@knowttl/mg-axi 0.1.6 → 0.1.7

package/dist/api.js

@@ -61,7 +61,7 @@ const AUTH_METHOD_FIELDS = ["id", "createdDateTime", "displayName", "phoneNumber
 const REGISTRATION_FIELDS = ["id", "userPrincipalName", "userDisplayName", "userType", "isAdmin", "isMfaRegistered", "isMfaCapable", "isPasswordlessCapable", "isSsprRegistered", "isSsprEnabled", "isSsprCapable", "userPreferredMethodForSecondaryAuthentication", "lastUpdatedDateTime"];
 const SIGNIN_FIELDS = ["id", "createdDateTime", "userId", "userPrincipalName", "userDisplayName", "appDisplayName", "appId", "ipAddress", "location", "status", "conditionalAccessStatus", "riskDetail", "riskLevelAggregated", "riskLevelDuringSignIn", "riskState", "resourceDisplayName", "resourceId", "clientAppUsed"];
 const AUDIT_FIELDS = ["id", "activityDateTime", "activityDisplayName", "category", "loggedByService", "operationType", "result", "resultReason", "correlationId", "initiatedBy", "targetResources"];
-const PROVISIONING_FIELDS = ["id", "activityDateTime", "tenantId", "jobId", "cycleId", "changeId", "action", "durationInMilliseconds", "sourceSystem", "sourceIdentity", "targetSystem", "targetIdentity", "provisioningStatusInfo", "provisioningSteps", "modifiedProperties", "servicePrincipal", "initiatedBy"];
+const PROVISIONING_FIELDS = ["id", "activityDateTime", "tenantId", "jobId", "cycleId", "changeId", "provisioningAction", "durationInMilliseconds", "sourceSystem", "sourceIdentity", "targetSystem", "targetIdentity", "provisioningStatusInfo", "provisioningSteps", "modifiedProperties", "servicePrincipal", "initiatedBy"];
 const RISKY_USER_FIELDS = ["id", "userPrincipalName", "userDisplayName", "riskDetail", "riskLastUpdatedDateTime", "riskLevel", "riskState"];
 const RISK_DETECTION_FIELDS = ["id", "detectedDateTime", "activityDateTime", "userId", "userPrincipalName", "userDisplayName", "ipAddress", "location", "riskDetail", "riskLevel", "riskState", "riskEventType", "detectionTimingType", "lastUpdatedDateTime", "source"];
 const RISKY_SP_FIELDS = ["id", "displayName", "appId", "servicePrincipalType", "riskDetail", "riskLastUpdatedDateTime", "riskLevel", "riskState", "isEnabled", "isProcessing"];
@@ -117,7 +117,7 @@ export const REVIEWED_ROUTES = [
         access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
         note: "Conditional Access needs P1.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/authenticationstrengthroot-list-policies?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_STRENGTH_FIELDS,
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}", kind: "single", query: [], fields: KNOWN_STRENGTH_FIELDS,
         access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
         note: "Conditional Access needs P1.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/authenticationstrengthpolicy-get?view=graph-rest-1.0"] },
@@ -145,7 +145,7 @@ export const REVIEWED_ROUTES = [
         access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (for example Security Reader) is also required.",
         note: "Conditional Access needs P1.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/conditionalaccesstemplate-get?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/identity/conditionalAccess/authenticationContextClassReferences", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_AUTH_CONTEXT_FIELDS,
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationContextClassReferences", kind: "collection", query: ["$filter", "$orderby", "$top"], fields: KNOWN_AUTH_CONTEXT_FIELDS,
         access: "D/A AuthenticationContext.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
         note: "Conditional Access needs P1.",
         sources: ["https://learn.microsoft.com/graph/api/conditionalaccessroot-list-authenticationcontextclassreferences?view=graph-rest-1.0"] },
@@ -187,7 +187,7 @@ export const REVIEWED_ROUTES = [
     { id: "v1.0:GET:/auditLogs/directoryAudits", kind: "collection", query: COLLECTION_QUERY, fields: AUDIT_FIELDS,
         access: "D/A AuditLog.Read.All. Delegated callers pass it as --scopes.",
         sources: ["https://learn.microsoft.com/graph/api/directoryaudit-list?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/auditLogs/provisioning", kind: "collection", query: COLLECTION_QUERY, fields: PROVISIONING_FIELDS,
+    { id: "v1.0:GET:/auditLogs/provisioning", kind: "collection", query: ["$filter", "$orderby", "$top"], fields: PROVISIONING_FIELDS,
         access: "D/A AuditLog.Read.All and Directory.Read.All. Delegated callers pass both as --scopes; Reports Reader is the least privileged directory role.",
         note: "Entra ID P1/P2 licence prerequisite; retention is 30 days on premium and 7 days on free.",
