@knowttl/artium-axi 0.0.15 → 0.0.17

package/README.md

@@ -163,6 +163,14 @@ Artium's authenticated setup fetches managed skills; a standalone skill installe
 All tools start disabled; write access defaults to off.
 Administrator capability alone grants no tool access; upstream permissions remain an additional boundary.
 
+Microsoft Graph defaults to the `entra` pack.
+Administrators can opt in to the single read-only `security hunting query` command for Defender XDR advanced hunting with `enabledPacks: ["entra", "security"]` in the managed tool settings.
+Hunting accepts exactly one UTF-8 plain-text upload named `query.kql`, at most 64 KiB, through `artium-axi mg-axi security hunting query --file query.kql`.
+See [client input handling](docs/client-reference.md#command-surface-and-subcommands) for local file paths and upload restrictions.
+Queries must use the upstream restricted read-only KQL subset.
+The existing mg-axi role grant is required; other security commands remain unavailable.
+See [Graph credential setup](docs/tool-credentials.md#microsoft-graph) for hunting permissions and consent; tenant acceptance remains unverified.
+
 Falcon investigation reads include detection lineage, process details and trees, existing sandbox reports, FileVantage changes and device-control policy details.
 
 Vectra supports selected QUX/RUX writes for detection close/open and mark-fixed, host/account close, key assets, tags, notes (including bulk notes), assignments and outcomes, triage labels and rules, groups and membership, proxies, threat feeds, internal-network settings, syslog/Kafka, notification destinations and Match, subject to deployment support in the [reviewed inventory](tools/inventories/vectra-axi.json).
@@ -183,7 +191,8 @@ See [client input handling](docs/client-reference.md#command-surface-and-subcomm
 | Hybrid Analysis | Sandbox submissions, YARA create/update/delete, consuming hunting matches and the four reviewed archive downloads require administrator `writes.allowWrites: true`, independently selected operations, native preview, `--execute`, exact `--confirm` and durable journaling. Downloads are limited to `hash-download-bin`, `report-download-bin`, `report-download-dropped-files` and `report-download-memory`, through the [authenticated CLI verified-save path](docs/client-reference.md#hybrid-analysis-archive-saving) after the [operator prerequisites](docs/runbook.md#scope-and-prerequisites) pass. All operations default off; enabling other writes never enables downloads or grants upstream entitlement. The browser provides warnings, command guidance and metadata/save status only. Ordinary tool-run downloads, local configuration and credential/origin overrides are blocked. |
 
 Hybrid Analysis quick scans transmit the supplied sample or URL as read exceptions without a write gate; sandbox submission previews disclose that samples and reports can become visible to the community.
-Consuming hunting matches marks every returned match delivered; reconcile ambiguous outcomes using the audit ID, durable native journal and returned read-back guidance before retrying.
+Consuming hunting matches is account-wide across all rules, with no rule selector, and irreversibly marks every returned match delivered; reconcile ambiguous outcomes using the audit ID, durable native journal and returned read-back guidance before retrying.
+Updating a YARA rule with `reset_counter:true` resets its all-time match counter and changes its rule ID; use the returned ID for subsequent commands.
 Labs hunting and search contracts are experimental.
 
 There is no universal Artium confirmation flag.

package/bin/artium-axi.mjs

@@ -20191,10 +20191,14 @@ var nativeSettingsSchemas = {
   "awx-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional() }),
   "ldap-axi": external_exports.strictObject({}),
   "ado-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional() }),
-  "mg-axi": external_exports.strictObject({ preview: external_exports.boolean().optional(), writes: external_exports.strictObject({
-    allowWrites: external_exports.boolean(),
-    operations: external_exports.array(external_exports.string().min(1).max(256)).min(1).max(64)
-  }).optional() }),
+  "mg-axi": external_exports.strictObject({
+    enabledPacks: external_exports.array(external_exports.enum(["entra", "security"])).min(1).max(2).refine((packs) => packs.includes("entra") && new Set(packs).size === packs.length).optional(),
