@knowttl/mg-axi 0.1.1 → 0.1.2

package/dist/setup.js

@@ -53,10 +53,15 @@ const READ_FAMILY_PREFIXES = [
     ["entra service-principal", "application/service-principal and consent grants"],
     ["entra risky-user", "risk"],
     ["entra risk-detection", "risk"],
+    ["entra risky-service-principal", "risk"],
+    ["entra service-principal-risk-detection", "risk"],
     ["entra conditional-access", "Conditional Access"],
     ["entra identity-provider", "identity-provider"],
     ["entra federation-configuration", "federation configurations"],
     ["entra data-policy-operation", "data policy operations"],
+    ["entra fraud-protection-provider", "risk prevention"],
+    ["entra web-application-firewall-provider", "risk prevention"],
+    ["entra web-application-firewall-verification", "risk prevention"],
     ["entra access-review", "access-review"],
     ["entra entitlement catalog", "entitlement catalogs and access packages"],
     ["entra entitlement access-package", "entitlement catalogs and access packages"],

package/docs/coverage.md

@@ -10,9 +10,9 @@ list below is the implemented truth and never counts scheduled work as complete.
 
 ## Counts
 
-- implemented read leaves: 192 (190 named Entra reads plus reviewed raw api get and doctor health check)
+- implemented read leaves: 233 (231 named Entra reads plus reviewed raw api get and doctor health check)
 - implemented write leaves: 5 (named gated mutations below)
-- local leaves: 6 (home, profile, login and setup views)
+- local leaves: 7 (home, profile, login and setup views)
 - inventory named-command: 0
 - inventory reviewed-raw-read: 0
 - inventory scheduled: 8440
@@ -38,6 +38,16 @@ list below is the implemented truth and never counts scheduled work as complete.
 | `mg-axi entra role-assignment list` | `GET:/roleManagement/directory/roleAssignments` | scheduled | READ-09 |
 | `mg-axi entra pim eligible list` | `GET:/roleManagement/directory/roleEligibilityScheduleInstances` | scheduled | READ-09 |
 | `mg-axi entra pim active list` | `GET:/roleManagement/directory/roleAssignmentScheduleInstances` | scheduled | READ-09 |
+| `mg-axi entra pim group-assignment-schedule list` | `GET:/identityGovernance/privilegedAccess/group/assignmentSchedules` | scheduled | EXT-02 |
+| `mg-axi entra pim group-assignment-schedule show` | `GET:/identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id}` | scheduled | EXT-02 |
+| `mg-axi entra pim group-assignment-instance list` | `GET:/identityGovernance/privilegedAccess/group/assignmentScheduleInstances` | scheduled | EXT-02 |
+| `mg-axi entra pim group-assignment-instance show` | `GET:/identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id}` | scheduled | EXT-02 |
+| `mg-axi entra pim group-eligibility-schedule list` | `GET:/identityGovernance/privilegedAccess/group/eligibilitySchedules` | scheduled | EXT-02 |
+| `mg-axi entra pim group-eligibility-schedule show` | `GET:/identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id}` | scheduled | EXT-02 |
+| `mg-axi entra pim group-eligibility-instance list` | `GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances` | scheduled | EXT-02 |
+| `mg-axi entra pim group-eligibility-instance show` | `GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id}` | scheduled | EXT-02 |
+| `mg-axi entra pim group-eligibility-request list` | `GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleRequests` | scheduled | EXT-02 |
+| `mg-axi entra pim group-eligibility-request show` | `GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id}` | scheduled | EXT-02 |
 | `mg-axi entra device list` | `GET:/devices` | scheduled | READ-10 |
 | `mg-axi entra device show` | `GET:/devices/{device-id}` | scheduled | READ-10 |
 | `mg-axi entra administrative-unit list` | `GET:/directory/administrativeUnits` | scheduled | READ-10 |
@@ -116,6 +126,12 @@ list below is the implemented truth and never counts scheduled work as complete.
