@knowttl/artium-axi 0.0.8 → 0.0.10

package/bin/artium-axi.mjs

@@ -6,9 +6,9 @@ var __export = (target, all) => {
 };
 
 // src/cli/main.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 import { homedir as homedir3 } from "node:os";
-import { resolve as resolve2, relative, sep, isAbsolute } from "node:path";
+import { resolve as resolve3, relative, sep, isAbsolute } from "node:path";
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -5036,7 +5036,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve3) {
+function isRecursive(inst, stack, resolve4) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -5046,7 +5046,7 @@ function isRecursive(inst, stack, resolve3) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve3);
+      const answer = isRecursive(child, stack, resolve4);
       if (answer > result)
         result = answer;
     }
@@ -5057,7 +5057,7 @@ function isRecursive(inst, stack, resolve3) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve4) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -5121,7 +5121,7 @@ function isRecursive(inst, stack, resolve3) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve4 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -19683,7 +19683,7 @@ var definitions = {
   STORE_SCHEMA_INVALID: { status: 503, message: "The store schema is unsupported by this image.", next: "Use the matching image, or restore the pre-upgrade backup into a new volume with its matching image and key." },
   BACKUP_FAILED: { status: 500, message: "Database backup did not complete.", next: "Check the source store and a writable backup directory; choose a new output file." },
   RESTORE_FAILED: { status: 500, message: "Database restore did not complete.", next: "Stop the destination server and use an empty new data volume, an intact backup and its matching master key." },
-  CLI_OUTDATED: { status: 426, message: "The CLI version is too old for this server.", next: "Download the current CLI from /cli/artium-axi.mjs." },
+  CLI_OUTDATED: { status: 426, message: "The CLI version is too old for this server.", next: "Run artium-axi update to install the current CLI." },
   CERTIFICATE_INVALID: { status: 503, message: "The server certificate could not be verified.", next: "Check certificate trust or set ARTIUM_AXI_CA_FILE to the trusted CA file." },
   ADMIN_REQUIRED: { status: 403, message: "Administrator capability is required.", next: "Ask an administrator to perform this operation." },
   REVISION_CONFLICT: { status: 409, message: "The record changed since it was read.", next: "Read the current record revision and retry your edit." },
@@ -19823,10 +19823,11 @@ var meResponseSchema = external_exports.strictObject({
   displayName: external_exports.string(),
   administrator: external_exports.boolean(),
   roles: external_exports.array(external_exports.string()),
-  accessExpiresAt: external_exports.number().int()
+  accessExpiresAt: external_exports.number().int(),
+  sessionExpiresAt: external_exports.number().int()
 });
 var accountId = external_exports.string().min(1);
-var toolSchema = external_exports.enum(["falcon-axi", "vectra-axi", "az-axi", "mg-axi", "ldap-axi", "ado-axi", "awx-axi"]);
+var toolSchema = external_exports.enum(["falcon-axi", "vectra-axi", "az-axi", "mg-axi", "ldap-axi", "ado-axi", "awx-axi", "tenable-axi"]);
 var skillsResponseSchema = external_exports.strictObject({ skills: external_exports.array(external_exports.strictObject({
   name: toolSchema,
   content: external_exports.string().min(1)
@@ -20046,6 +20047,10 @@ var adminAuditRoute = {
   auditEvent: null
 };
 var nativeSettingsSchemas = {
+  "tenable-axi": external_exports.strictObject({ writes: external_exports.strictObject({
+    allowWrites: external_exports.boolean(),
+    operations: external_exports.array(external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/)).min(1).max(64)
+  }).optional() }),
   "awx-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional() }),
   "ldap-axi": external_exports.strictObject({}),
   "ado-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional() }),
@@ -20091,10 +20096,25 @@ var healthSchema = external_exports.strictObject({
   credentialRevision: external_exports.number().int().nullable(),
   errorCode: external_exports.enum(Object.keys(errors)).nullable()
 });
+var toolWriteStateSchema = external_exports.strictObject({
+  capable: external_exports.boolean(),
+  enabled: external_exports.boolean(),
+  reason: external_exports.string().nullable(),
+  supportedOperations: external_exports.array(external_exports.string()).nullable(),
+  allowedOperations: external_exports.array(external_exports.string()),
+  unlocks: external_exports.string(),
+  blocked: external_exports.string()
+});
+var writeAccessInputSchema = external_exports.strictObject({
+  enabled: external_exports.boolean(),
+  operations: external_exports.array(external_exports.string().min(1).max(256)).max(64).refine((operations) => new Set(operations).size === operations.length).optional(),
+  expectedRevision: external_exports.number().int().positive()
+});
 var adminToolSchema = external_exports.strictObject({
   name: toolSchema,
   enabled: external_exports.boolean(),
   version: external_exports.string(),
+  writeAccess: toolWriteStateSchema,
   readOnly: external_exports.boolean().default(true),
   nativeSettings: external_exports.record(external_exports.string(), external_exports.unknown()),
   revision: external_exports.number().int().positive(),
@@ -20140,7 +20160,6 @@ var certificateInspectionSchema = external_exports.strictObject({
   warnings: external_exports.array(external_exports.string()),
   reason: external_exports.string(),
   verificationError: external_exports.string().nullable(),
-  repairAvailable: external_exports.boolean(),
   previousFingerprints: external_exports.array(external_exports.string())
 });
 var trustedCredentialCertificateSchema = external_exports.strictObject({
@@ -20148,7 +20167,7 @@ var trustedCredentialCertificateSchema = external_exports.strictObject({
   endpoint: external_exports.string(),
   certificate: certificateDetailsSchema,
   leaf: certificateDetailsSchema,
-  mode: external_exports.enum(["pin", "intermediate"]),
+  mode: external_exports.enum(["ca", "pin"]),
   createdAt: external_exports.number().int()
 });
 var adminCertificateRoutes = {
@@ -20167,7 +20186,7 @@ var adminCertificateRoutes = {
   trust: {
     method: "POST",
     path: "/v1/admin/tools/:tool/certificates/trust",
-    input: external_exports.strictObject({ inspectionId: external_exports.string() }),
+    input: external_exports.strictObject({ inspectionId: external_exports.string(), mode: external_exports.enum(["ca", "pin"]).default("ca") }),
     response: external_exports.strictObject({ trusted: external_exports.literal(true) })
   },
   remove: {
@@ -20178,6 +20197,26 @@ var adminCertificateRoutes = {
   }
 };
 var adminToolRoutes = {
+  get: {
+    method: "GET",
+    path: "/v1/admin/tools/:tool",
+    input: external_exports.strictObject({}),
+    response: adminToolSchema,
+    authorization: "administrator-and-recent-auth",
+    auditEvent: null
+  },
+  // Changes only write policy. Omitted operations retain the current allow-list; an empty
+  // list clears it while disabling. Graph and Vectra require a supported nonempty allow-list
+  // when enabling; tools without an allow-list reject operations input.
+  // Other native settings and credentials are preserved. Revision conflicts never mutate.
+  writeAccess: {
+    method: "PATCH",
+    path: "/v1/admin/tools/:tool/write-access",
+    input: writeAccessInputSchema,
+    response: adminToolSchema,
+    authorization: "administrator-and-recent-auth",
+    auditEvent: "tool-write-access"
+  },
   list: {
     method: "GET",
     path: "/v1/admin/tools",
@@ -20560,11 +20599,12 @@ import { readFileSync as readFileSync2 } from "node:fs";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { rootCertificates } from "node:tls";
+import { resolve } from "node:path";
 
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.8",
+  version: "0.0.10",
   private: true,
   license: "MIT",
   type: "module",
@@ -20642,8 +20682,20 @@ function sessionPath(platform = process.platform, environment = process.env, hom
   if (!base) throw new ArtiumError("CLIENT_CONFIG_INVALID", void 0, "Set APPDATA to your writable roaming configuration folder, then sign in again.");
   return paths.join(base, "artium-axi", "session.json");
 }
+function clientConfigPath(platform = process.platform, environment = process.env, home = homedir()) {
+  return sessionPath(platform, environment, home).replace(/session\.json$/, "config.json");
+}
+function readClientConfig(environment = process.env) {
+  try {
+    return external_exports.object({ serverUrl: external_exports.string(), caFile: external_exports.string().optional() }).parse(JSON.parse(readFileSync(clientConfigPath(process.platform, environment), "utf8")));
+  } catch (error62) {
+    if (error62.code === "ENOENT") return void 0;
+    if (error62 instanceof ArtiumError) throw error62;
+    throw new ArtiumError("CLIENT_CONFIG_INVALID");
+  }
+}
 function restrictWindowsAcl(path, directory) {
-  const script = `$ErrorActionPreference='Stop'; $path=$env:ARTIUM_AXI_SESSION_ACL_PATH; $directory=$env:ARTIUM_AXI_SESSION_ACL_KIND -eq 'directory'; $acl=if ($directory) { [System.Security.AccessControl.DirectorySecurity]::new() } else { [System.Security.AccessControl.FileSecurity]::new() }; $acl.SetAccessRuleProtection($true,$false); $user=[System.Security.Principal.WindowsIdentity]::GetCurrent().User; $inherit=if ($directory) { [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit' } else { [System.Security.AccessControl.InheritanceFlags]::None }; foreach ($sid in @($user,[System.Security.Principal.SecurityIdentifier]::new('S-1-5-18'),[System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))) { $acl.AddAccessRule([System.Security.AccessControl.FileSystemAccessRule]::new($sid,'FullControl',$inherit,'None','Allow')) }; Set-Acl -LiteralPath $path -AclObject $acl -ErrorAction Stop`;
+  const script = `$ErrorActionPreference='Stop'; $path=$env:ARTIUM_AXI_SESSION_ACL_PATH; $directory=$env:ARTIUM_AXI_SESSION_ACL_KIND -eq 'directory'; $acl=if ($directory) { [System.Security.AccessControl.DirectorySecurity]::new() } else { [System.Security.AccessControl.FileSecurity]::new() }; $acl.SetAccessRuleProtection($true,$false); $user=[System.Security.Principal.WindowsIdentity]::GetCurrent().User; $inherit=if ($directory) { [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit' } else { [System.Security.AccessControl.InheritanceFlags]::None }; foreach ($sid in @($user,[System.Security.Principal.SecurityIdentifier]::new('S-1-5-18'),[System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))) { $acl.AddAccessRule([System.Security.AccessControl.FileSystemAccessRule]::new($sid,'FullControl',$inherit,'None','Allow')) }; $item=if ($directory) { [System.IO.DirectoryInfo]::new($path) } else { [System.IO.FileInfo]::new($path) }; $item.SetAccessControl($acl)`;
   execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
     stdio: "ignore",
     env: { ...process.env, ARTIUM_AXI_SESSION_ACL_PATH: path, ARTIUM_AXI_SESSION_ACL_KIND: directory ? "directory" : "file" }
@@ -20707,6 +20759,26 @@ var SessionStore = class {
       rmSync(temporary, { force: true });
     }
   }
+  writeClientConfig(caFile) {
+    this.secureDirectory();
+    const temporary = join(this.directory, `${randomUUID()}.tmp`);
+    try {
+      const file2 = openSync(temporary, "wx", 384);
+      try {
+        if (this.platform === "win32") this.acl(temporary, false);
+        else fchmodSync(file2, 384);
+        writeFileSync(file2, JSON.stringify({ serverUrl: this.serverUrl, caFile }));
+        fsyncSync(file2);
+      } finally {
+        closeSync(file2);
+      }
+      renameSync(temporary, join(this.directory, "config.json"));
+    } catch {
+      throw new ArtiumError("SESSION_STORAGE_UNAVAILABLE");
+    } finally {
+      rmSync(temporary, { force: true });
+    }
+  }
   remove() {
     try {
       rmSync(this.file, { force: true });
@@ -20721,8 +20793,8 @@ var SessionStore = class {
     while (true) {
       const watcher = watch(this.directory);
       let timer;
-      const changed = new Promise((resolve3, reject) => {
-        watcher.once("change", () => resolve3());
+      const changed = new Promise((resolve4, reject) => {
+        watcher.once("change", () => resolve4());
         watcher.once("error", () => reject(new ArtiumError("SESSION_STORAGE_UNAVAILABLE")));
         timer = setTimeout(() => reject(new ArtiumError("SESSION_BUSY")), Math.max(0, deadline - Date.now()));
       });
@@ -20751,11 +20823,14 @@ var SessionStore = class {
 var DEFAULT_REQUEST_DEADLINE_MS = 9e4;
 var Client = class {
   constructor(environment = process.env, managed2, requestDeadlineMs = DEFAULT_REQUEST_DEADLINE_MS) {
-    this.environment = environment;
     this.managed = managed2;
     this.requestDeadlineMs = requestDeadlineMs;
     try {
-      const url2 = new URL(environment.ARTIUM_AXI_URL);
+      const config2 = !managed2 && (environment.ARTIUM_AXI_URL === void 0 || environment.ARTIUM_AXI_CA_FILE === void 0) ? readClientConfig(environment) : void 0;
+      this.serverUrlSource = environment.ARTIUM_AXI_URL === void 0 ? "config.json" : "ARTIUM_AXI_URL";
+      const caFile = environment.ARTIUM_AXI_CA_FILE ?? config2?.caFile;
+      this.caFile = caFile ? resolve(caFile) : void 0;
+      const url2 = new URL(environment.ARTIUM_AXI_URL ?? config2?.serverUrl ?? "");
       if (url2.username || url2.password || url2.href.includes("?") || url2.href.includes("#") || url2.protocol !== "https:" && !(url2.protocol === "http:" && environment.ARTIUM_AXI_TEST_HTTP === "1" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname))) throw new Error();
       this.serverUrl = url2.href.replace(/\/$/, "");
       if (!managed2) this.storedSessions = new SessionStore(this.serverUrl, sessionPath(process.platform, environment));
@@ -20765,21 +20840,22 @@ var Client = class {
     }
     managed2?.checkServer(this.serverUrl);
   }
-  environment;
   managed;
   requestDeadlineMs;
   serverUrl;
+  serverUrlSource;
+  caFile;
   storedSessions;
   get sessions() {
     if (!this.storedSessions) throw new ArtiumError("INVALID_INPUT", "Session-file operations are unavailable in managed mode.");
     return this.storedSessions;
   }
   certificateVerified = false;
-  async request(path, method, input2, token) {
+  async request(path, method, input2, token, bytes = false) {
     this.certificateVerified = false;
     let ca;
     try {
-      if (this.environment.ARTIUM_AXI_CA_FILE) ca = [...rootCertificates, readFileSync2(this.environment.ARTIUM_AXI_CA_FILE, "utf8")];
+      if (this.caFile) ca = [...rootCertificates, readFileSync2(this.caFile, "utf8")];
     } catch {
       throw new ArtiumError("CLIENT_CONFIG_INVALID");
     }
@@ -20787,7 +20863,7 @@ var Client = class {
     const controller = new AbortController();
     const deadline = setTimeout(() => controller.abort(), this.requestDeadlineMs);
     const url2 = new URL(`${this.serverUrl}${path}`);
-    const result = await new Promise((resolve3, reject) => {
+    const result = await new Promise((resolve4, reject) => {
       const request = (url2.protocol === "https:" ? httpsRequest : httpRequest)(url2, {
         method,
         ca,
@@ -20805,9 +20881,9 @@ var Client = class {
         response.on("error", () => reject(new ArtiumError("SERVER_UNAVAILABLE")));
         response.on("end", () => {
           try {
-            resolve3({
+            resolve4({
               status: response.statusCode,
-              body: response.statusCode === 204 ? void 0 : JSON.parse(Buffer.concat(chunks).toString("utf8")),
+              body: bytes ? Buffer.concat(chunks) : response.statusCode === 204 ? void 0 : JSON.parse(Buffer.concat(chunks).toString("utf8")),
               serverVersion: typeof response.headers["x-artium-cli-version"] === "string" ? response.headers["x-artium-cli-version"] : void 0
             });
           } catch {
@@ -20843,7 +20919,7 @@ var Client = class {
     if (result.status !== 200 && result.status !== 204) throw new ArtiumError("INVALID_RESPONSE");
     if ((path === "/v1/auth/login" || path === "/v1/auth/device") && result.serverVersion && result.serverVersion !== cliVersion) {
       const version2 = result.serverVersion.replace(/[\x00-\x1f\x7f]/g, "");
-      const warning = `warning: CLI ${cliVersion} differs from server ${version2}; download the matching client from ${this.serverUrl}/cli/artium-axi.mjs and verify its .sha256, or run npm install -g @knowttl/artium-axi@${version2}.
+      const warning = `warning: CLI ${cliVersion} differs from server ${version2}; run artium-axi update, or run npm install -g @knowttl/artium-axi@${version2}.