+    preview: external_exports.boolean().optional(),
+    writes: external_exports.strictObject({
+      allowWrites: external_exports.boolean(),
+      operations: external_exports.array(external_exports.string().min(1).max(256)).min(1).max(64)
+    }).optional()
+  }),
   "falcon-axi": external_exports.strictObject({
     allowWrites: external_exports.boolean().optional(),
     rtr: falconRtrSettingsSchema.optional(),
@@ -20737,7 +20741,6 @@ var runResponseSchema = external_exports.union([runSuccessSchema, errorResponseS
 
 // src/cli/http.ts
 import { readFileSync as readFileSync2 } from "node:fs";
-import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { rootCertificates } from "node:tls";
 import { resolve } from "node:path";
@@ -20745,7 +20748,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.15",
+  version: "0.0.17",
   private: true,
   license: "MIT",
   type: "module",
@@ -20961,6 +20964,8 @@ var SessionStore = class {
 };
 
 // src/cli/http.ts
+var { request: httpRequest } = process.getBuiltinModule("node:http");
+var ACCESS_EXPIRY_SKEW_MS = 3e4;
 var DEFAULT_REQUEST_DEADLINE_MS = 9e4;
 var Client = class {
   constructor(environment = process.env, managed2, requestDeadlineMs = DEFAULT_REQUEST_DEADLINE_MS) {
@@ -21076,9 +21081,13 @@ var Client = class {
       (token) => this.request(path, method, input2, token),
       (refreshToken) => this.request("/v1/auth/refresh", "POST", { refreshToken })
     );
-    const session = previous ? this.reload(previous) : this.sessions.read();
+    let session = previous ? this.reload(previous) : this.sessions.read();
     if (!session) throw new ArtiumError("TOKEN_INVALID", void 0, "Run artium-axi login --username <username> --password-stdin.");
     if (session.status === "password-change-required") throw new ArtiumError("PASSWORD_CHANGE_REQUIRED");
+    if (session.accessExpiresAt <= Date.now() + ACCESS_EXPIRY_SKEW_MS) {
+      const expiring = session;
+      session = await this.sessions.locked(() => this.refresh(expiring));
+    }
     let result;
     try {
       result = await this.request(path, method, input2, session.accessToken);
@@ -25016,10 +25025,10 @@ var vectra_axi_default = {
 var az_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "az-axi",
-  version: "0.1.10",
-  integrity: "sha512-9RGnZrFOKpCIMC66nwxpWAzFLYrNlUJqaZWz8i/W1WexcP3sRj6BK4JWg0loc4zn+X7QKHRynKIx3pkdDOpTyw==",
+  version: "0.1.11",
+  integrity: "sha512-XiCwLaSh6A6xb9sk7RQ7T3FvkYpkWFIoGUCi7HxYlHF4kssVpF5gun4V7Taw9eKcm0HEWftnLci9l4EBSaFj0w==",
   parserEvidence: "Installed pinned catalogue exports, provisional until adapter acceptance",
-  packageManifestSha256: "7ec6a1ca9fd18e24bf0405bb49702d6846e40bcb089b270e8bdafedf345d9545",
+  packageManifestSha256: "8bdf756d4f0b3d006543471320eb14d83f258122752bd1e07c76a2a74868691c",
   environment: [
     {
       name: "AZ_AXI_CONFIG",
@@ -25195,7 +25204,7 @@ var az_axi_default = {
       "sub",
       "list"
     ],
-    help: "Command: az-axi sub list\nNative operation: az-axi account list; existing scope, defaults and TOON output apply.\nFlags: --subscription, --management-group, --help, --full, --fields, --limit, --all, --max-rows\nShort flags where accepted: -h help, -s subscription, -g resource-group, -n name, -w workspace, -t timespan.\nLists accept comma-separated, space-separated and repeated values after the leaf path.\nBooleans accept bare flags or true/false. Conflicting scalar values are refused.\n\nLists live ARM subscriptions in selected scope (flags, environment, profile, else all accessible), resolving unambiguous names to IDs. This is not Azure CLI's cached account list. Legacy sub list still lists all visible subscriptions with inScope markers.\nDefault: name, id (subscription GUID), state, tenantId. --full adds ARM metadata and shows all fetched rows; --fields selects metadata. --limit defaults to 50. Paging stops at 100 pages with lower-bound counts. Management-group scope is unsupported.\nExamples: az-axi account list; az-axi account list -s <subscription> --full\nFetch budget per subscription: 1000 rows by default; --all raises it to 10000 (Key Vault: at most 2500 scanned at 25/page). --max-rows <1..100000> overrides either row budget. Every walk stops at 100 pages. Budgets count rows before local filters. --limit controls display only (default 50); --full shows every fetched row and expands display only, never bypassing fetch budgets. Incomplete totals are lower bounds; narrow the scope or raise --max-rows to search further."
