@knowttl/mg-axi 0.1.4 → 0.1.7

package/axi-credential.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "mg-axi credential profile",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["mode", "tenantId", "clientId"],
+  "properties": {
+    "mode": { "enum": ["delegated", "application"] },
+    "tenantId": { "$ref": "#/$defs/uuid" },
+    "clientId": { "$ref": "#/$defs/uuid" },
+    "cloud": { "const": "commercial", "default": "commercial" },
+    "enabledPacks": { "type": "array", "items": { "const": "entra" }, "uniqueItems": true, "default": ["entra"] },
+    "preview": { "type": "boolean", "default": false },
+    "sensitiveAreas": { "type": "array", "maxItems": 0, "default": [] },
+    "allowDeviceCode": { "type": "boolean", "default": false },
+    "auth": { "enum": ["certificate", "client-secret", "federated"] },
+    "thumbprintSha256": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$" },
+    "privateKey": { "$ref": "#/$defs/externalSecret", "x-secret": true },
+    "clientSecret": { "$ref": "#/$defs/externalSecret", "x-secret": true },
+    "token": { "$ref": "#/$defs/secret", "x-secret": true },
+    "writes": {
+      "type": "object", "additionalProperties": false, "required": ["allowWrites", "operations"],
+      "properties": {
+        "allowWrites": { "type": "boolean" },
+        "operations": { "type": "array", "minItems": 1, "maxItems": 64, "items": { "type": "string", "minLength": 1, "maxLength": 256 } }
+      }
+    }
+  },
+  "oneOf": [
+    {
+      "properties": { "mode": { "const": "delegated" } },
+      "not": { "anyOf": [{ "required": ["auth"] }, { "required": ["privateKey"] }, { "required": ["clientSecret"] }, { "required": ["thumbprintSha256"] }] }
+    },
+    {
+      "required": ["auth", "thumbprintSha256"],
+      "properties": { "mode": { "const": "application" }, "auth": { "const": "certificate" }, "allowDeviceCode": { "const": false } },
+      "not": { "anyOf": [{ "required": ["token"] }, { "required": ["clientSecret"] }] }
+    },
+    {
+      "required": ["auth"],
+      "properties": { "mode": { "const": "application" }, "auth": { "const": "client-secret" }, "allowDeviceCode": { "const": false } },
+      "not": { "anyOf": [{ "required": ["token"] }, { "required": ["privateKey"] }, { "required": ["thumbprintSha256"] }] }
+    },
+    {
+      "required": ["auth"],
+      "properties": { "mode": { "const": "application" }, "auth": { "const": "federated" }, "token": { "$ref": "#/$defs/externalSecret" }, "allowDeviceCode": { "const": false } },
+      "not": { "anyOf": [{ "required": ["privateKey"] }, { "required": ["clientSecret"] }, { "required": ["thumbprintSha256"] }] }
+    }
+  ],
+  "$defs": {
+    "uuid": { "type": "string", "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$" },
+    "externalSecret": {
+      "oneOf": [
+        { "type": "object", "additionalProperties": false, "required": ["env"], "properties": { "env": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" } } },
+        { "type": "object", "additionalProperties": false, "required": ["file"], "properties": { "file": { "type": "string", "pattern": "^(?:/|[A-Za-z]:[\\\\/])" } } }
+      ]
+    },
+    "secret": {
+      "oneOf": [
+        { "$ref": "#/$defs/externalSecret" },
+        { "type": "object", "additionalProperties": false, "required": ["stored"], "properties": { "stored": { "const": true } } }
+      ]
+    }
+  }
+}

package/dist/api.js

@@ -61,7 +61,7 @@ const AUTH_METHOD_FIELDS = ["id", "createdDateTime", "displayName", "phoneNumber
 const REGISTRATION_FIELDS = ["id", "userPrincipalName", "userDisplayName", "userType", "isAdmin", "isMfaRegistered", "isMfaCapable", "isPasswordlessCapable", "isSsprRegistered", "isSsprEnabled", "isSsprCapable", "userPreferredMethodForSecondaryAuthentication", "lastUpdatedDateTime"];
 const SIGNIN_FIELDS = ["id", "createdDateTime", "userId", "userPrincipalName", "userDisplayName", "appDisplayName", "appId", "ipAddress", "location", "status", "conditionalAccessStatus", "riskDetail", "riskLevelAggregated", "riskLevelDuringSignIn", "riskState", "resourceDisplayName", "resourceId", "clientAppUsed"];
 const AUDIT_FIELDS = ["id", "activityDateTime", "activityDisplayName", "category", "loggedByService", "operationType", "result", "resultReason", "correlationId", "initiatedBy", "targetResources"];
-const PROVISIONING_FIELDS = ["id", "activityDateTime", "tenantId", "jobId", "cycleId", "changeId", "action", "durationInMilliseconds", "sourceSystem", "sourceIdentity", "targetSystem", "targetIdentity", "provisioningStatusInfo", "provisioningSteps", "modifiedProperties", "servicePrincipal", "initiatedBy"];
+const PROVISIONING_FIELDS = ["id", "activityDateTime", "tenantId", "jobId", "cycleId", "changeId", "provisioningAction", "durationInMilliseconds", "sourceSystem", "sourceIdentity", "targetSystem", "targetIdentity", "provisioningStatusInfo", "provisioningSteps", "modifiedProperties", "servicePrincipal", "initiatedBy"];
 const RISKY_USER_FIELDS = ["id", "userPrincipalName", "userDisplayName", "riskDetail", "riskLastUpdatedDateTime", "riskLevel", "riskState"];
 const RISK_DETECTION_FIELDS = ["id", "detectedDateTime", "activityDateTime", "userId", "userPrincipalName", "userDisplayName", "ipAddress", "location", "riskDetail", "riskLevel", "riskState", "riskEventType", "detectionTimingType", "lastUpdatedDateTime", "source"];
