@binalyze/air-sdk 5.25.2 → 5.26.2

package/dist/sdk/typescript-axios-v2/sdk.gen.js

@@ -3,8 +3,9 @@
 // This file is auto-generated by @hey-api/openapi-ts
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.caseV2ApiControllerCreateCase = exports.caseV2ApiControllerFilterCases = exports.caseActionV2ApiControllerRemoveAssets = exports.caseActionV2ApiControllerArchive = exports.caseActionV2ApiControllerReopen = exports.caseActionV2ApiControllerClose = exports.caseTaskAssignmentV2ApiControllerRemoveTaskAssignment = exports.caseTaskAssignmentV2ApiControllerImportTaskAssignments = exports.caseTaskAssignmentV2ApiControllerFilterTaskAssignments = exports.caseNoteV2ApiControllerUpdateNote = exports.caseNoteV2ApiControllerDeleteNote = exports.caseNoteV2ApiControllerCreateNote = exports.caseNoteV2ApiControllerFilterNotes = exports.caseTaskV2ApiControllerFilterTasks = exports.caseUserV2ApiControllerFilterUsers = exports.caseAssetV2ApiControllerFilterAssets = exports.caseBulkActionV2ApiControllerArchive = exports.caseBulkActionV2ApiControllerClose = exports.caseExportV2ApiControllerExportCases = exports.caseActivityV2ApiControllerFilterCaseActivities = exports.caseActivityV2ApiControllerFilterGlobalActivities = exports.organizationV2ApiControllerGetOrganizationByIdOrName = exports.organizationV2ApiControllerListOrganizations = exports.organizationUserV2ApiControllerListOrganizationUsers = exports.triageLibraryExportV2ApiControllerDownload = exports.triageLibraryExportV2ApiControllerExport = exports.triageLibraryV2ApiControllerUpdate = exports.triageLibraryV2ApiControllerGet = exports.triageLibraryV2ApiControllerDelete = exports.triageLibraryV2ApiControllerValidate = exports.triageLibraryV2ApiControllerBulkDelete = exports.triageLibraryV2ApiControllerCreate = exports.triageLibraryV2ApiControllerList = exports.acquisitionLibraryDeviceV2ApiControllerUpdate = exports.acquisitionLibraryDeviceV2ApiControllerGet = exports.acquisitionLibraryDeviceV2ApiControllerDelete = exports.acquisitionLibraryDeviceV2ApiControllerBulkDelete = exports.acquisitionLibraryDeviceV2ApiControllerCreate = exports.acquisitionLibraryDeviceV2ApiControllerList = exports.tasksTriageV2ApiControllerDeleteOne = exports.tasksTriageV2ApiControllerCancelOne = exports.tasksTriageV2ApiControllerDelete = exports.tasksTriageV2ApiControllerCancel = exports.tasksTriageV2ApiControllerListHuntTasks = exports.tasksV2ApiControllerListTaskAssignments = exports.tasksV2ApiControllerListTaskAssets = exports.tasksV2ApiControllerUpdateTask = exports.tasksV2ApiControllerGetTaskById = exports.openApiAliasV2ApiControllerGet = exports.capabilitiesV2ApiControllerGet = void 0;
-exports.assetBulkMetadataV2ApiControllerSetConnectionRoute = exports.assetBulkMetadataV2ApiControllerSetUpdateExclusion = exports.assetBulkMetadataV2ApiControllerRemoveTags = exports.assetBulkMetadataV2ApiControllerAddTags = exports.assetBulkActionV2ApiControllerDisableMaintenance = exports.assetBulkActionV2ApiControllerEnableMaintenance = exports.assetBulkActionV2ApiControllerVersionUpdate = exports.assetBulkActionV2ApiControllerRetrieveLogs = exports.assetBulkActionV2ApiControllerUnisolate = exports.assetBulkActionV2ApiControllerIsolate = exports.assetBulkActionV2ApiControllerShutdown = exports.assetBulkActionV2ApiControllerReboot = exports.assetActionV2ApiControllerImportPpcToExistingAsset = exports.assetActionV2ApiControllerDisableMaintenance = exports.assetActionV2ApiControllerEnableMaintenance = exports.assetActionV2ApiControllerVersionUpdate = exports.assetActionV2ApiControllerRetrieveLogs = exports.assetActionV2ApiControllerUnisolate = exports.assetActionV2ApiControllerIsolate = exports.assetActionV2ApiControllerShutdown = exports.assetActionV2ApiControllerReboot = exports.investigationSqlV2ApiControllerExecuteSqlQuery = exports.investigationSqlV2ApiControllerGetSchema = exports.investigationEvidenceFlagV2ApiControllerUnflagEvidence = exports.investigationEvidenceFlagV2ApiControllerFlagEvidence = exports.flagsLibraryV2ApiControllerUpdate = exports.flagsLibraryV2ApiControllerGet = exports.flagsLibraryV2ApiControllerDelete = exports.flagsLibraryV2ApiControllerCreate = exports.flagsLibraryV2ApiControllerList = exports.interactCommandV2ApiControllerList = exports.interactLibraryFileV2ApiControllerDownload = exports.interactLibraryFileV2ApiControllerDelete = exports.interactLibraryFileV2ApiControllerBulkDelete = exports.interactLibraryFileV2ApiControllerUpload = exports.interactLibraryFileV2ApiControllerList = exports.interactLibraryTagV2ApiControllerUpdate = exports.interactLibraryTagV2ApiControllerGet = exports.interactLibraryTagV2ApiControllerDelete = exports.interactLibraryTagV2ApiControllerBulkDelete = exports.interactLibraryTagV2ApiControllerCreate = exports.interactLibraryTagV2ApiControllerList = exports.interactLibrarySnippetV2ApiControllerUpdate = exports.interactLibrarySnippetV2ApiControllerGet = exports.interactLibrarySnippetV2ApiControllerDelete = exports.interactLibrarySnippetV2ApiControllerBulkDelete = exports.interactLibrarySnippetV2ApiControllerCreate = exports.interactLibrarySnippetV2ApiControllerList = exports.caseV2ApiControllerUpdateCase = exports.caseV2ApiControllerGetCaseByIdOrName = void 0;
-exports.diskImageAcquisitionLibraryApiControllerUpdate = exports.diskImageAcquisitionLibraryApiControllerGet = exports.diskImageAcquisitionLibraryApiControllerDelete = exports.diskImageAcquisitionLibraryApiControllerBulkDelete = exports.diskImageAcquisitionLibraryApiControllerCreate = exports.diskImageAcquisitionLibraryApiControllerList = exports.cloudAcquisitionLibraryApiControllerUpdate = exports.cloudAcquisitionLibraryApiControllerGet = exports.cloudAcquisitionLibraryApiControllerDelete = exports.cloudAcquisitionLibraryApiControllerBulkDelete = exports.cloudAcquisitionLibraryApiControllerCreate = exports.cloudAcquisitionLibraryApiControllerList = exports.assetInteractMessageV2ApiControllerGetSessionReport = exports.assetInteractMessageV2ApiControllerDownloadMessageOutput = exports.assetInteractMessageV2ApiControllerGetMessage = exports.assetInteractMessageV2ApiControllerListSessionsForAsset = exports.assetAcquisitionV2ApiControllerFilterAcquisitionTasks = exports.assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = exports.assetAcquisitionV2ApiControllerCancelAcquisition = exports.assetAcquisitionV2ApiControllerAcquire = exports.assetTriageV2ApiControllerDeleteTriageAssignment = exports.assetTriageV2ApiControllerCancelTriage = exports.assetTriageV2ApiControllerRunTriage = exports.assetTriageV2ApiControllerFilterTriageTasks = exports.assetV2ApiControllerUpdateLabel = exports.assetV2ApiControllerReplaceTags = exports.assetV2ApiControllerGetAsset = exports.assetV2ApiControllerDeleteAsset = exports.assetV2ApiControllerFilterAssets = exports.assetV2ApiControllerExportAssets = exports.assetV2ApiControllerGetStats = exports.assetInteractV2ApiControllerCloseSession = exports.assetInteractV2ApiControllerCancelCommand = exports.assetInteractV2ApiControllerRunCommand = exports.assetInteractMessageV2ApiControllerListForAsset = exports.assetBulkTriageV2ApiControllerRunTriage = exports.assetBulkMetadataV2ApiControllerImportOffNetworkPpc = exports.assetBulkMetadataV2ApiControllerDeleteAssets = exports.assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = void 0;