+    help: "Command: az-axi sub list\nNative operation: az-axi account list; existing scope, defaults and TOON output apply.\nFlags: --subscription, --management-group, --help, --full, --fields, --limit, --all, --max-rows\nShort flags where accepted: -h help, -s subscription, -g resource-group, -n name, -w workspace, -t timespan.\nLists accept comma-separated, space-separated and repeated values after the leaf path.\nBooleans accept bare flags or true/false. Conflicting scalar values are refused.\n\nLists live ARM subscriptions in selected scope (flags, environment, profile, else all accessible), resolving unambiguous names to IDs. This is not Azure CLI's cached account list. Legacy sub list still lists all visible subscriptions with inScope markers.\nDefault: name, id (subscription GUID), state, tenantId. --full adds ARM metadata and shows all fetched rows; --fields selects metadata. --limit defaults to 50. Lists follow the shared fetch budget (up to 100 pages and the row budget per subscription); incomplete counts are disclosed as lower bounds. Management-group scope is unsupported.\nExamples: az-axi account list; az-axi account list -s <subscription> --full\nFetch budget per subscription or collection (Resource Graph: across selected scope, per exposure check): 1000 rows by default; --all raises it to 10000 (Key Vault: at most 2500 scanned at 25/page). --max-rows <1..100000> overrides either row budget. Every walk stops at 100 pages. Budgets count rows before local filters. --limit controls display only (usually 50; Defender assessments 25, exposure overview 10 per check); --full shows every fetched row and expands display only, never bypassing fetch budgets. Incomplete totals are lower bounds; narrow the scope or raise --max-rows to search further."
   },
   adapterBoundary: {
     unsafeOverrides: [
@@ -25278,7 +25287,7 @@ var az_axi_default = {
   tokenResourceSources: [
     {
       path: "dist/lib/registry.js",
-      sha256: "e53b5e91dd69c4555960f7d69f0ea377090c8c80ecd38b200885ed31c69d3889"
+      sha256: "1b0354317f721989465190b4a276fce811d559bcbbd9871129b02dd366a5beb5"
     },
     {
       path: "dist/lib/client.js",
@@ -25302,7 +25311,7 @@ var az_axi_default = {
     },
     {
       path: "dist/commands/rbac.js",
-      sha256: "140ee55e6e9c139de95c13198c9b24557dd7b3c510b33d2560e52acf55978eb0"
+      sha256: "a0b5d0e92d47b78be10ef210b657399b3386ca67d0869d466913b31451dcdcaa"
     },
     {
       path: "dist/commands/logs.js",
@@ -26007,6 +26016,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         "resource-group": "value",
         name: "value"
       },
@@ -26071,6 +26082,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         "resource-group": "value",
         name: "value"
       },
@@ -26134,6 +26147,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         "resource-group": "value",
         name: "value"
       },
@@ -26197,6 +26212,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         resource: "value"
       },
       flagAliases: {},
@@ -26256,6 +26273,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         resource: "value",
         metric: "list",
         "start-time": "value",
@@ -26515,6 +26534,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         principal: "value",
         role: "value",
         scope: "value",
@@ -26548,6 +26569,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         principal: "value",
         role: "value",
         scope: "value",
@@ -26582,6 +26605,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         since: "value",
         caller: "value",
         "resource-group": "value",
@@ -26615,6 +26640,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         since: "value",
         caller: "value",
         "resource-group": "value",
@@ -26650,6 +26677,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         severity: "list",
         status: "value",
         since: "value"
@@ -26680,6 +26709,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         severity: "list",
         status: "value",
         since: "value"
@@ -26737,6 +26768,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         name: "value"
       },
       flagAliases: {},
@@ -26796,6 +26829,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         name: "value",
         "assessment-name": "value",
         "assessed-resource-id": "value"
@@ -26935,6 +26970,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         severity: "list",
         status: "value",
         resource: "value",
@@ -26965,7 +27002,9 @@ var az_axi_default = {
         help: "boolean",
         full: "boolean",
         fields: "list",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       flagAliases: {},
       shortFlags: {
