@binalyze/air-sdk 5.23.0 → 5.25.1

package/dist/sdk/typescript-axios-v2/sdk.gen.js

@@ -2,9 +2,9 @@
 // @ts-nocheck
 // This file is auto-generated by @hey-api/openapi-ts
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.interactLibrarySnippetV2ApiControllerList = exports.caseV2ApiControllerUpdateCase = exports.caseV2ApiControllerGetCaseByIdOrName = exports.caseV2ApiControllerCreateCase = exports.caseV2ApiControllerFilterCases = exports.caseActionV2ApiControllerRemoveAssets = exports.caseActionV2ApiControllerArchive = exports.caseActionV2ApiControllerReopen = exports.caseActionV2ApiControllerClose = exports.caseTaskAssignmentV2ApiControllerRemoveTaskAssignment = exports.caseTaskAssignmentV2ApiControllerImportTaskAssignments = exports.caseTaskAssignmentV2ApiControllerFilterTaskAssignments = exports.caseNoteV2ApiControllerUpdateNote = exports.caseNoteV2ApiControllerDeleteNote = exports.caseNoteV2ApiControllerCreateNote = exports.caseNoteV2ApiControllerFilterNotes = exports.caseTaskV2ApiControllerFilterTasks = exports.caseUserV2ApiControllerFilterUsers = exports.caseAssetV2ApiControllerFilterAssets = exports.caseBulkActionV2ApiControllerArchive = exports.caseBulkActionV2ApiControllerClose = exports.caseExportV2ApiControllerExportCases = exports.caseActivityV2ApiControllerFilterCaseActivities = exports.caseActivityV2ApiControllerFilterGlobalActivities = exports.triageLibraryExportV2ApiControllerDownload = exports.triageLibraryExportV2ApiControllerExport = exports.triageLibraryV2ApiControllerUpdate = exports.triageLibraryV2ApiControllerGet = exports.triageLibraryV2ApiControllerDelete = exports.triageLibraryV2ApiControllerValidate = exports.triageLibraryV2ApiControllerBulkDelete = exports.triageLibraryV2ApiControllerCreate = exports.triageLibraryV2ApiControllerList = exports.acquisitionLibraryDeviceV2ApiControllerUpdate = exports.acquisitionLibraryDeviceV2ApiControllerGet = exports.acquisitionLibraryDeviceV2ApiControllerDelete = exports.acquisitionLibraryDeviceV2ApiControllerBulkDelete = exports.acquisitionLibraryDeviceV2ApiControllerCreate = exports.acquisitionLibraryDeviceV2ApiControllerList = exports.tasksTriageV2ApiControllerDeleteOne = exports.tasksTriageV2ApiControllerCancelOne = exports.tasksTriageV2ApiControllerDelete = exports.tasksTriageV2ApiControllerCancel = exports.tasksTriageV2ApiControllerListHuntTasks = exports.tasksV2ApiControllerListTaskAssignments = exports.tasksV2ApiControllerListTaskAssets = exports.tasksV2ApiControllerUpdateTask = exports.tasksV2ApiControllerGetTaskById = exports.openApiAliasV2ApiControllerGet = exports.capabilitiesV2ApiControllerGet = void 0;
-exports.assetBulkMetadataV2ApiControllerImportOffNetworkPpc = exports.assetBulkMetadataV2ApiControllerDeleteAssets = exports.assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = exports.assetBulkMetadataV2ApiControllerSetConnectionRoute = exports.assetBulkMetadataV2ApiControllerSetUpdateExclusion = exports.assetBulkMetadataV2ApiControllerRemoveTags = exports.assetBulkMetadataV2ApiControllerAddTags = exports.assetBulkActionV2ApiControllerDisableMaintenance = exports.assetBulkActionV2ApiControllerEnableMaintenance = exports.assetBulkActionV2ApiControllerVersionUpdate = exports.assetBulkActionV2ApiControllerRetrieveLogs = exports.assetBulkActionV2ApiControllerUnisolate = exports.assetBulkActionV2ApiControllerIsolate = exports.assetBulkActionV2ApiControllerShutdown = exports.assetBulkActionV2ApiControllerReboot = exports.assetActionV2ApiControllerImportPpcToExistingAsset = exports.assetActionV2ApiControllerDisableMaintenance = exports.assetActionV2ApiControllerEnableMaintenance = exports.assetActionV2ApiControllerVersionUpdate = exports.assetActionV2ApiControllerRetrieveLogs = exports.assetActionV2ApiControllerUnisolate = exports.assetActionV2ApiControllerIsolate = exports.assetActionV2ApiControllerShutdown = exports.assetActionV2ApiControllerReboot = exports.investigationSqlV2ApiControllerExecuteSqlQuery = exports.investigationSqlV2ApiControllerGetSchema = exports.investigationEvidenceFlagV2ApiControllerUnflagEvidence = exports.investigationEvidenceFlagV2ApiControllerFlagEvidence = exports.flagsLibraryV2ApiControllerUpdate = exports.flagsLibraryV2ApiControllerGet = exports.flagsLibraryV2ApiControllerDelete = exports.flagsLibraryV2ApiControllerCreate = exports.flagsLibraryV2ApiControllerList = exports.interactCommandV2ApiControllerList = exports.interactLibraryFileV2ApiControllerDownload = exports.interactLibraryFileV2ApiControllerDelete = exports.interactLibraryFileV2ApiControllerBulkDelete = exports.interactLibraryFileV2ApiControllerUpload = exports.interactLibraryFileV2ApiControllerList = exports.interactLibraryTagV2ApiControllerUpdate = exports.interactLibraryTagV2ApiControllerGet = exports.interactLibraryTagV2ApiControllerDelete = exports.interactLibraryTagV2ApiControllerBulkDelete = exports.interactLibraryTagV2ApiControllerCreate = exports.interactLibraryTagV2ApiControllerList = exports.interactLibrarySnippetV2ApiControllerUpdate = exports.interactLibrarySnippetV2ApiControllerGet = exports.interactLibrarySnippetV2ApiControllerDelete = exports.interactLibrarySnippetV2ApiControllerBulkDelete = exports.interactLibrarySnippetV2ApiControllerCreate = void 0;
-exports.diskImageAcquisitionLibraryApiControllerUpdate = exports.diskImageAcquisitionLibraryApiControllerGet = exports.diskImageAcquisitionLibraryApiControllerDelete = exports.diskImageAcquisitionLibraryApiControllerBulkDelete = exports.diskImageAcquisitionLibraryApiControllerCreate = exports.diskImageAcquisitionLibraryApiControllerList = exports.cloudAcquisitionLibraryApiControllerUpdate = exports.cloudAcquisitionLibraryApiControllerGet = exports.cloudAcquisitionLibraryApiControllerDelete = exports.cloudAcquisitionLibraryApiControllerBulkDelete = exports.cloudAcquisitionLibraryApiControllerCreate = exports.cloudAcquisitionLibraryApiControllerList = exports.assetInteractMessageV2ApiControllerGetSessionReport = exports.assetInteractMessageV2ApiControllerDownloadMessageOutput = exports.assetInteractMessageV2ApiControllerGetMessage = exports.assetInteractMessageV2ApiControllerListSessionsForAsset = exports.assetAcquisitionV2ApiControllerFilterAcquisitionTasks = exports.assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = exports.assetAcquisitionV2ApiControllerCancelAcquisition = exports.assetAcquisitionV2ApiControllerAcquire = exports.assetTriageV2ApiControllerDeleteTriageAssignment = exports.assetTriageV2ApiControllerCancelTriage = exports.assetTriageV2ApiControllerRunTriage = exports.assetTriageV2ApiControllerFilterTriageTasks = exports.assetV2ApiControllerUpdateLabel = exports.assetV2ApiControllerReplaceTags = exports.assetV2ApiControllerGetAsset = exports.assetV2ApiControllerDeleteAsset = exports.assetV2ApiControllerFilterAssets = exports.assetV2ApiControllerExportAssets = exports.assetV2ApiControllerGetStats = exports.assetInteractV2ApiControllerCloseSession = exports.assetInteractV2ApiControllerCancelCommand = exports.assetInteractV2ApiControllerRunCommand = exports.assetInteractMessageV2ApiControllerListForAsset = exports.assetBulkTriageV2ApiControllerRunTriage = void 0;
+exports.caseV2ApiControllerCreateCase = exports.caseV2ApiControllerFilterCases = exports.caseActionV2ApiControllerRemoveAssets = exports.caseActionV2ApiControllerArchive = exports.caseActionV2ApiControllerReopen = exports.caseActionV2ApiControllerClose = exports.caseTaskAssignmentV2ApiControllerRemoveTaskAssignment = exports.caseTaskAssignmentV2ApiControllerImportTaskAssignments = exports.caseTaskAssignmentV2ApiControllerFilterTaskAssignments = exports.caseNoteV2ApiControllerUpdateNote = exports.caseNoteV2ApiControllerDeleteNote = exports.caseNoteV2ApiControllerCreateNote = exports.caseNoteV2ApiControllerFilterNotes = exports.caseTaskV2ApiControllerFilterTasks = exports.caseUserV2ApiControllerFilterUsers = exports.caseAssetV2ApiControllerFilterAssets = exports.caseBulkActionV2ApiControllerArchive = exports.caseBulkActionV2ApiControllerClose = exports.caseExportV2ApiControllerExportCases = exports.caseActivityV2ApiControllerFilterCaseActivities = exports.caseActivityV2ApiControllerFilterGlobalActivities = exports.organizationV2ApiControllerGetOrganizationByIdOrName = exports.organizationV2ApiControllerListOrganizations = exports.organizationUserV2ApiControllerListOrganizationUsers = exports.triageLibraryExportV2ApiControllerDownload = exports.triageLibraryExportV2ApiControllerExport = exports.triageLibraryV2ApiControllerUpdate = exports.triageLibraryV2ApiControllerGet = exports.triageLibraryV2ApiControllerDelete = exports.triageLibraryV2ApiControllerValidate = exports.triageLibraryV2ApiControllerBulkDelete = exports.triageLibraryV2ApiControllerCreate = exports.triageLibraryV2ApiControllerList = exports.acquisitionLibraryDeviceV2ApiControllerUpdate = exports.acquisitionLibraryDeviceV2ApiControllerGet = exports.acquisitionLibraryDeviceV2ApiControllerDelete = exports.acquisitionLibraryDeviceV2ApiControllerBulkDelete = exports.acquisitionLibraryDeviceV2ApiControllerCreate = exports.acquisitionLibraryDeviceV2ApiControllerList = exports.tasksTriageV2ApiControllerDeleteOne = exports.tasksTriageV2ApiControllerCancelOne = exports.tasksTriageV2ApiControllerDelete = exports.tasksTriageV2ApiControllerCancel = exports.tasksTriageV2ApiControllerListHuntTasks = exports.tasksV2ApiControllerListTaskAssignments = exports.tasksV2ApiControllerListTaskAssets = exports.tasksV2ApiControllerUpdateTask = exports.tasksV2ApiControllerGetTaskById = exports.openApiAliasV2ApiControllerGet = exports.capabilitiesV2ApiControllerGet = void 0;
+exports.assetBulkMetadataV2ApiControllerSetConnectionRoute = exports.assetBulkMetadataV2ApiControllerSetUpdateExclusion = exports.assetBulkMetadataV2ApiControllerRemoveTags = exports.assetBulkMetadataV2ApiControllerAddTags = exports.assetBulkActionV2ApiControllerDisableMaintenance = exports.assetBulkActionV2ApiControllerEnableMaintenance = exports.assetBulkActionV2ApiControllerVersionUpdate = exports.assetBulkActionV2ApiControllerRetrieveLogs = exports.assetBulkActionV2ApiControllerUnisolate = exports.assetBulkActionV2ApiControllerIsolate = exports.assetBulkActionV2ApiControllerShutdown = exports.assetBulkActionV2ApiControllerReboot = exports.assetActionV2ApiControllerImportPpcToExistingAsset = exports.assetActionV2ApiControllerDisableMaintenance = exports.assetActionV2ApiControllerEnableMaintenance = exports.assetActionV2ApiControllerVersionUpdate = exports.assetActionV2ApiControllerRetrieveLogs = exports.assetActionV2ApiControllerUnisolate = exports.assetActionV2ApiControllerIsolate = exports.assetActionV2ApiControllerShutdown = exports.assetActionV2ApiControllerReboot = exports.investigationSqlV2ApiControllerExecuteSqlQuery = exports.investigationSqlV2ApiControllerGetSchema = exports.investigationEvidenceFlagV2ApiControllerUnflagEvidence = exports.investigationEvidenceFlagV2ApiControllerFlagEvidence = exports.flagsLibraryV2ApiControllerUpdate = exports.flagsLibraryV2ApiControllerGet = exports.flagsLibraryV2ApiControllerDelete = exports.flagsLibraryV2ApiControllerCreate = exports.flagsLibraryV2ApiControllerList = exports.interactCommandV2ApiControllerList = exports.interactLibraryFileV2ApiControllerDownload = exports.interactLibraryFileV2ApiControllerDelete = exports.interactLibraryFileV2ApiControllerBulkDelete = exports.interactLibraryFileV2ApiControllerUpload = exports.interactLibraryFileV2ApiControllerList = exports.interactLibraryTagV2ApiControllerUpdate = exports.interactLibraryTagV2ApiControllerGet = exports.interactLibraryTagV2ApiControllerDelete = exports.interactLibraryTagV2ApiControllerBulkDelete = exports.interactLibraryTagV2ApiControllerCreate = exports.interactLibraryTagV2ApiControllerList = exports.interactLibrarySnippetV2ApiControllerUpdate = exports.interactLibrarySnippetV2ApiControllerGet = exports.interactLibrarySnippetV2ApiControllerDelete = exports.interactLibrarySnippetV2ApiControllerBulkDelete = exports.interactLibrarySnippetV2ApiControllerCreate = exports.interactLibrarySnippetV2ApiControllerList = exports.caseV2ApiControllerUpdateCase = exports.caseV2ApiControllerGetCaseByIdOrName = void 0;
+exports.diskImageAcquisitionLibraryApiControllerUpdate = exports.diskImageAcquisitionLibraryApiControllerGet = exports.diskImageAcquisitionLibraryApiControllerDelete = exports.diskImageAcquisitionLibraryApiControllerBulkDelete = exports.diskImageAcquisitionLibraryApiControllerCreate = exports.diskImageAcquisitionLibraryApiControllerList = exports.cloudAcquisitionLibraryApiControllerUpdate = exports.cloudAcquisitionLibraryApiControllerGet = exports.cloudAcquisitionLibraryApiControllerDelete = exports.cloudAcquisitionLibraryApiControllerBulkDelete = exports.cloudAcquisitionLibraryApiControllerCreate = exports.cloudAcquisitionLibraryApiControllerList = exports.assetInteractMessageV2ApiControllerGetSessionReport = exports.assetInteractMessageV2ApiControllerDownloadMessageOutput = exports.assetInteractMessageV2ApiControllerGetMessage = exports.assetInteractMessageV2ApiControllerListSessionsForAsset = exports.assetAcquisitionV2ApiControllerFilterAcquisitionTasks = exports.assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = exports.assetAcquisitionV2ApiControllerCancelAcquisition = exports.assetAcquisitionV2ApiControllerAcquire = exports.assetTriageV2ApiControllerDeleteTriageAssignment = exports.assetTriageV2ApiControllerCancelTriage = exports.assetTriageV2ApiControllerRunTriage = exports.assetTriageV2ApiControllerFilterTriageTasks = exports.assetV2ApiControllerUpdateLabel = exports.assetV2ApiControllerReplaceTags = exports.assetV2ApiControllerGetAsset = exports.assetV2ApiControllerDeleteAsset = exports.assetV2ApiControllerFilterAssets = exports.assetV2ApiControllerExportAssets = exports.assetV2ApiControllerGetStats = exports.assetInteractV2ApiControllerCloseSession = exports.assetInteractV2ApiControllerCancelCommand = exports.assetInteractV2ApiControllerRunCommand = exports.assetInteractMessageV2ApiControllerListForAsset = exports.assetBulkTriageV2ApiControllerRunTriage = exports.assetBulkMetadataV2ApiControllerImportOffNetworkPpc = exports.assetBulkMetadataV2ApiControllerDeleteAssets = exports.assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = void 0;
 const client_1 = require("./client");
 const client_gen_1 = require("./client.gen");
 /**
@@ -36,6 +36,7 @@ exports.capabilitiesV2ApiControllerGet = capabilitiesV2ApiControllerGet;
  */
 const openApiAliasV2ApiControllerGet = (options) => {
     return (options?.client ?? client_gen_1.client).get({
+        responseType: 'json',
         security: [
             {
                 scheme: 'bearer',
@@ -54,7 +55,7 @@ const openApiAliasV2ApiControllerGet = (options) => {
 exports.openApiAliasV2ApiControllerGet = openApiAliasV2ApiControllerGet;
 /**
  * Get task by id
- * Fetch one Binalyze AIR task by UUID using GET /api/v2/tasks/{taskId}. Type-independent: works for triage, acquisition, interactShell and other task types. The response wraps the single task in result.entities[0] and is polymorphic: it carries a type/subtype discriminator plus only the matching domain block (triage{} / acquisition{} / interactShell{}); other blocks are absent, not null. It also returns counts{assigned,completed,failed,cancelled}, organization{id,name}, cases[], schedule (null when not scheduled) and taskAssignments{taskAssignmentCount,taskAssignmentsUrl}. Use air-tasks-assignments for the full per-endpoint assignment list and air-tasks-assets for the targeted assets. Only a task UUID is accepted; names and hostnames are rejected. A 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe), so do not infer the task does not exist.
+ * Fetches one task by UUID, regardless of task type (triage, acquisition, interactShell, ...). Returns the task in `result.entities[0]` with status counts, owning organizations, linked cases, schedule and the type-specific domain block.
  */
 const tasksV2ApiControllerGetTaskById = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -77,7 +78,7 @@ const tasksV2ApiControllerGetTaskById = (options) => {
 exports.tasksV2ApiControllerGetTaskById = tasksV2ApiControllerGetTaskById;
 /**
  * Update a task (rename + schedule; dryRun query preview)
- * Update one Binalyze AIR task via PATCH /api/v2/tasks/{taskId}. MUTATING. Send only the fields the user wants to change. Scheduled tasks (status=scheduled) accept all fields: taskName, caseIdOrName, schedule, ruleIds (triage), assets, profileIdOrName (acquisition), mitreEnabled, droneEnabled, eventLogRecordsConfig, cpuLimit, imageOptions (image acquisition). Tasks in any other status (processing, assigned, completed, cancelled, failed) accept only taskName and caseIdOrName; every other field is NOT applied -- the call still returns 200 but the field comes back in skippedFields (e.g. 'cpuLimit cannot be updated for processing task; skipped'). This is by design, not an error: a running task cannot change its execution config. When skippedFields is non-empty, tell the user which fields were skipped and why, and that scheduled-only fields require the task to be in status=scheduled (check with air-tasks-get first if unsure). Unschedule is forbidden: never send schedule=null; to stop a task use the hunt cancel/delete tools instead. Renaming to the same name fails 400. An empty body returns errors[0] NOTHING_CHANGED. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe). The success response returns the updated task in result.entities[0], same shape as air-tasks-get.
+ * Updates one task; send only the fields to change. Tasks in `scheduled` status accept the full field set (name, case link, schedule and execution config); tasks in any other status accept only `taskName` and `caseIdOrName`, and other fields are skipped and reported in the errors list. Returns the updated task in `result.entities[0]`.
  */
 const tasksV2ApiControllerUpdateTask = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -104,7 +105,7 @@ const tasksV2ApiControllerUpdateTask = (options) => {
 exports.tasksV2ApiControllerUpdateTask = tasksV2ApiControllerUpdateTask;
 /**
  * List a task assets
- * List the assets targeted by one Binalyze AIR task using GET /api/v2/tasks/{taskId}/assets. Paginated; entities use the same shape as GET /api/v2/assets (endpoint block with platform, onlineStatus, lastSeen, etc.). Use this when the user asks which hosts/assets a task ran on or targets; this is the resolver for the assetsUrl field seen in task and hunt list responses. It does NOT include per-asset assignment status or progress; for that use air-tasks-assignments. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe). Placeholder defaults such as pageNumber=1 or pageSize=20 are ignored.
+ * Lists the assets targeted by one task. Supports offset pagination and the same `filter[field]` querying as GET /api/v2/assets; entities use the asset shape from that endpoint. Per-asset assignment status lives on the task-assignments endpoint instead.
  */
 const tasksV2ApiControllerListTaskAssets = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -127,7 +128,7 @@ const tasksV2ApiControllerListTaskAssets = (options) => {
 exports.tasksV2ApiControllerListTaskAssets = tasksV2ApiControllerListTaskAssets;
 /**
  * List a task assignments
- * List the per-endpoint task assignments of one Binalyze AIR task using GET /api/v2/tasks/{taskId}/task-assignments. Paginated; this is the resolver for the taskAssignmentsUrl field in task detail responses. Each entity carries id, taskId, name, type, endpointId, endpointName, status, progress, hasDroneData, durations, metadata, organization{id,name}, response and cases[]. Use this when the user wants per-host progress, per-host status, or which endpoints completed/failed for a task; use air-tasks-assets for asset details instead. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe). Placeholder defaults such as pageNumber=1 are ignored.
+ * Lists the per-endpoint task assignments of one task. Supports offset pagination and `filter[field]` querying; each entity carries the assignment status, progress, durations, endpoint reference, organizations and linked cases.
