@knowttl/artium-axi 0.0.18 → 0.0.20

package/README.md

@@ -169,10 +169,20 @@ Administrators can opt in to the single read-only `security hunting query` comma
 Hunting accepts exactly one UTF-8 plain-text upload named `query.kql`, at most 64 KiB, through `artium-axi mg-axi security hunting query --file query.kql`.
 See [client input handling](docs/client-reference.md#command-surface-and-subcommands) for local file paths and upload restrictions.
 Queries must use the upstream restricted read-only KQL subset.
+Hunting parses KQL before the read-only allowlist and upstream authentication; syntax errors return positioned diagnostics without query excerpts or quoted literals.
+Parsing does not check tables, columns, types or permissions; recognized Graph 400 errors expose only the error class and line/column, while unknown error shapes remain opaque.
 The existing mg-axi role grant is required; other security commands remain unavailable.
 See [Graph credential setup](docs/tool-credentials.md#microsoft-graph) for hunting permissions and consent; tenant acceptance remains unverified.
 
+Azure Resource Graph and Log Analytics queries parse KQL before upstream authentication or requests, returning positioned syntax diagnostics and query excerpts on failure.
+Successful parsing does not validate tables, columns, functions, permissions or service-specific restrictions.
+
 Falcon investigation reads include detection lineage, process details and trees, existing sandbox reports, FileVantage changes and device-control policy details.
+NG-SIEM `search start` checks CQL structure before upstream authentication, reporting code, line, column and token class without echoing query text; function names, fields and semantics remain unchecked, and ambiguous syntax passes.
+Rejected searches preserve redacted server diagnostics, completed searches include server warnings when present, and `search start --wait` advises when the normalized filter differs.
+
+Vectra `host show` and `entity show --type host`, plus the matching raw host reads, retain every returned API field under `host`, separate from CLI metadata.
+Use `--full` on host/entity detail commands for complete returned text; secret redaction still applies, and upstream omissions cannot be restored.
 
 Vectra supports selected QUX/RUX writes for detection close/open and mark-fixed, host/account close, key assets, tags, notes (including bulk notes), assignments and outcomes, triage labels and rules, groups and membership, proxies, threat feeds, internal-network settings, syslog/Kafka, notification destinations and Match, subject to deployment support in the [reviewed inventory](tools/inventories/vectra-axi.json).
 User, role, API-client and credential administration remains blocked.

package/bin/artium-axi.mjs

@@ -20748,7 +20748,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.18",
+  version: "0.0.20",
   private: true,
   license: "MIT",
   type: "module",
@@ -21236,17 +21236,18 @@ var falcon_axi_default = {
   generatedBy: "scripts/falcon-inventory.mjs",
   tool: "falcon-axi",
   repository: "https://github.com/knowttl/falcon-axi.git",
-  tag: "v0.7.2",
-  commit: "96392a6b2afeb86d5422e3ff55e5a3d5e8af769f",
-  version: "0.7.2",
+  tag: "v0.8.0",
+  commit: "4ba25f373a5c4df46506bdd0d306fa3ef205d965",
+  version: "0.8.0",
   distribution: {
-    filename: "falcon_axi-0.7.2-py3-none-any.whl",
-    sha256: "8b87c8047f782a6d390324a26179def0f77e6c7c5bf4212012d5802a249132b6",
-    provenance: "https://pypi.org/integrity/falcon-axi/0.7.2/falcon_axi-0.7.2-py3-none-any.whl/provenance"
+    filename: "falcon_axi-0.8.0-py3-none-any.whl",