@@ -26992,7 +27031,9 @@ var az_axi_default = {
         help: "boolean",
         full: "boolean",
         fields: "list",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       flagAliases: {},
       shortFlags: {
@@ -27094,6 +27135,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         "workspace-name": "value",
         "resource-group": "value",
         workspace: "value",
@@ -27130,6 +27173,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         "workspace-name": "value",
         "resource-group": "value",
         workspace: "value",
@@ -27388,6 +27433,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         check: "value",
         "show-query": "boolean"
       },
@@ -28327,6 +28374,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         "resource-group": "value",
         name: "value"
       },
@@ -28390,6 +28439,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         name: "value"
       },
       flagAliases: {},
@@ -28449,6 +28500,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         name: "value"
       },
       flagAliases: {},
@@ -28508,6 +28561,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         "resource-group": "value",
         name: "value",
         assignment: "value",
@@ -28541,6 +28596,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         "resource-group": "value",
         name: "value"
       },
@@ -28604,6 +28661,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         "resource-group": "value",
         name: "value"
       },
@@ -28667,6 +28726,8 @@ var az_axi_default = {
         full: "boolean",
         fields: "list",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         "resource-group": "value",
         name: "value",
         "custom-role-only": "boolean"
@@ -29682,10 +29743,10 @@ var az_axi_default = {
 var mg_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "mg-axi",
-  version: "0.1.10",
-  integrity: "sha512-rsd8KjyXxojDF3Gu6C95xsJokATeEmUaIRO7Zcaw9h/sF9WLXpW/gh6tKB1niU2QTGe2tsZjPsqXvzpyG34UUA==",
+  version: "0.1.12",
+  integrity: "sha512-TBt2y2rpfn8oi4YOq95uIo43RTsV/iOc0xFa3e3YCjhqd/ZL/y2is+7W0+B5/g1sdwb95yJbcU1eqeJEzmKJ5g==",
   parserEvidence: "Installed pinned catalogue exports",
-  packageManifestSha256: "9526463c1fff30f32a30a58dffbbb2e3d6eaf21a3e06edb904f223d7a535da4d",
+  packageManifestSha256: "e686938dd356bffe87d9884d656a139b91e7eb6d62370f6aba3b5fd14283fb45",
   environment: [
     {
       name: "MG_AXI_CONFIG"
@@ -29723,7 +29784,7 @@ var mg_axi_default = {
   environmentSources: [
     {
       path: "dist/profiles.js",
-      sha256: "97c12ad60bc54bb4180c12eda9a324411070ad08a2cf4555db12eaade1ef3f30"
+      sha256: "5a683251d3427b1642a3d60b5168ae56656506d12aae614ad4469dde6c6d624e"
     },
     {
       path: "dist/mutations.js",
@@ -29763,7 +29824,7 @@ var mg_axi_default = {
     sources: [
       {
         path: "dist/profiles.js",
-        sha256: "97c12ad60bc54bb4180c12eda9a324411070ad08a2cf4555db12eaade1ef3f30"
+        sha256: "5a683251d3427b1642a3d60b5168ae56656506d12aae614ad4469dde6c6d624e"
       },
       {
         path: "dist/mutations.js",
@@ -29780,7 +29841,8 @@ var mg_axi_default = {
       "home",
       "doctor",
       "entra",
-      "api get"
+      "api get",
+      "security hunting query"
     ],
     example: [
       "entra",
@@ -29842,15 +29904,15 @@ var mg_axi_default = {
     sources: [
       {
         path: "dist/catalogue.js",
-        sha256: "4f7710d0feb1bdaeaae1ae68f4e9e41d67f77f20620b824d2f44a95f2c63ee31"
+        sha256: "b6a764b7e50c3f4c84d40dcef1290a2e6a784fe73809977d6b04c06884b7a516"
       },
       {
         path: "dist/cli.js",
-        sha256: "19485f95fc3eeb5447fe05a55eec028dcf5d3c4e17a12f3bee1e0cffc239f00d"
+        sha256: "613fc3ac4870e5538d2c53b0760244c7e3bb3837fa3d97c1b89b7916c557af44"
       },
       {
         path: "dist/profiles.js",
-        sha256: "97c12ad60bc54bb4180c12eda9a324411070ad08a2cf4555db12eaade1ef3f30"
+        sha256: "5a683251d3427b1642a3d60b5168ae56656506d12aae614ad4469dde6c6d624e"
       },
       {
         path: "dist/msal-app-provider.js",
@@ -29880,11 +29942,12 @@ var mg_axi_default = {
       "home",
       "doctor",
       "entra",
-      "api get"
+      "api get",
+      "security hunting query"
     ],
     inputs: {
       stdin: "cursor - only",
-      files: "unsupported",
+      files: "security hunting query only: one UTF-8 query.kql upload, at most 64 KiB; fixed runner leaf name",
       cursor: "opaque token or stdin; never a path",
       api: "reviewed GET routes only; pinned Graph destination and operation gates retained"
     },
@@ -29899,7 +29962,8 @@ var mg_axi_default = {
     ],
     knownOutputScanValues: [
       "clientSecret and trimmed clientSecret",
-      "privateKey and normalized PEM"