 `;
       if (this.managed) this.managed.write("stderr", warning);
       else process.stderr.write(warning);
@@ -20917,13 +20993,13 @@ async function readPassword(stdin, environmentVariable) {
   process.stdin.setRawMode(true);
   process.stdin.resume();
   try {
-    return await new Promise((resolve3, reject) => {
+    return await new Promise((resolve4, reject) => {
       let password = "";
       const keypress = (text2, key) => {
         if (key.name === "return" || key.ctrl && key.name === "c") {
           process.stdin.off("keypress", keypress);
           if (key.ctrl) reject(new ArtiumError("CANCELLED"));
-          else resolve3(password);
+          else resolve4(password);
         } else if (key.name === "backspace") password = Array.from(password).slice(0, -1).join("");
         else if (text2 && !key.ctrl && !new RegExp("\\p{Cc}", "u").test(text2)) password += text2;
       };
@@ -20937,82 +21013,17 @@ async function readPassword(stdin, environmentVariable) {
   }
 }
 
-// src/cli/doctor.ts
-var DIAGNOSTIC_REQUEST_DEADLINE_MS = 5e3;
-async function doctor(createClient = (deadline) => new Client(process.env, void 0, deadline), write = (text2) => {
-  process.stdout.write(text2);
-}) {
-  let failure2;
-  const line = (name, pass, detail, error62) => {
-    if (!pass) failure2 ??= error62 ?? new ArtiumError("INVALID_RESPONSE");
-    write(`${pass ? "pass" : "fail"}: ${name}${detail ? ` (${detail})` : ""}
-`);
-  };
-  let client;
-  try {
-    client = createClient(DIAGNOSTIC_REQUEST_DEADLINE_MS);
-  } catch (error62) {
-    for (const name of ["server address", "certificate", "token", "CLI version"]) line(name, false, "CLIENT_CONFIG_INVALID");
-    throw error62;
-  }
-  let addressOk = false;
-  try {
-    const live = await client.request("/health/live", "GET");
-    addressOk = !!live && typeof live === "object" && "status" in live && live.status === "ok";
-    line("server address", addressOk);
-    line("certificate", client.certificateVerified, client.certificateVerified ? void 0 : "test HTTP", new ArtiumError("CLIENT_CONFIG_INVALID"));
-  } catch (error62) {
-    const cause = error62 instanceof ArtiumError ? error62 : new ArtiumError("INVALID_RESPONSE");
-    line("server address", cause.code === "CERTIFICATE_INVALID", cause.code, cause);
-    line("certificate", client.certificateVerified, client.certificateVerified ? void 0 : cause.code, cause);
-  }
-  if (!addressOk && failure2) throw failure2;
-  let versionOk = true;
-  let versionError;
-  try {
-    await client.request("/v1/me", "GET");
-  } catch (error62) {
-    versionOk = error62 instanceof ArtiumError && error62.code === "TOKEN_INVALID";
-    if (!versionOk) versionError = error62 instanceof ArtiumError ? error62 : new ArtiumError("INVALID_RESPONSE");
-  }
-  let tokenOk = false;
-  let tokenError;
-  try {
-    tokenOk = meResponseSchema.safeParse(await client.authenticated("/v1/me", "GET")).success;
-  } catch (error62) {
-    tokenError = error62 instanceof ArtiumError ? error62 : new ArtiumError("INVALID_RESPONSE");
-  }
-  line("token", tokenOk, void 0, tokenError);
-  line("CLI version", versionOk, void 0, versionError);
-  if (tokenOk && versionOk) {
-    try {
-      const parsed = toolsResponseSchema.safeParse(await client.authenticated("/v1/tools", "GET"));
-      if (!parsed.success) throw new ArtiumError("INVALID_RESPONSE");
-      for (const tool of parsed.data.tools) line(
-        tool.name,
-        tool.status === "ok",
-        tool.status,
-        new ArtiumError(tool.status === "unconfigured" ? "CREDENTIAL_NOT_CONFIGURED" : tool.status === "error" ? "TOOL_FAILED" : tool.status === "disabled" ? "TOOL_DISABLED" : "SERVER_UNAVAILABLE")
-      );
-    } catch (error62) {
-      const cause = error62 instanceof ArtiumError ? error62 : new ArtiumError("INVALID_RESPONSE");
-      line("tools", false, cause.code, cause);
-    }
-  }
-  if (failure2) throw failure2;
-}
-
 // tools/inventories/falcon-axi.json
 var falcon_axi_default = {
   generatedBy: "scripts/falcon-inventory.mjs",
   tool: "falcon-axi",
   repository: "https://github.com/knowttl/falcon-axi.git",
-  tag: "v0.5.0",
-  commit: "2676743a997442e50cef570fc406ca38a5943833",
-  version: "0.5.0",
+  tag: "v0.5.1",
+  commit: "b595b500681eee476ddeb2d8d459bb9f8ad2125f",
+  version: "0.5.1",
   parser: {
     path: "falcon_axi/cli.py",
-    sha256: "ca8e5abef2ff056cf5cd08c37a5282851f5f858cf7a19feeae78ab1111ab95db",
+    sha256: "2f7ee1d6601dafb63e5e40cc3b1fe28b295f67f7da2f9e23e747cca644caa09d",
     aliases: {},
     shortFlags: {},
     repeats: "last value wins",
@@ -21633,7 +21644,8 @@ var falcon_axi_default = {
         profile: "value",
         query: "value",
         repository: "value",
-        since: "value"
+        since: "value",
+        wait: "value"
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
@@ -21647,7 +21659,8 @@ var falcon_axi_default = {
         "no-member-cid": "boolean",
         config: "value",
         profile: "value",
-        repository: "value"
+        repository: "value",
+        wait: "value"
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
@@ -22478,10 +22491,10 @@ var falcon_axi_default = {
 var vectra_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "vectra-axi",
-  version: "0.1.7",
-  integrity: "sha512-7gop8tQkTohKKoldYuHZ9Kz2Eq/vQNBqW0OZV8HLSPEKc3OVhdFt00osRb1kwRjB1h1Vr/ku0H0IWoKOxxticQ==",
+  version: "0.1.8",
+  integrity: "sha512-Wvn73g5hm4mzQQKhNnKvAjt6SfGFrPD2EAYMa4AXhoVqFfjXjxnQLk6tUw7E92jozeHtpZ+aDXSGMHaJhhTi1Q==",
   parserEvidence: "Installed pinned catalogue exports, provisional until adapter acceptance",
-  packageManifestSha256: "f9c6cbae6a861654398dd30d830ec5b048fad34f8b6bd5f8157dcf8a5cd3ed7e",
+  packageManifestSha256: "0e2e4e616e06435582fcd96787a2088f7fda5b0b99c32daa4d6c7dc8c2b2f3fb",
   environment: [
     {
       name: "VECTRA_AXI_CONFIG",
@@ -22547,6 +22560,38 @@ var vectra_axi_default = {
   nativeWriteSettings: {
     default: "disabled",
     disposition: "server-owned",
+    supportedOperations: [
+      "qux.account.assignment.create",
+      "qux.account.assignment.reassign",
+      "qux.account.assignment.unassign",
+      "qux.account.note.add",
+      "qux.account.note.delete",
+      "qux.account.note.edit",
+      "qux.account.tag.bulk-delete",
+      "qux.account.tag.bulk-set",
+      "qux.account.tag.set",
+      "qux.detection.note.add",
+      "qux.detection.note.delete",
+      "qux.detection.note.edit",
+      "qux.detection.tag.bulk-delete",
+      "qux.detection.tag.bulk-set",
+      "qux.detection.tag.set",
+      "qux.host.assignment.create",
+      "qux.host.assignment.reassign",
+      "qux.host.assignment.unassign",
+      "qux.host.note.add",
+      "qux.host.note.delete",
+      "qux.host.note.edit",
+      "qux.host.tag.bulk-delete",
+      "qux.host.tag.bulk-set",
+      "qux.host.tag.set",
+      "rux.account.note.delete",
+      "rux.account.note.edit",
+      "rux.detection.note.delete",
+      "rux.detection.note.edit",
+      "rux.host.note.delete",
+      "rux.host.note.edit"
+    ],
     profileFields: {
       "writes.allowWrites": "boolean",
       "writes.operations": "string[]"
@@ -22598,12 +22643,13 @@ var vectra_axi_default = {
     help: {
       command: "vectra-axi detection list",
       description: "List detections on QUX v2.5 or RUX v3.4 with server-side filters and a bounded window",
+      pagination: "QUX: collection pages; bounded --all supported; RUX: collection pages; bounded --all supported",
       flags: {
         "--help": "Show concise help; default false",
         "--state <state>": "Filter by server-side detection state",
         "--detection-type <type>": "Filter by server-side detection type",
         "--detection-category <category>": "Filter by server-side detection category",
-        "--host-id <id>": "Filter by server-side host ID (non-negative integer)",
+        "--host-id <id>": "Filter by server-side host ID (non-negative integer); find it with host list --name <text>, then detection list --host-id <id>",
         "--tags <tags>": "Filter by server-side tags",
         "--certainty-gte <score>": "Filter by server-side minimum certainty",
         "--threat-gte <score>": "Filter by server-side minimum threat",
@@ -22611,7 +22657,7 @@ var vectra_axi_default = {
         "--min-id <id>": "Server-side minimum detection ID (non-negative integer)",
         "--max-id <id>": "Server-side maximum detection ID (non-negative integer)",
         "--limit <rows>": "Row window for this read; default 100",
-        "--fields <list>": "Comma-separated projection over id,detection_type,state,threat,certainty",
+        "--fields <list>": "Comma-separated detection fields, including first_timestamp,last_timestamp,src_ip,src_host,summary,grouped_details; default id,detection_type,state,threat,certainty",
         "--all": "Traverse pages within 10 requests, 8 MiB, 60 seconds and 10000 rows; cannot combine with --limit",
         "--cursor <cursor>": "Resume a capped list with its original filters"
       },
@@ -22643,7 +22689,7 @@ var vectra_axi_default = {
     },
     source: {
       path: "dist/src/catalogue.js",
-      sha256: "9c0a3783a91fb0fd4c2a2f4df00e477b8abdc3ea3cefe80dc20e98b4cebf55fd"
+      sha256: "5fadea660c71fb4021a4c130699ae3883c54e801c8e3eb6c3f370a10b0a04930"
     }
   },
   flags: [
@@ -22974,6 +23020,7 @@ var vectra_axi_default = {
         profile: "value",
         config: "value",
         id: "value",
+        fields: "value",
         full: "boolean"
       }
     },
@@ -22996,6 +23043,7 @@ var vectra_axi_default = {
         help: "boolean",
         profile: "value",
         config: "value",
+        name: "value",
         "threat-gte": "value",
         "certainty-gte": "value",
         tags: "value",
@@ -23403,6 +23451,7 @@ var vectra_axi_default = {
         help: "boolean",
         profile: "value",
         config: "value",
+        all: "boolean",
         account: "value",
         host: "value",
         assignee: "value",
@@ -23435,6 +23484,7 @@ var vectra_axi_default = {
         help: "boolean",
         profile: "value",
         config: "value",
+        all: "boolean",
         limit: "value",
         fields: "value",
         cursor: "value"
@@ -23455,6 +23505,7 @@ var vectra_axi_default = {
         help: "boolean",
         profile: "value",
         config: "value",
+        all: "boolean",
         username: "value",
         limit: "value",
         fields: "value",
@@ -23491,6 +23542,7 @@ var vectra_axi_default = {
         help: "boolean",
         profile: "value",
         config: "value",
+        all: "boolean",
         name: "value",
         type: "value",
         limit: "value",
@@ -23513,6 +23565,7 @@ var vectra_axi_default = {
         help: "boolean",
         profile: "value",
         config: "value",
+        all: "boolean",
         id: "value",
         name: "value",
         ordering: "value",
@@ -23528,6 +23581,7 @@ var vectra_axi_default = {
         help: "boolean",
         profile: "value",
         config: "value",
+        all: "boolean",
         contains: "value",
         ordering: "value",
         limit: "value",
@@ -23612,727 +23666,6 @@ var vectra_axi_default = {
   ]
 };
 
-// tools/inventories/ldap-axi.json
-var ldap_axi_default = {
-  generatedBy: "scripts/ldap-inventory.mjs",
-  tool: "ldap-axi",
-  version: "0.2.0",
-  integrity: "sha512-w/gE4jHaUHE0iKh3ucDnDG0AVrhP0VwpFCEcw3wSTzLmTBMNZrJ9AFB06j2jnf4TFgK5+5NhF0EE0R69mv7crA==",
-  parserEvidence: "Installed pinned command schemas and reviewed CLI globals and entry routes",
-  sources: [
-    {
-      path: "package.json",
-      sha256: "7ee133bf0333fe975c905418c9ecdd542836dab39f52aa5f7f630776d2bcc0b0"
-    },
-    {
-      path: "README.md",
-      sha256: "3a1eeda8c376c39853e4835acf2a1d61f76f23a555651417d0d691459fbb3139"
-    },
-    {
-      path: "axi-credential.schema.json",
-      sha256: "76b9f5f449d844dcd4365b966ed907515582f72fc920b936dae825ebf1b7cc53"
-    },
-    {
-      path: "dist/src/cli.js",
-      sha256: "2cb024b2848c2c9e27c292205b3ed86a829cfed21d52e8fea06ef544a039ec2a"
-    },
-    {
-      path: "dist/src/schema.js",
-      sha256: "0d5946fa26efb55e8480e9a22f93cdb6b321c48697e77ca02c4c99630f11284f"
-    },
-    {
-      path: "dist/src/config.js",
-      sha256: "cbc48584b6ff2a2a70375e9e8e6242a87543a3e6e6f7e1c055a2d29c42b677f9"
-    },
-    {
-      path: "dist/src/secrets.js",
-      sha256: "9f2ccf86515cec1dd65f2dd5850188232374535f7fe56a788fdc7b94d91c8532"
-    },
-    {
-      path: "dist/src/directory/auth.js",
-      sha256: "d2b3a61cb9e63744462e3a6a2841fcddb2b48e7823c307841028288cfe9d688b"
-    },
-    {
-      path: "dist/src/directory/policy.js",
-      sha256: "a697dd78990493f7f1c19d22278ebb922c997e9cf88a51b12adfaca30fa8a01d"
-    }
-  ],
-  credentialSchema: {
-    $schema: "https://json-schema.org/draft/2020-12/schema",
-    title: "ldap-axi profile",
-    type: "object",
-    additionalProperties: false,
-    required: [
-      "url"
-    ],
-    properties: {
-      url: {
-        type: "string",
-        pattern: "^ldaps?://",
-        description: "LDAP URL without userinfo; use the server FQDN for ambient authentication"
-      },
-      auth: {
-        enum: [
-          "auto",
-          "gssapi",
-          "simple"
-        ],
-        default: "auto"
-      },
-      bindDn: {
-        type: "string",
-        minLength: 1,
-        description: "Simple-bind identity, required for simple authentication"
-      },
-      bindPassword: {
-        "x-secret": true,
-        description: "Simple-bind password reference; defaults to env LDAP_AXI_BIND_PASSWORD. No stored secrets.",
-        oneOf: [
-          {
-            type: "object",
-            additionalProperties: false,
-            required: [
-              "env"
-            ],
-            properties: {
-              env: {
-                type: "string",
-                pattern: "^[A-Za-z_][A-Za-z0-9_]*$"
-              }
-            }
-          },
-          {
-            type: "object",
-            additionalProperties: false,
-            required: [
-              "file"
-            ],
-            properties: {
-              file: {
-                type: "string",
-                pattern: "^(?:/|[A-Za-z]:[\\\\/])",
-                description: "Absolute local path to a private UTF-8 password file; UNC/device paths are forbidden on Windows"
-              }
-            }
-          }
-        ]
-      },
-      base: {
-        type: "string"
-      },
-      pageSize: {
-        type: "integer",
-        minimum: 1,
-        maximum: 1e3
-      },
-      caFile: {
-        type: "string",
-        minLength: 1
-      },
-      startTls: {
-        type: "boolean",
-        default: false
-      },
-      tlsMaxVersion: {
-        const: "1.2"
-      },
-      flavor: {
-        enum: [
-          "ad",
-          "adlds",
-          "ldapv3"
-        ]
-      },
-      gssapiService: {
-        type: "string",
-        minLength: 1
-      },
-      gssapiProtection: {
-        enum: [
-          "none",
-          "confidentiality"
-        ]
-      }
-    }
-  },
-  adapterBoundary: {
-    unsafeOverrides: [
-      "config",
-      "url",
-      "start-tls",
-      "ca-file",
-      "ca-only",
-      "tls-no-verify",
-      "tls-max-version",
-      "insecure-plaintext",
-      "anonymous",
-      "profile",
-      "auth",
-      "gssapi-service",
-      "gssapi-protection"
-    ],
-    blockedCommands: [
-      "config",
-      "profile",
-      "setup"
-    ],
-    sensitiveFlags: [
-      "base",
-      "filter",
-      "name",
-      "sam",
-      "upn",
-      "uid"
-    ],
-    authentication: "Stored simple-bind identity over verified LDAPS or StartTLS; no ambient ticket or keytab",
-    inputs: {
-      stdin: "unsupported",
-      files: "unsupported",
-      caFile: "stored PEM materialized privately by host"
-    },
-    resources: {
-      nodeHeapMiB: 128
-    },
-    nativeWrites: "read-only upstream design"
-  },
-  discovery: {
-    commands: [
-      "entry",
-      "user",
-      "group",
-      "computer",
-      "auth status",
-      "server"
-    ],
-    example: [
-      "user",
-      "list",
-      "--limit",
-      "1"
-    ],
-    help: "List user accounts.\nLDAPv3 users are inetOrgPerson or posixAccount entries; use ldap-axi entry search for account + simpleSecurityObject service accounts.\nUsage: ldap-axi user list [flags]\nFlags:\n  --help  show this help\n  --base  <dn> search base (default: environment, config, or server naming contexts)\n  --disabled  include disabled accounts (LDAPv3: permanent ppolicy locks)\n  --enabled  include enabled accounts (LDAPv3: exclude permanent ppolicy locks)\n  --locked  include current AD locks or recorded LDAPv3 ppolicy lock candidates\n  --all  read all pages up to --max-rows or --limit\n  --name  <pattern> match cn\n  --sam  <pattern> AD only: match sAMAccountName\n  --upn  <pattern> AD only: match userPrincipalName\n  --uid  <pattern> LDAPv3 only: match uid\n  --filter  <RFC4515> add a raw LDAP filter\n  --scope  <base|one|sub> search scope (default: sub)\n  --max-rows  <n> maximum output rows\n  --page-size  <1..1000> LDAP page size (default: AD 1000, LDAPv3 500; config overrides)\n  --limit  <n> alias for bounded list output\n  --fields  <name,...> select output fields\n  --attributes  <name,...> request and emit raw attributes\nActive Directory fields: sam, upn, name, dn, enabled, locked, last_logon, object_sid, when_created\nActive Directory defaults: sam, name, enabled, last_logon\nLDAPv3 fields: uid, name, mail, enabled, locked, account_state, dn, entry_uuid, when_created\nLDAPv3 defaults: uid, name, mail, enabled, locked, account_state\nExamples:\n  ldap-axi user list --disabled --max-rows 25\n  ldap-axi user list --name Alice --fields name,dn --limit 50"
-  },
-  suggestionFields: [
-    "help"
-  ],
-  format: "TOON",
-  commands: [
-    {
-      command: "home",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value"
-      },
-      positionalInput: false
-    },
-    {
-      command: "auth status",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        offline: "boolean"
-      },
-      positionalInput: false
-    },
-    {
-      command: "server",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value"
-      },
-      positionalInput: false
-    },
-    {
-      command: "entry search",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        filter: "value",
-        scope: "value",
-        attributes: "value",
-        "page-size": "value",
-        "max-rows": "value",
-        all: "boolean"
-      },
-      positionalInput: false
-    },
-    {
-      command: "entry show",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        attributes: "value",
-        "page-size": "value"
-      },
-      positionalInput: true
-    },
-    {
-      command: "user list",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        disabled: "boolean",
