@knowttl/mg-axi 0.1.4 → 0.1.7

package/dist/cli.js

@@ -1,10 +1,13 @@
 import { encode } from "@toon-format/toon";
-import { existsSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, relative, isAbsolute, sep } from "node:path";
 import { AxiError, installSessionStartHooks, runAxiCli } from "axi-sdk-js";
 import { LEAVES, home, leafHelp, operationFor, resolveCommand, DESCRIPTION, TOP_LEVEL_HELP } from "./catalogue.js";
 import { VERSION } from "./version.js";
 import { Profiles } from "./profiles.js";
+import { authStatus } from "./auth-status.js";
+import { redactSecrets } from "./redact.js";
 import { GraphSession, MAX_CURSOR_BYTES } from "./graph-session.js";
 import { listUsers, showUser } from "./entra-users.js";
 import { updateUserAccount } from "./entra-user-update.js";
@@ -48,22 +51,21 @@ import { addGroupMember } from "./entra-group-member-add.js";
 import { fetchTransport } from "./api.js";
 import { doctorTargets, runDoctor } from "./doctor.js";
 import { setupView } from "./setup.js";
-function localHome(name) {
+function localHome(name, config) {
     const output = home();
-    const store = new Profiles();
-    if (name || store.list().length) {
-        try {
-            const selected = store.resolve(name);
-            output.profile = selected.name;
-            output.tenant = selected.profile.tenantId;
-        }
-        catch (error) {
-            if (name || !(error instanceof AxiError) || error.code !== "AUTH_REQUIRED")
-                throw error;
+    const store = new Profiles(config);
+    try {
+        const selected = store.resolve(name);
+        output.profile = selected.name;
+        output.tenant = selected.profile.tenantId;
+    }
+    catch (error) {
+        if ((name?.trim() ? name : undefined) || !(error instanceof AxiError) || !["PROFILE_REQUIRED", "PROFILE_AMBIGUOUS"].includes(error.code))
+            throw error;
+        if (error.code === "PROFILE_AMBIGUOUS")
             output.profile = "unavailable: no default profile selected";
-        }
     }
-    output.help.unshift("npx -y @knowttl/mg-axi profile list", "npx -y @knowttl/mg-axi login --help");
+    output.help.unshift("npx -y @knowttl/mg-axi profile list", "npx -y @knowttl/mg-axi auth login --help");
     return output;
 }
 // One dispatch for the hook installer: resolve the sibling hook entry point
@@ -73,17 +75,34 @@ function localHome(name) {
 // summary from src/hook.ts. Install failures throw loudly; hook failures
 // never do.
 function runSetupHooks() {
-    const hookPath = join(dirname(process.argv[1] ?? ""), "mg-axi-hook.js");
+    const hookPath = join(dirname(realpathSync(process.argv[1] ?? "")), "mg-axi-hook.js");
     if (!existsSync(hookPath)) {
         throw new AxiError("Cannot locate the mg-axi-hook entry point", "HOOK_INSTALL_FAILED", [
             "Reinstall @knowttl/mg-axi so dist/bin/mg-axi-hook.js sits next to the main entry point",
             "Run mg-axi setup hooks again after reinstalling",
         ]);
     }
+    const target = realpathSync(hookPath);
+    const temporaryRoots = [tmpdir(), "/tmp", "/var/tmp"].map(path => existsSync(path) ? realpathSync(path) : path);
+    const inTemporaryDirectory = temporaryRoots.some(root => {
+        const path = relative(root, target);
+        return path === "" || (path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path));
+    });
+    let inWorktree = false;
+    for (let directory = dirname(target); directory !== dirname(directory); directory = dirname(directory)) {
+        const gitPath = join(directory, ".git");
+        if (existsSync(gitPath) && statSync(gitPath).isFile())
+            inWorktree = true;
+    }
+    if (inTemporaryDirectory || inWorktree || /(?:^|[/\\])(?:\.no-mistakes|\.treehouse|worktrees)(?:[/\\]|$)/.test(target)) {
+        throw new AxiError("Cannot install hooks from a temporary directory or worktree", "HOOK_INSTALL_FAILED", [
+            "Install @knowttl/mg-axi globally, then run mg-axi setup hooks from that installation",
+        ]);
+    }
     const failures = [];
     installSessionStartHooks({
         marker: "mg-axi-hook",
-        execPath: hookPath,
+        execPath: target,
         binaryNames: ["mg-axi-hook"],
         distEntrypoints: ["dist/bin/mg-axi-hook.js"],
         onError: (message) => { failures.push(message); },
@@ -115,23 +134,30 @@ export async function executeArgv(argv, overrides = {}) {
     if (flags.help)
         return leafHelp(leaf);
     if (leaf.path === "home")
-        return localHome(flags.profile);
-    const profiles = new Profiles();
+        return localHome(flags.profile, flags.config);
+    const profiles = new Profiles(flags.config);
+    if (leaf.path === "config path")
+        return { config: profiles.path };
     if (leaf.path === "profile create") {
-        const credentialFlags = ["certificate-thumbprint", "client-secret-env", "client-secret-file", "certificate-key-file", "certificate-key-env", "federated-token-file-env"];
+        const credentialFlags = ["certificate-thumbprint-sha256", "client-secret-env", "client-secret-file", "certificate-key-file", "certificate-key-env", "federated-token-file"];
         if (String(flags.mode ?? "delegated") !== "application" && (flags.federated || credentialFlags.some(name => flags[name] !== undefined)))
             throw new AxiError("Certificate, client-secret and federated credentials belong to application profiles; pass --mode application", "VALIDATION_ERROR", [leafHelp(leaf)]);
         const optional = (name) => flags[name] === undefined ? undefined : String(flags[name]);
         return profiles.create(String(flags.name), String(flags.tenant), String(flags.client), String(flags.cloud), !!flags["allow-device-code"], String(flags.mode ?? "delegated") === "application"
-            ? { certificateThumbprint: optional("certificate-thumbprint"), federated: !!flags.federated, clientSecretEnv: optional("client-secret-env"), clientSecretFile: optional("client-secret-file"), certificateKeyFile: optional("certificate-key-file"), certificateKeyEnv: optional("certificate-key-env"), federatedTokenFileEnv: optional("federated-token-file-env") }