 | `mg-axi entra delegated-admin-relationship show-request` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/requests/{delegatedAdminRelationshipRequest-id}` | scheduled | EXT-04 |
 | `mg-axi entra delegated-admin-customer list-service-management-details` | `GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails` | scheduled | EXT-04 |
 | `mg-axi entra delegated-admin-customer show-service-management-detail` | `GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails/{delegatedAdminServiceManagementDetail-id}` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-customer count` | `GET:/tenantRelationships/delegatedAdminCustomers/$count` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-customer count-service-management-details` | `GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails/$count` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship count` | `GET:/tenantRelationships/delegatedAdminRelationships/$count` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship count-access-assignments` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/accessAssignments/$count` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship count-operations` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/operations/$count` | scheduled | EXT-04 |
+| `mg-axi entra delegated-admin-relationship count-requests` | `GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/requests/$count` | scheduled | EXT-04 |
 | `mg-axi entra multi-tenant-organization show` | `GET:/tenantRelationships/multiTenantOrganization` | scheduled | EXT-04 |
 | `mg-axi entra multi-tenant-organization join-request show` | `GET:/tenantRelationships/multiTenantOrganization/joinRequest` | scheduled | EXT-04 |
 | `mg-axi entra multi-tenant-organization tenant list` | `GET:/tenantRelationships/multiTenantOrganization/tenants` | scheduled | EXT-04 |
@@ -137,6 +153,12 @@ list below is the implemented truth and never counts scheduled work as complete.
 | `mg-axi entra risky-user show` | `GET:/identityProtection/riskyUsers/{riskyUser-id}` | scheduled | READ-06 |
 | `mg-axi entra risk-detection list` | `GET:/identityProtection/riskDetections` | scheduled | READ-06 |
 | `mg-axi entra risk-detection show` | `GET:/identityProtection/riskDetections/{riskDetection-id}` | scheduled | READ-06 |
+| `mg-axi entra risky-service-principal list` | `GET:/identityProtection/riskyServicePrincipals` | scheduled | READ-06 |
+| `mg-axi entra risky-service-principal show` | `GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}` | scheduled | READ-06 |
+| `mg-axi entra risky-service-principal history list` | `GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}/history` | scheduled | READ-06 |
+| `mg-axi entra risky-service-principal history show` | `GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}/history/{riskyServicePrincipalHistoryItem-id}` | scheduled | READ-06 |
+| `mg-axi entra service-principal-risk-detection list` | `GET:/identityProtection/servicePrincipalRiskDetections` | scheduled | READ-06 |
+| `mg-axi entra service-principal-risk-detection show` | `GET:/identityProtection/servicePrincipalRiskDetections/{servicePrincipalRiskDetection-id}` | scheduled | READ-06 |
 | `mg-axi entra conditional-access policy list` | `GET:/identity/conditionalAccess/policies` | scheduled | READ-03 |
 | `mg-axi entra conditional-access policy show` | `GET:/identity/conditionalAccess/policies/{conditionalAccessPolicy-id}` | scheduled | READ-03 |
 | `mg-axi entra conditional-access named-location list` | `GET:/identity/conditionalAccess/namedLocations` | scheduled | READ-03 |
@@ -163,6 +185,16 @@ list below is the implemented truth and never counts scheduled work as complete.
 | `mg-axi entra data-policy-operation list` | `GET:/dataPolicyOperations` | scheduled | EXT-03 |
 | `mg-axi entra data-policy-operation show` | `GET:/dataPolicyOperations/{dataPolicyOperation-id}` | scheduled | EXT-03 |
 | `mg-axi entra data-policy-operation count` | `GET:/dataPolicyOperations/$count` | scheduled | EXT-03 |