-        enabled: "boolean",
-        locked: "boolean",
-        all: "boolean",
-        name: "value",
-        sam: "value",
-        upn: "value",
-        uid: "value",
-        filter: "value",
-        scope: "value",
-        "max-rows": "value",
-        "page-size": "value",
-        limit: "value",
-        fields: "value",
-        attributes: "value"
-      },
-      positionalInput: false
-    },
-    {
-      command: "user show",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        fields: "value",
-        attributes: "value"
-      },
-      positionalInput: true
-    },
-    {
-      command: "user groups",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        nested: "boolean",
-        "max-rows": "value",
-        "page-size": "value",
-        fields: "value"
-      },
-      positionalInput: true
-    },
-    {
-      command: "group list",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        all: "boolean",
-        name: "value",
-        sam: "value",
-        filter: "value",
-        scope: "value",
-        "max-rows": "value",
-        "page-size": "value",
-        limit: "value",
-        fields: "value",
-        attributes: "value"
-      },
-      positionalInput: false
-    },
-    {
-      command: "group show",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        fields: "value",
-        attributes: "value"
-      },
-      positionalInput: true
-    },
-    {
-      command: "group members",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        nested: "boolean",
-        "max-rows": "value",
-        "page-size": "value",
-        fields: "value"
-      },
-      positionalInput: true
-    },
-    {
-      command: "computer list",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        all: "boolean",
-        name: "value",
-        sam: "value",
-        filter: "value",
-        scope: "value",
-        "max-rows": "value",
-        "page-size": "value",
-        limit: "value",
-        fields: "value",
-        attributes: "value"
-      },
-      positionalInput: false
-    },
-    {
-      command: "computer show",
-      flags: {
-        help: "boolean",
-        config: "value",
-        url: "value",
-        base: "value",
-        "start-tls": "boolean",
-        "ca-file": "value",
-        "ca-only": "boolean",
-        "tls-no-verify": "boolean",
-        "tls-max-version": "value",
-        "insecure-plaintext": "boolean",
-        anonymous: "boolean",
-        profile: "value",
-        auth: "value",
-        "gssapi-service": "value",
-        "gssapi-protection": "value",
-        fields: "value",
-        attributes: "value"
-      },
-      positionalInput: true
-    }
-  ]
-};
-
-// src/cli/help.ts
-var commands = {
-  home: { usage: "artium-axi [tools [show <tool>]|whoami|login|passwd|logout|doctor|setup|<tool> <args>]", purpose: "Show your identity, roles and available tools.", flags: ["--version (default false; print the client package version and exit)"], example: "artium-axi" },
-  setup: {
-    usage: "artium-axi setup --host <claude|codex|opencode|pi> [--hook] [--force]",
-    purpose: "Install skills for your signed-in account\u2019s granted tools and an optional Claude Code session hook.",
-    flags: ["--host <claude|codex|opencode|pi> (required)", "--hook (default false; Claude Code only)", "--force (default false; explicitly replace an edited skill)"],
-    example: "artium-axi setup --host claude --hook"
-  },
-  tools: { usage: "artium-axi tools", purpose: "List available tools with their status and pinned version.", flags: [], example: "artium-axi tools" },
-  "tools show": { usage: "artium-axi tools show <tool>", purpose: "Show one available tool and its vetted upstream help.", flags: [], example: "artium-axi tools show falcon-axi" },
-  whoami: { usage: "artium-axi whoami", purpose: "Show your identity, roles, access expiry and server.", flags: [], example: "artium-axi whoami" },
-  login: {
-    usage: "artium-axi login --sso | --username <username> [--password-stdin]",
-    purpose: "Sign in through browser SSO (8-hour session) or with a local account.",
-    flags: ["--sso (default false; open the displayed URL in any browser and approve your terminal code; no password flags)", "--username <username> (required for local sign-in)", "--password-stdin (default false; local only; otherwise ARTIUM_AXI_PASSWORD or a terminal prompt)"],
-    example: "artium-axi login --sso"
-  },
-  passwd: {
-    usage: "artium-axi passwd [--password-stdin]",
-    purpose: "Change your password, then sign in again.",
-    flags: ["--password-stdin (default false; otherwise a terminal prompt; current password uses ARTIUM_AXI_CURRENT_PASSWORD or a terminal prompt)"],
-    example: "artium-axi passwd --password-stdin"
-  },
-  logout: { usage: "artium-axi logout", purpose: "Remove local tokens and revoke the server session.", flags: [], example: "artium-axi logout" },
-  doctor: { usage: "artium-axi doctor", purpose: "Check the server, certificate, token, CLI version and cached tool health.", flags: [], example: "artium-axi doctor" },
-  "falcon-axi": {
-    usage: "artium-axi falcon-axi [<args>]",
-    purpose: "Run Falcon commands with your managed credentials.",
-    flags: ["Arguments after falcon-axi are forwarded upstream, including --help."],
-    example: `artium-axi falcon-axi ${falcon_axi_default.discovery.example.join(" ")}`
-  },
-  "vectra-axi": {
-    usage: "artium-axi vectra-axi [<args>]",
-    purpose: "Run Vectra commands with your managed credentials.",
-    flags: ["Arguments after vectra-axi are forwarded upstream, including --help."],
-    example: `artium-axi vectra-axi ${vectra_axi_default.discovery.example.join(" ")}`
-  },
-  "ldap-axi": {
-    usage: "artium-axi ldap-axi [<args>]",
-    purpose: "Read directory data with the managed LDAP bind identity.",
-    flags: ["Arguments after ldap-axi are forwarded upstream, including --help."],
-    example: `artium-axi ldap-axi ${ldap_axi_default.discovery.example.join(" ")}`
-  },
-  "ado-axi": {
-    usage: "artium-axi ado-axi [<args>]",
-    purpose: "Run Azure DevOps commands with managed credentials.",
-    flags: ["Arguments after ado-axi include --help. Organization and credentials are managed by Artium; api is GET only; writes are off by default."],
-    example: "artium-axi ado-axi project list --limit 1"
-  },
-  "awx-axi": {
-    usage: "artium-axi awx-axi [<args>]",
-    purpose: "Inspect AWX automation with managed credentials.",
-    flags: ["Arguments after awx-axi include --help. Operational writes are off by default; configuration, deletion and security writes are blocked."],
-    example: "artium-axi awx-axi job list --limit 1"
-  },
-  "az-axi": {
-    usage: "artium-axi az-axi [<args>]",
-    purpose: "Run Azure commands with your managed identity.",
-    flags: ["Arguments after az-axi are forwarded upstream, including --help."],
-    example: "artium-axi az-axi sub list"
-  },
-  "mg-axi": {
-    usage: "artium-axi mg-axi [<args>]",
-    purpose: "Run Microsoft Graph commands with your managed identity.",
-    flags: ["Arguments after mg-axi are forwarded upstream, including --help."],
-    example: "artium-axi mg-axi entra user list"
-  },
-  "managed-session": {
-    usage: "artium-axi --managed-session <command> [<args>]",
-    purpose: "Let a caller supply and persist sessions through private pipes.",
-    flags: [],
-    example: "artium-axi --managed-session whoami"
-  }
-};
-function commandHelp(command) {
-  const entry = commands[command];
-  const flags = [
-    toolSchema.safeParse(command).success ? "--help before the tool name (default false)" : "--help (default false)",
-    ...entry.flags,
-    "--managed-session before the command (default false; caller-owned sessions; see artium-axi --managed-session --help)"
-  ];
-  const protocol = [
-    "Session JSON on inherited pipe fd 3, new sessions and rotations as JSON lines on private pipe fd 4; no session file.",
-    "Managed input: {serverUrl, accessToken, refreshToken?}; close fd 3 after JSON (64 KiB maximum). Output: {serverUrl, status, accessToken, refreshToken, accessExpiresAt, familyExpiresAt} per rotation, before retry, including on later failure.",
-    "Managed login: fd 3 is unused; fd 4 must be a writable private pipe/socket. Local sign-in requires --username <username> --password-stdin with protected inherited stdin; password argv and ARTIUM_AXI_PASSWORD are refused. SSO uses login --sso and displays browser approval instructions immediately. New sessions use the rotation envelope; password-change-required returns {serverUrl, status, passwordChangeToken, passwordChangeExpiresAt} on fd 4 and exits 1.",
-    "Managed exits: 0 success; 2 invalid JSON/descriptors or refused passwd/logout/setup; 1 authentication/transport failure; tool exit codes pass through. Only TOKEN_EXPIRED permits one refresh/retry; without refreshToken or on refusal, return control to the caller."
-  ];
-  const purposes = command === "home" ? `commands[${Object.keys(commands).length - 2}]{command,purpose}:
-${Object.entries(commands).filter(([name]) => name !== "home" && name !== "managed-session").map(([name, value]) => `  ${name},${JSON.stringify(value.purpose)}`).join("\n")}
-` : "";
-  return `purpose: ${entry.purpose}
-usage: ${entry.usage}
-${purposes}flags[${flags.length}]:
-${flags.map((flag) => `  - ${JSON.stringify(flag)}`).join("\n")}
-example: ${entry.example}
-` + (command === "login" || command === "managed-session" ? `managedSession[${protocol.length}]:
-${protocol.map((line) => `  - ${JSON.stringify(line)}`).join("\n")}
-` : "");
-}
-function validateArguments(args, prefixHelp) {
-  const command = args[0];
-  if (command === "tools") args = [...args.filter((arg) => arg !== "--help"), ...args.filter((arg) => arg === "--help")];
-  const rootFlags = "--help, --version, --managed-session (before the command)";
-  const rootCommands = Object.keys(commands).filter((name) => name !== "home" && name !== "managed-session" && name !== "tools show").join(", ");
-  function fail(token, level2, choices2) {
-    const kind = token?.startsWith("-") ? "flag" : "argument";
-    const message = token === void 0 ? `Missing argument for ${level2}.` : command === "login" || command === "passwd" ? `Unexpected argument at position ${args.indexOf(token) + 1} for ${level2}. Password arguments are refused.` : `Unknown or unexpected ${kind} ${JSON.stringify(kind === "flag" ? token.split("=")[0] : token)} for ${level2}.`;
-    throw new ArtiumError("INVALID_INPUT", message, choices2);
-  }
-  if (!command) return;
-  if (command === "--version" && args.length === 1) return;
-  if (!Object.hasOwn(commands, command) || command === "home" || command === "managed-session" || command === "tools show") {
-    fail(command, "artium-axi", `Valid commands: ${rootCommands}. Valid flags: ${rootFlags}.`);
-  }
-  if (toolSchema.safeParse(command).success) {
-    if (prefixHelp && args.length > 1) fail(args[1], command, `Use artium-axi --help ${command} for local help; artium-axi ${command} --help for upstream flags.`);
-    return;
-  }
-  let level = command;
-  let start = 1;
-  if (command === "tools" && args[1] === "show") {
-    level = "tools show";
-    start = 2;
-  }
-  const entry = commands[level];
-  const validFlags = ["--help", ...entry.flags.map((flag) => flag.split(" ")[0])];
-  const choices = `Valid flags for ${level}: ${validFlags.join(", ")}.` + (level === "tools" ? " Valid subcommands: show <tool>." : level === "tools show" ? ` Valid tools: ${toolSchema.options.join(", ")}.` : "");
-  let tool = false;
-  const seen = /* @__PURE__ */ new Set();
-  for (let index = start; index < args.length; index++) {
-    const token = args[index];
-    if (level === "tools show" && !token.startsWith("-") && !tool) {
-      if (!toolSchema.safeParse(token).success) fail(token, level, choices);
-      tool = true;
-    } else {
-      if (!validFlags.includes(token) || seen.has(token)) fail(token, level, choices);
-      seen.add(token);
-      if (token === "--username" || token === "--host") {
-        const value = args[index + 1];
-        if (!value) fail(value, `${level} ${token}`, `Supply ${token} ${token === "--host" ? "<claude|codex|opencode|pi>" : "<username>"}. ${choices}`);
-        if (token === "--host" && !["claude", "codex", "opencode", "pi"].includes(value)) fail(value, `${level} --host`, `Valid hosts: claude, codex, opencode, pi. Use ${entry.usage}.`);
-        index++;
-      }
-    }
-  }
-  if (level === "tools show" && !tool && !seen.has("--help") && !prefixHelp) fail(void 0, level, choices);
-}
-function helpCommand(args, prefixHelp = false) {
-  if (args[0] === "setup" && args.includes("--help")) {
-    const path2 = args.filter((arg) => arg !== "--help");
-    for (let index = 1; index < path2.length; index++) {
-      if (path2[index] === "--host" && ["claude", "codex", "opencode", "pi"].includes(path2[index + 1])) index++;
-      else if (path2[index] !== "--hook" && path2[index] !== "--force") return void 0;
-    }
-    return "setup";
-  }
-  if (toolSchema.safeParse(args[0]).success) return prefixHelp && args.length === 2 ? args[0] : void 0;
-  if (args[0] === "login" || args[0] === "passwd") {
-    if (args[0] === "login" && args.length === 3 && args.includes("--sso") && args.includes("--help")) return "login";
-    let requested = false;
-    let username = false;
-    let stdin = false;
-    for (let index = 1; index < args.length; index++) {
-      const option = args[index];
-      if (option === "--username" && args[0] === "login" && !username && args[index + 1] !== void 0) {
-        username = true;
-        index++;
-      } else if (option === "--password-stdin" && !stdin) stdin = true;
-      else if (option === "--help" && !requested) requested = true;
-      else return void 0;
-    }
-    return requested ? args[0] : void 0;
-  }
-  if (!args.includes("--help")) return void 0;
-  const path = args.filter((arg) => arg !== "--help");
-  if (path.length === 0) return "home";
-  if (path[0] === "tools" && path[1] === "show" && (path.length === 2 || path.length === 3 && toolSchema.safeParse(path[2]).success)) return "tools show";
-  if (path.length === 1 && path[0] !== "home" && Object.hasOwn(commands, path[0])) return path[0];
-  return void 0;
-}
-
 // tools/inventories/az-axi.json
 var az_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
@@ -29065,6 +28398,13 @@ var mg_axi_default = {
   ],
   nativeWriteSettings: {
     default: "disabled",
+    supportedOperations: [
+      "entra.conditional-access.policy.update",
+      "entra.risky-user.dismiss",
+      "entra.user.revokeSessions",
+      "entra.user.update",
+      "mg.entra.group.member.add"
+    ],
     profileFields: {
       "writes.allowWrites": "boolean",
       "writes.operations": "string[]"
@@ -33641,171 +32981,710 @@ var mg_axi_default = {
       positionalInput: false
     },
     {
-      command: "entra lifecycle run user-processing-result count",
+      command: "entra lifecycle run user-processing-result count",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        workflow: "value",
+        run: "value",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "entra lifecycle run subject-processing-result list",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        workflow: "value",
+        run: "value",
+        limit: "value",
+        all: "boolean",
+        filter: "value",
+        fields: "value",
+        full: "boolean",
+        cursor: "value",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "entra lifecycle run subject-processing-result show",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        workflow: "value",
+        run: "value",
+        id: "value",
+        fields: "value",
+        full: "boolean",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "entra lifecycle run subject-processing-result count",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        workflow: "value",
+        run: "value",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "entra lifecycle run task-processing-result list",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        workflow: "value",
+        run: "value",
+        limit: "value",
+        all: "boolean",
+        filter: "value",
+        select: "value",
+        fields: "value",
+        full: "boolean",
+        cursor: "value",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "entra lifecycle run task-processing-result show",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        workflow: "value",
+        run: "value",
+        id: "value",
+        fields: "value",
+        full: "boolean",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "entra lifecycle run task-processing-result count",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        workflow: "value",
+        run: "value",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "api get",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        odata: "value",
+        cursor: "value",
+        scopes: "value",
+        limit: "value",
+        all: "boolean",
+        full: "boolean",
+        config: "value"
+      },
+      positionalInput: {
+        name: "path",
+        description: "Server-relative Graph path, e.g. /users",
+        required: true
+      }
+    },
+    {
+      command: "login",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        method: "value",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "config path",
+      flags: {
+        help: "boolean",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "auth status",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "auth logout",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        config: "value"
+      },
+      positionalInput: false
+    }
+  ]
+};
+
+// tools/inventories/ldap-axi.json
+var ldap_axi_default = {
+  generatedBy: "scripts/ldap-inventory.mjs",
+  tool: "ldap-axi",
+  version: "0.3.0",
+  integrity: "sha512-QVectHNsRxYWNBf0im5DjeN78mcgK0Te0Sxh7uXGNb+AhQjsS5ywiCrnKAk0/INA/oxiZ1TiXaDX7jHAg5OvDg==",
+  parserEvidence: "Installed pinned command schemas and reviewed CLI globals and entry routes",
+  sources: [
+    {
+      path: "package.json",
+      sha256: "9fa26acd15443dad0857c7468f570164e436f7b25aef3df733da3c4d859917a9"
+    },
+    {
+      path: "README.md",
+      sha256: "cd05d13da53b80aa651a5207b680e7fa6a0fb0c975244e4cc135d26b13391204"
+    },
+    {
+      path: "axi-credential.schema.json",
+      sha256: "76b9f5f449d844dcd4365b966ed907515582f72fc920b936dae825ebf1b7cc53"
+    },
+    {
+      path: "dist/src/cli.js",
+      sha256: "2cb024b2848c2c9e27c292205b3ed86a829cfed21d52e8fea06ef544a039ec2a"
+    },
+    {
+      path: "dist/src/schema.js",
+      sha256: "ba2285cbda6e5994c536b2f9de65736df1b43b0b10c5d5b7a1c2d7124ab198a0"
+    },
+    {
+      path: "dist/src/config.js",
+      sha256: "cbc48584b6ff2a2a70375e9e8e6242a87543a3e6e6f7e1c055a2d29c42b677f9"
+    },
+    {