+      "privateKey and normalized PEM",
+      "hunting query text"
     ],
     outputScanLimit: "Upstream-minted Graph tokens and assertions are not available during prepare; live redaction remains unverified.",
     resources: {
@@ -29918,11 +29982,11 @@ var mg_axi_default = {
     parserSources: [
       {
         path: "dist/catalogue.js",
-        sha256: "4f7710d0feb1bdaeaae1ae68f4e9e41d67f77f20620b824d2f44a95f2c63ee31"
+        sha256: "b6a764b7e50c3f4c84d40dcef1290a2e6a784fe73809977d6b04c06884b7a516"
       },
       {
         path: "dist/cli.js",
-        sha256: "19485f95fc3eeb5447fe05a55eec028dcf5d3c4e17a12f3bee1e0cffc239f00d"
+        sha256: "613fc3ac4870e5538d2c53b0760244c7e3bb3837fa3d97c1b89b7916c557af44"
       }
     ]
   },
@@ -30023,6 +30087,9 @@ var mg_axi_default = {
     {
       name: "fields"
     },
+    {
+      name: "file"
+    },
     {
       name: "filter"
     },
@@ -30116,6 +30183,9 @@ var mg_axi_default = {
     {
       name: "tenant-id"
     },
+    {
+      name: "timespan"
+    },
     {
       name: "transitive"
     },
@@ -34456,6 +34526,20 @@ var mg_axi_default = {
         required: true
       }
     },
+    {
+      command: "security hunting query",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        file: "value",
+        timespan: "value",
+        limit: "value",
+        full: "boolean",
+        config: "value"
+      },
+      positionalInput: false
+    },
     {
       command: "login",
       flags: {
@@ -35039,8 +35123,8 @@ var ldap_axi_default = {
 var ado_axi_default = {
   generatedBy: "scripts/ado-inventory.mjs",
   tool: "ado-axi",
-  version: "0.4.6",
-  integrity: "sha512-DThi4K9uO/jz93QQMBXtpnCXeHaYsOWSt6TFdYGhnqDN8aScow3bwbhVTIg4KEMVT0KHPYPdH00V9UOPX0c2fA==",
+  version: "0.4.7",
+  integrity: "sha512-qA7qpO0vjlib6r1hOOBfY0+cWn0mVCLBmkFUktJJANPelwbTiZuqgfwgk5D1lGG0q9rgCv+aPJrHOphmWJv0fw==",
   parserEvidence: "Reviewed published dispatch switches, aliases and command flag constants",
   sources: [
     {
@@ -35101,7 +35185,7 @@ var ado_axi_default = {
     },
     {
       path: "dist/commands/pr.js",
-      sha256: "7b4f81ce93f18c1079294e71237be8e85a4c71313ae0bceac50b0245324d8772"
+      sha256: "b85a81782aa806201facd9fc414a62959bc96db9858fa4ba804015395d001c32"
     },
     {
       path: "dist/commands/ref.js",
@@ -39968,8 +40052,8 @@ var awx_axi_default = {
 var tenable_axi_default = {
   generatedBy: "scripts/tenable-inventory.mjs",
   tool: "tenable-axi",
-  version: "0.1.1",
-  integrity: "sha512-ukWwVny4DeEBLqqWJhaM0au4Z5dvQTsDKoE2NhROIE3p114WUz2tT5dOfWL8MaalVrmU/zSMhk+S29sUocR3xg==",
+  version: "0.1.2",
+  integrity: "sha512-csjV0urIUbZZlkA9VQpEGbsOWOnLgZTFMi0yRQD3uGlmlyPIxA6gKyvMzifSqcRvfyOaBEv7U5OjcWL1rs5NAw==",
   parserEvidence: "Published command catalogue, mutation registry and reviewed native parsers and transport gates",
   sources: [
     {
@@ -39990,7 +40074,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/catalogue.js",
-      sha256: "d05c8dfebce3219c2ee0a305888fa336e62db5fc3b3b4bc95a27c0588943587b"
+      sha256: "d99e739f4a9d61cf13c91fd18e69a248f639c33d3e2e5b37efb320f0f50cef16"
     },
     {
       path: "dist/src/cli.js",
@@ -40006,7 +40090,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/exposure.js",
-      sha256: "5e93b01dc54368627f1f7c1ac4a96579af2f4beae7c2b10189ba190cf5cc9af6"
+      sha256: "ef5fbe0d3525b741cc14a51b2ab9cc0cbd5289a1ec97fe01312b4d351beaf0b0"
     },
     {
       path: "dist/src/hook-install.js",
@@ -40014,7 +40098,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/inventory-catalogue.js",
-      sha256: "ccd42834a43aabffbd90e7326926660e9cff788997ab836cb2eb858fc36f1119"
+      sha256: "a0cc6abc55f11815fbacf4e7f869ce0e70e06f678ebbb012afe7500a26fb4de8"
     },
     {
       path: "dist/src/inventory-export-catalogue.js",
@@ -40026,7 +40110,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/inventory.js",
-      sha256: "83bd3b19b1ad54785fdf107b57a66ffc882141706337bb886108b67f75565bb1"
+      sha256: "bc712463ee14db76ff511c4b3ec8d6cadd43b3895e08f1baee785fe3a415916f"
     },
     {
       path: "dist/src/inventory/schema.js",
@@ -40034,7 +40118,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/local-commands.js",
-      sha256: "4bb2769049b72126c47857f850b3cd008a371f952c479e0b288d5279d7aaa77a"
+      sha256: "4169d7a4bc6753d202d515b488ca8863b7368e31e8166f9e958c2fd1c6b05d22"
     },
     {
       path: "dist/src/platform-tag-catalogue.js",
@@ -40046,11 +40130,11 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/private-file.js",
-      sha256: "a5f01182fe09394ecf508deb46d54c9fb0b39c9fd205094d155ace212bbd1c8b"
+      sha256: "436847d36438fa3d73edfbd45cb14faf9935308230fb8b24573926b7f07b6979"
     },
     {
       path: "dist/src/profiles.js",
-      sha256: "12defbf234e4da8584e1f6ba601eb3826733ff85c76445197b0162ac52299b4a"