+    sha256: "8aad289fd58847cb6555f46b8e930c5904d6afda34a7b2e6965cdd60c8df06a4",
+    provenance: "https://pypi.org/integrity/falcon-axi/0.8.0/falcon_axi-0.8.0-py3-none-any.whl/provenance"
   },
+  skillSha256: "5d5fd1cd57ff1da68e37448c93fce57236f76448ec9a10984c01ea7300c6a8e0",
   parser: {
     path: "falcon_axi/cli.py",
-    sha256: "ef29404b26da085b96ace7ba1f708e928eb40c7aa99e071807d5003a3421b0cd",
+    sha256: "9b3d42e3c00b3d302948e8937c6295bbdde9cb80384ebef253f9b8a077454909",
     aliases: {},
     shortFlags: {},
     repeats: "last value wins",
@@ -21521,7 +21522,9 @@ var falcon_axi_default = {
         profile: "value",
         filter: "value",
         limit: "value",
-        cursor: "value"
+        cursor: "value",
+        fields: "value",
+        full: "boolean"
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
@@ -22970,10 +22973,11 @@ var falcon_axi_default = {
 var vectra_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "vectra-axi",
-  version: "0.1.9",
-  integrity: "sha512-GUl24JV8lErGjZliTHcb6BcjjdpJhrzbbB8cBekKE6dM3b5ph9i9EteJHFRWUuGpnEPlVEPeu7X3l33V9DGKwQ==",
+  version: "0.1.10",
+  integrity: "sha512-X7yttDlwpQJW/j0eNox5vLf7nWlFejXjtaq90N7ezJ+ACNqEFspODrwQ/mYqbXFnqjpIugQnhSGcnaI8YNMeLw==",
   parserEvidence: "Installed pinned catalogue exports, provisional until adapter acceptance",
-  packageManifestSha256: "e7fe728c58d41a9ddd554b15c29de281dd06c2d7e6a6b044e43d75fb001aa53d",
+  packageManifestSha256: "3f4d4e3ec1b37690087e3c8850ffd5390574e6686cafbd723fb01f83b775ea97",
+  skillSha256: "58978bfd2468e9fac8d17644df1de46768572b1cd9a719a9eec64cdcb547ff9c",
   environment: [
     {
       name: "VECTRA_AXI_CONFIG",
@@ -23273,7 +23277,7 @@ var vectra_axi_default = {
     },
     source: {
       path: "dist/src/catalogue.js",
-      sha256: "e49354f34c86cd986d9cc166fc33f3c0423ab8eaa8044621131351c8f297e834"
+      sha256: "02e2443a4b6d6aef9faae51e0c4418c0c565ac5b0f73969a34a4c33a110bfabf"
     }
   },
   flags: [
@@ -23753,7 +23757,8 @@ var vectra_axi_default = {
         help: "boolean",
         profile: "value",
         config: "value",
-        id: "value"
+        id: "value",
+        full: "boolean"
       }
     },
     {
@@ -23805,7 +23810,8 @@ var vectra_axi_default = {
         profile: "value",
         config: "value",
         type: "value",
-        id: "value"
+        id: "value",
+        full: "boolean"
       }
     },
     {
@@ -25025,10 +25031,11 @@ var vectra_axi_default = {
 var az_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "az-axi",
-  version: "0.1.11",
-  integrity: "sha512-XiCwLaSh6A6xb9sk7RQ7T3FvkYpkWFIoGUCi7HxYlHF4kssVpF5gun4V7Taw9eKcm0HEWftnLci9l4EBSaFj0w==",
+  version: "0.1.13",
+  integrity: "sha512-qltNokGPKFvUxFxNVf25gV2jtgw9MpxT5k6Zlbhz0b/Y5pvbc04SpORpUurDZNXE7runLZZhoBmm38qXcA3M7Q==",
   parserEvidence: "Installed pinned catalogue exports, provisional until adapter acceptance",
-  packageManifestSha256: "8bdf756d4f0b3d006543471320eb14d83f258122752bd1e07c76a2a74868691c",
+  packageManifestSha256: "dc09976ff76cdda672ba89f0a7689c39873a86a19213d46687c2a9af861d3ed2",
+  skillSha256: "8a5bc0e8866ca55add8399376784a19e81671e6d036d10815e55b3c473540080",
   environment: [
     {
       name: "AZ_AXI_CONFIG",
@@ -25287,11 +25294,11 @@ var az_axi_default = {
   tokenResourceSources: [
     {
       path: "dist/lib/registry.js",
-      sha256: "1b0354317f721989465190b4a276fce811d559bcbbd9871129b02dd366a5beb5"
+      sha256: "dc1eb46c43aa5232b58acfb1d174fe2728491a3a6da28fa3cca27fed79494efd"
     },
     {
       path: "dist/lib/client.js",
-      sha256: "322f09655f302f8f4292cbb6317ad192854ed412376ce9041126b25e24ed27ed"