+| `mg-axi entra fraud-protection-provider list` | `GET:/identity/riskPrevention/fraudProtectionProviders` | scheduled | EXT-03 |
+| `mg-axi entra fraud-protection-provider show` | `GET:/identity/riskPrevention/fraudProtectionProviders/{fraudProtectionProvider-id}` | scheduled | EXT-03 |
+| `mg-axi entra fraud-protection-provider count` | `GET:/identity/riskPrevention/fraudProtectionProviders/$count` | scheduled | EXT-03 |
+| `mg-axi entra web-application-firewall-provider list` | `GET:/identity/riskPrevention/webApplicationFirewallProviders` | scheduled | EXT-03 |
+| `mg-axi entra web-application-firewall-provider show` | `GET:/identity/riskPrevention/webApplicationFirewallProviders/{webApplicationFirewallProvider-id}` | scheduled | EXT-03 |
+| `mg-axi entra web-application-firewall-provider count` | `GET:/identity/riskPrevention/webApplicationFirewallProviders/$count` | scheduled | EXT-03 |
+| `mg-axi entra web-application-firewall-verification list` | `GET:/identity/riskPrevention/webApplicationFirewallVerifications` | scheduled | EXT-03 |
+| `mg-axi entra web-application-firewall-verification show` | `GET:/identity/riskPrevention/webApplicationFirewallVerifications/{webApplicationFirewallVerificationModel-id}` | scheduled | EXT-03 |
+| `mg-axi entra web-application-firewall-verification count` | `GET:/identity/riskPrevention/webApplicationFirewallVerifications/$count` | scheduled | EXT-03 |
+| `mg-axi entra web-application-firewall-verification provider show` | `GET:/identity/riskPrevention/webApplicationFirewallVerifications/{webApplicationFirewallVerificationModel-id}/provider` | scheduled | EXT-03 |
 | `mg-axi entra access-review definition list` | `GET:/identityGovernance/accessReviews/definitions` | scheduled | EXT-02 |
 | `mg-axi entra access-review definition show` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}` | scheduled | EXT-02 |
 | `mg-axi entra access-review instance list` | `GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances` | scheduled | EXT-02 |
@@ -215,6 +247,15 @@ list below is the implemented truth and never counts scheduled work as complete.
 | `mg-axi entra lifecycle task-report count` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/$count` | scheduled | EXT-02 |
 | `mg-axi entra lifecycle task-report task show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/{taskReport-id}/task` | scheduled | EXT-02 |
 | `mg-axi entra lifecycle task-report task-definition show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/{taskReport-id}/taskDefinition` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run user-processing-result list` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run user-processing-result show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults/{userProcessingResult-id}` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run user-processing-result count` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults/$count` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run subject-processing-result list` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run subject-processing-result show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults/{subjectProcessingResult-id}` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run subject-processing-result count` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults/$count` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run task-processing-result list` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run task-processing-result show` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults/{taskProcessingResult-id}` | scheduled | EXT-02 |
+| `mg-axi entra lifecycle run task-processing-result count` | `GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults/$count` | scheduled | EXT-02 |
 | `mg-axi api get` | reviewed raw reads (see src/api.ts) | reviewed-raw-read catalogue | API-01 |
 | `mg-axi doctor` | bounded `GET:/users` health check | uses the named user-list read | PACK-01 |
 