+      sha256: "b52aa17032f025a81682f0459dcdbed45cf0ed84e10e5aefe31677c31f26414a"
     },
     {
       path: "dist/src/redact.js",
@@ -40257,14 +40341,14 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; default compact view",
+        fields: "Comma-separated display or wire properties; display names: id, name, class, exposureScore; default compact view",
         full: "Show full text; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
         cursor: "Opaque resume cursor; retain the original selectors and filters",
         query: "Simple query text",
-        filter: "Repeatable: <property> <operator> <JSON string array>",
+        filter: 'Repeatable: <property> <operator> <JSON string array>, e.g. asset_class = ["DEVICE"]',
         "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
         sort: "Wire property:asc|desc",
         "extra-properties": "Comma-separated extra wire properties",
@@ -40278,7 +40362,7 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; default compact view",
+        fields: "Comma-separated output fields; accepted: key, readable_name, operators, sortable, filterable, control, description; default compact view",
         full: "Show full text; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
@@ -40293,7 +40377,7 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; default compact view",
+        fields: "Comma-separated display or wire properties; display names: id, name, class, exposureScore; default compact view",
         full: "Show full text; default false",
         help: "Show help",
         id: "Required exact inventory ID",
@@ -40343,7 +40427,7 @@ var tenable_axi_default = {
       command: "auth status",
       effect: "read",
       flags: {
-        config: "Config path; default TENABLE_AXI_CONFIG or platform path",
+        config: "Config path; default environment override or platform path",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated output fields; default all",
         full: "Show full text; default false",
@@ -40686,14 +40770,14 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; default compact view",
+        fields: "Comma-separated display or wire properties; display names: id, name, severity, state; default compact view",
         full: "Show full text; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
         cursor: "Opaque resume cursor; retain the original selectors and filters",
         query: "Simple query text",
-        filter: "Repeatable: <property> <operator> <JSON string array>",
+        filter: 'Repeatable: <property> <operator> <JSON string array>, e.g. severity = ["HIGH"]',
         "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
         sort: "Wire property:asc|desc",
         "extra-properties": "Comma-separated extra wire properties",
@@ -40706,7 +40790,7 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; default compact view",
+        fields: "Comma-separated output fields; accepted: key, readable_name, operators, sortable, filterable, control, description; default compact view",
         full: "Show full text; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
@@ -40720,7 +40804,7 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; default compact view",
+        fields: "Comma-separated display or wire properties; display names: id, name, severity, state; default compact view",
         full: "Show full text; default false",
         help: "Show help",
         id: "Required exact inventory ID",
@@ -40846,14 +40930,14 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; default compact view",
+        fields: "Comma-separated display or wire properties; display names: name, version, publisher; default compact view",
         full: "Show full text; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
         cursor: "Opaque resume cursor; retain the original selectors and filters",
         query: "Simple query text",
-        filter: "Repeatable: <property> <operator> <JSON string array>",
+        filter: 'Repeatable: <property> <operator> <JSON string array>, e.g. application = ["example-app"]',
         "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
         sort: "Wire property:asc|desc",
         "extra-properties": "Comma-separated extra wire properties",
@@ -40866,7 +40950,7 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; default compact view",
+        fields: "Comma-separated output fields; accepted: key, readable_name, operators, sortable, filterable, control, description; default compact view",
         full: "Show full text; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
@@ -41170,8 +41254,8 @@ var tenable_axi_default = {
 var hybrid_axi_default = {
   generatedBy: "scripts/hybrid-inventory.mjs",
   tool: "hybrid-axi",