+exports.assetActionV2ApiControllerShutdown = exports.assetActionV2ApiControllerReboot = exports.investigationsDirectoryV2ApiControllerRetryFailedImports = exports.investigationsDirectoryV2ApiControllerMigrationsSummary = exports.investigationsDirectoryV2ApiControllerImportProgress = exports.investigationsDirectoryV2ApiControllerGet = exports.investigationsDirectoryV2ApiControllerList = exports.investigationSqlV2ApiControllerExecuteSqlQuery = exports.investigationSqlV2ApiControllerGetSchema = exports.investigationFindingV2ApiControllerUpdateFinding = exports.investigationFindingV2ApiControllerUnmarkFinding = exports.investigationFindingV2ApiControllerMarkAsFinding = exports.investigationEvidenceFlagV2ApiControllerUnflagEvidence = exports.investigationEvidenceFlagV2ApiControllerFlagEvidence = exports.investigationAnnotationV2ApiControllerDeleteComment = exports.investigationAnnotationV2ApiControllerCommentEvidence = exports.investigationAnnotationV2ApiControllerListComments = exports.investigationAnnotationV2ApiControllerUpdateNote = exports.flagsLibraryV2ApiControllerUpdate = exports.flagsLibraryV2ApiControllerGet = exports.flagsLibraryV2ApiControllerDelete = exports.flagsLibraryV2ApiControllerCreate = exports.flagsLibraryV2ApiControllerList = exports.exclusionRulesLibraryV2ApiControllerDeleteIndividual = exports.exclusionRulesLibraryV2ApiControllerApply = exports.exclusionRulesLibraryV2ApiControllerMatches = exports.exclusionRulesLibraryV2ApiControllerListReasons = exports.exclusionRulesLibraryV2ApiControllerCreate = exports.exclusionRulesLibraryV2ApiControllerList = exports.exclusionRulesLibraryV2ApiControllerDelete = exports.interactCommandV2ApiControllerList = exports.interactLibraryFileV2ApiControllerDownload = exports.interactLibraryFileV2ApiControllerDelete = exports.interactLibraryFileV2ApiControllerBulkDelete = exports.interactLibraryFileV2ApiControllerUpload = exports.interactLibraryFileV2ApiControllerList = exports.interactLibraryTagV2ApiControllerUpdate = exports.interactLibraryTagV2ApiControllerGet = exports.interactLibraryTagV2ApiControllerDelete = exports.interactLibraryTagV2ApiControllerBulkDelete = exports.interactLibraryTagV2ApiControllerCreate = exports.interactLibraryTagV2ApiControllerList = exports.interactLibrarySnippetV2ApiControllerUpdate = exports.interactLibrarySnippetV2ApiControllerGet = exports.interactLibrarySnippetV2ApiControllerDelete = exports.interactLibrarySnippetV2ApiControllerBulkDelete = exports.interactLibrarySnippetV2ApiControllerCreate = exports.interactLibrarySnippetV2ApiControllerList = exports.caseV2ApiControllerUpdateCase = exports.caseV2ApiControllerGetCaseByIdOrName = void 0;
+exports.cloudAcquisitionLibraryApiControllerBulkDelete = exports.cloudAcquisitionLibraryApiControllerCreate = exports.cloudAcquisitionLibraryApiControllerList = exports.assetInteractMessageV2ApiControllerGetSessionReport = exports.assetInteractMessageV2ApiControllerDownloadMessageOutput = exports.assetInteractMessageV2ApiControllerGetMessage = exports.assetInteractMessageV2ApiControllerListSessionsForAsset = exports.assetAcquisitionV2ApiControllerFilterAcquisitionTasks = exports.assetAcquisitionV2ApiControllerDeleteAcquisitionAssignment = exports.assetAcquisitionV2ApiControllerCancelAcquisition = exports.assetAcquisitionV2ApiControllerAcquire = exports.assetTriageV2ApiControllerDeleteTriageAssignment = exports.assetTriageV2ApiControllerCancelTriage = exports.assetTriageV2ApiControllerRunTriage = exports.assetTriageV2ApiControllerFilterTriageTasks = exports.assetV2ApiControllerUpdateLabel = exports.assetV2ApiControllerReplaceTags = exports.assetV2ApiControllerGetAsset = exports.assetV2ApiControllerDeleteAsset = exports.assetV2ApiControllerFilterAssets = exports.assetV2ApiControllerExportAssets = exports.assetV2ApiControllerGetStats = exports.assetInteractV2ApiControllerCloseSession = exports.assetInteractV2ApiControllerCancelCommand = exports.assetInteractV2ApiControllerRunCommand = exports.assetInteractMessageV2ApiControllerListForAsset = exports.assetDeploymentV2ApiControllerDeploy = exports.assetBulkTriageV2ApiControllerRunTriage = exports.assetBulkMetadataV2ApiControllerImportOffNetworkPpc = exports.assetBulkMetadataV2ApiControllerDeleteAssets = exports.assetBulkMetadataV2ApiControllerSetMitreDatabaseVersion = exports.assetBulkMetadataV2ApiControllerSetConnectionRoute = exports.assetBulkMetadataV2ApiControllerSetUpdateExclusion = exports.assetBulkMetadataV2ApiControllerRemoveTags = exports.assetBulkMetadataV2ApiControllerAddTags = exports.assetBulkActionV2ApiControllerDisableMaintenance = exports.assetBulkActionV2ApiControllerEnableMaintenance = exports.assetBulkActionV2ApiControllerVersionUpdate = exports.assetBulkActionV2ApiControllerRetrieveLogs = exports.assetBulkActionV2ApiControllerUnisolate = exports.assetBulkActionV2ApiControllerIsolate = exports.assetBulkActionV2ApiControllerShutdown = exports.assetBulkActionV2ApiControllerReboot = exports.assetActionV2ApiControllerImportPpcToExistingAsset = exports.assetActionV2ApiControllerDisableMaintenance = exports.assetActionV2ApiControllerEnableMaintenance = exports.assetActionV2ApiControllerVersionUpdate = exports.assetActionV2ApiControllerRetrieveLogs = exports.assetActionV2ApiControllerUnisolate = exports.assetActionV2ApiControllerIsolate = void 0;
+exports.diskImageAcquisitionLibraryApiControllerUpdate = exports.diskImageAcquisitionLibraryApiControllerGet = exports.diskImageAcquisitionLibraryApiControllerDelete = exports.diskImageAcquisitionLibraryApiControllerBulkDelete = exports.diskImageAcquisitionLibraryApiControllerCreate = exports.diskImageAcquisitionLibraryApiControllerList = exports.cloudAcquisitionLibraryApiControllerUpdate = exports.cloudAcquisitionLibraryApiControllerGet = exports.cloudAcquisitionLibraryApiControllerDelete = void 0;
 const client_1 = require("./client");
 const client_gen_1 = require("./client.gen");
 /**
@@ -25,7 +26,7 @@ const capabilitiesV2ApiControllerGet = (options) => {
                 type: 'http'
             }
         ],
-        url: '/api/v2/_/capabilities',
+        url: '/api/v2/token/capabilities',
         ...options
     });
 };
@@ -48,7 +49,7 @@ const openApiAliasV2ApiControllerGet = (options) => {
                 type: 'apiKey'
             }
         ],
-        url: '/api/v2/_/openapi',
+        url: '/api/v2/openapi',
         ...options
     });
 };
@@ -1730,6 +1731,187 @@ const interactCommandV2ApiControllerList = (options) => {
     });
 };
 exports.interactCommandV2ApiControllerList = interactCommandV2ApiControllerList;
+/**
+ * Delete exclusion rules
+ * Removes exclusion rules by id. The findings they were suppressing become visible again. Ids that do not exist are reported under warnings[] code=RULES_NOT_FOUND rather than counted as deleted; a request where none exist is a 404. `dryRun` previews without deleting.
