports.settingsValidateSftp = exports.settingsSaveBackupRestore = exports.settingsSavePolicy = exports.settingsValidateSsl = exports.settingsSaveSsl = exports.settingsValidateSmtp = exports.settingsSaveSmtp = exports.settingsValidateSyslog = exports.settingsSaveSyslog = exports.settingsGetSyslogEventTypes = exports.settingsValidateActiveDirectory = exports.settingsSaveActiveDirectory = exports.settingsValidateTrustedCertificate = exports.settingsDeleteTrustedCertificate = exports.settingsAddTrustedCertificateWithoutValidation = exports.settingsAddTrustedCertificate = exports.settingsGetTrustedCertificates = exports.settingsTestProxy1 = exports.settingsTestProxy0 = exports.settingsSaveProxy = exports.settingsSaveGeneralSettings = exports.settingsGetSettings = exports.tasksTriageV2ApiControllerDeleteOne = exports.tasksTriageV2ApiControllerCancelOne = exports.tasksTriageV2ApiControllerDelete = exports.tasksTriageV2ApiControllerCancel = exports.tasksTriageV2ApiControllerListHuntTasks = exports.tasksV2ApiControllerListTaskAssignments = exports.tasksV2ApiControllerListTaskAssets = exports.tasksV2ApiControllerUpdateTask = exports.tasksV2ApiControllerGetTaskById = exports.taskAssignmentGenerateTaskAssignmentReport = exports.taskAssignmentGet = exports.taskAssignmentDelete = exports.taskAssignmentCancel = exports.tasksAssignmentsGetMany = exports.endpointTaskGetComparableTasksByVendorDeviceId = exports.endpointTaskRetryUpload1 = exports.endpointTaskRetryUpload0 = exports.endpointTaskPurgeLocalData1 = exports.endpointTaskPurgeLocalData0 = void 0;
+exports.userPatTokensCreate = exports.userPatTokensGetMany = exports.userGroupUpdateGroup = exports.userGroupGetGroup = exports.userGroupDeleteGroup = exports.userGroupCreateGroup = exports.userGroupFilterGroups = exports.userRolesUpdateRole = exports.userRolesGetRole = exports.userRolesDeleteRole = exports.userRolesCreateRole = exports.userRolesGetRoles = exports.userRolesGetPrivileges = exports.userCreateApiUser = exports.userResetUserPassword = exports.userChangePassword = exports.userResetTfa = exports.userManagementUsersPurgeAndDelete = exports.userUpdateUser = exports.userPatchUser = exports.userManagementUsersGet = exports.userDelete = exports.userCreate = exports.userManagementUsersGetMany = exports.authGetUserSessionHistory = exports.authRegeneratePatToken = exports.authRenewOneClickLoginUrl = exports.authGenerateOneClickLoginUrl = exports.authLogin = exports.authOneClickLogin = exports.authUpdateProfile = exports.authCheckAuth = exports.settingsUpdateSsoProvider = exports.settingsDeleteSsoProvider = exports.settingsCreateSsoProvider = exports.settingsGetSsoProviders = exports.settingsSingleSignOnCallback = exports.settingsSaveMandatoryCaseSelection = exports.settingsGetMitreAttackDatabaseReleaseNotes = exports.settingsGetMitreAttackDatabaseVersions = exports.settingsSaveMitreAttackDatabaseSettings = exports.settingsGetAutoUpdateWindows = exports.settingsSaveAutoUpdateSettings = exports.settingsGetAutoUpdateSettings = exports.settingsSaveUninstallationPasswordProtection = exports.settingsSaveBanner = exports.settingsSaveConsoleAddress = exports.settingsValidateConsoleAddress = exports.settingsSaveRfc3161 = exports.settingsSaveLocard = void 0;
+exports.taxiiFeedsUpdateStatus = exports.taxiiFeedsCancelSync = exports.taxiiFeedsTriggerSync = exports.taxiiFeedsDiscoverCollections = exports.taxiiFeedsGetSyncLogs = exports.taxiiFeedsUpdate = exports.taxiiFeedsGetOne = exports.taxiiFeedsDelete = exports.taxiiFeedsGetIndicatorSummary = exports.taxiiFeedsGetIndicators = exports.taxiiFeedsCreate = exports.taxiiFeedsGetMany = exports.gitRepositoriesGetRepositoryBranches = exports.gitRepositoriesTestConnection = exports.gitRepositoriesBrowseTree = exports.gitRepositoriesGetSyncLogs = exports.gitRepositoriesCancelSync = exports.gitRepositoriesTriggerSync = exports.gitRepositoriesBulkDelete = exports.gitRepositoriesUpdate = exports.gitRepositoriesGetOne = exports.gitRepositoriesDelete = exports.gitRepositoriesCreate = exports.gitRepositoriesGetMany = exports.acquisitionLibraryDeviceV2ApiControllerUpdate = exports.acquisitionLibraryDeviceV2ApiControllerGet = exports.acquisitionLibraryDeviceV2ApiControllerDelete = exports.acquisitionLibraryDeviceV2ApiControllerBulkDelete = exports.acquisitionLibraryDeviceV2ApiControllerCreate = exports.acquisitionLibraryDeviceV2ApiControllerList = exports.acquisitionValidateOsQueries = exports.acquisitionUpdateScheduledImageAcquisition = exports.acquisitionUpdateScheduledEvidenceAcquisition = exports.acquisitionAcquireImage = exports.createOffNetworkAcquisitionTaskFile = exports.acquisitionAssignEvidenceTask2 = exports.acquisitionAssignEvidenceTask = exports.acquisitionDeleteBulk = exports.acquisitionUpdate = exports.acquisitionGet = exports.acquisitionDelete = exports.acquisitionCreate = exports.acquisitionProfilesGetOne = exports.licenseGetQuota = exports.licenseGetSubscriptionDetails = exports.licenseRefreshLicense = exports.licenseSetLicense = exports.licenseGetLicense = exports.userPatTokensDelete = exports.userPatTokensRotate = void 0;
+exports.evidenceRepositoryValidateGoogleCloudStorage = exports.evidenceRepositoryValidateSftpRepository = exports.evidenceRepositoryValidateFtpsRepository = exports.evidenceRepositoryValidateAzureStorage = exports.evidenceRepositoryValidateS3Compatible = exports.evidenceRepositoryValidateAmazonS3 = exports.evidenceRepositoryValidateById = exports.evidenceRepositoriesGetMany = exports.evidenceRepositoriesGet = exports.evidenceRepositoryDelete = exports.evidenceRepositoryUpdateS3Compatible = exports.evidenceRepositoryCreateS3Compatible = exports.evidenceRepositoryUpdateAmazonS3 = exports.evidenceRepositoryCreateAmazonS3 = exports.evidenceRepositoryUpdateAzureStorage = exports.evidenceRepositoryCreateAzureStorage = exports.evidenceRepositoryUpdateFtps = exports.evidenceRepositoryCreateFtps = exports.evidenceRepositoryUpdateSftp = exports.evidenceRepositoryCreateSftp = exports.evidenceRepositoryUpdateSmb = exports.evidenceRepositoryCreateSmb = exports.evidenceGetCasePpcFile = exports.evidenceGetCaseReportFileInfo = exports.evidenceDownloadExternalEvidence = exports.evidenceGetCaseReport1 = exports.evidenceGetCaseReport0 = exports.triageLibraryExportV2ApiControllerDownload = exports.triageLibraryExportV2ApiControllerExport = exports.triageLibraryV2ApiControllerUpdate = exports.triageLibraryV2ApiControllerGet = exports.triageLibraryV2ApiControllerDelete = exports.triageLibraryV2ApiControllerValidate = exports.triageLibraryV2ApiControllerBulkDelete = exports.triageLibraryV2ApiControllerCreate = exports.triageLibraryV2ApiControllerList = exports.deleteTriageRuleTag = exports.createTriageRuleTag = exports.filterTriageRuleTags = exports.createOffNetworkTriageTaskFile = exports.updateScheduledTriageTask = exports.assignTriageTask = exports.validateTriageRule = exports.deleteBulkTriageRules = exports.updateTriageRule = exports.getTriageRule = exports.deleteTriageRule = exports.createTriageRule = exports.getManyTriageRules = exports.taxiiFeedsBulkDelete = void 0;
+exports.caseActivityV2ApiControllerFilterCaseActivities = exports.caseActivityV2ApiControllerFilterGlobalActivities = exports.autoAssetTagUpdateScheduledAatTask = exports.autoAssetTagAssignAutoAssetTaggingTask = exports.autoAssetTagDeleteBulk = exports.autoAssetTagUpdateStatus = exports.autoAssetTagUpdateAutoAssetTag = exports.autoAssetTagGetById = exports.autoAssetTagDelete = exports.autoAssetTagSaveAutoAssetTag = exports.autoAssetTagFilter = exports.organizationGetUsers = exports.organizationAddTags = exports.organizationRemoveTags = exports.organizationUpdateDeploymentToken = exports.organizationUpdateShareableDeploymentStatus = exports.organizationGetOrganizationIdByToken = exports.organizationAssignGroups = exports.organizationRemoveGroups = exports.organizationAssignUsers = exports.organizationRemoveUsers = exports.organizationUpdate = exports.organizationGet = exports.organizationDelete = exports.organizationCheckNameExists = exports.organizationCreate = exports.organizationsGetMany = exports.policyCheckNameExists = exports.policyUpdateStatus = exports.policyUpdate = exports.policyGet = exports.policyDelete = exports.policyUpdatePriorities = exports.policyCreate = exports.policyFilter = exports.policyGetMatchStats = exports.auditLogsUpdateEventFilter = exports.auditLogsGetEventFilter = exports.auditLogsGetEventTypes = exports.auditLogExport = exports.auditLogsGetMany = exports.notificationMarkAsRead = exports.notificationMarkAllAsRead = exports.notificationFilter = exports.notificationDeleteAll = exports.evidenceRepositoryUpdateBox = exports.evidenceRepositoryCreateBox = exports.evidenceRepositoryValidateBox = exports.evidenceRepositoryUpdateGoogleCloudStorage = exports.evidenceRepositoryCreateGoogleCloudStorage = void 0;
+exports.caseDeleteCaseNote = exports.caseAddCaseNote = exports.caseExportActivities = exports.casesGetActivities = exports.casesGetAssetsByFilterExpression2 = exports.casesGetAssetsByFilterExpression = exports.casesGetEndpoints2 = exports.casesGetEndpoints = exports.caseFilterTaskAssignments = exports.casesGetTasks = exports.casesChangeOwner = exports.casesArchiveByFilter = exports.casesCloseByFilter = exports.caseArchiveCase = exports.caseReopenCase = exports.casesClose = exports.casesCreate = exports.casesGetMany = exports.caseUpdateCase = exports.casesGet = exports.casesCreateAssetsExpressionExport2 = exports.casesDownloadAssetsExpressionExport2 = exports.casesCreateAssetsExpressionExport = exports.casesDownloadAssetsExpressionExport = exports.caseExportCaseEndpoints1 = exports.caseExportCaseEndpoints0 = exports.caseExportCaseNotes = exports.caseExportCases = exports.casesCheckName = exports.caseV2ApiControllerUpdateCase = exports.caseV2ApiControllerGetCaseByIdOrName = exports.caseV2ApiControllerCreateCase = exports.caseV2ApiControllerFilterCases = exports.caseActionV2ApiControllerRemoveAssets = exports.caseActionV2ApiControllerArchive = exports.caseActionV2ApiControllerReopen = exports.caseActionV2ApiControllerClose = exports.caseTaskAssignmentV2ApiControllerRemoveTaskAssignment = exports.caseTaskAssignmentV2ApiControllerImportTaskAssignments = exports.caseTaskAssignmentV2ApiControllerFilterTaskAssignments = exports.caseNoteV2ApiControllerUpdateNote = exports.caseNoteV2ApiControllerDeleteNote = exports.caseNoteV2ApiControllerCreateNote = exports.caseNoteV2ApiControllerFilterNotes = exports.caseTaskV2ApiControllerFilterTasks = exports.caseUserV2ApiControllerFilterUsers = exports.caseAssetV2ApiControllerFilterAssets = exports.caseBulkActionV2ApiControllerArchive = exports.caseBulkActionV2ApiControllerClose = exports.caseExportV2ApiControllerExportCases = void 0;
 exports.interactLibrarySnippetV2ApiControllerGet = exports.interactLibrarySnippetV2ApiControllerDelete = exports.interactLibrarySnippetV2ApiControllerBulkDelete = exports.interactLibrarySnippetV2ApiControllerCreate = exports.interactLibrarySnippetV2ApiControllerList = exports.interactCommandSnippetTagsUpdate = exports.interactCommandSnippetTagsDelete = exports.interactCommandSnippetTagsCreate = exports.interactCommandSnippetTagsGetMany = exports.interactCommandSnippetsBulkDelete = exports.interactCommandSnippetsUpdate = exports.interactCommandSnippetsGetOne = exports.interactCommandSnippetsDelete = exports.interactCommandSnippetsCreate = exports.interactCommandSnippetsGetMany = exports.interactLibraryDelete = exports.interactLibraryDeleteBulk = exports.interactLibraryDownload = exports.interactLibraryUpload = exports.interactLibraryCheckLibraryFileExists = exports.interactLibraryFilter = exports.interactSessionGetCommandMessage = exports.interactSessionClose = exports.interactSessionInterruptCommand = exports.interactSessionExecuteAsyncCommand = exports.interactSessionExecuteCommand = exports.interactGetInterActShellReport = exports.interactShellAssignTask = exports.interactCommandsDownloadResultFile = exports.interactCommandsGetMany = exports.exportClosureReportAssets = exports.exportClosureReportFlags = exports.exportClosureReportFindings = exports.updateCaseCloseReport2 = exports.getCaseCloseReport2 = exports.updateCaseCloseReport = exports.getCaseCloseReport = exports.getCaseCloseReportHistory = exports.caseCategoriesDelete = exports.caseCategoriesCreate = exports.caseCategoriesFilter = exports.caseTagsDelete = exports.caseTagsCreate = exports.caseTagsFilter = exports.caseRemoveTaskAssignmentFromCase = exports.caseRemoveEndpointsFromCaseByFilter1 = exports.caseRemoveEndpointsFromCaseByFilter0 = exports.casesGetUsers = exports.caseImportTaskAssignment = exports.caseEditCaseNote = void 0;
-exports.investigationExportFlags = exports.investigationGetEvidenceRelationData = exports.investigationGetEvidenceData = exports.investigationGetEvidenceDataStructure = exports.investigationGetInvestigationMigrationsSummary = exports.investigationUpdateInvestigation = exports.investigationGetInvestigationById = exports.cloudAccountsSyncAllCloudAccount = exports.cloudAccountsSyncCloudAccount = exports.cloudAccountsUpdateCloudAccount = exports.cloudAccountsGetCloudAccountById = exports.cloudAccountsDelete = exports.cloudAccountsExport = exports.cloudAccountsGetConfig = exports.cloudAccountsCreateCloudAccount = exports.cloudAccountsFilter = exports.systemApiTokensUpdate = exports.systemApiTokensGetOne = exports.systemApiTokensDelete = exports.systemApiTokensCreate = exports.systemApiTokensGetMany = exports.apiTokensBulkDelete = exports.apiTokensUpdate = exports.apiTokensGetOne = exports.apiTokensDelete = exports.apiTokensGetCurrent = exports.apiTokensCreate = exports.apiTokensGetMany = exports.baselineGetComparisonReportByVendorDeviceId = exports.baselineGetComparisonReport = exports.baselineAcquire = exports.baselineCompare = exports.multipartUploadUploadPart = exports.multipartUploadDeleteFileParts = exports.multipartUploadIsReady = exports.multipartUploadFinalize = exports.multipartUploadInitialize = exports.multipartUploadInitializeHead = exports.interactLibraryFileV2ApiControllerDownload = exports.interactLibraryFileV2ApiControllerDelete = exports.interactLibraryFileV2ApiControllerBulkDelete = exports.interactLibraryFileV2ApiControllerUpload = exports.interactLibraryFileV2ApiControllerList = exports.interactLibraryTagV2ApiControllerUpdate = exports.interactLibraryTagV2ApiControllerGet = exports.interactLibraryTagV2ApiControllerDelete = exports.interactLibraryTagV2ApiControllerBulkDelete = exports.interactLibraryTagV2ApiControllerCreate = exports.interactLibraryTagV2ApiControllerList = exports.interactLibrarySnippetV2ApiControllerUpdate = void 0;
-exports.investigationFlagFilterFlags = exports.investigationReportDownloadPdfReport = exports.investigationReportGeneratePdfReport = exports.investigationReportUpdateReport = exports.investigationReportGetReport = exports.investigationReportDeleteReport = exports.investigationReportCreateReport = exports.investigationReportFilterReports = exports.investigationReportExportReports = exports.investigationExclusionDeleteIndividualFindingExclusionRule = exports.investigationExclusionApplyFindingExclusionRuleForAllAssets = exports.investigationExclusionApplyFindingExclusionRuleForOrganization = exports.investigationExclusionGetExclusionReasons = exports.investigationExclusionFilterFindingExclusionRules = exports.investigationExclusionDeleteFindingExclusionRule = exports.investigationExclusionGetFindingExclusionRulesMatches = exports.investigationExclusionBulkAddFindingExclusionRules = exports.investigationExclusionAddFindingExclusionRule = exports.investigationImportTornadoEvidenceToInvestigation1 = exports.investigationImportTornadoEvidenceToInvestigation0 = exports.investigationCreateExportRequestForFindings = exports.investigationExportFindingsData = exports.investigationGetInvestigationHubDataImportProgress = exports.investigationGetInvestigationTaskAssignmentDataImportProgress = exports.investigationGetInvestigationTaskAssignmentForImportedEvidence = exports.investigationUpdateInvestigationFinding = exports.investigationMarkInvestigationEvidenceAsFinding = exports.investigationRetryImportTaskAssignment = exports.investigationImportPstEvidencesToInvestigation = exports.investigationGetImportErrors = exports.investigationDeleteImport = exports.investigationGetAllImports = exports.investigationImportDataToInvestigationEvidence = exports.investigationUpdateInvestigationEvidence = exports.investigationCreateInvestigationEvidence = exports.investigationUpdateEvidenceNote = exports.investigationFlagEvidence = exports.investigationRemoveEvidenceFlag = exports.investigationEvidenceCounts = exports.investigationGlobalSearch = exports.investigationGetMitreMatches = exports.investigationGetFindingsSummary = exports.investigationFilterEndpointFindings = exports.investigationGetFindingDataStructure = exports.investigationGetSummary = exports.investigationGetSectionsByEndpoints = exports.investigationGetAssetsByInvestigationId = exports.investigationCreateExportRequestForSectionData = exports.investigationExportEvidenceData = exports.investigationCreateExportRequestForFlags = void 0;
-exports.assetActionV2ApiControllerEnableMaintenance = exports.assetActionV2ApiControllerVersionUpdate = exports.assetActionV2ApiControllerRetrieveLogs = exports.assetActionV2ApiControllerUnisolate = exports.assetActionV2ApiControllerIsolate = exports.assetActionV2ApiControllerShutdown = exports.assetActionV2ApiControllerReboot = exports.assetV2ApiControllerUpdateLabel = exports.assetV2ApiControllerReplaceTags = exports.assetV2ApiControllerGetAsset = exports.assetV2ApiControllerDeleteAsset = exports.assetV2ApiControllerFilterAssets = exports.assetV2ApiControllerExportAssets = exports.assetV2ApiControllerGetStats = exports.processorGetProcessorTypeByAssetType = exports.processorGetProcessorsByAssetType = exports.processorGetAllProcessors = exports.recentActivitiesCreate = exports.recentActivitiesGetMany = exports.relayProUpdateRelayUrl = exports.relayProRemove = exports.relayServerUpdateAddress = exports.relayServerRemoveRelayServer = exports.relayServerAssignFixUpdateRequiredIssueTask = exports.relayServerAssignRetrieveLogTask = exports.relayServerAssignRebootTask = exports.relayServerFilter = exports.relayServerGetById = exports.relayServerUpdateLabel = exports.relayServerUpdateTags = exports.investigationTaskExecutionLogFilterTaskExecutionLogs = exports.investigationTaskExecutionLogGetTaskExecutionLogs = exports.investigationTimelineCreateExportRequestForTimeline = exports.investigationTimelineExportTimelineData = exports.investigationTimelineGetTotalTimelineCount = exports.investigationTimelineGetTimelineStructure = exports.investigationTimelineFilterTimelineEvents = exports.investigationTimelineGetTimelineEventCountByAdvancedFilter = exports.investigationAdvancedFilterUpdateFilter = exports.investigationAdvancedFilterDeleteFilter = exports.investigationAdvancedFilterCreateFilter = exports.investigationAdvancedFilterGetFilters = exports.investigationCommentDeleteComment = exports.investigationCommentCommentEvidence = exports.investigationCommentFilterComments = exports.investigationActivityMarkAsRead = exports.investigationActivityFilter = exports.investigationFlagUpdateFlag = exports.investigationFlagDeleteFlag = exports.investigationFlagCreateFlag = void 0;
-exports.investigationDataUsageGetActualDataUsages = exports.eventSubscriptionTestEventSubscription = exports.eventSubscriptionDeleteBulkEventSubscriptions = exports.eventSubscriptionSubscriptionEventNames = exports.eventSubscriptionUpdateEventSubscription = exports.eventSubscriptionGetEventSubscription = exports.eventSubscriptionDeleteEventSubscription = exports.eventSubscriptionCreateEventSubscription = exports.eventSubscriptionFilterEventSubscriptions = exports.webhookDeleteBulk = exports.webhookUpdate = exports.webhookGet = exports.webhookDelete = exports.webhookCreate = exports.webhookFilter = exports.webhookFilterParsers = exports.assetInteractMessageV2ApiControllerGetSessionReport = exports.assetInteractMessageV2ApiControllerDownloadMessageOutput = exports.assetInteractMessageV2ApiControllerGetMessage = exports.assetInteractMessageV2ApiControllerListSessionsForAsset = exports.assetInteractV2ApiControllerCloseSession = exports.assetInteractV2ApiControllerCancelCommand = exports.assetInteractV2ApiControllerRunCommand = exports.assetInteractMessageV2ApiControllerListForAsset = exports.assetAcquisitionV2ApiControllerFilterAcquisitionTasks = exports.assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = exports.assetAcquisitionV2ApiControllerCancelAcquisition = exports.assetAcquisitionV2ApiControllerAcquire = exports.assetTriageV2ApiControllerDeleteTriageAssignment = exports.assetTriageV2ApiControllerCancelTriage = exports.assetTriageV2ApiControllerRunTriage = exports.assetTriageV2ApiControllerFilterTriageTasks = exports.assetBulkTriageV2ApiControllerRunTriage = exports.assetBulkMetadataV2ApiControllerImportOffNetworkPpc = exports.assetBulkMetadataV2ApiControllerDeleteAssets = exports.assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = exports.assetBulkMetadataV2ApiControllerSetConnectionRoute = exports.assetBulkMetadataV2ApiControllerSetUpdateExclusion = exports.assetBulkMetadataV2ApiControllerRemoveTags = exports.assetBulkMetadataV2ApiControllerAddTags = exports.assetBulkActionV2ApiControllerDisableMaintenance = exports.assetBulkActionV2ApiControllerEnableMaintenance = exports.assetBulkActionV2ApiControllerVersionUpdate = exports.assetBulkActionV2ApiControllerRetrieveLogs = exports.assetBulkActionV2ApiControllerUnisolate = exports.assetBulkActionV2ApiControllerIsolate = exports.assetBulkActionV2ApiControllerShutdown = exports.assetBulkActionV2ApiControllerReboot = exports.assetActionV2ApiControllerImportPpcToExistingAsset = exports.assetActionV2ApiControllerDisableMaintenance = void 0;
-exports.imageEvidenceAcquisitionProfilesCreate = exports.imageEvidenceAcquisitionProfilesGetMany = exports.cloudAcquisitionLibraryApiControllerUpdate = exports.cloudAcquisitionLibraryApiControllerGet = exports.cloudAcquisitionLibraryApiControllerDelete = exports.cloudAcquisitionLibraryApiControllerBulkDelete = exports.cloudAcquisitionLibraryApiControllerCreate = exports.cloudAcquisitionLibraryApiControllerList = exports.cloudAcquisitionProfilesUpdate = exports.cloudAcquisitionProfilesGetOne = exports.cloudAcquisitionProfilesDelete = exports.cloudAcquisitionProfilesCreate = exports.cloudAcquisitionProfilesGetMany = exports.fullTextSearchTaskUpdateScheduledFullTextSearchTask = exports.fullTextSearchTaskAssign = exports.fullTextSearchProfilesDeleteBulk = exports.fullTextSearchProfilesUpdate = exports.fullTextSearchProfilesGetOne = exports.fullTextSearchProfilesDelete = exports.fullTextSearchProfilesCreate = exports.fullTextSearchProfilesGetMany = exports.automationHubDisableAutomation = exports.automationHubEnableAutomation = exports.automationHubGetAutomationChangeHistory = exports.automationHubGetAutomationExecutions = exports.automationHubUpdateAutomation = exports.automationHubGetAutomation = exports.automationHubDeleteAutomation = exports.automationHubExecuteIntegration = exports.automationHubGetTags = exports.automationHubGetTriggerTypes = exports.automationHubTestAction = exports.automationHubGetActionTypes = exports.automationHubCreateAutomation = exports.automationHubFilterAutomations = exports.automationHubGetExecutionHistory = exports.presetFiltersUpdate = exports.presetFiltersDelete = exports.presetFiltersCreate = exports.presetFiltersGetMany = exports.investigationDataUsageCreateFilter = exports.investigationDataUsageUpdateFilter = exports.investigationDataUsageGetFilter = exports.investigationDataUsageDeleteFilter = exports.investigationDataUsageGetFilters = exports.investigationDataUsageGetDataUsageFilters = exports.investigationDataUsageGetHistoricalDataUsageStatistics = exports.investigationDataUsageGetActualDataUsageStatistics = exports.investigationDataUsageCreateExportRequestForActualDataUsages = exports.investigationDataUsageExportActualDataUsages = void 0;
-exports.diskImageAcquisitionTasksDownload = exports.diskImageAcquisitionTasksCreate = exports.diskImageAcquisitionLibraryApiControllerUpdate = exports.diskImageAcquisitionLibraryApiControllerGet = exports.diskImageAcquisitionLibraryApiControllerDelete = exports.diskImageAcquisitionLibraryApiControllerBulkDelete = exports.diskImageAcquisitionLibraryApiControllerCreate = exports.diskImageAcquisitionLibraryApiControllerList = exports.imageEvidenceAcquisitionProfilesDeleteBulk = exports.imageEvidenceAcquisitionProfilesUpdate = exports.imageEvidenceAcquisitionProfilesGetOne = exports.imageEvidenceAcquisitionProfilesDelete = void 0;
+exports.investigationEvidenceFlagV2ApiControllerFlagEvidence = exports.flagsLibraryV2ApiControllerUpdate = exports.flagsLibraryV2ApiControllerGet = exports.flagsLibraryV2ApiControllerDelete = exports.flagsLibraryV2ApiControllerCreate = exports.flagsLibraryV2ApiControllerList = exports.cloudAccountsSyncAllCloudAccount = exports.cloudAccountsSyncCloudAccount = exports.cloudAccountsUpdateCloudAccount = exports.cloudAccountsGetCloudAccountById = exports.cloudAccountsDelete = exports.cloudAccountsExport = exports.cloudAccountsGetConfig = exports.cloudAccountsCreateCloudAccount = exports.cloudAccountsFilter = exports.systemApiTokensUpdate = exports.systemApiTokensGetOne = exports.systemApiTokensDelete = exports.systemApiTokensCreate = exports.systemApiTokensGetMany = exports.apiTokensBulkDelete = exports.apiTokensUpdate = exports.apiTokensGetOne = exports.apiTokensDelete = exports.apiTokensGetCurrent = exports.apiTokensCreate = exports.apiTokensGetMany = exports.baselineGetComparisonReportByVendorDeviceId = exports.baselineGetComparisonReport = exports.baselineAcquire = exports.baselineCompare = exports.multipartUploadUploadPart = exports.multipartUploadDeleteFileParts = exports.multipartUploadIsReady = exports.multipartUploadFinalize = exports.multipartUploadInitialize = exports.multipartUploadInitializeHead = exports.interactCommandV2ApiControllerList = exports.interactLibraryFileV2ApiControllerDownload = exports.interactLibraryFileV2ApiControllerDelete = exports.interactLibraryFileV2ApiControllerBulkDelete = exports.interactLibraryFileV2ApiControllerUpload = exports.interactLibraryFileV2ApiControllerList = exports.interactLibraryTagV2ApiControllerUpdate = exports.interactLibraryTagV2ApiControllerGet = exports.interactLibraryTagV2ApiControllerDelete = exports.interactLibraryTagV2ApiControllerBulkDelete = exports.interactLibraryTagV2ApiControllerCreate = exports.interactLibraryTagV2ApiControllerList = exports.interactLibrarySnippetV2ApiControllerUpdate = void 0;
