@binalyze/air-sdk 5.23.0 → 5.24.3

package/dist/sdk/typescript-axios-v2/sdk.gen.d.ts

@@ -25,7 +25,7 @@ export declare const capabilitiesV2ApiControllerGet: <ThrowOnError extends boole
 export declare const openApiAliasV2ApiControllerGet: <ThrowOnError extends boolean = false>(options?: Options<OpenApiAliasV2ApiControllerGetData, ThrowOnError>) => import("./client").RequestResult<OpenApiAliasV2ApiControllerGetResponses, OpenApiAliasV2ApiControllerGetErrors, ThrowOnError>;
 /**
  * Get task by id
- * Fetch one Binalyze AIR task by UUID using GET /api/v2/tasks/{taskId}. Type-independent: works for triage, acquisition, interactShell and other task types. The response wraps the single task in result.entities[0] and is polymorphic: it carries a type/subtype discriminator plus only the matching domain block (triage{} / acquisition{} / interactShell{}); other blocks are absent, not null. It also returns counts{assigned,completed,failed,cancelled}, organization{id,name}, cases[], schedule (null when not scheduled) and taskAssignments{taskAssignmentCount,taskAssignmentsUrl}. Use air-tasks-assignments for the full per-endpoint assignment list and air-tasks-assets for the targeted assets. Only a task UUID is accepted; names and hostnames are rejected. A 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe), so do not infer the task does not exist.
+ * Fetch one Binalyze AIR task by UUID using GET /api/v2/tasks/{taskId}. Type-independent: works for triage, acquisition, interactShell and other task types. The response wraps the single task in result.entities[0] and is polymorphic: it carries a type/subtype discriminator plus only the matching domain block (triage{} / acquisition{} / interactShell{}); other blocks are absent, not null. It also returns counts{assigned,completed,failed,cancelled}, organizations[{id,name}], cases[], schedule (null when not scheduled) and taskAssignments{taskAssignmentCount,taskAssignmentsUrl}. Use air-tasks-assignments for the full per-endpoint assignment list and air-tasks-assets for the targeted assets. Only a task UUID is accepted; names and hostnames are rejected. A 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe), so do not infer the task does not exist.
  */
 export declare const tasksV2ApiControllerGetTaskById: <ThrowOnError extends boolean = false>(options: Options<TasksV2ApiControllerGetTaskByIdData, ThrowOnError>) => import("./client").RequestResult<TasksV2ApiControllerGetTaskByIdResponses, TasksV2ApiControllerGetTaskByIdErrors, ThrowOnError>;
 /**
@@ -40,7 +40,7 @@ export declare const tasksV2ApiControllerUpdateTask: <ThrowOnError extends boole
 export declare const tasksV2ApiControllerListTaskAssets: <ThrowOnError extends boolean = false>(options: Options<TasksV2ApiControllerListTaskAssetsData, ThrowOnError>) => import("./client").RequestResult<TasksV2ApiControllerListTaskAssetsResponses, TasksV2ApiControllerListTaskAssetsErrors, ThrowOnError>;
 /**
  * List a task assignments
- * List the per-endpoint task assignments of one Binalyze AIR task using GET /api/v2/tasks/{taskId}/task-assignments. Paginated; this is the resolver for the taskAssignmentsUrl field in task detail responses. Each entity carries id, taskId, name, type, endpointId, endpointName, status, progress, hasDroneData, durations, metadata, organization{id,name}, response and cases[]. Use this when the user wants per-host progress, per-host status, or which endpoints completed/failed for a task; use air-tasks-assets for asset details instead. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe). Placeholder defaults such as pageNumber=1 are ignored.
+ * List the per-endpoint task assignments of one Binalyze AIR task using GET /api/v2/tasks/{taskId}/task-assignments. Paginated; this is the resolver for the taskAssignmentsUrl field in task detail responses. Each entity carries id, taskId, name, type, endpointId, endpointName, status, progress, hasDroneData, durations, metadata, organizations[{id,name}], response and cases[]. Use this when the user wants per-host progress, per-host status, or which endpoints completed/failed for a task; use air-tasks-assets for asset details instead. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe). Placeholder defaults such as pageNumber=1 are ignored.
  */
 export declare const tasksV2ApiControllerListTaskAssignments: <ThrowOnError extends boolean = false>(options: Options<TasksV2ApiControllerListTaskAssignmentsData, ThrowOnError>) => import("./client").RequestResult<TasksV2ApiControllerListTaskAssignmentsResponses, TasksV2ApiControllerListTaskAssignmentsErrors, ThrowOnError>;
 /**
@@ -50,12 +50,12 @@ export declare const tasksV2ApiControllerListTaskAssignments: <ThrowOnError exte
 export declare const tasksTriageV2ApiControllerListHuntTasks: <ThrowOnError extends boolean = false>(options?: Options<TasksTriageV2ApiControllerListHuntTasksData, ThrowOnError>) => import("./client").RequestResult<TasksTriageV2ApiControllerListHuntTasksResponses, TasksTriageV2ApiControllerListHuntTasksErrors, ThrowOnError>;
 /**
  * Bulk cancel hunt (triage) tasks (body dryRun preview)
- * Cancel one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/cancel. MUTATING: cancels ALL active assignments of each task across all its assets; cancellation is queued asynchronously and an abort signal is sent to the agents. Task records and downloaded data are kept (use air-hunt-bulk-delete to remove them). taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and cancels EVERY active (scheduled/assigned/processing) hunt task in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists; confirm with the user before using it. dryRun defaults to true: the preview (200) returns result.entities[] = {taskId, taskName, willCancelAssignmentCount, status} without cancelling anything. ALWAYS run the preview first and show the user what would be cancelled; pass dryRun=false only after the user explicitly confirms the exact task list. The real cancel returns cancelledAssignmentCount and status 'cancelling' instead. Both forms include warnings[] for skipped tasks (e.g. already in a terminal state). 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-cancel, which returns a leak-safe 404 for unknown ids.
+ * Cancel one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/cancel. MUTATING: cancels ALL active assignments of each task across all its assets; cancellation is queued asynchronously and an abort signal is sent to the agents. Task records and downloaded data are kept (use air-hunt-bulk-delete to remove them). taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and cancels EVERY active (scheduled/assigned/processing) hunt task in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists; confirm with the user before using it. dryRun is opt-in at the API level (defaults to false); the OpenCode tools send dryRun=true by default. The preview (200) returns result.entities[] = {taskId, taskName, willCancelAssignmentCount, status} without cancelling anything. ALWAYS run the preview first and show the user what would be cancelled; pass dryRun=false only after the user explicitly confirms the exact task list. The real cancel returns cancelledAssignmentCount and status 'cancelling' instead. Both forms include warnings[] for skipped tasks (e.g. already in a terminal state). 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-cancel, which returns a leak-safe 404 for unknown ids.
  */
 export declare const tasksTriageV2ApiControllerCancel: <ThrowOnError extends boolean = false>(options: Options<TasksTriageV2ApiControllerCancelData, ThrowOnError>) => import("./client").RequestResult<TasksTriageV2ApiControllerCancelResponses, TasksTriageV2ApiControllerCancelErrors, ThrowOnError>;
 /**
  * Bulk delete hunt (triage) tasks (body dryRun preview)
- * Delete one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/delete. DESTRUCTIVE and irreversible: removes the task records, ALL assignments, and downloaded files/artifacts; nothing remains in history. Active tasks additionally get an agent cancel signal. Use air-hunt-bulk-cancel to merely stop tasks while keeping records. taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and deletes EVERY hunt task (active and finished) in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists. dryRun defaults to true: the preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS run the preview first and show the user what would be deleted; pass dryRun=false only after the user explicitly confirms the exact task list. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-delete (leak-safe 404).
+ * Delete one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/delete. DESTRUCTIVE and irreversible: removes the task records, ALL assignments, and downloaded files/artifacts; nothing remains in history. Active tasks additionally get an agent cancel signal. Use air-hunt-bulk-cancel to merely stop tasks while keeping records. taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and deletes EVERY hunt task (active and finished) in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists. dryRun is opt-in at the API level (defaults to false); the OpenCode tools send dryRun=true by default. The preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS run the preview first and show the user what would be deleted; pass dryRun=false only after the user explicitly confirms the exact task list. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-delete (leak-safe 404).