+            ? { certificateThumbprint: optional("certificate-thumbprint-sha256"), federated: !!flags.federated, clientSecretEnv: optional("client-secret-env"), clientSecretFile: optional("client-secret-file"), certificateKeyFile: optional("certificate-key-file"), certificateKeyEnv: optional("certificate-key-env"), federatedTokenFile: optional("federated-token-file") }
             : undefined);
     }
     if (leaf.path === "profile list") {
         const items = profiles.list();
-        return items.length ? { profiles: items, help: ["npx -y @knowttl/mg-axi profile show --profile <name>", "npx -y @knowttl/mg-axi login --help"] } : { profiles: "0 profiles configured", help: ["npx -y @knowttl/mg-axi profile create --help"] };
+        return items.length ? { profiles: items, help: ["npx -y @knowttl/mg-axi profile show --profile <name>", "npx -y @knowttl/mg-axi auth login --help"] } : { profiles: "0 profiles configured", help: ["npx -y @knowttl/mg-axi profile create --help"] };
     }
     if (leaf.path === "profile show")
         return profiles.resolve(flags.profile);
+    if (leaf.path === "auth status") {
+        const selected = profiles.resolve(flags.profile);
+        profiles.verifyPermissions();
+        return authStatus(selected.name, selected.profile);
+    }
     if (leaf.path === "setup")
         return setupView(profiles);
     if (leaf.path === "setup hooks")
@@ -153,18 +179,20 @@ export async function executeArgv(argv, overrides = {}) {
         const session = new GraphSession({ delegated, application, transport: overrides.transport ?? fetchTransport });
         // A failing profile still reports its bounded read on stdout; the
         // nonzero exit travels through process state, never the payload.
-        const result = await runDoctor({ store: profiles, names, session });
+        const selected = names.length === 1 ? profiles.resolve(flags.profile) : undefined;
+        const result = await runDoctor({ store: profiles, names, session, selected });
         if (result.failed)
             process.exitCode = 1;
         return result.output;
     }
-    if (leaf.path === "login") {
+    if (leaf.path === "login" || leaf.path === "auth login" || leaf.path === "auth logout") {
         const selected = profiles.resolve(flags.profile);
         if (selected.profile.mode !== "delegated")
             throw new AxiError("Application profiles authenticate with client credentials; interactive login is unavailable", "VALIDATION_ERROR", ["mg-axi profile show --profile <name>", "Application tokens are acquired silently with the configured Graph .default audience"]);
         const { DelegatedAuth } = await import("./auth.js");
         const { MsalProvider } = await import("./msal-provider.js");
-        return { profile: selected.name, ...await new DelegatedAuth(new MsalProvider()).login(selected.profile, String(flags.method ?? "browser"), String(flags.scopes).split(",")) };
+        const service = overrides.delegated ?? new DelegatedAuth(new MsalProvider());
+        return { profile: selected.name, ...await (leaf.path === "auth logout" ? service.logout(selected.profile) : service.login(selected.profile, String(flags.method ?? "browser"), String(flags.scopes).split(","))) };
     }
     if (leaf.path === "entra conditional-access policy list" || leaf.path === "entra conditional-access policy show" || leaf.path === "entra conditional-access named-location list" || leaf.path === "entra conditional-access named-location show" || leaf.path === "entra conditional-access auth-strength-policy list" || leaf.path === "entra conditional-access auth-strength-policy show" || leaf.path === "entra conditional-access combination-configuration list" || leaf.path === "entra conditional-access combination-configuration show" || leaf.path === "entra conditional-access auth-method-mode list" || leaf.path === "entra conditional-access auth-method-mode show" || leaf.path === "entra conditional-access template list" || leaf.path === "entra conditional-access template show" || leaf.path === "entra conditional-access auth-context list" || leaf.path === "entra conditional-access auth-context show" || leaf.path === "entra conditional-access deleted-policy list" || leaf.path === "entra conditional-access deleted-policy show" || leaf.path === "entra conditional-access deleted-named-location list" || leaf.path === "entra conditional-access deleted-named-location show") {
         const selected = profiles.resolve(flags.profile);
@@ -1432,12 +1460,15 @@ export async function executeArgv(argv, overrides = {}) {
     throw new AxiError(`Command is not executable: ${operation?.disposition ?? "unavailable"} (${operation?.owningSlice ?? "no inventory mapping"})`, "NOT_IMPLEMENTED", [leafHelp(leaf)]);
 }
 export async function main() {
+    const stderrWrite = process.stderr.write.bind(process.stderr);
+    process.stderr.write = ((chunk, ...args) => stderrWrite(redactSecrets(typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8")), ...args));
     await runAxiCli({
         description: DESCRIPTION,
         version: VERSION,
         topLevelHelp: TOP_LEVEL_HELP,
         // Strict resolution owns leaf help, so SDK help cannot bypass validation.
         argv: ["dispatch"],
+        stdout: { write: (value) => process.stdout.write(redactSecrets(value)) },
         home: () => localHome(),
         commands: {
             dispatch: async () => {
@@ -1447,7 +1478,7 @@ export async function main() {
             },
         },
         formatError: error => ({
-            output: `${encode(error instanceof AxiError ? { error: error.message, code: error.code, help: error.suggestions } : { error: "Unable to run mg-axi", help: ["mg-axi --help"] })}\n`,
+            output: `${redactSecrets(encode(error instanceof AxiError ? { error: error.message, code: error.code, help: error.suggestions } : { error: "Unable to run mg-axi", help: ["mg-axi --help"] }))}\n`,
             exitCode: error instanceof AxiError && error.code === "VALIDATION_ERROR" ? 2 : 1,
         }),
     });