-  version: "0.1.0",
-  integrity: "sha512-eQdks/92bP8wCn7mpLGqkl5bAI/kYLgRzrRXumtuwpe4sQytNXuAiXY/lNyTYdPT6/WXEFGL9JoaTwWA37F01A==",
+  version: "0.1.1",
+  integrity: "sha512-8K39EZadEq302GcuCKrWmdKJ6NvtFegpGWiStTF8T8gn+lbzbYNiBnRMt5lI0o+hCm7glUdOFahZqw62ylpi7w==",
   parserEvidence: "Published command catalogue, mutation registry and reviewed native parsers and transport gates",
   sources: [
     {
@@ -41180,7 +41264,7 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/cli.js",
-      sha256: "541b529cf64eeae007dac76898ffe288f03c8317f8e24b8c34ef13cb94c95665"
+      sha256: "85424239ee66a94aeb77789392277c300d784c9e77297c72a2b40fa22349abc7"
     },
     {
       path: "dist/src/download-catalogue.js",
@@ -41188,11 +41272,11 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/hunting-catalogue.js",
-      sha256: "899c3a2e5a199fc899364ba2c324d188b3b030a13cb73d7b32927abda0fa562e"
+      sha256: "f013f3f508b15805cabe58c3c6e8f44088dee6448b08469b1dbe8d9d07fae6df"
     },
     {
       path: "dist/src/hunting.js",
-      sha256: "65de316b45aadbaf1d043c44899a3f95acb55f3c1626cef1951a69b80b036d6c"
+      sha256: "323486f2003b1f97979400028b0350e978c84249700f05fed032eb9a1fe413f4"
     },
     {
       path: "dist/src/key-contracts.js",
@@ -41200,7 +41284,7 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/local-commands.js",
-      sha256: "80555cd34f3cfb55e72afb76080138b343bbfef000e0ae16060247ef547de7e9"
+      sha256: "c151a3662a623360ef3d4d40d7c268b8a090983ee7949131237a7704d02a63b8"
     },
     {
       path: "dist/src/private-file.js",
@@ -41208,7 +41292,7 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/profiles.js",
-      sha256: "13efc4d1755319813ddd08ca3a23b89df34c6decfe568e90d71d6c217dfcf1b4"
+      sha256: "a2b567d31d3d1f04bc86970fc8b736b3510c1d7b7848f685c347415387f85543"
     },
     {
       path: "dist/src/redact.js",
@@ -41224,11 +41308,11 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/reports.js",
-      sha256: "404a6bd21adcf33d1808b0703175f952b66220f1ad0821489d42720e0cfbc0fa"
+      sha256: "be256f71a04c2f19371b6eb862b88caff9f2e481b95551749bca172058d70396"
     },
     {
       path: "dist/src/search-catalogue.js",
-      sha256: "205bcc21e3d48f36b1b0d4501ab8a33b12f72d1998c74f7b40a9101328dfcbaa"
+      sha256: "e5cba3e769308123a560f7e9bcbb0f0ab36e428ce3631a173298953f063b8f7e"
     },
     {
       path: "dist/src/search-contracts.js",
@@ -41236,7 +41320,7 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/search.js",
-      sha256: "03c3a4169cb5b731b820ef52278baf7573f9eaaf75b7c0a5f205de2751424da5"
+      sha256: "bd9362c96f6ff2a90c3297308cb7e1ef91469a4b233228abfa3d7a8849d28204"
     },
     {
       path: "dist/src/session.js",
@@ -41268,7 +41352,7 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/writes-core.js",
-      sha256: "c231cae7b8ee78090c4eee94b0f0f1bd0ab3aa9433d0a02711bbd923183f7dc2"
+      sha256: "c91ce1b7b8e2735d60565e0cc043bc3aa76d7d31e81fa6745c01fbb42035baa0"
     },
     {
       path: "dist/src/writes.js",
@@ -41351,7 +41435,7 @@ var hybrid_axi_default = {
       }
     }
   },
-  skillSha256: "3b75c852fcfd4a18589145e1f7ae0cabac7e1896bd427d8ed8a3a43da989e20f",
+  skillSha256: "1d0266cf0237630d063531b567a6b960dca48a731e7917e72b50fb59f757d384",
   nativeWriteSettings: {
     supportedOperations: [
       "convertQuickScan",
@@ -41533,7 +41617,8 @@ var hybrid_axi_default = {
         fields: "Comma-separated response fields; default compact fields",
         full: "Include all response fields; default false",
         hash: "One MD5/SHA1/SHA256/SHA512; exactly one selector required",
-        "hashes-file": "Newline-separated MD5/SHA1/SHA256 file; deprecated bulk route"
+        "hashes-file": "Newline-separated MD5/SHA1/SHA256 file; deprecated bulk route",
+        limit: "Local row limit; default 100; --full does not change it"
       }
     },
     {
@@ -41545,7 +41630,8 @@ var hybrid_axi_default = {
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
         full: "Include all response fields; default false",
-        labs: "Experimental Labs overview; default false"
+        labs: "Experimental Labs overview; default false",
+        limit: "Local row limit; default 100; --full does not change it"
       }
     },
     {
@@ -44293,8 +44379,9 @@ async function toolInput(tool, original) {
   const args = [...original];
   const input2 = {};
   let totalFileBytes = 0;
-  if ((tool === "az-axi" || tool === "hybrid-axi") && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
-    const fileFlags = tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
+  const hunting = tool === "mg-axi" && args.slice(0, 3).join(" ") === "security hunting query";
+  if ((tool === "az-axi" || tool === "hybrid-axi" || hunting) && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