  */
 export declare const tasksTriageV2ApiControllerDelete: <ThrowOnError extends boolean = false>(options: Options<TasksTriageV2ApiControllerDeleteData, ThrowOnError>) => import("./client").RequestResult<TasksTriageV2ApiControllerDeleteResponses, TasksTriageV2ApiControllerDeleteErrors, ThrowOnError>;
 /**
@@ -65,17 +65,17 @@ export declare const tasksTriageV2ApiControllerDelete: <ThrowOnError extends boo
 export declare const tasksTriageV2ApiControllerCancelOne: <ThrowOnError extends boolean = false>(options: Options<TasksTriageV2ApiControllerCancelOneData, ThrowOnError>) => import("./client").RequestResult<TasksTriageV2ApiControllerCancelOneResponses, TasksTriageV2ApiControllerCancelOneErrors, ThrowOnError>;
 /**
  * Delete a single hunt (triage) task (dryRun query preview)
- * Delete a single Binalyze AIR hunt (triage) task via POST /api/v2/hunt/{taskId}/delete. DESTRUCTIVE and irreversible: removes the task record, ALL its assignments, and downloaded files/artifacts; nothing remains in history. An active task additionally gets an agent cancel signal. Use air-hunt-cancel to merely stop the task while keeping records. Use this for exactly one task; use air-hunt-bulk-delete for several tasks at once. The taskId comes from air-hunt-list or air-tasks-get. dryRun defaults to true and is sent as the ?dryRun=true query parameter: the preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS preview first and show the user; pass dryRun=false only after the user explicitly confirms this exact task. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe).
+ * Delete a single Binalyze AIR hunt (triage) task via POST /api/v2/hunt/{taskId}/delete. DESTRUCTIVE and irreversible: removes the task record, ALL its assignments, and downloaded files/artifacts; nothing remains in history. An active task additionally gets an agent cancel signal. Use air-hunt-cancel to merely stop the task while keeping records. Use this for exactly one task; use air-hunt-bulk-delete for several tasks at once. The taskId comes from air-hunt-list or air-tasks-get. dryRun is opt-in at the API level (defaults to false) and is sent as the ?dryRun=true query parameter; the OpenCode tools send it by default. The preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS preview first and show the user; pass dryRun=false only after the user explicitly confirms this exact task. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe).
  */
 export declare const tasksTriageV2ApiControllerDeleteOne: <ThrowOnError extends boolean = false>(options: Options<TasksTriageV2ApiControllerDeleteOneData, ThrowOnError>) => import("./client").RequestResult<TasksTriageV2ApiControllerDeleteOneResponses, TasksTriageV2ApiControllerDeleteOneErrors, ThrowOnError>;
 /**
  * List device acquisition profiles
- * List Binalyze AIR device (evidence) acquisition profiles via GET /api/v2/libraries/acquisition/device. Read-only and paginated. Each entity is a profile summary: id, name, organizationIds, averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. Per-OS configs (windows/linux/macos/aix/eDiscovery) are NOT included; use air-acquisition-device-get for one profile's full config. Use this when the user asks to list or search evidence acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with empty organizationIds are global.
+ * List Binalyze AIR device (evidence) acquisition profiles via GET /api/v2/libraries/acquisition/device. Read-only and paginated. Each entity is a profile summary: id, name, organizations[{id,name}], averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. Per-OS configs (windows/linux/macos/aix/eDiscovery) are NOT included; use air-acquisition-device-get for one profile's full config. Use this when the user asks to list or search evidence acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with an empty organizations array are global.
  */
 export declare const acquisitionLibraryDeviceV2ApiControllerList: <ThrowOnError extends boolean = false>(options?: Options<AcquisitionLibraryDeviceV2ApiControllerListData, ThrowOnError>) => import("./client").RequestResult<AcquisitionLibraryDeviceV2ApiControllerListResponses, AcquisitionLibraryDeviceV2ApiControllerListErrors, ThrowOnError>;
 /**
  * Create device acquisition profile
- * Create a Binalyze AIR device (evidence) acquisition profile via POST /api/v2/libraries/acquisition/device. MUTATING: persists a new profile in the acquisition library. Returns 200 with entities[0] = the created profile detail. `name` is required (alphanumeric) plus at least one config block: windows, linux, macos, aix (each with evidenceList/artifactList/customContentProfiles/networkCapture) or eDiscovery ({patterns:[{pattern,category}]}). Any subset of OS blocks is accepted. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Get the exact evidence/artifact keys from an existing profile (air-acquisition-device-get) when cloning or when unsure of valid values.
+ * Create a Binalyze AIR device (evidence) acquisition profile via POST /api/v2/libraries/acquisition/device. MUTATING: persists a new profile in the acquisition library. Returns 200 with entities[0] = the created profile detail. `name` is required (alphanumeric) plus at least one config block: windows, linux, macos, aix (each with evidenceList/artifactList/customContentProfiles/networkCapture) or eDiscovery ({patterns:[{pattern,category}]}). Any subset of OS blocks is accepted. Body `organizationIds` controls which organizations own the profile; common query `organizations`, `orgs`, and `org` parameters are rejected. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Get the exact evidence/artifact keys from an existing profile (air-acquisition-device-get) when cloning or when unsure of valid values.
  */
 export declare const acquisitionLibraryDeviceV2ApiControllerCreate: <ThrowOnError extends boolean = false>(options: Options<AcquisitionLibraryDeviceV2ApiControllerCreateData, ThrowOnError>) => import("./client").RequestResult<AcquisitionLibraryDeviceV2ApiControllerCreateResponses, AcquisitionLibraryDeviceV2ApiControllerCreateErrors, ThrowOnError>;
 /**
@@ -90,7 +90,7 @@ export declare const acquisitionLibraryDeviceV2ApiControllerBulkDelete: <ThrowOn
 export declare const acquisitionLibraryDeviceV2ApiControllerDelete: <ThrowOnError extends boolean = false>(options: Options<AcquisitionLibraryDeviceV2ApiControllerDeleteData, ThrowOnError>) => import("./client").RequestResult<AcquisitionLibraryDeviceV2ApiControllerDeleteResponses, AcquisitionLibraryDeviceV2ApiControllerDeleteErrors, ThrowOnError>;
 /**
  * Get device acquisition profile by id or name
- * Get ONE Binalyze AIR device (evidence) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/device/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizationIds, the per-OS configs (windows/linux/macos/aix with evidence and artifact lists), eDiscovery patterns, deletable, and timestamps. Use this when the user asks to show or inspect an evidence acquisition profile's contents, or to clone one. Ids and exact names come from air-acquisition-device-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
+ * Get ONE Binalyze AIR device (evidence) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/device/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizations[{id,name}], the per-OS configs (windows/linux/macos/aix with evidence and artifact lists), eDiscovery patterns, deletable, and timestamps. Use this when the user asks to show or inspect an evidence acquisition profile's contents, or to clone one. Ids and exact names come from air-acquisition-device-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
  */
 export declare const acquisitionLibraryDeviceV2ApiControllerGet: <ThrowOnError extends boolean = false>(options: Options<AcquisitionLibraryDeviceV2ApiControllerGetData, ThrowOnError>) => import("./client").RequestResult<AcquisitionLibraryDeviceV2ApiControllerGetResponses, AcquisitionLibraryDeviceV2ApiControllerGetErrors, ThrowOnError>;
 /**
@@ -170,7 +170,7 @@ export declare const caseBulkActionV2ApiControllerClose: <ThrowOnError extends b
 export declare const caseBulkActionV2ApiControllerArchive: <ThrowOnError extends boolean = false>(options: Options<CaseBulkActionV2ApiControllerArchiveData, ThrowOnError>) => import("./client").RequestResult<CaseBulkActionV2ApiControllerArchiveResponses, CaseBulkActionV2ApiControllerArchiveErrors, ThrowOnError>;
 /**
  * List assets linked to case
- * List the assets linked to a Binalyze AIR case using GET /api/v2/cases/{idOrName}/assets. Read-only, paginated; returns full canonical v2 asset entities (nested endpoint{} block) for every asset attached to the case. Use this to see which endpoints belong to a case, to pick asset ids for air-cases-remove-assets, or before acting on the case's machines with the asset tools. The path accepts a case UUID or exact case name. JSON only (the API's format=csv variant is not exposed here; use air-cases-export for file exports).
+ * List the assets linked to a Binalyze AIR case using GET /api/v2/cases/{idOrName}/assets. Read-only, paginated; returns full canonical v2 asset entities (nested endpoint{} block) for every asset attached to the case. Use this to see which endpoints belong to a case, to pick asset ids for air-cases-remove-assets, or before acting on the case's machines with the asset tools. The path accepts a case UUID or exact case name. Use format=json (default) for a paginated response or format=csv to stream the linked assets as text/csv.