@@ -305,6 +346,28 @@ Workforce context only; no external-customer support is claimed.
 | `beta:GET:/dataPolicyOperations/$count` | scheduled (deferred) | EXT-03 | Deferred by firstmate data-policy-operations scope to a later EXT-03 data-policy-operations beta subfamily: the three approved reads cover v1.0 only; beta data-policy operations need separate review. |
 | `beta:GET:/dataPolicyOperations/{dataPolicyOperation-id}` | scheduled (deferred) | EXT-03 | Deferred by firstmate data-policy-operations scope to a later EXT-03 data-policy-operations beta subfamily: the three approved reads cover v1.0 only; beta data-policy operations need separate review. |
 
+## EXT-03 risk-prevention scope decisions
+
+This change covers the ten v1.0 workforce risk-prevention reads above (fraud-protection-provider list, show and count; web-application-firewall-provider list, show and count; web-application-firewall-verification list, show, count and provider show).
+The eleven beta operations below remain scheduled with an explicit deferred disposition to a later EXT-03 subfamily; no new commands or raw access are approved.
+Risk-prevention reads support v1.0 only; beta needs its own review.
+API keys, client secrets and other key material (Arkose privateKey/publicKey, HUMAN serverToken, Akamai clientSecret/clientToken/accessToken, Cloudflare apiToken) are never selectable and never projected; application profiles are refused before credentials because Graph documents no supported application permission.
+Workforce context only; no external-customer support is claimed.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `beta:GET:/identity/riskPrevention` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+| `beta:GET:/identity/riskPrevention/fraudProtectionProviders` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+| `beta:GET:/identity/riskPrevention/fraudProtectionProviders/$count` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+| `beta:GET:/identity/riskPrevention/fraudProtectionProviders/{fraudProtectionProvider-id}` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+| `beta:GET:/identity/riskPrevention/webApplicationFirewallProviders` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+| `beta:GET:/identity/riskPrevention/webApplicationFirewallProviders/$count` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+| `beta:GET:/identity/riskPrevention/webApplicationFirewallProviders/{webApplicationFirewallProvider-id}` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+| `beta:GET:/identity/riskPrevention/webApplicationFirewallVerifications` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+| `beta:GET:/identity/riskPrevention/webApplicationFirewallVerifications/$count` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+| `beta:GET:/identity/riskPrevention/webApplicationFirewallVerifications/{webApplicationFirewallVerificationModel-id}` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+| `beta:GET:/identity/riskPrevention/webApplicationFirewallVerifications/{webApplicationFirewallVerificationModel-id}/provider` | scheduled (deferred) | EXT-03 | Deferred by firstmate risk-prevention scope to a later EXT-03 risk-prevention beta subfamily: the ten approved reads cover v1.0 only; beta risk prevention needs separate review. |
+
 ## EXT-03 invitations scope decisions
 
 Firstmate decision (mg-ext-03b inbox 001): do not implement these reads and add no scope.
@@ -707,19 +770,13 @@ Beta contracts need their own review; delta-token sync needs its own change-trac
 
 ## EXT-04 delegated-admin scope decisions
 
-Firstmate scope: approve narrowing this change to the twelve v1.0 delegated-admin reads above (customer list/show, relationship list/show, access-assignment list/show, operation list/show, request list/show and service-management-detail list/show).
+Firstmate scope: approve narrowing this change to the eighteen v1.0 delegated-admin reads above (customer list/show/count, relationship list/show/count, access-assignment list/show/count, operation list/show/count, request list/show/count and service-management-detail list/show/count).
 The operations below remain scheduled with an explicit deferred disposition to a later EXT-04 subfamily; no new commands or raw access are approved.
-Scalar counts need a separate query and response contract from the approved list/show reads; the tenantRelationship container root needs its own projection review; multi-tenant-organization reads shipped in the section below, and tenant-lookup functions ship as tenant-information show under the mg-ext-04e function-argument contract.
+The tenantRelationship container root needs its own projection review; multi-tenant-organization reads shipped in the section below, and tenant-lookup functions ship as tenant-information show under the mg-ext-04e function-argument contract.
 
 | Inventory operation | Disposition | Owning slice | Deferral reason |
 |---|---|---|---|
 | `v1.0:GET:/tenantRelationships` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin root subfamily: the tenantRelationship container singleton needs its own projection review beyond the approved customer and relationship list/show reads. |
-| `v1.0:GET:/tenantRelationships/delegatedAdminCustomers/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
-| `v1.0:GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
-| `v1.0:GET:/tenantRelationships/delegatedAdminRelationships/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
-| `v1.0:GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/accessAssignments/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
-| `v1.0:GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/operations/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
-| `v1.0:GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/requests/$count` | scheduled (deferred) | EXT-04 | Deferred by firstmate delegated-admin scope to a later EXT-04 delegated-admin counts subfamily: scalar counts need a separate query and response contract from the approved list/show reads. |
 
 ## EXT-04 multi-tenant-organization scope decisions
 
@@ -730,6 +787,15 @@ The single-member read below remains scheduled with an explicit deferred disposi
 |---|---|---|---|
 | `v1.0:GET:/tenantRelationships/multiTenantOrganization/tenants/{multiTenantOrganizationMember-id}` | scheduled (deferred) | EXT-04 | Deferred by firstmate multi-tenant-organization scope to a later EXT-04 multi-tenant-organization subfamily: documented least privilege is the write scope MultiTenantOrganization.ReadWrite.All in both delegated and application modes, so no named command or raw access is approved for the single-member read. |
 