+exports.investigationExclusionApplyFindingExclusionRuleForAllAssets = exports.investigationExclusionApplyFindingExclusionRuleForOrganization = exports.investigationExclusionGetExclusionReasons = exports.investigationExclusionFilterFindingExclusionRules = exports.investigationExclusionDeleteFindingExclusionRule = exports.investigationExclusionGetFindingExclusionRulesMatches = exports.investigationExclusionBulkAddFindingExclusionRules = exports.investigationExclusionAddFindingExclusionRule = exports.investigationImportTornadoEvidenceToInvestigation1 = exports.investigationImportTornadoEvidenceToInvestigation0 = exports.investigationCreateExportRequestForFindings = exports.investigationExportFindingsData = exports.investigationGetInvestigationHubDataImportProgress = exports.investigationGetInvestigationTaskAssignmentDataImportProgress = exports.investigationGetInvestigationTaskAssignmentForImportedEvidence = exports.investigationUpdateInvestigationFinding = exports.investigationMarkInvestigationEvidenceAsFinding = exports.investigationRetryImportTaskAssignment = exports.investigationImportPstEvidencesToInvestigation = exports.investigationGetImportErrors = exports.investigationDeleteImport = exports.investigationGetAllImports = exports.investigationImportDataToInvestigationEvidence = exports.investigationUpdateInvestigationEvidence = exports.investigationCreateInvestigationEvidence = exports.investigationUpdateEvidenceNote = exports.investigationFlagEvidence = exports.investigationRemoveEvidenceFlag = exports.investigationEvidenceCounts = exports.investigationGlobalSearch = exports.investigationGetMitreMatches = exports.investigationGetFindingsSummary = exports.investigationFilterEndpointFindings = exports.investigationGetFindingDataStructure = exports.investigationGetSummary = exports.investigationGetSectionsByEndpoints = exports.investigationGetAssetsByInvestigationId = exports.investigationCreateExportRequestForSectionData = exports.investigationExportEvidenceData = exports.investigationCreateExportRequestForFlags = exports.investigationExportFlags = exports.investigationGetEvidenceRelationData = exports.investigationGetEvidenceData = exports.investigationGetEvidenceDataStructure = exports.investigationGetInvestigationMigrationsSummary = exports.investigationUpdateInvestigation = exports.investigationGetInvestigationById = exports.investigationSqlV2ApiControllerExecuteSqlQuery = exports.investigationSqlV2ApiControllerGetSchema = exports.investigationEvidenceFlagV2ApiControllerUnflagEvidence = void 0;
+exports.assetActionV2ApiControllerUnisolate = exports.assetActionV2ApiControllerIsolate = exports.assetActionV2ApiControllerShutdown = exports.assetActionV2ApiControllerReboot = exports.processorGetProcessorTypeByAssetType = exports.processorGetProcessorsByAssetType = exports.processorGetAllProcessors = exports.recentActivitiesCreate = exports.recentActivitiesGetMany = exports.relayProUpdateRelayUrl = exports.relayProRemove = exports.relayServerUpdateAddress = exports.relayServerRemoveRelayServer = exports.relayServerAssignFixUpdateRequiredIssueTask = exports.relayServerAssignRetrieveLogTask = exports.relayServerAssignRebootTask = exports.relayServerFilter = exports.relayServerGetById = exports.relayServerUpdateLabel = exports.relayServerUpdateTags = exports.investigationTaskExecutionLogFilterTaskExecutionLogs = exports.investigationTaskExecutionLogGetTaskExecutionLogs = exports.investigationTimelineCreateExportRequestForTimeline = exports.investigationTimelineExportTimelineData = exports.investigationTimelineGetTotalTimelineCount = exports.investigationTimelineGetTimelineStructure = exports.investigationTimelineFilterTimelineEvents = exports.investigationTimelineGetTimelineEventCountByAdvancedFilter = exports.investigationAdvancedFilterUpdateFilter = exports.investigationAdvancedFilterDeleteFilter = exports.investigationAdvancedFilterCreateFilter = exports.investigationAdvancedFilterGetFilters = exports.investigationCommentDeleteComment = exports.investigationCommentCommentEvidence = exports.investigationCommentFilterComments = exports.investigationActivityMarkAsRead = exports.investigationActivityFilter = exports.investigationFlagUpdateFlag = exports.investigationFlagDeleteFlag = exports.investigationFlagCreateFlag = exports.investigationFlagFilterFlags = exports.investigationReportDownloadPdfReport = exports.investigationReportGeneratePdfReport = exports.investigationReportUpdateReport = exports.investigationReportGetReport = exports.investigationReportDeleteReport = exports.investigationReportCreateReport = exports.investigationReportFilterReports = exports.investigationReportExportReports = exports.investigationExclusionDeleteIndividualFindingExclusionRule = void 0;
+exports.webhookUpdate = exports.webhookGet = exports.webhookDelete = exports.webhookCreate = exports.webhookFilter = exports.webhookFilterParsers = exports.assetInteractMessageV2ApiControllerGetSessionReport = exports.assetInteractMessageV2ApiControllerDownloadMessageOutput = exports.assetInteractMessageV2ApiControllerGetMessage = exports.assetInteractMessageV2ApiControllerListSessionsForAsset = exports.assetAcquisitionV2ApiControllerFilterAcquisitionTasks = exports.assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = exports.assetAcquisitionV2ApiControllerCancelAcquisition = exports.assetAcquisitionV2ApiControllerAcquire = exports.assetTriageV2ApiControllerDeleteTriageAssignment = exports.assetTriageV2ApiControllerCancelTriage = exports.assetTriageV2ApiControllerRunTriage = exports.assetTriageV2ApiControllerFilterTriageTasks = exports.assetV2ApiControllerUpdateLabel = exports.assetV2ApiControllerReplaceTags = exports.assetV2ApiControllerGetAsset = exports.assetV2ApiControllerDeleteAsset = exports.assetV2ApiControllerFilterAssets = exports.assetV2ApiControllerExportAssets = exports.assetV2ApiControllerGetStats = exports.assetInteractV2ApiControllerCloseSession = exports.assetInteractV2ApiControllerCancelCommand = exports.assetInteractV2ApiControllerRunCommand = exports.assetInteractMessageV2ApiControllerListForAsset = exports.assetBulkTriageV2ApiControllerRunTriage = exports.assetBulkMetadataV2ApiControllerImportOffNetworkPpc = exports.assetBulkMetadataV2ApiControllerDeleteAssets = exports.assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = exports.assetBulkMetadataV2ApiControllerSetConnectionRoute = exports.assetBulkMetadataV2ApiControllerSetUpdateExclusion = exports.assetBulkMetadataV2ApiControllerRemoveTags = exports.assetBulkMetadataV2ApiControllerAddTags = exports.assetBulkActionV2ApiControllerDisableMaintenance = exports.assetBulkActionV2ApiControllerEnableMaintenance = exports.assetBulkActionV2ApiControllerVersionUpdate = exports.assetBulkActionV2ApiControllerRetrieveLogs = exports.assetBulkActionV2ApiControllerUnisolate = exports.assetBulkActionV2ApiControllerIsolate = exports.assetBulkActionV2ApiControllerShutdown = exports.assetBulkActionV2ApiControllerReboot = exports.assetActionV2ApiControllerImportPpcToExistingAsset = exports.assetActionV2ApiControllerDisableMaintenance = exports.assetActionV2ApiControllerEnableMaintenance = exports.assetActionV2ApiControllerVersionUpdate = exports.assetActionV2ApiControllerRetrieveLogs = void 0;
+exports.cloudAcquisitionProfilesCreate = exports.cloudAcquisitionProfilesGetMany = exports.fullTextSearchTaskUpdateScheduledFullTextSearchTask = exports.fullTextSearchTaskAssign = exports.fullTextSearchProfilesDeleteBulk = exports.fullTextSearchProfilesUpdate = exports.fullTextSearchProfilesGetOne = exports.fullTextSearchProfilesDelete = exports.fullTextSearchProfilesCreate = exports.fullTextSearchProfilesGetMany = exports.automationHubDisableAutomation = exports.automationHubEnableAutomation = exports.automationHubGenerateTriggerSecret = exports.automationHubGetAutomationChangeHistory = exports.automationHubGetAutomationExecutions = exports.automationHubUpdateAutomation = exports.automationHubGetAutomation = exports.automationHubDeleteAutomation = exports.automationHubExecuteIntegration = exports.automationHubGetTags = exports.automationHubGetTriggerTypes = exports.automationHubTestAction = exports.automationHubGetActionTypes = exports.automationHubCreateAutomation = exports.automationHubFilterAutomations = exports.automationHubGetExecutionHistory = exports.presetFiltersUpdate = exports.presetFiltersDelete = exports.presetFiltersCreate = exports.presetFiltersGetMany = exports.investigationDataUsageCreateFilter = exports.investigationDataUsageUpdateFilter = exports.investigationDataUsageGetFilter = exports.investigationDataUsageDeleteFilter = exports.investigationDataUsageGetFilters = exports.investigationDataUsageGetDataUsageFilters = exports.investigationDataUsageGetHistoricalDataUsageStatistics = exports.investigationDataUsageGetActualDataUsageStatistics = exports.investigationDataUsageCreateExportRequestForActualDataUsages = exports.investigationDataUsageExportActualDataUsages = exports.investigationDataUsageGetActualDataUsages = exports.eventSubscriptionTestEventSubscription = exports.eventSubscriptionDeleteBulkEventSubscriptions = exports.eventSubscriptionSubscriptionEventNames = exports.eventSubscriptionUpdateEventSubscription = exports.eventSubscriptionGetEventSubscription = exports.eventSubscriptionDeleteEventSubscription = exports.eventSubscriptionCreateEventSubscription = exports.eventSubscriptionFilterEventSubscriptions = exports.webhookDeleteBulk = void 0;
+exports.diskImageAcquisitionTasksDownload = exports.diskImageAcquisitionTasksCreate = exports.diskImageAcquisitionLibraryApiControllerUpdate = exports.diskImageAcquisitionLibraryApiControllerGet = exports.diskImageAcquisitionLibraryApiControllerDelete = exports.diskImageAcquisitionLibraryApiControllerBulkDelete = exports.diskImageAcquisitionLibraryApiControllerCreate = exports.diskImageAcquisitionLibraryApiControllerList = exports.imageEvidenceAcquisitionProfilesDeleteBulk = exports.imageEvidenceAcquisitionProfilesUpdate = exports.imageEvidenceAcquisitionProfilesGetOne = exports.imageEvidenceAcquisitionProfilesDelete = exports.imageEvidenceAcquisitionProfilesCreate = exports.imageEvidenceAcquisitionProfilesGetMany = exports.cloudAcquisitionLibraryApiControllerUpdate = exports.cloudAcquisitionLibraryApiControllerGet = exports.cloudAcquisitionLibraryApiControllerDelete = exports.cloudAcquisitionLibraryApiControllerBulkDelete = exports.cloudAcquisitionLibraryApiControllerCreate = exports.cloudAcquisitionLibraryApiControllerList = exports.cloudAcquisitionProfilesUpdate = exports.cloudAcquisitionProfilesGetOne = exports.cloudAcquisitionProfilesDelete = void 0;
 const client_1 = require("./client");
 const client_gen_1 = require("./client.gen");
 const appGetBasicInfo = (options) => {
@@ -110,6 +111,51 @@ const paramsGetMitreAttackTactics = (options) => {
     });
 };
 exports.paramsGetMitreAttackTactics = paramsGetMitreAttackTactics;
+/**
+ * Get caller capabilities
+ * Returns the authenticated caller (type user|apiToken, id, name), the canonical resource:action privileges granted by its roles, the boolean feature flags, the v2 apiVersion and the stable/beta stability tiers, inside the standard envelope. Requires authentication but no specific privilege; every caller may inspect its own capabilities. Takes no parameters.
+ */
+const capabilitiesV2ApiControllerGet = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/_/capabilities',
+        ...options
+    });
+};
+exports.capabilitiesV2ApiControllerGet = capabilitiesV2ApiControllerGet;
+/**
+ * Get the OpenAPI document
+ * Returns the published OpenAPI 3.x document (the same content as /swagger.json) as raw application/json, deliberately WITHOUT the standard v2 envelope so SDK/CLI generators and LLM clients can consume the spec directly. Answers 503 until the document has been generated at startup. Takes no parameters.
+ */
+const openApiAliasV2ApiControllerGet = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            },
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            }
+        ],
+        url: '/api/v2/_/openapi',
+        ...options
+    });
+};
+exports.openApiAliasV2ApiControllerGet = openApiAliasV2ApiControllerGet;
 const endpointExportEndpoints0 = (options) => {
     return (options.client ?? client_gen_1.client).get({
         security: [
@@ -300,33 +346,51 @@ const assetsGetManyByFilter2 = (options) => {
     });
 };
 exports.assetsGetManyByFilter2 = assetsGetManyByFilter2;
-const endpointGetEndpointsWithTaskCount = (options) => {
-    return (options.client ?? client_gen_1.client).get({
+/**
+ * Retrieve many assets by expression filter
+ * Retrieve a paginated list of assets by a flexible filter expression
+ */
+const assetsGetManyByFilterExpression = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
         security: [
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/assets/with-task-count',
-        ...options
+        url: '/api/public/endpoints/filter-query',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.endpointGetEndpointsWithTaskCount = endpointGetEndpointsWithTaskCount;
-const endpointGetEndpointsStats0 = (options) => {
-    return (options.client ?? client_gen_1.client).get({
+exports.assetsGetManyByFilterExpression = assetsGetManyByFilterExpression;
+/**
+ * Retrieve many assets by expression filter
+ * Retrieve a paginated list of assets by a flexible filter expression
+ */
+const assetsGetManyByFilterExpression2 = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
         security: [
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/endpoints/stats',
-        ...options
+        url: '/api/public/assets/filter-query',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.endpointGetEndpointsStats0 = endpointGetEndpointsStats0;
-const endpointGetEndpointsStats1 = (options) => {
+exports.assetsGetManyByFilterExpression2 = assetsGetManyByFilterExpression2;
+const endpointGetEndpointsWithTaskCount = (options) => {
     return (options.client ?? client_gen_1.client).get({
         security: [
             {
@@ -334,11 +398,11 @@ const endpointGetEndpointsStats1 = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/assets/stats',
+        url: '/api/public/assets/with-task-count',
         ...options
     });
 };
-exports.endpointGetEndpointsStats1 = endpointGetEndpointsStats1;
+exports.endpointGetEndpointsWithTaskCount = endpointGetEndpointsWithTaskCount;
 const endpointGetDeviceNameConflicts0 = (options) => {
     return (options.client ?? client_gen_1.client).get({
         security: [
@@ -707,7 +771,7 @@ const assetsSetMitreAttackDatabaseVersion2 = (options) => {
 };
 exports.assetsSetMitreAttackDatabaseVersion2 = assetsSetMitreAttackDatabaseVersion2;
 const endpointFilterDisks0 = (options) => {
-    return (options.client ?? client_gen_1.client).get({
+    return (options.client ?? client_gen_1.client).post({
         security: [
             {
                 scheme: 'bearer',
@@ -715,12 +779,16 @@ const endpointFilterDisks0 = (options) => {
             }
         ],
         url: '/api/public/endpoints/disks',
-        ...options
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
 exports.endpointFilterDisks0 = endpointFilterDisks0;
 const endpointFilterDisks1 = (options) => {
-    return (options.client ?? client_gen_1.client).get({
+    return (options.client ?? client_gen_1.client).post({
         security: [
             {
                 scheme: 'bearer',
@@ -728,7 +796,11 @@ const endpointFilterDisks1 = (options) => {
             }
         ],
         url: '/api/public/assets/disks',
-        ...options
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
 exports.endpointFilterDisks1 = endpointFilterDisks1;
@@ -1058,7 +1130,7 @@ const endpointSetMaintenanceMode1 = (options) => {
     });
 };
 exports.endpointSetMaintenanceMode1 = endpointSetMaintenanceMode1;
-const endpointTagFilterTags = (options) => {
+const endpointTagFilterAssetTags = (options) => {
     return (options.client ?? client_gen_1.client).get({
         security: [
             {
@@ -1070,8 +1142,25 @@ const endpointTagFilterTags = (options) => {
         ...options
     });
 };
-exports.endpointTagFilterTags = endpointTagFilterTags;
-const endpointTagDeleteAllTags = (options) => {
+exports.endpointTagFilterAssetTags = endpointTagFilterAssetTags;
+const endpointTagCreateAssetTag = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/asset-tags',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.endpointTagCreateAssetTag = endpointTagCreateAssetTag;
+const endpointTagDeleteAllAssetTags = (options) => {
     return (options?.client ?? client_gen_1.client).delete({
         security: [
             {
@@ -1083,8 +1172,8 @@ const endpointTagDeleteAllTags = (options) => {
         ...options
     });
 };
-exports.endpointTagDeleteAllTags = endpointTagDeleteAllTags;
-const endpointTagDeleteTag = (options) => {
+exports.endpointTagDeleteAllAssetTags = endpointTagDeleteAllAssetTags;
+const endpointTagDeleteAssetTag = (options) => {
     return (options?.client ?? client_gen_1.client).delete({
         security: [
             {
@@ -1096,7 +1185,24 @@ const endpointTagDeleteTag = (options) => {
         ...options
     });
 };
-exports.endpointTagDeleteTag = endpointTagDeleteTag;
+exports.endpointTagDeleteAssetTag = endpointTagDeleteAssetTag;
+const endpointTagRenameAssetTag = (options) => {
+    return (options.client ?? client_gen_1.client).put({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/asset-tags/{organizationId}/{id}',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.endpointTagRenameAssetTag = endpointTagRenameAssetTag;
 const endpointGroupGetChildGroupsOfGroup = (options) => {
     return (options?.client ?? client_gen_1.client).get({
         security: [
@@ -1743,7 +1849,7 @@ const taskAssignmentGenerateTaskAssignmentReport = (options) => {
 exports.taskAssignmentGenerateTaskAssignmentReport = taskAssignmentGenerateTaskAssignmentReport;
 /**
  * Get task by id
- * Returns a single task wrapped in entities[0], type-discriminated. 404 leak-safe.
+ * Fetch one Binalyze AIR task by UUID using GET /api/v2/tasks/{taskId}. Type-independent: works for triage, acquisition, interactShell and other task types. The response wraps the single task in result.entities[0] and is polymorphic: it carries a type/subtype discriminator plus only the matching domain block (triage{} / acquisition{} / interactShell{}); other blocks are absent, not null. It also returns counts{assigned,completed,failed,cancelled}, organizations[{id,name}], cases[], schedule (null when not scheduled) and taskAssignments{taskAssignmentCount,taskAssignmentsUrl}. Use air-tasks-assignments for the full per-endpoint assignment list and air-tasks-assets for the targeted assets. Only a task UUID is accepted; names and hostnames are rejected. A 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe), so do not infer the task does not exist.
  */
 const tasksV2ApiControllerGetTaskById = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -1766,6 +1872,7 @@ const tasksV2ApiControllerGetTaskById = (options) => {
 exports.tasksV2ApiControllerGetTaskById = tasksV2ApiControllerGetTaskById;
 /**
  * Update a task (rename + schedule; dryRun query preview)
+ * Update one Binalyze AIR task via PATCH /api/v2/tasks/{taskId}. MUTATING. Send only the fields the user wants to change. Scheduled tasks (status=scheduled) accept all fields: taskName, caseIdOrName, schedule, ruleIds (triage), assets, profileIdOrName (acquisition), mitreEnabled, droneEnabled, eventLogRecordsConfig, cpuLimit, imageOptions (image acquisition). Tasks in any other status (processing, assigned, completed, cancelled, failed) accept only taskName and caseIdOrName; every other field is NOT applied -- the call still returns 200 but the field comes back in skippedFields (e.g. 'cpuLimit cannot be updated for processing task; skipped'). This is by design, not an error: a running task cannot change its execution config. When skippedFields is non-empty, tell the user which fields were skipped and why, and that scheduled-only fields require the task to be in status=scheduled (check with air-tasks-get first if unsure). Unschedule is forbidden: never send schedule=null; to stop a task use the hunt cancel/delete tools instead. Renaming to the same name fails 400. An empty body returns errors[0] NOTHING_CHANGED. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe). The success response returns the updated task in result.entities[0], same shape as air-tasks-get.
  */
 const tasksV2ApiControllerUpdateTask = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -1792,7 +1899,7 @@ const tasksV2ApiControllerUpdateTask = (options) => {
 exports.tasksV2ApiControllerUpdateTask = tasksV2ApiControllerUpdateTask;
 /**
  * List a task assets
- * Paginated assets targeted by the task, in the shared GET /v2/assets shape.
+ * List the assets targeted by one Binalyze AIR task using GET /api/v2/tasks/{taskId}/assets. Paginated; entities use the same shape as GET /api/v2/assets (endpoint block with platform, onlineStatus, lastSeen, etc.). Use this when the user asks which hosts/assets a task ran on or targets; this is the resolver for the assetsUrl field seen in task and hunt list responses. It does NOT include per-asset assignment status or progress; for that use air-tasks-assignments. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe). Placeholder defaults such as pageNumber=1 or pageSize=20 are ignored.
  */
 const tasksV2ApiControllerListTaskAssets = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -1815,7 +1922,7 @@ const tasksV2ApiControllerListTaskAssets = (options) => {
 exports.tasksV2ApiControllerListTaskAssets = tasksV2ApiControllerListTaskAssets;
 /**
  * List a task assignments
- * Paginated task assignments for the task, with resolved organization and cases.
+ * List the per-endpoint task assignments of one Binalyze AIR task using GET /api/v2/tasks/{taskId}/task-assignments. Paginated; this is the resolver for the taskAssignmentsUrl field in task detail responses. Each entity carries id, taskId, name, type, endpointId, endpointName, status, progress, hasDroneData, durations, metadata, organizations[{id,name}], response and cases[]. Use this when the user wants per-host progress, per-host status, or which endpoints completed/failed for a task; use air-tasks-assets for asset details instead. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe). Placeholder defaults such as pageNumber=1 are ignored.
  */
 const tasksV2ApiControllerListTaskAssignments = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -1838,7 +1945,7 @@ const tasksV2ApiControllerListTaskAssignments = (options) => {
 exports.tasksV2ApiControllerListTaskAssignments = tasksV2ApiControllerListTaskAssignments;
 /**
  * List hunt (triage) tasks
- * Paginated task-centric hunt (triage) list. Also served at /api/v2/triage.
+ * List Binalyze AIR hunt (triage) tasks using GET /api/v2/hunt. Hunt is the public v2 alias for triage tasks; the list is task-centric and paginated. Each entity carries id, taskName, status, rules[] enriched as {id,name,engine}, totalMatched, assignment counters, assets{assetCount,assetsUrl}, schedule, createdBy and timestamps. Use this when the user asks to list hunts, triage tasks, IOC/YARA scans, or wants to find a hunt task id before cancelling or deleting it. The taskId values returned here feed air-tasks-get, air-hunt-cancel, air-hunt-delete and the bulk variants. Placeholder defaults such as pageNumber=1 are ignored; sortBy accepts only createdAt, taskName, status, assignmentCount.
  */
 const tasksTriageV2ApiControllerListHuntTasks = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -1861,6 +1968,7 @@ const tasksTriageV2ApiControllerListHuntTasks = (options) => {
 exports.tasksTriageV2ApiControllerListHuntTasks = tasksTriageV2ApiControllerListHuntTasks;
 /**
  * Bulk cancel hunt (triage) tasks (body dryRun preview)
+ * Cancel one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/cancel. MUTATING: cancels ALL active assignments of each task across all its assets; cancellation is queued asynchronously and an abort signal is sent to the agents. Task records and downloaded data are kept (use air-hunt-bulk-delete to remove them). taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and cancels EVERY active (scheduled/assigned/processing) hunt task in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists; confirm with the user before using it. dryRun is opt-in at the API level (defaults to false); the OpenCode tools send dryRun=true by default. The preview (200) returns result.entities[] = {taskId, taskName, willCancelAssignmentCount, status} without cancelling anything. ALWAYS run the preview first and show the user what would be cancelled; pass dryRun=false only after the user explicitly confirms the exact task list. The real cancel returns cancelledAssignmentCount and status 'cancelling' instead. Both forms include warnings[] for skipped tasks (e.g. already in a terminal state). 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-cancel, which returns a leak-safe 404 for unknown ids.