  */
 export declare const caseAssetV2ApiControllerFilterAssets: <ThrowOnError extends boolean = false>(options: Options<CaseAssetV2ApiControllerFilterAssetsData, ThrowOnError>) => import("./client").RequestResult<CaseAssetV2ApiControllerFilterAssetsResponses, CaseAssetV2ApiControllerFilterAssetsErrors, ThrowOnError>;
 /**
@@ -240,7 +240,7 @@ export declare const caseActionV2ApiControllerArchive: <ThrowOnError extends boo
 export declare const caseActionV2ApiControllerRemoveAssets: <ThrowOnError extends boolean = false>(options: Options<CaseActionV2ApiControllerRemoveAssetsData, ThrowOnError>) => import("./client").RequestResult<CaseActionV2ApiControllerRemoveAssetsResponses, CaseActionV2ApiControllerRemoveAssetsErrors, ThrowOnError>;
 /**
  * List cases
- * List Binalyze AIR cases using GET /api/v2/cases. Read-only, paginated. Each entity uses object refs: owner{id,name}, organization{id,name}, category{id,name}, tags[], assignedUsers[], plus taskCounts{} and assets/taskAssignments {count,url} summaries. Lifecycle is open -> closed -> archived (no unarchive). Reference filters (owner, assignedUser, category, tags) accept a UUID or an exact name/username; name is a case-insensitive substring match. Use this to find a case id or name before calling air-cases-get, air-cases-update, air-cases-close or the case sub-resource tools. organizations defaults to all accessible organizations.
+ * List Binalyze AIR cases using GET /api/v2/cases. Read-only, paginated. Each entity uses object refs: owner{id,name}, organizations[{id,name}], category{id,name}, tags[], assignedUsers[], plus taskCounts{} and assets/taskAssignments {count,url} summaries. Lifecycle is open -> closed -> archived (no unarchive). Reference filters (owner, assignedUser, category, tags) accept a UUID or an exact name/username; name is a case-insensitive substring match. Use this to find a case id or name before calling air-cases-get, air-cases-update, air-cases-close or the case sub-resource tools. organizations defaults to all accessible organizations.
  */
 export declare const caseV2ApiControllerFilterCases: <ThrowOnError extends boolean = false>(options?: Options<CaseV2ApiControllerFilterCasesData, ThrowOnError>) => import("./client").RequestResult<CaseV2ApiControllerFilterCasesResponses, CaseV2ApiControllerFilterCasesErrors, ThrowOnError>;
 /**
@@ -250,7 +250,7 @@ export declare const caseV2ApiControllerFilterCases: <ThrowOnError extends boole
 export declare const caseV2ApiControllerCreateCase: <ThrowOnError extends boolean = false>(options: Options<CaseV2ApiControllerCreateCaseData, ThrowOnError>) => import("./client").RequestResult<CaseV2ApiControllerCreateCaseResponses, CaseV2ApiControllerCreateCaseErrors, ThrowOnError>;
 /**
  * Get case by id or name
- * Fetch one Binalyze AIR case by UUID or case name using GET /api/v2/cases/{idOrName}. Read-only; the case is wrapped in result.entities[0]. The entity uses object refs (owner{}, organization{}, category{}, tags[], assignedUsers[]), taskCounts{}, and assets/taskAssignments {count,url} summaries. Lifecycle status is open, closed or archived. A 404 also covers cases outside the caller's organizations (leak-safe), so do not infer the case does not exist. Use air-cases-list to discover ids and names first.
+ * Fetch one Binalyze AIR case by UUID or case name using GET /api/v2/cases/{idOrName}. Read-only; the case is wrapped in result.entities[0]. The entity uses object refs (owner{}, organizations[{id,name}], category{}, tags[], assignedUsers[]), taskCounts{}, and assets/taskAssignments {count,url} summaries. Lifecycle status is open, closed or archived. A 404 also covers cases outside the caller's organizations (leak-safe), so do not infer the case does not exist. Use air-cases-list to discover ids and names first.
  */
 export declare const caseV2ApiControllerGetCaseByIdOrName: <ThrowOnError extends boolean = false>(options: Options<CaseV2ApiControllerGetCaseByIdOrNameData, ThrowOnError>) => import("./client").RequestResult<CaseV2ApiControllerGetCaseByIdOrNameResponses, CaseV2ApiControllerGetCaseByIdOrNameErrors, ThrowOnError>;
 /**
@@ -355,7 +355,7 @@ export declare const interactCommandV2ApiControllerList: <ThrowOnError extends b
 export declare const flagsLibraryV2ApiControllerList: <ThrowOnError extends boolean = false>(options?: Options<FlagsLibraryV2ApiControllerListData, ThrowOnError>) => import("./client").RequestResult<FlagsLibraryV2ApiControllerListResponses, FlagsLibraryV2ApiControllerListErrors, ThrowOnError>;
 /**
  * Create investigation flag
- * Create a Binalyze AIR investigation flag via POST /api/v2/libraries/flags. MUTATING: persists a new flag. Required: name (max 50 chars, not purely numeric). Optional: color (CSS color, defaults to #4A4D55), description, and organization (id or exact name; defaults to the caller organization when the caller has exactly one, otherwise the default organization). A name collision within the organization is resolved by auto-suffixing with a NAME_ADJUSTED warning; if a unique name cannot be allocated, returns 409 NAME_CONFLICT. dryRun DEFAULTS TO TRUE in the tool layer: the first call previews the would-create entity (action='would-create', final name) without persisting; pass dryRun=false only after the user confirms. Success returns entities[0] with the created flag.
+ * Create a Binalyze AIR investigation flag via POST /api/v2/libraries/flags. MUTATING: persists a new flag. Required: name (max 50 chars, not purely numeric). Optional: color (CSS color, defaults to #4A4D55), description, and organization (id or exact name; defaults to the caller organization when the caller has exactly one; multi-organization and all-organization callers must pass it explicitly or receive 400 ORGANIZATION_REQUIRED). A name collision within the organization is resolved by auto-suffixing with a NAME_ADJUSTED warning; if a unique name cannot be allocated, returns 409 NAME_CONFLICT. dryRun DEFAULTS TO TRUE in the tool layer: the first call previews the would-create entity (action='would-create', final name) without persisting; pass dryRun=false only after the user confirms. Success returns entities[0] with the created flag.
  */
 export declare const flagsLibraryV2ApiControllerCreate: <ThrowOnError extends boolean = false>(options: Options<FlagsLibraryV2ApiControllerCreateData, ThrowOnError>) => import("./client").RequestResult<FlagsLibraryV2ApiControllerCreateResponses, FlagsLibraryV2ApiControllerCreateErrors, ThrowOnError>;
 /**
@@ -510,7 +510,7 @@ export declare const assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion: <T
 export declare const assetBulkMetadataV2ApiControllerDeleteAssets: <ThrowOnError extends boolean = false>(options: Options<AssetBulkMetadataV2ApiControllerDeleteAssetsData, ThrowOnError>) => import("./client").RequestResult<AssetBulkMetadataV2ApiControllerDeleteAssetsResponses, AssetBulkMetadataV2ApiControllerDeleteAssetsErrors, ThrowOnError>;
 /**
  * Import an off-network PPC (find-or-create asset + offline task)
- * Import an OFF-NETWORK Task.dat via POST /api/v2/assets/import (multipart upload) and create an OFFLINE TASK (offline-triage or offline-acquisition). IMPORTANT semantics: this endpoint does NOT create or find an asset -- it only creates a task from the uploaded Task.dat (the asset is resolved later, when the evidence collection zip is imported into the task). The file must be a valid RC4-encrypted Task.dat; anything else (e.g. a regular case .ppc) is rejected 400 'Missing or invalid Task.dat format!'. Requires the Off-Network Responder feature. Success response (200): result.entities[0] = { taskId, taskName, organizationId, taskDetailsViewUrl, ppcFileName, importedAt } -- a task summary, no asset id/name. organizations must resolve to EXACTLY ONE organization id (the task is single-org). Optionally attach to a case via caseIdOrName (unknown case -> 400 'Case not found'). ALWAYS send dryRun=true first (generic preview; does not validate the file); pass dryRun=false only to perform the real import after the user confirms. To import a case PPC into an asset that already exists in AIR, use air-assets-import instead.
+ * Import an OFF-NETWORK Task.dat via POST /api/v2/assets/import (multipart upload) and create an OFFLINE TASK (offline-triage or offline-acquisition). IMPORTANT semantics: this endpoint does NOT create or find an asset -- it only creates a task from the uploaded Task.dat (the asset is resolved later, when the evidence collection zip is imported into the task). The file must be a valid RC4-encrypted Task.dat; anything else (e.g. a regular case .ppc) is rejected 400 'Missing or invalid Task.dat format!'. Requires the Off-Network Responder feature. Success response (200): result.entities[0] = { taskId, taskName, organizations: [{ id, name }], taskDetailsViewUrl, ppcFileName, importedAt } -- a task summary, no asset id/name. organizations must resolve to EXACTLY ONE organization id (the task is single-org). Optionally attach to a case via caseIdOrName (unknown case -> 400 'Case not found'). ALWAYS send dryRun=true first (generic preview; does not validate the file); pass dryRun=false only to perform the real import after the user confirms. To import a case PPC into an asset that already exists in AIR, use air-assets-import instead.