 const RISKY_SP_FIELDS = ["id", "displayName", "appId", "servicePrincipalType", "riskDetail", "riskLastUpdatedDateTime", "riskLevel", "riskState", "isEnabled", "isProcessing"];
@@ -117,7 +117,7 @@ export const REVIEWED_ROUTES = [
         access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
         note: "Conditional Access needs P1.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/authenticationstrengthroot-list-policies?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_STRENGTH_FIELDS,
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}", kind: "single", query: [], fields: KNOWN_STRENGTH_FIELDS,
         access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
         note: "Conditional Access needs P1.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/authenticationstrengthpolicy-get?view=graph-rest-1.0"] },
@@ -145,7 +145,7 @@ export const REVIEWED_ROUTES = [
         access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (for example Security Reader) is also required.",
         note: "Conditional Access needs P1.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/conditionalaccesstemplate-get?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/identity/conditionalAccess/authenticationContextClassReferences", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_AUTH_CONTEXT_FIELDS,
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationContextClassReferences", kind: "collection", query: ["$filter", "$orderby", "$top"], fields: KNOWN_AUTH_CONTEXT_FIELDS,
         access: "D/A AuthenticationContext.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
         note: "Conditional Access needs P1.",
         sources: ["https://learn.microsoft.com/graph/api/conditionalaccessroot-list-authenticationcontextclassreferences?view=graph-rest-1.0"] },
@@ -187,7 +187,7 @@ export const REVIEWED_ROUTES = [
     { id: "v1.0:GET:/auditLogs/directoryAudits", kind: "collection", query: COLLECTION_QUERY, fields: AUDIT_FIELDS,
         access: "D/A AuditLog.Read.All. Delegated callers pass it as --scopes.",
         sources: ["https://learn.microsoft.com/graph/api/directoryaudit-list?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/auditLogs/provisioning", kind: "collection", query: COLLECTION_QUERY, fields: PROVISIONING_FIELDS,
+    { id: "v1.0:GET:/auditLogs/provisioning", kind: "collection", query: ["$filter", "$orderby", "$top"], fields: PROVISIONING_FIELDS,
         access: "D/A AuditLog.Read.All and Directory.Read.All. Delegated callers pass both as --scopes; Reports Reader is the least privileged directory role.",
         note: "Entra ID P1/P2 licence prerequisite; retention is 30 days on premium and 7 days on free.",
         sources: ["https://learn.microsoft.com/graph/api/provisioningobjectsummary-list?view=graph-rest-1.0"] },
@@ -313,14 +313,6 @@ export const REVIEWED_ROUTES = [
         access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
         note: "Administrative-unit scopes need P1.",
         sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-get?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/scopedRoleMemberships", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
-        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
-        note: "Administrative-unit-scoped admin assignments; directory-wide assignments live on roleAssignments. Administrative-unit scopes need P1.",
-        sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-list?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/scopedRoleMemberships/{scopedRoleMembership-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
-        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
-        note: "Administrative-unit scopes need P1.",
-        sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-get?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/assignmentSchedules", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ASSIGNMENT_SCHEDULE_FIELDS,
         access: "D/A PrivilegedAssignmentSchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
         note: "Assignment schedules govern group membership or ownership over time; PIM for Groups needs P2 or ID Governance; lists require $filter on groupId or principalId. AssignmentScheduleRequests stay out: their least privilege is the write scope PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup.",
@@ -415,10 +407,6 @@ export const REVIEWED_ROUTES = [
         access: "D/A Domain.Read.All. Delegated callers pass it as --scopes; Domain Name Administrator or Global Reader are the least-privileged delegated roles. No P1/P2 prerequisite is stated for DNS record reads.",
         note: "No operation-level documentation page; access follows the parent service-configuration contract and the domainDnsRecord resource reference.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/graph/api/resources/domaindnsrecord?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/domainDnsRecords", kind: "collection", query: COLLECTION_QUERY, fields: DNS_RECORD_FIELDS,
-        access: "D/A Domain.Read.All. Delegated callers pass it as --scopes; Domain Name Administrator or Global Reader are the least-privileged delegated roles. No P1/P2 prerequisite is stated for DNS record reads.",