+      sha256: "156af240155e71c051a6a2f0c4235d51acaf3633d7a249736ff3b24ed541d2b6"
     },
     {
       path: "dist/lib/principals.js",
@@ -25315,11 +25322,11 @@ var az_axi_default = {
     },
     {
       path: "dist/commands/logs.js",
-      sha256: "07fc272e2947f12f8c03b9f818ec98fe2fb35beee43f544dcd0d0db15f37574b"
+      sha256: "1cfd781bd88e13ba1c70537263220c6bdd6932586e53edd6fc22fc75202bd938"
     },
     {
       path: "dist/commands/doctor.js",
-      sha256: "3c5e9c56bf0371a3654c04c296291c8d8a95dc05f9c5679b5544e0b2c3a5c475"
+      sha256: "02f26a4af30ed142b4187394c356e2204ad80f03fee52f65c2daf5c312150b06"
     },
     {
       path: "dist/commands/api.js",
@@ -29743,10 +29750,11 @@ var az_axi_default = {
 var mg_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "mg-axi",
-  version: "0.1.12",
-  integrity: "sha512-TBt2y2rpfn8oi4YOq95uIo43RTsV/iOc0xFa3e3YCjhqd/ZL/y2is+7W0+B5/g1sdwb95yJbcU1eqeJEzmKJ5g==",
+  version: "0.1.13",
+  integrity: "sha512-V9f/H1xISbn1ar3ARVnYvtT4NDUDRgvhCkrnQd6lqNdj1MeQjF4JESS6PA6hY3epXKrqE+g/2nCfgJV1JDmDTQ==",
   parserEvidence: "Installed pinned catalogue exports",
-  packageManifestSha256: "e686938dd356bffe87d9884d656a139b91e7eb6d62370f6aba3b5fd14283fb45",
+  packageManifestSha256: "2357d6568740146d05a0ad67fb8e0be3c871261726d3cf110fed83e216001dc9",
+  skillSha256: "98ff12e741b04592afae76853a00f572940dee6edf0e868d2ccba04a742b24ad",
   environment: [
     {
       name: "MG_AXI_CONFIG"
@@ -29908,7 +29916,7 @@ var mg_axi_default = {
       },
       {
         path: "dist/cli.js",
-        sha256: "613fc3ac4870e5538d2c53b0760244c7e3bb3837fa3d97c1b89b7916c557af44"
+        sha256: "723f00e5031068211b541ee43447fb559833bea924c91131e0d074349d5b9a4e"
       },
       {
         path: "dist/profiles.js",
@@ -29986,7 +29994,7 @@ var mg_axi_default = {
       },
       {
         path: "dist/cli.js",
-        sha256: "613fc3ac4870e5538d2c53b0760244c7e3bb3837fa3d97c1b89b7916c557af44"
+        sha256: "723f00e5031068211b541ee43447fb559833bea924c91131e0d074349d5b9a4e"
       }
     ]
   },
@@ -40052,13 +40060,13 @@ var awx_axi_default = {
 var tenable_axi_default = {
   generatedBy: "scripts/tenable-inventory.mjs",
   tool: "tenable-axi",
-  version: "0.1.2",
-  integrity: "sha512-csjV0urIUbZZlkA9VQpEGbsOWOnLgZTFMi0yRQD3uGlmlyPIxA6gKyvMzifSqcRvfyOaBEv7U5OjcWL1rs5NAw==",
+  version: "0.1.3",
+  integrity: "sha512-1Ji117XJv7tssAgqq0vQyQP6m3llQdqOoM6TG7tmMrma9iH9tqq+eESkXGnmHqUuJFjlS8TyyctViWk+zpTTjA==",
   parserEvidence: "Published command catalogue, mutation registry and reviewed native parsers and transport gates",
   sources: [
     {
       path: "dist/src/attack-catalogue.js",
-      sha256: "022f9d46c0e0a76b62ed528b17552fccae9634208698e541146f8af2f6107316"
+      sha256: "8e691131c15c0a25703a2f3c53f9e6f081b13d83e41b132df47f0196b9f3a192"
     },
     {
       path: "dist/src/attack-export-catalogue.js",
@@ -40070,11 +40078,11 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/attack.js",
-      sha256: "76905fe54d1038ffbaa6b4a82b4cb4fadb6473462d28679319a98ab7cdd08650"
+      sha256: "9e37ff7bb1371f3b16b36fe18ecc0286f6f89956d96d3b243c7c37538a9504be"
     },
     {
       path: "dist/src/catalogue.js",
-      sha256: "d99e739f4a9d61cf13c91fd18e69a248f639c33d3e2e5b37efb320f0f50cef16"
+      sha256: "44e7f1adc29b56741b71af0fb1b95239f4fa7c0293f137b8fb9e5e03befcbd72"
     },
     {
       path: "dist/src/cli.js",
@@ -40090,7 +40098,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/exposure.js",
-      sha256: "ef5fbe0d3525b741cc14a51b2ab9cc0cbd5289a1ec97fe01312b4d351beaf0b0"