  */
 export declare const assetBulkMetadataV2ApiControllerImportOffNetworkPpc: <ThrowOnError extends boolean = false>(options: Options<AssetBulkMetadataV2ApiControllerImportOffNetworkPpcData, ThrowOnError>) => import("./client").RequestResult<AssetBulkMetadataV2ApiControllerImportOffNetworkPpcResponses, AssetBulkMetadataV2ApiControllerImportOffNetworkPpcErrors, ThrowOnError>;
 /**
@@ -520,7 +520,7 @@ export declare const assetBulkMetadataV2ApiControllerImportOffNetworkPpc: <Throw
 export declare const assetBulkTriageV2ApiControllerRunTriage: <ThrowOnError extends boolean = false>(options: Options<AssetBulkTriageV2ApiControllerRunTriageData, ThrowOnError>) => import("./client").RequestResult<AssetBulkTriageV2ApiControllerRunTriageResponses, AssetBulkTriageV2ApiControllerRunTriageErrors, ThrowOnError>;
 /**
  * List InterAct messages for an asset
- * List the InterAct shell messages of EXACTLY ONE Binalyze AIR asset across all its sessions via GET /api/v2/assets/{idOrName}/interact. Read-only; returns a paginated envelope of messages (command + latest response, status, detectedType, output/outputUrl). Supports filtering by session, status, detected type, snippet, and created/completed date ranges. Use this when the user asks for an asset's shell command history, or to poll an async command's status by sessionId/status. Prefer UUID; names can be ambiguous across organizations. Omit any filter the user did not ask for. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * List the InterAct shell messages of EXACTLY ONE Binalyze AIR asset across all its sessions via GET /api/v2/assets/{idOrName}/interact. Read-only; returns a paginated envelope of messages (command + latest response, status, detectedType, output/outputUrl). Supports filtering by session and creation date range. Use this when the user asks for an asset's shell command history. Prefer UUID; names can be ambiguous across organizations. Omit any filter the user did not ask for. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 export declare const assetInteractMessageV2ApiControllerListForAsset: <ThrowOnError extends boolean = false>(options: Options<AssetInteractMessageV2ApiControllerListForAssetData, ThrowOnError>) => import("./client").RequestResult<AssetInteractMessageV2ApiControllerListForAssetResponses, AssetInteractMessageV2ApiControllerListForAssetErrors, ThrowOnError>;
 /**
@@ -635,12 +635,12 @@ export declare const assetInteractMessageV2ApiControllerDownloadMessageOutput: <
 export declare const assetInteractMessageV2ApiControllerGetSessionReport: <ThrowOnError extends boolean = false>(options: Options<AssetInteractMessageV2ApiControllerGetSessionReportData, ThrowOnError>) => import("./client").RequestResult<AssetInteractMessageV2ApiControllerGetSessionReportResponses, AssetInteractMessageV2ApiControllerGetSessionReportErrors, ThrowOnError>;
 /**
  * List cloud acquisition profiles
- * List Binalyze AIR cloud (M365) acquisition profiles via GET /api/v2/libraries/acquisition/cloud. Read-only and paginated. Each entity is a profile summary: id, name, organizationIds, averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. The m365UserBased/m365TenantWide evidence lists are NOT included; use air-acquisition-cloud-get for one profile's full config. Use this when the user asks to list or search cloud acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with empty organizationIds are global.
+ * List Binalyze AIR cloud (M365) acquisition profiles via GET /api/v2/libraries/acquisition/cloud. Read-only and paginated. Each entity is a profile summary: id, name, organizations[{id,name}], averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. The m365UserBased/m365TenantWide evidence lists are NOT included; use air-acquisition-cloud-get for one profile's full config. Use this when the user asks to list or search cloud acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with an empty organizations array are global.
  */
 export declare const cloudAcquisitionLibraryApiControllerList: <ThrowOnError extends boolean = false>(options?: Options<CloudAcquisitionLibraryApiControllerListData, ThrowOnError>) => import("./client").RequestResult<CloudAcquisitionLibraryApiControllerListResponses, CloudAcquisitionLibraryApiControllerListErrors, ThrowOnError>;
 /**
  * Create cloud acquisition profile
- * Create a Binalyze AIR cloud (M365) acquisition profile via POST /api/v2/libraries/acquisition/cloud. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. `name` (alphanumeric) plus BOTH m365UserBased and m365TenantWide blocks are required; each block is {evidenceList: string[]} and at least one evidence must be selected across the two blocks. Evidence keys are lowercase M365 collector names, e.g. user-based: outlookmails, onedrive, teams, teamschat, calendar, mfa, user; tenant-wide: ual, adminauditlog, azureadaccountlogon, sharepoint, exchangeadmin, riskyusers. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-cloud-get for the full list of valid evidence keys.
+ * Create a Binalyze AIR cloud (M365) acquisition profile via POST /api/v2/libraries/acquisition/cloud. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. `name` (alphanumeric) plus BOTH m365UserBased and m365TenantWide blocks are required; each block is {evidenceList: string[]} and at least one evidence must be selected across the two blocks. Body `organizationIds` controls which organizations own the profile; common query `organizations`, `orgs`, and `org` parameters are rejected. Evidence keys are lowercase M365 collector names, e.g. user-based: outlookmails, onedrive, teams, teamschat, calendar, mfa, user; tenant-wide: ual, adminauditlog, azureadaccountlogon, sharepoint, exchangeadmin, riskyusers. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-cloud-get for the full list of valid evidence keys.
  */
 export declare const cloudAcquisitionLibraryApiControllerCreate: <ThrowOnError extends boolean = false>(options: Options<CloudAcquisitionLibraryApiControllerCreateData, ThrowOnError>) => import("./client").RequestResult<CloudAcquisitionLibraryApiControllerCreateResponses, CloudAcquisitionLibraryApiControllerCreateErrors, ThrowOnError>;
 /**
@@ -655,7 +655,7 @@ export declare const cloudAcquisitionLibraryApiControllerBulkDelete: <ThrowOnErr
 export declare const cloudAcquisitionLibraryApiControllerDelete: <ThrowOnError extends boolean = false>(options: Options<CloudAcquisitionLibraryApiControllerDeleteData, ThrowOnError>) => import("./client").RequestResult<CloudAcquisitionLibraryApiControllerDeleteResponses, CloudAcquisitionLibraryApiControllerDeleteErrors, ThrowOnError>;
 /**
  * Get cloud acquisition profile by id or name
- * Get ONE Binalyze AIR cloud (M365) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/cloud/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizationIds, m365UserBased.evidenceList, m365TenantWide.evidenceList, deletable, and timestamps. Use this when the user asks to show or inspect a cloud acquisition profile's evidence selection, to clone one, or to discover valid M365 evidence keys. Ids and exact names come from air-acquisition-cloud-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
+ * Get ONE Binalyze AIR cloud (M365) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/cloud/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizations[{id,name}], m365UserBased.evidenceList, m365TenantWide.evidenceList, deletable, and timestamps. Use this when the user asks to show or inspect a cloud acquisition profile's evidence selection, to clone one, or to discover valid M365 evidence keys. Ids and exact names come from air-acquisition-cloud-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
  */
 export declare const cloudAcquisitionLibraryApiControllerGet: <ThrowOnError extends boolean = false>(options: Options<CloudAcquisitionLibraryApiControllerGetData, ThrowOnError>) => import("./client").RequestResult<CloudAcquisitionLibraryApiControllerGetResponses, CloudAcquisitionLibraryApiControllerGetErrors, ThrowOnError>;
 /**
@@ -665,12 +665,12 @@ export declare const cloudAcquisitionLibraryApiControllerGet: <ThrowOnError exte
 export declare const cloudAcquisitionLibraryApiControllerUpdate: <ThrowOnError extends boolean = false>(options: Options<CloudAcquisitionLibraryApiControllerUpdateData, ThrowOnError>) => import("./client").RequestResult<CloudAcquisitionLibraryApiControllerUpdateResponses, CloudAcquisitionLibraryApiControllerUpdateErrors, ThrowOnError>;
 /**
  * List disk image acquisition profiles
- * List Binalyze AIR disk-image acquisition profiles via GET /api/v2/libraries/acquisition/disk-image. Read-only and paginated. Requires the image-evidence-acquisition feature to be enabled on the Console. Each entity is a profile summary: id, name, organizationIds, averageTime, createdAt/updatedAt, createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. allFiles/paths/evidence config is NOT included; use air-acquisition-disk-image-get for one profile's full config. Use this when the user asks to list or search disk-image (forensic imaging) profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdAt, updatedAt, lastUsedAt, createdBy, lastUsedBy (default createdAt). Profiles with empty organizationIds are global.