  */
 const tasksTriageV2ApiControllerCancel = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1887,6 +1995,7 @@ const tasksTriageV2ApiControllerCancel = (options) => {
 exports.tasksTriageV2ApiControllerCancel = tasksTriageV2ApiControllerCancel;
 /**
  * Bulk delete hunt (triage) tasks (body dryRun preview)
+ * Delete one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/delete. DESTRUCTIVE and irreversible: removes the task records, ALL assignments, and downloaded files/artifacts; nothing remains in history. Active tasks additionally get an agent cancel signal. Use air-hunt-bulk-cancel to merely stop tasks while keeping records. taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and deletes EVERY hunt task (active and finished) in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists. dryRun is opt-in at the API level (defaults to false); the OpenCode tools send dryRun=true by default. The preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS run the preview first and show the user what would be deleted; pass dryRun=false only after the user explicitly confirms the exact task list. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-delete (leak-safe 404).
  */
 const tasksTriageV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1913,6 +2022,7 @@ const tasksTriageV2ApiControllerDelete = (options) => {
 exports.tasksTriageV2ApiControllerDelete = tasksTriageV2ApiControllerDelete;
 /**
  * Cancel a single hunt (triage) task (dryRun query preview)
+ * Cancel a single Binalyze AIR hunt (triage) task via POST /api/v2/hunt/{taskId}/cancel. MUTATING: cancels ALL active assignments of this task across all its assets; cancellation is queued asynchronously and an abort signal is sent to the agents. The task record and downloaded data are kept (use air-hunt-delete to remove them). Use this when the user wants to stop exactly one hunt/triage task; use air-hunt-bulk-cancel for several tasks at once. The taskId comes from air-hunt-list or air-tasks-get. Success (200) returns result.entities[] = {taskId, taskName, cancelledAssignmentCount, status} plus warnings[] (e.g. skipped when nothing is active). 404 'Task not found' also covers hunt tasks outside the caller's organizations (leak-safe); it does not necessarily mean the id is wrong.
  */
 const tasksTriageV2ApiControllerCancelOne = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1935,6 +2045,7 @@ const tasksTriageV2ApiControllerCancelOne = (options) => {
 exports.tasksTriageV2ApiControllerCancelOne = tasksTriageV2ApiControllerCancelOne;
 /**
  * Delete a single hunt (triage) task (dryRun query preview)
+ * Delete a single Binalyze AIR hunt (triage) task via POST /api/v2/hunt/{taskId}/delete. DESTRUCTIVE and irreversible: removes the task record, ALL its assignments, and downloaded files/artifacts; nothing remains in history. An active task additionally gets an agent cancel signal. Use air-hunt-cancel to merely stop the task while keeping records. Use this for exactly one task; use air-hunt-bulk-delete for several tasks at once. The taskId comes from air-hunt-list or air-tasks-get. dryRun is opt-in at the API level (defaults to false) and is sent as the ?dryRun=true query parameter; the OpenCode tools send it by default. The preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS preview first and show the user; pass dryRun=false only after the user explicitly confirms this exact task. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe).
  */
 const tasksTriageV2ApiControllerDeleteOne = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -3008,6 +3119,7 @@ const userChangePassword = (options) => {
 exports.userChangePassword = userChangePassword;
 const userResetUserPassword = (options) => {
     return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
         security: [
             {
                 scheme: 'bearer',
@@ -3568,6 +3680,7 @@ const acquisitionValidateOsQueries = (options) => {
 exports.acquisitionValidateOsQueries = acquisitionValidateOsQueries;
 /**
  * List device acquisition profiles
+ * List Binalyze AIR device (evidence) acquisition profiles via GET /api/v2/libraries/acquisition/device. Read-only and paginated. Each entity is a profile summary: id, name, organizations[{id,name}], averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. Per-OS configs (windows/linux/macos/aix/eDiscovery) are NOT included; use air-acquisition-device-get for one profile's full config. Use this when the user asks to list or search evidence acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with an empty organizations array are global.
  */
 const acquisitionLibraryDeviceV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -3590,6 +3703,7 @@ const acquisitionLibraryDeviceV2ApiControllerList = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerList = acquisitionLibraryDeviceV2ApiControllerList;
 /**
  * Create device acquisition profile
+ * Create a Binalyze AIR device (evidence) acquisition profile via POST /api/v2/libraries/acquisition/device. MUTATING: persists a new profile in the acquisition library. Returns 200 with entities[0] = the created profile detail. `name` is required (alphanumeric) plus at least one config block: windows, linux, macos, aix (each with evidenceList/artifactList/customContentProfiles/networkCapture) or eDiscovery ({patterns:[{pattern,category}]}). Any subset of OS blocks is accepted. Body `organizationIds` controls which organizations own the profile; common query `organizations`, `orgs`, and `org` parameters are rejected. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Get the exact evidence/artifact keys from an existing profile (air-acquisition-device-get) when cloning or when unsure of valid values.
  */
 const acquisitionLibraryDeviceV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -3616,6 +3730,7 @@ const acquisitionLibraryDeviceV2ApiControllerCreate = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerCreate = acquisitionLibraryDeviceV2ApiControllerCreate;
 /**
  * Bulk delete device acquisition profiles
+ * Bulk delete Binalyze AIR device (evidence) acquisition profiles via POST /api/v2/libraries/acquisition/device/delete. MUTATING and irreversible. Resolution is tolerant: unknown or ambiguous items are skipped and reported in warnings[] (action: 'skipped') instead of failing the whole request. Profiles referenced by running/scheduled tasks or system profiles are also skipped with a warning. dryRun DEFAULTS TO TRUE: the first call returns entities[] of what would be deleted; pass dryRun=false only to actually delete after the user confirms. A real delete returns deletedCount plus warnings[]. Use this for several profiles at once; use air-acquisition-device-delete for exactly one. Ids and exact names come from air-acquisition-device-list.
  */
 const acquisitionLibraryDeviceV2ApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -3642,6 +3757,7 @@ const acquisitionLibraryDeviceV2ApiControllerBulkDelete = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerBulkDelete = acquisitionLibraryDeviceV2ApiControllerBulkDelete;
 /**
  * Delete device acquisition profile
+ * Delete ONE Binalyze AIR device (evidence) acquisition profile via DELETE /api/v2/libraries/acquisition/device/{idOrName}. MUTATING and irreversible. A profile referenced by a still-running or scheduled acquisition task is protected: the API returns 400 PROFILE_IN_USE with the blocking task ids (completed/cancelled/failed tasks do not block). System (predefined) profiles return 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call returns what would be deleted without removing anything; pass dryRun=false only to actually delete after the user confirms. Use air-acquisition-device-bulk-delete for several profiles at once. The idOrName comes from air-acquisition-device-list or air-acquisition-device-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
  */
 const acquisitionLibraryDeviceV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -3664,6 +3780,7 @@ const acquisitionLibraryDeviceV2ApiControllerDelete = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerDelete = acquisitionLibraryDeviceV2ApiControllerDelete;
 /**
  * Get device acquisition profile by id or name
+ * Get ONE Binalyze AIR device (evidence) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/device/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizations[{id,name}], the per-OS configs (windows/linux/macos/aix with evidence and artifact lists), eDiscovery patterns, deletable, and timestamps. Use this when the user asks to show or inspect an evidence acquisition profile's contents, or to clone one. Ids and exact names come from air-acquisition-device-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
  */
 const acquisitionLibraryDeviceV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -3686,6 +3803,7 @@ const acquisitionLibraryDeviceV2ApiControllerGet = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerGet = acquisitionLibraryDeviceV2ApiControllerGet;
 /**
  * Update device acquisition profile
+ * Update ONE Binalyze AIR device (evidence) acquisition profile via PATCH /api/v2/libraries/acquisition/device/{idOrName}. MUTATING partial update: only the fields you pass change; omitted fields keep their current value. Updatable fields: name, organizationIds, windows, linux, macos, aix, eDiscovery. Passing null for an OS block removes it; the merged profile must still keep at least one config block. Sending no updatable field returns NOTHING_CHANGED with result null. System (predefined) profiles cannot be updated: the API returns 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call previews the merged profile without persisting; pass dryRun=false only to actually update after the user confirms. The idOrName comes from air-acquisition-device-list or air-acquisition-device-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
  */
 const acquisitionLibraryDeviceV2ApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -3845,6 +3963,23 @@ const gitRepositoriesTriggerSync = (options) => {
     });
 };
 exports.gitRepositoriesTriggerSync = gitRepositoriesTriggerSync;
+/**
+ * Cancel repository sync
+ * Cancel an in-progress synchronization for the specified repository connection
+ */
+const gitRepositoriesCancelSync = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/git-repositories/{id}/sync/cancel',
+        ...options
+    });
+};
+exports.gitRepositoriesCancelSync = gitRepositoriesCancelSync;
 /**
  * Get sync logs for a repository connection
  * Retrieve the synchronization history for a specific repository connection
@@ -3858,7 +3993,7 @@ const gitRepositoriesGetSyncLogs = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/git-repositories/{id}/sync-logs',
+        url: '/api/public/git-repositories/{id}/sync/logs',
         ...options
     });
 };
@@ -3928,10 +4063,10 @@ const gitRepositoriesGetRepositoryBranches = (options) => {
 };
 exports.gitRepositoriesGetRepositoryBranches = gitRepositoriesGetRepositoryBranches;
 /**
- * Get Many
- * Retrieve a paginated list of triage rules
+ * Filter TAXII feeds
+ * Retrieve all TAXII feeds with optional filters
  */
-const getManyTriageRules = (options) => {
+const taxiiFeedsGetMany = (options) => {
     return (options.client ?? client_gen_1.client).get({
         responseType: 'json',
         security: [
@@ -3940,16 +4075,16 @@ const getManyTriageRules = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/rules',
+        url: '/api/public/taxii-feeds',
         ...options
     });
 };
-exports.getManyTriageRules = getManyTriageRules;
+exports.taxiiFeedsGetMany = taxiiFeedsGetMany;
 /**
- * Create Triage Rule
- * Create a new triage rule that defines conditions and criteria
+ * Create a new TAXII feed
+ * Create a new TAXII feed for syncing threat intelligence indicators
  */
-const createTriageRule = (options) => {
+const taxiiFeedsCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -3958,7 +4093,7 @@ const createTriageRule = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/rules',
+        url: '/api/public/taxii-feeds',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -3966,12 +4101,46 @@ const createTriageRule = (options) => {
         }
     });
 };
-exports.createTriageRule = createTriageRule;
+exports.taxiiFeedsCreate = taxiiFeedsCreate;
 /**
- * Delete Triage Rule
- * Permanently delete a triage rule from the system
+ * Filter TAXII indicators
+ * Retrieve all indicators across TAXII feeds with optional filters
  */
-const deleteTriageRule = (options) => {
+const taxiiFeedsGetIndicators = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/taxii-feeds/indicators',
+        ...options
+    });
+};
+exports.taxiiFeedsGetIndicators = taxiiFeedsGetIndicators;
+/**
+ * Get TAXII indicator summary
+ * Retrieve aggregated statistics for indicators across TAXII feeds
+ */
+const taxiiFeedsGetIndicatorSummary = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/taxii-feeds/indicators/summary',
+        ...options
+    });
+};
+exports.taxiiFeedsGetIndicatorSummary = taxiiFeedsGetIndicatorSummary;
+/**
+ * Delete a TAXII feed
+ * Delete an existing TAXII feed by ID
+ */
+const taxiiFeedsDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
         security: [
             {
@@ -3979,16 +4148,16 @@ const deleteTriageRule = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/rules/{id}',
+        url: '/api/public/taxii-feeds/{id}',
         ...options
     });
 };
-exports.deleteTriageRule = deleteTriageRule;
+exports.taxiiFeedsDelete = taxiiFeedsDelete;
 /**
- * Get
- * Retrieve detailed information about a specific triage rule by its ID
+ * Get TAXII feed by ID
+ * Retrieve a specific TAXII feed
  */
-const getTriageRule = (options) => {
+const taxiiFeedsGetOne = (options) => {
     return (options.client ?? client_gen_1.client).get({
         responseType: 'json',
         security: [
@@ -3997,16 +4166,16 @@ const getTriageRule = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/rules/{id}',
+        url: '/api/public/taxii-feeds/{id}',
         ...options
     });
 };
-exports.getTriageRule = getTriageRule;
+exports.taxiiFeedsGetOne = taxiiFeedsGetOne;
 /**
- * Update Triage Rule
- * Update an existing triage rule by modifying its conditions
+ * Update a TAXII feed
+ * Update an existing TAXII feed configuration
  */
-const updateTriageRule = (options) => {
+const taxiiFeedsUpdate = (options) => {
     return (options.client ?? client_gen_1.client).put({
         responseType: 'json',
         security: [
@@ -4015,7 +4184,7 @@ const updateTriageRule = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/rules/{id}',
+        url: '/api/public/taxii-feeds/{id}',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -4023,42 +4192,38 @@ const updateTriageRule = (options) => {
         }
     });
 };
-exports.updateTriageRule = updateTriageRule;
+exports.taxiiFeedsUpdate = taxiiFeedsUpdate;
 /**
- * Delete Triage Rule Bulk
- * Permanently delete a triage rules from the system
+ * Get sync logs for a TAXII feed
+ * Retrieve the synchronization history for a specific TAXII feed
  */
-const deleteBulkTriageRules = (options) => {
-    return (options.client ?? client_gen_1.client).delete({
+const taxiiFeedsGetSyncLogs = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
         security: [
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/rules/bulk-delete',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
+        url: '/api/public/taxii-feeds/{id}/sync/logs',
+        ...options
     });
 };
-exports.deleteBulkTriageRules = deleteBulkTriageRules;
+exports.taxiiFeedsGetSyncLogs = taxiiFeedsGetSyncLogs;
 /**
- * Validate Triage Rule
- * Validate the syntax and structure of a triage rule
+ * Discover TAXII collections
+ * Connect to a TAXII server and list the collections available for subscription
  */
-const validateTriageRule = (options) => {
+const taxiiFeedsDiscoverCollections = (options) => {
     return (options.client ?? client_gen_1.client).post({
-        responseType: 'json',
         security: [
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/rules/validate',
+        url: '/api/public/taxii-feeds/discover',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -4066,42 +4231,54 @@ const validateTriageRule = (options) => {
         }
     });
 };
-exports.validateTriageRule = validateTriageRule;
+exports.taxiiFeedsDiscoverCollections = taxiiFeedsDiscoverCollections;
 /**
- * Assign Triage Task
- * Assign and execute triage tasks on filtered endpoints
+ * Trigger TAXII feed sync
+ * Manually trigger a synchronization for the specified TAXII feed
  */
-const assignTriageTask = (options) => {
+const taxiiFeedsTriggerSync = (options) => {
     return (options.client ?? client_gen_1.client).post({
-        responseType: 'json',
         security: [
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/triage',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
+        url: '/api/public/taxii-feeds/{id}/sync',
+        ...options
     });
 };
-exports.assignTriageTask = assignTriageTask;
+exports.taxiiFeedsTriggerSync = taxiiFeedsTriggerSync;
 /**
- * Update Scheduled Triage Task
- * Update a scheduled triage task
+ * Cancel TAXII feed sync
+ * Cancel an in-progress synchronization for the specified TAXII feed
  */
-const updateScheduledTriageTask = (options) => {
-    return (options.client ?? client_gen_1.client).put({
+const taxiiFeedsCancelSync = (options) => {
+    return (options.client ?? client_gen_1.client).post({
         security: [
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/schedule/triage/{id}',
+        url: '/api/public/taxii-feeds/{id}/sync/cancel',
+        ...options
+    });
+};
+exports.taxiiFeedsCancelSync = taxiiFeedsCancelSync;
+/**
+ * Enable or disable a TAXII feed
+ * Toggle the active state of a TAXII feed
+ */
+const taxiiFeedsUpdateStatus = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/taxii-feeds/{id}/update-status',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -4109,21 +4286,20 @@ const updateScheduledTriageTask = (options) => {
         }
     });
 };
-exports.updateScheduledTriageTask = updateScheduledTriageTask;
+exports.taxiiFeedsUpdateStatus = taxiiFeedsUpdateStatus;
 /**
- * Create Off Network Triage Task File
- * Create a triage task file for off network access
+ * Delete multiple TAXII feeds
+ * Delete multiple TAXII feeds by their IDs
  */
-const createOffNetworkTriageTaskFile = (options) => {
-    return (options.client ?? client_gen_1.client).post({
-        responseType: 'json',
+const taxiiFeedsBulkDelete = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
         security: [
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/triage/off-network',
+        url: '/api/public/taxii-feeds/bulk-delete',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -4131,12 +4307,12 @@ const createOffNetworkTriageTaskFile = (options) => {
         }
     });
 };
-exports.createOffNetworkTriageTaskFile = createOffNetworkTriageTaskFile;
+exports.taxiiFeedsBulkDelete = taxiiFeedsBulkDelete;
 /**
- * Filter Triage Rule Tags
- * Filter triage rule tags
+ * Get Many
+ * Retrieve a paginated list of triage rules
  */
-const filterTriageRuleTags = (options) => {
+const getManyTriageRules = (options) => {
     return (options.client ?? client_gen_1.client).get({
         responseType: 'json',
         security: [
@@ -4145,16 +4321,16 @@ const filterTriageRuleTags = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/tags',
+        url: '/api/public/triages/rules',
         ...options
     });
 };
-exports.filterTriageRuleTags = filterTriageRuleTags;
+exports.getManyTriageRules = getManyTriageRules;
 /**
- * Create Triage Rule Tag
- * Create a new triage rule tag
+ * Create Triage Rule
+ * Create a new triage rule that defines conditions and criteria
  */
-const createTriageRuleTag = (options) => {
+const createTriageRule = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -4163,7 +4339,7 @@ const createTriageRuleTag = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/triages/tags',
+        url: '/api/public/triages/rules',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -4171,12 +4347,217 @@ const createTriageRuleTag = (options) => {
         }
     });
 };
-exports.createTriageRuleTag = createTriageRuleTag;
+exports.createTriageRule = createTriageRule;
 /**
- * Delete Triage Rule Tag
- * Delete a triage rule tag
+ * Delete Triage Rule
+ * Permanently delete a triage rule from the system
  */
-const deleteTriageRuleTag = (options) => {
+const deleteTriageRule = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/triages/rules/{id}',
+        ...options
+    });
+};
+exports.deleteTriageRule = deleteTriageRule;
+/**
+ * Get
+ * Retrieve detailed information about a specific triage rule by its ID
+ */
+const getTriageRule = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/triages/rules/{id}',
+        ...options
+    });
+};
+exports.getTriageRule = getTriageRule;
+/**
+ * Update Triage Rule
+ * Update an existing triage rule by modifying its conditions
+ */
+const updateTriageRule = (options) => {
+    return (options.client ?? client_gen_1.client).put({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/triages/rules/{id}',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.updateTriageRule = updateTriageRule;
+/**
+ * Delete Triage Rule Bulk
+ * Permanently delete a triage rules from the system
+ */
+const deleteBulkTriageRules = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/triages/rules/bulk-delete',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.deleteBulkTriageRules = deleteBulkTriageRules;
+/**
+ * Validate Triage Rule
+ * Validate the syntax and structure of a triage rule
+ */
+const validateTriageRule = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/triages/rules/validate',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.validateTriageRule = validateTriageRule;
+/**
+ * Assign Triage Task
+ * Assign and execute triage tasks on filtered endpoints
+ */
+const assignTriageTask = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/triages/triage',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.assignTriageTask = assignTriageTask;
+/**
+ * Update Scheduled Triage Task
+ * Update a scheduled triage task
+ */
+const updateScheduledTriageTask = (options) => {
+    return (options.client ?? client_gen_1.client).put({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/triages/schedule/triage/{id}',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.updateScheduledTriageTask = updateScheduledTriageTask;
+/**
+ * Create Off Network Triage Task File
+ * Create a triage task file for off network access
+ */
+const createOffNetworkTriageTaskFile = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/triages/triage/off-network',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.createOffNetworkTriageTaskFile = createOffNetworkTriageTaskFile;
+/**
+ * Filter Triage Rule Tags
+ * Filter triage rule tags
+ */
+const filterTriageRuleTags = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/triages/tags',
+        ...options
+    });
+};
+exports.filterTriageRuleTags = filterTriageRuleTags;
+/**
+ * Create Triage Rule Tag
+ * Create a new triage rule tag
+ */
+const createTriageRuleTag = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/triages/tags',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.createTriageRuleTag = createTriageRuleTag;
+/**
+ * Delete Triage Rule Tag
+ * Delete a triage rule tag
+ */
+const deleteTriageRuleTag = (options) => {
     return (options.client ?? client_gen_1.client).delete({
         security: [
             {
@@ -4191,6 +4572,7 @@ const deleteTriageRuleTag = (options) => {
 exports.deleteTriageRuleTag = deleteTriageRuleTag;
 /**
  * List triage rules
+ * List Binalyze AIR triage rules (the triage library: YARA, Sigma, osquery IOC-scan rules) using GET /api/v2/libraries/triage. Read-only and paginated. Each entity is a rule summary: id, name, description, engine, searchIn flags, organizations [{id,name}], tags, author, createdAt/updatedAt/lastUsedAt. Rule content is NOT included; use air-triage-rules-get for one rule's body. Use this when the user asks to list triage/IOC rules, search the rule library, or needs a rule id or exact name before get, update, delete, or export. sortBy accepts only name, createdAt, updatedAt, lastUsedAt, author (default createdAt). Rules with an empty organizations list are global (visible to every org).
  */
 const triageLibraryV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -4213,6 +4595,7 @@ const triageLibraryV2ApiControllerList = (options) => {
 exports.triageLibraryV2ApiControllerList = triageLibraryV2ApiControllerList;
 /**
  * Create triage rule
+ * Create a Binalyze AIR triage rule (YARA, Sigma, or osquery IOC-scan rule) via POST /api/v2/libraries/triage. MUTATING: persists a new rule in the triage library; the rule content is validated by the engine before saving and an invalid rule fails with 400. Only `rule` (the content) is required; name and engine are auto-detected from the content when omitted, and a name collision is resolved by suffixing (a warning reports the adjusted name). dryRun DEFAULTS TO TRUE: the first call returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Success returns entities[0] with the created rule detail plus warnings[] (e.g. name adjustments). Use air-triage-rules-validate to only check a rule without creating it.
  */
 const triageLibraryV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -4239,6 +4622,7 @@ const triageLibraryV2ApiControllerCreate = (options) => {
 exports.triageLibraryV2ApiControllerCreate = triageLibraryV2ApiControllerCreate;
 /**
  * Bulk delete triage rules
+ * Bulk delete Binalyze AIR triage rules via POST /api/v2/libraries/triage/delete. MUTATING and irreversible: removes every resolved rule and its stored content from the triage library. Resolution is tolerant: rules that cannot be found are skipped and reported in warnings[] instead of failing the whole request. dryRun DEFAULTS TO TRUE: the first call previews what would be deleted; pass dryRun=false only to actually delete after the user confirms. Use this for several rules at once; use air-triage-rules-delete for exactly one. Rule ids and exact names come from air-triage-rules-list. Success returns deletedCount plus warnings[] (skipped or unresolved rules).
  */
 const triageLibraryV2ApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -4265,6 +4649,7 @@ const triageLibraryV2ApiControllerBulkDelete = (options) => {
 exports.triageLibraryV2ApiControllerBulkDelete = triageLibraryV2ApiControllerBulkDelete;
 /**
  * Validate triage rule
+ * Validate a Binalyze AIR triage rule (YARA, Sigma, or osquery) via POST /api/v2/libraries/triage/validate. Read-only: nothing is persisted, so there is no dryRun flag. The engine is auto-detected from the rule content when omitted; passing a wrong engine returns a 400 INVALID_ENGINE with the detected engine under errors[0].details.suggestions. osquery rules must be read-only SELECT statements against known tables. Use this before air-triage-rules-create or air-triage-rules-update when the user wants to check a rule, or to identify which engine a rule belongs to. Success returns entities[0] = {valid: true, engine} plus warnings[]; an invalid rule fails with a 400 envelope describing the syntax problem.
  */
 const triageLibraryV2ApiControllerValidate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -4291,6 +4676,7 @@ const triageLibraryV2ApiControllerValidate = (options) => {
 exports.triageLibraryV2ApiControllerValidate = triageLibraryV2ApiControllerValidate;
 /**
  * Delete triage rule
+ * Delete ONE Binalyze AIR triage rule via DELETE /api/v2/libraries/triage/{idOrName}. MUTATING and irreversible: removes the rule and its stored content from the triage library. dryRun DEFAULTS TO TRUE: the first call returns what would be deleted without removing anything; pass dryRun=false only to actually delete after the user confirms. Use air-triage-rules-bulk-delete for several rules at once. The idOrName comes from air-triage-rules-list or air-triage-rules-get. Success returns entities[0] = {id, name} of the deleted rule. 404 also covers rules outside the caller's organization scope (leak-safe); it does not necessarily mean the id is wrong.
  */
 const triageLibraryV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -4313,6 +4699,7 @@ const triageLibraryV2ApiControllerDelete = (options) => {
 exports.triageLibraryV2ApiControllerDelete = triageLibraryV2ApiControllerDelete;
 /**
  * Get triage rule by id or name
+ * Get ONE Binalyze AIR triage rule (YARA/Sigma/osquery IOC-scan rule) by UUID or exact name via GET /api/v2/libraries/triage/{idOrName}. Read-only. Returns the full rule detail in entities[0]: id, name, description, engine, searchIn flags, the rule content (body), organizations [{id,name}], tags, author and timestamps. Use this when the user asks to show, inspect, or read a triage rule's content. Rule ids and exact names come from air-triage-rules-list. 404 also covers rules outside the caller's organization scope (leak-safe); the response may include a did-you-mean suggestion when the name is close to an existing rule.