+      sha256: "db005db00fbf1dba311bad8e78a872836994909a9ce46b9bd8d498d72cfc7d2d"
     },
     {
       path: "dist/src/hook-install.js",
@@ -40098,7 +40106,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/inventory-catalogue.js",
-      sha256: "a0cc6abc55f11815fbacf4e7f869ce0e70e06f678ebbb012afe7500a26fb4de8"
+      sha256: "9000156bdbc7e9e8a461f89a602f6fa1e9d7217eabe30a67195be79442f8afe6"
     },
     {
       path: "dist/src/inventory-export-catalogue.js",
@@ -40110,7 +40118,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/inventory.js",
-      sha256: "bc712463ee14db76ff511c4b3ec8d6cadd43b3895e08f1baee785fe3a415916f"
+      sha256: "700efba15d086ba88be5444d66f131c9d7482e198dfd050eefc7ecd4f1b96bfe"
     },
     {
       path: "dist/src/inventory/schema.js",
@@ -40252,7 +40260,7 @@ var tenable_axi_default = {
       }
     }
   },
-  skillSha256: "ea35fe90d39fee3982f731ccc3c717c92aabd0799ff2371f6f3cc5e12d7aea9a",
+  skillSha256: "788b612b4b89f6e390e42ca1619da3a7c146599284ff8ebd69c9e5e42aae5ae0",
   nativeWriteSettings: {
     supportedOperations: [
       "apa-export-attack-path",
@@ -40342,7 +40350,7 @@ var tenable_axi_default = {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated display or wire properties; display names: id, name, class, exposureScore; default compact view",
-        full: "Show full text; default false",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -40350,7 +40358,7 @@ var tenable_axi_default = {
         query: "Simple query text",
         filter: 'Repeatable: <property> <operator> <JSON string array>, e.g. asset_class = ["DEVICE"]',
         "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
-        sort: "Wire property:asc|desc",
+        sort: "Sortable display or wire property:asc|desc; unknown names report valid choices",
         "extra-properties": "Comma-separated extra wire properties",
         offset: "Starting record; default 0; excludes --cursor",
         class: "Server-side asset class filter"
@@ -40363,7 +40371,7 @@ var tenable_axi_default = {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated output fields; accepted: key, readable_name, operators, sortable, filterable, control, description; default compact view",
-        full: "Show full text; default false",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -40377,8 +40385,8 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; display names: id, name, class, exposureScore; default compact view",
-        full: "Show full text; default false",
+        fields: "Comma-separated display or wire properties; display names: id, name, class, exposureScore, fqdns, last_observed_at; default compact view",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         id: "Required exact inventory ID",
         "extra-properties": "Comma-separated extra wire properties"
@@ -40770,8 +40778,8 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; display names: id, name, severity, state; default compact view",
-        full: "Show full text; default false",
+        fields: "Comma-separated display or wire properties; display names: id, name, severity, state, sensor_type; default compact view",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -40779,7 +40787,7 @@ var tenable_axi_default = {
         query: "Simple query text",
         filter: 'Repeatable: <property> <operator> <JSON string array>, e.g. severity = ["HIGH"]',
         "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
-        sort: "Wire property:asc|desc",
+        sort: "Sortable display or wire property:asc|desc; unknown names report valid choices",
         "extra-properties": "Comma-separated extra wire properties",
