@knowttl/mg-axi 0.1.2 → 0.1.4

package/inventory/operations.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/inventory/operations.json
-size: 75858703 bytes
-sha256: 8a83f2035abe014feb57473cb716c8c69ddeebf9205bf7fd547f2fbc3033e378
+size: 76161389 bytes
+sha256: 8168ba7deefe03b569ac77a440ea027380710f7ea2f5a031795ff373ce9199a9

package/inventory/schema.json

@@ -59,7 +59,7 @@
         "roles": {"$ref": "#/$defs/evidence"},
         "licences": {"$ref": "#/$defs/evidence"},
         "cloudAvailability": {"$ref": "#/$defs/evidence"},
-        "disposition": {"enum": ["named-command", "reviewed-raw-read", "scheduled", "intentionally-blocked", "deprecated", "unavailable", "excluded"]},
+        "disposition": {"enum": ["named-command", "reviewed-raw-read", "scheduled", "deferred", "intentionally-blocked", "deprecated", "unavailable", "excluded"]},
         "reason": {"$ref": "#/$defs/text"},
         "owningSlice": {"enum": [null, "READ-01", "READ-02", "READ-03", "READ-04", "READ-05", "READ-06", "READ-07", "READ-08", "READ-09", "READ-10", "EXT-01", "EXT-02", "EXT-02c", "EXT-03", "EXT-04", "WRITE-01", "WRITE-02", "WRITE-03", "WRITE-04", "WRITE-05", "WRITE-N"]}
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/mg-axi",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Agent-facing Microsoft Graph CLI, read-only by default",
   "type": "module",
   "bin": {

package/skills/mg-axi/SKILL.md

@@ -53,6 +53,13 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra group member add` | native | write |
 | `mg-axi entra directory-role list` | native | read |
 | `mg-axi entra directory-role show` | native | read |
+| `mg-axi entra directory-role-template list` | native | read |
+| `mg-axi entra directory-role-template show` | native | read |
+| `mg-axi entra directory-role member list` | native | read |
+| `mg-axi entra directory-role scoped-member list` | native | read |
+| `mg-axi entra directory-role scoped-member show` | native | read |
+| `mg-axi entra scoped-role-membership list` | native | read |
+| `mg-axi entra scoped-role-membership show` | native | read |
 | `mg-axi entra role-assignment list` | native | read |
 | `mg-axi entra pim eligible list` | native | read |
 | `mg-axi entra pim active list` | native | read |
@@ -159,6 +166,8 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra sign-in show` | native | read |
 | `mg-axi entra directory-audit list` | native | read |
 | `mg-axi entra directory-audit show` | native | read |
+| `mg-axi entra provisioning list` | native | read |
+| `mg-axi entra provisioning show` | native | read |
 | `mg-axi entra application list` | native | read |
 | `mg-axi entra application show` | native | read |
 | `mg-axi entra service-principal list` | native | read |
@@ -167,6 +176,13 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra service-principal owner list` | native | read |
 | `mg-axi entra service-principal oauth2-grant list` | native | read |
 | `mg-axi entra service-principal app-role-assignment list` | native | read |
+| `mg-axi entra service-principal app-role-assignment show` | native | read |
+| `mg-axi entra service-principal app-role-assigned-to list` | native | read |
+| `mg-axi entra service-principal app-role-assigned-to show` | native | read |
+| `mg-axi entra application federated-credential list` | native | read |
+| `mg-axi entra application federated-credential show` | native | read |
+| `mg-axi entra service-principal federated-credential list` | native | read |
+| `mg-axi entra service-principal federated-credential show` | native | read |
 | `mg-axi entra risky-user list` | native | read |
 | `mg-axi entra risky-user show` | native | read |
 | `mg-axi entra risky-user dismiss` | native | write |
@@ -183,6 +199,20 @@ See `docs/coverage.md` for the per-operation disposition records.
 | `mg-axi entra conditional-access policy update` | native | write |
 | `mg-axi entra conditional-access named-location list` | native | read |
 | `mg-axi entra conditional-access named-location show` | native | read |
+| `mg-axi entra conditional-access auth-strength-policy list` | native | read |
+| `mg-axi entra conditional-access auth-strength-policy show` | native | read |
+| `mg-axi entra conditional-access combination-configuration list` | native | read |
+| `mg-axi entra conditional-access combination-configuration show` | native | read |
+| `mg-axi entra conditional-access auth-method-mode list` | native | read |
+| `mg-axi entra conditional-access auth-method-mode show` | native | read |
+| `mg-axi entra conditional-access template list` | native | read |
+| `mg-axi entra conditional-access template show` | native | read |
+| `mg-axi entra conditional-access auth-context list` | native | read |
+| `mg-axi entra conditional-access auth-context show` | native | read |
+| `mg-axi entra conditional-access deleted-policy list` | native | read |
+| `mg-axi entra conditional-access deleted-policy show` | native | read |
+| `mg-axi entra conditional-access deleted-named-location list` | native | read |
+| `mg-axi entra conditional-access deleted-named-location show` | native | read |
 | `mg-axi entra identity-provider list` | native | read |
 | `mg-axi entra identity-provider show` | native | read |
 | `mg-axi entra identity-provider count` | native | read |
@@ -316,6 +346,9 @@ npx -y @knowttl/mg-axi entra user list --profile soc --limit 10
 
 Configuration defaults to `~/.mg-axi/config.json`; `MG_AXI_CONFIG` selects a separate file.
 `mg-axi setup` shows the selected path and writes nothing.
+Application profiles authenticate headlessly through credential references: the profile names an env var or file and the environment supplies the value at acquisition time.
+Container examples for client secrets, certificate keys and workload federation live in [README.md](../../README.md#mg-axi).
+A client secret is weaker than a certificate or federated credential and needs scheduled rotation.
 
 Agent discovery has two install paths, and either suffices alone.
 For ambient context at every agent session start instead of the skill, install the CLI globally and opt into the session hook:
@@ -344,5 +377,5 @@ Reads run through a session that authorizes only catalogued operations before si
 Writes preview before sending and need `--execute` plus a typed `--confirm` repeating the target; an already-desired value is a no-op with exit 0, never an error.
 Output is TOON on stdout; diagnostics use stderr.
 Text truncates at 500 characters (`--full` restores text, never redaction); row caps resume through opaque cursors.
-Secrets stay in protected storage references, never in argv, config files or output; credential fields carry expiry metadata only.
+Secrets stay in credential references, never in argv, config files or output; credential fields carry expiry metadata only.
 Tests run offline with fixture credentials; never point tests at a real tenant.