  */
 const triageLibraryV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -4335,6 +4722,7 @@ const triageLibraryV2ApiControllerGet = (options) => {
 exports.triageLibraryV2ApiControllerGet = triageLibraryV2ApiControllerGet;
 /**
  * Update triage rule
+ * Update ONE Binalyze AIR triage rule via PATCH /api/v2/libraries/triage/{idOrName}. MUTATING partial update: only the fields you pass change; omitted fields keep their current value. The engine cannot be changed (create a new rule instead). A changed rule body is re-validated by its engine before saving; an invalid rule fails with 400. `tags` REPLACES the whole tag set. Sending no updatable field returns a NOTHING_CHANGED error. dryRun DEFAULTS TO TRUE: the first call previews the resulting rule without persisting; pass dryRun=false only to actually update after the user confirms. The idOrName comes from air-triage-rules-list or air-triage-rules-get. Success returns entities[0] with the updated rule detail plus warnings[]. 404 also covers rules outside the caller's organization scope (leak-safe).
  */
 const triageLibraryV2ApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -4361,6 +4749,7 @@ const triageLibraryV2ApiControllerUpdate = (options) => {
 exports.triageLibraryV2ApiControllerUpdate = triageLibraryV2ApiControllerUpdate;
 /**
  * Export triage rules to an off-network package
+ * Export Binalyze AIR triage rules into an off-network triage package via POST /api/v2/libraries/triage/export. MUTATING: generates a package file on the Console that bundles the selected rules for offline (off-network) triage of air-gapped endpoints. Resolution is STRICT: any rule that cannot be found fails the whole request with 400 plus name suggestions (unlike bulk delete, which skips). dryRun DEFAULTS TO TRUE: the first call lists what would be exported without generating a package; pass dryRun=false only to actually export after the user confirms. Success returns entities[0] = {fileName, downloadUrl, binaryOptions[]}; feed fileName into air-triage-rules-export-download to fetch the package. Use this when the user wants an offline/off-network triage package of specific rules. Rule ids and exact names come from air-triage-rules-list.
  */
 const triageLibraryExportV2ApiControllerExport = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -4387,6 +4776,7 @@ const triageLibraryExportV2ApiControllerExport = (options) => {
 exports.triageLibraryExportV2ApiControllerExport = triageLibraryExportV2ApiControllerExport;
 /**
  * Download an exported off-network package
+ * Download a previously exported off-network triage package via GET /api/v2/libraries/triage/export/download and save it inside the current worktree. Read-only on the server side. The fileName comes from air-triage-rules-export (its downloadUrl carries the same value); this tool streams the archive to disk and returns {fileName, outputPath, byteLength}. Optionally embed agent binaries for specific platforms (binaries[]) and MITRE ATT&CK rules (mitre=true) into the package. Use this right after air-triage-rules-export when the user wants the actual package file. Packages can expire; a 404 may mean the export must be re-run.
  */
 const triageLibraryExportV2ApiControllerDownload = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -4873,6 +5263,57 @@ const evidenceRepositoryUpdateGoogleCloudStorage = (options) => {
     });
 };
 exports.evidenceRepositoryUpdateGoogleCloudStorage = evidenceRepositoryUpdateGoogleCloudStorage;
+const evidenceRepositoryValidateBox = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/evidences/repositories/validate/box',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.evidenceRepositoryValidateBox = evidenceRepositoryValidateBox;
+const evidenceRepositoryCreateBox = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/evidences/repositories/box',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.evidenceRepositoryCreateBox = evidenceRepositoryCreateBox;
+const evidenceRepositoryUpdateBox = (options) => {
+    return (options.client ?? client_gen_1.client).put({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/evidences/repositories/box/{id}',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.evidenceRepositoryUpdateBox = evidenceRepositoryUpdateBox;
 const notificationDeleteAll = (options) => {
     return (options?.client ?? client_gen_1.client).delete({
         security: [
@@ -5598,18 +6039,583 @@ const autoAssetTagUpdateScheduledAatTask = (options) => {
 };
 exports.autoAssetTagUpdateScheduledAatTask = autoAssetTagUpdateScheduledAatTask;
 /**
- * Check if a case name is available
- * Validates whether a given case name is exists
+ * List case activities across visible cases
+ * List the GLOBAL Binalyze AIR case audit feed across all visible cases using GET /api/v2/cases/activities. Read-only, paginated. Each row carries id, caseId, type (event class name like CaseNoteAddedEvent), performedBy, raw data{} payload, a computed description and timestamps. caseIds filter accepts case UUIDs or names (inclusive match). For the activities of ONE known case prefer air-cases-case-activities. Use this to audit who did what across cases, e.g. all activity by a user or all case closures in a time window.
  */
-const casesCheckName = (options) => {
-    return (options.client ?? client_gen_1.client).get({
+const caseActivityV2ApiControllerFilterGlobalActivities = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
         responseType: 'json',
         security: [
             {
-                scheme: 'bearer',
-                type: 'http'
-            }
-        ],
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/activities',
+        ...options
+    });
+};
+exports.caseActivityV2ApiControllerFilterGlobalActivities = caseActivityV2ApiControllerFilterGlobalActivities;
+/**
+ * List activities for case
+ * List the audit activity feed of ONE Binalyze AIR case using GET /api/v2/cases/{idOrName}/activities. Read-only, paginated. Each row carries id, type (event class name like CaseNoteAddedEvent), performedBy, raw data{} payload, a computed description and timestamps. The path accepts a case UUID or exact case name. For a feed across multiple cases use air-cases-activities (the global feed) instead. Use this to reconstruct the timeline of a case: who closed it, which notes and assets were added, and when.
+ */
+const caseActivityV2ApiControllerFilterCaseActivities = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/activities',
+        ...options
+    });
+};
+exports.caseActivityV2ApiControllerFilterCaseActivities = caseActivityV2ApiControllerFilterCaseActivities;
+/**
+ * Export cases
+ * Export Binalyze AIR cases to a file via GET /api/v2/cases/export and save it inside the current worktree. Read-only on the server side; no dryRun needed. format=csv (default) saves a text/csv file; format=json saves an application/zip archive containing cases.json (the newest 10000 matching cases, with a TRUNCATED warning when more matched). The filter model mirrors air-cases-list (name substring, status, searchTerm). Returns {format, outputPath, byteLength}. Use air-cases-list instead when the user just wants to read cases in the chat.
+ */
+const caseExportV2ApiControllerExportCases = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
+        responseType: 'text',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/export',
+        ...options
+    });
+};
+exports.caseExportV2ApiControllerExportCases = caseExportV2ApiControllerExportCases;
+/**
+ * Close cases in bulk
+ * Close MULTIPLE Binalyze AIR cases in one call via POST /api/v2/cases/close. MUTATING, partial success: eligible cases close, ineligible ones (already closed/archived, not found) surface as warnings[] instead of failing the request. dryRun DEFAULTS TO TRUE: the first call returns a would-close preview plus skip warnings; pass dryRun=false only after the user confirms the case list. Target cases by id or name in cases[], or set cases="all" to close every open case in the required organizations scope (deliberate action; organizations must be provided — ids/names or "all"; confirm with the user first). For exactly one case prefer air-cases-close, which also accepts closure report summaries.
+ */
+const caseBulkActionV2ApiControllerClose = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/close',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.caseBulkActionV2ApiControllerClose = caseBulkActionV2ApiControllerClose;
+/**
+ * Archive cases in bulk
+ * Archive MULTIPLE Binalyze AIR cases in one call via POST /api/v2/cases/archive. MUTATING and effectively FINAL: lifecycle is open -> closed -> archived and there is NO unarchive. Only closed cases are eligible; open or already-archived cases surface as warnings[] (partial success). dryRun DEFAULTS TO TRUE: the first call returns a would-archive preview plus skip warnings; pass dryRun=false only after the user confirms the case list. Target cases by id or name in cases[], or set cases="all" to archive every closed case in the required organizations scope (deliberate action; organizations must be provided — ids/names or "all"; confirm with the user first). For exactly one case prefer air-cases-archive.
+ */
+const caseBulkActionV2ApiControllerArchive = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/archive',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.caseBulkActionV2ApiControllerArchive = caseBulkActionV2ApiControllerArchive;
+/**
+ * List assets linked to case
+ * List the assets linked to a Binalyze AIR case using GET /api/v2/cases/{idOrName}/assets. Read-only, paginated; returns full canonical v2 asset entities (nested endpoint{} block) for every asset attached to the case. Use this to see which endpoints belong to a case, to pick asset ids for air-cases-remove-assets, or before acting on the case's machines with the asset tools. The path accepts a case UUID or exact case name. Use format=json (default) for a paginated response or format=csv to stream the linked assets as text/csv.
+ */
+const caseAssetV2ApiControllerFilterAssets = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/assets',
+        ...options
+    });
+};
+exports.caseAssetV2ApiControllerFilterAssets = caseAssetV2ApiControllerFilterAssets;
+/**
+ * List users for case
+ * List the users who can participate in a Binalyze AIR case using GET /api/v2/cases/{idOrName}/users. Read-only, paginated; the organization scope derives from the case itself. Each entity carries id, username, email, roles[] with privileges, organizations[] as {id,name} refs, admin flags (isGlobalAdmin, isOrganizationAdmin), tfaEnabled, lastLogin and onlineStatus. Use this to find valid usernames or user UUIDs before setting a case owner or assignedUsers via air-cases-create / air-cases-update. The path accepts a case UUID or exact case name.
+ */
+const caseUserV2ApiControllerFilterUsers = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/users',
+        ...options
+    });
+};
+exports.caseUserV2ApiControllerFilterUsers = caseUserV2ApiControllerFilterUsers;
+/**
+ * List task assignments for case
+ * List the tasks of a Binalyze AIR case using GET /api/v2/cases/{idOrName}/tasks. Read-only, paginated and ASSIGNMENT-CENTRIC: one task assigned to N assets yields N rows, each with taskId, taskName, taskType, per-asset status and endpoint fields. result.metadata.creators summarizes the unique task creators across the case. The taskId values feed air-tasks-get; assignment rows relate to air-cases-task-assignments-list. The path accepts a case UUID or exact case name. Use this to see what work (triage, acquisition, interact) ran under a case and its per-asset outcome.
+ */
+const caseTaskV2ApiControllerFilterTasks = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/tasks',
+        ...options
+    });
+};
+exports.caseTaskV2ApiControllerFilterTasks = caseTaskV2ApiControllerFilterTasks;
+/**
+ * List case notes
+ * List the notes of a Binalyze AIR case using GET /api/v2/cases/{idOrName}/notes. Read-only, paginated. Each entity carries id, note (the text), writtenBy{id,username,email,profile}, writtenAt and timestamps. The path accepts a case UUID or exact case name. The note id values feed air-cases-notes-update and air-cases-notes-delete. Use this to read the investigation notes of a case or to find a note before editing or deleting it.
+ */
+const caseNoteV2ApiControllerFilterNotes = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/notes',
+        ...options
+    });
+};
+exports.caseNoteV2ApiControllerFilterNotes = caseNoteV2ApiControllerFilterNotes;
+/**
+ * Create case note
+ * Add a note to a Binalyze AIR case via POST /api/v2/cases/{idOrName}/notes. MUTATING. The case must be OPEN; notes cannot be added to closed or archived cases. dryRun DEFAULTS TO TRUE: the first call returns a would-create preview without persisting; pass dryRun=false only after the user confirms. The created note comes back in result.entities[0] with id, note, writtenBy{} and timestamps. The path accepts a case UUID or exact case name; the note text is limited to 10000 characters.
+ */
+const caseNoteV2ApiControllerCreateNote = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/notes',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.caseNoteV2ApiControllerCreateNote = caseNoteV2ApiControllerCreateNote;
+/**
+ * Delete case note
+ * Delete one note of a Binalyze AIR case via DELETE /api/v2/cases/{idOrName}/notes/{noteId}. MUTATING and IRREVERSIBLE once executed. The case must be OPEN and deletion is restricted to the note's author or an authorized manager. dryRun DEFAULTS TO TRUE: the first call returns a would-delete preview without removing anything; pass dryRun=false only after the user explicitly confirms. The path accepts a case UUID or exact case name plus the note UUID from air-cases-notes-list.
+ */
+const caseNoteV2ApiControllerDeleteNote = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/notes/{noteId}',
+        ...options
+    });
+};
+exports.caseNoteV2ApiControllerDeleteNote = caseNoteV2ApiControllerDeleteNote;
+/**
+ * Update case note
+ * Edit one note of a Binalyze AIR case via PATCH /api/v2/cases/{idOrName}/notes/{noteId}. MUTATING; the note text is fully replaced. The case must be OPEN and only the note's author (or an authorized manager) may edit it. dryRun DEFAULTS TO TRUE: the first call returns a would-update preview without persisting; pass dryRun=false only after the user confirms. The path accepts a case UUID or exact case name plus the note UUID from air-cases-notes-list. The updated note comes back in result.entities[0].
+ */
+const caseNoteV2ApiControllerUpdateNote = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/notes/{noteId}',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.caseNoteV2ApiControllerUpdateNote = caseNoteV2ApiControllerUpdateNote;
+/**
+ * List task assignments for case
+ * List the task assignments attached to a Binalyze AIR case using GET /api/v2/cases/{idOrName}/task-assignments. Read-only, paginated. Each entity carries id, taskId, taskName, taskType, per-asset status, asset{id,name}, hasDroneData, dataImportStatus, progress and timestamps. The id values feed air-cases-task-assignments-delete (detach) and are what air-cases-task-assignments-import adds. The path accepts a case UUID or exact case name. Use this to see which task results are part of the case evidence set.
+ */
+const caseTaskAssignmentV2ApiControllerFilterTaskAssignments = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/task-assignments',
+        ...options
+    });
+};
+exports.caseTaskAssignmentV2ApiControllerFilterTaskAssignments = caseTaskAssignmentV2ApiControllerFilterTaskAssignments;
+/**
+ * Import task assignments into case
+ * Import task assignments into a Binalyze AIR case via POST /api/v2/cases/{idOrName}/task-assignments/import. MUTATING with PARTIAL SUCCESS: eligible assignments are attached to the case, ineligible ones surface as skipped warnings[]. The case must be OPEN. dryRun DEFAULTS TO TRUE: the first call previews what would be imported plus warnings; pass dryRun=false only after the user confirms. Provide EXACTLY ONE source: taskId (imports that task's eligible assignments) or taskAssignmentIds (explicit assignment UUIDs). Optionally restrict to specific assets via assets[]. Get taskId from air-tasks-get / air-cases-tasks and assignment ids from air-tasks-assignments.
+ */
+const caseTaskAssignmentV2ApiControllerImportTaskAssignments = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/task-assignments/import',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.caseTaskAssignmentV2ApiControllerImportTaskAssignments = caseTaskAssignmentV2ApiControllerImportTaskAssignments;
+/**
+ * Detach a task assignment from case
+ * Detach ONE task assignment from a Binalyze AIR case via DELETE /api/v2/cases/{idOrName}/task-assignments/{taskAssignmentId}. MUTATING but non-destructive: it removes ONLY the case relation; the assignment and its task data are NOT deleted. The case must be OPEN. dryRun DEFAULTS TO TRUE: the first call returns a would-remove-from-case preview; pass dryRun=false only after the user confirms. Idempotent: deleting an assignment that is not attached returns deletedCount 0 with a skipped warning instead of failing. Get the assignment UUID from air-cases-task-assignments-list.
+ */
+const caseTaskAssignmentV2ApiControllerRemoveTaskAssignment = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/task-assignments/{taskAssignmentId}',
+        ...options
+    });
+};
+exports.caseTaskAssignmentV2ApiControllerRemoveTaskAssignment = caseTaskAssignmentV2ApiControllerRemoveTaskAssignment;
+/**
+ * Close a case
+ * Close ONE Binalyze AIR case via POST /api/v2/cases/{idOrName}/close. MUTATING. Only an open case can be closed; closed/archived cases are rejected with a lifecycle error. dryRun DEFAULTS TO TRUE: the first call returns a would-close preview without closing; pass dryRun=false only after the user confirms. reason is required (resolved, false-positive, duplicate, other) and the optional summary fields feed the closure report; the closed case comes back in result.entities[0] with a closure report URL. For two or more cases use air-cases-bulk-close instead.
+ */
+const caseActionV2ApiControllerClose = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/close',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.caseActionV2ApiControllerClose = caseActionV2ApiControllerClose;
+/**
+ * Reopen a case
+ * Reopen ONE closed Binalyze AIR case via POST /api/v2/cases/{idOrName}/open. MUTATING. Only a CLOSED case can be reopened; open and archived cases are rejected with a lifecycle error (archiving is final, there is no unarchive). dryRun DEFAULTS TO TRUE: the first call returns a would-open preview without reopening; pass dryRun=false only after the user confirms. The reopened case comes back in result.entities[0].
+ */
+const caseActionV2ApiControllerReopen = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/open',
+        ...options
+    });
+};
+exports.caseActionV2ApiControllerReopen = caseActionV2ApiControllerReopen;
+/**
+ * Archive a case
+ * Archive ONE closed Binalyze AIR case via POST /api/v2/cases/{idOrName}/archive. MUTATING and FINAL: lifecycle is open -> closed -> archived and there is NO unarchive endpoint. Only a CLOSED case can be archived; open or already-archived cases are rejected with a lifecycle error. dryRun DEFAULTS TO TRUE: the first call returns a would-archive preview without archiving; pass dryRun=false only after the user explicitly confirms. The archived case comes back in result.entities[0]. For two or more cases use air-cases-bulk-archive instead.
+ */
+const caseActionV2ApiControllerArchive = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/archive',
+        ...options
+    });
+};
+exports.caseActionV2ApiControllerArchive = caseActionV2ApiControllerArchive;
+/**
+ * Unlink assets from a case
+ * Unlink assets from a Binalyze AIR case via POST /api/v2/cases/{idOrName}/remove-assets. MUTATING but non-destructive: it removes ONLY the case<->asset relation; the assets themselves are NOT deleted, purged or uninstalled. dryRun DEFAULTS TO TRUE: the first call previews which assets would be unlinked plus skip warnings; pass dryRun=false only after the user confirms. Target assets by id or name in assets[] (wins over filter), or with a filter JSON object matched against the assets linked to the case. Assets not attached to the case are skipped with a warning; the real run returns deletedCount.
+ */
+const caseActionV2ApiControllerRemoveAssets = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}/remove-assets',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.caseActionV2ApiControllerRemoveAssets = caseActionV2ApiControllerRemoveAssets;
+/**
+ * List cases
+ * List Binalyze AIR cases using GET /api/v2/cases. Read-only, paginated. Each entity uses object refs: owner{id,name}, organizations[{id,name}], category{id,name}, tags[], assignedUsers[], plus taskCounts{} and assets/taskAssignments {count,url} summaries. Lifecycle is open -> closed -> archived (no unarchive). Reference filters (owner, assignedUser, category, tags) accept a UUID or an exact name/username; name is a case-insensitive substring match. Use this to find a case id or name before calling air-cases-get, air-cases-update, air-cases-close or the case sub-resource tools. organizations defaults to all accessible organizations.
+ */
+const caseV2ApiControllerFilterCases = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases',
+        ...options
+    });
+};
+exports.caseV2ApiControllerFilterCases = caseV2ApiControllerFilterCases;
+/**
+ * Create a case
+ * Create a single Binalyze AIR case via POST /api/v2/cases. MUTATING. dryRun DEFAULTS TO TRUE: the first call returns a would-create preview (resolved unique name, organization, warnings) without persisting; pass dryRun=false only after the user confirms. Reference fields (owner, organization, category, tags, assignedUsers) accept a UUID or an exact name/username and are resolved before creation. The case name cannot be UUID-shaped and is auto-suffixed on a name conflict. owner defaults to the caller and organization is defaulted for single-organization callers. The created case is returned in result.entities[0].
+ */
+const caseV2ApiControllerCreateCase = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.caseV2ApiControllerCreateCase = caseV2ApiControllerCreateCase;
+/**
+ * Get case by id or name
+ * Fetch one Binalyze AIR case by UUID or case name using GET /api/v2/cases/{idOrName}. Read-only; the case is wrapped in result.entities[0]. The entity uses object refs (owner{}, organizations[{id,name}], category{}, tags[], assignedUsers[]), taskCounts{}, and assets/taskAssignments {count,url} summaries. Lifecycle status is open, closed or archived. A 404 also covers cases outside the caller's organizations (leak-safe), so do not infer the case does not exist. Use air-cases-list to discover ids and names first.
+ */
+const caseV2ApiControllerGetCaseByIdOrName = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}',
+        ...options
+    });
+};
+exports.caseV2ApiControllerGetCaseByIdOrName = caseV2ApiControllerGetCaseByIdOrName;
+/**
+ * Update a case
+ * Partially update a Binalyze AIR case via PATCH /api/v2/cases/{idOrName}. MUTATING. dryRun DEFAULTS TO TRUE: the first call returns a would-update preview without persisting; pass dryRun=false only after the user confirms. Only supplied fields change. Owner change is folded into this endpoint (there is no separate change-owner endpoint). tags and metadata are a FULL REPLACE, not a merge; removeCategory=true clears the category. Reference fields (owner, assignedUsers, category, tags) accept a UUID or an exact name/username. If nothing effectively changes the API answers with a NOTHING_CHANGED error envelope.
+ */
+const caseV2ApiControllerUpdateCase = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/cases/{idOrName}',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.caseV2ApiControllerUpdateCase = caseV2ApiControllerUpdateCase;
+/**
+ * Check if a case name is available
+ * Validates whether a given case name is exists
+ */
+const casesCheckName = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
         url: '/api/public/cases/check',
         ...options
     });
@@ -5667,6 +6673,84 @@ const caseExportCaseEndpoints1 = (options) => {
     });
 };
 exports.caseExportCaseEndpoints1 = caseExportCaseEndpoints1;
+/**
+ * Download a case assets expression export
+ * Downloads CSV for a previously created case assets expression export
+ */
+const casesDownloadAssetsExpressionExport = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cases/{id}/endpoints/export-query',
+        ...options
+    });
+};
+exports.casesDownloadAssetsExpressionExport = casesDownloadAssetsExpressionExport;
+/**
+ * Create a case assets expression export
+ * Caches an expression filter for downloading case-linked assets as CSV. Use the returned exportUrl within 60 seconds.
+ */
+const casesCreateAssetsExpressionExport = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cases/{id}/endpoints/export-query',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.casesCreateAssetsExpressionExport = casesCreateAssetsExpressionExport;
+/**
+ * Download a case assets expression export
+ * Downloads CSV for a previously created case assets expression export
+ */
+const casesDownloadAssetsExpressionExport2 = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cases/{id}/assets/export-query',
+        ...options
+    });
+};
+exports.casesDownloadAssetsExpressionExport2 = casesDownloadAssetsExpressionExport2;
+/**
+ * Create a case assets expression export
+ * Caches an expression filter for downloading case-linked assets as CSV. Use the returned exportUrl within 60 seconds.
+ */
+const casesCreateAssetsExpressionExport2 = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cases/{id}/assets/export-query',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.casesCreateAssetsExpressionExport2 = casesCreateAssetsExpressionExport2;
 /**
  * Retrieve a specific case
  * Fetches detailed information about a specific case
@@ -5900,13 +6984,53 @@ const casesGetEndpoints = (options) => {
         ...options
     });
 };
-exports.casesGetEndpoints = casesGetEndpoints;
+exports.casesGetEndpoints = casesGetEndpoints;
+/**
+ * Get endpoints for a specific case
+ * Retrieves a paginated list of endpoints/assets linked to the specified case
+ */
+const casesGetEndpoints2 = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cases/{id}/assets',
+        ...options
+    });
+};
+exports.casesGetEndpoints2 = casesGetEndpoints2;
+/**
+ * Get case assets by expression filter
+ * Retrieves a paginated list of endpoints/assets linked to the specified case using a filter expression
+ */
+const casesGetAssetsByFilterExpression = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cases/{id}/endpoints/filter-query',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.casesGetAssetsByFilterExpression = casesGetAssetsByFilterExpression;
 /**
- * Get endpoints for a specific case
- * Retrieves a paginated list of endpoints/assets linked to the specified case
+ * Get case assets by expression filter
+ * Retrieves a paginated list of endpoints/assets linked to the specified case using a filter expression
  */
-const casesGetEndpoints2 = (options) => {
-    return (options.client ?? client_gen_1.client).get({
+const casesGetAssetsByFilterExpression2 = (options) => {
+    return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
             {
@@ -5914,11 +7038,15 @@ const casesGetEndpoints2 = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/cases/{id}/assets',
-        ...options
+        url: '/api/public/cases/{id}/assets/filter-query',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.casesGetEndpoints2 = casesGetEndpoints2;
+exports.casesGetAssetsByFilterExpression2 = casesGetAssetsByFilterExpression2;
 /**
  * Get activities for a specific case
  * Retrieves a paginated list of activities for a case
@@ -6762,6 +7890,7 @@ const interactCommandSnippetTagsUpdate = (options) => {
 exports.interactCommandSnippetTagsUpdate = interactCommandSnippetTagsUpdate;
 /**
  * List InterAct command snippets
+ * List Binalyze AIR InterAct command snippets (reusable shell scripts in the InterAct library) using GET /api/v2/libraries/interact/snippets. Read-only and paginated. Each entity is a snippet summary: id, name, description, script, platforms, tags [{id,name}], organizations [{id,name}], origin (user or predefined), createdBy, createdAt/updatedAt. Use this when the user asks to list or search InterAct snippets/scripts, or needs a snippet id or exact name before get, update, or delete. sortBy accepts only name, createdAt, updatedAt (default name ASC). Predefined (system) snippets have origin=predefined and cannot be modified or deleted.
  */
 const interactLibrarySnippetV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -6784,6 +7913,7 @@ const interactLibrarySnippetV2ApiControllerList = (options) => {
 exports.interactLibrarySnippetV2ApiControllerList = interactLibrarySnippetV2ApiControllerList;
 /**
  * Create InterAct command snippet
+ * Create a Binalyze AIR InterAct command snippet (a reusable shell script in the InterAct library) via POST /api/v2/libraries/interact/snippets. MUTATING: persists a new snippet. `name` (max 255 alphanumeric chars, not UUID-shaped) and `script` (max 5000 chars) are required. Omitted platforms means all platforms. Omitted organizations auto-selects the caller's single accessible organization; multi-org and all-orgs callers must pass organizations explicitly (400 ORGANIZATION_REQUIRED). Unknown tag names are created in the shared InterAct tag store. A name collision within the target organizations is resolved by auto-suffixing; a warning reports the adjusted name. dryRun DEFAULTS TO TRUE: the first call previews the would-create entity (action='would-create', final name after suffixing) without persisting anything; pass dryRun=false only to actually create after the user confirms. Success returns entities[0] with the created snippet detail plus warnings[] (e.g. name adjustments).