         offset: "Starting record; default 0; excludes --cursor"
       }
@@ -40791,7 +40799,7 @@ var tenable_axi_default = {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated output fields; accepted: key, readable_name, operators, sortable, filterable, control, description; default compact view",
-        full: "Show full text; default false",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -40804,13 +40812,22 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; display names: id, name, severity, state; default compact view",
-        full: "Show full text; default false",
+        fields: "Comma-separated display or wire properties; display names: id, name, severity, state, sensor_type, asset_id, cves; default compact view",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         id: "Required exact inventory ID",
         "extra-properties": "Comma-separated extra wire properties"
       }
     },
+    {
+      command: "finding summary",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        help: "Show help"
+      }
+    },
     {
       command: "home",
       effect: "read",
@@ -40931,7 +40948,7 @@ var tenable_axi_default = {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated display or wire properties; display names: name, version, publisher; default compact view",
-        full: "Show full text; default false",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -40939,7 +40956,7 @@ var tenable_axi_default = {
         query: "Simple query text",
         filter: 'Repeatable: <property> <operator> <JSON string array>, e.g. application = ["example-app"]',
         "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
-        sort: "Wire property:asc|desc",
+        sort: "Sortable display or wire property:asc|desc; unknown names report valid choices",
         "extra-properties": "Comma-separated extra wire properties",
         offset: "Starting record; default 0; excludes --cursor"
       }
@@ -40951,7 +40968,7 @@ var tenable_axi_default = {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated output fields; accepted: key, readable_name, operators, sortable, filterable, control, description; default compact view",
-        full: "Show full text; default false",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -41254,13 +41271,13 @@ var tenable_axi_default = {
 var hybrid_axi_default = {
   generatedBy: "scripts/hybrid-inventory.mjs",
   tool: "hybrid-axi",
-  version: "0.1.1",
-  integrity: "sha512-8K39EZadEq302GcuCKrWmdKJ6NvtFegpGWiStTF8T8gn+lbzbYNiBnRMt5lI0o+hCm7glUdOFahZqw62ylpi7w==",
+  version: "0.1.2",
+  integrity: "sha512-rveeeytckjW+8lFwKQppSEAncC3yk8KpGqI7Qh3ziJvQtf4ycUrOw+6Tzp9a69gcTamGiYf805OC0+rhIhh6ag==",
   parserEvidence: "Published command catalogue, mutation registry and reviewed native parsers and transport gates",
   sources: [
     {
       path: "dist/src/catalogue.js",
-      sha256: "0244f912f05d7a491651b70015a80bfa15d39ed57b691174d8d4f15d89e8a907"
+      sha256: "cf353500382a0c33a6fa2c1735543ae43ecc10eb53c68e727a8940f7f881b380"
     },
     {
       path: "dist/src/cli.js",
@@ -41300,7 +41317,7 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/report-catalogue.js",
-      sha256: "387cbfd2c687cb0ec4a4813132057fdd3cf1145cb8a9760ccdaad99ed9732169"
+      sha256: "3c3346176cf5aabaf177c40a03efd1c67683640a95c8899f71cab1ec4bd95195"
     },
     {
       path: "dist/src/report-file.js",
@@ -41308,11 +41325,11 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/reports.js",
-      sha256: "be256f71a04c2f19371b6eb862b88caff9f2e481b95551749bca172058d70396"