+      path: "dist/src/secrets.js",
+      sha256: "9f2ccf86515cec1dd65f2dd5850188232374535f7fe56a788fdc7b94d91c8532"
+    },
+    {
+      path: "dist/src/directory/auth.js",
+      sha256: "64885ea4bc5067c58dcb4d432610f99eedfa9af65fa46273b68d503d26ec3214"
+    },
+    {
+      path: "dist/src/directory/policy.js",
+      sha256: "a697dd78990493f7f1c19d22278ebb922c997e9cf88a51b12adfaca30fa8a01d"
+    }
+  ],
+  credentialSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    title: "ldap-axi profile",
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "url"
+    ],
+    properties: {
+      url: {
+        type: "string",
+        pattern: "^ldaps?://",
+        description: "LDAP URL without userinfo; use the server FQDN for ambient authentication"
+      },
+      auth: {
+        enum: [
+          "auto",
+          "gssapi",
+          "simple"
+        ],
+        default: "auto"
+      },
+      bindDn: {
+        type: "string",
+        minLength: 1,
+        description: "Simple-bind identity, required for simple authentication"
+      },
+      bindPassword: {
+        "x-secret": true,
+        description: "Simple-bind password reference; defaults to env LDAP_AXI_BIND_PASSWORD. No stored secrets.",
+        oneOf: [
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "env"
+            ],
+            properties: {
+              env: {
+                type: "string",
+                pattern: "^[A-Za-z_][A-Za-z0-9_]*$"
+              }
+            }
+          },
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "file"
+            ],
+            properties: {
+              file: {
+                type: "string",
+                pattern: "^(?:/|[A-Za-z]:[\\\\/])",
+                description: "Absolute local path to a private UTF-8 password file; UNC/device paths are forbidden on Windows"
+              }
+            }
+          }
+        ]
+      },
+      base: {
+        type: "string"
+      },
+      pageSize: {
+        type: "integer",
+        minimum: 1,
+        maximum: 1e3
+      },
+      caFile: {
+        type: "string",
+        minLength: 1
+      },
+      startTls: {
+        type: "boolean",
+        default: false
+      },
+      tlsMaxVersion: {
+        const: "1.2"
+      },
+      flavor: {
+        enum: [
+          "ad",
+          "adlds",
+          "ldapv3"
+        ]
+      },
+      gssapiService: {
+        type: "string",
+        minLength: 1
+      },
+      gssapiProtection: {
+        enum: [
+          "none",
+          "confidentiality"
+        ]
+      }
+    }
+  },
+  adapterBoundary: {
+    unsafeOverrides: [
+      "config",
+      "url",
+      "start-tls",
+      "ca-file",
+      "ca-only",
+      "tls-no-verify",
+      "tls-max-version",
+      "insecure-plaintext",
+      "anonymous",
+      "profile",
+      "auth",
+      "gssapi-service",
+      "gssapi-protection"
+    ],
+    blockedCommands: [
+      "config",
+      "profile",
+      "setup"
+    ],
+    sensitiveFlags: [
+      "base",
+      "filter",
+      "name",
+      "sam",
+      "upn",
+      "uid"
+    ],
+    authentication: "Stored simple-bind identity over verified LDAPS or StartTLS; no ambient ticket or keytab",
+    inputs: {
+      stdin: "unsupported",
+      files: "unsupported",
+      caFile: "stored PEM materialized privately by host"
+    },
+    resources: {
+      nodeHeapMiB: 128
+    },
+    nativeWrites: "read-only upstream design"
+  },
+  discovery: {
+    commands: [
+      "entry",
+      "user",
+      "group",
+      "computer",
+      "auth status",
+      "server"
+    ],
+    example: [
+      "user",
+      "list",
+      "--limit",
+      "1"
+    ],
+    help: "List user accounts.\nLDAPv3 users are inetOrgPerson or posixAccount entries; use ldap-axi entry search for account + simpleSecurityObject service accounts.\nUsage: ldap-axi user list [flags]\nFlags:\n  --help  show this help\n  --base  <dn> search base (default: environment, config, or server naming contexts)\n  --disabled  include disabled accounts (LDAPv3: permanent ppolicy locks)\n  --enabled  include enabled accounts (LDAPv3: exclude permanent ppolicy locks)\n  --locked  include current AD locks or recorded LDAPv3 ppolicy lock candidates\n  --all  read all pages up to --max-rows or --limit\n  --name  <pattern> match cn\n  --sam  <pattern> AD only: match sAMAccountName\n  --upn  <pattern> AD only: match userPrincipalName\n  --uid  <pattern> LDAPv3 only: match uid\n  --filter  <RFC4515> add a raw LDAP filter\n  --scope  <base|one|sub> search scope (default: sub)\n  --max-rows  <n> maximum output rows\n  --page-size  <1..1000> LDAP page size (default: AD 1000, LDAPv3 500; config overrides)\n  --limit  <n> alias for bounded list output\n  --fields  <name,...> select output fields\n  --attributes  <name,...> request and emit raw attributes\nActive Directory fields: sam, upn, name, dn, enabled, locked, last_logon, object_sid, when_created, description, display_name, memberOf\nActive Directory defaults: sam, name, enabled, last_logon\nLDAPv3 fields: uid, name, mail, enabled, locked, account_state, dn, entry_uuid, when_created\nLDAPv3 defaults: uid, name, mail, enabled, locked, account_state\nExamples:\n  ldap-axi user list --disabled --max-rows 25\n  ldap-axi user list --name Alice --fields name,dn --limit 50"
+  },
+  suggestionFields: [
+    "help"
+  ],
+  format: "TOON",
+  commands: [
+    {
+      command: "home",
+      flags: {
+        help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
+        profile: "value",
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "auth status",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        "api-version": "value",
-        workflow: "value",
-        run: "value",
-        scopes: "value",
-        config: "value"
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
+        offline: "boolean"
       },
       positionalInput: false
     },
     {
-      command: "entra lifecycle run subject-processing-result list",
+      command: "server",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        "api-version": "value",
-        workflow: "value",
-        run: "value",
-        limit: "value",
-        all: "boolean",
-        filter: "value",
-        fields: "value",
-        full: "boolean",
-        cursor: "value",
-        scopes: "value",
-        config: "value"
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value"
       },
       positionalInput: false
     },
     {
-      command: "entra lifecycle run subject-processing-result show",
+      command: "entry search",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        "api-version": "value",
-        workflow: "value",
-        run: "value",
-        id: "value",
-        fields: "value",
-        full: "boolean",
-        scopes: "value",
-        config: "value"
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
+        filter: "value",
+        scope: "value",
+        attributes: "value",
+        "page-size": "value",
+        "max-rows": "value",
+        all: "boolean"
       },
       positionalInput: false
     },
     {
-      command: "entra lifecycle run subject-processing-result count",
+      command: "entry show",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        "api-version": "value",
-        workflow: "value",
-        run: "value",
-        scopes: "value",
-        config: "value"
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
+        attributes: "value",
+        "page-size": "value"
       },
-      positionalInput: false
+      positionalInput: true
     },
     {
-      command: "entra lifecycle run task-processing-result list",
+      command: "user list",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        "api-version": "value",
-        workflow: "value",
-        run: "value",
-        limit: "value",
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
+        disabled: "boolean",
+        enabled: "boolean",
+        locked: "boolean",
         all: "boolean",
+        name: "value",
+        sam: "value",
+        upn: "value",
+        uid: "value",
         filter: "value",
-        select: "value",
+        scope: "value",
+        "max-rows": "value",
+        "page-size": "value",
+        limit: "value",
         fields: "value",
-        full: "boolean",
-        cursor: "value",
-        scopes: "value",
-        config: "value"
+        attributes: "value"
       },
       positionalInput: false
     },
     {
-      command: "entra lifecycle run task-processing-result show",
+      command: "user show",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        "api-version": "value",
-        workflow: "value",
-        run: "value",
-        id: "value",
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
         fields: "value",
-        full: "boolean",
-        scopes: "value",
-        config: "value"
+        attributes: "value"
       },
-      positionalInput: false
+      positionalInput: true
     },
     {
-      command: "entra lifecycle run task-processing-result count",
+      command: "user groups",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        "api-version": "value",
-        workflow: "value",
-        run: "value",
-        scopes: "value",
-        config: "value"
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
+        nested: "boolean",
+        "max-rows": "value",
+        "page-size": "value",
+        fields: "value"
       },
-      positionalInput: false
+      positionalInput: true
     },
     {
-      command: "api get",
+      command: "group list",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        "api-version": "value",
-        odata: "value",
-        cursor: "value",
-        scopes: "value",
-        limit: "value",
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
         all: "boolean",
-        full: "boolean",
-        config: "value"
+        name: "value",
+        sam: "value",
+        filter: "value",
+        scope: "value",
+        "max-rows": "value",
+        "page-size": "value",
+        limit: "value",
+        fields: "value",
+        attributes: "value"
       },
-      positionalInput: {
-        name: "path",
-        description: "Server-relative Graph path, e.g. /users",
-        required: true
-      }
+      positionalInput: false
     },
     {
-      command: "login",
+      command: "group show",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        method: "value",
-        scopes: "value",
-        config: "value"
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
+        fields: "value",
+        attributes: "value"
       },
-      positionalInput: false
+      positionalInput: true
     },
     {
-      command: "config path",
+      command: "group members",
       flags: {
         help: "boolean",
-        config: "value"
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
+        profile: "value",
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
+        nested: "boolean",
+        "max-rows": "value",
+        "page-size": "value",
+        fields: "value"
       },
-      positionalInput: false
+      positionalInput: true
     },
     {
-      command: "auth status",
+      command: "computer list",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        config: "value"
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
+        all: "boolean",
+        name: "value",
+        sam: "value",
+        filter: "value",
+        scope: "value",
+        "max-rows": "value",
+        "page-size": "value",
+        limit: "value",
+        fields: "value",
+        attributes: "value"
       },
       positionalInput: false
     },
     {
-      command: "auth logout",
+      command: "computer show",
       flags: {
         help: "boolean",
+        config: "value",
+        url: "value",
+        base: "value",
+        "start-tls": "boolean",
+        "ca-file": "value",
+        "ca-only": "boolean",
+        "tls-no-verify": "boolean",
+        "tls-max-version": "value",
+        "insecure-plaintext": "boolean",
+        anonymous: "boolean",
         profile: "value",
-        config: "value"
+        auth: "value",
+        "gssapi-service": "value",
+        "gssapi-protection": "value",
+        fields: "value",
+        attributes: "value"
       },
-      positionalInput: false
+      positionalInput: true
     }
   ]
 };
@@ -34880,8 +34759,8 @@ var ado_axi_default = {
 var awx_axi_default = {
   generatedBy: "scripts/awx-inventory.mjs",
   tool: "awx-axi",
-  version: "0.1.7",
-  integrity: "sha512-hZFvJnOhW+UZDeBTp+un1K1anUqEVC0njETANXbHjgXKwiGB3W1h5oEZzmf4fiPskZarr+ynlEaUaWafEHtnsA==",
+  version: "0.1.8",
+  integrity: "sha512-tkheZgSTjs6nZT3KWo0e/+SH43ZacfvZpo7COktmpIs8lNr8VLhUtrGARz+mvwj8pov4zscdfmxAHL/8V025Bw==",
   parserEvidence: "Published domain registry, reviewed plan effects and transport safety gates",
   sources: [
     {
@@ -34894,7 +34773,7 @@ var awx_axi_default = {
     },
     {
       path: "dist/commands/auth.js",
-      sha256: "5ccc0c9a226ab900bcc89a55aa71b22b64a41069e9f64d73c2c1fece79190a68"
+      sha256: "cf8e52f33d6acb5091d009c23df4957da3d208d4e9417bdcbba547f4d7c8b690"
     },
     {
       path: "dist/commands/home.js",
@@ -34918,7 +34797,7 @@ var awx_axi_default = {
     },
     {
       path: "dist/core/flags.js",
-      sha256: "ae72d1964d63ef9fab92bb5ff561f584432c14b8d216b5f2e2b5967333b25fbb"
+      sha256: "60d5c58ab68c3cc61e57c249b93db544d619469c6fbd1e3082ee573ed1b50498"
     },
     {
       path: "dist/core/mutations.js",
@@ -34926,11 +34805,11 @@ var awx_axi_default = {
     },
     {
       path: "dist/core/output.js",
-      sha256: "b8d4dc8dff76151b2af0e25caf5946c97ba98f8eb21939aab49ed1222d7c16dd"
+      sha256: "7406df524ee329a3e2eb1f2b37295d8699de678e687525c8d55a3ce67d78dd0a"
     },
     {
       path: "dist/core/paginate.js",
-      sha256: "cd5b17961f1671e204a8087b96ef8a15dc8c4994b486f0b3027734c560e648b2"
+      sha256: "d952bc390a4ac2da263b1d98c24f05e416652335904de37b26379576632059a3"
     },
     {
       path: "dist/core/poll.js",
@@ -34938,19 +34817,19 @@ var awx_axi_default = {
     },
     {
       path: "dist/core/private-file.js",
-      sha256: "eedc2a13e5e4470eb22b8e3d500cd971b376c57fff9220c12c4d507ceeb240f6"
+      sha256: "30f44672d91f74b232ae6f7884b7daee6bd12ce6702ca57b3213a8a5da4bf992"
     },
     {
       path: "dist/core/profiles.js",
-      sha256: "72b3bfe669c5471222efb6a457d25daff793375399c406f47a112fc76b291dc4"
+      sha256: "c3ac1d2a531115d253ed83020d88e3763108249a4a03ca710da40833db05bc7d"
     },
     {
       path: "dist/core/redact.js",
-      sha256: "dd8de047c53d06808f90f9c51324b737a51d83768c16d4e69f9af64f56bdf602"
+      sha256: "4fa205b30a3165738578c01ecfa5787bb6993ee11b07dbcb74b6401d4441679f"
     },
     {
       path: "dist/core/registry.js",
-      sha256: "a1818f532b67b39c6402d694b982b688234fdfdec4df51782ef30783b7afe488"
+      sha256: "89d3983928dd3a63712e9c78a4959c2e9c950097a3d200f6d1ccf2c3327bbdfd"
     },
     {
       path: "dist/core/resolve.js",
@@ -34966,95 +34845,95 @@ var awx_axi_default = {
     },
     {
       path: "dist/domains/activity-stream/index.js",
-      sha256: "b5e7094013f5626affc0bf756b96ad3edce3d1720d0698238bc703e749e8571a"
+      sha256: "633995f66b7e24cb4c6d98341e943a7e8d61b3b271503cb1b191b161b3fb927f"
     },
     {
       path: "dist/domains/ad-hoc/index.js",
-      sha256: "8fdaf507ab0b4b4f7e9ae7713e36ae318d55882276cfe9e82dfdeff65417266d"
+      sha256: "92f5395f74f449bb6fde43276764dfe965eaa8afb491a8f5e13323dc9a366084"
     },
     {
       path: "dist/domains/approval/index.js",
-      sha256: "139356c4fa1289f2694d55248b7f12e8b0267fa5acd39edb05b0f3ac4da0f64e"
+      sha256: "741282a1143b776ba0850cd8cc0ec3da913e1d354cc08f671b51cdea58621b1b"
     },
     {
       path: "dist/domains/credential/index.js",
-      sha256: "554a36457a4d264f2361da766350ec6696aaace78280e978f56b6fb577447f6b"
+      sha256: "00e5171e9b653f8266722cc53302748bbd54c874c07e60e2967f95797c7bcf05"
     },
     {
       path: "dist/domains/execution-environment/index.js",
-      sha256: "d068ff30cdf0eff1d8af2a53a564ed26e2843c544cd1d0d5c2643e8a9f07bdca"
+      sha256: "0038065d8d51b9fe370e8e517ddcebfdb8ccf0b3ee512a89147eea413e918685"
     },
     {
       path: "dist/domains/group/index.js",
-      sha256: "6415d7548cc0220f423dd5da887b0fc6975be3cdb8367ed5df74f7af375fc5ef"
+      sha256: "7fdd83edd141372fcc5486ba07968137f913ac9a73147aa748127b523c4cc785"
     },
     {
       path: "dist/domains/host/index.js",
-      sha256: "2faf483f269b39a12f759f46ff520ee97ac1009448062ccfb333c5a26ecd4591"
+      sha256: "478ff268a6a6a8452aa206be7671e402782fbfde8504808d9cc4fe10205b6707"
     },
     {
       path: "dist/domains/inventory-source/index.js",
-      sha256: "1015ff818f4051828cd089ff603f6a1fe28ddb672061be021372c93f68053f56"
+      sha256: "56d8f203514f688eb734c29c2db45930dcddb96bdb82424bf8cc835c493cb279"
     },
     {
       path: "dist/domains/inventory/index.js",
-      sha256: "8363397bbb0b9f90617442ae980d9900b536f7c17dec35d1b931c71546603f31"
+      sha256: "0352fc474d38aed258ab069a6a80da83d3acf00c9cccd37c3d26b16e8b6d8e2d"
     },
     {
       path: "dist/domains/job/index.js",
-      sha256: "5a5c76bc626d83dc286b737416b8f44c0b5bf53b419f39cc07bb61ef65ae00bd"
+      sha256: "db22aa5cd3c15da799d7aaea4430c9a6aa5e04e7f5fa1a5cacb340799f34f38c"
     },
     {
       path: "dist/domains/notification-template/index.js",
-      sha256: "8b6faa1fd012db6d2c66246dea378d8360aaa36dc1accfed367cb39f4679721a"
+      sha256: "c3ddb6e7abcdc57583bc1ada57f30302f63b01a559381c2be196b7ee3bbfdc9b"
     },
     {
       path: "dist/domains/notification/index.js",
-      sha256: "4825216f22fb565de502165455dd23a3126573dcff584d5cf97915123680d3cf"
+      sha256: "d9c46319aabe8187e3417710c3ebeda5650b55463f84fa9baa3d6fe91edc1ced"
     },
     {
       path: "dist/domains/organization/index.js",
-      sha256: "d79160904aca5909b3e83cee7a43d751566a49fcba7fd63595d2d10ecb473289"
+      sha256: "65072b9afb1706b67b1f7c37c9d96bf12104d8ec56a214f06a512e6283fb0229"
     },
     {
       path: "dist/domains/project/index.js",
-      sha256: "8dcb5a74ed19511e9c53cfe0d9c67efe3cf78861019a559c60c19914d8d7cde2"
+      sha256: "eafb98f7148e2a5e8c194af16ebbaa7569ddf74344e367531ba9f6946a39ef46"
     },
     {
       path: "dist/domains/role/index.js",
-      sha256: "63df014ea35ce97855e19fba126ccef8971756b2cc707a9c442f3fd6c094bdc9"
+      sha256: "0e5ee47acb703d2f202f01450eb87330140b97c430440eff31c4f33bab28a647"
     },
     {
       path: "dist/domains/schedule/index.js",
-      sha256: "bcab018cfa8b38fa9c4b3509ba1ec1c10c4e4d10e3887e500e00baa794bbc8a6"
+      sha256: "d3267a27432a6911027a2d5dc04177eb46db703ea012cc6d1cfe33c19be49694"
     },
     {
       path: "dist/domains/system-job-template/index.js",
-      sha256: "d9c8efd7b12054715e2a110bffa726dcb1bd34120521725c505b1179d7a49b45"
+      sha256: "8f485966f9f290399dfaf2eedf21b4182d2dd712bb6833e1df377eabb53ebb04"
     },
     {