-        note: "No operation-level documentation page; access follows the documented domain/DNS-read contract and the domainDnsRecord resource reference.",
-        sources: ["https://learn.microsoft.com/en-us/graph/api/domain-list?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/graph/api/resources/domaindnsrecord?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/domainDnsRecords/{domainDnsRecord-id}", kind: "single", query: SINGLE_QUERY, fields: DNS_RECORD_FIELDS,
         access: "D/A Domain.Read.All. Delegated callers pass it as --scopes; Domain Name Administrator or Global Reader are the least-privileged delegated roles. No P1/P2 prerequisite is stated for DNS record reads.",
         note: "No operation-level documentation page; access follows the documented domain/DNS-read contract and the domainDnsRecord resource reference.",
@@ -489,10 +477,6 @@ export const REVIEWED_ROUTES = [
         delegatedOnly: true,
         note: "No single-acceptance operation page; access follows the parent acceptance-list contract and the agreementAcceptance resource reference. Acceptance records are personal data: default rows carry id, agreementId, state and recordedDateTime only.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/agreement-list-acceptances?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/graph/api/resources/agreementacceptance?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/directoryObjects", kind: "collection", query: ["$select"], fields: KNOWN_DIRECTORY_OBJECT_FIELDS, defaultFields: ["id"], keepODataType: true,
-        access: "D/A Directory.Read.All. Delegated callers pass it as --scopes; no delegated role prerequisite is stated for directory-object reads. Personal Microsoft accounts are not supported.",
-        note: "No List operation page exists; access follows the sibling directoryobject-get contract and the directoryObject resource reference. Graph documents no collection filter contract here, so only $select is reviewed. Rows are polymorphic: the @odata.type discriminator rides along automatically and subtype properties need the subtype's named reads, never raw $select of unreviewed fields.",
-        sources: ["https://learn.microsoft.com/en-us/graph/api/directoryobject-get?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/graph/api/resources/directoryobject?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/directoryObjects/{directoryObject-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_DIRECTORY_OBJECT_FIELDS, defaultFields: ["id", "deletedDateTime"], keepODataType: true,
         access: "D/A Directory.Read.All. Delegated callers pass it as --scopes; no delegated role prerequisite is stated for this read. Personal Microsoft accounts are not supported.",
         note: "Single reads return the base-type properties plus the @odata.type discriminator; subtype detail needs the subtype's named reads. Only base properties are projected, so subtype secrets or credentials can never appear.",
@@ -605,7 +589,7 @@ export const REVIEWED_ROUTES = [
         access: "D/A OrgContact.Read.All and Group.Read.All together least-privileged (Directory.Read.All is the documented higher-privileged alternative). Delegated callers pass both as --scopes; delegated access additionally needs a supported Entra role (Directory Readers reads basic properties; Global Reader, Directory Writers, Intune Administrator or User Administrator also work). Personal Microsoft accounts are not supported.",
         note: "No operation-level documentation page; OData cast selects the administrativeUnit subtype and access follows the parent transitiveMemberOf contract and the administrativeUnit resource reference.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/orgcontact-list-transitivememberof?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/graph/api/resources/administrativeunit?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/groupLifecyclePolicies", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_LIFECYCLE_FIELDS,
+    { id: "v1.0:GET:/groupLifecyclePolicies", kind: "collection", query: ["$filter", "$orderby", "$top"], fields: KNOWN_LIFECYCLE_FIELDS,
         access: "D/A Directory.Read.All. Delegated callers pass it as --scopes; no delegated role prerequisite is stated for lifecycle-policy reads. Personal Microsoft accounts are not supported.",
         note: "Filtering uses plain $filter with no $count or ConsistencyLevel contract; no P1/P2 prerequisite is stated for lifecycle-policy reads.",
         sources: ["https://learn.microsoft.com/graph/api/grouplifecyclepolicy-list?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/grouplifecyclepolicy?view=graph-rest-1.0"] },

package/dist/app-auth.js

@@ -1,5 +1,7 @@
 import { AxiError } from "axi-sdk-js";
+import { PrivateFiles } from "./private-file.js";
 import { validateApplicationProfile } from "./profiles.js";
+import { registerSecret } from "./redact.js";
 // The configured Graph audience is the app's consented application grants, never a per-command subset.
 export const graphAudience = (profile) => `https://graph.microsoft.com/.default`;
 // This service is the application credential boundary for CORE-01; tokens never reach CLI output.