+      sha256: "167fa9b8a542b149b8056dbb5f27bbe70c0ed4385662fc6ae9698c40e421a8d7"
     },
     {
       path: "dist/src/search-catalogue.js",
-      sha256: "e5cba3e769308123a560f7e9bcbb0f0ab36e428ce3631a173298953f063b8f7e"
+      sha256: "42fa4e7e979914c67f99fd9b083f18030ed58c01dc6cbaddea3a03553ac2a353"
     },
     {
       path: "dist/src/search-contracts.js",
@@ -41320,11 +41337,11 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/search.js",
-      sha256: "bd9362c96f6ff2a90c3297308cb7e1ef91469a4b233228abfa3d7a8849d28204"
+      sha256: "cf6192817869625e1d70030c2df748535c39d48632d8e5604cd020003807ef37"
     },
     {
       path: "dist/src/session.js",
-      sha256: "e75476c1db36aa635d6f3f675e95dfcde6bdda5c66abd0f8f905db881c7d9cf5"
+      sha256: "c55dce9aea70c4f213a040968783bb81296127395367136593985bfe99b4788c"
     },
     {
       path: "dist/src/setup.js",
@@ -41435,7 +41452,7 @@ var hybrid_axi_default = {
       }
     }
   },
-  skillSha256: "1d0266cf0237630d063531b567a6b960dca48a731e7917e72b50fb59f757d384",
+  skillSha256: "0dc43810bcc0774457a33dba2454849e2c8588f0607bd770b30fefe09cd0d26c",
   nativeWriteSettings: {
     supportedOperations: [
       "convertQuickScan",
@@ -44070,19 +44087,19 @@ var commands = {
   "tenable-axi": {
     usage: "artium-axi tenable-axi [<args>]",
     purpose: "Investigate Tenable One with managed API keys.",
-    flags: ["Writes and export jobs are off by default and require administrator-enabled operations, preview, --execute and exact --confirm. Downloads are blocked."],
+    flags: ["Writes and export jobs are off by default and require administrator-enabled operations, preview, --execute and exact --confirm. Downloads are blocked.", "Declared file flags accept - to read stdin to EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass a local file path."],
     example: "artium-axi tenable-axi card list --limit 1"
   },
   "hybrid-axi": {
     usage: "artium-axi hybrid-axi [<args>]",
     purpose: "Investigate Hybrid Analysis with a managed API key.",
-    flags: ["Submissions, YARA mutations, consuming matches and four reviewed archive downloads are off by default and selected independently by an administrator. Native preview, --execute and exact --confirm remain required. Use artium-axi download --help for authenticated CLI verified saving.", transferWarning],
+    flags: ["Submissions, YARA mutations, consuming matches and four reviewed archive downloads are off by default and selected independently by an administrator. Native preview, --execute and exact --confirm remain required. Use artium-axi download --help for authenticated CLI verified saving.", "--body-file - reads stdin to EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass a local file path.", transferWarning],
     example: "artium-axi hybrid-axi quota"
   },
   "az-axi": {
     usage: "artium-axi az-axi [<args>]",
     purpose: "Run Azure commands with your managed identity.",
-    flags: ["Arguments after az-axi are forwarded upstream, including --help."],
+    flags: ["Arguments after az-axi are forwarded upstream, including --help.", "Query commands read non-terminal stdin to EOF only without a file, positional query or query flag. api reads stdin only without --body, --body-file or --data; method/path are not body sources. The pinned upstream accepts --body, not --data.", "Tool stdin must reach EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass --file for queries, --body or --body-file for api."],
     example: "artium-axi az-axi sub list"
   },
   "mg-axi": {
@@ -44369,9 +44386,12 @@ ${executableBlock}
 // src/cli/input.ts
 import { createReadStream } from "node:fs";