package/dist/credentials.js

@@ -0,0 +1,78 @@
+import { rmSync } from "node:fs";
+import { AxiError } from "axi-sdk-js";
+import { statePath } from "./paths.js";
+import { PrivateFiles } from "./private-file.js";
+import { profileName } from "./profiles.js";
+import { registerCache } from "./redact.js";
+const object = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+// The only persistent credential backend. Access tokens never leave memory.
+export class Credentials {
+    path;
+    files;
+    constructor(path = statePath("credentials.json"), files = new PrivateFiles()) {
+        this.path = path;
+        this.files = files;
+    }
+    load(verifyAcl = false) {
+        let text;
+        try {
+            text = this.files.read(this.path, true, verifyAcl);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return { version: 1, profiles: Object.create(null) };
+            throw error;
+        }
+        try {
+            const value = JSON.parse(text);
+            if (!object(value) || value.version !== 1 || !object(value.profiles) || Object.keys(value).some(key => !["version", "profiles"].includes(key)))
+                throw new Error("Invalid store");
+            for (const [name, entry] of Object.entries(value.profiles)) {
+                if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name) || !object(entry) || typeof entry.tenantId !== "string" || typeof entry.clientId !== "string" || typeof entry.cache !== "string" ||
+                    Object.keys(entry).some(key => !["tenantId", "clientId", "cache"].includes(key)) || !object(JSON.parse(entry.cache)))
+                    throw new Error("Invalid cache");
+            }
+            return value;
+        }
+        catch (error) {
+            if (error instanceof AxiError)
+                throw error;
+            throw new AxiError(`Invalid credential store ${this.path}`, "CONFIG_INVALID", ["Restore a valid protected credentials.json before signing in again"]);
+        }
+    }
+    name(profile) {
+        const name = profileName(profile);
+        if (!name)
+            throw new AxiError("Stored credentials require a named profile", "CONFIG_INVALID");
+        return name;
+    }
+    read(profile, verifyAcl = false) {
+        const records = this.load(verifyAcl).profiles;
+        const name = this.name(profile);
+        const entry = Object.hasOwn(records, name) ? records[name] : undefined;
+        if (!entry)
+            return undefined;
+        if (entry.tenantId.toLowerCase() !== profile.tenantId.toLowerCase() || entry.clientId.toLowerCase() !== profile.clientId.toLowerCase())
+            throw new AxiError("Stored credential binding does not match the selected tenant and client", "AUTH_REQUIRED", ["mg-axi auth login --profile <name> --scopes <comma-separated-Graph-scopes>"]);
+        return registerCache(entry.cache);
+    }
+    write(profile, serialized) {
+        registerCache(serialized);
+        const cache = JSON.parse(serialized);
+        delete cache.AccessToken;
+        const store = this.load();
+        Object.defineProperty(store.profiles, this.name(profile), { value: { tenantId: profile.tenantId, clientId: profile.clientId, cache: JSON.stringify(cache) }, enumerable: true, configurable: true, writable: true });
+        this.files.write(this.path, `${JSON.stringify(store, null, 2)}\n`);
+    }
+    remove(profile) {
+        const store = this.load();
+        const name = this.name(profile);
+        if (!Object.hasOwn(store.profiles, name))
+            return;
+        delete store.profiles[name];
+        if (Object.keys(store.profiles).length)
+            this.files.write(this.path, `${JSON.stringify(store, null, 2)}\n`);
+        else
+            rmSync(this.path);
+    }
+}