  */
 const tasksV2ApiControllerListTaskAssignments = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -150,7 +151,7 @@ const tasksV2ApiControllerListTaskAssignments = (options) => {
 exports.tasksV2ApiControllerListTaskAssignments = tasksV2ApiControllerListTaskAssignments;
 /**
  * List hunt (triage) tasks
- * List Binalyze AIR hunt (triage) tasks using GET /api/v2/hunt. Hunt is the public v2 alias for triage tasks; the list is task-centric and paginated. Each entity carries id, taskName, status, rules[] enriched as {id,name,engine}, totalMatched, assignment counters, assets{assetCount,assetsUrl}, schedule, createdBy and timestamps. Use this when the user asks to list hunts, triage tasks, IOC/YARA scans, or wants to find a hunt task id before cancelling or deleting it. The taskId values returned here feed air-tasks-get, air-hunt-cancel, air-hunt-delete and the bulk variants. Placeholder defaults such as pageNumber=1 are ignored; sortBy accepts only createdAt, taskName, status, assignmentCount.
+ * Lists hunt (triage) tasks — IOC/YARA/Sigma scans — as a task-centric paginated list scoped by `organizations`. Each entry carries the task status, enriched rules, match totals, assignment counters, schedule and timestamps. Supports offset pagination, `filter[field]` querying and whitelisted sorting; task ids from this list feed the single-task cancel and delete endpoints.
  */
 const tasksTriageV2ApiControllerListHuntTasks = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -173,7 +174,7 @@ const tasksTriageV2ApiControllerListHuntTasks = (options) => {
 exports.tasksTriageV2ApiControllerListHuntTasks = tasksTriageV2ApiControllerListHuntTasks;
 /**
  * Bulk cancel hunt (triage) tasks (body dryRun preview)
- * Cancel one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/cancel. MUTATING: cancels ALL active assignments of each task across all its assets; cancellation is queued asynchronously and an abort signal is sent to the agents. Task records and downloaded data are kept (use air-hunt-bulk-delete to remove them). taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and cancels EVERY active (scheduled/assigned/processing) hunt task in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists; confirm with the user before using it. dryRun defaults to true: the preview (200) returns result.entities[] = {taskId, taskName, willCancelAssignmentCount, status} without cancelling anything. ALWAYS run the preview first and show the user what would be cancelled; pass dryRun=false only after the user explicitly confirms the exact task list. The real cancel returns cancelledAssignmentCount and status 'cancelling' instead. Both forms include warnings[] for skipped tasks (e.g. already in a terminal state). 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-cancel, which returns a leak-safe 404 for unknown ids.
+ * Cancels one or more hunt (triage) tasks by id, or every active hunt task in the given organization scope when `all=true`. Cancellation is queued asynchronously across all assigned assets; task records and downloaded data are kept. Set `dryRun=true` to preview the affected tasks and assignment counts without cancelling anything.
  */
 const tasksTriageV2ApiControllerCancel = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -200,7 +201,7 @@ const tasksTriageV2ApiControllerCancel = (options) => {
 exports.tasksTriageV2ApiControllerCancel = tasksTriageV2ApiControllerCancel;
 /**
  * Bulk delete hunt (triage) tasks (body dryRun preview)
- * Delete one or more Binalyze AIR hunt (triage) tasks via POST /api/v2/hunt/delete. DESTRUCTIVE and irreversible: removes the task records, ALL assignments, and downloaded files/artifacts; nothing remains in history. Active tasks additionally get an agent cancel signal. Use air-hunt-bulk-cancel to merely stop tasks while keeping records. taskIds takes task UUIDs from air-hunt-list. Setting all=true sends taskIds='all' and deletes EVERY hunt task (active and finished) in the required organizations scope -- body organizations (ids/names or "all") is REQUIRED for taskIds='all' and optional for explicit id lists. dryRun defaults to true: the preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS run the preview first and show the user what would be deleted; pass dryRun=false only after the user explicitly confirms the exact task list. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 400 'No matching tasks found' means no given id resolved to an accessible hunt task. For a single task prefer air-hunt-delete (leak-safe 404).
+ * Deletes one or more hunt (triage) tasks by id, or every hunt task in the given organization scope when `all=true`. Deletion is irreversible: task records, all assignments and downloaded artifacts are removed, and active tasks are cancelled on the agents. Set `dryRun=true` to preview the affected tasks and assets without deleting anything.
  */
 const tasksTriageV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -227,7 +228,7 @@ const tasksTriageV2ApiControllerDelete = (options) => {
 exports.tasksTriageV2ApiControllerDelete = tasksTriageV2ApiControllerDelete;
 /**
  * Cancel a single hunt (triage) task (dryRun query preview)
- * Cancel a single Binalyze AIR hunt (triage) task via POST /api/v2/hunt/{taskId}/cancel. MUTATING: cancels ALL active assignments of this task across all its assets; cancellation is queued asynchronously and an abort signal is sent to the agents. The task record and downloaded data are kept (use air-hunt-delete to remove them). Use this when the user wants to stop exactly one hunt/triage task; use air-hunt-bulk-cancel for several tasks at once. The taskId comes from air-hunt-list or air-tasks-get. Success (200) returns result.entities[] = {taskId, taskName, cancelledAssignmentCount, status} plus warnings[] (e.g. skipped when nothing is active). 404 'Task not found' also covers hunt tasks outside the caller's organizations (leak-safe); it does not necessarily mean the id is wrong.
+ * Cancels a single hunt (triage) task, stopping all of its active assignments across assets; cancellation is queued asynchronously. The task record and downloaded data are kept. Set `dryRun=true` to preview the effect without cancelling.
  */
 const tasksTriageV2ApiControllerCancelOne = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -250,7 +251,7 @@ const tasksTriageV2ApiControllerCancelOne = (options) => {
 exports.tasksTriageV2ApiControllerCancelOne = tasksTriageV2ApiControllerCancelOne;
 /**
  * Delete a single hunt (triage) task (dryRun query preview)
- * Delete a single Binalyze AIR hunt (triage) task via POST /api/v2/hunt/{taskId}/delete. DESTRUCTIVE and irreversible: removes the task record, ALL its assignments, and downloaded files/artifacts; nothing remains in history. An active task additionally gets an agent cancel signal. Use air-hunt-cancel to merely stop the task while keeping records. Use this for exactly one task; use air-hunt-bulk-delete for several tasks at once. The taskId comes from air-hunt-list or air-tasks-get. dryRun defaults to true and is sent as the ?dryRun=true query parameter: the preview (200) returns result.entities[] = {taskId, taskName, willDeleteAssignmentCount, affectedAssets[], status, createdAt} without deleting anything. ALWAYS preview first and show the user; pass dryRun=false only after the user explicitly confirms this exact task. The real delete returns deletedAssignmentCount instead of willDeleteAssignmentCount. 404 'Task not found' also covers tasks outside the caller's organizations (leak-safe).
+ * Deletes a single hunt (triage) task, irreversibly removing its record, all of its assignments and any downloaded artifacts; an active task is also cancelled on the agents. Set `dryRun=true` to preview the affected assignments and assets without deleting anything.
  */
 const tasksTriageV2ApiControllerDeleteOne = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -273,7 +274,7 @@ const tasksTriageV2ApiControllerDeleteOne = (options) => {
 exports.tasksTriageV2ApiControllerDeleteOne = tasksTriageV2ApiControllerDeleteOne;
 /**
  * List device acquisition profiles
- * List Binalyze AIR device (evidence) acquisition profiles via GET /api/v2/libraries/acquisition/device. Read-only and paginated. Each entity is a profile summary: id, name, organizationIds, averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. Per-OS configs (windows/linux/macos/aix/eDiscovery) are NOT included; use air-acquisition-device-get for one profile's full config. Use this when the user asks to list or search evidence acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with empty organizationIds are global.
+ * Lists device (evidence) acquisition profiles as paginated summary rows scoped by `organizations`, with `filter[field]` querying and sorting by name, createdBy, createdAt, lastUsedAt or lastUsedBy. Each row carries id, name, organizations, usage metadata and a detailsUrl; per-OS configs are returned by the single-profile endpoint.
  */
 const acquisitionLibraryDeviceV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -296,7 +297,7 @@ const acquisitionLibraryDeviceV2ApiControllerList = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerList = acquisitionLibraryDeviceV2ApiControllerList;
 /**
  * Create device acquisition profile
- * Create a Binalyze AIR device (evidence) acquisition profile via POST /api/v2/libraries/acquisition/device. MUTATING: persists a new profile in the acquisition library. Returns 200 with entities[0] = the created profile detail. `name` is required (alphanumeric) plus at least one config block: windows, linux, macos, aix (each with evidenceList/artifactList/customContentProfiles/networkCapture) or eDiscovery ({patterns:[{pattern,category}]}). Any subset of OS blocks is accepted. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Get the exact evidence/artifact keys from an existing profile (air-acquisition-device-get) when cloning or when unsure of valid values.
+ * Creates a device (evidence) acquisition profile from a required `name` plus at least one config block: windows, linux, macos, aix or eDiscovery. Body `organizationIds` controls which organizations own the profile. With dryRun=true (the default) the request is only validated and the would-be profile is returned without persisting; a real create returns the profile detail in entities[0].
  */
 const acquisitionLibraryDeviceV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -323,7 +324,7 @@ const acquisitionLibraryDeviceV2ApiControllerCreate = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerCreate = acquisitionLibraryDeviceV2ApiControllerCreate;
 /**
  * Bulk delete device acquisition profiles
- * Bulk delete Binalyze AIR device (evidence) acquisition profiles via POST /api/v2/libraries/acquisition/device/delete. MUTATING and irreversible. Resolution is tolerant: unknown or ambiguous items are skipped and reported in warnings[] (action: 'skipped') instead of failing the whole request. Profiles referenced by running/scheduled tasks or system profiles are also skipped with a warning. dryRun DEFAULTS TO TRUE: the first call returns entities[] of what would be deleted; pass dryRun=false only to actually delete after the user confirms. A real delete returns deletedCount plus warnings[]. Use this for several profiles at once; use air-acquisition-device-delete for exactly one. Ids and exact names come from air-acquisition-device-list.
+ * Deletes several device (evidence) acquisition profiles in one request, resolving each item by UUID or exact name. Unknown, ambiguous, in-use or system profiles are skipped and reported in warnings[] instead of failing the batch. With dryRun=true (the default) the response previews what would be deleted; a real delete returns deletedCount plus warnings[].
  */
 const acquisitionLibraryDeviceV2ApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -350,7 +351,7 @@ const acquisitionLibraryDeviceV2ApiControllerBulkDelete = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerBulkDelete = acquisitionLibraryDeviceV2ApiControllerBulkDelete;
 /**
  * Delete device acquisition profile
- * Delete ONE Binalyze AIR device (evidence) acquisition profile via DELETE /api/v2/libraries/acquisition/device/{idOrName}. MUTATING and irreversible. A profile referenced by a still-running or scheduled acquisition task is protected: the API returns 400 PROFILE_IN_USE with the blocking task ids (completed/cancelled/failed tasks do not block). System (predefined) profiles return 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call returns what would be deleted without removing anything; pass dryRun=false only to actually delete after the user confirms. Use air-acquisition-device-bulk-delete for several profiles at once. The idOrName comes from air-acquisition-device-list or air-acquisition-device-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
+ * Deletes one device (evidence) acquisition profile by UUID or exact name. Profiles referenced by running or scheduled acquisition tasks are protected (400 PROFILE_IN_USE), and system profiles cannot be deleted (406 SYSTEM_PROFILE_IMMUTABLE). With dryRun=true (the default) the response shows what would be deleted without removing anything.
  */
 const acquisitionLibraryDeviceV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -373,7 +374,7 @@ const acquisitionLibraryDeviceV2ApiControllerDelete = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerDelete = acquisitionLibraryDeviceV2ApiControllerDelete;
 /**
  * Get device acquisition profile by id or name
- * Get ONE Binalyze AIR device (evidence) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/device/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizationIds, the per-OS configs (windows/linux/macos/aix with evidence and artifact lists), eDiscovery patterns, deletable, and timestamps. Use this when the user asks to show or inspect an evidence acquisition profile's contents, or to clone one. Ids and exact names come from air-acquisition-device-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
+ * Fetches one device (evidence) acquisition profile by UUID or exact name, returning the full detail in entities[0]: per-OS configs (windows, linux, macos, aix), eDiscovery patterns, organizations and timestamps. A name matching several profiles returns 400 AMBIGUOUS_NAME with candidates; an unknown identifier returns 404 with suggestions.
  */
 const acquisitionLibraryDeviceV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -396,7 +397,7 @@ const acquisitionLibraryDeviceV2ApiControllerGet = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerGet = acquisitionLibraryDeviceV2ApiControllerGet;
 /**
  * Update device acquisition profile
- * Update ONE Binalyze AIR device (evidence) acquisition profile via PATCH /api/v2/libraries/acquisition/device/{idOrName}. MUTATING partial update: only the fields you pass change; omitted fields keep their current value. Updatable fields: name, organizationIds, windows, linux, macos, aix, eDiscovery. Passing null for an OS block removes it; the merged profile must still keep at least one config block. Sending no updatable field returns NOTHING_CHANGED with result null. System (predefined) profiles cannot be updated: the API returns 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call previews the merged profile without persisting; pass dryRun=false only to actually update after the user confirms. The idOrName comes from air-acquisition-device-list or air-acquisition-device-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
+ * Partially updates one device (evidence) acquisition profile: only the provided fields (name, organizationIds, windows, linux, macos, aix, eDiscovery) change, and passing null removes an OS block. The merged profile must keep at least one config block, and system profiles cannot be updated. With dryRun=true (the default) the merged profile is previewed without persisting.
  */
 const acquisitionLibraryDeviceV2ApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -423,7 +424,7 @@ const acquisitionLibraryDeviceV2ApiControllerUpdate = (options) => {
 exports.acquisitionLibraryDeviceV2ApiControllerUpdate = acquisitionLibraryDeviceV2ApiControllerUpdate;
 /**
  * List triage rules
- * List Binalyze AIR triage rules (the triage library: YARA, Sigma, osquery IOC-scan rules) using GET /api/v2/libraries/triage. Read-only and paginated. Each entity is a rule summary: id, name, description, engine, searchIn flags, organizations [{id,name}], tags, author, createdAt/updatedAt/lastUsedAt. Rule content is NOT included; use air-triage-rules-get for one rule's body. Use this when the user asks to list triage/IOC rules, search the rule library, or needs a rule id or exact name before get, update, delete, or export. sortBy accepts only name, createdAt, updatedAt, lastUsedAt, author (default createdAt). Rules with an empty organizations list are global (visible to every org).
+ * Lists triage rules (YARA, Sigma and osquery) from the triage library, scoped by `organizations`. Supports offset pagination, whitelisted sorting and `filter[field]` querying. Each entry is a rule summary without the rule body.
  */
 const triageLibraryV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -446,7 +447,7 @@ const triageLibraryV2ApiControllerList = (options) => {
 exports.triageLibraryV2ApiControllerList = triageLibraryV2ApiControllerList;
 /**
  * Create triage rule
- * Create a Binalyze AIR triage rule (YARA, Sigma, or osquery IOC-scan rule) via POST /api/v2/libraries/triage. MUTATING: persists a new rule in the triage library; the rule content is validated by the engine before saving and an invalid rule fails with 400. Only `rule` (the content) is required; name and engine are auto-detected from the content when omitted, and a name collision is resolved by suffixing (a warning reports the adjusted name). dryRun DEFAULTS TO TRUE: the first call returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Success returns entities[0] with the created rule detail plus warnings[] (e.g. name adjustments). Use air-triage-rules-validate to only check a rule without creating it.
+ * Creates a triage rule from the submitted rule content; the content is validated by its engine before saving, and name and engine are auto-detected when omitted. Supports a dry-run preview that returns the would-be rule without persisting it. Returns the created rule detail plus any warnings, such as name adjustments after a collision.
  */
 const triageLibraryV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -473,7 +474,7 @@ const triageLibraryV2ApiControllerCreate = (options) => {
 exports.triageLibraryV2ApiControllerCreate = triageLibraryV2ApiControllerCreate;
 /**
  * Bulk delete triage rules
- * Bulk delete Binalyze AIR triage rules via POST /api/v2/libraries/triage/delete. MUTATING and irreversible: removes every resolved rule and its stored content from the triage library. Resolution is tolerant: rules that cannot be found are skipped and reported in warnings[] instead of failing the whole request. dryRun DEFAULTS TO TRUE: the first call previews what would be deleted; pass dryRun=false only to actually delete after the user confirms. Use this for several rules at once; use air-triage-rules-delete for exactly one. Rule ids and exact names come from air-triage-rules-list. Success returns deletedCount plus warnings[] (skipped or unresolved rules).
+ * Deletes several triage rules in one request, identified by UUID or exact name in the `rules` body field. Rules that cannot be resolved are skipped and reported as warnings, and a dry-run preview lists what would be deleted. Returns the number of deleted rules.
  */
 const triageLibraryV2ApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -500,7 +501,7 @@ const triageLibraryV2ApiControllerBulkDelete = (options) => {
 exports.triageLibraryV2ApiControllerBulkDelete = triageLibraryV2ApiControllerBulkDelete;
 /**
  * Validate triage rule
- * Validate a Binalyze AIR triage rule (YARA, Sigma, or osquery) via POST /api/v2/libraries/triage/validate. Read-only: nothing is persisted, so there is no dryRun flag. The engine is auto-detected from the rule content when omitted; passing a wrong engine returns a 400 INVALID_ENGINE with the detected engine under errors[0].details.suggestions. osquery rules must be read-only SELECT statements against known tables. Use this before air-triage-rules-create or air-triage-rules-update when the user wants to check a rule, or to identify which engine a rule belongs to. Success returns entities[0] = {valid: true, engine} plus warnings[]; an invalid rule fails with a 400 envelope describing the syntax problem.
+ * Validates triage rule content (YARA, Sigma or osquery) without persisting anything. The engine is auto-detected when omitted; a valid rule returns the detected engine and any advisories, while an invalid rule fails with a 400 error describing the problem.
  */
 const triageLibraryV2ApiControllerValidate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -527,7 +528,7 @@ const triageLibraryV2ApiControllerValidate = (options) => {
 exports.triageLibraryV2ApiControllerValidate = triageLibraryV2ApiControllerValidate;
 /**
  * Delete triage rule
- * Delete ONE Binalyze AIR triage rule via DELETE /api/v2/libraries/triage/{idOrName}. MUTATING and irreversible: removes the rule and its stored content from the triage library. dryRun DEFAULTS TO TRUE: the first call returns what would be deleted without removing anything; pass dryRun=false only to actually delete after the user confirms. Use air-triage-rules-bulk-delete for several rules at once. The idOrName comes from air-triage-rules-list or air-triage-rules-get. Success returns entities[0] = {id, name} of the deleted rule. 404 also covers rules outside the caller's organization scope (leak-safe); it does not necessarily mean the id is wrong.
+ * Deletes one triage rule identified by UUID or exact name, removing the rule and its stored content from the triage library. A dry-run preview returns what would be deleted without removing anything; a real deletion returns the id and name of the deleted rule.
  */
 const triageLibraryV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -550,7 +551,7 @@ const triageLibraryV2ApiControllerDelete = (options) => {
 exports.triageLibraryV2ApiControllerDelete = triageLibraryV2ApiControllerDelete;
 /**
  * Get triage rule by id or name
- * Get ONE Binalyze AIR triage rule (YARA/Sigma/osquery IOC-scan rule) by UUID or exact name via GET /api/v2/libraries/triage/{idOrName}. Read-only. Returns the full rule detail in entities[0]: id, name, description, engine, searchIn flags, the rule content (body), organizations [{id,name}], tags, author and timestamps. Use this when the user asks to show, inspect, or read a triage rule's content. Rule ids and exact names come from air-triage-rules-list. 404 also covers rules outside the caller's organization scope (leak-safe); the response may include a did-you-mean suggestion when the name is close to an existing rule.
+ * Fetches one triage rule by UUID or exact name, including the rule content, engine, searchIn flags, organizations, tags and timestamps. A rule outside the caller's organization scope returns 404, possibly with a did-you-mean suggestion.
  */
 const triageLibraryV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -573,7 +574,7 @@ const triageLibraryV2ApiControllerGet = (options) => {
 exports.triageLibraryV2ApiControllerGet = triageLibraryV2ApiControllerGet;
 /**
  * Update triage rule
- * Update ONE Binalyze AIR triage rule via PATCH /api/v2/libraries/triage/{idOrName}. MUTATING partial update: only the fields you pass change; omitted fields keep their current value. The engine cannot be changed (create a new rule instead). A changed rule body is re-validated by its engine before saving; an invalid rule fails with 400. `tags` REPLACES the whole tag set. Sending no updatable field returns a NOTHING_CHANGED error. dryRun DEFAULTS TO TRUE: the first call previews the resulting rule without persisting; pass dryRun=false only to actually update after the user confirms. The idOrName comes from air-triage-rules-list or air-triage-rules-get. Success returns entities[0] with the updated rule detail plus warnings[]. 404 also covers rules outside the caller's organization scope (leak-safe).
+ * Applies a partial update to one triage rule identified by UUID or exact name: only the submitted fields change, `tags` replaces the whole tag set, and the engine cannot be modified. A changed rule body is re-validated before saving, and a dry-run preview of the resulting rule is supported. Returns the updated rule detail plus any warnings.
  */
 const triageLibraryV2ApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -600,7 +601,7 @@ const triageLibraryV2ApiControllerUpdate = (options) => {
 exports.triageLibraryV2ApiControllerUpdate = triageLibraryV2ApiControllerUpdate;
 /**
  * Export triage rules to an off-network package
- * Export Binalyze AIR triage rules into an off-network triage package via POST /api/v2/libraries/triage/export. MUTATING: generates a package file on the Console that bundles the selected rules for offline (off-network) triage of air-gapped endpoints. Resolution is STRICT: any rule that cannot be found fails the whole request with 400 plus name suggestions (unlike bulk delete, which skips). dryRun DEFAULTS TO TRUE: the first call lists what would be exported without generating a package; pass dryRun=false only to actually export after the user confirms. Success returns entities[0] = {fileName, downloadUrl, binaryOptions[]}; feed fileName into air-triage-rules-export-download to fetch the package. Use this when the user wants an offline/off-network triage package of specific rules. Rule ids and exact names come from air-triage-rules-list.