+## EXT-04 reports scope decisions
+
+Firstmate scope: approve deferring the v1.0 relying-party summary read below; no named command or raw access is approved for it.
+The relying-party summary read below remains scheduled with an explicit deferred disposition: its period function argument needs a new session-guard function-argument binding beyond the three allowlisted tenant-lookup/commerce routes, and the request-path guard must stay byte-identical to origin/main apart from READ_SCOPES additions, so no named command or raw access is approved for it until its own guard review lands.
+
+| Inventory operation | Disposition | Owning slice | Deferral reason |
+|---|---|---|---|
+| `v1.0:GET:/reports/getRelyingPartyDetailedSummary(period='{period}')` | scheduled (deferred) | EXT-04 | Deferred by firstmate reports scope to a later EXT-04 reports subfamily: the period function argument needs a new session-guard function-argument binding beyond the three allowlisted tenant-lookup/commerce routes, and the request-path guard must stay byte-identical to origin/main apart from READ_SCOPES additions, so no named command or raw access is approved for the relying-party summary read. |
+
 ## EXT-04 tenant-lookup scope decisions
 
 Firstmate scope: approve the mg-ext-04e function-argument contract with the three v1.0 reads it unblocks (tenant-information show by domain name or tenant ID, subscription show by commerce subscription ID).
@@ -1006,9 +1072,9 @@ Approval and subject reads carry personal data and stay scheduled for later part
 
 ## EXT-02 lifecycle-workflows scope decisions
 
-This change covers the twenty-four v1.0 lifecycle-workflows first-, second- and third-part reads above (workflow, workflow-template and task-definition list/show/count reads, the tenant settings show, top-level run and user/subject processing-result list/show/count reads, plus task-report list/show/count reads with the task and taskDefinition singles).
-Run-nested and third-level processing results, taskProcessingResults sub-reads, reprocessed runs, subject sub-reads, workflow tasks, template tasks, versions, insights, deleted items and custom task extensions stay scheduled for follow-up parts with no new commands or raw access approved; so do the six top-level summary functions, which stay deferred because they need bracketed start/end arguments outside the session-guard function-binding allowlist while the request-path guard cannot change beyond READ_SCOPES additions. Every beta operation and every mutation (no workflow create/update/delete/activate/run, no settings update, no restore) stays out.
-No new commands or raw access are approved for any lifecycle-workflows row outside the twenty-four above.
+This change covers the thirty-three v1.0 lifecycle-workflows first-, second-, third- and fourth-part reads above (workflow, workflow-template and task-definition list/show/count reads, the tenant settings show, top-level run and user/subject processing-result list/show/count reads, task-report list/show/count reads with the task and taskDefinition singles, plus run-nested user/subject/task processing-result list/show/count reads).
+Third-level processing results, taskProcessingResults sub-reads under a user or subject result, reprocessed runs, subject sub-reads, workflow tasks, template tasks, versions, insights, deleted items and custom task extensions stay scheduled for follow-up parts with no new commands or raw access approved; so do the six summary functions (the run user/subject summaries plus the four top-level ones), which stay deferred because they need bracketed start/end arguments outside the session-guard function-binding allowlist while the request-path guard cannot change beyond READ_SCOPES additions. Every beta operation and every mutation (no workflow create/update/delete/activate/run, no settings update, no restore) stays out.
+No new commands or raw access are approved for any lifecycle-workflows row outside the thirty-three above.
 
 ## Named writes
 

package/inventory/operations.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/inventory/operations.json
-size: 75857800 bytes
-sha256: bf8b0cdd323b9f6fbdd2803f7964e15545bbcc4b779e8e8d6cc6068b11324d95
+size: 75858703 bytes
+sha256: 8a83f2035abe014feb57473cb716c8c69ddeebf9205bf7fd547f2fbc3033e378