       path: "dist/domains/system-job/index.js",
-      sha256: "59e45fa7495ae48f1e9d8e551a80673cbfbe880d4c78c4221a168709a8247cff"
+      sha256: "25bae07068cd93cf705c2bebcd8a4f6e5f6071c6b41951edb62527630e2c678f"
     },
     {
       path: "dist/domains/team/index.js",
-      sha256: "fd47ffaa541b5deede3994d16be4ad6683a2a8b0883d99846475f2e924453797"
+      sha256: "eb3a4b5cff91f8ef1b07b64a934a3b9d9bc025cf2eb476f6aafa92086b9c07b6"
     },
     {
       path: "dist/domains/template/index.js",
-      sha256: "30801bdd67e37b105eefd4df3e7c0ece4a7257258e9087bf444a3383e12c93c8"
+      sha256: "92dd83d5adbba8b572b2bcec6090630a34d572b4a1346906dafdc8499d6f7941"
     },
     {
       path: "dist/domains/user/index.js",
-      sha256: "b85dc53d942ffc9ed062bf948565c69d4cb046f718bb65118e3e27ce7533217c"
+      sha256: "dc2de36112a32b61f34d631f642a134b317255a5f5a1c1f2da6f3cf6d09e7cf3"
     },
     {
       path: "dist/domains/workflow/index.js",
-      sha256: "d5734a2b8f937fca7e0660f8c2942fbcc0e543c105c4be5a16b3f3787e6530af"
+      sha256: "811a3b1df2bfa7a2f76f6fb1c3464de91ed2b7c171788bc82ae4cd991ce4c52a"
     },
     {
       path: "dist/skill.js",
-      sha256: "65fe6713e288b6263bc74331969db46c39bd7d798b816266512de456427626a7"
+      sha256: "c7280e3093b0f547c577d54dc1f861cac4ce13ec70afabf7a3d1d55e3dbd6247"
     }
   ],
   credentialSchema: {
@@ -35146,7 +35025,7 @@ var awx_axi_default = {
       }
     }
   },
-  skillSha256: "b3e128cd347128b36f949cf5641a4a1e3eeac47866e469d74d467f068cfb99c5",
+  skillSha256: "71f03eed887e2a5189b1b08b692fc5fd7a4acfd274102bd925c27d1dd16177ce",
   adapterBoundary: {
     unsafeOverrides: [
       "config",
@@ -35219,7 +35098,9 @@ var awx_axi_default = {
         template: "value",
         failed: "boolean",
         since: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -35264,7 +35145,9 @@ var awx_axi_default = {
         failed: "boolean",
         host: "value",
         task: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -35277,7 +35160,10 @@ var awx_axi_default = {
       command: "job hosts",
       effect: "read",
       flags: {
-        help: "boolean"
+        help: "boolean",
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -35367,7 +35253,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -35594,7 +35482,9 @@ var awx_axi_default = {
         help: "boolean",
         project: "value",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -35659,7 +35549,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -36020,7 +35912,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -36077,7 +35971,10 @@ var awx_axi_default = {
       command: "workflow nodes",
       effect: "read",
       flags: {
-        help: "boolean"
+        help: "boolean",
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -36091,7 +35988,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -36104,8 +36003,7 @@ var awx_axi_default = {
       command: "workflow template-node",
       effect: "read",
       flags: {
-        help: "boolean",
-        limit: "value"
+        help: "boolean"
       },
       positionals: {
         names: [
@@ -36431,7 +36329,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -36473,7 +36373,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -36516,7 +36418,9 @@ var awx_axi_default = {
         search: "value",
         template: "value",
         status: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -36544,7 +36448,9 @@ var awx_axi_default = {
         failed: "boolean",
         host: "value",
         task: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -36558,7 +36464,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -36572,7 +36480,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -36659,7 +36569,9 @@ var awx_axi_default = {
         help: "boolean",
         search: "value",
         organization: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -36685,7 +36597,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         "include-decided": "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -36767,7 +36681,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -36794,7 +36710,9 @@ var awx_axi_default = {
         help: "boolean",
         host: "value",
         task: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -36933,7 +36851,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -36971,7 +36891,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -36984,7 +36906,10 @@ var awx_axi_default = {
       command: "project roles",
       effect: "read",
       flags: {
-        help: "boolean"
+        help: "boolean",
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -37416,7 +37341,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -37442,7 +37369,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -37458,6 +37387,8 @@ var awx_axi_default = {
         help: "boolean",
         search: "value",
         limit: "value",
+        all: "boolean",
+        "max-rows": "value",
         facts: "boolean"
       },
       positionals: {
@@ -37473,7 +37404,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -37504,7 +37437,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -37532,7 +37467,9 @@ var awx_axi_default = {
         search: "value",
         name: "value",
         inventory: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -37560,7 +37497,9 @@ var awx_axi_default = {
         search: "value",
         name: "value",
         inventory: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -37590,7 +37529,9 @@ var awx_axi_default = {
         inventory: "value",
         source: "value",
         status: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -37782,7 +37723,9 @@ var awx_axi_default = {
         template: "value",
         enabled: "boolean",
         disabled: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -37883,7 +37826,9 @@ var awx_axi_default = {
         search: "value",
         organization: "value",
         type: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -38001,7 +37946,9 @@ var awx_axi_default = {
       flags: {
         help: "boolean",
         search: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -38035,7 +37982,9 @@ var awx_axi_default = {
         "inventory-update": "value",
         "ad-hoc": "value",
         "system-job": "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -38153,7 +38102,9 @@ var awx_axi_default = {
         search: "value",
         type: "value",
         organization: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -38190,7 +38141,9 @@ var awx_axi_default = {
         team: "value",
         user: "value",
         credential: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -38318,7 +38271,9 @@ var awx_axi_default = {
         help: "boolean",
         search: "value",
         organization: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -38343,7 +38298,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -38357,7 +38314,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -38371,7 +38330,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -38385,7 +38346,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -38399,7 +38362,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -38413,7 +38378,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -38463,7 +38430,9 @@ var awx_axi_default = {
         help: "boolean",
         search: "value",
         type: "value",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [],
@@ -38488,7 +38457,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -38502,7 +38473,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -38516,7 +38489,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -38530,7 +38505,9 @@ var awx_axi_default = {
       effect: "read",
       flags: {
         help: "boolean",
-        limit: "value"
+        limit: "value",
+        all: "boolean",
+        "max-rows": "value"
       },
       positionals: {
         names: [
@@ -38641,8 +38618,1210 @@ var awx_axi_default = {
   ]
 };
 
+// tools/inventories/tenable-axi.json
+var tenable_axi_default = {
+  generatedBy: "scripts/tenable-inventory.mjs",
+  tool: "tenable-axi",
+  version: "0.1.0",
+  integrity: "sha512-nw1HLOmUZdeo/x1po1uOmFQhZsg0rP1eMGrcwLj+Pd2UkdwKodAQjDCjgBdl5DNLIqaafkUEV6mPMJmkFLQpzw==",
+  parserEvidence: "Published command catalogue, mutation registry and reviewed native parsers and transport gates",
+  sources: [
+    {
+      path: "dist/src/attack-catalogue.js",
+      sha256: "022f9d46c0e0a76b62ed528b17552fccae9634208698e541146f8af2f6107316"
+    },
+    {
+      path: "dist/src/attack-export-catalogue.js",
+      sha256: "7127a33fdbb01db34886b2c91b36bdc174131819b5753c1201c56999389584ee"
+    },
+    {
+      path: "dist/src/attack-export.js",
+      sha256: "38adf6d13ab1afe4f8d0123803257c2f10a1c47b9a7f9b216ee9107ea30368c8"
+    },
+    {
+      path: "dist/src/attack.js",
+      sha256: "76905fe54d1038ffbaa6b4a82b4cb4fadb6473462d28679319a98ab7cdd08650"
+    },
+    {
+      path: "dist/src/catalogue.js",
+      sha256: "d05c8dfebce3219c2ee0a305888fa336e62db5fc3b3b4bc95a27c0588943587b"
+    },
+    {
+      path: "dist/src/cli.js",
+      sha256: "df6dfee98019af2da15ac7a3c4d1ea7b3860c73021cbf2f08ac52386a64f441c"
+    },
+    {
+      path: "dist/src/export-file.js",
+      sha256: "2eb4f73e2d9a3361283a62e887c6cf95de70d5d3f353441bcd4de738377d57df"
+    },
+    {
+      path: "dist/src/exposure-contracts.js",
+      sha256: "febe68635d243ce801607d76af753d21f2ff30712c0efe9c3a2805209cc4b915"
+    },
+    {
+      path: "dist/src/exposure.js",
+      sha256: "0278853a917eb583c721c69d10c5e466aed9d18c8d910f20991dcfe33faac738"
+    },
+    {
+      path: "dist/src/hook-install.js",
+      sha256: "74fce246ea8fd1ee83bc89f06ab71b3bbf10b2b6ebce0701d24c95eae7755668"
+    },
+    {
+      path: "dist/src/inventory-catalogue.js",
+      sha256: "2a4b4338917af9060b6859eaa2cfc94cc5ccb936bf96f744b51755d4d92d98a7"
+    },
+    {
+      path: "dist/src/inventory-export-catalogue.js",
+      sha256: "a85ef57098bdec74dccd587b7065ebb4c84b3902043fc87c8aedd878d74b375f"
+    },
+    {
+      path: "dist/src/inventory-export.js",
+      sha256: "5422b59008eecad8476d8c0ce5f287188a2f1ad4fcfe763450ac187423d7d0f2"
+    },
+    {
+      path: "dist/src/inventory.js",
+      sha256: "12ad8effb2728fea7791e5f62716d079484b377c56f8b9cdb83d500842258b7d"
+    },
+    {
+      path: "dist/src/inventory/schema.js",
+      sha256: "1dc7cf0f1fb0e07dcf79bcac7e41450e1394345fc4fcd410119ab639064926af"
+    },
+    {
+      path: "dist/src/local-commands.js",
+      sha256: "4bb2769049b72126c47857f850b3cd008a371f952c479e0b288d5279d7aaa77a"
+    },
+    {
+      path: "dist/src/platform-tag-catalogue.js",
+      sha256: "9c887c06dd1179a877696deae8873ffce5e3b3e001f2c61ae7968f883eafe314"
+    },
+    {
+      path: "dist/src/platform-tag.js",
+      sha256: "ff31eb9a454ba20d2e378403fd4cb29b097e8de4b8b241b3af13197598a66972"
+    },
+    {
+      path: "dist/src/private-file.js",
+      sha256: "a5f01182fe09394ecf508deb46d54c9fb0b39c9fd205094d155ace212bbd1c8b"
+    },
+    {
+      path: "dist/src/profiles.js",
+      sha256: "12defbf234e4da8584e1f6ba601eb3826733ff85c76445197b0162ac52299b4a"
+    },
+    {
+      path: "dist/src/redact.js",
+      sha256: "e88631746e63a7fc08f206b58ddf3754ecea6f0ec21011c37ded0114dfbb6830"
+    },
+    {
+      path: "dist/src/response-catalogue.js",
+      sha256: "6f0eb3f6ba860e59e7bfd764a0d3932b52101e4013acea4ee5aa63081a1f83db"
+    },
+    {
+      path: "dist/src/response.js",
+      sha256: "44277f2a0c28b3e6801c47578603270ed59c76aac5214c6428fd2dbf8a83f1d4"
+    },
+    {
+      path: "dist/src/setup.js",
+      sha256: "2e9c8430b4fbf0f95e0e31267ba828107fd054e9d525a5c970f7c9c2e20d5348"
+    },
+    {
+      path: "dist/src/transport-core.js",
+      sha256: "db13c1c33aa1716bc8a32e3ebc6459421c64f078ea4641f248e552c5b74a621d"
+    },
+    {
+      path: "dist/src/transport.js",
+      sha256: "c3639f96d71c80217da15fe7449b586ee797c94e9f4f6b3f22d0472613d28ee1"
+    },
+    {
+      path: "dist/src/writes-core.js",
+      sha256: "55a76961512751653c8d14778b6b74094318ba1527b50dedf2167127f1e7c1f9"
+    },
+    {
+      path: "dist/src/writes.js",
+      sha256: "43099c373b451991102515f0f583c9a7678edb89a5b6bc9ad7e261a1c1f4a5dd"
+    }
+  ],
+  credentialSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "https://github.com/knowttl/tenable-axi/axi-credential.schema.json",
+    title: "Tenable AXI credential profile",
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      origin: {
+        const: "https://cloud.tenable.com",
+        default: "https://cloud.tenable.com"
+      },
+      accessKey: {
+        $ref: "#/$defs/secretRef",
+        "x-secret": true,
+        default: {
+          env: "TENABLE_AXI_ACCESS_KEY"
+        }
+      },
+      secretKey: {
+        $ref: "#/$defs/secretRef",
+        "x-secret": true,
+        default: {
+          env: "TENABLE_AXI_SECRET_KEY"
+        }
+      },
+      writes: {
+        type: "object",
+        additionalProperties: false,
+        required: [
+          "allowWrites",
+          "operations"
+        ],
+        default: {
+          allowWrites: false,
+          operations: []
+        },
+        properties: {
+          allowWrites: {
+            type: "boolean"
+          },
+          operations: {
+            type: "array",
+            items: {
+              type: "string",
+              pattern: "^[A-Za-z0-9][A-Za-z0-9_-]*$"
+            }
+          }
+        }
+      }
+    },
+    $defs: {
+      secretRef: {
+        oneOf: [
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "env"
+            ],
+            properties: {
+              env: {
+                type: "string",
+                pattern: "^[A-Za-z_][A-Za-z0-9_]*$"
+              }
+            }
+          },
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "file"
+            ],
+            properties: {
+              file: {
+                type: "string",
+                pattern: "^(?:/|[A-Za-z]:[\\\\/])"
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  skillSha256: "ea35fe90d39fee3982f731ccc3c717c92aabd0799ff2371f6f3cc5e12d7aea9a",
+  nativeWriteSettings: {
+    supportedOperations: [
+      "apa-export-attack-path",
+      "apa-export-attack-technique",
+      "apa-export-mitre-heatmap",
+      "combinations-create",
+      "combinations-delete",
+      "combinations-update",
+      "initiatives-create",
+      "initiatives-delete",
+      "initiatives-update",
+      "inventory-export-assets",
+      "inventory-export-findings",
+      "tags-assign-asset-tags",
+      "tags-create-tag-category",
+      "tags-create-tag-value",
+      "tags-delete-tag-category",
+      "tags-delete-tag-value",
+      "tags-delete-tag-values-bulk",
+      "tags-edit-tag-category",
+      "tags-update-tag-value"
+    ]
+  },
+  adapterBoundary: {
+    unsafeOverrides: [
+      "config",
+      "profile",
+      "origin",
+      "output"
+    ],
+    inputFileFlags: [
+      "filter-file",
+      "body-file",
+      "ids-file",
+      "asset-ids-file",
+      "tag-ids-file"
+    ],
+    blockedCommands: [
+      "setup hooks",
+      "config path",
+      "profile list",
+      "hook",
+      "export attack download",
+      "export inventory download"
+    ],
+    inputs: {
+      stdin: "explicit file flag with - only",
+      files: "uploaded leaves only",
+      downloads: "unsupported"
+    },
+    nativeWrites: "native preview, operation allow-list, execute, exact confirm and durable journal"
+  },
+  discovery: {
+    commands: [
+      "asset",
+      "attack-path",
+      "attack-technique",
+      "auth",
+      "card",
+      "combination",
+      "connector",
+      "doctor",
+      "export",
+      "finding",
+      "home",
+      "initiative",
+      "software",
+      "tag"
+    ],
+    example: [
+      "card",
+      "list",
+      "--limit",
+      "1"
+    ],
+    help: "tenable-axi card list [--limit <n>]\nArtium manages both API keys and the fixed https://cloud.tenable.com origin. Writes and export-job creation require administrator-enabled operations, preview, --execute and exact --confirm. File inputs accept uploaded leaves or explicit stdin (-). Downloads and local configuration are blocked.\n"
+  },
+  suggestionFields: [
+    "help"
+  ],
+  format: "TOON",
+  commands: [
+    {
+      command: "asset list",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire properties; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        limit: "Maximum emitted rows, 1-10000; default 100",
+        all: "Read up to 10000 rows within invocation budgets; excludes --limit",
+        cursor: "Opaque resume cursor; retain the original selectors and filters",
+        query: "Simple query text",
+        filter: "Repeatable: <property> <operator> <JSON string array>",
+        "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
+        sort: "Wire property:asc|desc",
+        "extra-properties": "Comma-separated extra wire properties",
+        offset: "Starting record; default 0; excludes --cursor",
+        class: "Server-side asset class filter"
+      }
+    },
+    {
+      command: "asset properties",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire properties; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        limit: "Maximum emitted rows, 1-10000; default 100",
+        all: "Read up to 10000 rows within invocation budgets; excludes --limit",
+        cursor: "Opaque resume cursor; retain the original selectors and filters",
+        "asset-classes": "Comma-separated documented asset classes"
+      }
+    },
+    {
+      command: "asset show",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire properties; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        id: "Required exact inventory ID",
+        "extra-properties": "Comma-separated extra wire properties"
+      }
+    },
+    {
+      command: "attack-path list",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire fields; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        limit: "Maximum emitted rows, 1-10000; default 100",
+        all: "Read up to 10000 rows within invocation budgets; excludes --limit",
+        cursor: "Bounded resume cursor; retain original selectors, filters, sort and fields",
+        offset: "Starting record; default 0; excludes --cursor",
+        sort: "Documented wire property:direction",
+        filter: "Repeatable: <property> <operator> <JSON-value>; combines with AND (paths) or and (techniques)",
+        "filter-file": "Documented single or nested JSON filter, at most two logical levels; '-' reads stdin; excludes --filter",
+        "include-resolved": "Include resolved records; default false (exclude_resolved=true)",
+        "run-ai-summarization": "true|false; default false"
+      }
+    },
+    {
+      command: "attack-technique list",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire fields; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        limit: "Maximum emitted rows, 1-10000; default 100",