@@ -7,13 +9,15 @@ export const graphAudience = (profile) => `https://graph.microsoft.com/.default`
 export class ApplicationAuth {
     provider;
     now;
+    files;
     cache = new Map();
-    constructor(provider, now = Date.now) {
+    constructor(provider, now = Date.now, files = new PrivateFiles()) {
         this.provider = provider;
         this.now = now;
+        this.files = files;
     }
     async credential(profile, scopes = [graphAudience(profile)]) {
-        profile = validateApplicationProfile(profile);
+        profile = validateApplicationProfile(profile, this.files);
         const requested = this.audience(profile, scopes);
         const key = this.key(profile, requested);
         const hit = this.cache.get(key);
@@ -30,7 +34,7 @@ export class ApplicationAuth {
         catch (error) {
             // Provider AUTH_REQUIRED failures already name only the credential
             // reference, never its value; everything else stays fully generic.
-            if (error instanceof AxiError && error.code === "AUTH_REQUIRED")
+            if (error instanceof AxiError && ["AUTH_REQUIRED", "CONFIG_INVALID", "CONFIG_INSECURE"].includes(error.code))
                 throw error;
             throw this.failure();
         }
@@ -41,10 +45,11 @@ export class ApplicationAuth {
             throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", ["mg-axi profile show --profile <name>", "Application permissions apply to the app registration, not to individual commands"]);
         return configured;
     }
-    key(profile, scopes) { return JSON.stringify([profile.credentialRef, profile.tenantId, profile.clientId, profile.cloud, scopes]); }
+    key(profile, scopes) { return JSON.stringify([profile.auth, profile.auth === "certificate" ? [profile.privateKey, profile.thumbprintSha256] : profile.auth === "client-secret" ? profile.clientSecret : profile.token, profile.tenantId, profile.clientId, profile.cloud, scopes]); }
     check(profile, credential) {
         if (!credential.token || credential.tenantId.toLowerCase() !== profile.tenantId.toLowerCase() || credential.clientId.toLowerCase() !== profile.clientId.toLowerCase() || !Number.isFinite(credential.expiresAt) || credential.expiresAt <= this.now() + 60_000)
             throw new Error("Invalid credential context");
+        registerSecret(credential.token);
         return { ...credential };
     }
     failure() { return new AxiError("Application authentication failed for the configured identity; no user or device-code fallback was attempted", "AUTH_REQUIRED", ["mg-axi profile show --profile <name>", "Ask an administrator to grant application consent for the Graph .default audience on this app registration", "Confirm the certificate thumbprint or federated credential mapping on the app registration"]); }

package/dist/auth-status.js

@@ -0,0 +1,20 @@
+import { AxiError } from "axi-sdk-js";
+import { Credentials } from "./credentials.js";
+import { resolveSecret, secretSource } from "./secrets.js";
+export function authStatus(name, profile, credentials = new Credentials()) {
+    const fields = profile.mode === "delegated" ? { token: profile.token }
+        : profile.auth === "certificate" ? { privateKey: profile.privateKey }
+            : profile.auth === "client-secret" ? { clientSecret: profile.clientSecret } : { token: profile.token };
+    const sources = Object.entries(fields).map(([field, ref]) => {
+        let available = false;
+        try {
+            available = "stored" in ref && profile.mode === "delegated" ? credentials.read(profile, true) !== undefined : !!resolveSecret(ref, credentials.files, true);
+        }
+        catch (error) {
+            if (!(error instanceof AxiError) || error.code !== "AUTH_REQUIRED")
+                throw error;
+        }
+        return { field, source: "stored" in ref ? `stored:${credentials.path}` : secretSource(ref), available };
+    });
+    return { profile: name, mode: profile.mode, endpoint: "https://graph.microsoft.com", tenantId: profile.tenantId, clientId: profile.clientId, sources };
+}

package/dist/auth.js

@@ -1,18 +1,22 @@
 import { AxiError } from "axi-sdk-js";
-import { validateDelegatedProfile } from "./profiles.js";
+import { PrivateFiles } from "./private-file.js";
+import { profileName, validateDelegatedProfile } from "./profiles.js";
+import { registerSecret } from "./redact.js";
 // This service is the credential boundary for CORE-01; tokens never reach CLI output.