+ */
+const exclusionRulesLibraryV2ApiControllerDelete = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/libraries/exclusion-rules',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.exclusionRulesLibraryV2ApiControllerDelete = exclusionRulesLibraryV2ApiControllerDelete;
+/**
+ * List the exclusion rules of one organization
+ * Returns the finding-exclusion rules visible in one organization, with offset pagination, a case-insensitive `filter[searchTerm]` contains match on the reason and optional `filter[sourceType]` narrowing. Investigation-scoped rules are included only for investigations the caller can reach. Only RULE-type exclusions are listed: individual, per-row suppressions live on the findings that carry them, not in the library.
+ */
+const exclusionRulesLibraryV2ApiControllerList = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/libraries/exclusion-rules',
+        ...options
+    });
+};
+exports.exclusionRulesLibraryV2ApiControllerList = exclusionRulesLibraryV2ApiControllerList;
+/**
+ * Create exclusion rules
+ * Creates one or many exclusion rules in a single call; each rule carries its own scope, and the request-level `reason` is recorded on all of them. Creating a rule SUPPRESSES matching findings from analysis, so the `dryRun` preview reports how many findings would disappear rather than only echoing the request.
+ */
+const exclusionRulesLibraryV2ApiControllerCreate = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/libraries/exclusion-rules',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.exclusionRulesLibraryV2ApiControllerCreate = exclusionRulesLibraryV2ApiControllerCreate;
+/**
+ * List the exclusion reasons already in use
+ * Returns the built-in reasons plus the reasons recorded on the rules of ONE organization, so a new rule can reuse the wording the team already agreed on instead of inventing another. Scoped like the rule listing: reasons are analyst-written free text and are not shared across organizations.
+ */
+const exclusionRulesLibraryV2ApiControllerListReasons = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/libraries/exclusion-rules/reasons',
+        ...options
+    });
+};
+exports.exclusionRulesLibraryV2ApiControllerListReasons = exclusionRulesLibraryV2ApiControllerListReasons;
+/**
+ * Count the findings some rules would suppress
+ * Evaluates draft rules against the existing findings and returns how many they would suppress. Read-only: nothing is created. The scan covers only the investigations the caller can reach, so an organization-scoped rule is sized over the caller's own view of that organization rather than all of it. Use it to size the effect of a rule before committing to it.
+ */
+const exclusionRulesLibraryV2ApiControllerMatches = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/libraries/exclusion-rules/matches',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.exclusionRulesLibraryV2ApiControllerMatches = exclusionRulesLibraryV2ApiControllerMatches;
+/**
+ * Widen an existing exclusion rule
+ * Broadens an existing rule: `scope=organization` re-scopes it to a whole organization, `scope=allAssets` drops its asset restriction. Both widen what the rule suppresses and neither can be narrowed back through this endpoint -- delete and recreate instead. Widening an already organization-scoped rule to an organization is a 409, since there is nothing to widen. `dryRun` previews without applying.
+ */
+const exclusionRulesLibraryV2ApiControllerApply = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/libraries/exclusion-rules/{ruleId}/apply',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.exclusionRulesLibraryV2ApiControllerApply = exclusionRulesLibraryV2ApiControllerApply;
+/**
+ * Remove individual per-row exclusions from one investigation
+ * Removes individual exclusions -- the ones that hide a single finding row -- from one investigation, making those findings visible again. Addressed by investigation because that is the scope an individual exclusion lives in. `dryRun` previews without removing.
+ */
+const exclusionRulesLibraryV2ApiControllerDeleteIndividual = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/libraries/exclusion-rules/individual',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.exclusionRulesLibraryV2ApiControllerDeleteIndividual = exclusionRulesLibraryV2ApiControllerDeleteIndividual;
 /**
  * List investigation flags
  * Lists the shared investigation flag library, scoped by `organizations`. Supports offset pagination, a case-insensitive `filter[name]` contains match and sorting by name, createdAt or updatedAt (default name ascending). Each entry carries the flag's id, name, color, description and owning organization.