+        all: "Read up to 10000 rows within invocation budgets; excludes --limit",
+        cursor: "Bounded resume cursor; retain original selectors, filters, sort and fields",
+        offset: "Starting record; default 0; excludes --cursor",
+        sort: "Documented wire property:direction",
+        filter: "Repeatable: <property> <operator> <JSON-value>; combines with AND (paths) or and (techniques)",
+        "filter-file": "Documented single or nested JSON filter, at most two logical levels; '-' reads stdin; excludes --filter",
+        "include-resolved": "Include resolved records; default false (exclude_resolved=true)"
+      }
+    },
+    {
+      command: "auth status",
+      effect: "read",
+      flags: {
+        config: "Config path; default TENABLE_AXI_CONFIG or platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full text; default false",
+        help: "Show help; default false"
+      }
+    },
+    {
+      command: "card list",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact projection",
+        full: "Full text; default false",
+        help: "Show help; default false",
+        limit: "Output rows; default 100",
+        offset: "Starting record; default 0",
+        cursor: "Resume the same scoped collection",
+        all: "Read up to 10000 rows; incompatible with --limit",
+        global: "true or false; default all cards",
+        query: "Card name search",
+        "sorting-order": "asc or desc; default API order"
+      }
+    },
+    {
+      command: "card show",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact projection",
+        full: "Full text; default false",
+        help: "Show help; default false",
+        id: "Required card ID",
+        "trend-start-date": "UTC ISO timestamp",
+        "trend-end-date": "UTC ISO timestamp",
+        "sla-efficiency-start-date": "UTC ISO timestamp",
+        "sla-efficiency-end-date": "UTC ISO timestamp",
+        "sla-breakdown-filter": "ANY, REMEDIATED or NON_REMEDIATED; default ANY",
+        "include-trend-events": "true or false; default false"
+      }
+    },
+    {
+      command: "combination create",
+      effect: "write",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        execute: "Send once; default preview",
+        "dry-run": "Preview only; excludes --execute",
+        confirm: "Exact preview confirmation; required to execute",
+        "body-file": "Required strict JSON, at most 1 MiB; '-' reads stdin"
+      }
+    },
+    {
+      command: "combination delete",
+      effect: "write",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID",
+        execute: "Send once; default preview",
+        "dry-run": "Preview only; excludes --execute",
+        confirm: "Exact preview confirmation; required to execute"
+      }
+    },
+    {
+      command: "combination filters",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        limit: "Output rows; default 100, maximum 10000",
+        all: "Up to 10000 rows; excludes --limit",
+        cursor: "Re-fetch and resume an unchanged unpaged collection; requires original selectors"
+      }
+    },
+    {
+      command: "combination list",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        limit: "Output rows; default 100, maximum 10000",
+        all: "Up to 10000 rows; excludes --limit",
+        cursor: "Re-fetch and resume an unchanged unpaged collection; requires original selectors",
+        type: "private, shared or tenable; default all accessible"
+      }
+    },
+    {
+      command: "combination show",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID"
+      }
+    },
+    {
+      command: "combination update",
+      effect: "write",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID",
+        execute: "Send once; default preview",
+        "dry-run": "Preview only; excludes --execute",
+        confirm: "Exact preview confirmation; required to execute",
+        "body-file": "Required strict JSON, at most 1 MiB; '-' reads stdin"
+      }
+    },
+    {
+      command: "config path",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default TENABLE_AXI_CONFIG or platform path",
+        profile: "Common selector; paths are independent of profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full text; default false",
+        help: "Show help; default false"
+      }
+    },
+    {
+      command: "connector logs",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire fields; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        limit: "Maximum emitted rows, 1-10000; default 100",
+        all: "Read up to 10000 rows within invocation budgets; excludes --limit",
+        cursor: "Bounded resume cursor; retain original selectors, filters, sort and fields",
+        "connector-id": "Nonnegative numeric connector ID",
+        status: "SUCCEEDED|FAILED",
+        "start-date": "Inclusive YYYY-MM-DD; requires --end-date",
+        "end-date": "Exclusive YYYY-MM-DD; requires --start-date"
+      }
+    },
+    {
+      command: "doctor",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact projection",
+        full: "Full text; default false",
+        help: "Show help; default false"
+      }
+    },
+    {
+      command: "export asset jobs",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full output; default false",
+        help: "Show help",
+        status: "QUEUED|PROCESSING|FINISHED|ERROR",
+        limit: "1-1000; default 100; last three days only"
+      }
+    },
+    {
+      command: "export asset start",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full output; default false",
+        help: "Show help",
+        "body-file": "Optional strict query/filters JSON file, '-' for stdin; maximum 1 MiB",
+        properties: "Comma-separated property names",
+        "use-readable-name": "true|false; API default true",
+        "max-chunk-file-size": "5242880-104857600 bytes; API default 20971520",
+        sort: "property:asc|desc",
+        "file-format": "JSON|CSV; API default JSON",
+        compress: "true|false; API default false",
+        execute: "Create once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection"
+      }
+    },
+    {
+      command: "export attack download",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated metadata fields; default compact view",
+        full: "Full metadata text; default false",
+        help: "Show help",
+        id: "Required attack export UUID",
+        output: "Required new output file; overwrite refused"
+      }
+    },
+    {
+      command: "export attack status",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated metadata fields; default compact view",
+        full: "Full metadata text; default false",
+        help: "Show help",
+        id: "Required attack export UUID",
+        wait: "Poll once per second within 20-second/20-request budgets; default false"
+      }
+    },
+    {
+      command: "export attack-path start",
+      effect: "write",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated metadata fields; default compact view",
+        full: "Full metadata text; default false",
+        help: "Show help",
+        "body-file": "Required strict operation-specific JSON file, at most 1 MiB; '-' reads stdin",
+        execute: "Create the previewed job once; default false",
+        "dry-run": "Preview only; excludes --execute",
+        confirm: "Exact confirmation string from preview; required with --execute"
+      }
+    },
+    {
+      command: "export attack-technique start",
+      effect: "write",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated metadata fields; default compact view",
+        full: "Full metadata text; default false",
+        help: "Show help",
+        "body-file": "Required strict operation-specific JSON file, at most 1 MiB; '-' reads stdin",
+        execute: "Create the previewed job once; default false",
+        "dry-run": "Preview only; excludes --execute",
+        confirm: "Exact confirmation string from preview; required with --execute"
+      }
+    },
+    {
+      command: "export finding jobs",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full output; default false",
+        help: "Show help",
+        status: "QUEUED|PROCESSING|FINISHED|ERROR",
+        limit: "1-1000; default 100; last three days only"
+      }
+    },
+    {
+      command: "export finding start",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full output; default false",
+        help: "Show help",
+        "body-file": "Optional strict query/filters JSON file, '-' for stdin; maximum 1 MiB",
+        properties: "Comma-separated property names",
+        "use-readable-name": "true|false; API default true",
+        "max-chunk-file-size": "5242880-104857600 bytes; API default 20971520",
+        sort: "property:asc|desc",
+        "file-format": "JSON|CSV; API default JSON",
+        compress: "true|false; API default false",
+        execute: "Create once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection"
+      }
+    },
+    {
+      command: "export inventory download",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full output; default false",
+        help: "Show help",
+        id: "Required export UUID",
+        chunk: "Required nonnegative chunk number from status",
+        output: "Required new output file; refuses overwrite"
+      }
+    },
+    {
+      command: "export inventory status",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full output; default false",
+        help: "Show help",
+        id: "Required export UUID"
+      }
+    },
+    {
+      command: "export mitre-heatmap start",
+      effect: "write",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated metadata fields; default compact view",
+        full: "Full metadata text; default false",
+        help: "Show help",
+        "body-file": "Required strict operation-specific JSON file, at most 1 MiB; '-' reads stdin",
+        execute: "Create the previewed job once; default false",
+        "dry-run": "Preview only; excludes --execute",
+        confirm: "Exact confirmation string from preview; required with --execute"
+      }
+    },
+    {
+      command: "finding list",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire properties; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        limit: "Maximum emitted rows, 1-10000; default 100",
+        all: "Read up to 10000 rows within invocation budgets; excludes --limit",
+        cursor: "Opaque resume cursor; retain the original selectors and filters",
+        query: "Simple query text",
+        filter: "Repeatable: <property> <operator> <JSON string array>",
+        "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
+        sort: "Wire property:asc|desc",
+        "extra-properties": "Comma-separated extra wire properties",
+        offset: "Starting record; default 0; excludes --cursor"
+      }
+    },
+    {
+      command: "finding properties",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire properties; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        limit: "Maximum emitted rows, 1-10000; default 100",
+        all: "Read up to 10000 rows within invocation budgets; excludes --limit",
+        cursor: "Opaque resume cursor; retain the original selectors and filters"
+      }
+    },
+    {
+      command: "finding show",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire properties; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        id: "Required exact inventory ID",
+        "extra-properties": "Comma-separated extra wire properties"
+      }
+    },
+    {
+      command: "home",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Card fields; default id,name,score",
+        full: "Full text; default false",
+        help: "Show help; default false"
+      }
+    },
+    {
+      command: "hook",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact projection",
+        full: "Full text; default false",
+        help: "Show help; default false"
+      }
+    },
+    {
+      command: "initiative create",
+      effect: "write",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        execute: "Send once; default preview",
+        "dry-run": "Preview only; excludes --execute",
+        confirm: "Exact preview confirmation; required to execute",
+        "body-file": "Required strict JSON, at most 1 MiB; '-' reads stdin"
+      }
+    },
+    {
+      command: "initiative delete",
+      effect: "write",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID",
+        execute: "Send once; default preview",
+        "dry-run": "Preview only; excludes --execute",
+        confirm: "Exact preview confirmation; required to execute"
+      }
+    },
+    {
+      command: "initiative list",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        limit: "Output rows; default 100, maximum 10000",
+        all: "Up to 10000 rows; excludes --limit",
+        cursor: "Re-fetch and resume an unchanged unpaged collection; requires original selectors"
+      }
+    },
+    {
+      command: "initiative show",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID"
+      }
+    },
+    {
+      command: "initiative update",
+      effect: "write",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID",
+        execute: "Send once; default preview",
+        "dry-run": "Preview only; excludes --execute",
+        confirm: "Exact preview confirmation; required to execute",
+        "body-file": "Required strict JSON, at most 1 MiB; '-' reads stdin"
+      }
+    },
+    {
+      command: "profile list",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default TENABLE_AXI_CONFIG or platform path",
+        profile: "Common selector; list still shows all profiles",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full text; default false",
+        help: "Show help; default false"
+      }
+    },
+    {
+      command: "setup hooks",
+      effect: "blocked",
+      flags: {
+        scope: "user or project; default user; project targets the current directory",
+        help: "Show help; default false"
+      }
+    },
+    {
+      command: "software list",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire properties; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        limit: "Maximum emitted rows, 1-10000; default 100",
+        all: "Read up to 10000 rows within invocation budgets; excludes --limit",
+        cursor: "Opaque resume cursor; retain the original selectors and filters",
+        query: "Simple query text",
+        filter: "Repeatable: <property> <operator> <JSON string array>",
+        "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
+        sort: "Wire property:asc|desc",
+        "extra-properties": "Comma-separated extra wire properties",
+        offset: "Starting record; default 0; excludes --cursor"
+      }
+    },
+    {
+      command: "software properties",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated display or wire properties; default compact view",
+        full: "Show full text; default false",
+        help: "Show help",
+        limit: "Maximum emitted rows, 1-10000; default 100",
+        all: "Read up to 10000 rows within invocation budgets; excludes --limit",
+        cursor: "Opaque resume cursor; retain the original selectors and filters"
+      }
+    },
+    {
+      command: "tag asset-filter list",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        limit: "Output rows; default 100; maximum 10000",
+        cursor: "Resume the same scoped collection",
+        all: "Read at most 10000 rows; excludes --limit"
+      }
+    },
+    {
+      command: "tag assignment add",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        execute: "Execute once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection",
+        "asset-ids-file": "Required JSON asset UUID array; '-' for stdin",
+        "tag-ids-file": "Required JSON tag UUID array; '-' for stdin"
+      }
+    },
+    {
+      command: "tag assignment list",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        "asset-id": "Required exact asset UUID",
+        limit: "Output rows; default 100; maximum 10000",
+        cursor: "Resume the same scoped collection",
+        all: "Read at most 10000 rows; excludes --limit"
+      }
+    },
+    {
+      command: "tag assignment remove",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        execute: "Execute once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection",
+        "asset-ids-file": "Required JSON asset UUID array; '-' for stdin",
+        "tag-ids-file": "Required JSON tag UUID array; '-' for stdin"
+      }
+    },
+    {
+      command: "tag category create",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        name: "Required category name, at most 127 characters, no colon",
+        description: "Optional description, at most 3000 characters",
+        execute: "Execute once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection"
+      }
+    },
+    {
+      command: "tag category delete",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID",
+        execute: "Execute once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection"
+      }
+    },
+    {
+      command: "tag category list",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        limit: "Output rows; default 100; maximum 10000",
+        offset: "Starting record; default 0",
+        cursor: "Resume the same scoped collection",
+        all: "Read at most 10000 rows; excludes --limit",
+        filter: "Repeatable field:operator:value",
+        "filter-type": "and|or; API default and",
+        sort: "Comma-separated field:asc|desc"
+      }
+    },
+    {
+      command: "tag category show",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID"
+      }
+    },
+    {
+      command: "tag category update",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID",
+        name: "Required category name, at most 127 characters, no colon",
+        description: "Optional description, at most 3000 characters",
+        execute: "Execute once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection"
+      }
+    },
+    {
+      command: "tag exclusion list",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        limit: "Output rows; default 100; maximum 10000",
+        offset: "Starting record; default 0",
+        cursor: "Resume the same scoped collection",
+        all: "Read at most 10000 rows; excludes --limit",
+        "tag-id": "Required exact dynamic tag UUID",
+        "target-type": "assets; API default assets"
+      }
+    },
+    {
+      command: "tag list",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact projection",
+        full: "Full text; default false",
+        help: "Show help; default false",
+        limit: "Output rows; default 100",
+        offset: "Starting record; default 0",
+        cursor: "Resume the same scoped collection",
+        all: "Read up to 10000 rows; incompatible with --limit",