 export class DelegatedAuth {
     provider;
     now;
+    files;
     cache = new Map();
-    constructor(provider, now = Date.now) {
+    constructor(provider, now = Date.now, files = new PrivateFiles()) {
         this.provider = provider;
         this.now = now;
+        this.files = files;
     }
     async login(profile, method = "browser", scopes = []) {
-        profile = validateDelegatedProfile(profile);
+        profile = validateDelegatedProfile(profile, this.files);
         if (method !== "browser" && method !== "device-code")
-            throw new AxiError("Login method must be browser or device-code", "VALIDATION_ERROR", ["mg-axi login --help"]);
+            throw new AxiError("Login method must be browser or device-code", "VALIDATION_ERROR", ["mg-axi auth login --help"]);
         if (method === "device-code" && !profile.allowDeviceCode)
             throw new AxiError("Device code is disabled for this profile", "VALIDATION_ERROR", ["Enable device code only when organization policy permits it; browser login is the default"]);
         const requested = this.scopes(scopes);
@@ -23,12 +27,14 @@ export class DelegatedAuth {
             this.cache.set(key, credential);
             return { status: "authenticated", mode: "delegated", storage: this.provider.storage };
         }
-        catch {
+        catch (error) {
+            if (error instanceof AxiError && ["CONFIG_INVALID", "CONFIG_INSECURE"].includes(error.code))
+                throw error;
             throw this.failure("LOGIN_FAILED");
         }
     }
     async credential(profile, scopes) {
-        profile = validateDelegatedProfile(profile);
+        profile = validateDelegatedProfile(profile, this.files);
         const requested = this.scopes(scopes);
         const key = this.key(profile, requested);
         const hit = this.cache.get(key);
@@ -40,20 +46,28 @@ export class DelegatedAuth {
             this.cache.set(key, credential);
             return { ...credential };
         }
-        catch {
+        catch (error) {
+            if (error instanceof AxiError && ["CONFIG_INVALID", "CONFIG_INSECURE"].includes(error.code))
+                throw error;
             throw this.failure("AUTH_REQUIRED");
         }
     }
+    async logout(profile) {
+        this.cache.clear();
+        await this.provider.logout(validateDelegatedProfile(profile, this.files));
+        return { status: "signed out", revocation: "MSAL provides no token revocation API; local credentials deleted" };
+    }
     scopes(scopes) {
         if (!scopes.length || scopes.some(scope => !/^https:\/\/graph\.microsoft\.com\/[A-Za-z][A-Za-z.-]+$/.test(scope) || scope.endsWith("/.default")))
-            throw new AxiError("Explicit delegated Graph scopes are required", "VALIDATION_ERROR", ["mg-axi login --profile <name> --scopes <comma-separated-Graph-scopes>"]);
+            throw new AxiError("Explicit delegated Graph scopes are required", "VALIDATION_ERROR", ["mg-axi auth login --profile <name> --scopes <comma-separated-Graph-scopes>"]);
         return [...new Set(scopes)].sort();
     }
-    key(profile, scopes) { return JSON.stringify([profile.credentialRef, profile.tenantId, profile.clientId, profile.cloud, scopes]); }
+    key(profile, scopes) { return JSON.stringify([profileName(profile), profile.token, profile.tenantId, profile.clientId, profile.cloud, scopes]); }
     check(profile, credential) {
         if (!credential.token || !credential.accountId || credential.tenantId.toLowerCase() !== profile.tenantId.toLowerCase() || credential.clientId.toLowerCase() !== profile.clientId.toLowerCase() || !Number.isFinite(credential.expiresAt) || credential.expiresAt <= this.now() + 60_000)
             throw new Error("Invalid credential context");
+        registerSecret(credential.token);
         return { ...credential };
     }
-    failure(code) { return new AxiError("Authentication unavailable for the configured identity; no interactive fallback was attempted", code, ["mg-axi login --profile <name> --scopes <comma-separated-Graph-scopes>", "Check dedicated app consent and organization sign-in policy", "Restore OS credential store access before retrying login; prior stored accounts must be invalidated before replacement"]); }
+    failure(code) { return new AxiError("Authentication unavailable for the configured identity; no interactive fallback was attempted", code, ["mg-axi auth login --profile <name> --scopes <comma-separated-Graph-scopes>", "Check dedicated app consent and organization sign-in policy", "Restore access to the protected credentials.json before retrying login"]); }
 }

package/dist/catalogue.js

@@ -506,23 +506,23 @@ export const LEAVES = [
             cloud: { value: "commercial", required: true, description: "Explicit cloud; only commercial is supported" },
             mode: { value: "delegated|application", default: "delegated", description: "Delegated analyst sign-in or application client credentials" },
             "allow-device-code": { description: "Delegated only: opt in only when permitted by organization policy; never enables fallback" },
-            "certificate-thumbprint": { value: "40-hex-digits", description: "Application only: certificate thumbprint; the private key stays in referenced storage" },