@@ -1853,6 +2035,106 @@ const flagsLibraryV2ApiControllerUpdate = (options) => {
     });
 };
 exports.flagsLibraryV2ApiControllerUpdate = flagsLibraryV2ApiControllerUpdate;
+/**
+ * Write or clear the note on evidence rows
+ * Sets the note carried by one or more rows of an investigation. A row holds exactly ONE note, so writing replaces whatever was there; sending an empty `note` clears it. The note is keyed by the evidence coordinate, which means the same note is visible from the evidence grid, the Findings view and the timeline -- `source` only records where it was written. Coordinates that match no row are skipped and reported under warnings[] code=ROWS_SKIPPED. `dryRun` previews without writing.
+ */
+const investigationAnnotationV2ApiControllerUpdateNote = (options) => {
+    return (options.client ?? client_gen_1.client).put({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}/note',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.investigationAnnotationV2ApiControllerUpdateNote = investigationAnnotationV2ApiControllerUpdateNote;
+/**
+ * List the comments on one evidence row
+ * Returns the analyst comments on a single row, oldest first, each with its id (what the delete route takes), author and mentioned users. Identify the row with evidence (table name as SQL discovery shows it, or its bare section), taskAssignmentId and objectId (the evidence row air_object_id, NOT air_id). A coordinate that resolves to no row simply has no comments and returns an empty list.
+ */
+const investigationAnnotationV2ApiControllerListComments = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}/comments',
+        ...options
+    });
+};
+exports.investigationAnnotationV2ApiControllerListComments = investigationAnnotationV2ApiControllerListComments;
+/**
+ * Post a comment on evidence rows
+ * Adds an analyst comment to one or more rows. Unlike the note, comments accumulate: each post is a new comment and nothing is replaced. Mentioned users are NOTIFIED, so a live call reaches real people -- preview with `dryRun` first, which resolves the coordinates and notifies nobody. Coordinates that match no row are skipped and reported under warnings[] code=ROWS_SKIPPED.
+ */
+const investigationAnnotationV2ApiControllerCommentEvidence = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}/comments',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.investigationAnnotationV2ApiControllerCommentEvidence = investigationAnnotationV2ApiControllerCommentEvidence;
+/**
+ * Delete one comment
+ * Removes a single comment, addressed by the id the list route returns. Only its author may delete it (403 otherwise); a comment id from another investigation is a leak-safe 404. Irreversible. `dryRun` previews without deleting.
+ */
+const investigationAnnotationV2ApiControllerDeleteComment = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}/comments/{commentId}',
+        ...options
+    });
+};
+exports.investigationAnnotationV2ApiControllerDeleteComment = investigationAnnotationV2ApiControllerDeleteComment;
 /**
  * Flag evidence rows in an investigation
  * Marks evidence, finding or timeline rows of one investigation with a flag from the flags library, identified by numeric id or exact name; a flag name that does not exist yet is auto-created in the investigation's organization. Each row is addressed by its evidence table or section name, objectId and taskAssignmentId, and `source` selects the surface (EVIDENCE, FINDING or TIMELINE). Returns a receipt with the resolved flag and the number of rows flagged, plus warnings for skipped rows and flag auto-creation; `dryRun` previews the outcome without changing anything.
@@ -1907,6 +2189,87 @@ const investigationEvidenceFlagV2ApiControllerUnflagEvidence = (options) => {
     });
 };
 exports.investigationEvidenceFlagV2ApiControllerUnflagEvidence = investigationEvidenceFlagV2ApiControllerUnflagEvidence;
+/**
+ * Mark evidence rows as findings
+ * Records the analyst verdict on evidence rows of one investigation, turning each row into a finding. Rows are addressed by their evidence table or section name, taskAssignmentId and objectId, where objectId is the row air_object_id -- NOT air_id and NOT the full-text-search id. An optional request-level `note` is attached to every row this call marks, in the same request. Coordinates that match no row are skipped and reported under warnings[] code=ROWS_SKIPPED; rows that already carry a finding are left untouched and reported as ALREADY_FINDING (use the update endpoint to change those). If the findings are written but the note is not, the response still succeeds with noteAttached=false, a NOTE_FAILED warning and the coordinates to retry the note with -- nothing is rolled back. `dryRun` previews the outcome without changing anything. Discover coordinates with air-investigations-sql-query first.