package/dist/docs.js

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import { DESCRIPTION, HOME_HELP, LEAVES } from "./catalogue.js";
+const UNSUPPORTED_READ_NOTE = "Graph v1.0 does not support the legacy `entra scoped-role-membership list/show`, `entra domain-dns-record list` or `entra directory-object list` routes; those commands fail locally with supported alternatives and their root routes are not available through `api get`.";
 // PACK-01: single source for generated release records. The committed
 // skills/mg-axi/SKILL.md and docs/coverage.md are generated from the templates
 // below, the executable catalogue and the discovery inventory, so help, skill
@@ -138,7 +139,7 @@ export function skillDescription() {
 // profile/login hints localHome() in cli.ts prepends to HOME_HELP; the
 // rest is HOME_HELP verbatim, so skill and home view cannot drift apart.
 export function skillHomeHints() {
-    return ["npx -y @knowttl/mg-axi profile list", "npx -y @knowttl/mg-axi login --help", ...HOME_HELP];
+    return ["npx -y @knowttl/mg-axi profile list", "npx -y @knowttl/mg-axi auth login --help", ...HOME_HELP];
 }
 // The full installable skill. Durable guidance only: read-only by default,
 // writes need preview plus typed confirmation, no secrets in output, the
@@ -165,15 +166,16 @@ export function skillDocument() {
         "Run commands non-interactively as `npx -y @knowttl/mg-axi ...`: no global install needed and no interactive prompts.",
         "Version pinning is the installer's choice: use `npx -y @knowttl/mg-axi@<version> ...` to select a specific release.",
         "Run `npx -y @knowttl/mg-axi doctor` first.",
-        "See [README.md](../../README.md#release) for doctor profile selection, checks and failure behavior.",
+        "See [README.md](../../README.md#usage) for doctor profile selection, checks and failure behavior.",
         "",
         "## Orientation",
         "",
         "The exact current leaf registry is `src/catalogue.ts`.",
         "Its capability label is `native` (implemented by an mg-axi handler).",
-        "Its effect is `read` for Graph read leaves and the doctor health check, `write` for the gated named writes, or `local` for home, profile, login and setup views.",
+        "Its effect is `read` for Graph read leaves and the doctor health check, `write` for the gated named writes, or `local` for home, profile, auth, config path, login-alias and setup views.",
         "Doctor acquires credentials silently and contacts Graph; only its help view stays offline.",
         "The list below records current executable leaves; it makes no coverage claim for other Graph operations.",
+        UNSUPPORTED_READ_NOTE,
         "See `docs/coverage.md` for the per-operation disposition records.",
         "`docs/coverage.md` and this file are generated from the same catalogue and inventory sources; `node tools/generate-docs.mjs --check` fails when they are stale.",
         "",
@@ -194,18 +196,18 @@ export function skillDocument() {
         "",
         "## Setup (explicit only)",
         "",
-        "Follow [release guidance](../../README.md#release) for npm installation and explicit skill installation; [README.md](../../README.md#mg-axi) also documents checkout builds.",
+        "Follow [installation guidance](../../README.md#quick-start) for npm installation and explicit skill installation; [README.md](../../README.md#development--testing) also documents checkout builds.",
         "Create profiles explicitly and keep secrets out of argv and config files:",
         "",
         "```sh",
         "npx -y @knowttl/mg-axi setup                    # build steps, config path and capabilities; writes nothing",
         "npx -y @knowttl/mg-axi profile create --name soc --tenant <tenant-id> --client <client-id> --cloud commercial",
-        "npx -y @knowttl/mg-axi login --profile soc --scopes https://graph.microsoft.com/User.Read.All",
+        "npx -y @knowttl/mg-axi auth login --profile soc --scopes https://graph.microsoft.com/User.Read.All",
         "npx -y @knowttl/mg-axi doctor                   # one bounded read per selected profile",
         "npx -y @knowttl/mg-axi entra user list --profile soc --limit 10",
         "```",
         "",
-        "Configuration defaults to `~/.mg-axi/config.json`; `MG_AXI_CONFIG` selects a separate file.",
+        "Configuration uses the XDG config directory (default `~/.config/mg-axi/config.json`), or `%APPDATA%\\mg-axi\\config.json` on Windows; `--config` overrides `MG_AXI_CONFIG`.",
         "`mg-axi setup` shows the selected path and writes nothing.",