-            "certificate-key-file": { value: "path", description: "Application only: certificate PEM private key from this 0600 file; omit both key flags for the OS keychain" },
-            "certificate-key-env": { value: "env-var-name", description: "Application only: certificate PEM private key from this environment variable; omit both key flags for the OS keychain" },
+            "certificate-thumbprint-sha256": { value: "64-hex-digits", description: "Application only: SHA-256 certificate thumbprint" },
+            "certificate-key-file": { value: "absolute-path", description: "Application only: certificate PEM private key from this protected file" },
+            "certificate-key-env": { value: "env-var-name", description: "Application only: certificate PEM private key from this environment variable; defaults to MG_AXI_PRIVATE_KEY" },
             "client-secret-env": { value: "env-var-name", description: "Application only: client secret from this environment variable; exactly one of this or --client-secret-file" },
-            "client-secret-file": { value: "path", description: "Application only: client secret from this 0600 file; exactly one of this or --client-secret-env" },
-            federated: { description: "Application only: workload federation via the assertion file named by --federated-token-file-env" },
-            "federated-token-file-env": { value: "env-var-name", description: "Application only: environment variable naming the workload assertion file; defaults to AZURE_FEDERATED_TOKEN_FILE" },
-        }, examples: ["mg-axi profile create --name soc --tenant <tenant-id> --client <client-id> --cloud commercial", "mg-axi profile create --name batch --tenant <tenant-id> --client <client-id> --cloud commercial --mode application --federated", "mg-axi profile create --name daemon --tenant <tenant-id> --client <client-id> --cloud commercial --mode application --certificate-thumbprint <40-hex-digit-thumbprint> --certificate-key-file /run/secrets/mg-axi-key.pem", "mg-axi profile create --name svc --tenant <tenant-id> --client <client-id> --cloud commercial --mode application --client-secret-env MG_AXI_CLIENT_SECRET", "mg-axi profile create --help"] },
+            "client-secret-file": { value: "absolute-path", description: "Application only: client secret from this protected file; exactly one of this or --client-secret-env" },
+            federated: { description: "Application only: workload federation; token defaults to env MG_AXI_TOKEN; AZURE_FEDERATED_TOKEN_FILE stays accepted as a deprecated alias" },
+            "federated-token-file": { value: "absolute-path", description: "Application only: workload assertion content from this protected file" },
+        }, examples: ["mg-axi profile create --name soc --tenant <tenant-id> --client <client-id> --cloud commercial", "mg-axi profile create --name batch --tenant <tenant-id> --client <client-id> --cloud commercial --mode application --federated", "mg-axi profile create --name daemon --tenant <tenant-id> --client <client-id> --cloud commercial --mode application --certificate-thumbprint-sha256 <64-hex-digit-thumbprint> --certificate-key-file /run/secrets/mg-axi-key.pem", "mg-axi profile create --name svc --tenant <tenant-id> --client <client-id> --cloud commercial --mode application --client-secret-env MG_AXI_CLIENT_SECRET", "mg-axi profile create --help"] },
     { path: "profile list", description: "List configured profiles without accessing credentials", flags: {}, examples: ["mg-axi profile list", "mg-axi profile list --help"] },
     { path: "profile show", description: "Show profile policy and credential reference, never credentials", flags: {
             profile: common.profile,
         }, examples: ["mg-axi profile show --profile soc", "mg-axi profile show"] },
-    { path: "login", description: "Explicit delegated login; browser by default, no automatic device-code fallback", flags: {
+    { path: "auth login", description: "Explicit delegated login; browser by default, no automatic device-code fallback", flags: {
             profile: common.profile,
             method: { value: "browser|device-code", default: "browser", description: "Device code additionally requires profile opt-in" },
             scopes: { value: "comma-separated-Graph-scopes", required: true, description: "Explicit delegated permissions using full https://graph.microsoft.com/ scope names" },
-        }, examples: ["mg-axi login --profile soc --scopes https://graph.microsoft.com/User.Read", "mg-axi login --profile soc --method device-code --scopes https://graph.microsoft.com/User.Read"] },
+        }, examples: ["mg-axi auth login --profile soc --scopes https://graph.microsoft.com/User.Read", "mg-axi auth login --profile soc --method device-code --scopes https://graph.microsoft.com/User.Read"] },
     { path: "setup", description: "Show installation, configuration and capability guidance without signing in or writing anything", flags: {}, examples: ["mg-axi setup", "mg-axi setup --help"] },
     { path: "setup hooks", description: "Install or repair agent SessionStart hooks for mg-axi ambient context", flags: {}, examples: ["mg-axi setup hooks", "mg-axi setup hooks --help"] },