+ */
+const investigationFindingV2ApiControllerMarkAsFinding = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}/mark-as-finding',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.investigationFindingV2ApiControllerMarkAsFinding = investigationFindingV2ApiControllerMarkAsFinding;
+/**
+ * Remove a finding
+ * Removes exactly one analyst finding, addressed by the same coordinate mark-as-finding took, together with the timeline entry derived from it. Irreversible: re-marking the row creates a new finding, it does not restore this one. Only findings created through mark-as-finding can be removed, and only by the analyst who created them (403 otherwise); automatically produced findings return 404. The justification note and any flags on the coordinate are NOT removed -- both belong to the evidence row and stay visible on the evidence surface. `dryRun` previews without deleting anything.
+ */
+const investigationFindingV2ApiControllerUnmarkFinding = (options) => {
+    return (options.client ?? client_gen_1.client).delete({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}/finding',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.investigationFindingV2ApiControllerUnmarkFinding = investigationFindingV2ApiControllerUnmarkFinding;
+/**
+ * Update a finding
+ * Replaces the editable fields of exactly one finding -- verdict, category, path, date/dateSource and MITRE mapping -- and optionally its justification note. The finding is addressed by the SAME coordinate mark-as-finding took: the evidence table or section name, taskAssignmentId and the evidence row air_object_id (which the findings surface stores as air_evidence_object_id, NOT the findings row own air_object_id). Unlike marking, a coordinate that resolves to no editable finding is a 404 rather than a skipped row: only findings created through mark-as-finding are editable, and only by the analyst who created them (403 otherwise). Omitted optional fields are cleared; omit `note` entirely to leave the existing note alone, or send an empty string to clear it. `dryRun` previews the outcome without changing anything.
+ */
+const investigationFindingV2ApiControllerUpdateFinding = (options) => {
+    return (options.client ?? client_gen_1.client).patch({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}/finding',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.investigationFindingV2ApiControllerUpdateFinding = investigationFindingV2ApiControllerUpdateFinding;
 /**
  * Discover investigation tables and columns
  * Two-stage schema discovery for one investigation via POST /api/v2/investigations/{idOrName}/schema. Read-only. Empty body {} lists populated tables/materialized views using catalog row estimates and available regular views with rowCount=null. Body { "table": "<name>" } returns an exact, timeout-bounded row count and that table or view's columns (name, type, nullable). idOrName accepts an investigation UUID, a case UUID or an exact case name. Fixed tables: air_investigation_activities, air_investigation_activity_user_reads, air_investigation_comments, air_investigation_evidence_metadata, air_investigation_evidence_relations, air_investigation_evidence_transformer_versions, air_investigation_external_section_import_error, air_investigation_external_section_import_status, air_investigation_finding_timeline, air_investigation_flags, air_investigation_full_text_search, air_investigation_metadata, air_investigation_notes, air_investigation_reports, air_investigation_report_history, air_investigation_task_assignments, air_investigation_task_execution_logs, air_investigation_timeline, air_investigation_timeline_event_range, air_investigation_timeline_hourly, air_investigation_user_findings, drone_findings. Views: air_all_findings_view, air_excluded_findings_view, air_findings_view, air_timeline_findings_view. Evidence tables are named <platform>_<section> (e.g. windows_triage_file, linux_triage_file, windows_event_records) and vary per investigation. POST the schema endpoint with an empty body to list the populated tables of this investigation with row counts; POST { "table": "<name>" } for column details.
@@ -1961,6 +2324,125 @@ const investigationSqlV2ApiControllerExecuteSqlQuery = (options) => {
     });
 };
 exports.investigationSqlV2ApiControllerExecuteSqlQuery = investigationSqlV2ApiControllerExecuteSqlQuery;
+/**
+ * List investigations
+ * Lists investigations visible to the caller, scoped by `organizations`. Supports offset pagination, a case-insensitive `filter[name]` contains match on the backing case name and sorting by createdAt or lastAccessedAt (default createdAt descending). Rows are relevance-filtered: callers only see investigations they are related to via an accessible task assignment or a case they can access.