+ * Bundles the selected triage rules into an off-network package for offline triage of air-gapped endpoints. Rules are resolved strictly, so any rule that cannot be found fails the request; with dryRun=true (the default) the response previews what would be exported instead of generating a package. A real export returns the generated file name, its download URL and the available agent binary options.
  */
 const triageLibraryExportV2ApiControllerExport = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -627,10 +628,11 @@ const triageLibraryExportV2ApiControllerExport = (options) => {
 exports.triageLibraryExportV2ApiControllerExport = triageLibraryExportV2ApiControllerExport;
 /**
  * Download an exported off-network package
- * Download a previously exported off-network triage package via GET /api/v2/libraries/triage/export/download and save it inside the current worktree. Read-only on the server side. The fileName comes from air-triage-rules-export (its downloadUrl carries the same value); this tool streams the archive to disk and returns {fileName, outputPath, byteLength}. Optionally embed agent binaries for specific platforms (binaries[]) and MITRE ATT&CK rules (mitre=true) into the package. Use this right after air-triage-rules-export when the user wants the actual package file. Packages can expire; a 404 may mean the export must be re-run.
+ * Streams a previously exported off-network triage package as a zip download. The fileName query parameter identifies the package generated by the export endpoint; agent binaries for selected platforms and MITRE ATT&CK rules can optionally be embedded into the package.
  */
 const triageLibraryExportV2ApiControllerDownload = (options) => {
     return (options.client ?? client_gen_1.client).get({
+        responseType: 'blob',
         security: [
             {
                 in: 'cookie',
@@ -647,9 +649,78 @@ const triageLibraryExportV2ApiControllerDownload = (options) => {
     });
 };
 exports.triageLibraryExportV2ApiControllerDownload = triageLibraryExportV2ApiControllerDownload;
+/**
+ * List users of an organization
+ * Lists users assigned to one caller-visible organization selected by numeric id or case-insensitive exact name. The result uses the canonical v2 user shape, including role privilege metadata, authentication posture, last-login and online-presence fields. Organization references on each user are clipped to organizations the caller can access, preventing membership disclosure across organization boundaries. Use filter[searchTerm] to search username and email; the response is classified as PII on agent-facing surfaces.
+ */
+const organizationUserV2ApiControllerListOrganizationUsers = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/organizations/{idOrName}/users',
+        ...options
+    });
+};
+exports.organizationUserV2ApiControllerListOrganizationUsers = organizationUserV2ApiControllerListOrganizationUsers;
+/**
+ * List organizations
+ * Lists the organizations visible to the caller using offset pagination. Use organizations to narrow the caller-accessible scope by numeric id or exact name; omitting it selects all accessible organizations. Each result maps the internal _id to id, excludes the deployment credential, and includes totalEndpoints for inventory sizing. filter[name] performs a case-insensitive name contains match, while filter[searchTerm] searches name, owner, and an exact numeric id.
+ */
+const organizationV2ApiControllerListOrganizations = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/organizations',
+        ...options
+    });
+};
+exports.organizationV2ApiControllerListOrganizations = organizationV2ApiControllerListOrganizations;
+/**
+ * Get organization by id or name
+ * Returns one caller-visible organization selected by numeric id or case-insensitive exact name. The response excludes the deployment credential and reports endpoint totals plus total, open, closed, and archived case counts. An inaccessible organization is returned as a leak-safe 404. A numeric miss has no suggestions; a name miss may include ranked suggestions drawn only from organizations visible to the caller.
+ */
+const organizationV2ApiControllerGetOrganizationByIdOrName = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/organizations/{idOrName}',
+        ...options
+    });
+};
+exports.organizationV2ApiControllerGetOrganizationByIdOrName = organizationV2ApiControllerGetOrganizationByIdOrName;
 /**
  * List case activities across visible cases
- * List the GLOBAL Binalyze AIR case audit feed across all visible cases using GET /api/v2/cases/activities. Read-only, paginated. Each row carries id, caseId, type (event class name like CaseNoteAddedEvent), performedBy, raw data{} payload, a computed description and timestamps. caseIds filter accepts case UUIDs or names (inclusive match). For the activities of ONE known case prefer air-cases-case-activities. Use this to audit who did what across cases, e.g. all activity by a user or all case closures in a time window.
+ * Lists the global audit activity feed across all cases visible to the caller, with offset pagination and optional filters over case, type, performer, time window and free text. Each row carries the activity type, the user who performed it, the raw event payload and a computed description. Set format=csv to stream the feed as CSV.
  */
 const caseActivityV2ApiControllerFilterGlobalActivities = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -672,7 +743,7 @@ const caseActivityV2ApiControllerFilterGlobalActivities = (options) => {
 exports.caseActivityV2ApiControllerFilterGlobalActivities = caseActivityV2ApiControllerFilterGlobalActivities;
 /**
  * List activities for case
- * List the audit activity feed of ONE Binalyze AIR case using GET /api/v2/cases/{idOrName}/activities. Read-only, paginated. Each row carries id, type (event class name like CaseNoteAddedEvent), performedBy, raw data{} payload, a computed description and timestamps. The path accepts a case UUID or exact case name. For a feed across multiple cases use air-cases-activities (the global feed) instead. Use this to reconstruct the timeline of a case: who closed it, which notes and assets were added, and when.
+ * Lists the audit activity feed of one case identified by UUID or exact name, with offset pagination and optional filters over type, performer, time window and free text. Each row carries the activity type, the user who performed it, the raw event payload and a computed description.
  */
 const caseActivityV2ApiControllerFilterCaseActivities = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -695,7 +766,7 @@ const caseActivityV2ApiControllerFilterCaseActivities = (options) => {
 exports.caseActivityV2ApiControllerFilterCaseActivities = caseActivityV2ApiControllerFilterCaseActivities;
 /**
  * Export cases
- * Export Binalyze AIR cases to a file via GET /api/v2/cases/export and save it inside the current worktree. Read-only on the server side; no dryRun needed. format=csv (default) saves a text/csv file; format=json saves an application/zip archive containing cases.json (the newest 10000 matching cases, with a TRUNCATED warning when more matched). The filter model mirrors air-cases-list (name substring, status, searchTerm). Returns {format, outputPath, byteLength}. Use air-cases-list instead when the user just wants to read cases in the chat.
+ * Exports the cases matching the filter as a downloadable file. format=csv (default) streams a text/csv file; format=json streams an application/zip archive containing cases.json with up to the newest 10000 matching cases. The filter model matches GET /api/v2/cases.
  */
 const caseExportV2ApiControllerExportCases = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -718,7 +789,7 @@ const caseExportV2ApiControllerExportCases = (options) => {
 exports.caseExportV2ApiControllerExportCases = caseExportV2ApiControllerExportCases;
 /**
  * Close cases in bulk
- * Close MULTIPLE Binalyze AIR cases in one call via POST /api/v2/cases/close. MUTATING, partial success: eligible cases close, ineligible ones (already closed/archived, not found) surface as warnings[] instead of failing the request. dryRun DEFAULTS TO TRUE: the first call returns a would-close preview plus skip warnings; pass dryRun=false only after the user confirms the case list. Target cases by id or name in cases[], or set cases="all" to close every open case in the required organizations scope (deliberate action; organizations must be provided — ids/names or "all"; confirm with the user first). For exactly one case prefer air-cases-close, which also accepts closure report summaries.
+ * Closes multiple cases in one request, targeted by ids or names in cases[] or by cases="all" within an organization scope. Eligible cases are closed and skipped ones are reported in warnings[] (partial success); a dryRun preview of the affected cases is supported.
  */
 const caseBulkActionV2ApiControllerClose = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -745,7 +816,7 @@ const caseBulkActionV2ApiControllerClose = (options) => {
 exports.caseBulkActionV2ApiControllerClose = caseBulkActionV2ApiControllerClose;
 /**
  * Archive cases in bulk
- * Archive MULTIPLE Binalyze AIR cases in one call via POST /api/v2/cases/archive. MUTATING and effectively FINAL: lifecycle is open -> closed -> archived and there is NO unarchive. Only closed cases are eligible; open or already-archived cases surface as warnings[] (partial success). dryRun DEFAULTS TO TRUE: the first call returns a would-archive preview plus skip warnings; pass dryRun=false only after the user confirms the case list. Target cases by id or name in cases[], or set cases="all" to archive every closed case in the required organizations scope (deliberate action; organizations must be provided — ids/names or "all"; confirm with the user first). For exactly one case prefer air-cases-archive.
+ * Archives multiple closed cases in one request, targeted by ids or names in cases[] or by cases="all" within an organization scope. Only closed cases are eligible; skipped cases are reported in warnings[] (partial success) and a dryRun preview is supported. Archiving cannot be undone.
  */
 const caseBulkActionV2ApiControllerArchive = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -772,7 +843,7 @@ const caseBulkActionV2ApiControllerArchive = (options) => {
 exports.caseBulkActionV2ApiControllerArchive = caseBulkActionV2ApiControllerArchive;
 /**
  * List assets linked to case
- * List the assets linked to a Binalyze AIR case using GET /api/v2/cases/{idOrName}/assets. Read-only, paginated; returns full canonical v2 asset entities (nested endpoint{} block) for every asset attached to the case. Use this to see which endpoints belong to a case, to pick asset ids for air-cases-remove-assets, or before acting on the case's machines with the asset tools. The path accepts a case UUID or exact case name. JSON only (the API's format=csv variant is not exposed here; use air-cases-export for file exports).
+ * Lists the assets linked to one case identified by UUID or exact name, returning full v2 asset entities with offset pagination and an optional endpoint filter. Set format=csv to stream the linked assets as CSV instead of JSON.
  */
 const caseAssetV2ApiControllerFilterAssets = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -795,7 +866,7 @@ const caseAssetV2ApiControllerFilterAssets = (options) => {
 exports.caseAssetV2ApiControllerFilterAssets = caseAssetV2ApiControllerFilterAssets;
 /**
  * List users for case
- * List the users who can participate in a Binalyze AIR case using GET /api/v2/cases/{idOrName}/users. Read-only, paginated; the organization scope derives from the case itself. Each entity carries id, username, email, roles[] with privileges, organizations[] as {id,name} refs, admin flags (isGlobalAdmin, isOrganizationAdmin), tfaEnabled, lastLogin and onlineStatus. Use this to find valid usernames or user UUIDs before setting a case owner or assignedUsers via air-cases-create / air-cases-update. The path accepts a case UUID or exact case name.
+ * Lists the users who can participate in one case identified by UUID or exact name, with offset pagination and a searchTerm filter over username and email. Each entity carries roles with privileges, organization references, admin flags and login and presence details; the organization scope derives from the case itself.
  */
 const caseUserV2ApiControllerFilterUsers = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -818,7 +889,7 @@ const caseUserV2ApiControllerFilterUsers = (options) => {
 exports.caseUserV2ApiControllerFilterUsers = caseUserV2ApiControllerFilterUsers;
 /**
  * List task assignments for case
- * List the tasks of a Binalyze AIR case using GET /api/v2/cases/{idOrName}/tasks. Read-only, paginated and ASSIGNMENT-CENTRIC: one task assigned to N assets yields N rows, each with taskId, taskName, taskType, per-asset status and endpoint fields. result.metadata.creators summarizes the unique task creators across the case. The taskId values feed air-tasks-get; assignment rows relate to air-cases-task-assignments-list. The path accepts a case UUID or exact case name. Use this to see what work (triage, acquisition, interact) ran under a case and its per-asset outcome.
+ * Lists the tasks of one case identified by UUID or exact name as assignment-centric rows: a task assigned to N assets yields N rows with per-asset status and endpoint fields. The paginated result also carries a metadata.creators summary of the unique task creators across the case.
  */
 const caseTaskV2ApiControllerFilterTasks = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -841,7 +912,7 @@ const caseTaskV2ApiControllerFilterTasks = (options) => {
 exports.caseTaskV2ApiControllerFilterTasks = caseTaskV2ApiControllerFilterTasks;
 /**
  * List case notes
- * List the notes of a Binalyze AIR case using GET /api/v2/cases/{idOrName}/notes. Read-only, paginated. Each entity carries id, note (the text), writtenBy{id,username,email,profile}, writtenAt and timestamps. The path accepts a case UUID or exact case name. The note id values feed air-cases-notes-update and air-cases-notes-delete. Use this to read the investigation notes of a case or to find a note before editing or deleting it.
+ * Lists the notes of a case identified by UUID or exact case name. Read-only and paginated; supports filtering by writer and free-text search over the note body. Each note carries its id, text, writer details and timestamps.
  */
 const caseNoteV2ApiControllerFilterNotes = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -864,7 +935,7 @@ const caseNoteV2ApiControllerFilterNotes = (options) => {
 exports.caseNoteV2ApiControllerFilterNotes = caseNoteV2ApiControllerFilterNotes;
 /**
  * Create case note
- * Add a note to a Binalyze AIR case via POST /api/v2/cases/{idOrName}/notes. MUTATING. The case must be OPEN; notes cannot be added to closed or archived cases. dryRun DEFAULTS TO TRUE: the first call returns a would-create preview without persisting; pass dryRun=false only after the user confirms. The created note comes back in result.entities[0] with id, note, writtenBy{} and timestamps. The path accepts a case UUID or exact case name; the note text is limited to 10000 characters.
+ * Adds a note to an open case identified by UUID or exact case name; the note text is limited to 10000 characters. With dryRun=true the response is a would-create preview and nothing is persisted; otherwise the created note is returned in `result.entities[0]`.
  */
 const caseNoteV2ApiControllerCreateNote = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -891,7 +962,7 @@ const caseNoteV2ApiControllerCreateNote = (options) => {
 exports.caseNoteV2ApiControllerCreateNote = caseNoteV2ApiControllerCreateNote;
 /**
  * Delete case note
- * Delete one note of a Binalyze AIR case via DELETE /api/v2/cases/{idOrName}/notes/{noteId}. MUTATING and IRREVERSIBLE once executed. The case must be OPEN and deletion is restricted to the note's author or an authorized manager. dryRun DEFAULTS TO TRUE: the first call returns a would-delete preview without removing anything; pass dryRun=false only after the user explicitly confirms. The path accepts a case UUID or exact case name plus the note UUID from air-cases-notes-list.
+ * Deletes one note from an open case; deletion is restricted to the note's author or an authorized manager and is irreversible once executed. With dryRun=true the response is a would-delete preview and nothing is removed; otherwise a deletion receipt is returned in `result.entities[0]`.
  */
 const caseNoteV2ApiControllerDeleteNote = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -914,7 +985,7 @@ const caseNoteV2ApiControllerDeleteNote = (options) => {
 exports.caseNoteV2ApiControllerDeleteNote = caseNoteV2ApiControllerDeleteNote;
 /**
  * Update case note
- * Edit one note of a Binalyze AIR case via PATCH /api/v2/cases/{idOrName}/notes/{noteId}. MUTATING; the note text is fully replaced. The case must be OPEN and only the note's author (or an authorized manager) may edit it. dryRun DEFAULTS TO TRUE: the first call returns a would-update preview without persisting; pass dryRun=false only after the user confirms. The path accepts a case UUID or exact case name plus the note UUID from air-cases-notes-list. The updated note comes back in result.entities[0].
+ * Replaces the text of one note on an open case; only the note's author or an authorized manager may edit it. With dryRun=true the response is a would-update preview and nothing is persisted; otherwise the updated note is returned in `result.entities[0]`.
  */
 const caseNoteV2ApiControllerUpdateNote = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -941,7 +1012,7 @@ const caseNoteV2ApiControllerUpdateNote = (options) => {
 exports.caseNoteV2ApiControllerUpdateNote = caseNoteV2ApiControllerUpdateNote;
 /**
  * List task assignments for case
- * List the task assignments attached to a Binalyze AIR case using GET /api/v2/cases/{idOrName}/task-assignments. Read-only, paginated. Each entity carries id, taskId, taskName, taskType, per-asset status, asset{id,name}, hasDroneData, dataImportStatus, progress and timestamps. The id values feed air-cases-task-assignments-delete (detach) and are what air-cases-task-assignments-import adds. The path accepts a case UUID or exact case name. Use this to see which task results are part of the case evidence set.
+ * Lists the task assignments attached to one case identified by UUID or exact name, with offset pagination and filters over status, type, assets and data import state. Each entity carries the task reference, per-asset status, the targeted asset and timestamps.
  */
 const caseTaskAssignmentV2ApiControllerFilterTaskAssignments = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -964,7 +1035,7 @@ const caseTaskAssignmentV2ApiControllerFilterTaskAssignments = (options) => {
 exports.caseTaskAssignmentV2ApiControllerFilterTaskAssignments = caseTaskAssignmentV2ApiControllerFilterTaskAssignments;
 /**
  * Import task assignments into case
- * Import task assignments into a Binalyze AIR case via POST /api/v2/cases/{idOrName}/task-assignments/import. MUTATING with PARTIAL SUCCESS: eligible assignments are attached to the case, ineligible ones surface as skipped warnings[]. The case must be OPEN. dryRun DEFAULTS TO TRUE: the first call previews what would be imported plus warnings; pass dryRun=false only after the user confirms. Provide EXACTLY ONE source: taskId (imports that task's eligible assignments) or taskAssignmentIds (explicit assignment UUIDs). Optionally restrict to specific assets via assets[]. Get taskId from air-tasks-get / air-cases-tasks and assignment ids from air-tasks-assignments.
+ * Imports task assignments into an open case from either a task id or an explicit list of assignment ids, optionally restricted to specific assets. Eligible assignments are attached and ineligible ones are reported in warnings[] (partial success); a dryRun preview is supported.
  */
 const caseTaskAssignmentV2ApiControllerImportTaskAssignments = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -991,7 +1062,7 @@ const caseTaskAssignmentV2ApiControllerImportTaskAssignments = (options) => {
 exports.caseTaskAssignmentV2ApiControllerImportTaskAssignments = caseTaskAssignmentV2ApiControllerImportTaskAssignments;
 /**
  * Detach a task assignment from case
- * Detach ONE task assignment from a Binalyze AIR case via DELETE /api/v2/cases/{idOrName}/task-assignments/{taskAssignmentId}. MUTATING but non-destructive: it removes ONLY the case relation; the assignment and its task data are NOT deleted. The case must be OPEN. dryRun DEFAULTS TO TRUE: the first call returns a would-remove-from-case preview; pass dryRun=false only after the user confirms. Idempotent: deleting an assignment that is not attached returns deletedCount 0 with a skipped warning instead of failing. Get the assignment UUID from air-cases-task-assignments-list.
+ * Detaches one task assignment from an open case without deleting the assignment or its task data. The operation is idempotent and supports a dryRun preview; detaching an assignment that is not attached returns deletedCount 0 with a skipped warning.
  */
 const caseTaskAssignmentV2ApiControllerRemoveTaskAssignment = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -1014,7 +1085,7 @@ const caseTaskAssignmentV2ApiControllerRemoveTaskAssignment = (options) => {
 exports.caseTaskAssignmentV2ApiControllerRemoveTaskAssignment = caseTaskAssignmentV2ApiControllerRemoveTaskAssignment;
 /**
  * Close a case
- * Close ONE Binalyze AIR case via POST /api/v2/cases/{idOrName}/close. MUTATING. Only an open case can be closed; closed/archived cases are rejected with a lifecycle error. dryRun DEFAULTS TO TRUE: the first call returns a would-close preview without closing; pass dryRun=false only after the user confirms. reason is required (resolved, false-positive, duplicate, other) and the optional summary fields feed the closure report; the closed case comes back in result.entities[0] with a closure report URL. For two or more cases use air-cases-bulk-close instead.
+ * Closes an open case identified by id or name. Requires a closure `reason` (resolved, false-positive, duplicate, other); the optional summary fields feed the closure report. Returns the closed case, including a closure report URL, in `result.entities[0]`; with `dryRun` a would-close preview is returned instead.
  */
 const caseActionV2ApiControllerClose = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1041,7 +1112,7 @@ const caseActionV2ApiControllerClose = (options) => {
 exports.caseActionV2ApiControllerClose = caseActionV2ApiControllerClose;
 /**
  * Reopen a case
- * Reopen ONE closed Binalyze AIR case via POST /api/v2/cases/{idOrName}/open. MUTATING. Only a CLOSED case can be reopened; open and archived cases are rejected with a lifecycle error (archiving is final, there is no unarchive). dryRun DEFAULTS TO TRUE: the first call returns a would-open preview without reopening; pass dryRun=false only after the user confirms. The reopened case comes back in result.entities[0].
+ * Reopens a closed case identified by id or name; open and archived cases are rejected with a lifecycle error. Returns the reopened case in `result.entities[0]`; with `dryRun` a would-open preview is returned instead.
  */
 const caseActionV2ApiControllerReopen = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1064,7 +1135,7 @@ const caseActionV2ApiControllerReopen = (options) => {
 exports.caseActionV2ApiControllerReopen = caseActionV2ApiControllerReopen;
 /**
  * Archive a case
- * Archive ONE closed Binalyze AIR case via POST /api/v2/cases/{idOrName}/archive. MUTATING and FINAL: lifecycle is open -> closed -> archived and there is NO unarchive endpoint. Only a CLOSED case can be archived; open or already-archived cases are rejected with a lifecycle error. dryRun DEFAULTS TO TRUE: the first call returns a would-archive preview without archiving; pass dryRun=false only after the user explicitly confirms. The archived case comes back in result.entities[0]. For two or more cases use air-cases-bulk-archive instead.