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@knowttl/mg-axi",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Agent-facing Microsoft Graph CLI, read-only by default",
   "type": "module",
   "bin": {
-    "mg-axi": "dist/bin/mg-axi.js"
+    "mg-axi": "dist/bin/mg-axi.js",
+    "mg-axi-hook": "dist/bin/mg-axi-hook.js"
   },
   "publishConfig": {
     "access": "public"
@@ -27,7 +28,7 @@
   "packageManager": "pnpm@10.34.6",
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "test": "node --test test/*.test.mjs",
+    "test": "node --test --test-concurrency=4 test/*.test.mjs",
     "lint": "tsc --noEmit -p tsconfig.json",
     "docs:generate": "node tools/generate-docs.mjs",
     "docs:check": "node tools/generate-docs.mjs --check"

package/skills/mg-axi/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: mg-axi
 description: >
-  Inspect Microsoft Entra users, authentication methods, groups, roles, devices, administrative units, organization and branding, domains and DNS records, certificate authentication, commercial subscriptions, on-premises synchronization, terms-of-use agreements and acceptances, directory objects, organizational contacts, group lifecycle policies, group setting templates, attribute sets and custom security attributes, partner contracts, delegated administration, multi-tenant organization, tenant information, sign-ins and audit logs, applications and consent grants, risk, Conditional Access, identity providers, federation configurations, deleted directory items, data policy operations, access reviews, entitlement catalogs and access packages, entitlement assignments and requests, lifecycle workflows, templates, task definitions, settings, runs, processing results and task reports, reviewed raw reads and run 5 gated writes (account enable/disable, session revocation, group-membership add, risky-user dismissal, CA policy update) through token-efficient TOON output.
+  Inspect Microsoft Entra users, authentication methods, groups, roles, devices, administrative units, organization and branding, domains and DNS records, certificate authentication, commercial subscriptions, on-premises synchronization, terms-of-use agreements and acceptances, directory objects, organizational contacts, group lifecycle policies, group setting templates, attribute sets and custom security attributes, partner contracts, delegated administration, multi-tenant organization, tenant information, sign-ins and audit logs, applications and consent grants, risk, Conditional Access, identity providers, federation configurations, deleted directory items, data policy operations, risk prevention, access reviews, entitlement catalogs and access packages, entitlement assignments and requests, lifecycle workflows, templates, task definitions, settings, runs, processing results and task reports, reviewed raw reads and run 5 gated writes (account enable/disable, session revocation, group-membership add, risky-user dismissal, CA policy update) through token-efficient TOON output.
 user-invocable: false
 ---
 