         sources: ["https://learn.microsoft.com/graph/api/provisioningobjectsummary-list?view=graph-rest-1.0"] },
@@ -313,14 +313,6 @@ export const REVIEWED_ROUTES = [
         access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
         note: "Administrative-unit scopes need P1.",
         sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-get?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/scopedRoleMemberships", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
-        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
-        note: "Administrative-unit-scoped admin assignments; directory-wide assignments live on roleAssignments. Administrative-unit scopes need P1.",
-        sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-list?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/scopedRoleMemberships/{scopedRoleMembership-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
-        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
-        note: "Administrative-unit scopes need P1.",
-        sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-get?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/assignmentSchedules", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ASSIGNMENT_SCHEDULE_FIELDS,
         access: "D/A PrivilegedAssignmentSchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
         note: "Assignment schedules govern group membership or ownership over time; PIM for Groups needs P2 or ID Governance; lists require $filter on groupId or principalId. AssignmentScheduleRequests stay out: their least privilege is the write scope PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup.",
@@ -415,10 +407,6 @@ export const REVIEWED_ROUTES = [
         access: "D/A Domain.Read.All. Delegated callers pass it as --scopes; Domain Name Administrator or Global Reader are the least-privileged delegated roles. No P1/P2 prerequisite is stated for DNS record reads.",
         note: "No operation-level documentation page; access follows the parent service-configuration contract and the domainDnsRecord resource reference.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/graph/api/resources/domaindnsrecord?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/domainDnsRecords", kind: "collection", query: COLLECTION_QUERY, fields: DNS_RECORD_FIELDS,
-        access: "D/A Domain.Read.All. Delegated callers pass it as --scopes; Domain Name Administrator or Global Reader are the least-privileged delegated roles. No P1/P2 prerequisite is stated for DNS record reads.",
-        note: "No operation-level documentation page; access follows the documented domain/DNS-read contract and the domainDnsRecord resource reference.",
-        sources: ["https://learn.microsoft.com/en-us/graph/api/domain-list?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/graph/api/resources/domaindnsrecord?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/domainDnsRecords/{domainDnsRecord-id}", kind: "single", query: SINGLE_QUERY, fields: DNS_RECORD_FIELDS,
         access: "D/A Domain.Read.All. Delegated callers pass it as --scopes; Domain Name Administrator or Global Reader are the least-privileged delegated roles. No P1/P2 prerequisite is stated for DNS record reads.",
         note: "No operation-level documentation page; access follows the documented domain/DNS-read contract and the domainDnsRecord resource reference.",
@@ -489,10 +477,6 @@ export const REVIEWED_ROUTES = [
         delegatedOnly: true,
         note: "No single-acceptance operation page; access follows the parent acceptance-list contract and the agreementAcceptance resource reference. Acceptance records are personal data: default rows carry id, agreementId, state and recordedDateTime only.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/agreement-list-acceptances?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/graph/api/resources/agreementacceptance?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/directoryObjects", kind: "collection", query: ["$select"], fields: KNOWN_DIRECTORY_OBJECT_FIELDS, defaultFields: ["id"], keepODataType: true,
-        access: "D/A Directory.Read.All. Delegated callers pass it as --scopes; no delegated role prerequisite is stated for directory-object reads. Personal Microsoft accounts are not supported.",
-        note: "No List operation page exists; access follows the sibling directoryobject-get contract and the directoryObject resource reference. Graph documents no collection filter contract here, so only $select is reviewed. Rows are polymorphic: the @odata.type discriminator rides along automatically and subtype properties need the subtype's named reads, never raw $select of unreviewed fields.",