+ * Archives a closed case identified by id or name. Archiving is the final lifecycle step (open, closed, archived) and cannot be undone; only a closed case can be archived. Returns the archived case in `result.entities[0]`; with `dryRun` a would-archive preview is returned instead.
  */
 const caseActionV2ApiControllerArchive = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1087,7 +1158,7 @@ const caseActionV2ApiControllerArchive = (options) => {
 exports.caseActionV2ApiControllerArchive = caseActionV2ApiControllerArchive;
 /**
  * Unlink assets from a case
- * Unlink assets from a Binalyze AIR case via POST /api/v2/cases/{idOrName}/remove-assets. MUTATING but non-destructive: it removes ONLY the case<->asset relation; the assets themselves are NOT deleted, purged or uninstalled. dryRun DEFAULTS TO TRUE: the first call previews which assets would be unlinked plus skip warnings; pass dryRun=false only after the user confirms. Target assets by id or name in assets[] (wins over filter), or with a filter JSON object matched against the assets linked to the case. Assets not attached to the case are skipped with a warning; the real run returns deletedCount.
+ * Unlinks assets from an open case without deleting the assets themselves. Target assets by id or name in `assets[]` (takes precedence) or with a `filter` object matched against the assets linked to the case; unmatched targets are skipped with a warning. Returns the number of removed case-asset relations in `deletedCount`; with `dryRun` the assets that would be unlinked are previewed instead.
  */
 const caseActionV2ApiControllerRemoveAssets = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1114,7 +1185,7 @@ const caseActionV2ApiControllerRemoveAssets = (options) => {
 exports.caseActionV2ApiControllerRemoveAssets = caseActionV2ApiControllerRemoveAssets;
 /**
  * List cases
- * List Binalyze AIR cases using GET /api/v2/cases. Read-only, paginated. Each entity uses object refs: owner{id,name}, organization{id,name}, category{id,name}, tags[], assignedUsers[], plus taskCounts{} and assets/taskAssignments {count,url} summaries. Lifecycle is open -> closed -> archived (no unarchive). Reference filters (owner, assignedUser, category, tags) accept a UUID or an exact name/username; name is a case-insensitive substring match. Use this to find a case id or name before calling air-cases-get, air-cases-update, air-cases-close or the case sub-resource tools. organizations defaults to all accessible organizations.
+ * Lists cases visible to the caller, scoped by `organizations`. Supports offset pagination, whitelisted sorting and `filter[field]` querying over name, status, owner, assigned user, visibility, category, tags, date ranges and a free-text search term. Start here to discover case ids for the single-case endpoints.
  */
 const caseV2ApiControllerFilterCases = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -1137,7 +1208,7 @@ const caseV2ApiControllerFilterCases = (options) => {
 exports.caseV2ApiControllerFilterCases = caseV2ApiControllerFilterCases;
 /**
  * Create a case
- * Create a single Binalyze AIR case via POST /api/v2/cases. MUTATING. dryRun DEFAULTS TO TRUE: the first call returns a would-create preview (resolved unique name, organization, warnings) without persisting; pass dryRun=false only after the user confirms. Reference fields (owner, organization, category, tags, assignedUsers) accept a UUID or an exact name/username and are resolved before creation. The case name cannot be UUID-shaped and is auto-suffixed on a name conflict. owner defaults to the caller and organization is defaulted for single-organization callers. The created case is returned in result.entities[0].
+ * Creates a case. Reference fields (owner, organization, category, tags, assignedUsers) accept a UUID or an exact name and are resolved before creation; the case name is auto-suffixed on a conflict. With dryRun=true the response is a would-create preview and nothing is persisted; otherwise the created case is returned in `result.entities[0]`.
  */
 const caseV2ApiControllerCreateCase = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1164,7 +1235,7 @@ const caseV2ApiControllerCreateCase = (options) => {
 exports.caseV2ApiControllerCreateCase = caseV2ApiControllerCreateCase;
 /**
  * Get case by id or name
- * Fetch one Binalyze AIR case by UUID or case name using GET /api/v2/cases/{idOrName}. Read-only; the case is wrapped in result.entities[0]. The entity uses object refs (owner{}, organization{}, category{}, tags[], assignedUsers[]), taskCounts{}, and assets/taskAssignments {count,url} summaries. Lifecycle status is open, closed or archived. A 404 also covers cases outside the caller's organizations (leak-safe), so do not infer the case does not exist. Use air-cases-list to discover ids and names first.
+ * Fetches one case by UUID or exact case name, returned in `result.entities[0]`. The entity carries object references (owner, organizations, category, tags, assigned users) plus task counts and asset/task-assignment summaries. Cases outside the caller's organizations answer with 404.
  */
 const caseV2ApiControllerGetCaseByIdOrName = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -1187,7 +1258,7 @@ const caseV2ApiControllerGetCaseByIdOrName = (options) => {
 exports.caseV2ApiControllerGetCaseByIdOrName = caseV2ApiControllerGetCaseByIdOrName;
 /**
  * Update a case
- * Partially update a Binalyze AIR case via PATCH /api/v2/cases/{idOrName}. MUTATING. dryRun DEFAULTS TO TRUE: the first call returns a would-update preview without persisting; pass dryRun=false only after the user confirms. Only supplied fields change. Owner change is folded into this endpoint (there is no separate change-owner endpoint). tags and metadata are a FULL REPLACE, not a merge; removeCategory=true clears the category. Reference fields (owner, assignedUsers, category, tags) accept a UUID or an exact name/username. If nothing effectively changes the API answers with a NOTHING_CHANGED error envelope.
+ * Partially updates an open case: only supplied fields change, tags and metadata are replaced wholesale, removeCategory=true clears the category, and owner changes go through this endpoint. With dryRun=true the response is a would-update preview; a no-op update answers with a NOTHING_CHANGED error envelope.
  */
 const caseV2ApiControllerUpdateCase = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -1214,7 +1285,7 @@ const caseV2ApiControllerUpdateCase = (options) => {
 exports.caseV2ApiControllerUpdateCase = caseV2ApiControllerUpdateCase;
 /**
  * List InterAct command snippets
- * List Binalyze AIR InterAct command snippets (reusable shell scripts in the InterAct library) using GET /api/v2/libraries/interact/snippets. Read-only and paginated. Each entity is a snippet summary: id, name, description, script, platforms, tags [{id,name}], organizations [{id,name}], origin (user or predefined), createdBy, createdAt/updatedAt. Use this when the user asks to list or search InterAct snippets/scripts, or needs a snippet id or exact name before get, update, or delete. sortBy accepts only name, createdAt, updatedAt (default name ASC). Predefined (system) snippets have origin=predefined and cannot be modified or deleted.
+ * Lists InterAct command snippets (reusable shell scripts) visible to the caller, scoped by `organizations`. Supports offset pagination, `filter[field]` querying and sorting by name, createdAt or updatedAt. Each entity carries the snippet's script, platforms, tags, organizations and origin.
  */
 const interactLibrarySnippetV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -1237,7 +1308,7 @@ const interactLibrarySnippetV2ApiControllerList = (options) => {
 exports.interactLibrarySnippetV2ApiControllerList = interactLibrarySnippetV2ApiControllerList;
 /**
  * Create InterAct command snippet
- * Create a Binalyze AIR InterAct command snippet (a reusable shell script in the InterAct library) via POST /api/v2/libraries/interact/snippets. MUTATING: persists a new snippet. `name` (max 255 alphanumeric chars, not UUID-shaped) and `script` (max 5000 chars) are required. Omitted platforms means all platforms. Omitted organizations auto-selects the caller's single accessible organization; multi-org and all-orgs callers must pass organizations explicitly (400 ORGANIZATION_REQUIRED). Unknown tag names are created in the shared InterAct tag store. A name collision within the target organizations is resolved by auto-suffixing; a warning reports the adjusted name. dryRun DEFAULTS TO TRUE: the first call previews the would-create entity (action='would-create', final name after suffixing) without persisting anything; pass dryRun=false only to actually create after the user confirms. Success returns entities[0] with the created snippet detail plus warnings[] (e.g. name adjustments).
+ * Creates a reusable InterAct command snippet from a `name` and `script`, with optional description, platforms, tags and organization scope. Name collisions are resolved by auto-suffixing and reported in `warnings[]`. Supports `dryRun` previews and returns the created snippet in `entities[0]`.
  */
 const interactLibrarySnippetV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1264,7 +1335,7 @@ const interactLibrarySnippetV2ApiControllerCreate = (options) => {
 exports.interactLibrarySnippetV2ApiControllerCreate = interactLibrarySnippetV2ApiControllerCreate;
 /**
  * Bulk delete InterAct command snippets
- * Bulk delete Binalyze AIR InterAct command snippets by id or name via POST /api/v2/libraries/interact/snippets/delete. MUTATING and irreversible. Targets that are unknown or predefined (system) are skipped and reported in warnings[]; the delete itself is all-or-nothing over the resolved targets (if one vanishes mid-delete, nothing is deleted and a warning explains it). dryRun DEFAULTS TO TRUE: the first call returns entities[] previews (action:'would-delete' per resolved snippet) plus warnings for skipped targets, without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns { deletedCount, warnings }. For a single snippet prefer air-interact-snippets-delete.
+ * Deletes several InterAct command snippets in one call, targeted by UUID or exact name. Unknown or predefined (system) targets are skipped and reported in `warnings[]`. Supports `dryRun` previews and returns the number of deleted snippets in `deletedCount`.
  */
 const interactLibrarySnippetV2ApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1291,7 +1362,7 @@ const interactLibrarySnippetV2ApiControllerBulkDelete = (options) => {
 exports.interactLibrarySnippetV2ApiControllerBulkDelete = interactLibrarySnippetV2ApiControllerBulkDelete;
 /**
  * Delete InterAct command snippet
- * Delete ONE Binalyze AIR InterAct command snippet by UUID or exact name via DELETE /api/v2/libraries/interact/snippets/{idOrName}. MUTATING and irreversible: removes the snippet record and its tag relations. Predefined (system, origin=predefined) snippets cannot be deleted and return an error. An unknown id or name returns 404. dryRun DEFAULTS TO TRUE: the first call returns entities[0] = { id, name, action:'would-delete', effects } without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns entities[0] = { id, name } of the deleted snippet. For deleting several snippets at once use air-interact-snippets-bulk-delete.
+ * Deletes one InterAct command snippet identified by UUID or exact name, removing the snippet record and its tag relations. Predefined (system) snippets cannot be deleted. Supports `dryRun` previews and returns the deleted snippet's id and name in `entities[0]`.
  */
 const interactLibrarySnippetV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -1314,7 +1385,7 @@ const interactLibrarySnippetV2ApiControllerDelete = (options) => {
 exports.interactLibrarySnippetV2ApiControllerDelete = interactLibrarySnippetV2ApiControllerDelete;
 /**
  * Get InterAct command snippet by id or name
- * Get ONE Binalyze AIR InterAct command snippet by UUID or exact name using GET /api/v2/libraries/interact/snippets/{idOrName}. Read-only. Returns entities[0] with the full snippet detail: id, name, description, script, platforms, tags [{id,name}], organizations [{id,name}], origin (user or predefined), createdBy, createdAt/updatedAt. Use this when the user asks for a specific snippet's script or metadata. An unknown id or name returns 404. If the name is not exact, use air-interact-snippets-list with a name filter first.
+ * Fetches one InterAct command snippet by UUID or exact name, returned in `entities[0]` with the snippet's script, platforms, tags, organizations and origin. An unknown id or name returns 404.
  */
 const interactLibrarySnippetV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -1337,7 +1408,7 @@ const interactLibrarySnippetV2ApiControllerGet = (options) => {
 exports.interactLibrarySnippetV2ApiControllerGet = interactLibrarySnippetV2ApiControllerGet;
 /**
  * Update InterAct command snippet
- * Update ONE Binalyze AIR InterAct command snippet by UUID or exact name via PATCH /api/v2/libraries/interact/snippets/{idOrName}. MUTATING, partial update: only the fields you pass are changed. Updatable fields: name, script, description, platforms, tags, organizations. Passing tags=[] clears all tags; passing organizations replaces the organization scope (requires authority over the current scope). Predefined (system, origin=predefined) snippets cannot be modified and return an error. Sending no updatable field returns HTTP 200 with success:false and a NOTHING_CHANGED error entry. dryRun DEFAULTS TO TRUE: the first call previews the would-update entity with changedFields without persisting; pass dryRun=false only to actually update after the user confirms. Success returns entities[0] with the updated snippet detail plus warnings[] (e.g. name auto-suffix on collision).
+ * Applies a partial update to one InterAct command snippet identified by UUID or exact name; only the provided fields (name, script, description, platforms, tags, organizations) change. Predefined (system) snippets cannot be modified. Supports `dryRun` previews and returns the updated snippet in `entities[0]`.
  */
 const interactLibrarySnippetV2ApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -1364,7 +1435,7 @@ const interactLibrarySnippetV2ApiControllerUpdate = (options) => {
 exports.interactLibrarySnippetV2ApiControllerUpdate = interactLibrarySnippetV2ApiControllerUpdate;
 /**
  * List InterAct command snippet tags
- * List Binalyze AIR InterAct snippet tags (the shared tag store of the InterAct library) using GET /api/v2/libraries/interact/tags. Read-only and paginated. Each entity is a tag: id, name, organizations [{id,name}], createdAt/updatedAt, and (with withCount=true) the number of snippets using it. Use this when the user asks to list or search InterAct tags, or needs a tag id or exact name before get, update, delete, or before tagging snippets. sortBy accepts only name, createdAt, updatedAt (default name ASC).
+ * Lists InterAct snippet tags (the shared tag store of the InterAct library) visible to the caller, scoped by `organizations`. Supports offset pagination, `filter[field]` querying and sorting by name, createdAt or updatedAt. Each entity carries the tag name, organizations and, with `filter[withCount]=true`, its snippet usage count.
  */
 const interactLibraryTagV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -1387,7 +1458,7 @@ const interactLibraryTagV2ApiControllerList = (options) => {
 exports.interactLibraryTagV2ApiControllerList = interactLibraryTagV2ApiControllerList;
 /**
  * Create InterAct command snippet tag
- * Create a Binalyze AIR InterAct snippet tag (in the shared tag store of the InterAct library) via POST /api/v2/libraries/interact/tags. MUTATING: persists a new tag. `name` (max 100 alphanumeric chars, not UUID-shaped) is required. Omitted organizations auto-selects the caller's single accessible organization; multi-org and all-orgs callers must pass organizations explicitly (400 ORGANIZATION_REQUIRED). A name collision within the target organizations is resolved by auto-suffixing; a warning reports the adjusted name. dryRun DEFAULTS TO TRUE: the first call previews the would-create entity (action='would-create', final name after suffixing) without persisting anything; pass dryRun=false only to actually create after the user confirms. Success returns entities[0] with the created tag plus warnings[]. Note: air-interact-snippets-create and -update also auto-create unknown tag names, so an explicit tag create is only needed when the user wants the tag itself.
+ * Creates an InterAct snippet tag in the shared tag store of the InterAct library from a `name`, with an optional organization scope. Name collisions are resolved by auto-suffixing and reported in `warnings[]`. Supports `dryRun` previews and returns the created tag in `entities[0]`.
  */
 const interactLibraryTagV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1414,7 +1485,7 @@ const interactLibraryTagV2ApiControllerCreate = (options) => {
 exports.interactLibraryTagV2ApiControllerCreate = interactLibraryTagV2ApiControllerCreate;
 /**
  * Bulk delete InterAct command snippet tags
- * Bulk delete Binalyze AIR InterAct snippet tags by id or name via POST /api/v2/libraries/interact/tags/delete. MUTATING and irreversible: removes the tag records and their snippet-tag relations (snippets themselves are kept). Targets that are unknown or system tags are skipped and reported in warnings[]; deletion is per-tag, so a tag already deleted concurrently counts as gone. dryRun DEFAULTS TO TRUE: the first call returns entities[] previews (action:'would-delete' per resolved tag) plus warnings for skipped targets, without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns { deletedCount, warnings }. For a single tag prefer air-interact-tags-delete.
+ * Deletes several InterAct snippet tags in one call, targeted by UUID or exact name. Deleting a tag removes its snippet-tag relations while keeping the snippets. Unknown or system targets are skipped and reported in `warnings[]`. Supports `dryRun` previews and returns the number of deleted tags in `deletedCount`.
  */
 const interactLibraryTagV2ApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1441,7 +1512,7 @@ const interactLibraryTagV2ApiControllerBulkDelete = (options) => {
 exports.interactLibraryTagV2ApiControllerBulkDelete = interactLibraryTagV2ApiControllerBulkDelete;
 /**
  * Delete InterAct command snippet tag
- * Delete ONE Binalyze AIR InterAct snippet tag by UUID or exact name via DELETE /api/v2/libraries/interact/tags/{idOrName}. MUTATING and irreversible: removes the tag record and its snippet-tag relations (snippets themselves are kept). System tags cannot be deleted and return an error. An unknown id or name returns 404. dryRun DEFAULTS TO TRUE: the first call returns entities[0] = { id, name, action:'would-delete', effects } without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns entities[0] = { id, name } of the deleted tag. For deleting several tags at once use air-interact-tags-bulk-delete.
+ * Deletes one InterAct snippet tag identified by UUID or exact name, removing its snippet-tag relations while keeping the snippets. System tags cannot be deleted. Supports `dryRun` previews and returns the deleted tag identity in `entities[0]`.
  */
 const interactLibraryTagV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -1464,7 +1535,7 @@ const interactLibraryTagV2ApiControllerDelete = (options) => {
 exports.interactLibraryTagV2ApiControllerDelete = interactLibraryTagV2ApiControllerDelete;
 /**
  * Get InterAct command snippet tag by id or name
- * Get ONE Binalyze AIR InterAct snippet tag by UUID or exact name using GET /api/v2/libraries/interact/tags/{idOrName}. Read-only. Returns entities[0] with the tag detail: id, name, organizations [{id,name}], snippet usage count, createdAt/updatedAt. Use this when the user asks about a specific InterAct tag. An unknown id or name returns 404. If the name is not exact, use air-interact-tags-list with a name filter first.
+ * Fetches one InterAct snippet tag by UUID or exact name, returned in `entities[0]` with the tag's name, organizations and snippet usage count. An unknown id or name returns 404.
  */
 const interactLibraryTagV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -1487,7 +1558,7 @@ const interactLibraryTagV2ApiControllerGet = (options) => {
 exports.interactLibraryTagV2ApiControllerGet = interactLibraryTagV2ApiControllerGet;
 /**
  * Update InterAct command snippet tag
- * Update ONE Binalyze AIR InterAct snippet tag by UUID or exact name via PATCH /api/v2/libraries/interact/tags/{idOrName}. MUTATING, partial update: only the fields you pass are changed. Updatable fields: name and organizations (replaces the current organization scope; requires authority over the current scope). System tags cannot be updated and return an error. Sending no updatable field returns HTTP 200 with success:false and a NOTHING_CHANGED error entry. dryRun DEFAULTS TO TRUE: the first call previews the would-update entity with changedFields without persisting; pass dryRun=false only to actually update after the user confirms. Success returns entities[0] with the updated tag plus warnings[] (e.g. name auto-suffix on collision).
+ * Applies a partial update to one InterAct snippet tag identified by UUID or exact name; only the provided fields (name, organizations) change. System tags cannot be modified. Supports `dryRun` previews and returns the updated tag in `entities[0]`.
  */
 const interactLibraryTagV2ApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -1514,7 +1585,7 @@ const interactLibraryTagV2ApiControllerUpdate = (options) => {
 exports.interactLibraryTagV2ApiControllerUpdate = interactLibraryTagV2ApiControllerUpdate;
 /**
  * List InterAct library files
- * List Binalyze AIR InterAct library files (binaries/scripts responders can download during a shell session) using GET /api/v2/libraries/interact/files. Read-only and paginated. Each entity is a file record: id, name, size, sha256, organizations [{id,name}], uploadedBy/uploadedAt, lastUsedBy/lastUsedAt. File CONTENT is not included; use air-interact-files-download for the bytes. Use this when the user asks to list or search InterAct library files, verify a file by sha256, or needs a file id or exact name before download or delete. searchTerm matches name or sha256 (contains, case-insensitive); sha256 is an exact full-hash lookup. sortBy accepts only name, size, uploadedAt, uploadedBy, lastUsedAt, lastUsedBy (default uploadedAt DESC).
+ * Lists InterAct library files (binaries and scripts responders can download during a shell session) visible to the caller, scoped by `organizations`. Supports offset pagination, `filter[field]` querying and sorting by name, size, uploadedAt, uploadedBy, lastUsedAt or lastUsedBy. Each entity carries the file's metadata (name, size, sha256, organizations, upload and last-use details); the file content itself is not included.
  */
 const interactLibraryFileV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -1537,7 +1608,7 @@ const interactLibraryFileV2ApiControllerList = (options) => {
 exports.interactLibraryFileV2ApiControllerList = interactLibraryFileV2ApiControllerList;
 /**
  * Upload InterAct library file
- * Upload a file into the Binalyze AIR InterAct library via POST /api/v2/libraries/interact/files (multipart field 'file'). MUTATING: persists the file so responders can download it during InterAct shell sessions. Limits: max 4 GB per upload and 20 GB total library size. A name collision within the target organizations is resolved by auto-suffixing; a warning reports the adjusted name. dryRun DEFAULTS TO TRUE: the first call previews the would-create entity (name, size, sha256) without persisting anything; pass dryRun=false only to actually upload after the user confirms. Success returns entities[0] with the file record (id, name, size, sha256, organizations) plus warnings[], and a Location header pointing at the new resource.