  */
 const interactLibrarySnippetV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -6810,6 +7940,7 @@ const interactLibrarySnippetV2ApiControllerCreate = (options) => {
 exports.interactLibrarySnippetV2ApiControllerCreate = interactLibrarySnippetV2ApiControllerCreate;
 /**
  * Bulk delete InterAct command snippets
+ * Bulk delete Binalyze AIR InterAct command snippets by id or name via POST /api/v2/libraries/interact/snippets/delete. MUTATING and irreversible. Targets that are unknown or predefined (system) are skipped and reported in warnings[]; the delete itself is all-or-nothing over the resolved targets (if one vanishes mid-delete, nothing is deleted and a warning explains it). dryRun DEFAULTS TO TRUE: the first call returns entities[] previews (action:'would-delete' per resolved snippet) plus warnings for skipped targets, without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns { deletedCount, warnings }. For a single snippet prefer air-interact-snippets-delete.
  */
 const interactLibrarySnippetV2ApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -6836,6 +7967,7 @@ const interactLibrarySnippetV2ApiControllerBulkDelete = (options) => {
 exports.interactLibrarySnippetV2ApiControllerBulkDelete = interactLibrarySnippetV2ApiControllerBulkDelete;
 /**
  * Delete InterAct command snippet
+ * Delete ONE Binalyze AIR InterAct command snippet by UUID or exact name via DELETE /api/v2/libraries/interact/snippets/{idOrName}. MUTATING and irreversible: removes the snippet record and its tag relations. Predefined (system, origin=predefined) snippets cannot be deleted and return an error. An unknown id or name returns 404. dryRun DEFAULTS TO TRUE: the first call returns entities[0] = { id, name, action:'would-delete', effects } without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns entities[0] = { id, name } of the deleted snippet. For deleting several snippets at once use air-interact-snippets-bulk-delete.
  */
 const interactLibrarySnippetV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -6858,6 +7990,7 @@ const interactLibrarySnippetV2ApiControllerDelete = (options) => {
 exports.interactLibrarySnippetV2ApiControllerDelete = interactLibrarySnippetV2ApiControllerDelete;
 /**
  * Get InterAct command snippet by id or name
+ * Get ONE Binalyze AIR InterAct command snippet by UUID or exact name using GET /api/v2/libraries/interact/snippets/{idOrName}. Read-only. Returns entities[0] with the full snippet detail: id, name, description, script, platforms, tags [{id,name}], organizations [{id,name}], origin (user or predefined), createdBy, createdAt/updatedAt. Use this when the user asks for a specific snippet's script or metadata. An unknown id or name returns 404. If the name is not exact, use air-interact-snippets-list with a name filter first.
  */
 const interactLibrarySnippetV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -6880,6 +8013,7 @@ const interactLibrarySnippetV2ApiControllerGet = (options) => {
 exports.interactLibrarySnippetV2ApiControllerGet = interactLibrarySnippetV2ApiControllerGet;
 /**
  * Update InterAct command snippet
+ * Update ONE Binalyze AIR InterAct command snippet by UUID or exact name via PATCH /api/v2/libraries/interact/snippets/{idOrName}. MUTATING, partial update: only the fields you pass are changed. Updatable fields: name, script, description, platforms, tags, organizations. Passing tags=[] clears all tags; passing organizations replaces the organization scope (requires authority over the current scope). Predefined (system, origin=predefined) snippets cannot be modified and return an error. Sending no updatable field returns HTTP 200 with success:false and a NOTHING_CHANGED error entry. dryRun DEFAULTS TO TRUE: the first call previews the would-update entity with changedFields without persisting; pass dryRun=false only to actually update after the user confirms. Success returns entities[0] with the updated snippet detail plus warnings[] (e.g. name auto-suffix on collision).
  */
 const interactLibrarySnippetV2ApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -6906,6 +8040,7 @@ const interactLibrarySnippetV2ApiControllerUpdate = (options) => {
 exports.interactLibrarySnippetV2ApiControllerUpdate = interactLibrarySnippetV2ApiControllerUpdate;
 /**
  * List InterAct command snippet tags
+ * List Binalyze AIR InterAct snippet tags (the shared tag store of the InterAct library) using GET /api/v2/libraries/interact/tags. Read-only and paginated. Each entity is a tag: id, name, organizations [{id,name}], createdAt/updatedAt, and (with withCount=true) the number of snippets using it. Use this when the user asks to list or search InterAct tags, or needs a tag id or exact name before get, update, delete, or before tagging snippets. sortBy accepts only name, createdAt, updatedAt (default name ASC).
  */
 const interactLibraryTagV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -6928,6 +8063,7 @@ const interactLibraryTagV2ApiControllerList = (options) => {
 exports.interactLibraryTagV2ApiControllerList = interactLibraryTagV2ApiControllerList;
 /**
  * Create InterAct command snippet tag
+ * Create a Binalyze AIR InterAct snippet tag (in the shared tag store of the InterAct library) via POST /api/v2/libraries/interact/tags. MUTATING: persists a new tag. `name` (max 100 alphanumeric chars, not UUID-shaped) is required. Omitted organizations auto-selects the caller's single accessible organization; multi-org and all-orgs callers must pass organizations explicitly (400 ORGANIZATION_REQUIRED). A name collision within the target organizations is resolved by auto-suffixing; a warning reports the adjusted name. dryRun DEFAULTS TO TRUE: the first call previews the would-create entity (action='would-create', final name after suffixing) without persisting anything; pass dryRun=false only to actually create after the user confirms. Success returns entities[0] with the created tag plus warnings[]. Note: air-interact-snippets-create and -update also auto-create unknown tag names, so an explicit tag create is only needed when the user wants the tag itself.
  */
 const interactLibraryTagV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -6954,6 +8090,7 @@ const interactLibraryTagV2ApiControllerCreate = (options) => {
 exports.interactLibraryTagV2ApiControllerCreate = interactLibraryTagV2ApiControllerCreate;
 /**
  * Bulk delete InterAct command snippet tags
+ * Bulk delete Binalyze AIR InterAct snippet tags by id or name via POST /api/v2/libraries/interact/tags/delete. MUTATING and irreversible: removes the tag records and their snippet-tag relations (snippets themselves are kept). Targets that are unknown or system tags are skipped and reported in warnings[]; deletion is per-tag, so a tag already deleted concurrently counts as gone. dryRun DEFAULTS TO TRUE: the first call returns entities[] previews (action:'would-delete' per resolved tag) plus warnings for skipped targets, without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns { deletedCount, warnings }. For a single tag prefer air-interact-tags-delete.
  */
 const interactLibraryTagV2ApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -6980,6 +8117,7 @@ const interactLibraryTagV2ApiControllerBulkDelete = (options) => {
 exports.interactLibraryTagV2ApiControllerBulkDelete = interactLibraryTagV2ApiControllerBulkDelete;
 /**
  * Delete InterAct command snippet tag
+ * Delete ONE Binalyze AIR InterAct snippet tag by UUID or exact name via DELETE /api/v2/libraries/interact/tags/{idOrName}. MUTATING and irreversible: removes the tag record and its snippet-tag relations (snippets themselves are kept). System tags cannot be deleted and return an error. An unknown id or name returns 404. dryRun DEFAULTS TO TRUE: the first call returns entities[0] = { id, name, action:'would-delete', effects } without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns entities[0] = { id, name } of the deleted tag. For deleting several tags at once use air-interact-tags-bulk-delete.
  */
 const interactLibraryTagV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -7002,7 +8140,7 @@ const interactLibraryTagV2ApiControllerDelete = (options) => {
 exports.interactLibraryTagV2ApiControllerDelete = interactLibraryTagV2ApiControllerDelete;
 /**
  * Get InterAct command snippet tag by id or name
- * v2-only endpoint. Returns a single tag wrapped in entities[0].
+ * Get ONE Binalyze AIR InterAct snippet tag by UUID or exact name using GET /api/v2/libraries/interact/tags/{idOrName}. Read-only. Returns entities[0] with the tag detail: id, name, organizations [{id,name}], snippet usage count, createdAt/updatedAt. Use this when the user asks about a specific InterAct tag. An unknown id or name returns 404. If the name is not exact, use air-interact-tags-list with a name filter first.
  */
 const interactLibraryTagV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -7025,6 +8163,7 @@ const interactLibraryTagV2ApiControllerGet = (options) => {
 exports.interactLibraryTagV2ApiControllerGet = interactLibraryTagV2ApiControllerGet;
 /**
  * Update InterAct command snippet tag
+ * Update ONE Binalyze AIR InterAct snippet tag by UUID or exact name via PATCH /api/v2/libraries/interact/tags/{idOrName}. MUTATING, partial update: only the fields you pass are changed. Updatable fields: name and organizations (replaces the current organization scope; requires authority over the current scope). System tags cannot be updated and return an error. Sending no updatable field returns HTTP 200 with success:false and a NOTHING_CHANGED error entry. dryRun DEFAULTS TO TRUE: the first call previews the would-update entity with changedFields without persisting; pass dryRun=false only to actually update after the user confirms. Success returns entities[0] with the updated tag plus warnings[] (e.g. name auto-suffix on collision).
  */
 const interactLibraryTagV2ApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -7051,6 +8190,7 @@ const interactLibraryTagV2ApiControllerUpdate = (options) => {
 exports.interactLibraryTagV2ApiControllerUpdate = interactLibraryTagV2ApiControllerUpdate;
 /**
  * List InterAct library files
+ * List Binalyze AIR InterAct library files (binaries/scripts responders can download during a shell session) using GET /api/v2/libraries/interact/files. Read-only and paginated. Each entity is a file record: id, name, size, sha256, organizations [{id,name}], uploadedBy/uploadedAt, lastUsedBy/lastUsedAt. File CONTENT is not included; use air-interact-files-download for the bytes. Use this when the user asks to list or search InterAct library files, verify a file by sha256, or needs a file id or exact name before download or delete. searchTerm matches name or sha256 (contains, case-insensitive); sha256 is an exact full-hash lookup. sortBy accepts only name, size, uploadedAt, uploadedBy, lastUsedAt, lastUsedBy (default uploadedAt DESC).
  */
 const interactLibraryFileV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -7073,9 +8213,11 @@ const interactLibraryFileV2ApiControllerList = (options) => {
 exports.interactLibraryFileV2ApiControllerList = interactLibraryFileV2ApiControllerList;
 /**
  * Upload InterAct library file
+ * Upload a file into the Binalyze AIR InterAct library via POST /api/v2/libraries/interact/files (multipart field 'file'). MUTATING: persists the file so responders can download it during InterAct shell sessions. Limits: max 4 GB per upload and 20 GB total library size. A name collision within the target organizations is resolved by auto-suffixing; a warning reports the adjusted name. dryRun DEFAULTS TO TRUE: the first call previews the would-create entity (name, size, sha256) without persisting anything; pass dryRun=false only to actually upload after the user confirms. Success returns entities[0] with the file record (id, name, size, sha256, organizations) plus warnings[], and a Location header pointing at the new resource.
  */
 const interactLibraryFileV2ApiControllerUpload = (options) => {
     return (options.client ?? client_gen_1.client).post({
+        ...client_1.formDataBodySerializer,
         responseType: 'json',
         security: [
             {
@@ -7091,7 +8233,7 @@ const interactLibraryFileV2ApiControllerUpload = (options) => {
         url: '/api/v2/libraries/interact/files',
         ...options,
         headers: {
-            'Content-Type': 'application/json',
+            'Content-Type': null,
             ...options.headers
         }
     });
@@ -7099,6 +8241,7 @@ const interactLibraryFileV2ApiControllerUpload = (options) => {
 exports.interactLibraryFileV2ApiControllerUpload = interactLibraryFileV2ApiControllerUpload;
 /**
  * Bulk delete InterAct library files
+ * Bulk delete Binalyze AIR InterAct library files by id or name via POST /api/v2/libraries/interact/files/delete. MUTATING and irreversible: removes the file records and their stored content. Unknown targets are skipped and reported in warnings[]; the delete itself is all-or-nothing over the resolved targets (if one vanishes mid-delete, nothing is deleted and a warning explains it). dryRun DEFAULTS TO TRUE: the first call returns entities[] previews (action:'would-delete' per resolved file) plus warnings for skipped targets, without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns { deletedCount, warnings }. For a single file prefer air-interact-files-delete.
  */
 const interactLibraryFileV2ApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -7125,6 +8268,7 @@ const interactLibraryFileV2ApiControllerBulkDelete = (options) => {
 exports.interactLibraryFileV2ApiControllerBulkDelete = interactLibraryFileV2ApiControllerBulkDelete;
 /**
  * Delete InterAct library file
+ * Delete ONE Binalyze AIR InterAct library file by UUID or exact name via DELETE /api/v2/libraries/interact/files/{idOrName}. MUTATING and irreversible: removes the library-file record, its file-info record, and the stored file content. An unknown id or name returns 404. dryRun DEFAULTS TO TRUE: the first call returns entities[0] = { id, name, action:'would-delete', effects } without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns entities[0] = { id, name } of the deleted file. For deleting several files at once use air-interact-files-bulk-delete.
  */
 const interactLibraryFileV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -7147,6 +8291,7 @@ const interactLibraryFileV2ApiControllerDelete = (options) => {
 exports.interactLibraryFileV2ApiControllerDelete = interactLibraryFileV2ApiControllerDelete;
 /**
  * Download InterAct library file by id or name
+ * Download ONE Binalyze AIR InterAct library file by UUID or exact name via GET /api/v2/libraries/interact/files/{idOrName}. Read-only; the endpoint streams the file content as an attachment (it bypasses the JSON envelope). This tool saves the bytes to a file inside the current worktree (outputPath, default artifacts/interact-library-file.bin) and returns { outputPath, byteLength }; read the saved file for the content. Use air-interact-files-list first if you only need the file's size/sha256 metadata without downloading content. An unknown id or name returns 404. Library files can be forensic tooling or scripts; treat downloaded content carefully and do not execute it.
  */
 const interactLibraryFileV2ApiControllerDownload = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -7167,6 +8312,29 @@ const interactLibraryFileV2ApiControllerDownload = (options) => {
     });
 };
 exports.interactLibraryFileV2ApiControllerDownload = interactLibraryFileV2ApiControllerDownload;
+/**
+ * List native InterAct shell commands
+ * List the AIR native InterAct shell commands (and their aliases, descriptions, usage) via GET /api/v2/interact/commands. Use this to GROUND command handling instead of guessing: before telling the user a command looks like a typo, call this tool (optionally with searchTerm) and suggest the closest real command name from `commandNames`. Note: a command that is NOT in this list is not necessarily invalid -- air-assets-interact-run also runs arbitrary shell commands. So only offer a "did you mean" when a close native match exists. Read-only.
+ */
+const interactCommandV2ApiControllerList = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/interact/commands',
+        ...options
+    });
+};
+exports.interactCommandV2ApiControllerList = interactCommandV2ApiControllerList;
 const multipartUploadInitializeHead = (options) => {
     return (options?.client ?? client_gen_1.client).head({
         security: [
@@ -7474,25 +8642,257 @@ const systemApiTokensGetMany = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/system-tokens',
+        url: '/api/public/system-tokens',
+        ...options
+    });
+};
+exports.systemApiTokensGetMany = systemApiTokensGetMany;
+/**
+ * Create a new system API token
+ * Create a new system API token with the specified name, description, expiration date, and role
+ */
+const systemApiTokensCreate = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/system-tokens',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.systemApiTokensCreate = systemApiTokensCreate;
+/**
+ * Delete a system API token
+ * Delete an existing system API token by ID
+ */
+const systemApiTokensDelete = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/system-tokens/{id}',
+        ...options
+    });
+};
+exports.systemApiTokensDelete = systemApiTokensDelete;
+/**
+ * Get system API token by ID
+ * Retrieve a specific system API token
+ */
+const systemApiTokensGetOne = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/system-tokens/{id}',
+        ...options
+    });
+};
+exports.systemApiTokensGetOne = systemApiTokensGetOne;
+/**
+ * Update an existing system API token
+ * Update an existing system API token
+ */
+const systemApiTokensUpdate = (options) => {
+    return (options.client ?? client_gen_1.client).put({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/system-tokens/{id}',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.systemApiTokensUpdate = systemApiTokensUpdate;
+const cloudAccountsFilter = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cloud-forensics/accounts',
+        ...options
+    });
+};
+exports.cloudAccountsFilter = cloudAccountsFilter;
+const cloudAccountsCreateCloudAccount = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cloud-forensics/accounts',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.cloudAccountsCreateCloudAccount = cloudAccountsCreateCloudAccount;
+const cloudAccountsGetConfig = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cloud-forensics/accounts/config',
+        ...options
+    });
+};
+exports.cloudAccountsGetConfig = cloudAccountsGetConfig;
+const cloudAccountsExport = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cloud-forensics/accounts/export',
+        ...options
+    });
+};
+exports.cloudAccountsExport = cloudAccountsExport;
+const cloudAccountsDelete = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cloud-forensics/accounts/{id}',
+        ...options
+    });
+};
+exports.cloudAccountsDelete = cloudAccountsDelete;
+const cloudAccountsGetCloudAccountById = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cloud-forensics/accounts/{id}',
+        ...options
+    });
+};
+exports.cloudAccountsGetCloudAccountById = cloudAccountsGetCloudAccountById;
+const cloudAccountsUpdateCloudAccount = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cloud-forensics/accounts/{id}',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.cloudAccountsUpdateCloudAccount = cloudAccountsUpdateCloudAccount;
+const cloudAccountsSyncCloudAccount = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cloud-forensics/accounts/sync/{id}',
+        ...options
+    });
+};
+exports.cloudAccountsSyncCloudAccount = cloudAccountsSyncCloudAccount;
+const cloudAccountsSyncAllCloudAccount = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/cloud-forensics/accounts/sync/{cloudVendor}/all',
+        ...options
+    });
+};
+exports.cloudAccountsSyncAllCloudAccount = cloudAccountsSyncAllCloudAccount;
+/**
+ * List investigation flags
+ * List Binalyze AIR investigation flags (the shared evidence-flag library) using GET /api/v2/libraries/flags. Read-only and paginated. Each entity: numeric id, name, description, color, organizations [{ id, name }], createdBy, createdAt/updatedAt. filter[name] is a case-insensitive contains match; sortBy accepts name, createdAt, updatedAt (default name ASC). Use this to find a flag id or exact name before update/delete or before flagging evidence in an investigation.
+ */
+const flagsLibraryV2ApiControllerList = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/libraries/flags',
         ...options
     });
 };
-exports.systemApiTokensGetMany = systemApiTokensGetMany;
+exports.flagsLibraryV2ApiControllerList = flagsLibraryV2ApiControllerList;
 /**
- * Create a new system API token
- * Create a new system API token with the specified name, description, expiration date, and role
+ * Create investigation flag
+ * Create a Binalyze AIR investigation flag via POST /api/v2/libraries/flags. MUTATING: persists a new flag. Required: name (max 50 chars, not purely numeric). Optional: color (CSS color, defaults to #4A4D55), description, and organization (id or exact name; defaults to the caller organization when the caller has exactly one; multi-organization and all-organization callers must pass it explicitly or receive 400 ORGANIZATION_REQUIRED). A name collision within the organization is resolved by auto-suffixing with a NAME_ADJUSTED warning; if a unique name cannot be allocated, returns 409 NAME_CONFLICT. dryRun DEFAULTS TO TRUE in the tool layer: the first call previews the would-create entity (action='would-create', final name) without persisting; pass dryRun=false only after the user confirms. Success returns entities[0] with the created flag.
  */
-const systemApiTokensCreate = (options) => {
+const flagsLibraryV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/system-tokens',
+        url: '/api/v2/libraries/flags',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -7500,56 +8900,72 @@ const systemApiTokensCreate = (options) => {
         }
     });
 };
-exports.systemApiTokensCreate = systemApiTokensCreate;
+exports.flagsLibraryV2ApiControllerCreate = flagsLibraryV2ApiControllerCreate;
 /**
- * Delete a system API token
- * Delete an existing system API token by ID
+ * Delete investigation flag
+ * Delete ONE Binalyze AIR investigation flag by numeric id or exact name via DELETE /api/v2/libraries/flags/{idOrName}. MUTATING and irreversible: removes the flag record. System-created flags cannot be deleted (406). dryRun DEFAULTS TO TRUE in the tool layer: the first call returns entities[0] = { id, name, action:'would-delete' } without deleting; pass dryRun=false only after the user confirms. Success returns entities[0] = { id, name } of the deleted flag.
  */
-const systemApiTokensDelete = (options) => {
+const flagsLibraryV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
+        responseType: 'json',
         security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/system-tokens/{id}',
+        url: '/api/v2/libraries/flags/{idOrName}',
         ...options
     });
 };
-exports.systemApiTokensDelete = systemApiTokensDelete;
+exports.flagsLibraryV2ApiControllerDelete = flagsLibraryV2ApiControllerDelete;
 /**
- * Get system API token by ID
- * Retrieve a specific system API token
+ * Get investigation flag by id or name
+ * Get ONE Binalyze AIR investigation flag by numeric id or exact name using GET /api/v2/libraries/flags/{idOrName}. Read-only. Returns entities[0] with the flag detail. An unknown name returns 404 with ranked did-you-mean candidates under errors[0].details.suggestions; a name shared across organizations returns 400 AMBIGUOUS_NAME with errors[0].details.matches.
  */
-const systemApiTokensGetOne = (options) => {
+const flagsLibraryV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
         responseType: 'json',
         security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/system-tokens/{id}',
+        url: '/api/v2/libraries/flags/{idOrName}',
         ...options
     });
 };
-exports.systemApiTokensGetOne = systemApiTokensGetOne;
+exports.flagsLibraryV2ApiControllerGet = flagsLibraryV2ApiControllerGet;
 /**
- * Update an existing system API token
- * Update an existing system API token
+ * Update investigation flag
+ * Update ONE Binalyze AIR investigation flag by numeric id or exact name via PATCH /api/v2/libraries/flags/{idOrName}. MUTATING, partial: only the fields you pass (name, color, description) change; null is treated as not provided. Sending no updatable field returns HTTP 200 with success:false and a NOTHING_CHANGED error entry. A rename collision is resolved by auto-suffixing with a NAME_ADJUSTED warning. dryRun DEFAULTS TO TRUE in the tool layer: preview first, then pass dryRun=false to persist. Success returns entities[0] with the updated flag (fresh timestamps).
  */
-const systemApiTokensUpdate = (options) => {
-    return (options.client ?? client_gen_1.client).put({
+const flagsLibraryV2ApiControllerUpdate = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
         responseType: 'json',
         security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/system-tokens/{id}',
+        url: '/api/v2/libraries/flags/{idOrName}',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -7557,29 +8973,26 @@ const systemApiTokensUpdate = (options) => {
         }
     });
 };
-exports.systemApiTokensUpdate = systemApiTokensUpdate;
-const cloudAccountsFilter = (options) => {
-    return (options.client ?? client_gen_1.client).get({
-        security: [
-            {
-                scheme: 'bearer',
-                type: 'http'
-            }
-        ],
-        url: '/api/public/cloud-forensics/accounts',
-        ...options
-    });
-};
-exports.cloudAccountsFilter = cloudAccountsFilter;
-const cloudAccountsCreateCloudAccount = (options) => {
+exports.flagsLibraryV2ApiControllerUpdate = flagsLibraryV2ApiControllerUpdate;
+/**
+ * Flag evidence rows in an investigation
+ * Mark rows of one investigation with a flag via POST /api/v2/investigations/{idOrName}/flag. MUTATING. body.flag accepts a numeric flag id or exact flag name from the /api/v2/libraries/flags library (the flag must belong to the investigation's organization). A flag NAME that does not exist yet is auto-created in the investigation's organization and reported under warnings[] code=FLAG_CREATED (dryRun previews it as FLAG_WILL_BE_CREATED with flag.id=null); a numeric flag id must already exist (404 otherwise). Auto-creating a flag requires the case-container manage privilege (the same write the /api/v2/libraries/flags create endpoint needs); without it an unknown flag name is rejected with 403. If every items[] row is skipped, the missing flag is NOT created (warnings[] code=FLAG_NOT_CREATED, in the dryRun preview as well) so bad coordinates never mutate the flag library. COORDINATES (critical): each items[] row is identified by evidence + objectId + taskAssignmentId. evidence accepts the evidence TABLE name exactly as air-investigations-schema/sql-query show it (e.g. linux_shell_history) or its bare section name (e.g. shell_history); the endpoint normalizes to the bare section the UI joins on, so just pass the table name you queried. objectId MUST be the row's air_object_id column -- NOT air_id and NOT the full-text-search id/primary key. SOURCE selects the surface (and where the flag shows): EVIDENCE (default) = raw evidence rows, FINDING = the Findings view (what users usually mean by "findings"/"bulgular"), TIMELINE = timeline rows. Take items[] from that SAME surface: for EVIDENCE, evidence=<table name> and objectId=<that table>.air_object_id; for FINDING, evidence=air_findings_view.section and objectId=air_findings_view.air_evidence_object_id (its air_evidence_object_id, NOT its air_object_id); for TIMELINE, evidence=evidence_category and objectId=air_evidence_object_id of the timeline row. EXAMPLE (flag two evidence rows): source omitted (EVIDENCE), items=[{"evidence":"windows_processes","objectId":48,"taskAssignmentId":"604df464-...","}, {"evidence":"windows_user_folders","objectId":1,"taskAssignmentId":"2eb56bc4-..."}] where 48 and 1 are air_object_id values discovered with air-investigations-sql-query (e.g. SELECT air_object_id, air_task_assignment_id FROM windows_processes ...). Rows with an unknown evidence name or coordinates matching no real row are SKIPPED (not written) and reported under warnings[] code=ROWS_SKIPPED with a per-item reason (UNKNOWN_EVIDENCE / ROW_NOT_FOUND); itemCount reflects only the rows actually flagged. dryRun DEFAULTS TO TRUE in the tool layer: the first call previews (action='would-flag', resolved flag, itemCount, any ROWS_SKIPPED warnings) without changing anything; pass dryRun=false only after the user confirms.