+    const fileFlags = hunting ? ["file"] : tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
     for (let index = 0; index < args.length; index++) {
       if (args[index] === "--") break;
       const [flag] = args[index].split("=");
@@ -44306,10 +44393,11 @@ async function toolInput(tool, original) {
         continue;
       }
       if (!path || path === "-") throw new ArtiumError("UNSUPPORTED_INPUT", "A file flag requires a local file path.");
-      const name = basename(path);
+      if (hunting && (path.split(/[\\/]/).includes("..") || input2.files?.length)) throw new ArtiumError("INVALID_INPUT");
+      const name = hunting ? "query.kql" : basename(path);
       if (input2.files?.some((file2) => file2.name === name)) throw new ArtiumError("INVALID_INPUT", "Upload file names must be distinct.");
       if ((input2.files?.length ?? 0) >= inputLimits.files) throw new ArtiumError("INVALID_INPUT", "Too many upload files.");
-      const content = await readBounded(createReadStream(path), inputLimits.fileBytes);
+      const content = await readBounded(createReadStream(path), hunting ? 65536 : inputLimits.fileBytes);
       totalFileBytes += content.length;
       if (totalFileBytes > inputLimits.totalFileBytes) throw new ArtiumError("INVALID_INPUT", "Uploads exceed the total byte limit.");
       input2.files ??= [];
@@ -44452,6 +44540,7 @@ var ManagedSession = class _ManagedSession {
   }
   channel;
   session;
+  refreshing;
   secrets = [];
   output = { stdout: "", stderr: "" };
   static async read(signIn = false) {
@@ -44497,17 +44586,25 @@ var ManagedSession = class _ManagedSession {
   }
   async authenticated(request, refresh) {
     if (!this.session) throw new ArtiumError("TOKEN_INVALID");
+    const session = this.session;
     try {
-      return await request(this.session.accessToken);
+      return await request(session.accessToken);
     } catch (error62) {
       if (!(error62 instanceof ArtiumError) || error62.code !== "TOKEN_EXPIRED" || !this.session.refreshToken) throw error62;
     }
-    const parsed = loginResponseSchema.safeParse(await refresh(this.session.refreshToken));
-    if (!parsed.success || parsed.data.status !== "authenticated" || !parsed.data.accessToken || !parsed.data.refreshToken) {
-      throw new ArtiumError("INVALID_RESPONSE");
+    if (!this.refreshing && this.session.accessToken === session.accessToken) {
+      this.refreshing = (async () => {
+        const parsed = loginResponseSchema.safeParse(await refresh(session.refreshToken));
+        if (!parsed.success || parsed.data.status !== "authenticated" || !parsed.data.accessToken || !parsed.data.refreshToken) {
+          throw new ArtiumError("INVALID_RESPONSE");
+        }
+        await this.emit(session.serverUrl, parsed.data);
+        this.session = { serverUrl: session.serverUrl, ...parsed.data };
+      })().finally(() => {
+        this.refreshing = void 0;
+      });
     }
-    await this.emit(this.session.serverUrl, parsed.data);
-    this.session = { serverUrl: this.session.serverUrl, ...parsed.data };
+    await this.refreshing;
     return request(this.session.accessToken);
   }
   protect(...secrets) {
@@ -44992,13 +45089,19 @@ remoteRevocation: ${verified ? "verified" : "unverified"}
   const client = new Client(process.env, managed);
   const homeSession = home && !managed ? client.sessions.read() : void 0;
   if (home && !managed && !homeSession) throw new ArtiumError("TOKEN_INVALID", void 0, "Run artium-axi login --username <username> --password-stdin.");
-  const result = await client.authenticated(home || whoami ? "/v1/me" : `/v1/tools${listing ? "" : `/${command}/run`}`, home || listing || whoami ? "GET" : "POST", input2, homeSession);
+  const [result, homeTools] = (await Promise.allSettled([
+    client.authenticated(home || whoami ? "/v1/me" : `/v1/tools${listing ? "" : `/${command}/run`}`, home || listing || whoami ? "GET" : "POST", input2, homeSession),
+    home ? client.authenticated("/v1/tools", "GET", void 0, homeSession) : void 0
+  ])).map((response) => {
+    if (response.status === "rejected") throw response.reason;
+    return response.value;
+  });
   if (home || whoami) {
     const parsed = meResponseSchema.safeParse(result);
     if (!parsed.success) throw new ArtiumError("INVALID_RESPONSE");
     let view = identityView(parsed.data, client.serverUrl);
     if (home) {
-      const tools = toolsResponseSchema.safeParse(await client.authenticated("/v1/tools", "GET", void 0, homeSession));
+      const tools = toolsResponseSchema.safeParse(homeTools);
       if (!tools.success) throw new ArtiumError("INVALID_RESPONSE");
       const executable = resolve4(process.argv[1]);
       const local = relative(homedir3(), executable);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",