+ */
+const investigationsDirectoryV2ApiControllerList = (options) => {
+    return (options?.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations',
+        ...options
+    });
+};
+exports.investigationsDirectoryV2ApiControllerList = investigationsDirectoryV2ApiControllerList;
+/**
+ * Get investigation by id or case name
+ * Fetches one investigation by investigation UUID, case UUID or exact case name and returns its detail in entities[0]. Callers unrelated to the investigation receive the same leak-safe 404 as an unknown identifier; a case name shared across organizations returns 400 AMBIGUOUS_NAME.
+ */
+const investigationsDirectoryV2ApiControllerGet = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}',
+        ...options
+    });
+};
+exports.investigationsDirectoryV2ApiControllerGet = investigationsDirectoryV2ApiControllerGet;
+/**
+ * Get evidence-import progress
+ * Readiness check: without `taskAssignmentId` returns task-assignment counts grouped by data-import status for the whole investigation; with it, per-table import progress for that assignment. SQL queries return meaningful data only after imports complete.
+ */
+const investigationsDirectoryV2ApiControllerImportProgress = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}/import-progress',
+        ...options
+    });
+};
+exports.investigationsDirectoryV2ApiControllerImportProgress = investigationsDirectoryV2ApiControllerImportProgress;
+/**
+ * Get schema/data migration status
+ * Readiness check: per-migration status (pending/in-progress/completed/failed) for the investigation's internal schema and data migrations. `registryState: "unknown"` means the investigation is not tracked by the migration registry yet. Until migrations complete, views or columns may be missing and SQL queries can fail with UNKNOWN_TABLE.
+ */
+const investigationsDirectoryV2ApiControllerMigrationsSummary = (options) => {
+    return (options.client ?? client_gen_1.client).get({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}/migrations-summary',
+        ...options
+    });
+};
+exports.investigationsDirectoryV2ApiControllerMigrationsSummary = investigationsDirectoryV2ApiControllerMigrationsSummary;
+/**
+ * Retry failed evidence imports
+ * Re-enqueues failed task-assignment evidence imports for the investigation, optionally narrowed by taskAssignmentId and/or investigationDataType. `?dryRun=true` previews the assignments that would be retried without enqueueing anything. Duplicate in-flight retries are deduplicated downstream by the deterministic per-assignment import job id. An assignment the job queue does not accept is left in its failed (retryable) state and reported under `warnings` with code `ENQUEUE_FAILED` instead of being counted.
+ */
+const investigationsDirectoryV2ApiControllerRetryFailedImports = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/investigations/{idOrName}/retry-failed-imports',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.investigationsDirectoryV2ApiControllerRetryFailedImports = investigationsDirectoryV2ApiControllerRetryFailedImports;
 /**
  * Reboot a single asset
  * Sends a reboot signal to one asset, identified by UUID or exact name. Returns the created task assignment; dryRun=true returns a same-shape preview without dispatching anything.
@@ -2638,6 +3120,33 @@ const assetBulkTriageV2ApiControllerRunTriage = (options) => {
     });
 };
 exports.assetBulkTriageV2ApiControllerRunTriage = assetBulkTriageV2ApiControllerRunTriage;
+/**
+ * Deploy the AIR Responder to cloud assets
+ * Resolves cloud assets by id or exact name, previews eligible targets with dryRun=true, and creates one agent-deployment task per organization with dryRun=false.
+ */
+const assetDeploymentV2ApiControllerDeploy = (options) => {
+    return (options.client ?? client_gen_1.client).post({
+        responseType: 'json',
+        security: [
+            {
+                in: 'cookie',
+                name: 'Authentication',
+                type: 'apiKey'
+            },
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/api/v2/deploy',
+        ...options,
+        headers: {
+            'Content-Type': 'application/json',
+            ...options.headers
+        }
+    });
+};
+exports.assetDeploymentV2ApiControllerDeploy = assetDeploymentV2ApiControllerDeploy;
 /**
  * List InterAct messages for an asset
  * Lists the InterAct shell messages recorded for one asset, identified by UUID or exact name, across all of its sessions. Supports offset pagination, sorting, and filtering by session and creation date range. Each entry carries the command, its status, and the output inline or via outputUrl.