+ */
+const investigationEvidenceFlagV2ApiControllerFlagEvidence = (options) => {
     return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
         security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/cloud-forensics/accounts',
+        url: '/api/v2/investigations/{idOrName}/flag',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -7587,68 +9000,53 @@ const cloudAccountsCreateCloudAccount = (options) => {
         }
     });
 };
-exports.cloudAccountsCreateCloudAccount = cloudAccountsCreateCloudAccount;
-const cloudAccountsGetConfig = (options) => {
-    return (options?.client ?? client_gen_1.client).get({
-        security: [
-            {
-                scheme: 'bearer',
-                type: 'http'
-            }
-        ],
-        url: '/api/public/cloud-forensics/accounts/config',
-        ...options
-    });
-};
-exports.cloudAccountsGetConfig = cloudAccountsGetConfig;
-const cloudAccountsExport = (options) => {
-    return (options.client ?? client_gen_1.client).get({
+exports.investigationEvidenceFlagV2ApiControllerFlagEvidence = investigationEvidenceFlagV2ApiControllerFlagEvidence;
+/**
+ * Remove a flag from evidence rows in an investigation
+ * Remove one flag from rows of one investigation via POST /api/v2/investigations/{idOrName}/unflag. MUTATING. Same body/coordinate contract as the flag endpoint: body.flag is a numeric flag id or exact flag name (must already exist -- unlike the flag endpoint, unflag never auto-creates), items[] identifies rows by evidence (table name like linux_shell_history or its bare section shell_history -- normalized server-side) + objectId (the row air_object_id, NOT air_id) + taskAssignmentId, and source (EVIDENCE default, FINDING, TIMELINE) must match the surface the flag was applied to, with coordinates from that same surface (see the flag endpoint). Rows that do not carry the flag are ignored. Unknown evidence names or coordinates matching no real row are skipped and reported under warnings[] code=ROWS_SKIPPED with a per-item reason. itemCount reflects the rows actually processed; it is not the number of rows that actually changed. dryRun DEFAULTS TO TRUE in the tool layer: the first call previews (action='would-unflag') without changing anything; pass dryRun=false only after the user confirms.
+ */
+const investigationEvidenceFlagV2ApiControllerUnflagEvidence = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
         security: [
             {
-                scheme: 'bearer',
-                type: 'http'
-            }
-        ],
-        url: '/api/public/cloud-forensics/accounts/export',
-        ...options
-    });
-};
-exports.cloudAccountsExport = cloudAccountsExport;
-const cloudAccountsDelete = (options) => {
-    return (options.client ?? client_gen_1.client).delete({
-        security: [
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/cloud-forensics/accounts/{id}',
-        ...options
+        url: '/api/v2/investigations/{idOrName}/unflag',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.cloudAccountsDelete = cloudAccountsDelete;
-const cloudAccountsGetCloudAccountById = (options) => {
-    return (options.client ?? client_gen_1.client).get({
+exports.investigationEvidenceFlagV2ApiControllerUnflagEvidence = investigationEvidenceFlagV2ApiControllerUnflagEvidence;
+/**
+ * Discover investigation tables and columns
+ * Two-stage schema discovery for one investigation via POST /api/v2/investigations/{idOrName}/schema. Read-only. Empty body {} lists populated tables/materialized views using catalog row estimates and available regular views with rowCount=null. Body { "table": "<name>" } returns an exact, timeout-bounded row count and that table or view's columns (name, type, nullable). idOrName accepts an investigation UUID, a case UUID or an exact case name. Fixed tables: air_investigation_activities, air_investigation_activity_user_reads, air_investigation_comments, air_investigation_evidence_metadata, air_investigation_evidence_relations, air_investigation_evidence_transformer_versions, air_investigation_external_section_import_error, air_investigation_external_section_import_status, air_investigation_finding_timeline, air_investigation_flags, air_investigation_full_text_search, air_investigation_metadata, air_investigation_notes, air_investigation_reports, air_investigation_report_history, air_investigation_task_assignments, air_investigation_task_execution_logs, air_investigation_timeline, air_investigation_timeline_event_range, air_investigation_timeline_hourly, air_investigation_user_findings, drone_findings. Views: air_all_findings_view, air_excluded_findings_view, air_findings_view, air_timeline_findings_view. Evidence tables are named <platform>_<section> (e.g. windows_triage_file, linux_triage_file, windows_event_records) and vary per investigation. POST the schema endpoint with an empty body to list the populated tables of this investigation with row counts; POST { "table": "<name>" } for column details.
+ */
+const investigationSqlV2ApiControllerGetSchema = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
         security: [
             {
-                scheme: 'bearer',
-                type: 'http'
-            }
-        ],
-        url: '/api/public/cloud-forensics/accounts/{id}',
-        ...options
-    });
-};
-exports.cloudAccountsGetCloudAccountById = cloudAccountsGetCloudAccountById;
-const cloudAccountsUpdateCloudAccount = (options) => {
-    return (options.client ?? client_gen_1.client).patch({
-        security: [
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/cloud-forensics/accounts/{id}',
+        url: '/api/v2/investigations/{idOrName}/schema',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -7656,33 +9054,34 @@ const cloudAccountsUpdateCloudAccount = (options) => {
         }
     });
 };
-exports.cloudAccountsUpdateCloudAccount = cloudAccountsUpdateCloudAccount;
-const cloudAccountsSyncCloudAccount = (options) => {
-    return (options.client ?? client_gen_1.client).get({
+exports.investigationSqlV2ApiControllerGetSchema = investigationSqlV2ApiControllerGetSchema;
+/**
+ * Run a read-only SQL query on an investigation
+ * Execute one read-only SELECT statement inside the investigation schema via POST /api/v2/investigations/{idOrName}/sql-query. Returns a paginated result (pageNumber/pageSize in the body; totalEntityCount, totalPageCount, nextPage/previousPage in the envelope). Trailing semicolons, end-of-query -- comments, and trailing LIMIT/OFFSET in sqlQuery are stripped so request paging owns the page slice. Write statements, multiple statements and cross-schema references are rejected. Every result-producing branch must be anchored to at least one relation in the selected investigation. Functions are admitted through PostgreSQL catalog capability checks; volatile, dangerous, user-schema and object-reference functions are rejected. Use the schema endpoint to discover the selected investigation tables and columns; PostgreSQL catalog, object-reference, and cross-schema introspection are rejected. Fixed tables: air_investigation_activities, air_investigation_activity_user_reads, air_investigation_comments, air_investigation_evidence_metadata, air_investigation_evidence_relations, air_investigation_evidence_transformer_versions, air_investigation_external_section_import_error, air_investigation_external_section_import_status, air_investigation_finding_timeline, air_investigation_flags, air_investigation_full_text_search, air_investigation_metadata, air_investigation_notes, air_investigation_reports, air_investigation_report_history, air_investigation_task_assignments, air_investigation_task_execution_logs, air_investigation_timeline, air_investigation_timeline_event_range, air_investigation_timeline_hourly, air_investigation_user_findings, drone_findings. Views: air_all_findings_view, air_excluded_findings_view, air_findings_view, air_timeline_findings_view. Evidence tables are named <platform>_<section> (e.g. windows_triage_file, linux_triage_file, windows_event_records) and vary per investigation. POST the schema endpoint with an empty body to list the populated tables of this investigation with row counts; POST { "table": "<name>" } for column details. Documented row-analysis functions (94): abs, age, array_agg, array_cat, array_length, array_position, array_remove, array_to_string, ascii, avg, bit_length, bool_and, bool_or, btrim, cardinality, ceil, ceiling, char_length, chr, concat, concat_ws, corr, count, date_part, date_trunc, dense_rank, div, first_value, floor, initcap, json_array_length, json_typeof, jsonb_array_elements, jsonb_array_elements_text, jsonb_array_length, jsonb_path_exists, jsonb_typeof, lag, last_value, lead, left, length, lower, lpad, ltrim, max, md5, min, mod, mode, now, nth_value, ntile, octet_length, percentile_cont, percentile_disc, plainto_tsquery, position, power, rank, regexp_matches, regexp_replace, regexp_split_to_array, repeat, replace, reverse, right, round, row_number, rpad, rtrim, split_part, sqrt, starts_with, stddev, stddev_pop, string_agg, string_to_array, strpos, substr, substring, sum, to_char, to_date, to_timestamp, to_tsquery, to_tsvector, translate, trim, trunc, unnest, upper, var_pop, variance. Allowed cast types: bigint, boolean, character, character varying, date, double precision, integer, interval, json, jsonb, numeric, real, smallint, text, time, time with time zone, time without time zone, timestamp with time zone, timestamp without time zone, uuid (plus the usual aliases such as int, varchar, timestamptz). Additional functions are admitted only when PostgreSQL catalog metadata proves they are safe, non-volatile built-ins; unknown, extension, user-schema and dangerous functions are rejected. Object-reference (regclass/oid), catalog, session, filesystem, network and *_to_xml* capabilities are rejected. Safe set-returning functions may expand rows in SELECT, FROM or LATERAL. GROUP BY accepts ROLLUP and GROUPING SETS; CUBE is not supported because the name doubles as an extension function. Execution-context expressions (current_user, current_schema, current_catalog) are rejected.
+ */
+const investigationSqlV2ApiControllerExecuteSqlQuery = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
         security: [
             {
-                scheme: 'bearer',
-                type: 'http'
-            }
-        ],
-        url: '/api/public/cloud-forensics/accounts/sync/{id}',
-        ...options
-    });
-};
-exports.cloudAccountsSyncCloudAccount = cloudAccountsSyncCloudAccount;
-const cloudAccountsSyncAllCloudAccount = (options) => {
-    return (options.client ?? client_gen_1.client).get({
-        security: [
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
             {
                 scheme: 'bearer',
                 type: 'http'
             }
         ],
-        url: '/api/public/cloud-forensics/accounts/sync/{cloudVendor}/all',
-        ...options
+        url: '/api/v2/investigations/{idOrName}/sql-query',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.cloudAccountsSyncAllCloudAccount = cloudAccountsSyncAllCloudAccount;
+exports.investigationSqlV2ApiControllerExecuteSqlQuery = investigationSqlV2ApiControllerExecuteSqlQuery;
 const investigationGetInvestigationById = (options) => {
     return (options.client ?? client_gen_1.client).get({
         security: [
@@ -9122,17 +10521,125 @@ const processorGetProcessorTypeByAssetType = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/public/processors/type/{assetType}',
-        ...options
+        url: '/api/public/processors/type/{assetType}',
+        ...options
+    });
+};
+exports.processorGetProcessorTypeByAssetType = processorGetProcessorTypeByAssetType;
+/**
+ * Reboot a single asset
+ * Reboot EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/reboot. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-reboot instead. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real reboot signal after the user confirms the exact asset. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ */
+const assetActionV2ApiControllerReboot = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/assets/{idOrName}/reboot',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.assetActionV2ApiControllerReboot = assetActionV2ApiControllerReboot;
+/**
+ * Shut down a single asset
+ * Shut down EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/shutdown. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-shutdown instead. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real shutdown signal after the user confirms the exact asset. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ */
+const assetActionV2ApiControllerShutdown = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/assets/{idOrName}/shutdown',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.assetActionV2ApiControllerShutdown = assetActionV2ApiControllerShutdown;
+/**
+ * Isolate a single asset
+ * Network-isolate EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/isolate. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-isolate instead. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real isolation signal after the user confirms the exact asset. Requires the Isolation feature to be enabled. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ */
+const assetActionV2ApiControllerIsolate = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/assets/{idOrName}/isolate',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.assetActionV2ApiControllerIsolate = assetActionV2ApiControllerIsolate;
+/**
+ * Unisolate a single asset
+ * Remove network isolation from EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/unisolate. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-unisolate instead. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real unisolation signal after the user confirms the exact asset. Requires the Isolation feature to be enabled. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ */
+const assetActionV2ApiControllerUnisolate = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/assets/{idOrName}/unisolate',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.processorGetProcessorTypeByAssetType = processorGetProcessorTypeByAssetType;
+exports.assetActionV2ApiControllerUnisolate = assetActionV2ApiControllerUnisolate;
 /**
- * Get asset issue/actionability stats
- * Aggregated counts (version/connectivity/deployment/assignment/isolation) for assets matching the same filter set as GET /api/v2/assets. organizations defaults to allAccessible when omitted.
+ * Retrieve the agent logs of a single asset
+ * Retrieve agent logs for a task on EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/log-retrieval. Use this ONLY for one specific asset; it also requires the taskId whose logs should be collected. If the user gives two or more assets, a list, or a group, use air-assets-bulk-log-retrieval instead. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to assign the real log-retrieval task after the user confirms the asset and task. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetV2ApiControllerGetStats = (options) => {
-    return (options?.client ?? client_gen_1.client).get({
+const assetActionV2ApiControllerRetrieveLogs = (options) => {
+    return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
             {
@@ -9145,18 +10652,22 @@ const assetV2ApiControllerGetStats = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/stats',
-        ...options
+        url: '/api/v2/assets/{idOrName}/log-retrieval',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.assetV2ApiControllerGetStats = assetV2ApiControllerGetStats;
+exports.assetActionV2ApiControllerRetrieveLogs = assetActionV2ApiControllerRetrieveLogs;
 /**
- * Export assets as CSV
- * Streams assets matching the GET /api/v2/assets filter/sort model as text/csv. Successful response bypasses the JSON envelope. Note: tag filtering (tagIds) is not applied on export.
+ * Update the agent version on a single asset
+ * Update the agent version on EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/update. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-version-update instead. There is no version targeting: the agent always updates to the console's current supported version. ALWAYS send dryRun=true on every call (would-update preview); pass dryRun=false only to assign the real immediate one-time update task after the user confirms the exact asset. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetV2ApiControllerExportAssets = (options) => {
-    return (options.client ?? client_gen_1.client).get({
-        responseType: 'text',
+const assetActionV2ApiControllerVersionUpdate = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
         security: [
             {
                 in: 'cookie',
@@ -9168,17 +10679,21 @@ const assetV2ApiControllerExportAssets = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/export',
-        ...options
+        url: '/api/v2/assets/{idOrName}/update',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.assetV2ApiControllerExportAssets = assetV2ApiControllerExportAssets;
+exports.assetActionV2ApiControllerVersionUpdate = assetActionV2ApiControllerVersionUpdate;
 /**
- * List assets
- * Paginated (offset) list of assets visible to the caller. Supports pageNumber/pageSize/sortBy/sortType, filter[*] params, and organizations (defaults to allAccessible when omitted).
+ * Enable maintenance mode on a single asset
+ * Enable maintenance mode on EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/enable-maintenance. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-enable-maintenance instead. ALWAYS send dryRun=true on every call (would-change preview); pass dryRun=false only to apply the real change after the user confirms the exact asset. Updates the asset synchronously (no task is created). A no-op (already in maintenance mode) returns HTTP 200 with a NO_OP entry in errors[]. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetV2ApiControllerFilterAssets = (options) => {
-    return (options?.client ?? client_gen_1.client).get({
+const assetActionV2ApiControllerEnableMaintenance = (options) => {
+    return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
             {
@@ -9191,17 +10706,21 @@ const assetV2ApiControllerFilterAssets = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets',
-        ...options
+        url: '/api/v2/assets/{idOrName}/enable-maintenance',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.assetV2ApiControllerFilterAssets = assetV2ApiControllerFilterAssets;
+exports.assetActionV2ApiControllerEnableMaintenance = assetActionV2ApiControllerEnableMaintenance;
 /**
- * Delete an asset by id or name
- * Deletes the asset. `mode` selects purge / uninstall / purge-and-uninstall. `dryRun=true` returns a would-delete preview and executes nothing.
+ * Disable maintenance mode on a single asset
+ * Disable maintenance mode on EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/disable-maintenance. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-disable-maintenance instead. ALWAYS send dryRun=true on every call (would-change preview); pass dryRun=false only to apply the real change after the user confirms the exact asset. Updates the asset synchronously (no task is created). A no-op (not in maintenance mode) returns HTTP 200 with a NO_OP entry in errors[]. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetV2ApiControllerDeleteAsset = (options) => {
-    return (options.client ?? client_gen_1.client).delete({
+const assetActionV2ApiControllerDisableMaintenance = (options) => {
+    return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
             {
@@ -9214,17 +10733,22 @@ const assetV2ApiControllerDeleteAsset = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}',
-        ...options
+        url: '/api/v2/assets/{idOrName}/disable-maintenance',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.assetV2ApiControllerDeleteAsset = assetV2ApiControllerDeleteAsset;
+exports.assetActionV2ApiControllerDisableMaintenance = assetActionV2ApiControllerDisableMaintenance;
 /**
- * Get asset by id or name
- * Looks up a single asset by canonical UUID `_id` or by name. UUID lookup ignores `organizations`; name lookup searches every accessible org and returns one entry per match.
+ * Import a PPC file into an existing asset
+ * Import a case PPC evidence file into an EXISTING Binalyze AIR asset via POST /api/v2/assets/{idOrName}/import (multipart upload). Use this when the asset already exists in AIR and you want to attach/import a .ppc captured from it (a real PPC zip containing Case.db). Optionally attach the import to a case via caseIdOrName (resolved as uuid or name). Success response (200): result.entities[0] = { id (asset id), name (asset name), ppcFileName, importedAt }. Unknown asset -> 404. KNOWN ISSUE: a corrupt or non-zip file currently returns 500 INTERNAL_ERROR (not a clean 400) -- treat that 500 as 'invalid PPC file', do not retry blindly and do not report it as a server outage. ALWAYS send dryRun=true first (generic preview; does not validate the file); pass dryRun=false only to perform the real import after the user confirms the asset and file. For an off-network Task.dat that should create an offline task, use air-assets-off-network-import instead. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetV2ApiControllerGetAsset = (options) => {
-    return (options.client ?? client_gen_1.client).get({
+const assetActionV2ApiControllerImportPpcToExistingAsset = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        ...client_1.formDataBodySerializer,
         responseType: 'json',
         security: [
             {
@@ -9237,17 +10761,21 @@ const assetV2ApiControllerGetAsset = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}',
-        ...options
+        url: '/api/v2/assets/{idOrName}/import',
+        ...options,
+        headers: {
+            'Content-Type': null,
+            ...options.headers
+        }
     });
 };
-exports.assetV2ApiControllerGetAsset = assetV2ApiControllerGetAsset;
+exports.assetActionV2ApiControllerImportPpcToExistingAsset = assetActionV2ApiControllerImportPpcToExistingAsset;
 /**
- * Replace asset tags
- * Full replace: the asset tag set becomes exactly `tags`. Empty array clears all.
+ * Reboot multiple assets
+ * Reboot MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/reboot. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-reboot (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to send the real reboot signals after the user confirms the asset list. Use failIfNumberOfAssetsGreaterThan as a safety cap.
  */
-const assetV2ApiControllerReplaceTags = (options) => {
-    return (options.client ?? client_gen_1.client).patch({
+const assetBulkActionV2ApiControllerReboot = (options) => {
+    return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
             {
@@ -9260,7 +10788,7 @@ const assetV2ApiControllerReplaceTags = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/tags',
+        url: '/api/v2/reboot',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9268,13 +10796,13 @@ const assetV2ApiControllerReplaceTags = (options) => {
         }
     });
 };
-exports.assetV2ApiControllerReplaceTags = assetV2ApiControllerReplaceTags;
+exports.assetBulkActionV2ApiControllerReboot = assetBulkActionV2ApiControllerReboot;
 /**
- * Update asset label
- * Sets the user-friendly label. Sending null clears it.
+ * Shut down multiple assets
+ * Shut down MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/shutdown. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-shutdown (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to send the real shutdown signals after the user confirms the asset list. Use failIfNumberOfAssetsGreaterThan as a safety cap.
  */
-const assetV2ApiControllerUpdateLabel = (options) => {
-    return (options.client ?? client_gen_1.client).patch({
+const assetBulkActionV2ApiControllerShutdown = (options) => {
+    return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
             {
@@ -9287,7 +10815,7 @@ const assetV2ApiControllerUpdateLabel = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/label',
+        url: '/api/v2/shutdown',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9295,11 +10823,12 @@ const assetV2ApiControllerUpdateLabel = (options) => {
         }
     });
 };
-exports.assetV2ApiControllerUpdateLabel = assetV2ApiControllerUpdateLabel;
+exports.assetBulkActionV2ApiControllerShutdown = assetBulkActionV2ApiControllerShutdown;
 /**
- * Reboot a single asset
+ * Isolate multiple assets
+ * Network-isolate MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/isolate. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-isolate (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to send the real isolation signals after the user confirms the asset list. Requires the Isolation feature to be enabled. Use failIfNumberOfAssetsGreaterThan as a safety cap.
  */
-const assetActionV2ApiControllerReboot = (options) => {
+const assetBulkActionV2ApiControllerIsolate = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9313,7 +10842,7 @@ const assetActionV2ApiControllerReboot = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/reboot',
+        url: '/api/v2/isolate',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9321,11 +10850,12 @@ const assetActionV2ApiControllerReboot = (options) => {
         }
     });
 };
-exports.assetActionV2ApiControllerReboot = assetActionV2ApiControllerReboot;
+exports.assetBulkActionV2ApiControllerIsolate = assetBulkActionV2ApiControllerIsolate;
 /**
- * Shut down a single asset
+ * Unisolate multiple assets
+ * Remove network isolation from MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/unisolate. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-unisolate (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to send the real unisolation signals after the user confirms the asset list. Requires the Isolation feature to be enabled. Use failIfNumberOfAssetsGreaterThan as a safety cap.
  */
-const assetActionV2ApiControllerShutdown = (options) => {
+const assetBulkActionV2ApiControllerUnisolate = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9339,7 +10869,7 @@ const assetActionV2ApiControllerShutdown = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/shutdown',
+        url: '/api/v2/unisolate',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9347,11 +10877,12 @@ const assetActionV2ApiControllerShutdown = (options) => {
         }
     });
 };
-exports.assetActionV2ApiControllerShutdown = assetActionV2ApiControllerShutdown;
+exports.assetBulkActionV2ApiControllerUnisolate = assetBulkActionV2ApiControllerUnisolate;
 /**
- * Isolate a single asset
+ * Retrieve the agent logs of multiple assets
+ * Retrieve agent logs from MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/log-retrieval. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset (and a specific taskId), use air-assets-log-retrieval (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to assign the real log-retrieval task after the user confirms the asset list. Use failIfNumberOfAssetsGreaterThan as a safety cap.
  */
-const assetActionV2ApiControllerIsolate = (options) => {
+const assetBulkActionV2ApiControllerRetrieveLogs = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9365,7 +10896,7 @@ const assetActionV2ApiControllerIsolate = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/isolate',
+        url: '/api/v2/log-retrieval',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9373,11 +10904,12 @@ const assetActionV2ApiControllerIsolate = (options) => {
         }
     });
 };
-exports.assetActionV2ApiControllerIsolate = assetActionV2ApiControllerIsolate;
+exports.assetBulkActionV2ApiControllerRetrieveLogs = assetBulkActionV2ApiControllerRetrieveLogs;
 /**
- * Unisolate a single asset
+ * Update the agent version on multiple assets
+ * Update the agent version on MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/version-update. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-version-update (the single-asset tool) instead. There is no version targeting: agents always update to the console's current supported version. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to assign the real immediate one-time update task after the user confirms the asset list. Provide organizations when names are ambiguous across orgs. Use failIfNumberOfAssetsGreaterThan as a safety cap.
  */
-const assetActionV2ApiControllerUnisolate = (options) => {
+const assetBulkActionV2ApiControllerVersionUpdate = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9391,7 +10923,7 @@ const assetActionV2ApiControllerUnisolate = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/unisolate',
+        url: '/api/v2/version-update',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9399,11 +10931,12 @@ const assetActionV2ApiControllerUnisolate = (options) => {
         }
     });
 };
-exports.assetActionV2ApiControllerUnisolate = assetActionV2ApiControllerUnisolate;
+exports.assetBulkActionV2ApiControllerVersionUpdate = assetBulkActionV2ApiControllerVersionUpdate;
 /**
- * Retrieve the agent logs of a single asset
+ * Enable maintenance mode on multiple assets
+ * Enable maintenance mode on MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/enable-maintenance. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-enable-maintenance (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to apply the real change after the user confirms the asset list. These endpoints update assets synchronously and do not create tasks. Provide organizations when names are ambiguous across orgs.
  */
-const assetActionV2ApiControllerRetrieveLogs = (options) => {
+const assetBulkActionV2ApiControllerEnableMaintenance = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9417,7 +10950,7 @@ const assetActionV2ApiControllerRetrieveLogs = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/log-retrieval',
+        url: '/api/v2/enable-maintenance',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9425,11 +10958,12 @@ const assetActionV2ApiControllerRetrieveLogs = (options) => {
         }
     });
 };
-exports.assetActionV2ApiControllerRetrieveLogs = assetActionV2ApiControllerRetrieveLogs;
+exports.assetBulkActionV2ApiControllerEnableMaintenance = assetBulkActionV2ApiControllerEnableMaintenance;
 /**
- * Update the agent version on a single asset
+ * Disable maintenance mode on multiple assets
+ * Disable maintenance mode on MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/disable-maintenance. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-disable-maintenance (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to apply the real change after the user confirms the asset list. These endpoints update assets synchronously and do not create tasks. Provide organizations when names are ambiguous across orgs.
  */
-const assetActionV2ApiControllerVersionUpdate = (options) => {
+const assetBulkActionV2ApiControllerDisableMaintenance = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9443,7 +10977,7 @@ const assetActionV2ApiControllerVersionUpdate = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/update',
+        url: '/api/v2/disable-maintenance',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9451,11 +10985,12 @@ const assetActionV2ApiControllerVersionUpdate = (options) => {
         }
     });
 };
-exports.assetActionV2ApiControllerVersionUpdate = assetActionV2ApiControllerVersionUpdate;
+exports.assetBulkActionV2ApiControllerDisableMaintenance = assetBulkActionV2ApiControllerDisableMaintenance;
 /**
- * Enable maintenance mode on a single asset
+ * Add tag(s) to multiple assets
+ * Add tags to one or more Binalyze AIR assets in one call via POST /api/v2/assets/tags. This APPENDS the given tags to the assets in assets[]; it is not a full replacement (use air-assets-tags to replace one asset's whole tag set). Idempotent: assets that already carry a tag are not re-updated but still report 'tags-added'. Success response (200): result.entities[] = {asset{id,name}, action 'tags-added', addedTags[]}; unresolved/skipped inputs land in result.warnings[] = {asset, action 'skipped', reason}. Zero resolved assets -> 404 'No assets matched'. ALWAYS send dryRun=true first (preview); pass dryRun=false only to apply the real tag add after the user confirms the asset list. UUID entries carry their own org; ambiguous names may need organizations.