 import { basename } from "node:path";
-async function readBounded(stream, limit) {
+async function readBounded(stream, limit, stdinAlternative) {
   const chunks = [];
   let bytes = 0;
+  const deadline = stdinAlternative === void 0 ? void 0 : setTimeout(() => {
+    stream.destroy(new ArtiumError("INVALID_INPUT", `no stdin EOF after 5 s; close stdin or pass ${stdinAlternative}`));
+  }, 5e3);
   try {
     for await (const chunk of stream) {
       const buffer = Buffer.from(chunk);
@@ -44382,6 +44402,8 @@ async function readBounded(stream, limit) {
   } catch (error62) {
     if (error62 instanceof ArtiumError) throw error62;
     throw new ArtiumError("INVALID_INPUT", "Tool input could not be read.", "Check the local input file or stdin.");
+  } finally {
+    clearTimeout(deadline);
   }
   return Buffer.concat(chunks);
 }
@@ -44400,7 +44422,7 @@ async function toolInput(tool, original) {
       const equals = args[index].indexOf("=");
       const path = equals < 0 ? args[++index] : args[index].slice(equals + 1);
       if (path === "-" && (tool === "tenable-axi" || tool === "hybrid-axi" && flag === "--body-file")) {
-        input2.stdin = (await readBounded(process.stdin, inputLimits.stdinBytes)).toString("utf8");
+        input2.stdin = (await readBounded(process.stdin, inputLimits.stdinBytes, flag)).toString("utf8");
         continue;
       }
       if (!path || path === "-") throw new ArtiumError("UNSUPPORTED_INPUT", "A file flag requires a local file path.");
@@ -44425,20 +44447,22 @@ async function toolInput(tool, original) {
     }
     const route = az_axi_default.commands.find((route2) => ["rg query", "logs query", "api"].includes(route2.handlerCommand) && route2.command.split(" ").every((word, index) => args[leading + index] === word));
     let positional = false;
+    let explicitInput = false;
     if (route) {
       for (let index = leading + route.command.split(" ").length; index < args.length; index++) {
         const token = args[index];
         if (token === "--") {
-          positional = index + 1 < args.length;
+          positional ||= index + 1 < args.length;
           break;
         }
         if (!token.startsWith("-") || token === "-") {
           positional = true;
-          break;
+          continue;
         }
         const raw = token.slice(token.startsWith("--") ? 2 : 1).split("=")[0];
         const expanded = token.startsWith("--") ? raw : route.shortFlags[raw] ?? raw;
         const name = route.flagAliases[expanded] ?? expanded;
+        if ((route.handlerCommand === "api" ? ["body", "body-file", "data"] : ["graph-query", "analytics-query"]).includes(name)) explicitInput = true;
         const kind = route.flags[name];
         if (token.includes("=") || !kind) continue;
         if (kind === "boolean") {
@@ -44451,8 +44475,8 @@ async function toolInput(tool, original) {
         }
       }
     }
-    if (tool === "az-axi" && route && !input2.files?.length && !positional && !process.stdin.isTTY) {
-      const stdin = await readBounded(process.stdin, inputLimits.stdinBytes);
+    if (tool === "az-axi" && route && !input2.files?.length && !explicitInput && (route.handlerCommand === "api" || !positional) && !process.stdin.isTTY) {
+      const stdin = await readBounded(process.stdin, inputLimits.stdinBytes, route.handlerCommand === "api" ? "--data (supported body flag: --body)" : "--file");
       if (stdin.length) input2.stdin = stdin.toString("utf8");
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.18",
+  "version": "0.0.20",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",