+ * List Binalyze AIR disk-image acquisition profiles via GET /api/v2/libraries/acquisition/disk-image. Read-only and paginated. Requires the image-evidence-acquisition feature to be enabled on the Console. Each entity is a profile summary: id, name, organizations[{id,name}], averageTime, createdAt/updatedAt, createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. allFiles/paths/evidence config is NOT included; use air-acquisition-disk-image-get for one profile's full config. Use this when the user asks to list or search disk-image (forensic imaging) profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdAt, updatedAt, lastUsedAt, createdBy, lastUsedBy (default createdAt). Profiles with an empty organizations array are global.
  */
 export declare const diskImageAcquisitionLibraryApiControllerList: <ThrowOnError extends boolean = false>(options?: Options<DiskImageAcquisitionLibraryApiControllerListData, ThrowOnError>) => import("./client").RequestResult<DiskImageAcquisitionLibraryApiControllerListResponses, DiskImageAcquisitionLibraryApiControllerListErrors, ThrowOnError>;
 /**
  * Create disk image acquisition profile
- * Create a Binalyze AIR disk-image acquisition profile via POST /api/v2/libraries/acquisition/disk-image. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. Requires the image-evidence-acquisition feature to be enabled on the Console. `name` is required (alphanumeric). Scope is either allFiles=true (full image) OR a `paths` list of directories/files to image; the allFiles/paths combination must be consistent (a profile cannot have both allFiles=true and paths). `imageAcquisitionEvidences` optionally selects extra evidence to collect alongside the image. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-disk-image-get when cloning or when unsure of valid evidence keys.
+ * Create a Binalyze AIR disk-image acquisition profile via POST /api/v2/libraries/acquisition/disk-image. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. Requires the image-evidence-acquisition feature to be enabled on the Console. `name` is required (alphanumeric). Scope is either allFiles=true (full image) OR a `paths` list of directories/files to image; the allFiles/paths combination must be consistent (a profile cannot have both allFiles=true and paths). `imageAcquisitionEvidences` optionally selects extra evidence to collect alongside the image. Body `organizationIds` controls which organizations own the profile; common query `organizations`, `orgs`, and `org` parameters are rejected. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-disk-image-get when cloning or when unsure of valid evidence keys.
  */
 export declare const diskImageAcquisitionLibraryApiControllerCreate: <ThrowOnError extends boolean = false>(options: Options<DiskImageAcquisitionLibraryApiControllerCreateData, ThrowOnError>) => import("./client").RequestResult<DiskImageAcquisitionLibraryApiControllerCreateResponses, DiskImageAcquisitionLibraryApiControllerCreateErrors, ThrowOnError>;
 /**
@@ -685,7 +685,7 @@ export declare const diskImageAcquisitionLibraryApiControllerBulkDelete: <ThrowO
 export declare const diskImageAcquisitionLibraryApiControllerDelete: <ThrowOnError extends boolean = false>(options: Options<DiskImageAcquisitionLibraryApiControllerDeleteData, ThrowOnError>) => import("./client").RequestResult<DiskImageAcquisitionLibraryApiControllerDeleteResponses, DiskImageAcquisitionLibraryApiControllerDeleteErrors, ThrowOnError>;
 /**
  * Get disk image acquisition profile by id or name
- * Get ONE Binalyze AIR disk-image acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/disk-image/{idOrName}. Read-only. Requires the image-evidence-acquisition feature to be enabled on the Console. Returns the full profile detail in entities[0]: id, name, organizationIds, allFiles, paths[] ({path, description}), imageAcquisitionEvidences, deletable, and timestamps. Use this when the user asks to show or inspect a disk-image profile's scope, or to clone one. Ids and exact names come from air-acquisition-disk-image-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
+ * Get ONE Binalyze AIR disk-image acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/disk-image/{idOrName}. Read-only. Requires the image-evidence-acquisition feature to be enabled on the Console. Returns the full profile detail in entities[0]: id, name, organizations[{id,name}], allFiles, paths[] ({path, description}), imageAcquisitionEvidences, deletable, and timestamps. Use this when the user asks to show or inspect a disk-image profile's scope, or to clone one. Ids and exact names come from air-acquisition-disk-image-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
  */
 export declare const diskImageAcquisitionLibraryApiControllerGet: <ThrowOnError extends boolean = false>(options: Options<DiskImageAcquisitionLibraryApiControllerGetData, ThrowOnError>) => import("./client").RequestResult<DiskImageAcquisitionLibraryApiControllerGetResponses, DiskImageAcquisitionLibraryApiControllerGetErrors, ThrowOnError>;
 /**

package/dist/sdk/typescript-axios-v2/sdk.gen.js

@@ -54,7 +54,7 @@ const openApiAliasV2ApiControllerGet = (options) => {
 exports.openApiAliasV2ApiControllerGet = openApiAliasV2ApiControllerGet;
 /**
  * Get task by id
- * Fetch one Binalyze AIR task by UUID using GET /api/v2/tasks/{taskId}. Type-independent: works for triage, acquisition, interactShell and other task types. The response wraps the single task in result.entities[0] and is polymorphic: it carries a type/subtype discriminator plus only the matching domain block (triage{} / acquisition{} / interactShell{}); other blocks are absent, not null. It also returns counts{assigned,completed,failed,cancelled}, organization{id,name}, cases[], schedule (null when not scheduled) and taskAssignments{taskAssignmentCount,taskAssignmentsUrl}. Use air-tasks-assignments for the full per-endpoint assignment list and air-tasks-assets for the targeted assets. Only a task UUID is accepted; names and hostnames are rejected. A 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe), so do not infer the task does not exist.
+ * Fetch one Binalyze AIR task by UUID using GET /api/v2/tasks/{taskId}. Type-independent: works for triage, acquisition, interactShell and other task types. The response wraps the single task in result.entities[0] and is polymorphic: it carries a type/subtype discriminator plus only the matching domain block (triage{} / acquisition{} / interactShell{}); other blocks are absent, not null. It also returns counts{assigned,completed,failed,cancelled}, organizations[{id,name}], cases[], schedule (null when not scheduled) and taskAssignments{taskAssignmentCount,taskAssignmentsUrl}. Use air-tasks-assignments for the full per-endpoint assignment list and air-tasks-assets for the targeted assets. Only a task UUID is accepted; names and hostnames are rejected. A 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe), so do not infer the task does not exist.
  */
 const tasksV2ApiControllerGetTaskById = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -127,7 +127,7 @@ const tasksV2ApiControllerListTaskAssets = (options) => {
 exports.tasksV2ApiControllerListTaskAssets = tasksV2ApiControllerListTaskAssets;
 /**
  * List a task assignments
- * List the per-endpoint task assignments of one Binalyze AIR task using GET /api/v2/tasks/{taskId}/task-assignments. Paginated; this is the resolver for the taskAssignmentsUrl field in task detail responses. Each entity carries id, taskId, name, type, endpointId, endpointName, status, progress, hasDroneData, durations, metadata, organization{id,name}, response and cases[]. Use this when the user wants per-host progress, per-host status, or which endpoints completed/failed for a task; use air-tasks-assets for asset details instead. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe). Placeholder defaults such as pageNumber=1 are ignored.
+ * List the per-endpoint task assignments of one Binalyze AIR task using GET /api/v2/tasks/{taskId}/task-assignments. Paginated; this is the resolver for the taskAssignmentsUrl field in task detail responses. Each entity carries id, taskId, name, type, endpointId, endpointName, status, progress, hasDroneData, durations, metadata, organizations[{id,name}], response and cases[]. Use this when the user wants per-host progress, per-host status, or which endpoints completed/failed for a task; use air-tasks-assets for asset details instead. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe). Placeholder defaults such as pageNumber=1 are ignored.