  */
-const assetActionV2ApiControllerEnableMaintenance = (options) => {
+const assetBulkMetadataV2ApiControllerAddTags = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9469,7 +11004,7 @@ const assetActionV2ApiControllerEnableMaintenance = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/enable-maintenance',
+        url: '/api/v2/assets/tags',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9477,11 +11012,12 @@ const assetActionV2ApiControllerEnableMaintenance = (options) => {
         }
     });
 };
-exports.assetActionV2ApiControllerEnableMaintenance = assetActionV2ApiControllerEnableMaintenance;
+exports.assetBulkMetadataV2ApiControllerAddTags = assetBulkMetadataV2ApiControllerAddTags;
 /**
- * Disable maintenance mode on a single asset
+ * Remove tag(s) from multiple assets
+ * Remove tags from one or more Binalyze AIR assets in one call via POST /api/v2/assets/tags/delete. This DELETES the given tags from the assets in assets[] (only the listed tags are removed; other tags stay; the tag catalog row itself is not deleted). Responses (200): real removal returns result.entities[] = {asset{id,name}, action 'tags-removed', removedTags[]}; with ?dryRun=true the action is 'would-remove-tags' and nothing changes. Zero resolved assets -> 404 'No assets matched'. ALWAYS send dryRun=true first (schema-specific would-remove preview); pass dryRun=false only to apply the real tag removal after the user confirms the asset list. UUID entries carry their own org; ambiguous names may need organizations.
  */
-const assetActionV2ApiControllerDisableMaintenance = (options) => {
+const assetBulkMetadataV2ApiControllerRemoveTags = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9495,7 +11031,7 @@ const assetActionV2ApiControllerDisableMaintenance = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/disable-maintenance',
+        url: '/api/v2/assets/tags/delete',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9503,12 +11039,13 @@ const assetActionV2ApiControllerDisableMaintenance = (options) => {
         }
     });
 };
-exports.assetActionV2ApiControllerDisableMaintenance = assetActionV2ApiControllerDisableMaintenance;
+exports.assetBulkMetadataV2ApiControllerRemoveTags = assetBulkMetadataV2ApiControllerRemoveTags;
 /**
- * Import a PPC file into an existing asset
+ * Set the update-exclusion flag on multiple assets
+ * Set or clear the 'excluded from automatic agent updates' flag on one or more Binalyze AIR assets via PATCH /api/v2/assets/update-exclusion. excludedFromUpdates=true excludes the assets from auto-updates; false re-includes them. Success response (200): result.entities[] only contains assets that were actually updated ({asset{id,name}, action 'update-exclusion-set', excludedFromUpdates, updatedAt}); assets with an unsupported OS are NOT updated and land in result.warnings[] with action 'skipped' and reason 'Asset has unsupported OS for update'. entities may be empty when every asset was skipped -- report that honestly, do not claim an update. Zero resolved assets -> 404 'No assets matched'. ALWAYS send dryRun=true first (generic preview); pass dryRun=false only to apply the real change after the user confirms the asset list. UUID entries carry their own org; ambiguous names may need organizations.
  */
-const assetActionV2ApiControllerImportPpcToExistingAsset = (options) => {
-    return (options.client ?? client_gen_1.client).post({
+const assetBulkMetadataV2ApiControllerSetUpdateExclusion = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
         responseType: 'json',
         security: [
             {
@@ -9521,16 +11058,21 @@ const assetActionV2ApiControllerImportPpcToExistingAsset = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/import',
-        ...options
+        url: '/api/v2/assets/update-exclusion',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
     });
 };
-exports.assetActionV2ApiControllerImportPpcToExistingAsset = assetActionV2ApiControllerImportPpcToExistingAsset;
+exports.assetBulkMetadataV2ApiControllerSetUpdateExclusion = assetBulkMetadataV2ApiControllerSetUpdateExclusion;
 /**
- * Reboot multiple assets
+ * Set or clear the relay connection route on multiple assets
+ * Set or clear the relay-server connection route of one or more Binalyze AIR assets via PATCH /api/v2/assets/connection-route. relayServerId is the numeric relay server id to route through; pass null to CLEAR the route (direct connection). The relay server's organization must match the assets' organization. ALWAYS send dryRun=true on every call (would-change preview of resolved assets and warnings); pass dryRun=false only to apply the real change after the user confirms the asset list. UUID entries carry their own org; ambiguous names may need organizations.
  */
-const assetBulkActionV2ApiControllerReboot = (options) => {
-    return (options.client ?? client_gen_1.client).post({
+const assetBulkMetadataV2ApiControllerSetConnectionRoute = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
         responseType: 'json',
         security: [
             {
@@ -9543,7 +11085,7 @@ const assetBulkActionV2ApiControllerReboot = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/reboot',
+        url: '/api/v2/assets/connection-route',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9551,12 +11093,13 @@ const assetBulkActionV2ApiControllerReboot = (options) => {
         }
     });
 };
-exports.assetBulkActionV2ApiControllerReboot = assetBulkActionV2ApiControllerReboot;
+exports.assetBulkMetadataV2ApiControllerSetConnectionRoute = assetBulkMetadataV2ApiControllerSetConnectionRoute;
 /**
- * Shut down multiple assets
+ * Set the demanded MITRE ATT&CK Database version on multiple assets
+ * Set the demanded MITRE ATT&CK database version on one or more Binalyze AIR assets via PATCH /api/v2/assets/mitre-attack-database/version. This is the MITRE ATT&CK DATABASE version, not the agent version (use air-assets-bulk-version-update for the agent). PRECONDITIONS: (1) MITRE auto-update must be OFF, otherwise the call fails 400 with code MITRE_AUTO_UPDATE_ENABLED and a message telling how to disable it (PUT /api/public/settings/mitre-attack-database with autoUpdateEnabled=false). (2) version must be one that EXISTS in the system -- versions look like '13.5.2' (no 'v' prefix); list them via GET /api/public/settings/mitre-attack-database/versions; an unknown version fails 400 'is not available in the system'. Success response (200): result.entities[] only contains assets that were actually updated ({asset{id,name}, action 'mitre-database-updated', version, assignedAt}); INELIGIBLE assets are NOT updated and land in result.warnings[] with action 'skipped' and a reason ('Asset subtype is not endpoint', 'Asset is not managed', or 'Agent build does not support MITRE database updates'). entities may be empty when every asset was skipped -- report that honestly, do not claim an update. ALWAYS send dryRun=true first (generic preview; it does NOT check auto-update or version validity); pass dryRun=false only to apply the real change after the user confirms. UUID entries carry their own org; ambiguous names may need organizations.
  */
-const assetBulkActionV2ApiControllerShutdown = (options) => {
-    return (options.client ?? client_gen_1.client).post({
+const assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
         responseType: 'json',
         security: [
             {
@@ -9569,7 +11112,7 @@ const assetBulkActionV2ApiControllerShutdown = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/shutdown',
+        url: '/api/v2/assets/mitre-attack-database/version',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9577,11 +11120,12 @@ const assetBulkActionV2ApiControllerShutdown = (options) => {
         }
     });
 };
-exports.assetBulkActionV2ApiControllerShutdown = assetBulkActionV2ApiControllerShutdown;
+exports.assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion;
 /**
- * Isolate multiple assets
+ * Bulk delete assets (purge / uninstall / purge-and-uninstall)
+ * Delete / decommission one or more Binalyze AIR assets via POST /api/v2/assets/delete. DESTRUCTIVE and largely irreversible (uninstall signals a real agent). mode selects the action: 'purge' (remove console records + evidence files; agent stays), 'uninstall' (uninstall the agent; records stay), or 'purge-and-uninstall' (both). mode 'purge' additionally requires the PurgeWithoutUninstall feature flag; when disabled the call fails 403 Forbidden. Invalid mode -> 400. Zero resolved assets -> 404 'No assets matched'. Responses: dryRun preview (200) returns result.entities[] = {asset{id,name}, mode, action 'would-delete', effects[] (e.g. 'agent-uninstall','console-records','evidence-files')}; the REAL delete (200) returns result = { deletedCount, warnings[] }. ALWAYS send dryRun=true first and show the user the per-asset effects; pass dryRun=false only after the user explicitly confirms the exact asset list and mode. UUID entries carry their own org; ambiguous names may need organizations. Use failIfNumberOfAssetsGreaterThan as a safety cap.
  */
-const assetBulkActionV2ApiControllerIsolate = (options) => {
+const assetBulkMetadataV2ApiControllerDeleteAssets = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9595,7 +11139,7 @@ const assetBulkActionV2ApiControllerIsolate = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/isolate',
+        url: '/api/v2/assets/delete',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9603,12 +11147,14 @@ const assetBulkActionV2ApiControllerIsolate = (options) => {
         }
     });
 };
-exports.assetBulkActionV2ApiControllerIsolate = assetBulkActionV2ApiControllerIsolate;
+exports.assetBulkMetadataV2ApiControllerDeleteAssets = assetBulkMetadataV2ApiControllerDeleteAssets;
 /**
- * Unisolate multiple assets
+ * Import an off-network PPC (find-or-create asset + offline task)
+ * Import an OFF-NETWORK Task.dat via POST /api/v2/assets/import (multipart upload) and create an OFFLINE TASK (offline-triage or offline-acquisition). IMPORTANT semantics: this endpoint does NOT create or find an asset -- it only creates a task from the uploaded Task.dat (the asset is resolved later, when the evidence collection zip is imported into the task). The file must be a valid RC4-encrypted Task.dat; anything else (e.g. a regular case .ppc) is rejected 400 'Missing or invalid Task.dat format!'. Requires the Off-Network Responder feature. Success response (200): result.entities[0] = { taskId, taskName, organizations: [{ id, name }], taskDetailsViewUrl, ppcFileName, importedAt } -- a task summary, no asset id/name. organizations must resolve to EXACTLY ONE organization id (the task is single-org). Optionally attach to a case via caseIdOrName (unknown case -> 400 'Case not found'). ALWAYS send dryRun=true first (generic preview; does not validate the file); pass dryRun=false only to perform the real import after the user confirms. To import a case PPC into an asset that already exists in AIR, use air-assets-import instead.
  */
-const assetBulkActionV2ApiControllerUnisolate = (options) => {
+const assetBulkMetadataV2ApiControllerImportOffNetworkPpc = (options) => {
     return (options.client ?? client_gen_1.client).post({
+        ...client_1.formDataBodySerializer,
         responseType: 'json',
         security: [
             {
@@ -9621,19 +11167,20 @@ const assetBulkActionV2ApiControllerUnisolate = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/unisolate',
+        url: '/api/v2/assets/import',
         ...options,
         headers: {
-            'Content-Type': 'application/json',
+            'Content-Type': null,
             ...options.headers
         }
     });
 };
-exports.assetBulkActionV2ApiControllerUnisolate = assetBulkActionV2ApiControllerUnisolate;
+exports.assetBulkMetadataV2ApiControllerImportOffNetworkPpc = assetBulkMetadataV2ApiControllerImportOffNetworkPpc;
 /**
- * Retrieve the agent logs of multiple assets
+ * Run triage rule(s) on multiple assets
+ * Run triage rule(s) IMMEDIATELY on one or more Binalyze AIR assets via POST /api/v2/triage. Creates ONE triage task (status 'assigned') covering every runnable asset. This tool is for IMMEDIATE runs only -- it deliberately has NO schedule and NO cpuLimit parameter. To create a recurring/scheduled triage (or set a CPU cap), use air-assets-bulk-triage-scheduled instead; do NOT try to pass schedule fields here. ruleIds accept a rule UUID OR an exact rule name (names are resolved within the assets' authorized org scope; an ambiguous or unknown name becomes a per-input error in result.errors[]). NEVER invent or guess a rule id/name -- if the user did not give one, ask or look it up first. OMIT every optional argument the user did not ask for; never fill placeholders (no empty strings). Use assertions.failIfNumberOfAssetsGreaterThan as a safety cap: the task is rejected (406) if more assets match than the cap allows; omitted, it defaults to the resolved asset count. Success response (200): result.entities[0] = { id (task id), name, assets { assetCount, assetsUrl }, assignedAssetCount, organizations [{id,name}], rules [{id,name,engine}], status 'assigned', source, createdBy, createdAt, taskDetailsViewUrl }; result.errors[] lists per-input skips (e.g. 'Asset not found: X'). Zero matching assets -> 404 'No matching assets found'; zero matching rules -> 404 'No matching triage rules found'. ALWAYS send dryRun=true first (generic preview; it does NOT validate rules); pass dryRun=false only to create the real task after the user confirms. A preview is NOT a created task; only dryRun=false with ok=true and a returned task id means it was created -- treat ok=false / non-2xx / the error field as failure. Supports Idempotency-Key so a retried call replays the first response instead of creating duplicate tasks.
  */
-const assetBulkActionV2ApiControllerRetrieveLogs = (options) => {
+const assetBulkTriageV2ApiControllerRunTriage = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9647,7 +11194,7 @@ const assetBulkActionV2ApiControllerRetrieveLogs = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/log-retrieval',
+        url: '/api/v2/triage',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9655,12 +11202,13 @@ const assetBulkActionV2ApiControllerRetrieveLogs = (options) => {
         }
     });
 };
-exports.assetBulkActionV2ApiControllerRetrieveLogs = assetBulkActionV2ApiControllerRetrieveLogs;
+exports.assetBulkTriageV2ApiControllerRunTriage = assetBulkTriageV2ApiControllerRunTriage;
 /**
- * Update the agent version on multiple assets
+ * List InterAct messages for an asset
+ * List the InterAct shell messages of EXACTLY ONE Binalyze AIR asset across all its sessions via GET /api/v2/assets/{idOrName}/interact. Read-only; returns a paginated envelope of messages (command + latest response, status, detectedType, output/outputUrl). Supports filtering by session and creation date range. Use this when the user asks for an asset's shell command history. Prefer UUID; names can be ambiguous across organizations. Omit any filter the user did not ask for. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetBulkActionV2ApiControllerVersionUpdate = (options) => {
-    return (options.client ?? client_gen_1.client).post({
+const assetInteractMessageV2ApiControllerListForAsset = (options) => {
+    return (options.client ?? client_gen_1.client).get({
         responseType: 'json',
         security: [
             {
@@ -9673,19 +11221,16 @@ const assetBulkActionV2ApiControllerVersionUpdate = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/version-update',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
+        url: '/api/v2/assets/{idOrName}/interact',
+        ...options
     });
 };
-exports.assetBulkActionV2ApiControllerVersionUpdate = assetBulkActionV2ApiControllerVersionUpdate;
+exports.assetInteractMessageV2ApiControllerListForAsset = assetInteractMessageV2ApiControllerListForAsset;
 /**
- * Enable maintenance mode on multiple assets
+ * Run an InterAct command on an asset
+ * Run an InterAct shell command on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/interact. WARNING: this endpoint has NO dry-run preview -- a successful call EXECUTES the command on the live endpoint IMMEDIATELY. Confirm the exact asset and command with the user before calling; never run a destructive command without explicit confirmation. Sync mode (default) waits for the result up to the server timeout and returns 200 with the message (output inlined when small, else outputUrl); a timeout or async=true returns 202 with status 'running' and a messageId to poll. COMMAND ROUTING: when the first word matches an AIR native command (ls/dir, cd, ...; list via air-interact-commands), the NATIVE implementation runs -- it has its own option set and does NOT accept POSIX/shell flags (e.g. 'ls -la' fails; the native form is 'ls ext'). For a real shell command, prefix it with exec (e.g. 'exec ls -la /etc'); anything that matches no native command is auto-run as exec. When a native command fails on its flag parser, the response's `hint` field explains this and gives the exec form -- relay it to the user. Use the returned sessionId/messageId with air-assets-interact-message, air-assets-interact-cancel, or air-assets-interact-close. Prefer UUID; names can be ambiguous across organizations. If the asset name looks partial or you are not certain it is the EXACT name (e.g. user says 'mrv'), do not ask the user to clarify blindly -- either call this tool with that name (a non-matching name is safe: it executes nothing and returns HTTP 404 with suggestions) or first resolve it with air-assets-filtered-list using searchTerm=<the name>, then confirm with the user. Likewise, if the COMMAND looks like a typo of an AIR native command (e.g. 'pslt'), do not guess from memory -- call air-interact-commands (optionally searchTerm) and suggest the closest real command name from its `commandNames`; note a non-native command may still be a valid shell command, so only offer 'did you mean' when a close native match exists. Also: when a run COMPLETES with a failed command (non-zero exit) that was an unrecognized native command, the response body (not the error envelope) surfaces `suggestions` as native-command NAME strings (e.g. ['pslist']) -- distinct from the asset-name suggestion objects on a 404 -- tell the user 'the command failed; did you mean <name>?' and offer to re-run the corrected command. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id. Omit optional arguments the user did not ask for.
  */
-const assetBulkActionV2ApiControllerEnableMaintenance = (options) => {
+const assetInteractV2ApiControllerRunCommand = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9699,7 +11244,7 @@ const assetBulkActionV2ApiControllerEnableMaintenance = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/enable-maintenance',
+        url: '/api/v2/assets/{idOrName}/interact',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9707,11 +11252,12 @@ const assetBulkActionV2ApiControllerEnableMaintenance = (options) => {
         }
     });
 };
-exports.assetBulkActionV2ApiControllerEnableMaintenance = assetBulkActionV2ApiControllerEnableMaintenance;
+exports.assetInteractV2ApiControllerRunCommand = assetInteractV2ApiControllerRunCommand;
 /**
- * Disable maintenance mode on multiple assets
+ * Cancel the running InterAct command on an asset
+ * Cancel the running InterAct shell command on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/interact/cancel. WARNING: this endpoint has NO dry-run preview -- it sends a real interrupt to the running command; the session stays open. With no body it cancels the caller's active session's running command. Pass messageId to target a specific running message, or sessionId to target a specific session. Cancellation is best-effort (the agent confirms asynchronously); the returned message may still read as running. 404 'No active session' / 'Message not found' when nothing matches; 400 'No running command to cancel' / 'Message is not running' when there is nothing to interrupt. Prefer UUID for the asset. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetBulkActionV2ApiControllerDisableMaintenance = (options) => {
+const assetInteractV2ApiControllerCancelCommand = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9725,7 +11271,7 @@ const assetBulkActionV2ApiControllerDisableMaintenance = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/disable-maintenance',
+        url: '/api/v2/assets/{idOrName}/interact/cancel',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9733,11 +11279,12 @@ const assetBulkActionV2ApiControllerDisableMaintenance = (options) => {
         }
     });
 };
-exports.assetBulkActionV2ApiControllerDisableMaintenance = assetBulkActionV2ApiControllerDisableMaintenance;
+exports.assetInteractV2ApiControllerCancelCommand = assetInteractV2ApiControllerCancelCommand;
 /**
- * Add tag(s) to multiple assets
+ * Close the InterAct session on an asset
+ * Close the InterAct shell session on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/interact/close. WARNING: this endpoint has NO dry-run preview -- it really closes the session. With no body it closes the caller's active session; pass sessionId to target a specific session. If the session has running commands and force is omitted/false, the API returns 400 with errors[0].details.runningMessageIds; set force=true to cancel those commands first and then close. Success returns { sessionId, closedAt, cancelledMessageIds[] }. 404 'No active session' when nothing matches. Prefer UUID for the asset. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetBulkMetadataV2ApiControllerAddTags = (options) => {
+const assetInteractV2ApiControllerCloseSession = (options) => {
     return (options.client ?? client_gen_1.client).post({
         responseType: 'json',
         security: [
@@ -9751,7 +11298,7 @@ const assetBulkMetadataV2ApiControllerAddTags = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/tags',
+        url: '/api/v2/assets/{idOrName}/interact/close',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9759,12 +11306,13 @@ const assetBulkMetadataV2ApiControllerAddTags = (options) => {
         }
     });
 };
-exports.assetBulkMetadataV2ApiControllerAddTags = assetBulkMetadataV2ApiControllerAddTags;
+exports.assetInteractV2ApiControllerCloseSession = assetInteractV2ApiControllerCloseSession;
 /**
- * Remove tag(s) from multiple assets
+ * Get asset issue/actionability stats
+ * Get aggregate Binalyze AIR asset statistics from GET /api/v2/assets/stats. Use this for fleet summaries, counts, and breakdowns, not for listing individual assets. Only include filters when the user explicitly asks for scoped stats.
  */
-const assetBulkMetadataV2ApiControllerRemoveTags = (options) => {
-    return (options.client ?? client_gen_1.client).post({
+const assetV2ApiControllerGetStats = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
         responseType: 'json',
         security: [
             {
@@ -9777,21 +11325,18 @@ const assetBulkMetadataV2ApiControllerRemoveTags = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/tags/delete',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
+        url: '/api/v2/assets/stats',
+        ...options
     });
 };
-exports.assetBulkMetadataV2ApiControllerRemoveTags = assetBulkMetadataV2ApiControllerRemoveTags;
+exports.assetV2ApiControllerGetStats = assetV2ApiControllerGetStats;
 /**
- * Set the update-exclusion flag on multiple assets
+ * Export assets as CSV
+ * Export Binalyze AIR assets as a CSV file via GET /api/v2/assets/export and save it inside the current worktree. Read-only on the server side; no dryRun needed. The filter model mirrors air-assets-filtered-list (searchTerm, subtype, status, platform, isolation), but tag filtering (tagIds) is NOT applied on export. organizations defaults to all accessible organizations when omitted. Returns {outputPath, byteLength}; default output is artifacts/assets.csv. Use air-assets-list or air-assets-filtered-list instead when the user just wants to read assets in the chat.
  */
-const assetBulkMetadataV2ApiControllerSetUpdateExclusion = (options) => {
-    return (options.client ?? client_gen_1.client).patch({
-        responseType: 'json',
+const assetV2ApiControllerExportAssets = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
+        responseType: 'text',
         security: [
             {
                 in: 'cookie',
@@ -9803,20 +11348,17 @@ const assetBulkMetadataV2ApiControllerSetUpdateExclusion = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/update-exclusion',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
+        url: '/api/v2/assets/export',
+        ...options
     });
 };
-exports.assetBulkMetadataV2ApiControllerSetUpdateExclusion = assetBulkMetadataV2ApiControllerSetUpdateExclusion;
+exports.assetV2ApiControllerExportAssets = assetV2ApiControllerExportAssets;
 /**
- * Set or clear the relay connection route on multiple assets
+ * List assets
+ * List Binalyze AIR assets with explicit filters, organization scope, pagination, sorting, or output format. Use this only when the user asks for a constrained asset list, such as offline Windows endpoints, page 2, assets with no agent, or markdown output. For subtype-only prompts like 'filter by disk image', prefer air-assets-by-subtype. If a small model sends searchTerm=diskImage here, this tool normalizes it to subtype=['diskImage']. Placeholder defaults such as organizations=all, pageNumber=1, pageSize=20, sortType without sortBy, and false booleans are ignored.