     { path: "doctor", description: "Check each selected profile with one bounded user-list read; never signs in interactively, installs nothing, enables no writes", flags: {
@@ -677,7 +677,7 @@ export const LEAVES = [
             cursor: roleRead.cursor,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
         }, examples: ["mg-axi entra directory-role member list --role <role-id> --profile soc", "mg-axi entra directory-role member list --role <role-id> --profile soc --filter \"displayName eq 'Adele Vance'\""] },
-    { path: "entra directory-role scoped-member list", description: "List the scoped members of one activated directory role (id, principalId, roleId, directoryScopeId); administrative-unit scopes need P1", operation: "GET:/directoryRoles/{directoryRole-id}/scopedMembers", flags: {
+    { path: "entra directory-role scoped-member list", description: "List the scoped members of one activated directory role (id, roleMemberInfo, roleId, administrativeUnitId); administrative-unit scopes need P1", operation: "GET:/directoryRoles/{directoryRole-id}/scopedMembers", flags: {
             ...common, role: { value: "role-id", required: true, description: "Activated directory-role object ID whose scoped members are listed" },
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
@@ -687,7 +687,7 @@ export const LEAVES = [
             full: roleRead.full,
             cursor: roleRead.cursor,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
-        }, examples: ["mg-axi entra directory-role scoped-member list --role <role-id> --profile soc", "mg-axi entra directory-role scoped-member list --role <role-id> --profile soc --filter \"principalId eq '<principal-id>'\""] },
+        }, examples: ["mg-axi entra directory-role scoped-member list --role <role-id> --profile soc", "mg-axi entra directory-role scoped-member list --role <role-id> --profile soc --filter \"administrativeUnitId eq '<unit-id>'\""] },
     { path: "entra directory-role scoped-member show", description: "Show one scoped member of an activated directory role with richer default properties", operation: "GET:/directoryRoles/{directoryRole-id}/scopedMembers/{scopedRoleMembership-id}", flags: {
             ...common, role: { value: "role-id", required: true, description: "Activated directory-role object ID owning the scoped member" },
             id: { value: "scoped-membership-id", required: true, description: "Scoped membership object ID" },
@@ -696,7 +696,7 @@ export const LEAVES = [
             full: roleRead.full,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
         }, examples: ["mg-axi entra directory-role scoped-member show --role <role-id> --id <scoped-membership-id> --profile soc", "mg-axi entra directory-role scoped-member show --role <role-id> --id <scoped-membership-id> --profile soc --full"] },
-    { path: "entra scoped-role-membership list", description: "List administrative-unit-scoped role memberships (id, principalId, roleId, directoryScopeId); directory-wide assignments live on roleAssignments", operation: "GET:/scopedRoleMemberships", flags: {
+    { path: "entra scoped-role-membership list", description: "Unsupported by Graph v1.0; use directory-role scoped-member list --role <role-id>", operation: "GET:/scopedRoleMemberships", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
@@ -707,7 +707,7 @@ export const LEAVES = [
             cursor: roleRead.cursor,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
         }, examples: ["mg-axi entra scoped-role-membership list --profile soc", "mg-axi entra scoped-role-membership list --profile soc --filter \"roleId eq '<role-id>'\""] },
-    { path: "entra scoped-role-membership show", description: "Show one administrative-unit-scoped role membership with richer default properties", operation: "GET:/scopedRoleMemberships/{scopedRoleMembership-id}", flags: {
+    { path: "entra scoped-role-membership show", description: "Unsupported by Graph v1.0; use directory-role scoped-member show --role <role-id> --id <scoped-membership-id>", operation: "GET:/scopedRoleMemberships/{scopedRoleMembership-id}", flags: {
             ...common, id: { value: "scoped-membership-id", required: true, description: "Scoped membership object ID" },
             select: roleRead.select,
             fields: roleRead.fields,
@@ -981,7 +981,7 @@ export const LEAVES = [
             full: dnsRead.full,
             scopes: dnsRead.scopes,
         }, examples: ["mg-axi entra domain service-configuration-record show --domain contoso.com --id <record-id> --profile soc"] },
-    { path: "entra domain-dns-record list", description: "List domain DNS records from the top-level record set; rows carry @odata.type naming the derived record kind", operation: "GET:/domainDnsRecords", flags: {
+    { path: "entra domain-dns-record list", description: "Unsupported by Graph v1.0; use domain verification-dns-record list or domain service-configuration-record list with --domain <domain-id>", operation: "GET:/domainDnsRecords", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
@@ -1145,7 +1145,7 @@ export const LEAVES = [
             full: acceptanceRead.full,
             scopes: acceptanceRead.scopes,
         }, examples: ["mg-axi entra agreement-acceptance show --id <acceptance-id> --profile soc"] },