+ * Uploads a file into the InterAct library via a multipart request (field `file`) so responders can download it during shell sessions. Uploads are limited to 4 GB per file and 20 GB total library size; name collisions are resolved by auto-suffixing and reported in `warnings[]`. Supports `dryRun` previews and returns the stored file's metadata in `entities[0]` plus a Location header pointing at the new resource.
  */
 const interactLibraryFileV2ApiControllerUpload = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1565,7 +1636,7 @@ const interactLibraryFileV2ApiControllerUpload = (options) => {
 exports.interactLibraryFileV2ApiControllerUpload = interactLibraryFileV2ApiControllerUpload;
 /**
  * Bulk delete InterAct library files
- * Bulk delete Binalyze AIR InterAct library files by id or name via POST /api/v2/libraries/interact/files/delete. MUTATING and irreversible: removes the file records and their stored content. Unknown targets are skipped and reported in warnings[]; the delete itself is all-or-nothing over the resolved targets (if one vanishes mid-delete, nothing is deleted and a warning explains it). dryRun DEFAULTS TO TRUE: the first call returns entities[] previews (action:'would-delete' per resolved file) plus warnings for skipped targets, without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns { deletedCount, warnings }. For a single file prefer air-interact-files-delete.
+ * Deletes several InterAct library files in one call, targeted by UUID or exact name. Unknown targets are skipped and reported in `warnings[]`; the delete itself is all-or-nothing over the resolved targets. Supports `dryRun` previews and returns the number of deleted files in `deletedCount`.
  */
 const interactLibraryFileV2ApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1592,7 +1663,7 @@ const interactLibraryFileV2ApiControllerBulkDelete = (options) => {
 exports.interactLibraryFileV2ApiControllerBulkDelete = interactLibraryFileV2ApiControllerBulkDelete;
 /**
  * Delete InterAct library file
- * Delete ONE Binalyze AIR InterAct library file by UUID or exact name via DELETE /api/v2/libraries/interact/files/{idOrName}. MUTATING and irreversible: removes the library-file record, its file-info record, and the stored file content. An unknown id or name returns 404. dryRun DEFAULTS TO TRUE: the first call returns entities[0] = { id, name, action:'would-delete', effects } without deleting anything; pass dryRun=false only to actually delete after the user confirms. Success returns entities[0] = { id, name } of the deleted file. For deleting several files at once use air-interact-files-bulk-delete.
+ * Deletes one InterAct library file, targeted by UUID or exact name, removing the file record and its stored content. Supports `dryRun` previews and returns the deleted file's id and name in `entities[0]`. An unknown id or name returns 404.
  */
 const interactLibraryFileV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -1615,7 +1686,7 @@ const interactLibraryFileV2ApiControllerDelete = (options) => {
 exports.interactLibraryFileV2ApiControllerDelete = interactLibraryFileV2ApiControllerDelete;
 /**
  * Download InterAct library file by id or name
- * Download ONE Binalyze AIR InterAct library file by UUID or exact name via GET /api/v2/libraries/interact/files/{idOrName}. Read-only; the endpoint streams the file content as an attachment (it bypasses the JSON envelope). This tool saves the bytes to a file inside the current worktree (outputPath, default artifacts/interact-library-file.bin) and returns { outputPath, byteLength }; read the saved file for the content. Use air-interact-files-list first if you only need the file's size/sha256 metadata without downloading content. An unknown id or name returns 404. Library files can be forensic tooling or scripts; treat downloaded content carefully and do not execute it.
+ * Downloads the content of one InterAct library file, resolved by UUID or exact name and streamed as an `application/octet-stream` attachment rather than a JSON envelope. An unknown id or name returns 404.
  */
 const interactLibraryFileV2ApiControllerDownload = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -1638,7 +1709,7 @@ const interactLibraryFileV2ApiControllerDownload = (options) => {
 exports.interactLibraryFileV2ApiControllerDownload = interactLibraryFileV2ApiControllerDownload;
 /**
  * List native InterAct shell commands
- * List the AIR native InterAct shell commands (and their aliases, descriptions, usage) via GET /api/v2/interact/commands. Use this to GROUND command handling instead of guessing: before telling the user a command looks like a typo, call this tool (optionally with searchTerm) and suggest the closest real command name from `commandNames`. Note: a command that is NOT in this list is not necessarily invalid -- air-assets-interact-run also runs arbitrary shell commands. So only offer a "did you mean" when a close native match exists. Read-only.
+ * Lists the native InterAct shell commands built into the AIR agent, including their aliases, descriptions, and usage lines. An optional searchTerm narrows the list with a case-insensitive substring match on command names and aliases.
  */
 const interactCommandV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -1661,7 +1732,7 @@ const interactCommandV2ApiControllerList = (options) => {
 exports.interactCommandV2ApiControllerList = interactCommandV2ApiControllerList;
 /**
  * List investigation flags
- * List Binalyze AIR investigation flags (the shared evidence-flag library) using GET /api/v2/libraries/flags. Read-only and paginated. Each entity: numeric id, name, description, color, organizations [{ id, name }], createdBy, createdAt/updatedAt. filter[name] is a case-insensitive contains match; sortBy accepts name, createdAt, updatedAt (default name ASC). Use this to find a flag id or exact name before update/delete or before flagging evidence in an investigation.
+ * Lists the shared investigation flag library, scoped by `organizations`. Supports offset pagination, a case-insensitive `filter[name]` contains match and sorting by name, createdAt or updatedAt (default name ascending). Each entry carries the flag's id, name, color, description and owning organization.
  */
 const flagsLibraryV2ApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -1684,7 +1755,7 @@ const flagsLibraryV2ApiControllerList = (options) => {
 exports.flagsLibraryV2ApiControllerList = flagsLibraryV2ApiControllerList;
 /**
  * Create investigation flag
- * Create a Binalyze AIR investigation flag via POST /api/v2/libraries/flags. MUTATING: persists a new flag. Required: name (max 50 chars, not purely numeric). Optional: color (CSS color, defaults to #4A4D55), description, and organization (id or exact name; defaults to the caller organization when the caller has exactly one, otherwise the default organization). A name collision within the organization is resolved by auto-suffixing with a NAME_ADJUSTED warning; if a unique name cannot be allocated, returns 409 NAME_CONFLICT. dryRun DEFAULTS TO TRUE in the tool layer: the first call previews the would-create entity (action='would-create', final name) without persisting; pass dryRun=false only after the user confirms. Success returns entities[0] with the created flag.
+ * Creates an investigation flag from a required name plus optional color, description and owning organization (color defaults to #4A4D55). A name collision within the organization is auto-suffixed and reported as a NAME_ADJUSTED warning. Returns the created flag in entities[0].
  */
 const flagsLibraryV2ApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1711,7 +1782,7 @@ const flagsLibraryV2ApiControllerCreate = (options) => {
 exports.flagsLibraryV2ApiControllerCreate = flagsLibraryV2ApiControllerCreate;
 /**
  * Delete investigation flag
- * Delete ONE Binalyze AIR investigation flag by numeric id or exact name via DELETE /api/v2/libraries/flags/{idOrName}. MUTATING and irreversible: removes the flag record. System-created flags cannot be deleted (406). dryRun DEFAULTS TO TRUE in the tool layer: the first call returns entities[0] = { id, name, action:'would-delete' } without deleting; pass dryRun=false only after the user confirms. Success returns entities[0] = { id, name } of the deleted flag.
+ * Deletes one investigation flag identified by numeric id or exact name. System-created flags cannot be deleted and return 406. Returns the id and name of the deleted flag in entities[0].
  */
 const flagsLibraryV2ApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -1734,7 +1805,7 @@ const flagsLibraryV2ApiControllerDelete = (options) => {
 exports.flagsLibraryV2ApiControllerDelete = flagsLibraryV2ApiControllerDelete;
 /**
  * Get investigation flag by id or name
- * Get ONE Binalyze AIR investigation flag by numeric id or exact name using GET /api/v2/libraries/flags/{idOrName}. Read-only. Returns entities[0] with the flag detail. An unknown name returns 404 with ranked did-you-mean candidates under errors[0].details.suggestions; a name shared across organizations returns 400 AMBIGUOUS_NAME with errors[0].details.matches.
+ * Fetches one investigation flag by numeric id or exact name and returns its detail in entities[0]. An unknown name returns 404 with near-miss suggestions in errors[0].details.suggestions; a name shared across organizations returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches.
  */
 const flagsLibraryV2ApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -1757,7 +1828,7 @@ const flagsLibraryV2ApiControllerGet = (options) => {
 exports.flagsLibraryV2ApiControllerGet = flagsLibraryV2ApiControllerGet;
 /**
  * Update investigation flag
- * Update ONE Binalyze AIR investigation flag by numeric id or exact name via PATCH /api/v2/libraries/flags/{idOrName}. MUTATING, partial: only the fields you pass (name, color, description) change; null is treated as not provided. Sending no updatable field returns HTTP 200 with success:false and a NOTHING_CHANGED error entry. A rename collision is resolved by auto-suffixing with a NAME_ADJUSTED warning. dryRun DEFAULTS TO TRUE in the tool layer: preview first, then pass dryRun=false to persist. Success returns entities[0] with the updated flag (fresh timestamps).
+ * Applies a partial update (name, color and/or description) to one investigation flag identified by numeric id or exact name; omitted or null fields stay unchanged. A rename collision is auto-suffixed and reported as a NAME_ADJUSTED warning. Returns the updated flag in entities[0].
  */
 const flagsLibraryV2ApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -1784,7 +1855,7 @@ const flagsLibraryV2ApiControllerUpdate = (options) => {
 exports.flagsLibraryV2ApiControllerUpdate = flagsLibraryV2ApiControllerUpdate;
 /**
  * Flag evidence rows in an investigation
- * Mark rows of one investigation with a flag via POST /api/v2/investigations/{idOrName}/flag. MUTATING. body.flag accepts a numeric flag id or exact flag name from the /api/v2/libraries/flags library (the flag must belong to the investigation's organization). A flag NAME that does not exist yet is auto-created in the investigation's organization and reported under warnings[] code=FLAG_CREATED (dryRun previews it as FLAG_WILL_BE_CREATED with flag.id=null); a numeric flag id must already exist (404 otherwise). Auto-creating a flag requires the case-container manage privilege (the same write the /api/v2/libraries/flags create endpoint needs); without it an unknown flag name is rejected with 403. If every items[] row is skipped, the missing flag is NOT created (warnings[] code=FLAG_NOT_CREATED, in the dryRun preview as well) so bad coordinates never mutate the flag library. COORDINATES (critical): each items[] row is identified by evidence + objectId + taskAssignmentId. evidence accepts the evidence TABLE name exactly as air-investigations-schema/sql-query show it (e.g. linux_shell_history) or its bare section name (e.g. shell_history); the endpoint normalizes to the bare section the UI joins on, so just pass the table name you queried. objectId MUST be the row's air_object_id column -- NOT air_id and NOT the full-text-search id/primary key. SOURCE selects the surface (and where the flag shows): EVIDENCE (default) = raw evidence rows, FINDING = the Findings view (what users usually mean by "findings"/"bulgular"), TIMELINE = timeline rows. Take items[] from that SAME surface: for EVIDENCE, evidence=<table name> and objectId=<that table>.air_object_id; for FINDING, evidence=air_findings_view.section and objectId=air_findings_view.air_evidence_object_id (its air_evidence_object_id, NOT its air_object_id); for TIMELINE, evidence=evidence_category and objectId=air_evidence_object_id of the timeline row. EXAMPLE (flag two evidence rows): source omitted (EVIDENCE), items=[{"evidence":"windows_processes","objectId":48,"taskAssignmentId":"604df464-...","}, {"evidence":"windows_user_folders","objectId":1,"taskAssignmentId":"2eb56bc4-..."}] where 48 and 1 are air_object_id values discovered with air-investigations-sql-query (e.g. SELECT air_object_id, air_task_assignment_id FROM windows_processes ...). Rows with an unknown evidence name or coordinates matching no real row are SKIPPED (not written) and reported under warnings[] code=ROWS_SKIPPED with a per-item reason (UNKNOWN_EVIDENCE / ROW_NOT_FOUND); itemCount reflects only the rows actually flagged. dryRun DEFAULTS TO TRUE in the tool layer: the first call previews (action='would-flag', resolved flag, itemCount, any ROWS_SKIPPED warnings) without changing anything; pass dryRun=false only after the user confirms.
+ * Marks evidence, finding or timeline rows of one investigation with a flag from the flags library, identified by numeric id or exact name; a flag name that does not exist yet is auto-created in the investigation's organization. Each row is addressed by its evidence table or section name, objectId and taskAssignmentId, and `source` selects the surface (EVIDENCE, FINDING or TIMELINE). Returns a receipt with the resolved flag and the number of rows flagged, plus warnings for skipped rows and flag auto-creation; `dryRun` previews the outcome without changing anything.
  */
 const investigationEvidenceFlagV2ApiControllerFlagEvidence = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1811,7 +1882,7 @@ const investigationEvidenceFlagV2ApiControllerFlagEvidence = (options) => {
 exports.investigationEvidenceFlagV2ApiControllerFlagEvidence = investigationEvidenceFlagV2ApiControllerFlagEvidence;
 /**
  * Remove a flag from evidence rows in an investigation
- * Remove one flag from rows of one investigation via POST /api/v2/investigations/{idOrName}/unflag. MUTATING. Same body/coordinate contract as the flag endpoint: body.flag is a numeric flag id or exact flag name (must already exist -- unlike the flag endpoint, unflag never auto-creates), items[] identifies rows by evidence (table name like linux_shell_history or its bare section shell_history -- normalized server-side) + objectId (the row air_object_id, NOT air_id) + taskAssignmentId, and source (EVIDENCE default, FINDING, TIMELINE) must match the surface the flag was applied to, with coordinates from that same surface (see the flag endpoint). Rows that do not carry the flag are ignored. Unknown evidence names or coordinates matching no real row are skipped and reported under warnings[] code=ROWS_SKIPPED with a per-item reason. itemCount reflects the rows actually processed; it is not the number of rows that actually changed. dryRun DEFAULTS TO TRUE in the tool layer: the first call previews (action='would-unflag') without changing anything; pass dryRun=false only after the user confirms.
+ * Removes one flag from evidence, finding or timeline rows of one investigation. The body follows the same contract as the flag endpoint (flag by numeric id or exact existing name, rows addressed by evidence, objectId and taskAssignmentId on the chosen source surface); rows that do not carry the flag are ignored. Returns a receipt with the resolved flag and the number of rows processed, plus warnings for skipped rows; `dryRun` previews the outcome without changing anything.
  */
 const investigationEvidenceFlagV2ApiControllerUnflagEvidence = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1865,7 +1936,7 @@ const investigationSqlV2ApiControllerGetSchema = (options) => {
 exports.investigationSqlV2ApiControllerGetSchema = investigationSqlV2ApiControllerGetSchema;
 /**
  * Run a read-only SQL query on an investigation
- * Execute one read-only SELECT statement inside the investigation schema via POST /api/v2/investigations/{idOrName}/sql-query. Returns a paginated result (pageNumber/pageSize in the body; totalEntityCount, totalPageCount, nextPage/previousPage in the envelope). Trailing semicolons, end-of-query -- comments, and trailing LIMIT/OFFSET in sqlQuery are stripped so request paging owns the page slice. Write statements, multiple statements and cross-schema references are rejected. Fixed tables: air_investigation_activities, air_investigation_activity_user_reads, air_investigation_comments, air_investigation_evidence_metadata, air_investigation_evidence_relations, air_investigation_evidence_transformer_versions, air_investigation_external_section_import_error, air_investigation_external_section_import_status, air_investigation_finding_timeline, air_investigation_flags, air_investigation_full_text_search, air_investigation_metadata, air_investigation_notes, air_investigation_reports, air_investigation_report_history, air_investigation_task_assignments, air_investigation_task_execution_logs, air_investigation_timeline, air_investigation_timeline_event_range, air_investigation_timeline_hourly, air_investigation_user_findings, drone_findings. Views: air_all_findings_view, air_excluded_findings_view, air_findings_view, air_timeline_findings_view. Evidence tables are named <platform>_<section> (e.g. windows_triage_file, linux_triage_file, windows_event_records) and vary per investigation. POST the schema endpoint with an empty body to list the populated tables of this investigation with row counts; POST { "table": "<name>" } for column details.
+ * Execute one read-only SELECT statement inside the investigation schema via POST /api/v2/investigations/{idOrName}/sql-query. Returns a paginated result (pageNumber/pageSize in the body; totalEntityCount, totalPageCount, nextPage/previousPage in the envelope). Trailing semicolons, end-of-query -- comments, and trailing LIMIT/OFFSET in sqlQuery are stripped so request paging owns the page slice. Write statements, multiple statements and cross-schema references are rejected. Every result-producing branch must be anchored to at least one relation in the selected investigation. Functions are admitted through PostgreSQL catalog capability checks; volatile, dangerous, user-schema and object-reference functions are rejected. Use the schema endpoint to discover the selected investigation tables and columns; PostgreSQL catalog, object-reference, and cross-schema introspection are rejected. Fixed tables: air_investigation_activities, air_investigation_activity_user_reads, air_investigation_comments, air_investigation_evidence_metadata, air_investigation_evidence_relations, air_investigation_evidence_transformer_versions, air_investigation_external_section_import_error, air_investigation_external_section_import_status, air_investigation_finding_timeline, air_investigation_flags, air_investigation_full_text_search, air_investigation_metadata, air_investigation_notes, air_investigation_reports, air_investigation_report_history, air_investigation_task_assignments, air_investigation_task_execution_logs, air_investigation_timeline, air_investigation_timeline_event_range, air_investigation_timeline_hourly, air_investigation_user_findings, drone_findings. Views: air_all_findings_view, air_excluded_findings_view, air_findings_view, air_timeline_findings_view. Evidence tables are named <platform>_<section> (e.g. windows_triage_file, linux_triage_file, windows_event_records) and vary per investigation. POST the schema endpoint with an empty body to list the populated tables of this investigation with row counts; POST { "table": "<name>" } for column details. Documented row-analysis functions (94): abs, age, array_agg, array_cat, array_length, array_position, array_remove, array_to_string, ascii, avg, bit_length, bool_and, bool_or, btrim, cardinality, ceil, ceiling, char_length, chr, concat, concat_ws, corr, count, date_part, date_trunc, dense_rank, div, first_value, floor, initcap, json_array_length, json_typeof, jsonb_array_elements, jsonb_array_elements_text, jsonb_array_length, jsonb_path_exists, jsonb_typeof, lag, last_value, lead, left, length, lower, lpad, ltrim, max, md5, min, mod, mode, now, nth_value, ntile, octet_length, percentile_cont, percentile_disc, plainto_tsquery, position, power, rank, regexp_matches, regexp_replace, regexp_split_to_array, repeat, replace, reverse, right, round, row_number, rpad, rtrim, split_part, sqrt, starts_with, stddev, stddev_pop, string_agg, string_to_array, strpos, substr, substring, sum, to_char, to_date, to_timestamp, to_tsquery, to_tsvector, translate, trim, trunc, unnest, upper, var_pop, variance. Allowed cast types: bigint, boolean, character, character varying, date, double precision, integer, interval, json, jsonb, numeric, real, smallint, text, time, time with time zone, time without time zone, timestamp with time zone, timestamp without time zone, uuid (plus the usual aliases such as int, varchar, timestamptz). Additional functions are admitted only when PostgreSQL catalog metadata proves they are safe, non-volatile built-ins; unknown, extension, user-schema and dangerous functions are rejected. Object-reference (regclass/oid), catalog, session, filesystem, network and *_to_xml* capabilities are rejected. Safe set-returning functions may expand rows in SELECT, FROM or LATERAL. GROUP BY accepts ROLLUP and GROUPING SETS; CUBE is not supported because the name doubles as an extension function. Execution-context expressions (current_user, current_schema, current_catalog) are rejected.
  */
 const investigationSqlV2ApiControllerExecuteSqlQuery = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1892,7 +1963,7 @@ const investigationSqlV2ApiControllerExecuteSqlQuery = (options) => {
 exports.investigationSqlV2ApiControllerExecuteSqlQuery = investigationSqlV2ApiControllerExecuteSqlQuery;
 /**
  * Reboot a single asset
- * Reboot EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/reboot. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-reboot instead. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real reboot signal after the user confirms the exact asset. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Sends a reboot signal to one asset, identified by UUID or exact name. Returns the created task assignment; dryRun=true returns a same-shape preview without dispatching anything.
  */
 const assetActionV2ApiControllerReboot = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1919,7 +1990,7 @@ const assetActionV2ApiControllerReboot = (options) => {
 exports.assetActionV2ApiControllerReboot = assetActionV2ApiControllerReboot;
 /**
  * Shut down a single asset
- * Shut down EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/shutdown. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-shutdown instead. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real shutdown signal after the user confirms the exact asset. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Sends a shutdown signal to one asset, identified by UUID or exact name. Returns the created task assignment; dryRun=true returns a same-shape preview without dispatching anything.
  */
 const assetActionV2ApiControllerShutdown = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1946,7 +2017,7 @@ const assetActionV2ApiControllerShutdown = (options) => {
 exports.assetActionV2ApiControllerShutdown = assetActionV2ApiControllerShutdown;
 /**
  * Isolate a single asset
- * Network-isolate EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/isolate. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-isolate instead. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real isolation signal after the user confirms the exact asset. Requires the Isolation feature to be enabled. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Network-isolates one asset, identified by UUID or exact name. Requires the Isolation feature; returns the created isolation task with the target `isolationStatus`, and dryRun=true returns a same-shape preview without dispatching anything.