+        query: "Simple text search",
+        filter: "Repeatable: property operator JSON-array-of-strings",
+        "filter-file": "Strict documented tag filter array; incompatible with --filter",
+        sort: "property:asc or property:desc",
+        "extra-properties": "Comma-separated property names"
+      }
+    },
+    {
+      command: "tag properties",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact projection",
+        full: "Full text; default false",
+        help: "Show help; default false"
+      }
+    },
+    {
+      command: "tag value bulk-delete",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        execute: "Execute once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection",
+        "ids-file": "Required JSON UUID array; '-' for stdin; maximum 1 MiB"
+      }
+    },
+    {
+      command: "tag value create",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        "body-file": "Required strict tag JSON; '-' for stdin; maximum 1 MiB; no access_control",
+        execute: "Execute once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection"
+      }
+    },
+    {
+      command: "tag value delete",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID",
+        execute: "Execute once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection"
+      }
+    },
+    {
+      command: "tag value list",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        limit: "Output rows; default 100; maximum 10000",
+        offset: "Starting record; default 0",
+        cursor: "Resume the same scoped collection",
+        all: "Read at most 10000 rows; excludes --limit",
+        filter: "Repeatable field:operator:value",
+        "filter-type": "and|or; API default and",
+        sort: "Comma-separated field:asc|desc",
+        with: "Wildcard search value (w)",
+        "with-filter": "Comma-separated wildcard fields (wf)"
+      }
+    },
+    {
+      command: "tag value show",
+      effect: "read",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID"
+      }
+    },
+    {
+      command: "tag value update",
+      effect: "write",
+      flags: {
+        config: "Config path; default platform path",
+        profile: "Profile name; default credential precedence",
+        fields: "Comma-separated output fields; default compact view",
+        full: "Full text; default false",
+        help: "Show help",
+        id: "Required exact UUID",
+        "body-file": "Required strict tag JSON; '-' for stdin; maximum 1 MiB; no access_control",
+        execute: "Execute once; default preview",
+        "dry-run": "Explicit preview; excludes --execute",
+        confirm: "Exact confirmation from preview",
+        "intent-id": "Unique execution intent for replay protection"
+      }
+    }
+  ]
+};
+
 // src/shared/tool-manifests.ts
-var toolManifests = { "falcon-axi": falcon_axi_default, "vectra-axi": vectra_axi_default, "az-axi": az_axi_default, "mg-axi": mg_axi_default, "ldap-axi": ldap_axi_default, "ado-axi": ado_axi_default, "awx-axi": awx_axi_default };
+var toolManifests = { "falcon-axi": falcon_axi_default, "vectra-axi": vectra_axi_default, "az-axi": az_axi_default, "mg-axi": mg_axi_default, "ldap-axi": ldap_axi_default, "ado-axi": ado_axi_default, "awx-axi": awx_axi_default, "tenable-axi": tenable_axi_default };
 
 // node_modules/.pnpm/@toon-format+toon@2.3.1/node_modules/@toon-format/toon/dist/index.mjs
 var NULL_LITERAL = "null";
@@ -40010,6 +41189,7 @@ function resolveDecodeOptions(options) {
 
 // src/cli/rewrite.ts
 var managedFlags = {
+  "tenable-axi": tenable_axi_default.adapterBoundary.unsafeOverrides,
   "awx-axi": awx_axi_default.adapterBoundary.unsafeOverrides,
   "falcon-axi": falcon_axi_default.unsafeOverrides,
   "vectra-axi": vectra_axi_default.adapterBoundary.unsafeOverrides,
@@ -40072,6 +41252,13 @@ function rewriteSuggestions(output3, tool, truncated = false) {
   try {
     const json2 = output3.trimStart().startsWith("{");
     let parsed = json2 ? jsonHelp(output3) : toonHelp(output3);
+    if (tool === "tenable-axi" && parsed.document.commands) {
+      return encode3({
+        description: "Investigate Tenable One with managed API keys.",
+        commands: tenable_axi_default.commands.filter((route) => route.effect !== "blocked").map((route) => route.command),
+        help: [tenable_axi_default.discovery.help.replaceAll("tenable-axi ", "artium-axi tenable-axi ")]
+      }) + "\n";
+    }
     if (tool === "ldap-axi" && parsed.document.description === "Read Active Directory and LDAPv3 directories safely with ldap-axi (read-only)" && Array.isArray(parsed.document.commands) && parsed.spans.length) {
       const home = {
         ...parsed.document,
@@ -40167,9 +41354,14 @@ function managedFlagRanges(command, tool) {
   return ranges;
 }
 function hostedHelp(help, tool, flags, commands2) {
+  if (tool === "tenable-axi") {
+    help = help.split("\n").filter((line) => !/TENABLE_AXI_|SecretRefs|tenable-axi (?:setup|config|profile|hook)|export (?:attack|inventory) download/.test(line)).join("\n");
+    const guidance = "Artium manages both API keys and the fixed origin. Administrators enable write operations; native preview, execute, exact confirmation and journal gates remain required. Downloads are unavailable.";
+    if (commands2 && !help.includes(guidance)) help = help.trimEnd() + "\n" + guidance + "\n";
+  }
   if (tool === "awx-axi") {
     const guidance = "Artium manages the controller origin, verified TLS and token. Operational writes require administrator allowWrites and --confirm; configuration, deletion and security writes are blocked. No stdin or files. Ask an administrator to update the managed credential.";
-    help = help.split("\n").filter((line) => !/(?:\bAWX_AXI_[A-Z_]+\b|\bawx-axi (?:auth (?:login|logout)|setup|config|profile|update)\b|--(?:origin|profile|config|verify-ssl|allow-http)\b)/.test(line)).filter((line) => !/^(?:Run|Use) .*\bawx-axi job stdout\b.*--download\b/.test(line)).map((line) => (/^(?:artium-axi )?awx-axi job stdout\b/.test(line) ? line.replace(/ \[--(?:full|ansi)\]| \[--download <path>\]/g, "") : line).replace(/--timeout (?:600|3600)/g, "--timeout 50")).join("\n");
+    help = help.split("\n").filter((line) => !/(?:\bAWX_AXI_[A-Z_]+\b|\bawx-axi (?:auth (?:login|logout)|setup|config|profile|update)\b|--(?:origin|profile|config|verify-ssl|allow-http)\b)/.test(line)).filter((line) => !/^(?:Run|Use) .*\bawx-axi job stdout\b.*--download\b/.test(line)).map((line) => (/^(?:artium-axi )?awx-axi job stdout\b/.test(line) ? line.replace(/ \[--(?:full|ansi)\]| \[--download <path>\]/g, "") : line).replace(/^((?:artium-axi )?awx-axi job list\b[^\n]*) \[--fields <fields>\]/, "$1").replace(/--timeout (?:600|3600)/g, "--timeout 50")).join("\n");
     if (!help.trim()) help = guidance;
     else if (commands2 && !help.includes(guidance)) help = help.trimEnd() + "\n" + guidance + "\n";
   }
@@ -40199,7 +41391,8 @@ function hostedHelp(help, tool, flags, commands2) {
   const filtered = help.replace(
     /^([ \t]*(?:(?:Flags|Globals|Global flags|Selector flags on every command|[Vv]alid flags for `[^`]+`): |(?=--)))([^\r\n]*)(\r?\n|$)/gm,
     (_, label, listed, ending) => {
-      const retained = listed.split(", ").filter((flag) => !flags.includes(/^--([\w-]+)/.exec(flag)?.[1] ?? "")).join(", ");
+      const entries = label.trim() || /^--[\w-]+(?: <[^>]+>)?(?:, --[\w-]+(?: <[^>]+>)?)*\.?$/.test(listed) ? listed.split(", ") : [listed];
+      const retained = entries.filter((flag) => !flags.includes(/^--([\w-]+)/.exec(flag)?.[1] ?? "")).join(", ");
       if (!retained && !label.trim()) return "";
       return label + retained + (listed.endsWith(".") && !retained.endsWith(".") ? "." : "") + ending;
     }
@@ -40322,9 +41515,16 @@ function identityView(user, server) {
   return `user: ${JSON.stringify(user.username)}
 server: ${JSON.stringify(server)}
 roles[${user.roles.length}]: ${user.roles.map((role) => JSON.stringify(role)).join(",")}
-accessExpiresAt: ${user.accessExpiresAt}
+sessionExpiresAt: ${sessionExpiryView(user.sessionExpiresAt)}
+accessExpiresAt: ${sessionExpiryView(user.accessExpiresAt)}
+note: Access tokens refresh automatically when a refresh token is available.
 `;
 }
+function sessionExpiryView(expiresAt, now = Date.now()) {
+  const minutes = Math.max(0, Math.floor((expiresAt - now) / 6e4));
+  const remaining = expiresAt <= now ? "expired" : `in ${Math.floor(minutes / 60)}h ${minutes % 60}m`;
+  return `${new Date(expiresAt).toISOString().replace(".000Z", "Z")} (${remaining})`;
+}
 function toolsView(tools) {
   if (!tools.length) return "tools: 0 available\nreason: No enabled runtime tool is available through your assigned roles.\ncontact: Ask an administrator to check your role assignments and enabled tools.\nnext[1]:\n  - artium-axi whoami\n";
   return `tools[${tools.length}]{name,status,version,readOnly}:
@@ -40349,11 +41549,268 @@ upstreamHelp: ${JSON.stringify(help)}
 `;
 }
 
+// src/cli/doctor.ts
+var DIAGNOSTIC_REQUEST_DEADLINE_MS = 5e3;
+async function doctor(createClient = (deadline) => new Client(process.env, void 0, deadline), write = (text2) => {
+  process.stdout.write(text2);
+}) {
+  let failure2;
+  const line = (name, pass, detail, error62) => {
+    if (!pass) failure2 ??= error62 ?? new ArtiumError("INVALID_RESPONSE");
+    write(`${pass ? "pass" : "fail"}: ${name}${detail ? ` (${detail})` : ""}
+`);
+  };
+  let client;
+  try {
+    client = createClient(DIAGNOSTIC_REQUEST_DEADLINE_MS);
+  } catch (error62) {
+    for (const name of ["server address", "certificate", "token", "CLI version"]) line(name, false, "CLIENT_CONFIG_INVALID");
+    throw error62;
+  }
+  let addressOk = false;
+  try {
+    const live = await client.request("/health/live", "GET");
+    addressOk = !!live && typeof live === "object" && "status" in live && live.status === "ok";
+    line("server address", addressOk, client.serverUrlSource);
+    line("certificate", client.certificateVerified, client.certificateVerified ? void 0 : "test HTTP", new ArtiumError("CLIENT_CONFIG_INVALID"));
+  } catch (error62) {
+    const cause = error62 instanceof ArtiumError ? error62 : new ArtiumError("INVALID_RESPONSE");
+    line("server address", cause.code === "CERTIFICATE_INVALID", `${client.serverUrlSource}: ${cause.code}`, cause);
+    line("certificate", client.certificateVerified, client.certificateVerified ? void 0 : cause.code, cause);
+  }
+  if (!addressOk && failure2) throw failure2;
+  let versionOk = true;
+  let versionError;
+  try {
+    await client.request("/v1/me", "GET");
+  } catch (error62) {
+    versionOk = error62 instanceof ArtiumError && error62.code === "TOKEN_INVALID";
+    if (!versionOk) versionError = error62 instanceof ArtiumError ? error62 : new ArtiumError("INVALID_RESPONSE");
+  }
+  let tokenOk = false;
+  let tokenError;
+  let tokenDetail;
+  try {
+    const parsed = meResponseSchema.safeParse(await client.authenticated("/v1/me", "GET"));
+    tokenOk = parsed.success;
+    if (parsed.success) tokenDetail = `session expires ${sessionExpiryView(parsed.data.sessionExpiresAt)}`;
+  } catch (error62) {
+    tokenError = error62 instanceof ArtiumError ? error62 : new ArtiumError("INVALID_RESPONSE");
+  }
+  line("token", tokenOk, tokenDetail, tokenError);
+  line("CLI version", versionOk, void 0, versionError);
+  if (tokenOk && versionOk) {
+    try {
+      const parsed = toolsResponseSchema.safeParse(await client.authenticated("/v1/tools", "GET"));
+      if (!parsed.success) throw new ArtiumError("INVALID_RESPONSE");
+      for (const tool of parsed.data.tools) line(
+        tool.name,
+        tool.status === "ok",
+        tool.status,
+        new ArtiumError(tool.status === "unconfigured" ? "CREDENTIAL_NOT_CONFIGURED" : tool.status === "error" ? "TOOL_FAILED" : tool.status === "disabled" ? "TOOL_DISABLED" : "SERVER_UNAVAILABLE")
+      );
+    } catch (error62) {
+      const cause = error62 instanceof ArtiumError ? error62 : new ArtiumError("INVALID_RESPONSE");
+      line("tools", false, cause.code, cause);
+    }
+  }
+  if (failure2) throw failure2;
+}
+
+// src/cli/help.ts
+var commands = {
+  home: { usage: "artium-axi [tools [show <tool>]|whoami|login|passwd|logout|doctor|setup|update|<tool> <args>]", purpose: "Show your identity, roles and available tools.", flags: ["--version (default false; print the client package version and exit)"], example: "artium-axi" },
+  setup: {
+    usage: "artium-axi setup --host <claude|codex|opencode|pi> [--hook] [--force]",
+    purpose: "Install skills for your signed-in account\u2019s granted tools and an optional Claude Code session hook.",
+    flags: ["--host <claude|codex|opencode|pi> (required)", "--hook (default false; Claude Code only)", "--force (default false; explicitly replace an edited skill)"],
+    example: "artium-axi setup --host claude --hook"
+  },
+  tools: { usage: "artium-axi tools", purpose: "List available tools with their status and pinned version.", flags: [], example: "artium-axi tools" },
+  "tools show": { usage: "artium-axi tools show <tool>", purpose: "Show one available tool and its vetted upstream help.", flags: [], example: "artium-axi tools show falcon-axi" },
+  whoami: { usage: "artium-axi whoami", purpose: "Show your identity, roles, session expiry and server.", flags: [], example: "artium-axi whoami" },
+  login: {
+    usage: "artium-axi login --sso | --username <username> [--password-stdin]",
+    purpose: "Sign in through browser SSO (8-hour session) or with a local account.",
+    flags: ["--sso (default false; open the displayed URL in any browser and approve your terminal code; no password flags)", "--username <username> (required for local sign-in)", "--password-stdin (default false; local only; otherwise ARTIUM_AXI_PASSWORD or a terminal prompt)"],
+    example: "artium-axi login --sso"
+  },
+  passwd: {
+    usage: "artium-axi passwd [--password-stdin]",
+    purpose: "Change your password, then sign in again.",
+    flags: ["--password-stdin (default false; otherwise a terminal prompt; current password uses ARTIUM_AXI_CURRENT_PASSWORD or a terminal prompt)"],
+    example: "artium-axi passwd --password-stdin"
+  },
+  logout: { usage: "artium-axi logout", purpose: "Remove local tokens and revoke the server session.", flags: [], example: "artium-axi logout" },
+  doctor: { usage: "artium-axi doctor", purpose: "Check the server, certificate, token, CLI version and cached tool health.", flags: [], example: "artium-axi doctor" },
+  update: { usage: "artium-axi update", purpose: "Download and verify the server\u2019s client, replace this file and keep a .bak backup. npm installations must use npm install -g @knowttl/artium-axi.", flags: [], example: "artium-axi update" },
+  "falcon-axi": {
+    usage: "artium-axi falcon-axi [<args>]",
+    purpose: "Run Falcon commands with your managed credentials.",
+    flags: ["Arguments after falcon-axi are forwarded upstream, including --help."],
+    example: `artium-axi falcon-axi ${falcon_axi_default.discovery.example.join(" ")}`
+  },
+  "vectra-axi": {
+    usage: "artium-axi vectra-axi [<args>]",
+    purpose: "Run Vectra commands with your managed credentials.",
+    flags: ["Arguments after vectra-axi are forwarded upstream, including --help."],
+    example: `artium-axi vectra-axi ${vectra_axi_default.discovery.example.join(" ")}`
+  },
+  "ldap-axi": {
+    usage: "artium-axi ldap-axi [<args>]",
+    purpose: "Read directory data with the managed LDAP bind identity.",
+    flags: ["Arguments after ldap-axi are forwarded upstream, including --help."],
+    example: `artium-axi ldap-axi ${ldap_axi_default.discovery.example.join(" ")}`
+  },
+  "ado-axi": {
+    usage: "artium-axi ado-axi [<args>]",
+    purpose: "Run Azure DevOps commands with managed credentials.",
+    flags: ["Arguments after ado-axi include --help. Organization and credentials are managed by Artium; api is GET only; writes are off by default."],
+    example: "artium-axi ado-axi project list --limit 1"
+  },
+  "awx-axi": {
+    usage: "artium-axi awx-axi [<args>]",
+    purpose: "Inspect AWX automation with managed credentials.",
+    flags: ["Arguments after awx-axi include --help. Operational writes are off by default; configuration, deletion and security writes are blocked."],
+    example: "artium-axi awx-axi job list --limit 1"
+  },
+  "tenable-axi": {
+    usage: "artium-axi tenable-axi [<args>]",
+    purpose: "Investigate Tenable One with managed API keys.",
+    flags: ["Writes and export jobs are off by default and require administrator-enabled operations, preview, --execute and exact --confirm. Downloads are blocked."],
+    example: "artium-axi tenable-axi card list --limit 1"
+  },
+  "az-axi": {
+    usage: "artium-axi az-axi [<args>]",
+    purpose: "Run Azure commands with your managed identity.",
+    flags: ["Arguments after az-axi are forwarded upstream, including --help."],
+    example: "artium-axi az-axi sub list"
+  },
+  "mg-axi": {
+    usage: "artium-axi mg-axi [<args>]",
+    purpose: "Run Microsoft Graph commands with your managed identity.",
+    flags: ["Arguments after mg-axi are forwarded upstream, including --help."],
+    example: "artium-axi mg-axi entra user list"
+  },
+  "managed-session": {
+    usage: "artium-axi --managed-session <command> [<args>]",
+    purpose: "Let a caller supply and persist sessions through private pipes.",
+    flags: [],
+    example: "artium-axi --managed-session whoami"
+  }
+};
+function commandHelp(command) {
+  const entry = commands[command];
+  const flags = [
+    toolSchema.safeParse(command).success ? "--help before the tool name (default false)" : "--help (default false)",
+    ...entry.flags,
+    ...command === "update" ? [] : ["--managed-session before the command (default false; caller-owned sessions; see artium-axi --managed-session --help)"]
+  ];
+  const protocol = [
+    "Session JSON on inherited pipe fd 3, new sessions and rotations as JSON lines on private pipe fd 4; no session file.",
+    "Managed input: {serverUrl, accessToken, refreshToken?}; close fd 3 after JSON (64 KiB maximum). Output: {serverUrl, status, accessToken, refreshToken, accessExpiresAt, familyExpiresAt} per rotation, before retry, including on later failure.",
+    "Managed login: fd 3 is unused; fd 4 must be a writable private pipe/socket. Local sign-in requires --username <username> --password-stdin with protected inherited stdin; password argv and ARTIUM_AXI_PASSWORD are refused. SSO uses login --sso and displays browser approval instructions immediately. New sessions use the rotation envelope; password-change-required returns {serverUrl, status, passwordChangeToken, passwordChangeExpiresAt} on fd 4 and exits 1.",
+    "Managed exits: 0 success; 2 invalid JSON/descriptors or refused passwd/logout/setup/update; 1 authentication/transport failure; tool exit codes pass through. Only TOKEN_EXPIRED permits one refresh/retry; without refreshToken or on refusal, return control to the caller."