@@ -38,6 +38,7 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi profile show` | native | local |
 | `mg-axi login` | native | local |
 | `mg-axi setup` | native | local |
+| `mg-axi setup hooks` | native | local |
 | `mg-axi doctor` | native | read |
 | `mg-axi entra user list` | native | read |
 | `mg-axi entra user show` | native | read |
@@ -55,6 +56,16 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra role-assignment list` | native | read |
 | `mg-axi entra pim eligible list` | native | read |
 | `mg-axi entra pim active list` | native | read |
+| `mg-axi entra pim group-assignment-schedule list` | native | read |
+| `mg-axi entra pim group-assignment-schedule show` | native | read |
+| `mg-axi entra pim group-assignment-instance list` | native | read |
+| `mg-axi entra pim group-assignment-instance show` | native | read |
+| `mg-axi entra pim group-eligibility-schedule list` | native | read |
+| `mg-axi entra pim group-eligibility-schedule show` | native | read |
+| `mg-axi entra pim group-eligibility-instance list` | native | read |
+| `mg-axi entra pim group-eligibility-instance show` | native | read |
+| `mg-axi entra pim group-eligibility-request list` | native | read |
+| `mg-axi entra pim group-eligibility-request show` | native | read |
 | `mg-axi entra device list` | native | read |
 | `mg-axi entra device show` | native | read |
 | `mg-axi entra administrative-unit list` | native | read |
@@ -133,6 +144,12 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra delegated-admin-relationship show-request` | native | read |
 | `mg-axi entra delegated-admin-customer list-service-management-details` | native | read |
 | `mg-axi entra delegated-admin-customer show-service-management-detail` | native | read |
+| `mg-axi entra delegated-admin-customer count` | native | read |
+| `mg-axi entra delegated-admin-customer count-service-management-details` | native | read |
+| `mg-axi entra delegated-admin-relationship count` | native | read |
+| `mg-axi entra delegated-admin-relationship count-access-assignments` | native | read |
+| `mg-axi entra delegated-admin-relationship count-operations` | native | read |
+| `mg-axi entra delegated-admin-relationship count-requests` | native | read |
 | `mg-axi entra multi-tenant-organization show` | native | read |
 | `mg-axi entra multi-tenant-organization join-request show` | native | read |
 | `mg-axi entra multi-tenant-organization tenant list` | native | read |
@@ -155,6 +172,12 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra risky-user dismiss` | native | write |
 | `mg-axi entra risk-detection list` | native | read |
 | `mg-axi entra risk-detection show` | native | read |
+| `mg-axi entra risky-service-principal list` | native | read |
+| `mg-axi entra risky-service-principal show` | native | read |
+| `mg-axi entra risky-service-principal history list` | native | read |
+| `mg-axi entra risky-service-principal history show` | native | read |
+| `mg-axi entra service-principal-risk-detection list` | native | read |
+| `mg-axi entra service-principal-risk-detection show` | native | read |
 | `mg-axi entra conditional-access policy list` | native | read |
 | `mg-axi entra conditional-access policy show` | native | read |
 | `mg-axi entra conditional-access policy update` | native | write |
@@ -182,6 +205,16 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra data-policy-operation list` | native | read |
 | `mg-axi entra data-policy-operation show` | native | read |
 | `mg-axi entra data-policy-operation count` | native | read |
+| `mg-axi entra fraud-protection-provider list` | native | read |
+| `mg-axi entra fraud-protection-provider show` | native | read |
+| `mg-axi entra fraud-protection-provider count` | native | read |
+| `mg-axi entra web-application-firewall-provider list` | native | read |
+| `mg-axi entra web-application-firewall-provider show` | native | read |
+| `mg-axi entra web-application-firewall-provider count` | native | read |
+| `mg-axi entra web-application-firewall-verification list` | native | read |
+| `mg-axi entra web-application-firewall-verification show` | native | read |
+| `mg-axi entra web-application-firewall-verification count` | native | read |
+| `mg-axi entra web-application-firewall-verification provider show` | native | read |
 | `mg-axi entra access-review definition list` | native | read |
 | `mg-axi entra access-review definition show` | native | read |
 | `mg-axi entra access-review instance list` | native | read |
@@ -234,6 +267,15 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra lifecycle task-report count` | native | read |
 | `mg-axi entra lifecycle task-report task show` | native | read |
 | `mg-axi entra lifecycle task-report task-definition show` | native | read |
+| `mg-axi entra lifecycle run user-processing-result list` | native | read |
+| `mg-axi entra lifecycle run user-processing-result show` | native | read |
+| `mg-axi entra lifecycle run user-processing-result count` | native | read |
+| `mg-axi entra lifecycle run subject-processing-result list` | native | read |
+| `mg-axi entra lifecycle run subject-processing-result show` | native | read |
+| `mg-axi entra lifecycle run subject-processing-result count` | native | read |
+| `mg-axi entra lifecycle run task-processing-result list` | native | read |
+| `mg-axi entra lifecycle run task-processing-result show` | native | read |
+| `mg-axi entra lifecycle run task-processing-result count` | native | read |
 | `mg-axi api get` | native | read |
 <!-- command-registry:end -->
 
@@ -275,6 +317,19 @@ npx -y @knowttl/mg-axi entra user list --profile soc --limit 10
 Configuration defaults to `~/.mg-axi/config.json`; `MG_AXI_CONFIG` selects a separate file.
 `mg-axi setup` shows the selected path and writes nothing.
 
+Agent discovery has two install paths, and either suffices alone.
+For ambient context at every agent session start instead of the skill, install the CLI globally and opt into the session hook:
+
+```sh
+npm install --global @knowttl/mg-axi
+mg-axi setup hooks
+```
+
+This installs a `SessionStart` hook for Claude Code, Codex and OpenCode that prints a short local-only summary (configured profile names with tenant labels, auth-cache presence, write posture and version).
+The hook makes no network, Graph or sign-in call, and prints a short `not configured` record with exit 0 when unconfigured.
+Restart the agent session after running the installer.
+No other ordinary command installs hooks, plugins or configuration.
+
 ## Selecting a profile
 
 Read leaves accept `--profile <name>`.