  */
 const assetActionV2ApiControllerIsolate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -1973,7 +2044,7 @@ const assetActionV2ApiControllerIsolate = (options) => {
 exports.assetActionV2ApiControllerIsolate = assetActionV2ApiControllerIsolate;
 /**
  * Unisolate a single asset
- * Remove network isolation from EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/unisolate. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-unisolate instead. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real unisolation signal after the user confirms the exact asset. Requires the Isolation feature to be enabled. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Removes network isolation from one asset, identified by UUID or exact name. Requires the Isolation feature; returns the created unisolation task with the target `isolationStatus`, and dryRun=true returns a same-shape preview without dispatching anything.
  */
 const assetActionV2ApiControllerUnisolate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2000,7 +2071,7 @@ const assetActionV2ApiControllerUnisolate = (options) => {
 exports.assetActionV2ApiControllerUnisolate = assetActionV2ApiControllerUnisolate;
 /**
  * Retrieve the agent logs of a single asset
- * Retrieve agent logs for a task on EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/log-retrieval. Use this ONLY for one specific asset; it also requires the taskId whose logs should be collected. If the user gives two or more assets, a list, or a group, use air-assets-bulk-log-retrieval instead. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to assign the real log-retrieval task after the user confirms the asset and task. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Assigns a log-retrieval task that collects the agent logs from one asset, identified by UUID or exact name. Returns the created task assignment; dryRun=true returns a same-shape preview without dispatching anything.
  */
 const assetActionV2ApiControllerRetrieveLogs = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2027,7 +2098,7 @@ const assetActionV2ApiControllerRetrieveLogs = (options) => {
 exports.assetActionV2ApiControllerRetrieveLogs = assetActionV2ApiControllerRetrieveLogs;
 /**
  * Update the agent version on a single asset
- * Update the agent version on EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/update. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-version-update instead. There is no version targeting: the agent always updates to the console's current supported version. ALWAYS send dryRun=true on every call (would-update preview); pass dryRun=false only to assign the real immediate one-time update task after the user confirms the exact asset. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Assigns a one-time task that updates the agent on one asset to the console's current supported version; no specific version can be targeted. Returns the created task assignment; dryRun=true returns a same-shape preview without dispatching anything.
  */
 const assetActionV2ApiControllerVersionUpdate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2054,7 +2125,7 @@ const assetActionV2ApiControllerVersionUpdate = (options) => {
 exports.assetActionV2ApiControllerVersionUpdate = assetActionV2ApiControllerVersionUpdate;
 /**
  * Enable maintenance mode on a single asset
- * Enable maintenance mode on EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/enable-maintenance. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-enable-maintenance instead. ALWAYS send dryRun=true on every call (would-change preview); pass dryRun=false only to apply the real change after the user confirms the exact asset. Updates the asset synchronously (no task is created). A no-op (already in maintenance mode) returns HTTP 200 with a NO_OP entry in errors[]. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Enables maintenance mode on one asset, identified by UUID or exact name. The change is applied synchronously without creating a task; an asset already in maintenance mode returns HTTP 200 with a NO_OP entry in errors[], and dryRun=true returns a same-shape preview.
  */
 const assetActionV2ApiControllerEnableMaintenance = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2081,7 +2152,7 @@ const assetActionV2ApiControllerEnableMaintenance = (options) => {
 exports.assetActionV2ApiControllerEnableMaintenance = assetActionV2ApiControllerEnableMaintenance;
 /**
  * Disable maintenance mode on a single asset
- * Disable maintenance mode on EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, via POST /api/v2/assets/{idOrName}/disable-maintenance. Use this ONLY for one specific asset. If the user gives two or more assets, a list, a group, or 'all matching' assets, use air-assets-bulk-disable-maintenance instead. ALWAYS send dryRun=true on every call (would-change preview); pass dryRun=false only to apply the real change after the user confirms the exact asset. Updates the asset synchronously (no task is created). A no-op (not in maintenance mode) returns HTTP 200 with a NO_OP entry in errors[]. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Disables maintenance mode on one asset, identified by UUID or exact name. The change is applied synchronously without creating a task; an asset not in maintenance mode returns HTTP 200 with a NO_OP entry in errors[], and dryRun=true returns a same-shape preview.
  */
 const assetActionV2ApiControllerDisableMaintenance = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2108,7 +2179,7 @@ const assetActionV2ApiControllerDisableMaintenance = (options) => {
 exports.assetActionV2ApiControllerDisableMaintenance = assetActionV2ApiControllerDisableMaintenance;
 /**
  * Import a PPC file into an existing asset
- * Import a case PPC evidence file into an EXISTING Binalyze AIR asset via POST /api/v2/assets/{idOrName}/import (multipart upload). Use this when the asset already exists in AIR and you want to attach/import a .ppc captured from it (a real PPC zip containing Case.db). Optionally attach the import to a case via caseIdOrName (resolved as uuid or name). Success response (200): result.entities[0] = { id (asset id), name (asset name), ppcFileName, importedAt }. Unknown asset -> 404. KNOWN ISSUE: a corrupt or non-zip file currently returns 500 INTERNAL_ERROR (not a clean 400) -- treat that 500 as 'invalid PPC file', do not retry blindly and do not report it as a server outage. ALWAYS send dryRun=true first (generic preview; does not validate the file); pass dryRun=false only to perform the real import after the user confirms the asset and file. For an off-network Task.dat that should create an offline task, use air-assets-off-network-import instead. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Imports an uploaded PPC evidence file (multipart field `ppcFile`, max 4 GB) into an existing asset identified by UUID or exact name, optionally attaching it to a case via `caseIdOrName`. Returns the asset identity together with the imported file name and import time.
  */
 const assetActionV2ApiControllerImportPpcToExistingAsset = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2136,7 +2207,7 @@ const assetActionV2ApiControllerImportPpcToExistingAsset = (options) => {
 exports.assetActionV2ApiControllerImportPpcToExistingAsset = assetActionV2ApiControllerImportPpcToExistingAsset;
 /**
  * Reboot multiple assets
- * Reboot MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/reboot. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-reboot (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to send the real reboot signals after the user confirms the asset list. Use failIfNumberOfAssetsGreaterThan as a safety cap.
+ * Sends a reboot signal to multiple assets, listed by id or name in `assets[]` and optionally scoped by `organizations`. Supports dryRun previews and the `failIfNumberOfAssetsGreaterThan` safety cap; returns per-asset task entries plus warnings for skipped assets.
  */
 const assetBulkActionV2ApiControllerReboot = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2163,7 +2234,7 @@ const assetBulkActionV2ApiControllerReboot = (options) => {
 exports.assetBulkActionV2ApiControllerReboot = assetBulkActionV2ApiControllerReboot;
 /**
  * Shut down multiple assets
- * Shut down MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/shutdown. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-shutdown (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to send the real shutdown signals after the user confirms the asset list. Use failIfNumberOfAssetsGreaterThan as a safety cap.
+ * Sends a shutdown signal to multiple assets, listed by id or name in `assets[]` and optionally scoped by `organizations`. Supports dryRun previews and the `failIfNumberOfAssetsGreaterThan` safety cap; returns per-asset task entries plus warnings for skipped assets.
  */
 const assetBulkActionV2ApiControllerShutdown = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2190,7 +2261,7 @@ const assetBulkActionV2ApiControllerShutdown = (options) => {
 exports.assetBulkActionV2ApiControllerShutdown = assetBulkActionV2ApiControllerShutdown;
 /**
  * Isolate multiple assets
- * Network-isolate MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/isolate. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-isolate (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to send the real isolation signals after the user confirms the asset list. Requires the Isolation feature to be enabled. Use failIfNumberOfAssetsGreaterThan as a safety cap.
+ * Network-isolates multiple assets, listed by id or name in `assets[]` and optionally scoped by `organizations`. Requires the Isolation feature; supports dryRun previews and the `failIfNumberOfAssetsGreaterThan` safety cap. Returns per-asset task entries plus warnings for skipped assets.
  */
 const assetBulkActionV2ApiControllerIsolate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2217,7 +2288,7 @@ const assetBulkActionV2ApiControllerIsolate = (options) => {
 exports.assetBulkActionV2ApiControllerIsolate = assetBulkActionV2ApiControllerIsolate;
 /**
  * Unisolate multiple assets
- * Remove network isolation from MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/unisolate. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-unisolate (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to send the real unisolation signals after the user confirms the asset list. Requires the Isolation feature to be enabled. Use failIfNumberOfAssetsGreaterThan as a safety cap.
+ * Removes network isolation from multiple assets, listed by id or name in `assets[]` and optionally scoped by `organizations`. Requires the Isolation feature; supports dryRun previews and the `failIfNumberOfAssetsGreaterThan` safety cap. Returns per-asset task entries plus warnings for skipped assets.
  */
 const assetBulkActionV2ApiControllerUnisolate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2244,7 +2315,7 @@ const assetBulkActionV2ApiControllerUnisolate = (options) => {
 exports.assetBulkActionV2ApiControllerUnisolate = assetBulkActionV2ApiControllerUnisolate;
 /**
  * Retrieve the agent logs of multiple assets
- * Retrieve agent logs from MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/log-retrieval. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset (and a specific taskId), use air-assets-log-retrieval (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to assign the real log-retrieval task after the user confirms the asset list. Use failIfNumberOfAssetsGreaterThan as a safety cap.
+ * Assigns a log-retrieval task to multiple assets, listed by id or name in `assets[]` and optionally scoped by `organizations`. Supports dryRun previews and the `failIfNumberOfAssetsGreaterThan` safety cap; returns per-asset task entries plus warnings for skipped assets.
  */
 const assetBulkActionV2ApiControllerRetrieveLogs = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2271,7 +2342,7 @@ const assetBulkActionV2ApiControllerRetrieveLogs = (options) => {
 exports.assetBulkActionV2ApiControllerRetrieveLogs = assetBulkActionV2ApiControllerRetrieveLogs;
 /**
  * Update the agent version on multiple assets
- * Update the agent version on MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/version-update. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-version-update (the single-asset tool) instead. There is no version targeting: agents always update to the console's current supported version. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to assign the real immediate one-time update task after the user confirms the asset list. Provide organizations when names are ambiguous across orgs. Use failIfNumberOfAssetsGreaterThan as a safety cap.
+ * Assigns an immediate one-time agent version update task to multiple assets, listed by id or name in `assets[]` and optionally scoped by `organizations`. Agents update to the console's current supported version; there is no version targeting. Supports dryRun previews and the `failIfNumberOfAssetsGreaterThan` safety cap; returns per-asset task entries plus warnings for skipped assets.
  */
 const assetBulkActionV2ApiControllerVersionUpdate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2298,7 +2369,7 @@ const assetBulkActionV2ApiControllerVersionUpdate = (options) => {
 exports.assetBulkActionV2ApiControllerVersionUpdate = assetBulkActionV2ApiControllerVersionUpdate;
 /**
  * Enable maintenance mode on multiple assets
- * Enable maintenance mode on MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/enable-maintenance. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-enable-maintenance (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to apply the real change after the user confirms the asset list. These endpoints update assets synchronously and do not create tasks. Provide organizations when names are ambiguous across orgs.
+ * Enables maintenance mode on multiple assets, listed by id or name in `assets[]` and optionally scoped by `organizations`. The change is applied synchronously without creating tasks; supports dryRun previews and returns per-asset entries plus warnings for assets already in maintenance mode or otherwise skipped.
  */
 const assetBulkActionV2ApiControllerEnableMaintenance = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2325,7 +2396,7 @@ const assetBulkActionV2ApiControllerEnableMaintenance = (options) => {
 exports.assetBulkActionV2ApiControllerEnableMaintenance = assetBulkActionV2ApiControllerEnableMaintenance;
 /**
  * Disable maintenance mode on multiple assets
- * Disable maintenance mode on MULTIPLE Binalyze AIR assets in one call, listed by id or name in assets[], via POST /api/v2/disable-maintenance. Use this ONLY when the user targets two or more assets, a list, or a group. For exactly ONE asset, use air-assets-disable-maintenance (the single-asset tool) instead. ALWAYS send dryRun=true on every call (preview of eligible assets and warnings); pass dryRun=false only to apply the real change after the user confirms the asset list. These endpoints update assets synchronously and do not create tasks. Provide organizations when names are ambiguous across orgs.
+ * Disables maintenance mode on multiple assets, listed by id or name in `assets[]` and optionally scoped by `organizations`. The change is applied synchronously without creating tasks; supports dryRun previews and returns per-asset entries plus warnings for assets not in maintenance mode or otherwise skipped.
  */
 const assetBulkActionV2ApiControllerDisableMaintenance = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2352,7 +2423,7 @@ const assetBulkActionV2ApiControllerDisableMaintenance = (options) => {
 exports.assetBulkActionV2ApiControllerDisableMaintenance = assetBulkActionV2ApiControllerDisableMaintenance;
 /**
  * Add tag(s) to multiple assets
- * Add tags to one or more Binalyze AIR assets in one call via POST /api/v2/assets/tags. This APPENDS the given tags to the assets in assets[]; it is not a full replacement (use air-assets-tags to replace one asset's whole tag set). Idempotent: assets that already carry a tag are not re-updated but still report 'tags-added'. Success response (200): result.entities[] = {asset{id,name}, action 'tags-added', addedTags[]}; unresolved/skipped inputs land in result.warnings[] = {asset, action 'skipped', reason}. Zero resolved assets -> 404 'No assets matched'. ALWAYS send dryRun=true first (preview); pass dryRun=false only to apply the real tag add after the user confirms the asset list. UUID entries carry their own org; ambiguous names may need organizations.
+ * Appends the given `tags` to every asset listed in `assets[]` in a single call. Existing tags are kept; assets that already carry a tag are unchanged but still reported. Returns per-asset results in `entities[]` and skipped inputs in `warnings[]`.
  */
 const assetBulkMetadataV2ApiControllerAddTags = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2379,7 +2450,7 @@ const assetBulkMetadataV2ApiControllerAddTags = (options) => {
 exports.assetBulkMetadataV2ApiControllerAddTags = assetBulkMetadataV2ApiControllerAddTags;
 /**
  * Remove tag(s) from multiple assets
- * Remove tags from one or more Binalyze AIR assets in one call via POST /api/v2/assets/tags/delete. This DELETES the given tags from the assets in assets[] (only the listed tags are removed; other tags stay; the tag catalog row itself is not deleted). Responses (200): real removal returns result.entities[] = {asset{id,name}, action 'tags-removed', removedTags[]}; with ?dryRun=true the action is 'would-remove-tags' and nothing changes. Zero resolved assets -> 404 'No assets matched'. ALWAYS send dryRun=true first (schema-specific would-remove preview); pass dryRun=false only to apply the real tag removal after the user confirms the asset list. UUID entries carry their own org; ambiguous names may need organizations.
+ * Removes the given `tags` from every asset listed in `assets[]` in a single call. Only the listed tags are removed; other tags and the tag catalog itself are untouched. Supports a `dryRun` preview. Returns per-asset results in `entities[]` and skipped inputs in `warnings[]`.
  */
 const assetBulkMetadataV2ApiControllerRemoveTags = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2406,7 +2477,7 @@ const assetBulkMetadataV2ApiControllerRemoveTags = (options) => {
 exports.assetBulkMetadataV2ApiControllerRemoveTags = assetBulkMetadataV2ApiControllerRemoveTags;
 /**
  * Set the update-exclusion flag on multiple assets
- * Set or clear the 'excluded from automatic agent updates' flag on one or more Binalyze AIR assets via PATCH /api/v2/assets/update-exclusion. excludedFromUpdates=true excludes the assets from auto-updates; false re-includes them. Success response (200): result.entities[] only contains assets that were actually updated ({asset{id,name}, action 'update-exclusion-set', excludedFromUpdates, updatedAt}); assets with an unsupported OS are NOT updated and land in result.warnings[] with action 'skipped' and reason 'Asset has unsupported OS for update'. entities may be empty when every asset was skipped -- report that honestly, do not claim an update. Zero resolved assets -> 404 'No assets matched'. ALWAYS send dryRun=true first (generic preview); pass dryRun=false only to apply the real change after the user confirms the asset list. UUID entries carry their own org; ambiguous names may need organizations.
+ * Sets or clears the "excluded from automatic agent updates" flag on every asset listed in `assets[]`. `excludedFromUpdates=true` excludes the assets from auto-updates; `false` re-includes them. Returns the changed assets in `entities[]`; assets with an unsupported OS are skipped and reported in `warnings[]`.
  */
 const assetBulkMetadataV2ApiControllerSetUpdateExclusion = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -2433,7 +2504,7 @@ const assetBulkMetadataV2ApiControllerSetUpdateExclusion = (options) => {
 exports.assetBulkMetadataV2ApiControllerSetUpdateExclusion = assetBulkMetadataV2ApiControllerSetUpdateExclusion;
 /**
  * Set or clear the relay connection route on multiple assets
- * Set or clear the relay-server connection route of one or more Binalyze AIR assets via PATCH /api/v2/assets/connection-route. relayServerId is the numeric relay server id to route through; pass null to CLEAR the route (direct connection). The relay server's organization must match the assets' organization. ALWAYS send dryRun=true on every call (would-change preview of resolved assets and warnings); pass dryRun=false only to apply the real change after the user confirms the asset list. UUID entries carry their own org; ambiguous names may need organizations.
+ * Sets or clears the relay-server connection route of every asset listed in `assets[]`. `relayServerId` is the numeric relay server to route through; `null` clears the route (direct connection). The relay server's organization must match the assets' organization. Returns per-asset results in `entities[]` and skipped inputs in `warnings[]`.
  */
 const assetBulkMetadataV2ApiControllerSetConnectionRoute = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -2460,7 +2531,7 @@ const assetBulkMetadataV2ApiControllerSetConnectionRoute = (options) => {
 exports.assetBulkMetadataV2ApiControllerSetConnectionRoute = assetBulkMetadataV2ApiControllerSetConnectionRoute;
 /**
  * Set the demanded MITRE ATT&CK Database version on multiple assets
- * Set the demanded MITRE ATT&CK database version on one or more Binalyze AIR assets via PATCH /api/v2/assets/mitre-attack-database/version. This is the MITRE ATT&CK DATABASE version, not the agent version (use air-assets-bulk-version-update for the agent). PRECONDITIONS: (1) MITRE auto-update must be OFF, otherwise the call fails 400 with code MITRE_AUTO_UPDATE_ENABLED and a message telling how to disable it (PUT /api/public/settings/mitre-attack-database with autoUpdateEnabled=false). (2) version must be one that EXISTS in the system -- versions look like '13.5.2' (no 'v' prefix); list them via GET /api/public/settings/mitre-attack-database/versions; an unknown version fails 400 'is not available in the system'. Success response (200): result.entities[] only contains assets that were actually updated ({asset{id,name}, action 'mitre-database-updated', version, assignedAt}); INELIGIBLE assets are NOT updated and land in result.warnings[] with action 'skipped' and a reason ('Asset subtype is not endpoint', 'Asset is not managed', or 'Agent build does not support MITRE database updates'). entities may be empty when every asset was skipped -- report that honestly, do not claim an update. ALWAYS send dryRun=true first (generic preview; it does NOT check auto-update or version validity); pass dryRun=false only to apply the real change after the user confirms. UUID entries carry their own org; ambiguous names may need organizations.
+ * Sets the demanded MITRE ATT&CK database version on every asset listed in `assets[]`. Requires MITRE auto-update to be disabled and `version` to be one available in the system. Returns the updated assets in `entities[]`; ineligible assets are skipped and reported in `warnings[]`.
  */
 const assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -2487,7 +2558,7 @@ const assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = (options) => {
 exports.assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion;
 /**
  * Bulk delete assets (purge / uninstall / purge-and-uninstall)
- * Delete / decommission one or more Binalyze AIR assets via POST /api/v2/assets/delete. DESTRUCTIVE and largely irreversible (uninstall signals a real agent). mode selects the action: 'purge' (remove console records + evidence files; agent stays), 'uninstall' (uninstall the agent; records stay), or 'purge-and-uninstall' (both). mode 'purge' additionally requires the PurgeWithoutUninstall feature flag; when disabled the call fails 403 Forbidden. Invalid mode -> 400. Zero resolved assets -> 404 'No assets matched'. Responses: dryRun preview (200) returns result.entities[] = {asset{id,name}, mode, action 'would-delete', effects[] (e.g. 'agent-uninstall','console-records','evidence-files')}; the REAL delete (200) returns result = { deletedCount, warnings[] }. ALWAYS send dryRun=true first and show the user the per-asset effects; pass dryRun=false only after the user explicitly confirms the exact asset list and mode. UUID entries carry their own org; ambiguous names may need organizations. Use failIfNumberOfAssetsGreaterThan as a safety cap.
+ * Deletes or decommissions every asset listed in `assets[]`. `mode` selects the action: `purge` (remove console records and evidence files), `uninstall` (uninstall the agent), or `purge-and-uninstall` (both). A `dryRun` preview returns the per-asset effects; the real delete returns `deletedCount` plus any `warnings[]`.
  */
 const assetBulkMetadataV2ApiControllerDeleteAssets = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2514,7 +2585,7 @@ const assetBulkMetadataV2ApiControllerDeleteAssets = (options) => {
 exports.assetBulkMetadataV2ApiControllerDeleteAssets = assetBulkMetadataV2ApiControllerDeleteAssets;
 /**
  * Import an off-network PPC (find-or-create asset + offline task)
- * Import an OFF-NETWORK Task.dat via POST /api/v2/assets/import (multipart upload) and create an OFFLINE TASK (offline-triage or offline-acquisition). IMPORTANT semantics: this endpoint does NOT create or find an asset -- it only creates a task from the uploaded Task.dat (the asset is resolved later, when the evidence collection zip is imported into the task). The file must be a valid RC4-encrypted Task.dat; anything else (e.g. a regular case .ppc) is rejected 400 'Missing or invalid Task.dat format!'. Requires the Off-Network Responder feature. Success response (200): result.entities[0] = { taskId, taskName, organizationId, taskDetailsViewUrl, ppcFileName, importedAt } -- a task summary, no asset id/name. organizations must resolve to EXACTLY ONE organization id (the task is single-org). Optionally attach to a case via caseIdOrName (unknown case -> 400 'Case not found'). ALWAYS send dryRun=true first (generic preview; does not validate the file); pass dryRun=false only to perform the real import after the user confirms. To import a case PPC into an asset that already exists in AIR, use air-assets-import instead.