         "Application profiles authenticate headlessly through credential references: the profile names an env var or file and the environment supplies the value at acquisition time.",
         "Container examples for client secrets, certificate keys and workload federation live in [README.md](../../README.md#mg-axi).",
@@ -227,14 +229,13 @@ export function skillDocument() {
         "## Selecting a profile",
         "",
         "Read leaves accept `--profile <name>`.",
-        "Selection uses `--profile` or the configured default.",
-        "Without either, read leaves report `AUTH_REQUIRED`, even if only one profile exists.",
-        "Doctor selection is documented in [README.md](../../README.md#release).",
+        "Profile selection order and env-profile rules live in [README Configuration](../../README.md#configuration); an explicitly selected file profile ignores env fields.",
+        "Doctor selection is documented in [README.md](../../README.md#usage).",
         "Without profiles, home, setup and profile list show unconfigured state; Graph read leaves report `AUTH_REQUIRED`.",
         "",
         "## Safety",
         "",
-        "Reads run through a session that authorizes only catalogued operations before silent credential acquisition; only explicit `login` opens a browser or prints a device-code challenge.",
+        "Reads run through a session that authorizes only catalogued operations before silent credential acquisition; only explicit `auth login` opens a browser or prints a device-code challenge.",
         "Writes preview before sending and need `--execute` plus a typed `--confirm` repeating the target; an already-desired value is a no-op with exit 0, never an error.",
         "Output is TOON on stdout; diagnostics use stderr.",
         "Text truncates at 500 characters (`--full` restores text, never redaction); row caps resume through opaque cursors.",
@@ -407,7 +408,7 @@ export function capabilityDocument() {
         "",
         `- implemented read leaves: ${readCount} (${readLeaves.length} named Entra reads plus reviewed raw api get and doctor health check)`,
         `- implemented write leaves: ${writeLeaves.length} (named gated mutations below)`,
-        `- local leaves: ${localCount} (home, profile, login and setup views)`,
+        `- local leaves: ${localCount} (home, profile, config, auth, login alias and setup views)`,
         ...DISPOSITIONS.map(disposition => `- inventory ${disposition}: ${count(disposition)}`),
         "",
         ...auditRecord(rows),
@@ -420,9 +421,12 @@ export function capabilityDocument() {
         "| `mg-axi api get` | reviewed raw reads (see src/api.ts) | reviewed-raw-read catalogue | API-01 |",
         "| `mg-axi doctor` | bounded `GET:/users` health check | uses the named user-list read | PACK-01 |",
         "",
+        UNSUPPORTED_READ_NOTE,
+        "",
         "## EXT-01 domain scope decisions",
         "",
         "Firstmate decision R1: approve narrowing this change to the eight v1.0 domain reads above.",
+        "The root domain-dns-record list is now explicitly unsupported; use verification-dns-record or service-configuration-record list with a parent domain.",
         "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Federation stays out because it can carry signing-certificate material.",
         "Firstmate decision R2: keep the write-family status section as the coverage fix added to scope (resolved-kept).",
@@ -561,10 +565,10 @@ export function capabilityDocument() {
         "",
         "## EXT-01 directory-objects scope decisions",
         "",
-        "This change covers the three v1.0 directory-object reads above (directory-object list, show and count).",
+        "Directory-object show and count are available. Graph v1.0 rejects directory-object list; the legacy command fails locally and points to show or a typed list command.",
         "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Directory-object reads support v1.0 only; beta needs its own review.",
-        "Delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads; the POST lookup and validation actions need their own request and projection review.",
+        "Delta-token sync needs its own change-tracking contract beyond the approved show/count reads; the POST lookup and validation actions need their own request and projection review.",
         "Rows are polymorphic: only the base-type properties plus the @odata.type discriminator are projected, so subtype secrets or credentials can never appear.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",