  */
-const assetBulkMetadataV2ApiControllerSetConnectionRoute = (options) => {
-    return (options.client ?? client_gen_1.client).patch({
+const assetV2ApiControllerFilterAssets = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
         responseType: 'json',
         security: [
             {
@@ -9829,20 +11371,17 @@ const assetBulkMetadataV2ApiControllerSetConnectionRoute = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/connection-route',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
+        url: '/api/v2/assets',
+        ...options
     });
 };
-exports.assetBulkMetadataV2ApiControllerSetConnectionRoute = assetBulkMetadataV2ApiControllerSetConnectionRoute;
+exports.assetV2ApiControllerFilterAssets = assetV2ApiControllerFilterAssets;
 /**
- * Set the demanded MITRE ATT&CK Database version on multiple assets
+ * Delete an asset by id or name
+ * Delete or uninstall EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, using DELETE /api/v2/assets/{idOrName}. This is destructive. ALWAYS send dryRun=true on every call (would-delete preview); pass dryRun=false only for the final real delete after the user confirms the exact asset id and mode. Use mode='purge' for console record deletion only, 'uninstall' for agent uninstall signal, and 'purge-and-uninstall' for both. Prefer UUID; names can be ambiguous. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = (options) => {
-    return (options.client ?? client_gen_1.client).patch({
+const assetV2ApiControllerDeleteAsset = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
         responseType: 'json',
         security: [
             {
@@ -9855,20 +11394,17 @@ const assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/mitre-attack-database/version',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
+        url: '/api/v2/assets/{idOrName}',
+        ...options
     });
 };
-exports.assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion;
+exports.assetV2ApiControllerDeleteAsset = assetV2ApiControllerDeleteAsset;
 /**
- * Bulk delete assets (purge / uninstall / purge-and-uninstall)
+ * Get asset by id or name
+ * Fetch one Binalyze AIR asset by UUID or name using GET /api/v2/assets/{idOrName}. Use this when the user wants details for a specific host/asset. Prefer UUID because names can be duplicated. If the API returns AMBIGUOUS_NAME, show the candidates and retry only with the selected id. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetBulkMetadataV2ApiControllerDeleteAssets = (options) => {
-    return (options.client ?? client_gen_1.client).post({
+const assetV2ApiControllerGetAsset = (options) => {
+    return (options.client ?? client_gen_1.client).get({
         responseType: 'json',
         security: [
             {
@@ -9881,21 +11417,17 @@ const assetBulkMetadataV2ApiControllerDeleteAssets = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/delete',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
+        url: '/api/v2/assets/{idOrName}',
+        ...options
     });
 };
-exports.assetBulkMetadataV2ApiControllerDeleteAssets = assetBulkMetadataV2ApiControllerDeleteAssets;
+exports.assetV2ApiControllerGetAsset = assetV2ApiControllerGetAsset;
 /**
- * Import an off-network PPC (find-or-create asset + offline task)
+ * Replace asset tags
+ * Replace the complete tag set of one Binalyze AIR asset using PATCH /api/v2/assets/{idOrName}/tags. Use this only when the user asks to set, replace, update, or clear tags. This is a full replacement, not an append operation. ALWAYS send dryRun=true on every call (would-change preview); pass dryRun=false only to apply the real tag change after the user confirms the exact asset. Prefer UUID because asset names can be ambiguous; retry by id if AMBIGUOUS_NAME is returned. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetBulkMetadataV2ApiControllerImportOffNetworkPpc = (options) => {
-    return (options.client ?? client_gen_1.client).post({
-        ...client_1.formDataBodySerializer,
+const assetV2ApiControllerReplaceTags = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
         responseType: 'json',
         security: [
             {
@@ -9908,20 +11440,21 @@ const assetBulkMetadataV2ApiControllerImportOffNetworkPpc = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/import',
+        url: '/api/v2/assets/{idOrName}/tags',
         ...options,
         headers: {
-            'Content-Type': null,
+            'Content-Type': 'application/json',
             ...options.headers
         }
     });
 };
-exports.assetBulkMetadataV2ApiControllerImportOffNetworkPpc = assetBulkMetadataV2ApiControllerImportOffNetworkPpc;
+exports.assetV2ApiControllerReplaceTags = assetV2ApiControllerReplaceTags;
 /**
- * Run triage rule(s) on multiple assets
+ * Update asset label
+ * Set or clear the label of one Binalyze AIR asset using PATCH /api/v2/assets/{idOrName}/label. Use this only for asset label changes, not tags. Pass a string to set the label or null to clear it. ALWAYS send dryRun=true on every call (would-change preview); pass dryRun=false only to apply the real label change after the user confirms the exact asset. Prefer UUID because asset names can be ambiguous; retry by id if AMBIGUOUS_NAME is returned. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
-const assetBulkTriageV2ApiControllerRunTriage = (options) => {
-    return (options.client ?? client_gen_1.client).post({
+const assetV2ApiControllerUpdateLabel = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
         responseType: 'json',
         security: [
             {
@@ -9934,7 +11467,7 @@ const assetBulkTriageV2ApiControllerRunTriage = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/triage',
+        url: '/api/v2/assets/{idOrName}/label',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9942,10 +11475,10 @@ const assetBulkTriageV2ApiControllerRunTriage = (options) => {
         }
     });
 };
-exports.assetBulkTriageV2ApiControllerRunTriage = assetBulkTriageV2ApiControllerRunTriage;
+exports.assetV2ApiControllerUpdateLabel = assetV2ApiControllerUpdateLabel;
 /**
- * List the triage task history of a single asset
- * List the triage task history of a single asset
+ * List the hunt task history of a single asset
+ * List the hunt (triage) task history of EXACTLY ONE Binalyze AIR asset via GET /api/v2/assets/{idOrName}/hunt (formerly /triage). Read-only; returns a paginated envelope of the triage tasks previously run on that asset. Use this when the user asks for an asset's past/ongoing triage tasks. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetTriageV2ApiControllerFilterTriageTasks = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -9961,13 +11494,14 @@ const assetTriageV2ApiControllerFilterTriageTasks = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/triage',
+        url: '/api/v2/assets/{idOrName}/hunt',
         ...options
     });
 };
 exports.assetTriageV2ApiControllerFilterTriageTasks = assetTriageV2ApiControllerFilterTriageTasks;
 /**
  * Run triage rule(s) on a single asset
+ * Run hunt (triage) rule(s) on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/hunt (formerly /triage). Use this ONLY for one specific asset; for two or more assets, a list, a group, or 'all matching', use air-assets-bulk-triage instead. WARNING: this endpoint has NO dry-run preview -- a successful call creates a REAL triage task IMMEDIATELY (or a scheduled one when `schedule` is set). Confirm the exact asset and rules with the user before calling. ruleIds accept a rule UUID OR an exact rule name (names are resolved within the asset's authorized org scope; unknown/ambiguous names become per-input errors). NEVER invent or guess a rule id/name. Omit every optional argument the user did not ask for; never fill placeholders. Only a 2xx response with a returned task id means the task was created -- treat ok=false / non-2xx / the error field as failure. Supports Idempotency-Key so a retried call replays the first response instead of creating duplicate tasks. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetTriageV2ApiControllerRunTriage = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -9983,7 +11517,7 @@ const assetTriageV2ApiControllerRunTriage = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/triage',
+        url: '/api/v2/assets/{idOrName}/hunt',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -9994,6 +11528,7 @@ const assetTriageV2ApiControllerRunTriage = (options) => {
 exports.assetTriageV2ApiControllerRunTriage = assetTriageV2ApiControllerRunTriage;
 /**
  * Cancel triage tasks on a single asset
+ * Cancel triage (hunt) tasks on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/triage/cancel. Use this ONLY for one specific asset's triage tasks. For cancelling a whole hunt task across all its assets, use air-hunt-cancel instead. `tasks` is ALWAYS required: an array of parent task UUIDs, or the literal string 'all' to cancel every cancellable triage task of this asset. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real cancellation after the user confirms the exact asset and tasks. Prefer UUID for the asset; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetTriageV2ApiControllerCancelTriage = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -10009,7 +11544,7 @@ const assetTriageV2ApiControllerCancelTriage = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/triage/cancel',
+        url: '/api/v2/assets/{idOrName}/hunt/cancel',
         ...options,
         headers: {
             'Content-Type': 'application/json',
@@ -10020,6 +11555,7 @@ const assetTriageV2ApiControllerCancelTriage = (options) => {
 exports.assetTriageV2ApiControllerCancelTriage = assetTriageV2ApiControllerCancelTriage;
 /**
  * Delete one asset's triage task assignment
+ * Delete ONE asset's triage (hunt) task assignment via DELETE /api/v2/assets/{idOrName}/triage/{taskId}. DESTRUCTIVE and irreversible once executed: removes this asset's assignment of the given parent triage task, including its collected results for this asset. Other assets' assignments of the same task are NOT touched; to delete the whole task everywhere, use air-hunt-delete instead. ALWAYS send dryRun=true on every call (would-delete preview); pass dryRun=false only after the user confirms the exact asset and task. taskId must be the parent task UUID (see air-assets-triage-history). Prefer UUID for the asset; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetTriageV2ApiControllerDeleteTriageAssignment = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -10035,13 +11571,14 @@ const assetTriageV2ApiControllerDeleteTriageAssignment = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/assets/{idOrName}/triage/{taskId}',
+        url: '/api/v2/assets/{idOrName}/hunt/{taskId}',
         ...options
     });
 };
 exports.assetTriageV2ApiControllerDeleteTriageAssignment = assetTriageV2ApiControllerDeleteTriageAssignment;
 /**
  * Start an evidence or image acquisition on a single asset
+ * Start an evidence or disk-image acquisition on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/acquire. WARNING: this endpoint has NO dry-run preview -- a successful call starts a REAL acquisition task IMMEDIATELY (or a scheduled one when `schedule` is set). Confirm the exact asset, type, and profile/image options with the user before calling. type='evidence' (default) REQUIRES profileIdOrName and accepts NO image-specific field. type='image' REQUIRES imageType + at least one volume, accepts NO profileIdOrName, and description/examinerName are EWF2-only. The server rejects cross-type field combinations with 400. profileIdOrName / caseIdOrName accept a UUID or an exact name resolved within the asset's org scope. NEVER invent or guess a profile/case id. Omit every optional argument the user did not ask for; never fill placeholders. Only a 2xx response with a returned task id means the task was started -- treat ok=false / non-2xx / the error field as failure. Supports Idempotency-Key so a retried call replays the first response instead of starting duplicate tasks. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetAcquisitionV2ApiControllerAcquire = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -10068,6 +11605,7 @@ const assetAcquisitionV2ApiControllerAcquire = (options) => {
 exports.assetAcquisitionV2ApiControllerAcquire = assetAcquisitionV2ApiControllerAcquire;
 /**
  * Cancel acquisition tasks on a single asset
+ * Cancel evidence/image acquisition tasks on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/acquisition/cancel. Use this ONLY for one specific asset's acquisition tasks (started with air-assets-acquire). `tasks` is ALWAYS required: an array of parent task UUIDs, or the literal string 'all' to cancel every cancellable acquisition task of this asset. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real cancellation after the user confirms the exact asset and tasks. Prefer UUID for the asset; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetAcquisitionV2ApiControllerCancelAcquisition = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -10094,6 +11632,7 @@ const assetAcquisitionV2ApiControllerCancelAcquisition = (options) => {
 exports.assetAcquisitionV2ApiControllerCancelAcquisition = assetAcquisitionV2ApiControllerCancelAcquisition;
 /**
  * Delete one asset's acquisition task assignment
+ * Delete ONE asset's acquisition task assignment via DELETE /api/v2/assets/{idOrName}/acquisition/{taskId}. DESTRUCTIVE and irreversible once executed: removes this asset's assignment of the given parent acquisition task, including its collected evidence for this asset. Other assets' assignments of the same task are NOT touched. ALWAYS send dryRun=true on every call (would-delete preview); pass dryRun=false only after the user confirms the exact asset and task. taskId must be the parent task UUID (see air-assets-acquisition-history). Prefer UUID for the asset; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -10116,7 +11655,7 @@ const assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = (options) =>
 exports.assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment;
 /**
  * List the acquisition task history of a single asset
- * List the acquisition task history of a single asset
+ * List the acquisition (evidence/image) task history of EXACTLY ONE Binalyze AIR asset via GET /api/v2/assets/{idOrName}/acquisition. Read-only; returns a paginated envelope of the acquisition tasks previously started on that asset. Use this when the user asks for an asset's past/ongoing acquisition tasks. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetAcquisitionV2ApiControllerFilterAcquisitionTasks = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -10137,113 +11676,9 @@ const assetAcquisitionV2ApiControllerFilterAcquisitionTasks = (options) => {
     });
 };
 exports.assetAcquisitionV2ApiControllerFilterAcquisitionTasks = assetAcquisitionV2ApiControllerFilterAcquisitionTasks;
-/**
- * List InterAct messages for an asset
- * Paginated InterAct command messages for the asset across all of its sessions.
- */
-const assetInteractMessageV2ApiControllerListForAsset = (options) => {
-    return (options.client ?? client_gen_1.client).get({
-        responseType: 'json',
-        security: [
-            {
-                in: 'cookie',
-                name: 'Authentication',
-                type: 'apiKey'
-            },
-            {
-                scheme: 'bearer',
-                type: 'http'
-            }
-        ],
-        url: '/api/v2/assets/{idOrName}/interact',
-        ...options
-    });
-};
-exports.assetInteractMessageV2ApiControllerListForAsset = assetInteractMessageV2ApiControllerListForAsset;
-/**
- * Run an InterAct command on an asset
- * Runs a command; sync returns the message (200), async/timeout returns 202.
- */
-const assetInteractV2ApiControllerRunCommand = (options) => {
-    return (options.client ?? client_gen_1.client).post({
-        responseType: 'json',
-        security: [
-            {
-                in: 'cookie',
-                name: 'Authentication',
-                type: 'apiKey'
-            },
-            {
-                scheme: 'bearer',
-                type: 'http'
-            }
-        ],
-        url: '/api/v2/assets/{idOrName}/interact',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
-    });
-};
-exports.assetInteractV2ApiControllerRunCommand = assetInteractV2ApiControllerRunCommand;
-/**
- * Cancel the running InterAct command on an asset
- * Cancels the target/active running command; the session stays open.
- */
-const assetInteractV2ApiControllerCancelCommand = (options) => {
-    return (options.client ?? client_gen_1.client).post({
-        responseType: 'json',
-        security: [
-            {
-                in: 'cookie',
-                name: 'Authentication',
-                type: 'apiKey'
-            },
-            {
-                scheme: 'bearer',
-                type: 'http'
-            }
-        ],
-        url: '/api/v2/assets/{idOrName}/interact/cancel',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
-    });
-};
-exports.assetInteractV2ApiControllerCancelCommand = assetInteractV2ApiControllerCancelCommand;
-/**
- * Close the InterAct session on an asset
- * Closes the active/target session; force=true cancels running commands first.
- */
-const assetInteractV2ApiControllerCloseSession = (options) => {
-    return (options.client ?? client_gen_1.client).post({
-        responseType: 'json',
-        security: [
-            {
-                in: 'cookie',
-                name: 'Authentication',
-                type: 'apiKey'
-            },
-            {
-                scheme: 'bearer',
-                type: 'http'
-            }
-        ],
-        url: '/api/v2/assets/{idOrName}/interact/close',
-        ...options,
-        headers: {
-            'Content-Type': 'application/json',
-            ...options.headers
-        }
-    });
-};
-exports.assetInteractV2ApiControllerCloseSession = assetInteractV2ApiControllerCloseSession;
 /**
  * List InterAct sessions for an asset
- * Paginated InterAct sessions for the asset with derived activity state.
+ * List the InterAct shell sessions of EXACTLY ONE Binalyze AIR asset via GET /api/v2/assets/{idOrName}/interact/sessions. Read-only; returns a paginated envelope of sessions (activityState active/idle, createdBy, task, case, messageCount, timestamps). Supports filtering by session, creator, and creation date; sortable by createdAt. Use this when the user asks for an asset's shell sessions. Prefer UUID; names can be ambiguous across organizations. Omit any filter the user did not ask for. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetInteractMessageV2ApiControllerListSessionsForAsset = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -10266,7 +11701,7 @@ const assetInteractMessageV2ApiControllerListSessionsForAsset = (options) => {
 exports.assetInteractMessageV2ApiControllerListSessionsForAsset = assetInteractMessageV2ApiControllerListSessionsForAsset;
 /**
  * Get an InterAct message scoped to an asset
- * Single InterAct message wrapped in entities[0]; cross-asset mismatch returns 404.
+ * Fetch ONE InterAct shell message of a Binalyze AIR asset by message UUID via GET /api/v2/assets/{idOrName}/interact/{messageId}. Read-only; returns the unified message entity (command, status, output/outputUrl, exitCode, timestamps). Use this to poll a 'running' message returned by air-assets-interact-run, or to inspect one specific message. The message must belong to the asset, otherwise the API returns 404. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetInteractMessageV2ApiControllerGetMessage = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -10289,7 +11724,7 @@ const assetInteractMessageV2ApiControllerGetMessage = (options) => {
 exports.assetInteractMessageV2ApiControllerGetMessage = assetInteractMessageV2ApiControllerGetMessage;
 /**
  * Download an InterAct message output
- * Streams the message output as an attachment; bypasses the JSON envelope.
+ * Download the output of ONE InterAct shell message of a Binalyze AIR asset via GET /api/v2/assets/{idOrName}/interact/{messageId}/download. Read-only; the endpoint streams the message output as an attachment (it bypasses the JSON envelope). This tool saves the bytes to a file inside the current worktree (outputPath, default artifacts/interact-message-output.bin) and returns { outputPath, byteLength }; read the saved file for the content. Use this for a message whose output is too large to inline (outputUrl is set). The message must be terminal -- a still-running message returns 400. On HTTP 404 the asset name or message id was not found; verify the asset with air-assets-get and the message with air-assets-interact-messages before retrying.
  */
 const assetInteractMessageV2ApiControllerDownloadMessageOutput = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -10312,7 +11747,7 @@ const assetInteractMessageV2ApiControllerDownloadMessageOutput = (options) => {
 exports.assetInteractMessageV2ApiControllerDownloadMessageOutput = assetInteractMessageV2ApiControllerDownloadMessageOutput;
 /**
  * Get an InterAct session report scoped to an asset
- * Self-contained session report; JSON by default, HTML when format=html.
+ * Get the InterAct shell session report of a Binalyze AIR asset via GET /api/v2/assets/{idOrName}/interact/sessions/{sessionId}/report. Read-only; returns a self-contained session report. format='json' (default) returns the structured report envelope (session, asset, messages, messageCount, lastActivityAt); format='html' returns the rendered HTML report (this tool returns a preview of the HTML plus its byte length). Use a sessionId from air-assets-interact-sessions. The session must belong to the asset, otherwise the API returns 404. Prefer UUID for the asset. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetInteractMessageV2ApiControllerGetSessionReport = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -10830,6 +12265,7 @@ const automationHubFilterAutomations = (options) => {
 exports.automationHubFilterAutomations = automationHubFilterAutomations;
 const automationHubCreateAutomation = (options) => {
     return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
         security: [
             {
                 scheme: 'bearer',
@@ -10979,6 +12415,20 @@ const automationHubGetAutomationChangeHistory = (options) => {
     });
 };
 exports.automationHubGetAutomationChangeHistory = automationHubGetAutomationChangeHistory;
+const automationHubGenerateTriggerSecret = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/public/automation-hub/{id}/trigger/secret',
+        ...options
+    });
+};
+exports.automationHubGenerateTriggerSecret = automationHubGenerateTriggerSecret;
 const automationHubEnableAutomation = (options) => {
     return (options.client ?? client_gen_1.client).patch({
         security: [
@@ -11256,6 +12706,7 @@ const cloudAcquisitionProfilesUpdate = (options) => {
 exports.cloudAcquisitionProfilesUpdate = cloudAcquisitionProfilesUpdate;
 /**
  * List cloud acquisition profiles
+ * List Binalyze AIR cloud (M365) acquisition profiles via GET /api/v2/libraries/acquisition/cloud. Read-only and paginated. Each entity is a profile summary: id, name, organizations[{id,name}], averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. The m365UserBased/m365TenantWide evidence lists are NOT included; use air-acquisition-cloud-get for one profile's full config. Use this when the user asks to list or search cloud acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with an empty organizations array are global.
  */
 const cloudAcquisitionLibraryApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -11278,6 +12729,7 @@ const cloudAcquisitionLibraryApiControllerList = (options) => {
 exports.cloudAcquisitionLibraryApiControllerList = cloudAcquisitionLibraryApiControllerList;
 /**
  * Create cloud acquisition profile
+ * Create a Binalyze AIR cloud (M365) acquisition profile via POST /api/v2/libraries/acquisition/cloud. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. `name` (alphanumeric) plus BOTH m365UserBased and m365TenantWide blocks are required; each block is {evidenceList: string[]} and at least one evidence must be selected across the two blocks. Body `organizationIds` controls which organizations own the profile; common query `organizations`, `orgs`, and `org` parameters are rejected. Evidence keys are lowercase M365 collector names, e.g. user-based: outlookmails, onedrive, teams, teamschat, calendar, mfa, user; tenant-wide: ual, adminauditlog, azureadaccountlogon, sharepoint, exchangeadmin, riskyusers. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-cloud-get for the full list of valid evidence keys.
  */
 const cloudAcquisitionLibraryApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -11304,6 +12756,7 @@ const cloudAcquisitionLibraryApiControllerCreate = (options) => {
 exports.cloudAcquisitionLibraryApiControllerCreate = cloudAcquisitionLibraryApiControllerCreate;
 /**
  * Bulk delete cloud acquisition profiles
+ * Bulk delete Binalyze AIR cloud (M365) acquisition profiles via POST /api/v2/libraries/acquisition/cloud/delete. MUTATING and irreversible. Resolution is tolerant: unknown or ambiguous items are skipped and reported in warnings[] (action: 'skipped') instead of failing the whole request. System profiles are also skipped with a warning. dryRun DEFAULTS TO TRUE: the first call returns entities[] of what would be deleted; pass dryRun=false only to actually delete after the user confirms. A real delete returns deletedCount plus warnings[]. Use this for several profiles at once; use air-acquisition-cloud-delete for exactly one. Ids and exact names come from air-acquisition-cloud-list.
  */
 const cloudAcquisitionLibraryApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -11330,6 +12783,7 @@ const cloudAcquisitionLibraryApiControllerBulkDelete = (options) => {
 exports.cloudAcquisitionLibraryApiControllerBulkDelete = cloudAcquisitionLibraryApiControllerBulkDelete;
 /**
  * Delete cloud acquisition profile
+ * Delete ONE Binalyze AIR cloud (M365) acquisition profile via DELETE /api/v2/libraries/acquisition/cloud/{idOrName}. MUTATING and irreversible. System (predefined) profiles cannot be deleted: the API returns 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call returns what would be deleted without removing anything; pass dryRun=false only to actually delete after the user confirms. Use air-acquisition-cloud-bulk-delete for several profiles at once. The idOrName comes from air-acquisition-cloud-list or air-acquisition-cloud-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
  */
 const cloudAcquisitionLibraryApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -11352,6 +12806,7 @@ const cloudAcquisitionLibraryApiControllerDelete = (options) => {
 exports.cloudAcquisitionLibraryApiControllerDelete = cloudAcquisitionLibraryApiControllerDelete;
 /**
  * Get cloud acquisition profile by id or name
+ * Get ONE Binalyze AIR cloud (M365) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/cloud/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizations[{id,name}], m365UserBased.evidenceList, m365TenantWide.evidenceList, deletable, and timestamps. Use this when the user asks to show or inspect a cloud acquisition profile's evidence selection, to clone one, or to discover valid M365 evidence keys. Ids and exact names come from air-acquisition-cloud-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
  */
 const cloudAcquisitionLibraryApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -11374,6 +12829,7 @@ const cloudAcquisitionLibraryApiControllerGet = (options) => {
 exports.cloudAcquisitionLibraryApiControllerGet = cloudAcquisitionLibraryApiControllerGet;
 /**
  * Update cloud acquisition profile
+ * Update ONE Binalyze AIR cloud (M365) acquisition profile via PATCH /api/v2/libraries/acquisition/cloud/{idOrName}. MUTATING partial update: only the fields you pass change; omitted fields keep their current value. Updatable fields: name, organizationIds, m365UserBased, m365TenantWide. A passed evidence block REPLACES that whole block. The merged profile must keep at least one M365 evidence selected across the two blocks (a name-only patch is fine). Sending no updatable field returns NOTHING_CHANGED with result null. System (predefined) profiles cannot be updated: the API returns 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call previews the merged profile without persisting; pass dryRun=false only to actually update after the user confirms. The idOrName comes from air-acquisition-cloud-list or air-acquisition-cloud-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
  */
 const cloudAcquisitionLibraryApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -11518,6 +12974,7 @@ const imageEvidenceAcquisitionProfilesDeleteBulk = (options) => {
 exports.imageEvidenceAcquisitionProfilesDeleteBulk = imageEvidenceAcquisitionProfilesDeleteBulk;
 /**
  * List disk image acquisition profiles
+ * List Binalyze AIR disk-image acquisition profiles via GET /api/v2/libraries/acquisition/disk-image. Read-only and paginated. Requires the image-evidence-acquisition feature to be enabled on the Console. Each entity is a profile summary: id, name, organizations[{id,name}], averageTime, createdAt/updatedAt, createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. allFiles/paths/evidence config is NOT included; use air-acquisition-disk-image-get for one profile's full config. Use this when the user asks to list or search disk-image (forensic imaging) profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdAt, updatedAt, lastUsedAt, createdBy, lastUsedBy (default createdAt). Profiles with an empty organizations array are global.
  */
 const diskImageAcquisitionLibraryApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -11540,6 +12997,7 @@ const diskImageAcquisitionLibraryApiControllerList = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerList = diskImageAcquisitionLibraryApiControllerList;
 /**
  * Create disk image acquisition profile
+ * Create a Binalyze AIR disk-image acquisition profile via POST /api/v2/libraries/acquisition/disk-image. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. Requires the image-evidence-acquisition feature to be enabled on the Console. `name` is required (alphanumeric). Scope is either allFiles=true (full image) OR a `paths` list of directories/files to image; the allFiles/paths combination must be consistent (a profile cannot have both allFiles=true and paths). `imageAcquisitionEvidences` optionally selects extra evidence to collect alongside the image. Body `organizationIds` controls which organizations own the profile; common query `organizations`, `orgs`, and `org` parameters are rejected. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-disk-image-get when cloning or when unsure of valid evidence keys.
  */
 const diskImageAcquisitionLibraryApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -11566,6 +13024,7 @@ const diskImageAcquisitionLibraryApiControllerCreate = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerCreate = diskImageAcquisitionLibraryApiControllerCreate;
 /**
  * Bulk delete disk image acquisition profiles
+ * Bulk delete Binalyze AIR disk-image acquisition profiles via POST /api/v2/libraries/acquisition/disk-image/delete. MUTATING and irreversible. Requires the image-evidence-acquisition feature to be enabled on the Console. Resolution is tolerant: unknown or ambiguous items are skipped and reported in warnings[] (action: 'skipped') instead of failing the whole request. System profiles are also skipped with a warning. dryRun DEFAULTS TO TRUE: the first call returns entities[] of what would be deleted; pass dryRun=false only to actually delete after the user confirms. A real delete returns deletedCount plus warnings[]. Use this for several profiles at once; use air-acquisition-disk-image-delete for exactly one. Ids and exact names come from air-acquisition-disk-image-list.
  */
 const diskImageAcquisitionLibraryApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -11592,6 +13051,7 @@ const diskImageAcquisitionLibraryApiControllerBulkDelete = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerBulkDelete = diskImageAcquisitionLibraryApiControllerBulkDelete;
 /**
  * Delete disk image acquisition profile
+ * Delete ONE Binalyze AIR disk-image acquisition profile via DELETE /api/v2/libraries/acquisition/disk-image/{idOrName}. MUTATING and irreversible. Requires the image-evidence-acquisition feature to be enabled on the Console. System (predefined) profiles cannot be deleted: the API returns 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call returns what would be deleted without removing anything; pass dryRun=false only to actually delete after the user confirms. Use air-acquisition-disk-image-bulk-delete for several profiles at once. The idOrName comes from air-acquisition-disk-image-list or air-acquisition-disk-image-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
  */
 const diskImageAcquisitionLibraryApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -11614,6 +13074,7 @@ const diskImageAcquisitionLibraryApiControllerDelete = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerDelete = diskImageAcquisitionLibraryApiControllerDelete;
 /**
  * Get disk image acquisition profile by id or name
+ * Get ONE Binalyze AIR disk-image acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/disk-image/{idOrName}. Read-only. Requires the image-evidence-acquisition feature to be enabled on the Console. Returns the full profile detail in entities[0]: id, name, organizations[{id,name}], allFiles, paths[] ({path, description}), imageAcquisitionEvidences, deletable, and timestamps. Use this when the user asks to show or inspect a disk-image profile's scope, or to clone one. Ids and exact names come from air-acquisition-disk-image-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
  */
 const diskImageAcquisitionLibraryApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -11636,6 +13097,7 @@ const diskImageAcquisitionLibraryApiControllerGet = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerGet = diskImageAcquisitionLibraryApiControllerGet;
 /**
  * Update disk image acquisition profile
+ * Update ONE Binalyze AIR disk-image acquisition profile via PATCH /api/v2/libraries/acquisition/disk-image/{idOrName}. MUTATING partial update: only the fields you pass change; omitted fields keep their current value. Requires the image-evidence-acquisition feature. Updatable fields: name, organizationIds, allFiles, paths, imageAcquisitionEvidences. The merged profile must stay consistent: allFiles=true cannot coexist with a non-empty paths list. Sending no updatable field returns NOTHING_CHANGED with result null. System (predefined) profiles cannot be updated: the API returns 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call previews the merged profile without persisting; pass dryRun=false only to actually update after the user confirms. The idOrName comes from air-acquisition-disk-image-list or air-acquisition-disk-image-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
  */
 const diskImageAcquisitionLibraryApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({