+ * Imports an off-network Task.dat (multipart upload; field `ppcFile`) and creates an offline task. The asset itself is resolved later, when the evidence collection zip is imported into the task. `organizations` must resolve to exactly one organization; `caseIdOrName` optionally attaches the task to a case. Requires the Off-Network Responder feature. Returns the created task summary.
  */
 const assetBulkMetadataV2ApiControllerImportOffNetworkPpc = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2542,7 +2613,7 @@ const assetBulkMetadataV2ApiControllerImportOffNetworkPpc = (options) => {
 exports.assetBulkMetadataV2ApiControllerImportOffNetworkPpc = assetBulkMetadataV2ApiControllerImportOffNetworkPpc;
 /**
  * Run triage rule(s) on multiple assets
- * Run triage rule(s) IMMEDIATELY on one or more Binalyze AIR assets via POST /api/v2/triage. Creates ONE triage task (status 'assigned') covering every runnable asset. This tool is for IMMEDIATE runs only -- it deliberately has NO schedule and NO cpuLimit parameter. To create a recurring/scheduled triage (or set a CPU cap), use air-assets-bulk-triage-scheduled instead; do NOT try to pass schedule fields here. ruleIds accept a rule UUID OR an exact rule name (names are resolved within the assets' authorized org scope; an ambiguous or unknown name becomes a per-input error in result.errors[]). NEVER invent or guess a rule id/name -- if the user did not give one, ask or look it up first. OMIT every optional argument the user did not ask for; never fill placeholders (no empty strings). Use assertions.failIfNumberOfAssetsGreaterThan as a safety cap: the task is rejected (406) if more assets match than the cap allows; omitted, it defaults to the resolved asset count. Success response (200): result.entities[0] = { id (task id), name, assets { assetCount, assetsUrl }, assignedAssetCount, organizations [{id,name}], rules [{id,name,engine}], status 'assigned', source, createdBy, createdAt, taskDetailsViewUrl }; result.errors[] lists per-input skips (e.g. 'Asset not found: X'). Zero matching assets -> 404 'No matching assets found'; zero matching rules -> 404 'No matching triage rules found'. ALWAYS send dryRun=true first (generic preview; it does NOT validate rules); pass dryRun=false only to create the real task after the user confirms. A preview is NOT a created task; only dryRun=false with ok=true and a returned task id means it was created -- treat ok=false / non-2xx / the error field as failure. Supports Idempotency-Key so a retried call replays the first response instead of creating duplicate tasks.
+ * Runs one or more triage (hunt) rules across multiple assets, creating a single task that covers every runnable asset. Assets and rules are referenced by id or exact name; inputs that cannot be resolved are reported per input in `result.errors[]` instead of failing the call. Returns the created task entity with its asset rollup, organizations and rules.
  */
 const assetBulkTriageV2ApiControllerRunTriage = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2569,7 +2640,7 @@ const assetBulkTriageV2ApiControllerRunTriage = (options) => {
 exports.assetBulkTriageV2ApiControllerRunTriage = assetBulkTriageV2ApiControllerRunTriage;
 /**
  * List InterAct messages for an asset
- * List the InterAct shell messages of EXACTLY ONE Binalyze AIR asset across all its sessions via GET /api/v2/assets/{idOrName}/interact. Read-only; returns a paginated envelope of messages (command + latest response, status, detectedType, output/outputUrl). Supports filtering by session, status, detected type, snippet, and created/completed date ranges. Use this when the user asks for an asset's shell command history, or to poll an async command's status by sessionId/status. Prefer UUID; names can be ambiguous across organizations. Omit any filter the user did not ask for. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Lists the InterAct shell messages recorded for one asset, identified by UUID or exact name, across all of its sessions. Supports offset pagination, sorting, and filtering by session and creation date range. Each entry carries the command, its status, and the output inline or via outputUrl.
  */
 const assetInteractMessageV2ApiControllerListForAsset = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -2592,7 +2663,7 @@ const assetInteractMessageV2ApiControllerListForAsset = (options) => {
 exports.assetInteractMessageV2ApiControllerListForAsset = assetInteractMessageV2ApiControllerListForAsset;
 /**
  * Run an InterAct command on an asset
- * Run an InterAct shell command on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/interact. WARNING: this endpoint has NO dry-run preview -- a successful call EXECUTES the command on the live endpoint IMMEDIATELY. Confirm the exact asset and command with the user before calling; never run a destructive command without explicit confirmation. Sync mode (default) waits for the result up to the server timeout and returns 200 with the message (output inlined when small, else outputUrl); a timeout or async=true returns 202 with status 'running' and a messageId to poll. COMMAND ROUTING: when the first word matches an AIR native command (ls/dir, cd, ...; list via air-interact-commands), the NATIVE implementation runs -- it has its own option set and does NOT accept POSIX/shell flags (e.g. 'ls -la' fails; the native form is 'ls ext'). For a real shell command, prefix it with exec (e.g. 'exec ls -la /etc'); anything that matches no native command is auto-run as exec. When a native command fails on its flag parser, the response's `hint` field explains this and gives the exec form -- relay it to the user. Use the returned sessionId/messageId with air-assets-interact-message, air-assets-interact-cancel, or air-assets-interact-close. Prefer UUID; names can be ambiguous across organizations. If the asset name looks partial or you are not certain it is the EXACT name (e.g. user says 'mrv'), do not ask the user to clarify blindly -- either call this tool with that name (a non-matching name is safe: it executes nothing and returns HTTP 404 with suggestions) or first resolve it with air-assets-filtered-list using searchTerm=<the name>, then confirm with the user. Likewise, if the COMMAND looks like a typo of an AIR native command (e.g. 'pslt'), do not guess from memory -- call air-interact-commands (optionally searchTerm) and suggest the closest real command name from its `commandNames`; note a non-native command may still be a valid shell command, so only offer 'did you mean' when a close native match exists. Also: when a run COMPLETES with a failed command (non-zero exit) that was an unrecognized native command, the response body (not the error envelope) surfaces `suggestions` as native-command NAME strings (e.g. ['pslist']) -- distinct from the asset-name suggestion objects on a 404 -- tell the user 'the command failed; did you mean <name>?' and offer to re-run the corrected command. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id. Omit optional arguments the user did not ask for.
+ * Runs an InterAct shell command on one asset, identified by UUID or exact name. In synchronous mode (default) the call waits for the result and returns the completed message with its output; when the command is still running after the sync timeout, or when async=true, it returns HTTP 202 with a running message handle to poll.
  */
 const assetInteractV2ApiControllerRunCommand = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2619,7 +2690,7 @@ const assetInteractV2ApiControllerRunCommand = (options) => {
 exports.assetInteractV2ApiControllerRunCommand = assetInteractV2ApiControllerRunCommand;
 /**
  * Cancel the running InterAct command on an asset
- * Cancel the running InterAct shell command on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/interact/cancel. WARNING: this endpoint has NO dry-run preview -- it sends a real interrupt to the running command; the session stays open. With no body it cancels the caller's active session's running command. Pass messageId to target a specific running message, or sessionId to target a specific session. Cancellation is best-effort (the agent confirms asynchronously); the returned message may still read as running. 404 'No active session' / 'Message not found' when nothing matches; 400 'No running command to cancel' / 'Message is not running' when there is nothing to interrupt. Prefer UUID for the asset. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Sends a best-effort interrupt to a running InterAct shell command on one asset; the session stays open. With no body it targets the running command of the caller's active session; pass messageId or sessionId to target a specific command or session. Returns the affected message entity.
  */
 const assetInteractV2ApiControllerCancelCommand = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2646,7 +2717,7 @@ const assetInteractV2ApiControllerCancelCommand = (options) => {
 exports.assetInteractV2ApiControllerCancelCommand = assetInteractV2ApiControllerCancelCommand;
 /**
  * Close the InterAct session on an asset
- * Close the InterAct shell session on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/interact/close. WARNING: this endpoint has NO dry-run preview -- it really closes the session. With no body it closes the caller's active session; pass sessionId to target a specific session. If the session has running commands and force is omitted/false, the API returns 400 with errors[0].details.runningMessageIds; set force=true to cancel those commands first and then close. Success returns { sessionId, closedAt, cancelledMessageIds[] }. 404 'No active session' when nothing matches. Prefer UUID for the asset. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Closes an InterAct shell session on one asset. With no body it closes the caller's active session; pass sessionId to target a specific session and force=true to cancel any running commands first. Returns the session id, the close timestamp, and the ids of cancelled messages.
  */
 const assetInteractV2ApiControllerCloseSession = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2673,7 +2744,7 @@ const assetInteractV2ApiControllerCloseSession = (options) => {
 exports.assetInteractV2ApiControllerCloseSession = assetInteractV2ApiControllerCloseSession;
 /**
  * Get asset issue/actionability stats
- * Get aggregate Binalyze AIR asset statistics from GET /api/v2/assets/stats. Use this for fleet summaries, counts, and breakdowns, not for listing individual assets. Only include filters when the user explicitly asks for scoped stats.
+ * Returns aggregate statistics over the assets visible to the caller, grouped into version, connectivity, deployment, assignment and isolation domains. Accepts the same `filter` and `organizations` query parameters as the asset list endpoint.
  */
 const assetV2ApiControllerGetStats = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -2696,7 +2767,7 @@ const assetV2ApiControllerGetStats = (options) => {
 exports.assetV2ApiControllerGetStats = assetV2ApiControllerGetStats;
 /**
  * Export assets as CSV
- * Export Binalyze AIR assets as a CSV file via GET /api/v2/assets/export and save it inside the current worktree. Read-only on the server side; no dryRun needed. The filter model mirrors air-assets-filtered-list (searchTerm, subtype, status, platform, isolation), but tag filtering (tagIds) is NOT applied on export. organizations defaults to all accessible organizations when omitted. Returns {outputPath, byteLength}; default output is artifacts/assets.csv. Use air-assets-list or air-assets-filtered-list instead when the user just wants to read assets in the chat.
+ * Exports the assets matching the given filter as a CSV file stream. Supports the same `filter` and `organizations` parameters as the asset list endpoint, except that tag filtering (tagIds) is not applied on export; `columnsOrder` controls the leading column order of the CSV.
  */
 const assetV2ApiControllerExportAssets = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -2719,7 +2790,7 @@ const assetV2ApiControllerExportAssets = (options) => {
 exports.assetV2ApiControllerExportAssets = assetV2ApiControllerExportAssets;
 /**
  * List assets
- * List Binalyze AIR assets with explicit filters, organization scope, pagination, sorting, or output format. Use this only when the user asks for a constrained asset list, such as offline Windows endpoints, page 2, assets with no agent, or markdown output. For subtype-only prompts like 'filter by disk image', prefer air-assets-by-subtype. If a small model sends searchTerm=diskImage here, this tool normalizes it to subtype=['diskImage']. Placeholder defaults such as organizations=all, pageNumber=1, pageSize=20, sortType without sortBy, and false booleans are ignored.
+ * Lists assets visible to the caller, scoped by `organizations`. Supports offset pagination, whitelisted sorting and `filter[field]` querying. Start here to discover asset ids for the single-asset endpoints.
  */
 const assetV2ApiControllerFilterAssets = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -2742,7 +2813,7 @@ const assetV2ApiControllerFilterAssets = (options) => {
 exports.assetV2ApiControllerFilterAssets = assetV2ApiControllerFilterAssets;
 /**
  * Delete an asset by id or name
- * Delete or uninstall EXACTLY ONE Binalyze AIR asset, identified by a single id or name in the path, using DELETE /api/v2/assets/{idOrName}. This is destructive. ALWAYS send dryRun=true on every call (would-delete preview); pass dryRun=false only for the final real delete after the user confirms the exact asset id and mode. Use mode='purge' for console record deletion only, 'uninstall' for agent uninstall signal, and 'purge-and-uninstall' for both. Prefer UUID; names can be ambiguous. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Deletes an asset. `mode` picks the blast radius (purge, uninstall, or purge-and-uninstall). Send dryRun=true first: it returns the exact effects without dispatching anything.
  */
 const assetV2ApiControllerDeleteAsset = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -2765,7 +2836,7 @@ const assetV2ApiControllerDeleteAsset = (options) => {
 exports.assetV2ApiControllerDeleteAsset = assetV2ApiControllerDeleteAsset;
 /**
  * Get asset by id or name
- * Fetch one Binalyze AIR asset by UUID or name using GET /api/v2/assets/{idOrName}. Use this when the user wants details for a specific host/asset. Prefer UUID because names can be duplicated. If the API returns AMBIGUOUS_NAME, show the candidates and retry only with the selected id. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Fetches one asset by UUID or by exact name. Prefer the UUID: names can collide. A name matching several assets returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches; a near-miss name returns 404 with errors[0].details.suggestions.
  */
 const assetV2ApiControllerGetAsset = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -2788,7 +2859,7 @@ const assetV2ApiControllerGetAsset = (options) => {
 exports.assetV2ApiControllerGetAsset = assetV2ApiControllerGetAsset;
 /**
  * Replace asset tags
- * Replace the complete tag set of one Binalyze AIR asset using PATCH /api/v2/assets/{idOrName}/tags. Use this only when the user asks to set, replace, update, or clear tags. This is a full replacement, not an append operation. ALWAYS send dryRun=true on every call (would-change preview); pass dryRun=false only to apply the real tag change after the user confirms the exact asset. Prefer UUID because asset names can be ambiguous; retry by id if AMBIGUOUS_NAME is returned. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Replaces the complete tag set of a single asset, identified by UUID or exact name; this is a full replacement, not an append, and an empty array clears all tags. Supports `dryRun` to preview the change before applying it. Returns the updated asset.
  */
 const assetV2ApiControllerReplaceTags = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -2815,7 +2886,7 @@ const assetV2ApiControllerReplaceTags = (options) => {
 exports.assetV2ApiControllerReplaceTags = assetV2ApiControllerReplaceTags;
 /**
  * Update asset label
- * Set or clear the label of one Binalyze AIR asset using PATCH /api/v2/assets/{idOrName}/label. Use this only for asset label changes, not tags. Pass a string to set the label or null to clear it. ALWAYS send dryRun=true on every call (would-change preview); pass dryRun=false only to apply the real label change after the user confirms the exact asset. Prefer UUID because asset names can be ambiguous; retry by id if AMBIGUOUS_NAME is returned. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Sets or clears the label of a single asset, identified by UUID or exact name. Pass a string in `label` to set the label or null to clear it. Supports `dryRun` to preview the change before applying it. Returns the updated asset.
  */
 const assetV2ApiControllerUpdateLabel = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -2842,7 +2913,7 @@ const assetV2ApiControllerUpdateLabel = (options) => {
 exports.assetV2ApiControllerUpdateLabel = assetV2ApiControllerUpdateLabel;
 /**
  * List the hunt task history of a single asset
- * List the hunt (triage) task history of EXACTLY ONE Binalyze AIR asset via GET /api/v2/assets/{idOrName}/hunt (formerly /triage). Read-only; returns a paginated envelope of the triage tasks previously run on that asset. Use this when the user asks for an asset's past/ongoing triage tasks. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Lists the triage (hunt) task history of a single asset, identified by UUID or exact name. Supports offset pagination, whitelisted sorting and `filter[field]` querying over status and search term. Returns a paginated envelope of the triage tasks previously run on the asset.
  */
 const assetTriageV2ApiControllerFilterTriageTasks = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -2865,7 +2936,7 @@ const assetTriageV2ApiControllerFilterTriageTasks = (options) => {
 exports.assetTriageV2ApiControllerFilterTriageTasks = assetTriageV2ApiControllerFilterTriageTasks;
 /**
  * Run triage rule(s) on a single asset
- * Run hunt (triage) rule(s) on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/hunt (formerly /triage). Use this ONLY for one specific asset; for two or more assets, a list, a group, or 'all matching', use air-assets-bulk-triage instead. WARNING: this endpoint has NO dry-run preview -- a successful call creates a REAL triage task IMMEDIATELY (or a scheduled one when `schedule` is set). Confirm the exact asset and rules with the user before calling. ruleIds accept a rule UUID OR an exact rule name (names are resolved within the asset's authorized org scope; unknown/ambiguous names become per-input errors). NEVER invent or guess a rule id/name. Omit every optional argument the user did not ask for; never fill placeholders. Only a 2xx response with a returned task id means the task was created -- treat ok=false / non-2xx / the error field as failure. Supports Idempotency-Key so a retried call replays the first response instead of creating duplicate tasks. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Runs one or more triage (hunt) rules on a single asset, identified by UUID or exact name. Rules are referenced by id or exact name, and an optional `schedule` defers or repeats the run, which otherwise starts immediately. Returns the created task entity with its rules and owning organizations.
  */
 const assetTriageV2ApiControllerRunTriage = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2892,7 +2963,7 @@ const assetTriageV2ApiControllerRunTriage = (options) => {
 exports.assetTriageV2ApiControllerRunTriage = assetTriageV2ApiControllerRunTriage;
 /**
  * Cancel triage tasks on a single asset
- * Cancel triage (hunt) tasks on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/triage/cancel. Use this ONLY for one specific asset's triage tasks. For cancelling a whole hunt task across all its assets, use air-hunt-cancel instead. `tasks` is ALWAYS required: an array of parent task UUIDs, or the literal string 'all' to cancel every cancellable triage task of this asset. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real cancellation after the user confirms the exact asset and tasks. Prefer UUID for the asset; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Cancels triage (hunt) tasks on a single asset, identified by UUID or exact name. `tasks` selects the parent task ids to cancel, or the literal 'all' for every cancellable triage task of the asset; only this asset's assignments are cancelled. Returns per-task entries with cancelled and skipped assignment counts.
  */
 const assetTriageV2ApiControllerCancelTriage = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2919,7 +2990,7 @@ const assetTriageV2ApiControllerCancelTriage = (options) => {
 exports.assetTriageV2ApiControllerCancelTriage = assetTriageV2ApiControllerCancelTriage;
 /**
  * Delete one asset's triage task assignment
- * Delete ONE asset's triage (hunt) task assignment via DELETE /api/v2/assets/{idOrName}/triage/{taskId}. DESTRUCTIVE and irreversible once executed: removes this asset's assignment of the given parent triage task, including its collected results for this asset. Other assets' assignments of the same task are NOT touched; to delete the whole task everywhere, use air-hunt-delete instead. ALWAYS send dryRun=true on every call (would-delete preview); pass dryRun=false only after the user confirms the exact asset and task. taskId must be the parent task UUID (see air-assets-triage-history). Prefer UUID for the asset; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Deletes a single asset's assignment of the given parent triage task, including the results collected for that asset; other assets' assignments of the same task are unaffected. Supports `dryRun` to preview the deletion before executing it. Returns the deleted (or previewed) assignment row.
  */
 const assetTriageV2ApiControllerDeleteTriageAssignment = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -2942,7 +3013,7 @@ const assetTriageV2ApiControllerDeleteTriageAssignment = (options) => {
 exports.assetTriageV2ApiControllerDeleteTriageAssignment = assetTriageV2ApiControllerDeleteTriageAssignment;
 /**
  * Start an evidence or image acquisition on a single asset
- * Start an evidence or disk-image acquisition on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/acquire. WARNING: this endpoint has NO dry-run preview -- a successful call starts a REAL acquisition task IMMEDIATELY (or a scheduled one when `schedule` is set). Confirm the exact asset, type, and profile/image options with the user before calling. type='evidence' (default) REQUIRES profileIdOrName and accepts NO image-specific field. type='image' REQUIRES imageType + at least one volume, accepts NO profileIdOrName, and description/examinerName are EWF2-only. The server rejects cross-type field combinations with 400. profileIdOrName / caseIdOrName accept a UUID or an exact name resolved within the asset's org scope. NEVER invent or guess a profile/case id. Omit every optional argument the user did not ask for; never fill placeholders. Only a 2xx response with a returned task id means the task was started -- treat ok=false / non-2xx / the error field as failure. Supports Idempotency-Key so a retried call replays the first response instead of starting duplicate tasks. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Starts an evidence or disk-image acquisition on one asset. `type` selects the branch: 'evidence' (default) requires `profileIdOrName`; 'image' requires `imageType` and at least one volume. `caseIdOrName` attaches the task to a case. The call starts a real task immediately (or a scheduled one when `schedule` is set); the Idempotency-Key header makes retries safe. Returns the created task assignment.
  */
 const assetAcquisitionV2ApiControllerAcquire = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2969,7 +3040,7 @@ const assetAcquisitionV2ApiControllerAcquire = (options) => {
 exports.assetAcquisitionV2ApiControllerAcquire = assetAcquisitionV2ApiControllerAcquire;
 /**
  * Cancel acquisition tasks on a single asset
- * Cancel evidence/image acquisition tasks on EXACTLY ONE Binalyze AIR asset via POST /api/v2/assets/{idOrName}/acquisition/cancel. Use this ONLY for one specific asset's acquisition tasks (started with air-assets-acquire). `tasks` is ALWAYS required: an array of parent task UUIDs, or the literal string 'all' to cancel every cancellable acquisition task of this asset. ALWAYS send dryRun=true on every call (would-run preview); pass dryRun=false only to send the real cancellation after the user confirms the exact asset and tasks. Prefer UUID for the asset; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Cancels evidence/image acquisition tasks on a single asset, identified by UUID or exact name. `tasks` selects the parent task ids to cancel, or the literal 'all' for every cancellable acquisition task of the asset; only this asset's assignments are cancelled. Returns an asset-level summary of the cancelled tasks.