package/dist/doctor.js

@@ -1,6 +1,7 @@
 import { AxiError } from "axi-sdk-js";
 import { LEAVES, operationFor } from "./catalogue.js";
 import { listUsers } from "./entra-users.js";
+import { authStatus } from "./auth-status.js";
 // PACK-01: explicit release health check over the reviewed read-only session.
 // Doctor performs one documented bounded read per profile (entra user list
 // with a one-row window) and reports configuration, connectivity,
@@ -8,7 +9,7 @@ import { listUsers } from "./entra-users.js";
 // DelegatedAuth.credential and ApplicationAuth.credential never open a
 // browser or device-code flow, so doctor never signs in interactively.
 // Doctor never auto-installs, changes profiles or enables Graph writes;
-// silent token refresh may update the protected credential cache.
+// silent token refresh stays in memory.
 // See README.md for usage.
 export const DOCTOR_OPERATION = "GET:/users";
 export const DOCTOR_VERSION = "v1.0";
@@ -16,19 +17,18 @@ export const DOCTOR_CHECK = `entra user list --limit 1 (${DOCTOR_VERSION}:${DOCT
 export function doctorTargets(store, flag) {
     if (flag !== undefined)
         return [store.resolve(flag).name];
-    const items = store.list();
-    if (!items.length)
-        return [];
     try {
         return [store.resolve(undefined).name];
     }
-    catch {
-        return items.map(item => item.name);
+    catch (error) {
+        if (!(error instanceof AxiError) || !["PROFILE_REQUIRED", "PROFILE_AMBIGUOUS"].includes(error.code))
+            throw error;
+        return store.list().map(item => item.name);
     }
 }
 export async function runDoctor(args) {
     if (!args.names.length) {
-        throw new AxiError("No profiles are configured", "AUTH_REQUIRED", ["npx -y @knowttl/mg-axi profile create --help", "npx -y @knowttl/mg-axi setup"]);
+        throw new AxiError("No profiles are configured", "PROFILE_REQUIRED", ["npx -y @knowttl/mg-axi profile create --help", "npx -y @knowttl/mg-axi setup"]);
     }
     const leaf = LEAVES.find(item => item.path === "entra user list");
     const operation = leaf === undefined ? undefined : operationFor(leaf, DOCTOR_VERSION);
@@ -39,7 +39,9 @@ export async function runDoctor(args) {
     for (const name of args.names) {
         const rerun = `npx -y @knowttl/mg-axi doctor --profile ${name}`;
         try {
-            const selected = args.store.resolve(name);
+            args.store.verifyPermissions();
+            const selected = args.selected ?? args.store.resolve(name);
+            authStatus(name, selected.profile);
             // The same bounded read the named leaf serves: one fetched page, one
             // surfaced row, remainder buffered in a discarded cursor. Doctor keeps
             // no cursor and accepts none; recovery reruns doctor, not the read.

package/dist/entra-audit-logs.js

@@ -72,7 +72,7 @@ export const KNOWN_PROVISIONING_FIELDS = [
     "jobId",
     "cycleId",
     "changeId",
-    "action",
+    "provisioningAction",
     "durationInMilliseconds",
     "sourceSystem",
     "sourceIdentity",
@@ -88,7 +88,7 @@ const PROVISIONING_KNOWN = new Set(KNOWN_PROVISIONING_FIELDS);
 // Compact list rows: identifier, time, who/what happened, and outcome.
 const DEFAULT_SIGNIN_LIST_SELECT = ["id", "createdDateTime", "userPrincipalName", "appDisplayName"];
 const DEFAULT_AUDIT_LIST_SELECT = ["id", "activityDateTime", "activityDisplayName", "result"];
-const DEFAULT_PROVISIONING_LIST_SELECT = ["id", "activityDateTime", "action", "provisioningStatusInfo"];
+const DEFAULT_PROVISIONING_LIST_SELECT = ["id", "activityDateTime", "provisioningAction", "provisioningStatusInfo"];
 // Show rows: the full reviewed server set for one object.
 const DEFAULT_SIGNIN_SHOW_SELECT = [...KNOWN_SIGNIN_FIELDS];
 const DEFAULT_AUDIT_SHOW_SELECT = [...KNOWN_AUDIT_FIELDS];
@@ -344,7 +344,8 @@ async function listLogs(shape, session, flags, profile, operation, help, profile
     const scopes = scopesFor(flags, profile, help, shape.defaultScopes);
     const full = flags.full === true;
     const filter = boundedFilter(shape.dateField, flags, help);
-    const query = { $select: select.join(",") };
+    // Provisioning lists reject $select; selection remains a local projection.
+    const query = shape.noun === "provisioning" ? {} : { $select: select.join(",") };
     const explicitFilter = filter !== undefined;
     if (explicitFilter)
         query.$filter = filter;
@@ -362,7 +363,7 @@ async function listLogs(shape, session, flags, profile, operation, help, profile
     // The hint replays the caller's own time flags (or the cursor alone, which
     // restores the saved query); copying back the composed $filter would wrap
     // it a second time and conflict with the cursor context.
-    const effectiveFlags = { ...flags, select: result.query.$select ?? shape.defaultSelect.join(",") };
+    const effectiveFlags = { ...flags, select: result.query.$select ?? select.join(",") };
     const rows = [];
     let truncated = false;
     for (const row of result.value) {