  */
 const tasksV2ApiControllerListTaskAssignments = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -173,7 +173,7 @@ const tasksTriageV2ApiControllerListHuntTasks = (options) => {
 exports.tasksTriageV2ApiControllerListHuntTasks = tasksTriageV2ApiControllerListHuntTasks;
 /**
  * Bulk cancel hunt (triage) tasks (body dryRun preview)
- * Cancel one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/cancel. MUTATING: cancels ALL active assignments of each task across all its assets; cancellation is queued asynchronously and an abort signal is sent to the agents. Task records and downloaded data are kept (use air-hunt-bulk-delete to remove them). taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and cancels EVERY active (scheduled/assigned/processing) hunt task in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists; confirm with the user before using it. dryRun defaults to true: the preview (200) returns result.entities[] = {taskId, taskName, willCancelAssignmentCount, status} without cancelling anything. ALWAYS run the preview first and show the user what would be cancelled; pass dryRun=false only after the user explicitly confirms the exact task list. The real cancel returns cancelledAssignmentCount and status 'cancelling' instead. Both forms include warnings[] for skipped tasks (e.g. already in a terminal state). 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-cancel, which returns a leak-safe 404 for unknown ids.
+ * Cancel one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/cancel. MUTATING: cancels ALL active assignments of each task across all its assets; cancellation is queued asynchronously and an abort signal is sent to the agents. Task records and downloaded data are kept (use air-hunt-bulk-delete to remove them). taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and cancels EVERY active (scheduled/assigned/processing) hunt task in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists; confirm with the user before using it. dryRun is opt-in at the API level (defaults to false); the OpenCode tools send dryRun=true by default. The preview (200) returns result.entities[] = {taskId, taskName, willCancelAssignmentCount, status} without cancelling anything. ALWAYS run the preview first and show the user what would be cancelled; pass dryRun=false only after the user explicitly confirms the exact task list. The real cancel returns cancelledAssignmentCount and status 'cancelling' instead. Both forms include warnings[] for skipped tasks (e.g. already in a terminal state). 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-cancel, which returns a leak-safe 404 for unknown ids.
  */
 const tasksTriageV2ApiControllerCancel = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -200,7 +200,7 @@ const tasksTriageV2ApiControllerCancel = (options) => {
 exports.tasksTriageV2ApiControllerCancel = tasksTriageV2ApiControllerCancel;
 /**
  * Bulk delete hunt (triage) tasks (body dryRun preview)
- * Delete one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/delete. DESTRUCTIVE and irreversible: removes the task records, ALL assignments, and downloaded files/artifacts; nothing remains in history. Active tasks additionally get an agent cancel signal. Use air-hunt-bulk-cancel to merely stop tasks while keeping records. taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and deletes EVERY hunt task (active and finished) in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists. dryRun defaults to true: the preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS run the preview first and show the user what would be deleted; pass dryRun=false only after the user explicitly confirms the exact task list. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-delete (leak-safe 404).
+ * Delete one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/delete. DESTRUCTIVE and irreversible: removes the task records, ALL assignments, and downloaded files/artifacts; nothing remains in history. Active tasks additionally get an agent cancel signal. Use air-hunt-bulk-cancel to merely stop tasks while keeping records. taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and deletes EVERY hunt task (active and finished) in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists. dryRun is opt-in at the API level (defaults to false); the OpenCode tools send dryRun=true by default. The preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS run the preview first and show the user what would be deleted; pass dryRun=false only after the user explicitly confirms the exact task list. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-delete (leak-safe 404).
  */
 const tasksTriageV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -250,7 +250,7 @@ const tasksTriageV2ApiControllerCancelOne = (options) => {
 exports.tasksTriageV2ApiControllerCancelOne = tasksTriageV2ApiControllerCancelOne;
 /**
  * Delete a single hunt (triage) task (dryRun query preview)
- * Delete a single Binalyze AIR hunt (triage) task via POST /api/v2/hunt/{taskId}/delete. DESTRUCTIVE and irreversible: removes the task record, ALL its assignments, and downloaded files/artifacts; nothing remains in history. An active task additionally gets an agent cancel signal. Use air-hunt-cancel to merely stop the task while keeping records. Use this for exactly one task; use air-hunt-bulk-delete for several tasks at once. The taskId comes from air-hunt-list or air-tasks-get. dryRun defaults to true and is sent as the ?dryRun=true query parameter: the preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS preview first and show the user; pass dryRun=false only after the user explicitly confirms this exact task. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe).
+ * Delete a single Binalyze AIR hunt (triage) task via POST /api/v2/hunt/{taskId}/delete. DESTRUCTIVE and irreversible: removes the task record, ALL its assignments, and downloaded files/artifacts; nothing remains in history. An active task additionally gets an agent cancel signal. Use air-hunt-cancel to merely stop the task while keeping records. Use this for exactly one task; use air-hunt-bulk-delete for several tasks at once. The taskId comes from air-hunt-list or air-tasks-get. dryRun is opt-in at the API level (defaults to false) and is sent as the ?dryRun=true query parameter; the OpenCode tools send it by default. The preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS preview first and show the user; pass dryRun=false only after the user explicitly confirms this exact task. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe).
  */
 const tasksTriageV2ApiControllerDeleteOne = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -273,7 +273,7 @@ const tasksTriageV2ApiControllerDeleteOne = (options) => {
 exports.tasksTriageV2ApiControllerDeleteOne = tasksTriageV2ApiControllerDeleteOne;
 /**
  * List device acquisition profiles
- * List Binalyze AIR device (evidence) acquisition profiles via GET /api/v2/libraries/acquisition/device. Read-only and paginated. Each entity is a profile summary: id, name, organizationIds, averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. Per-OS configs (windows/linux/macos/aix/eDiscovery) are NOT included; use air-acquisition-device-get for one profile's full config. Use this when the user asks to list or search evidence acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with empty organizationIds are global.
+ * List Binalyze AIR device (evidence) acquisition profiles via GET /api/v2/libraries/acquisition/device. Read-only and paginated. Each entity is a profile summary: id, name, organizations[{id,name}], averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. Per-OS configs (windows/linux/macos/aix/eDiscovery) are NOT included; use air-acquisition-device-get for one profile's full config. Use this when the user asks to list or search evidence acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with an empty organizations array are global.
  */
 const acquisitionLibraryDeviceV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -296,7 +296,7 @@ const acquisitionLibraryDeviceV2ApiControllerList = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerList = acquisitionLibraryDeviceV2ApiControllerList;
 /**
  * Create device acquisition profile
- * Create a Binalyze AIR device (evidence) acquisition profile via POST /api/v2/libraries/acquisition/device. MUTATING: persists a new profile in the acquisition library. Returns 200 with entities[0] = the created profile detail. `name` is required (alphanumeric) plus at least one config block: windows, linux, macos, aix (each with evidenceList/artifactList/customContentProfiles/networkCapture) or eDiscovery ({patterns:[{pattern,category}]}). Any subset of OS blocks is accepted. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Get the exact evidence/artifact keys from an existing profile (air-acquisition-device-get) when cloning or when unsure of valid values.
+ * Create a Binalyze AIR device (evidence) acquisition profile via POST /api/v2/libraries/acquisition/device. MUTATING: persists a new profile in the acquisition library. Returns 200 with entities[0] = the created profile detail. `name` is required (alphanumeric) plus at least one config block: windows, linux, macos, aix (each with evidenceList/artifactList/customContentProfiles/networkCapture) or eDiscovery ({patterns:[{pattern,category}]}). Any subset of OS blocks is accepted. Body `organizationIds` controls which organizations own the profile; common query `organizations`, `orgs`, and `org` parameters are rejected. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Get the exact evidence/artifact keys from an existing profile (air-acquisition-device-get) when cloning or when unsure of valid values.
  */
 const acquisitionLibraryDeviceV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -373,7 +373,7 @@ const acquisitionLibraryDeviceV2ApiControllerDelete = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerDelete = acquisitionLibraryDeviceV2ApiControllerDelete;
 /**
  * Get device acquisition profile by id or name
- * Get ONE Binalyze AIR device (evidence) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/device/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizationIds, the per-OS configs (windows/linux/macos/aix with evidence and artifact lists), eDiscovery patterns, deletable, and timestamps. Use this when the user asks to show or inspect an evidence acquisition profile's contents, or to clone one. Ids and exact names come from air-acquisition-device-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
+ * Get ONE Binalyze AIR device (evidence) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/device/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizations[{id,name}], the per-OS configs (windows/linux/macos/aix with evidence and artifact lists), eDiscovery patterns, deletable, and timestamps. Use this when the user asks to show or inspect an evidence acquisition profile's contents, or to clone one. Ids and exact names come from air-acquisition-device-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
  */
 const acquisitionLibraryDeviceV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -772,7 +772,7 @@ const caseBulkActionV2ApiControllerArchive = (options) => {
 exports.caseBulkActionV2ApiControllerArchive = caseBulkActionV2ApiControllerArchive;
 /**
  * List assets linked to case
- * List the assets linked to a Binalyze AIR case using GET /api/v2/cases/{idOrName}/assets. Read-only, paginated; returns full canonical v2 asset entities (nested endpoint{} block) for every asset attached to the case. Use this to see which endpoints belong to a case, to pick asset ids for air-cases-remove-assets, or before acting on the case's machines with the asset tools. The path accepts a case UUID or exact case name. JSON only (the API's format=csv variant is not exposed here; use air-cases-export for file exports).