  */
 const assetAcquisitionV2ApiControllerCancelAcquisition = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2996,7 +3067,7 @@ const assetAcquisitionV2ApiControllerCancelAcquisition = (options) => {
 exports.assetAcquisitionV2ApiControllerCancelAcquisition = assetAcquisitionV2ApiControllerCancelAcquisition;
 /**
  * Delete one asset's acquisition task assignment
- * Delete ONE asset's acquisition task assignment via DELETE /api/v2/assets/{idOrName}/acquisition/{taskId}. DESTRUCTIVE and irreversible once executed: removes this asset's assignment of the given parent acquisition task, including its collected evidence for this asset. Other assets' assignments of the same task are NOT touched. ALWAYS send dryRun=true on every call (would-delete preview); pass dryRun=false only after the user confirms the exact asset and task. taskId must be the parent task UUID (see air-assets-acquisition-history). Prefer UUID for the asset; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Deletes a single asset's assignment of the given parent acquisition task, including the evidence collected for that asset; other assets' assignments of the same task are unaffected. Supports `dryRun` to preview the deletion before executing it. Returns the deleted (or previewed) assignment row.
  */
 const assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -3019,7 +3090,7 @@ const assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = (options) =>
 exports.assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment;
 /**
  * List the acquisition task history of a single asset
- * List the acquisition (evidence/image) task history of EXACTLY ONE Binalyze AIR asset via GET /api/v2/assets/{idOrName}/acquisition. Read-only; returns a paginated envelope of the acquisition tasks previously started on that asset. Use this when the user asks for an asset's past/ongoing acquisition tasks. Prefer UUID; names can be ambiguous across organizations. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Lists the acquisition (evidence/image) task history of a single asset, identified by UUID or exact name. Supports offset pagination, whitelisted sorting and `filter[field]` querying over status, type and search term. Returns a paginated envelope of the acquisition tasks previously started on the asset.
  */
 const assetAcquisitionV2ApiControllerFilterAcquisitionTasks = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -3042,7 +3113,7 @@ const assetAcquisitionV2ApiControllerFilterAcquisitionTasks = (options) => {
 exports.assetAcquisitionV2ApiControllerFilterAcquisitionTasks = assetAcquisitionV2ApiControllerFilterAcquisitionTasks;
 /**
  * List InterAct sessions for an asset
- * List the InterAct shell sessions of EXACTLY ONE Binalyze AIR asset via GET /api/v2/assets/{idOrName}/interact/sessions. Read-only; returns a paginated envelope of sessions (activityState active/idle, createdBy, task, case, messageCount, timestamps). Supports filtering by session, creator, and creation date; sortable by createdAt. Use this when the user asks for an asset's shell sessions. Prefer UUID; names can be ambiguous across organizations. Omit any filter the user did not ask for. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Lists the InterAct shell sessions recorded for one asset, identified by UUID or exact name. Supports offset pagination, sorting, and filtering by session, creator, and creation date range. Each entry includes the derived activity state, message count, and related task and case references.
  */
 const assetInteractMessageV2ApiControllerListSessionsForAsset = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -3065,7 +3136,7 @@ const assetInteractMessageV2ApiControllerListSessionsForAsset = (options) => {
 exports.assetInteractMessageV2ApiControllerListSessionsForAsset = assetInteractMessageV2ApiControllerListSessionsForAsset;
 /**
  * Get an InterAct message scoped to an asset
- * Fetch ONE InterAct shell message of a Binalyze AIR asset by message UUID via GET /api/v2/assets/{idOrName}/interact/{messageId}. Read-only; returns the unified message entity (command, status, output/outputUrl, exitCode, timestamps). Use this to poll a 'running' message returned by air-assets-interact-run, or to inspect one specific message. The message must belong to the asset, otherwise the API returns 404. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Fetches one InterAct shell message of an asset by message UUID. Returns the unified message entity with the command, status, exit code, timestamps, and the output inline or via outputUrl. The message must belong to the asset, otherwise the API returns 404.
  */
 const assetInteractMessageV2ApiControllerGetMessage = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -3088,7 +3159,7 @@ const assetInteractMessageV2ApiControllerGetMessage = (options) => {
 exports.assetInteractMessageV2ApiControllerGetMessage = assetInteractMessageV2ApiControllerGetMessage;
 /**
  * Download an InterAct message output
- * Download the output of ONE InterAct shell message of a Binalyze AIR asset via GET /api/v2/assets/{idOrName}/interact/{messageId}/download. Read-only; the endpoint streams the message output as an attachment (it bypasses the JSON envelope). This tool saves the bytes to a file inside the current worktree (outputPath, default artifacts/interact-message-output.bin) and returns { outputPath, byteLength }; read the saved file for the content. Use this for a message whose output is too large to inline (outputUrl is set). The message must be terminal -- a still-running message returns 400. On HTTP 404 the asset name or message id was not found; verify the asset with air-assets-get and the message with air-assets-interact-messages before retrying.
+ * Streams the stored output of one completed InterAct shell message as a binary attachment, bypassing the JSON envelope. Intended for output too large to inline (outputUrl is set on the message). A still-running message returns 400.
  */
 const assetInteractMessageV2ApiControllerDownloadMessageOutput = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -3111,7 +3182,7 @@ const assetInteractMessageV2ApiControllerDownloadMessageOutput = (options) => {
 exports.assetInteractMessageV2ApiControllerDownloadMessageOutput = assetInteractMessageV2ApiControllerDownloadMessageOutput;
 /**
  * Get an InterAct session report scoped to an asset
- * Get the InterAct shell session report of a Binalyze AIR asset via GET /api/v2/assets/{idOrName}/interact/sessions/{sessionId}/report. Read-only; returns a self-contained session report. format='json' (default) returns the structured report envelope (session, asset, messages, messageCount, lastActivityAt); format='html' returns the rendered HTML report (this tool returns a preview of the HTML plus its byte length). Use a sessionId from air-assets-interact-sessions. The session must belong to the asset, otherwise the API returns 404. Prefer UUID for the asset. On HTTP 404 with errors[0].details.suggestions, the asset name was not found -- show those suggestions to the user and confirm before retrying, never guess; on HTTP 400 AMBIGUOUS_NAME with errors[0].details.matches, ask which asset by id.
+ * Builds a self-contained report for one InterAct shell session of an asset. The default JSON format returns the session, the asset identity, and all messages; format=html returns the rendered HTML report instead. The session must belong to the asset, otherwise the API returns 404.
  */
 const assetInteractMessageV2ApiControllerGetSessionReport = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -3134,7 +3205,7 @@ const assetInteractMessageV2ApiControllerGetSessionReport = (options) => {
 exports.assetInteractMessageV2ApiControllerGetSessionReport = assetInteractMessageV2ApiControllerGetSessionReport;
 /**
  * List cloud acquisition profiles
- * List Binalyze AIR cloud (M365) acquisition profiles via GET /api/v2/libraries/acquisition/cloud. Read-only and paginated. Each entity is a profile summary: id, name, organizationIds, averageTime, createdAt/createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. The m365UserBased/m365TenantWide evidence lists are NOT included; use air-acquisition-cloud-get for one profile's full config. Use this when the user asks to list or search cloud acquisition profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdBy, createdAt, lastUsedAt, lastUsedBy (default createdAt). Profiles with empty organizationIds are global.
+ * Lists cloud (M365) acquisition profiles as paginated summary rows scoped by `organizations`, with `filter[field]` querying and sorting by name, createdBy, createdAt, lastUsedAt or lastUsedBy. Each row carries id, name, organizations, usage metadata and a detailsUrl; the M365 evidence selections are returned by the single-profile endpoint.
  */
 const cloudAcquisitionLibraryApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -3157,7 +3228,7 @@ const cloudAcquisitionLibraryApiControllerList = (options) => {
 exports.cloudAcquisitionLibraryApiControllerList = cloudAcquisitionLibraryApiControllerList;
 /**
  * Create cloud acquisition profile
- * Create a Binalyze AIR cloud (M365) acquisition profile via POST /api/v2/libraries/acquisition/cloud. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. `name` (alphanumeric) plus BOTH m365UserBased and m365TenantWide blocks are required; each block is {evidenceList: string[]} and at least one evidence must be selected across the two blocks. Evidence keys are lowercase M365 collector names, e.g. user-based: outlookmails, onedrive, teams, teamschat, calendar, mfa, user; tenant-wide: ual, adminauditlog, azureadaccountlogon, sharepoint, exchangeadmin, riskyusers. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-cloud-get for the full list of valid evidence keys.
+ * Creates a cloud (M365) acquisition profile from a required `name` plus the m365UserBased and m365TenantWide evidence blocks, with at least one evidence selected across the two. Body `organizationIds` controls which organizations own the profile. With dryRun=true (the default) the request is only validated and the would-be profile is returned without persisting; a real create returns the profile detail in entities[0].
  */
 const cloudAcquisitionLibraryApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -3184,7 +3255,7 @@ const cloudAcquisitionLibraryApiControllerCreate = (options) => {
 exports.cloudAcquisitionLibraryApiControllerCreate = cloudAcquisitionLibraryApiControllerCreate;
 /**
  * Bulk delete cloud acquisition profiles
- * Bulk delete Binalyze AIR cloud (M365) acquisition profiles via POST /api/v2/libraries/acquisition/cloud/delete. MUTATING and irreversible. Resolution is tolerant: unknown or ambiguous items are skipped and reported in warnings[] (action: 'skipped') instead of failing the whole request. System profiles are also skipped with a warning. dryRun DEFAULTS TO TRUE: the first call returns entities[] of what would be deleted; pass dryRun=false only to actually delete after the user confirms. A real delete returns deletedCount plus warnings[]. Use this for several profiles at once; use air-acquisition-cloud-delete for exactly one. Ids and exact names come from air-acquisition-cloud-list.
+ * Deletes several cloud (M365) acquisition profiles in one request, resolving each item by UUID or exact name. Unknown, ambiguous or system profiles are skipped and reported in warnings[] instead of failing the batch. With dryRun=true (the default) the response previews what would be deleted; a real delete returns deletedCount plus warnings[].
  */
 const cloudAcquisitionLibraryApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -3211,7 +3282,7 @@ const cloudAcquisitionLibraryApiControllerBulkDelete = (options) => {
 exports.cloudAcquisitionLibraryApiControllerBulkDelete = cloudAcquisitionLibraryApiControllerBulkDelete;
 /**
  * Delete cloud acquisition profile
- * Delete ONE Binalyze AIR cloud (M365) acquisition profile via DELETE /api/v2/libraries/acquisition/cloud/{idOrName}. MUTATING and irreversible. System (predefined) profiles cannot be deleted: the API returns 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call returns what would be deleted without removing anything; pass dryRun=false only to actually delete after the user confirms. Use air-acquisition-cloud-bulk-delete for several profiles at once. The idOrName comes from air-acquisition-cloud-list or air-acquisition-cloud-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
+ * Deletes one cloud (M365) acquisition profile by UUID or exact name. System profiles cannot be deleted (406 SYSTEM_PROFILE_IMMUTABLE). With dryRun=true (the default) the response shows what would be deleted without removing anything.
  */
 const cloudAcquisitionLibraryApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -3234,7 +3305,7 @@ const cloudAcquisitionLibraryApiControllerDelete = (options) => {
 exports.cloudAcquisitionLibraryApiControllerDelete = cloudAcquisitionLibraryApiControllerDelete;
 /**
  * Get cloud acquisition profile by id or name
- * Get ONE Binalyze AIR cloud (M365) acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/cloud/{idOrName}. Read-only. Returns the full profile detail in entities[0]: id, name, organizationIds, m365UserBased.evidenceList, m365TenantWide.evidenceList, deletable, and timestamps. Use this when the user asks to show or inspect a cloud acquisition profile's evidence selection, to clone one, or to discover valid M365 evidence keys. Ids and exact names come from air-acquisition-cloud-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
+ * Fetches one cloud (M365) acquisition profile by UUID or exact name, returning the full detail in entities[0]: the m365UserBased and m365TenantWide evidence lists, organizations and timestamps. A name matching several profiles returns 400 AMBIGUOUS_NAME with candidates; an unknown identifier returns 404 with suggestions.
  */
 const cloudAcquisitionLibraryApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -3257,7 +3328,7 @@ const cloudAcquisitionLibraryApiControllerGet = (options) => {
 exports.cloudAcquisitionLibraryApiControllerGet = cloudAcquisitionLibraryApiControllerGet;
 /**
  * Update cloud acquisition profile
- * Update ONE Binalyze AIR cloud (M365) acquisition profile via PATCH /api/v2/libraries/acquisition/cloud/{idOrName}. MUTATING partial update: only the fields you pass change; omitted fields keep their current value. Updatable fields: name, organizationIds, m365UserBased, m365TenantWide. A passed evidence block REPLACES that whole block. The merged profile must keep at least one M365 evidence selected across the two blocks (a name-only patch is fine). Sending no updatable field returns NOTHING_CHANGED with result null. System (predefined) profiles cannot be updated: the API returns 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call previews the merged profile without persisting; pass dryRun=false only to actually update after the user confirms. The idOrName comes from air-acquisition-cloud-list or air-acquisition-cloud-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
+ * Partially updates one cloud (M365) acquisition profile: only the provided fields (name, organizationIds, m365UserBased, m365TenantWide) change, and a passed evidence block replaces that whole block. The merged profile must keep at least one M365 evidence selected, and system profiles cannot be updated. With dryRun=true (the default) the merged profile is previewed without persisting.
  */
 const cloudAcquisitionLibraryApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({
@@ -3284,7 +3355,7 @@ const cloudAcquisitionLibraryApiControllerUpdate = (options) => {
 exports.cloudAcquisitionLibraryApiControllerUpdate = cloudAcquisitionLibraryApiControllerUpdate;
 /**
  * List disk image acquisition profiles
- * List Binalyze AIR disk-image acquisition profiles via GET /api/v2/libraries/acquisition/disk-image. Read-only and paginated. Requires the image-evidence-acquisition feature to be enabled on the Console. Each entity is a profile summary: id, name, organizationIds, averageTime, createdAt/updatedAt, createdBy, lastUsedAt/lastUsedBy, deletable, and a detailsUrl. allFiles/paths/evidence config is NOT included; use air-acquisition-disk-image-get for one profile's full config. Use this when the user asks to list or search disk-image (forensic imaging) profiles, or needs a profile id or exact name before get, update, delete, or bulk delete. sortBy accepts only name, createdAt, updatedAt, lastUsedAt, createdBy, lastUsedBy (default createdAt). Profiles with empty organizationIds are global.
+ * Lists disk image acquisition profiles as paginated summary rows scoped by `organizations`, with `filter[field]` querying and sorting by name, createdAt, updatedAt, lastUsedAt, createdBy or lastUsedBy. Each row carries id, name, organizations, usage metadata and a detailsUrl; the allFiles/paths/evidence configuration is returned by the single-profile endpoint.
  */
 const diskImageAcquisitionLibraryApiControllerList = (options) => {
     return (options?.client ?? client_gen_1.client).get({
@@ -3307,7 +3378,7 @@ const diskImageAcquisitionLibraryApiControllerList = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerList = diskImageAcquisitionLibraryApiControllerList;
 /**
  * Create disk image acquisition profile
- * Create a Binalyze AIR disk-image acquisition profile via POST /api/v2/libraries/acquisition/disk-image. MUTATING: persists a new profile. Returns 200 with entities[0] = the created profile detail. Requires the image-evidence-acquisition feature to be enabled on the Console. `name` is required (alphanumeric). Scope is either allFiles=true (full image) OR a `paths` list of directories/files to image; the allFiles/paths combination must be consistent (a profile cannot have both allFiles=true and paths). `imageAcquisitionEvidences` optionally selects extra evidence to collect alongside the image. dryRun DEFAULTS TO TRUE: the first call validates and returns the would-be entity without persisting anything; pass dryRun=false only to actually create after the user confirms. Inspect an existing profile with air-acquisition-disk-image-get when cloning or when unsure of valid evidence keys.
+ * Creates a disk image acquisition profile from a required `name` plus an imaging scope: either allFiles=true for a full-disk image or a `paths` list of directories and files, optionally with extra `imageAcquisitionEvidences` collected alongside the image. Body `organizationIds` controls which organizations own the profile. With dryRun=true (the default) the request is only validated and the would-be profile is returned without persisting; a real create returns the profile detail in entities[0].
  */
 const diskImageAcquisitionLibraryApiControllerCreate = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -3334,7 +3405,7 @@ const diskImageAcquisitionLibraryApiControllerCreate = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerCreate = diskImageAcquisitionLibraryApiControllerCreate;
 /**
  * Bulk delete disk image acquisition profiles
- * Bulk delete Binalyze AIR disk-image acquisition profiles via POST /api/v2/libraries/acquisition/disk-image/delete. MUTATING and irreversible. Requires the image-evidence-acquisition feature to be enabled on the Console. Resolution is tolerant: unknown or ambiguous items are skipped and reported in warnings[] (action: 'skipped') instead of failing the whole request. System profiles are also skipped with a warning. dryRun DEFAULTS TO TRUE: the first call returns entities[] of what would be deleted; pass dryRun=false only to actually delete after the user confirms. A real delete returns deletedCount plus warnings[]. Use this for several profiles at once; use air-acquisition-disk-image-delete for exactly one. Ids and exact names come from air-acquisition-disk-image-list.
+ * Deletes several disk image acquisition profiles in one request, resolving each item by UUID or exact name. Unknown, ambiguous or system profiles are skipped and reported in warnings[] instead of failing the batch. With dryRun=true (the default) the response previews what would be deleted; a real delete returns deletedCount plus warnings[].
  */
 const diskImageAcquisitionLibraryApiControllerBulkDelete = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -3361,7 +3432,7 @@ const diskImageAcquisitionLibraryApiControllerBulkDelete = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerBulkDelete = diskImageAcquisitionLibraryApiControllerBulkDelete;
 /**
  * Delete disk image acquisition profile
- * Delete ONE Binalyze AIR disk-image acquisition profile via DELETE /api/v2/libraries/acquisition/disk-image/{idOrName}. MUTATING and irreversible. Requires the image-evidence-acquisition feature to be enabled on the Console. System (predefined) profiles cannot be deleted: the API returns 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call returns what would be deleted without removing anything; pass dryRun=false only to actually delete after the user confirms. Use air-acquisition-disk-image-bulk-delete for several profiles at once. The idOrName comes from air-acquisition-disk-image-list or air-acquisition-disk-image-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
+ * Deletes one disk image acquisition profile by UUID or exact name. System profiles cannot be deleted (406 SYSTEM_PROFILE_IMMUTABLE). With dryRun=true (the default) the response shows what would be deleted without removing anything.
  */
 const diskImageAcquisitionLibraryApiControllerDelete = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -3384,7 +3455,7 @@ const diskImageAcquisitionLibraryApiControllerDelete = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerDelete = diskImageAcquisitionLibraryApiControllerDelete;
 /**
  * Get disk image acquisition profile by id or name
- * Get ONE Binalyze AIR disk-image acquisition profile by UUID or exact name via GET /api/v2/libraries/acquisition/disk-image/{idOrName}. Read-only. Requires the image-evidence-acquisition feature to be enabled on the Console. Returns the full profile detail in entities[0]: id, name, organizationIds, allFiles, paths[] ({path, description}), imageAcquisitionEvidences, deletable, and timestamps. Use this when the user asks to show or inspect a disk-image profile's scope, or to clone one. Ids and exact names come from air-acquisition-disk-image-list. An unknown idOrName returns 404 NOT_FOUND with did-you-mean suggestions in errors[0].details.suggestions[]; an ambiguous name returns 400 AMBIGUOUS_NAME with candidates in errors[0].details.matches[].
+ * Fetches one disk image acquisition profile by UUID or exact name, returning the full detail in entities[0]: the allFiles/paths imaging scope, extra evidence selection, organizations and timestamps. A name matching several profiles returns 400 AMBIGUOUS_NAME with candidates; an unknown identifier returns 404 with suggestions.
  */
 const diskImageAcquisitionLibraryApiControllerGet = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -3407,7 +3478,7 @@ const diskImageAcquisitionLibraryApiControllerGet = (options) => {
 exports.diskImageAcquisitionLibraryApiControllerGet = diskImageAcquisitionLibraryApiControllerGet;
 /**
  * Update disk image acquisition profile
- * Update ONE Binalyze AIR disk-image acquisition profile via PATCH /api/v2/libraries/acquisition/disk-image/{idOrName}. MUTATING partial update: only the fields you pass change; omitted fields keep their current value. Requires the image-evidence-acquisition feature. Updatable fields: name, organizationIds, allFiles, paths, imageAcquisitionEvidences. The merged profile must stay consistent: allFiles=true cannot coexist with a non-empty paths list. Sending no updatable field returns NOTHING_CHANGED with result null. System (predefined) profiles cannot be updated: the API returns 406 SYSTEM_PROFILE_IMMUTABLE. dryRun DEFAULTS TO TRUE: the first call previews the merged profile without persisting; pass dryRun=false only to actually update after the user confirms. The idOrName comes from air-acquisition-disk-image-list or air-acquisition-disk-image-get. An unknown idOrName returns 404 NOT_FOUND with suggestions; an ambiguous name returns 400 AMBIGUOUS_NAME.
+ * Partially updates one disk image acquisition profile: only the provided fields (name, organizationIds, allFiles, paths, imageAcquisitionEvidences) change. The merged profile must keep a consistent scope (allFiles=true cannot coexist with a non-empty paths list), and system profiles cannot be updated. With dryRun=true (the default) the merged profile is previewed without persisting.
  */
 const diskImageAcquisitionLibraryApiControllerUpdate = (options) => {
     return (options.client ?? client_gen_1.client).patch({