package/dist/entra-conditional-access.js

@@ -376,7 +376,8 @@ async function listCollection(shape, session, flags, profile, operation, help, p
     const { select, fields } = selectedFields(flags, savedSelect === undefined ? shape.defaultSelect : fieldList(savedSelect, "select", shape.known, shape.knownList, shape.noun, help), shape.known, shape.knownList, shape.noun, help);
     const scopes = scopesFor(flags, profile, help, shape.defaultScopes);
     const full = flags.full === true;
-    const query = { $select: select.join(",") };
+    // Authentication contexts reject $select; selection remains a local projection.
+    const query = shape.noun === "auth-context" ? {} : { $select: select.join(",") };
     if (flags.filter !== undefined)
         query.$filter = String(flags.filter);
     const args = { profile, operation, query, scopes };
@@ -397,7 +398,7 @@ async function listCollection(shape, session, flags, profile, operation, help, p
         args.limit = flags.limit === undefined ? 100 : Number(flags.limit);
     }
     const result = await withGuidance(shape.denialHints, () => session.collect(args));
-    const effectiveFlags = { ...flags, select: result.query.$select ?? shape.defaultSelect.join(",") };
+    const effectiveFlags = { ...flags, select: result.query.$select ?? select.join(",") };
     if (result.query.$filter !== undefined)
         effectiveFlags.filter = result.query.$filter;
     const rows = [];
@@ -474,7 +475,7 @@ async function showSingle(shape, session, flags, profile, operation, help, profi
         profile,
         operation,
         params,
-        query: { $select: select.join(",") },
+        query: shape.noun === "auth-strength-policy" ? {} : { $select: select.join(",") },
         scopes,
     }));
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {

package/dist/entra-directory-objects.js

@@ -1,7 +1,7 @@
 import { AxiError } from "axi-sdk-js";
 import { listTotals } from "./list-totals.js";
 // EXT-01 directory-objects subfamily: the read mapping behind
-// `mg-axi entra directory-object list/show/count`. Operation construction
+// `mg-axi entra directory-object show/count`. Operation construction
 // stays beside its command; the shared session owns URLs, credentials,
 // paging, retries and error translation, and the SDK owns TOON rendering.
 // This module only maps flags to session calls and projects rows for compact
@@ -10,10 +10,9 @@ import { listTotals } from "./list-totals.js";
 // Reviewed against the v1.0 directoryobject-get operation documentation and
 // the directoryObject resource reference on 2026-10-05. There is no dedicated
 // List operation page: the resource Methods table documents Get, delta,
-// Delete and the lookup/validation functions only, so the collection GET
-// follows the sibling get contract and the resource reference (both name
-// Directory.Read.All), with $select-only queries because collection filter
-// support is unreviewed. Both reads take delegated or application
+// Delete and the lookup/validation functions only. Graph rejects the root
+// collection GET, so the session refuses the legacy list command with
+// supported alternatives. Detail and count reads take delegated or application
 // Directory.Read.All, the documented least privilege in each mode; personal
 // Microsoft accounts are not supported. No delegated role and no P1/P2
 // prerequisite are stated for these reads. The $count scalar carries no

package/dist/entra-domains.js

@@ -2,7 +2,7 @@ import { AxiError } from "axi-sdk-js";
 import { listTotals } from "./list-totals.js";
 // EXT-01 domains subfamily: the read mapping behind `mg-axi entra domain
 // list/show`, the per-domain verification and service-configuration DNS
-// record reads, and the top-level domain DNS record reads. Operation
+// record reads, and the top-level domain DNS record show. Operation
 // construction stays beside its command; the shared session owns URLs,
 // credentials, paging, retries and error translation, and the SDK owns TOON
 // rendering. This module only maps flags to session calls and projects rows
@@ -17,7 +17,7 @@ import { listTotals } from "./list-totals.js";
 // domain list/get support those plus Directory Readers and other directory
 // roles). Personal Microsoft accounts are not supported. No P1/P2
 // prerequisite is stated for these reads. The single-record GETs and the
-// top-level /domainDnsRecords GETs carry no operation-level documentation
+// top-level /domainDnsRecords/{id} GET carries no operation-level documentation
 // page; they read the same domainDnsRecord resource through the same
 // permission contract, so the review cites the parent list documentation
 // alongside the domainDnsRecord resource reference. Domain ids are fully
@@ -28,6 +28,8 @@ import { listTotals } from "./list-totals.js";
 // no $count or ConsistencyLevel contract. No domain mutation exists in this
 // slice: verify, forceDelete, promote, federation and shared-email surfaces
 // belong to later pieces.
+// Graph rejects the root /domainDnsRecords collection. The session refuses
+// its legacy list command and points to the parent-domain DNS collections.
 // Every domain property this slice may request or display, matching the
 // reviewed raw surface. Anything else fails before credentials.
 export const KNOWN_DOMAIN_FIELDS = [