-    { path: "entra directory-object list", description: "List directory objects with compact rows (id plus the @odata.type subtype discriminator); Graph documents no List operation page, so no --filter", operation: "GET:/directoryObjects", flags: {
+    { path: "entra directory-object list", description: "Unsupported by Graph v1.0; use directory-object show --id <object-id> or a named user, group, device, application or service-principal list", operation: "GET:/directoryObjects", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
@@ -1254,7 +1254,7 @@ export const LEAVES = [
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
             filter: lifecycleRead.filter,
-            select: lifecycleRead.select,
+            select: { value: "comma-separated-properties", description: "Select output properties locally; no $select is sent to Graph" },
             fields: lifecycleRead.fields,
             full: lifecycleRead.full,
             cursor: lifecycleRead.cursor,
@@ -1599,7 +1599,7 @@ export const LEAVES = [
             since: { ...logRead.since, description: "Required for a new query (resume with --cursor instead): earliest activityDateTime bounding the server time range" },
             until: logRead.until,
             filter: logRead.filter,
-            select: { value: "comma-separated-properties", description: "Request server properties from the supported provisioning-log property set" },
+            select: { value: "comma-separated-properties", description: "Select output properties locally from the provisioning-log set, including provisioningAction; no $select is sent to Graph" },
             fields: logRead.fields,
             full: logRead.full,
             cursor: logRead.cursor,
@@ -1921,7 +1921,7 @@ export const LEAVES = [
         }, examples: ["mg-axi entra conditional-access auth-strength-policy list --profile soc", "mg-axi entra conditional-access auth-strength-policy list --profile soc --limit 10", "mg-axi entra conditional-access auth-strength-policy list --profile soc --filter \"policyType eq 'builtIn'\" --select id,displayName,policyType"] },
     { path: "entra conditional-access auth-strength-policy show", description: "Show one authentication-strength policy with the full reviewed property set", operation: "GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}", flags: {
             ...common, id: { value: "auth-strength-policy-id", required: true, description: "Authentication-strength policy object ID" },
-            select: caStrengthRead.select,
+            select: { value: "comma-separated-properties", description: "Select output properties locally; no $select is sent to Graph" },
             fields: caStrengthRead.fields,
             full: caStrengthRead.full,
             scopes: caStrengthRead.scopes,
@@ -1987,7 +1987,7 @@ export const LEAVES = [
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
             filter: caAuthContextRead.filter,
-            select: caAuthContextRead.select,
+            select: { value: "comma-separated-properties", description: "Select output properties locally; no $select is sent to Graph" },
             fields: caAuthContextRead.fields,
             full: caAuthContextRead.full,
             cursor: caAuthContextRead.cursor,
@@ -2790,6 +2790,12 @@ export const LEAVES = [
             full: { description: "Disable 500-character string truncation; never disables redaction or row caps" },
         }, examples: ["mg-axi api get /users --scopes https://graph.microsoft.com/User.Read.All", "mg-axi api get /groups --odata '$filter=securityEnabled eq true&$top=5' --scopes https://graph.microsoft.com/GroupMember.Read.All", "mg-axi api get /users --cursor - --all --scopes https://graph.microsoft.com/User.Read.All < cursor.txt"] },
 ];
+LEAVES.push({ ...LEAVES.find(leaf => leaf.path === "auth login"), path: "login", description: "Deprecated alias for auth login (one minor release)" });
+LEAVES.push({ path: "config path", description: "Show the selected configuration path without reading credentials", flags: {}, examples: ["mg-axi config path", "mg-axi config path --config /absolute/path/config.json"] });
+LEAVES.push({ path: "auth status", description: "Show credential sources and verify local file permissions without a live request", flags: { profile: common.profile }, examples: ["mg-axi auth status", "mg-axi auth status --profile soc"] });
+LEAVES.push({ path: "auth logout", description: "Delete the selected delegated login cache without prompting", flags: { profile: common.profile }, examples: ["mg-axi auth logout", "mg-axi auth logout --profile soc"] });
+for (const leaf of LEAVES)
+    leaf.flags.config = { value: "path", description: "Configuration file override; takes precedence over MG_AXI_CONFIG" };
 export function leafHelp(leaf) {
     return [
         `mg-axi ${leaf.path}${leaf.positional ? ` <${leaf.positional.name}>` : ""}`, leaf.description,
@@ -2828,7 +2834,7 @@ export function resolveCommand(argv) {
     const flags = Object.create(null);
     for (let i = flagStart; i < argv.length; i++) {
         const arg = argv[i];
-        const match = /^--([a-z-]+)(?:=(.*))?$/.exec(arg);
+        const match = /^--([a-z][a-z0-9-]*)(?:=(.*))?$/.exec(arg);
         if (!match)
             fail("unexpected argument or short flag");
         const name = match[1];