+  ];
+  const purposes = command === "home" ? `commands[${Object.keys(commands).length - 2}]{command,purpose}:
+${Object.entries(commands).filter(([name]) => name !== "home" && name !== "managed-session").map(([name, value]) => `  ${name},${JSON.stringify(value.purpose)}`).join("\n")}
+` : "";
+  return `purpose: ${entry.purpose}
+usage: ${entry.usage}
+${purposes}flags[${flags.length}]:
+${flags.map((flag) => `  - ${JSON.stringify(flag)}`).join("\n")}
+example: ${entry.example}
+` + (command === "login" || command === "managed-session" ? `managedSession[${protocol.length}]:
+${protocol.map((line) => `  - ${JSON.stringify(line)}`).join("\n")}
+` : "");
+}
+function validateArguments(args, prefixHelp) {
+  const command = args[0];
+  if (command === "tools") args = [...args.filter((arg) => arg !== "--help"), ...args.filter((arg) => arg === "--help")];
+  const rootFlags = "--help, --version, --managed-session (before the command)";
+  const rootCommands = Object.keys(commands).filter((name) => name !== "home" && name !== "managed-session" && name !== "tools show").join(", ");
+  function fail(token, level2, choices2) {
+    const kind = token?.startsWith("-") ? "flag" : "argument";
+    const message = token === void 0 ? `Missing argument for ${level2}.` : command === "login" || command === "passwd" ? `Unexpected argument at position ${args.indexOf(token) + 1} for ${level2}. Password arguments are refused.` : `Unknown or unexpected ${kind} ${JSON.stringify(kind === "flag" ? token.split("=")[0] : token)} for ${level2}.`;
+    throw new ArtiumError("INVALID_INPUT", message, choices2);
+  }
+  if (!command) return;
+  if (command === "--version" && args.length === 1) return;
+  if (!Object.hasOwn(commands, command) || command === "home" || command === "managed-session" || command === "tools show") {
+    fail(command, "artium-axi", `Valid commands: ${rootCommands}. Valid flags: ${rootFlags}.`);
+  }
+  if (toolSchema.safeParse(command).success) {
+    if (prefixHelp && args.length > 1) fail(args[1], command, `Use artium-axi --help ${command} for local help; artium-axi ${command} --help for upstream flags.`);
+    return;
+  }
+  let level = command;
+  let start = 1;
+  if (command === "tools" && args[1] === "show") {
+    level = "tools show";
+    start = 2;
+  }
+  const entry = commands[level];
+  const validFlags = ["--help", ...entry.flags.map((flag) => flag.split(" ")[0])];
+  const choices = `Valid flags for ${level}: ${validFlags.join(", ")}.` + (level === "tools" ? " Valid subcommands: show <tool>." : level === "tools show" ? ` Valid tools: ${toolSchema.options.join(", ")}.` : "");
+  let tool = false;
+  const seen = /* @__PURE__ */ new Set();
+  for (let index = start; index < args.length; index++) {
+    const token = args[index];
+    if (level === "tools show" && !token.startsWith("-") && !tool) {
+      if (!toolSchema.safeParse(token).success) fail(token, level, choices);
+      tool = true;
+    } else {
+      if (!validFlags.includes(token) || seen.has(token)) fail(token, level, choices);
+      seen.add(token);
+      if (token === "--username" || token === "--host") {
+        const value = args[index + 1];
+        if (!value) fail(value, `${level} ${token}`, `Supply ${token} ${token === "--host" ? "<claude|codex|opencode|pi>" : "<username>"}. ${choices}`);
+        if (token === "--host" && !["claude", "codex", "opencode", "pi"].includes(value)) fail(value, `${level} --host`, `Valid hosts: claude, codex, opencode, pi. Use ${entry.usage}.`);
+        index++;
+      }
+    }
+  }
+  if (level === "tools show" && !tool && !seen.has("--help") && !prefixHelp) fail(void 0, level, choices);
+}
+function helpCommand(args, prefixHelp = false) {
+  if (args[0] === "setup" && args.includes("--help")) {
+    const path2 = args.filter((arg) => arg !== "--help");
+    for (let index = 1; index < path2.length; index++) {
+      if (path2[index] === "--host" && ["claude", "codex", "opencode", "pi"].includes(path2[index + 1])) index++;
+      else if (path2[index] !== "--hook" && path2[index] !== "--force") return void 0;
+    }
+    return "setup";
+  }
+  if (toolSchema.safeParse(args[0]).success) return prefixHelp && args.length === 2 ? args[0] : void 0;
+  if (args[0] === "login" || args[0] === "passwd") {
+    if (args[0] === "login" && args.length === 3 && args.includes("--sso") && args.includes("--help")) return "login";
+    let requested = false;
+    let username = false;
+    let stdin = false;
+    for (let index = 1; index < args.length; index++) {
+      const option = args[index];
+      if (option === "--username" && args[0] === "login" && !username && args[index + 1] !== void 0) {
+        username = true;
+        index++;
+      } else if (option === "--password-stdin" && !stdin) stdin = true;
+      else if (option === "--help" && !requested) requested = true;
+      else return void 0;
+    }
+    return requested ? args[0] : void 0;
+  }
+  if (!args.includes("--help")) return void 0;
+  const path = args.filter((arg) => arg !== "--help");
+  if (path.length === 0) return "home";
+  if (path[0] === "tools" && path[1] === "show" && (path.length === 2 || path.length === 3 && toolSchema.safeParse(path[2]).success)) return "tools show";
+  if (path.length === 1 && path[0] !== "home" && Object.hasOwn(commands, path[0])) return path[0];
+  return void 0;
+}
+
 // src/cli/setup.ts
 import { createHash, randomUUID as randomUUID2 } from "node:crypto";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname2, join as join2, resolve } from "node:path";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
 
 // skill/artium-axi/SKILL.md
 var SKILL_default = "---\nname: artium-axi\ndescription: Discover and run managed commands through Artium, using the signed-in account and its granted tools.\n---\n\nUse artium-axi tools first for requests involving data from Artium-managed tools.\nRun `artium-axi tools` to discover the tools available to this account before choosing a tool.\nRun `artium-axi tools show <tool>` for its commands and a vetted example, then run `artium-axi <tool> <args>`.\nFollow the returned next commands; they already include the Artium prefix.\nKeep upstream arguments intact and use the managed credentials rather than configuring an upstream CLI directly.\n\nIf artium-axi is absent from PATH, use the installed command below in place of `artium-axi` in every example:\n\n<!-- artium-axi executable -->\nThe setup command records the standalone bundle's Node invocation here.\n<!-- /artium-axi executable -->\n\nIf sign-in is required, ask the user to follow `artium-axi login --help` for their SSO or local account.\nNever request or print tokens or put passwords in arguments.\nAn empty tool list means no enabled runtime tool is available through the account's roles; ask an administrator to check grants and enabled tools.\nUse `artium-axi doctor` for connection or cached health diagnostics.\nDo not retry an uncertain command outcome, especially a write.\n";
@@ -40452,7 +41909,7 @@ async function setup(args) {
   if (hook && host !== "claude") {
     throw new ArtiumError("INVALID_INPUT", `Hook installation is unsupported for ${host}: this installer has no verified ${host} hook implementation. No files were written.`, `Install the skill with artium-axi setup --host ${host} without --hook; Claude Code supports --hook.`);
   }
-  const executable = resolve(process.argv[1]);
+  const executable = resolve2(process.argv[1]);
   const invocation = process.platform === "win32" ? `& '${process.execPath.replaceAll("'", "''")}' '${executable.replaceAll("'", "''")}'` : `${quote(process.execPath)} ${quote(executable)}`;
   const executableBlock = `<!-- artium-axi executable -->
 
@@ -40462,7 +41919,7 @@ ${invocation}
 
 <!-- /artium-axi executable -->`;
   const content = SKILL_default.replace(/<!-- artium-axi executable -->[\s\S]*?<!-- \/artium-axi executable -->/, () => executableBlock);
-  const hostDirectory = host === "claude" && process.env.CLAUDE_CONFIG_DIR ? resolve(process.env.CLAUDE_CONFIG_DIR) : host === "pi" && process.env.PI_CODING_AGENT_DIR ? resolve(process.env.PI_CODING_AGENT_DIR.replace(/^~(?=\/|$)/, () => homedir2())) : join2(homedir2(), ...hosts[host]);
+  const hostDirectory = host === "claude" && process.env.CLAUDE_CONFIG_DIR ? resolve2(process.env.CLAUDE_CONFIG_DIR) : host === "pi" && process.env.PI_CODING_AGENT_DIR ? resolve2(process.env.PI_CODING_AGENT_DIR.replace(/^~(?=\/|$)/, () => homedir2())) : join2(homedir2(), ...hosts[host]);
   const client = new Client();
   const response = skillsResponseSchema.safeParse(await client.authenticated("/v1/skills", "GET"));
   if (!response.success) throw new ArtiumError("INVALID_RESPONSE");
@@ -40581,6 +42038,7 @@ expires: ${new Date(device.expiresAt).toISOString()}
         if (managed2) await managed2.emit(client.serverUrl, session);
         else await client.sessions.locked(async () => {
           client.sessions.write(session);
+          client.sessions.writeClientConfig(client.caFile);
         });
         const message = `status: authenticated
 session-ends: ${new Date(session.familyExpiresAt).toISOString()}
@@ -40735,9 +42193,9 @@ var ManagedSession = class _ManagedSession {
     if (session.status === "authenticated") this.protect(session.accessToken, session.refreshToken);
     else this.protect(session.passwordChangeToken);
     try {
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve4, reject) => {
         this.channel.write(`${JSON.stringify({ serverUrl, ...session })}
-`, (error62) => error62 ? reject(error62) : resolve3());
+`, (error62) => error62 ? reject(error62) : resolve4());
       });
     } catch {
       throw new ArtiumError(
@@ -40761,9 +42219,45 @@ var ManagedSession = class _ManagedSession {
   }
 };
 
+// src/cli/update.ts
+import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
+import { copyFileSync, existsSync as existsSync3, readFileSync as readFileSync4, realpathSync, renameSync as renameSync3, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
+async function update() {
+  const executable = realpathSync(process.argv[1]);
+  const metadata = join3(dirname3(executable), "..", "package.json");
+  if (existsSync3(metadata) && JSON.parse(readFileSync4(metadata, "utf8")).name === "@knowttl/artium-axi") {
+    throw new ArtiumError("INVALID_INPUT", "This client was installed from npm.", "Run npm install -g @knowttl/artium-axi@latest.");
+  }
+  const client = new Client();
+  const bundle = await client.request("/cli/artium-axi.mjs", "GET", void 0, void 0, true);
+  const checksum2 = await client.request("/cli/artium-axi.mjs.sha256", "GET", void 0, void 0, true);
+  const digest = checksum2.toString("utf8").trim().split(/\s+/)[0];
+  if (!/^[a-fA-F0-9]{64}$/.test(digest) || createHash2("sha256").update(bundle).digest("hex") !== digest.toLowerCase()) {
+    throw new ArtiumError("INVALID_RESPONSE", "The downloaded client failed SHA-256 verification.", "Run artium-axi update again after checking the server bundle and checksum.");
+  }
+  const temporary = `${executable}.${randomUUID3()}.tmp`;
+  try {
+    writeFileSync3(temporary, bundle, { flag: "wx", mode: statSync3(executable).mode & 511 });
+    copyFileSync(executable, `${executable}.bak`);
+    renameSync3(temporary, executable);
+  } catch {
+    throw new ArtiumError("INTERNAL_ERROR", "The client could not be replaced.", "Check write permissions for the client file and its directory, then run artium-axi update.");
+  } finally {
+    rmSync3(temporary, { force: true });
+  }
+  return "status: updated\nnext: artium-axi --version\n";
+}
+
 // src/cli/main.ts
 var managed;
+for (const stream of [process.stdout, process.stderr]) {
+  stream.on("error", (error62) => {
+    if (error62.code !== "EPIPE") throw error62;
+  });
+}
 function output2(stream, text2) {
+  if (process[stream].destroyed) return;
   if (managed) managed.write(stream, text2);
   else process[stream].write(text2);
 }
@@ -40791,7 +42285,7 @@ async function main(args) {
     return;
   }
   if (managedMode) {
-    if (["passwd", "logout", "setup"].includes(args[0])) {
+    if (["passwd", "logout", "setup", "update"].includes(args[0])) {
       throw new ArtiumError(
         "INVALID_INPUT",
         "This command is unavailable in managed session mode.",
@@ -40800,6 +42294,10 @@ async function main(args) {
     }
     managed = await ManagedSession.read(args[0] === "login");
   }
+  if (command === "update") {
+    output2("stdout", await update());
+    return;
+  }
   if (command === "setup") {
     output2("stdout", await setup(args.slice(1)));
     return;
@@ -40854,7 +42352,10 @@ async function main(args) {
         const parsed = loginResponseSchema.safeParse(await client2.request("/v1/auth/login", "POST", { username, password }));
         if (!parsed.success) throw new ArtiumError("INVALID_RESPONSE");
         if (managed) await managed.emit(client2.serverUrl, parsed.data);
-        else client2.sessions.write(parsed.data);
+        else {
+          client2.sessions.write(parsed.data);
+          client2.sessions.writeClientConfig(client2.caFile);
+        }
         return parsed.data;
       };
       const session = await (managed ? signIn() : client2.sessions.locked(signIn));
@@ -40916,7 +42417,7 @@ remoteRevocation: ${verified ? "verified" : "unverified"}
     if (home) {
       const tools = toolsResponseSchema.safeParse(await client.authenticated("/v1/tools", "GET", void 0, homeSession));
       if (!tools.success) throw new ArtiumError("INVALID_RESPONSE");
-      const executable = resolve2(process.argv[1]);
+      const executable = resolve3(process.argv[1]);
       const local = relative(homedir3(), executable);
       const bin = local && !isAbsolute(local) && !local.startsWith(`..${sep}`) && local !== ".." ? `~${sep}${local}` : executable;
       view = `bin: ${JSON.stringify(bin)}
@@ -40950,11 +42451,11 @@ ${Object.entries(response.error).map(([key, value]) => `  ${key}: ${JSON.stringi
 `);
   process.exitCode = errors[response.error.code].exitCode;
 }
-main(process.argv.slice(2)).catch((error62) => printError(errorResponse(error62 instanceof ArtiumError ? error62 : new ArtiumError("INTERNAL_ERROR"), randomUUID3()))).then(() => {
+main(process.argv.slice(2)).catch((error62) => printError(errorResponse(error62 instanceof ArtiumError ? error62 : new ArtiumError("INTERNAL_ERROR"), randomUUID4()))).then(() => {
   try {
     managed?.flush();
   } catch {
     managed = void 0;
-    printError(errorResponse(new ArtiumError("SECRET_IN_OUTPUT"), randomUUID3()));
+    printError(errorResponse(new ArtiumError("SECRET_IN_OUTPUT"), randomUUID4()));
   }
 });