package/dist/entra-group-lifecycle.js

@@ -186,7 +186,8 @@ function collectionCommon(session, flags, known, knownList, defaults, defaultSco
     return { cursor, select, fields, scopes: scopesFor(flags, defaultScopes, profile, help), full: flags.full === true, filter };
 }
 function collectArgs(profile, operation, common, flags, help) {
-    const query = { $select: common.select.join(",") };
+    // Lifecycle-policy lists reject $select; keep the selected output fields local.
+    const query = operation.path === "/groupLifecyclePolicies" ? {} : { $select: common.select.join(",") };
     if (common.filter !== undefined)
         query.$filter = common.filter;
     const args = { profile, operation, query, scopes: common.scopes };
@@ -227,7 +228,7 @@ function singleResult(raw, fields, full, kind) {
 export async function listLifecyclePolicies(session, flags, profile, operation, help, profileName) {
     const common = collectionCommon(session, flags, KNOWN_LIFECYCLE, KNOWN_LIFECYCLE_FIELDS, DEFAULT_LIFECYCLE_LIST_SELECT, DEFAULT_LIFECYCLE_SCOPES, operation, help, profile, true);
     const result = await withGuidance(LIFECYCLE_DENIAL_HINTS, () => session.collect(collectArgs(profile, operation, common, flags, help)));
-    const effectiveFlags = { ...flags, select: result.query.$select ?? DEFAULT_LIFECYCLE_LIST_SELECT.join(",") };
+    const effectiveFlags = { ...flags, select: result.query.$select ?? common.select.join(",") };
     if (result.query.$filter !== undefined)
         effectiveFlags.filter = result.query.$filter;
     const policies = [];

package/dist/entra-roles.js

@@ -3,8 +3,8 @@ import { listTotals } from "./list-totals.js";
 // READ-09: the Entra directory-role and PIM read mapping behind
 // `mg-axi entra directory-role list/show`, `mg-axi entra directory-role-template
 // list/show`, `mg-axi entra directory-role member list`, `mg-axi entra
-// directory-role scoped-member list/show`, `mg-axi entra scoped-role-membership
-// list/show`, `mg-axi entra role-assignment list`, `mg-axi entra pim eligible
+// directory-role scoped-member list/show`, `mg-axi entra role-assignment
+// list`, `mg-axi entra pim eligible
 // list` and `mg-axi entra pim active list`.
 // Operation construction stays beside its command; the shared session owns
 // URLs, credentials, paging, retries and error translation, and the SDK owns
@@ -44,6 +44,8 @@ import { listTotals } from "./list-totals.js";
 // every other PIM mutation belongs to later write slices, never to these
 // reads. Built-in roles are base inventory; custom role assignments need P1;
 // PIM reads need P2 or ID Governance.
+// Direct /scopedRoleMemberships queries are unsupported by Graph v1.0;
+// the session refuses the legacy commands with parent-role alternatives.
 // Eligible and active instances need separate reviewed property sets:
 // only active instances expose assignmentType.
 export const KNOWN_ROLE_FIELDS = [
@@ -84,9 +86,8 @@ export const KNOWN_ROLE_MEMBER_FIELDS = [
 ];
 export const KNOWN_SCOPED_MEMBER_FIELDS = [
     "id",
-    "principalId",
+    "roleMemberInfo",
     "roleId",
-    "directoryScopeId",
     "administrativeUnitId",
 ];
 const ROLE_KNOWN = new Set(KNOWN_ROLE_FIELDS);
@@ -106,7 +107,7 @@ const DEFAULT_ACTIVE_SELECT = ["id", "principalId", "roleDefinitionId", "assignm
 const DEFAULT_TEMPLATE_LIST_SELECT = ["id", "displayName", "description"];
 const DEFAULT_TEMPLATE_SHOW_SELECT = [...KNOWN_TEMPLATE_FIELDS];
 const DEFAULT_MEMBER_SELECT = ["id", "displayName"];
-const DEFAULT_SCOPED_LIST_SELECT = ["id", "principalId", "roleId", "directoryScopeId"];
+const DEFAULT_SCOPED_LIST_SELECT = ["id", "roleMemberInfo", "roleId", "administrativeUnitId"];
 const DEFAULT_SCOPED_SHOW_SELECT = [...KNOWN_SCOPED_MEMBER_FIELDS];
 export const DEFAULT_ROLE_SCOPES = ["https://graph.microsoft.com/RoleManagement.Read.Directory"];
 export const DEFAULT_ELIGIBLE_SCOPES = ["https://graph.microsoft.com/RoleEligibilitySchedule.Read.Directory"];