+ * List the assets linked to a Binalyze AIR case using GET /api/v2/cases/{idOrName}/assets. Read-only, paginated; returns full canonical v2 asset entities (nested endpoint{} block) for every asset attached to the case. Use this to see which endpoints belong to a case, to pick asset ids for air-cases-remove-assets, or before acting on the case's machines with the asset tools. The path accepts a case UUID or exact case name. Use format=json (default) for a paginated response or format=csv to stream the linked assets as text/csv.
  */
 const caseAssetV2ApiControllerFilterAssets = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -1114,7 +1114,7 @@ const caseActionV2ApiControllerRemoveAssets = (options) => {
 exports.caseActionV2ApiControllerRemoveAssets = caseActionV2ApiControllerRemoveAssets;
 /**
  * List cases
- * List Binalyze AIR cases using GET /api/v2/cases. Read-only, paginated. Each entity uses object refs: owner{id,name}, organization{id,name}, category{id,name}, tags[], assignedUsers[], plus taskCounts{} and assets/taskAssignments {count,url} summaries. Lifecycle is open -> closed -> archived (no unarchive). Reference filters (owner, assignedUser, category, tags) accept a UUID or an exact name/username; name is a case-insensitive substring match. Use this to find a case id or name before calling air-cases-get, air-cases-update, air-cases-close or the case sub-resource tools. organizations defaults to all accessible organizations.
+ * List Binalyze AIR cases using GET /api/v2/cases. Read-only, paginated. Each entity uses object refs: owner{id,name}, organizations[{id,name}], category{id,name}, tags[], assignedUsers[], plus taskCounts{} and assets/taskAssignments {count,url} summaries. Lifecycle is open -> closed -> archived (no unarchive). Reference filters (owner, assignedUser, category, tags) accept a UUID or an exact name/username; name is a case-insensitive substring match. Use this to find a case id or name before calling air-cases-get, air-cases-update, air-cases-close or the case sub-resource tools. organizations defaults to all accessible organizations.
  */
 const caseV2ApiControllerFilterCases = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -1164,7 +1164,7 @@ const caseV2ApiControllerCreateCase = (options) => {
 exports.caseV2ApiControllerCreateCase = caseV2ApiControllerCreateCase;
 /**
  * Get case by id or name
- * Fetch one Binalyze AIR case by UUID or case name using GET /api/v2/cases/{idOrName}. Read-only; the case is wrapped in result.entities[0]. The entity uses object refs (owner{}, organization{}, category{}, tags[], assignedUsers[]), taskCounts{}, and assets/taskAssignments {count,url} summaries. Lifecycle status is open, closed or archived. A 404 also covers cases outside the caller's organizations (leak-safe), so do not infer the case does not exist. Use air-cases-list to discover ids and names first.
+ * Fetch one Binalyze AIR case by UUID or case name using GET /api/v2/cases/{idOrName}. Read-only; the case is wrapped in result.entities[0]. The entity uses object refs (owner{}, organizations[{id,name}], category{}, tags[], assignedUsers[]), taskCounts{}, and assets/taskAssignments {count,url} summaries. Lifecycle status is open, closed or archived. A 404 also covers cases outside the caller's organizations (leak-safe), so do not infer the case does not exist. Use air-cases-list to discover ids and names first.
  */
 const caseV2ApiControllerGetCaseByIdOrName = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -1684,7 +1684,7 @@ const flagsLibraryV2ApiControllerList = (options) => {
 exports.flagsLibraryV2ApiControllerList = flagsLibraryV2ApiControllerList;
 /**
  * Create investigation flag
- * Create a Binalyze AIR investigation flag via POST /api/v2/libraries/flags. MUTATING: persists a new flag. Required: name (max 50 chars, not purely numeric). Optional: color (CSS color, defaults to #4A4D55), description, and organization (id or exact name; defaults to the caller organization when the caller has exactly one, otherwise the default organization). A name collision within the organization is resolved by auto-suffixing with a NAME_ADJUSTED warning; if a unique name cannot be allocated, returns 409 NAME_CONFLICT. dryRun DEFAULTS TO TRUE in the tool layer: the first call previews the would-create entity (action='would-create', final name) without persisting; pass dryRun=false only after the user confirms. Success returns entities[0] with the created flag.
+ * Create a Binalyze AIR investigation flag via POST /api/v2/libraries/flags. MUTATING: persists a new flag. Required: name (max 50 chars, not purely numeric). Optional: color (CSS color, defaults to #4A4D55), description, and organization (id or exact name; defaults to the caller organization when the caller has exactly one; multi-organization and all-organization callers must pass it explicitly or receive 400 ORGANIZATION_REQUIRED). A name collision within the organization is resolved by auto-suffixing with a NAME_ADJUSTED warning; if a unique name cannot be allocated, returns 409 NAME_CONFLICT. dryRun DEFAULTS TO TRUE in the tool layer: the first call previews the would-create entity (action='would-create', final name) without persisting; pass dryRun=false only after the user confirms. Success returns entities[0] with the created flag.
  */
 const flagsLibraryV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2514,7 +2514,7 @@ const assetBulkMetadataV2ApiControllerDeleteAssets = (options) => {
 exports.assetBulkMetadataV2ApiControllerDeleteAssets = assetBulkMetadataV2ApiControllerDeleteAssets;
 /**
  * Import an off-network PPC (find-or-create asset + offline task)
- * Import an OFF-NETWORK Task.dat via POST /api/v2/assets/import (multipart upload) and create an OFFLINE TASK (offline-triage or offline-acquisition). IMPORTANT semantics: this endpoint does NOT create or find an asset -- it only creates a task from the uploaded Task.dat (the asset is resolved later, when the evidence collection zip is imported into the task). The file must be a valid RC4-encrypted Task.dat; anything else (e.g. a regular case .ppc) is rejected 400 'Missing or invalid Task.dat format!'. Requires the Off-Network Responder feature. Success response (200): result.entities[0] = { taskId, taskName, organizationId, taskDetailsViewUrl, ppcFileName, importedAt } -- a task summary, no asset id/name. organizations must resolve to EXACTLY ONE organization id (the task is single-org). Optionally attach to a case via caseIdOrName (unknown case -> 400 'Case not found'). ALWAYS send dryRun=true first (generic preview; does not validate the file); pass dryRun=false only to perform the real import after the user confirms. To import a case PPC into an asset that already exists in AIR, use air-assets-import instead.
+ * Import an OFF-NETWORK Task.dat via POST /api/v2/assets/import (multipart upload) and create an OFFLINE TASK (offline-triage or offline-acquisition). IMPORTANT semantics: this endpoint does NOT create or find an asset -- it only creates a task from the uploaded Task.dat (the asset is resolved later, when the evidence collection zip is imported into the task). The file must be a valid RC4-encrypted Task.dat; anything else (e.g. a regular case .ppc) is rejected 400 'Missing or invalid Task.dat format!'. Requires the Off-Network Responder feature. Success response (200): result.entities[0] = { taskId, taskName, organizations: [{ id, name }], taskDetailsViewUrl, ppcFileName, importedAt } -- a task summary, no asset id/name. organizations must resolve to EXACTLY ONE organization id (the task is single-org). Optionally attach to a case via caseIdOrName (unknown case -> 400 'Case not found'). ALWAYS send dryRun=true first (generic preview; does not validate the file); pass dryRun=false only to perform the real import after the user confirms. To import a case PPC into an asset that already exists in AIR, use air-assets-import instead.
  */
 const assetBulkMetadataV2ApiControllerImportOffNetworkPpc = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2569,7 +2569,7 @@ const assetBulkTriageV2ApiControllerRunTriage = (options) => {
 exports.assetBulkTriageV2ApiControllerRunTriage = assetBulkTriageV2ApiControllerRunTriage;
 /**
  * List InterAct messages for an asset
- * List the InterAct shell messages of EXACTLY ONE Binalyze AIR asset across all its sessions via GET /api/v2/assets/{idOrName}/interact. Read-only; returns a paginated envelope of messages (command + latest response, status, detectedType, output/outputUrl). Supports filtering by session, status, detected type, snippet, and created/completed date ranges. Use this when the user asks for an asset's shell command history, or to poll an async command's status by sessionId/status. Prefer UUID; names can be ambiguous across organizations. Omit any filter the user did not ask for. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * List the InterAct shell messages of EXACTLY ONE Binalyze AIR asset across all its sessions via GET /api/v2/assets/{idOrName}/interact. Read-only; returns a paginated envelope of messages (command + latest response, status, detectedType, output/outputUrl). Supports filtering by session and creation date range. Use this when the user asks for an asset's shell command history. Prefer UUID; names can be ambiguous across organizations. Omit any filter the user did not ask for. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
  */
 const assetInteractMessageV2ApiControllerListForAsset = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -3134,7 +3134,7 @@ const assetInteractMessageV2ApiControllerGetSessionReport = (options) => {
 exports.assetInteractMessageV2ApiControllerGetSessionReport = assetInteractMessageV2ApiControllerGetSessionReport;
 /**
  * List cloud acquisition profiles
- * List Binalyze AIR cloud (M365) acquisition profiles via GET /api/v2/libraries/acquisition/cloud. Read-only and paginated. Each entity is a profile summary: id, name, organizationIds, averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. The m365UserBased/m365TenantWide evidence lists are NOT included; use air-acquisition-cloud-get for one profile's full config. Use this when the user asks to list or search cloud acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with empty organizationIds are global.
+ * List Binalyze AIR cloud (M365) acquisition profiles via GET /api/v2/libraries/acquisition/cloud. Read-only and paginated. Each entity is a profile summary: id, name, organizations[{id,name}], averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. The m365UserBased/m365TenantWide evidence lists are NOT included; use air-acquisition-cloud-get for one profile's full config. Use this when the user asks to list or search cloud acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with an empty organizations array are global.
  */
 const cloudAcquisitionLibraryApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -3157,7 +3157,7 @@ const cloudAcquisitionLibraryApiControllerList = (options) => {
 exports.cloudAcquisitionLibraryApiControllerList = cloudAcquisitionLibraryApiControllerList;
 /**
  * Create cloud acquisition profile
- * Create a Binalyze AIR cloud (M365) acquisition profile via POST /api/v2/libraries/acquisition/cloud. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. `name` (alphanumeric) plus BOTH m365UserBased and m365TenantWide blocks are required; each block is {evidenceList: string[]} and at least one evidence must be selected across the two blocks. Evidence keys are lowercase M365 collector names, e.g. user-based: outlookmails, onedrive, teams, teamschat, calendar, mfa, user; tenant-wide: ual, adminauditlog, azureadaccountlogon, sharepoint, exchangeadmin, riskyusers. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-cloud-get for the full list of valid evidence keys.
+ * Create a Binalyze AIR cloud (M365) acquisition profile via POST /api/v2/libraries/acquisition/cloud. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. `name` (alphanumeric) plus BOTH m365UserBased and m365TenantWide blocks are required; each block is {evidenceList: string[]} and at least one evidence must be selected across the two blocks. Body `organizationIds` controls which organizations own the profile; common query `organizations`, `orgs`, and `org` parameters are rejected. Evidence keys are lowercase M365 collector names, e.g. user-based: outlookmails, onedrive, teams, teamschat, calendar, mfa, user; tenant-wide: ual, adminauditlog, azureadaccountlogon, sharepoint, exchangeadmin, riskyusers. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-cloud-get for the full list of valid evidence keys.
  */
 const cloudAcquisitionLibraryApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -3234,7 +3234,7 @@ const cloudAcquisitionLibraryApiControllerDelete = (options) => {
 exports.cloudAcquisitionLibraryApiControllerDelete = cloudAcquisitionLibraryApiControllerDelete;
 /**
  * Get cloud acquisition profile by id or name
- * Get ONE Binalyze AIR cloud (M365) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/cloud/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizationIds, m365UserBased.evidenceList, m365TenantWide.evidenceList, deletable, and timestamps. Use this when the user asks to show or inspect a cloud acquisition profile's evidence selection, to clone one, or to discover valid M365 evidence keys. Ids and exact names come from air-acquisition-cloud-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
+ * Get ONE Binalyze AIR cloud (M365) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/cloud/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizations[{id,name}], m365UserBased.evidenceList, m365TenantWide.evidenceList, deletable, and timestamps. Use this when the user asks to show or inspect a cloud acquisition profile's evidence selection, to clone one, or to discover valid M365 evidence keys. Ids and exact names come from air-acquisition-cloud-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
  */
 const cloudAcquisitionLibraryApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -3284,7 +3284,7 @@ const cloudAcquisitionLibraryApiControllerUpdate = (options) => {
 exports.cloudAcquisitionLibraryApiControllerUpdate = cloudAcquisitionLibraryApiControllerUpdate;
 /**
  * List disk image acquisition profiles
- * List Binalyze AIR disk-image acquisition profiles via GET /api/v2/libraries/acquisition/disk-image. Read-only and paginated. Requires the image-evidence-acquisition feature to be enabled on the Console. Each entity is a profile summary: id, name, organizationIds, averageTime, createdAt/updatedAt, createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. allFiles/paths/evidence config is NOT included; use air-acquisition-disk-image-get for one profile's full config. Use this when the user asks to list or search disk-image (forensic imaging) profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdAt, updatedAt, lastUsedAt, createdBy, lastUsedBy (default createdAt). Profiles with empty organizationIds are global.
+ * List Binalyze AIR disk-image acquisition profiles via GET /api/v2/libraries/acquisition/disk-image. Read-only and paginated. Requires the image-evidence-acquisition feature to be enabled on the Console. Each entity is a profile summary: id, name, organizations[{id,name}], averageTime, createdAt/updatedAt, createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. allFiles/paths/evidence config is NOT included; use air-acquisition-disk-image-get for one profile's full config. Use this when the user asks to list or search disk-image (forensic imaging) profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdAt, updatedAt, lastUsedAt, createdBy, lastUsedBy (default createdAt). Profiles with an empty organizations array are global.
  */
 const diskImageAcquisitionLibraryApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -3307,7 +3307,7 @@ const diskImageAcquisitionLibraryApiControllerList = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerList = diskImageAcquisitionLibraryApiControllerList;
 /**
  * Create disk image acquisition profile
- * Create a Binalyze AIR disk-image acquisition profile via POST /api/v2/libraries/acquisition/disk-image. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. Requires the image-evidence-acquisition feature to be enabled on the Console. `name` is required (alphanumeric). Scope is either allFiles=true (full image) OR a `paths` list of directories/files to image; the allFiles/paths combination must be consistent (a profile cannot have both allFiles=true and paths). `imageAcquisitionEvidences` optionally selects extra evidence to collect alongside the image. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-disk-image-get when cloning or when unsure of valid evidence keys.
+ * Create a Binalyze AIR disk-image acquisition profile via POST /api/v2/libraries/acquisition/disk-image. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. Requires the image-evidence-acquisition feature to be enabled on the Console. `name` is required (alphanumeric). Scope is either allFiles=true (full image) OR a `paths` list of directories/files to image; the allFiles/paths combination must be consistent (a profile cannot have both allFiles=true and paths). `imageAcquisitionEvidences` optionally selects extra evidence to collect alongside the image. Body `organizationIds` controls which organizations own the profile; common query `organizations`, `orgs`, and `org` parameters are rejected. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-disk-image-get when cloning or when unsure of valid evidence keys.
  */
 const diskImageAcquisitionLibraryApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -3384,7 +3384,7 @@ const diskImageAcquisitionLibraryApiControllerDelete = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerDelete = diskImageAcquisitionLibraryApiControllerDelete;
 /**
  * Get disk image acquisition profile by id or name
- * Get ONE Binalyze AIR disk-image acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/disk-image/{idOrName}. Read-only. Requires the image-evidence-acquisition feature to be enabled on the Console. Returns the full profile detail in entities[0]: id, name, organizationIds, allFiles, paths[] ({path, description}), imageAcquisitionEvidences, deletable, and timestamps. Use this when the user asks to show or inspect a disk-image profile's scope, or to clone one. Ids and exact names come from air-acquisition-disk-image-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
+ * Get ONE Binalyze AIR disk-image acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/disk-image/{idOrName}. Read-only. Requires the image-evidence-acquisition feature to be enabled on the Console. Returns the full profile detail in entities[0]: id, name, organizations[{id,name}], allFiles, paths[] ({path, description}), imageAcquisitionEvidences, deletable, and timestamps. Use this when the user asks to show or inspect a disk-image profile's scope, or to clone one. Ids and exact names come from air-acquisition-disk-image-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
  */
 const diskImageAcquisitionLibraryApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({