-        sources: ["https://learn.microsoft.com/en-us/graph/api/directoryobject-get?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/graph/api/resources/directoryobject?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/directoryObjects/{directoryObject-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_DIRECTORY_OBJECT_FIELDS, defaultFields: ["id", "deletedDateTime"], keepODataType: true,
         access: "D/A Directory.Read.All. Delegated callers pass it as --scopes; no delegated role prerequisite is stated for this read. Personal Microsoft accounts are not supported.",
         note: "Single reads return the base-type properties plus the @odata.type discriminator; subtype detail needs the subtype's named reads. Only base properties are projected, so subtype secrets or credentials can never appear.",
@@ -605,7 +589,7 @@ export const REVIEWED_ROUTES = [
         access: "D/A OrgContact.Read.All and Group.Read.All together least-privileged (Directory.Read.All is the documented higher-privileged alternative). Delegated callers pass both as --scopes; delegated access additionally needs a supported Entra role (Directory Readers reads basic properties; Global Reader, Directory Writers, Intune Administrator or User Administrator also work). Personal Microsoft accounts are not supported.",
         note: "No operation-level documentation page; OData cast selects the administrativeUnit subtype and access follows the parent transitiveMemberOf contract and the administrativeUnit resource reference.",
         sources: ["https://learn.microsoft.com/en-us/graph/api/orgcontact-list-transitivememberof?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/graph/api/resources/administrativeunit?view=graph-rest-1.0"] },
-    { id: "v1.0:GET:/groupLifecyclePolicies", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_LIFECYCLE_FIELDS,
+    { id: "v1.0:GET:/groupLifecyclePolicies", kind: "collection", query: ["$filter", "$orderby", "$top"], fields: KNOWN_LIFECYCLE_FIELDS,
         access: "D/A Directory.Read.All. Delegated callers pass it as --scopes; no delegated role prerequisite is stated for lifecycle-policy reads. Personal Microsoft accounts are not supported.",
         note: "Filtering uses plain $filter with no $count or ConsistencyLevel contract; no P1/P2 prerequisite is stated for lifecycle-policy reads.",
         sources: ["https://learn.microsoft.com/graph/api/grouplifecyclepolicy-list?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/grouplifecyclepolicy?view=graph-rest-1.0"] },

package/dist/catalogue.js

@@ -677,7 +677,7 @@ export const LEAVES = [
             cursor: roleRead.cursor,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
         }, examples: ["mg-axi entra directory-role member list --role <role-id> --profile soc", "mg-axi entra directory-role member list --role <role-id> --profile soc --filter \"displayName eq 'Adele Vance'\""] },
-    { path: "entra directory-role scoped-member list", description: "List the scoped members of one activated directory role (id, principalId, roleId, directoryScopeId); administrative-unit scopes need P1", operation: "GET:/directoryRoles/{directoryRole-id}/scopedMembers", flags: {
+    { path: "entra directory-role scoped-member list", description: "List the scoped members of one activated directory role (id, roleMemberInfo, roleId, administrativeUnitId); administrative-unit scopes need P1", operation: "GET:/directoryRoles/{directoryRole-id}/scopedMembers", flags: {
             ...common, role: { value: "role-id", required: true, description: "Activated directory-role object ID whose scoped members are listed" },
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
@@ -687,7 +687,7 @@ export const LEAVES = [
             full: roleRead.full,
             cursor: roleRead.cursor,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
-        }, examples: ["mg-axi entra directory-role scoped-member list --role <role-id> --profile soc", "mg-axi entra directory-role scoped-member list --role <role-id> --profile soc --filter \"principalId eq '<principal-id>'\""] },
+        }, examples: ["mg-axi entra directory-role scoped-member list --role <role-id> --profile soc", "mg-axi entra directory-role scoped-member list --role <role-id> --profile soc --filter \"administrativeUnitId eq '<unit-id>'\""] },
     { path: "entra directory-role scoped-member show", description: "Show one scoped member of an activated directory role with richer default properties", operation: "GET:/directoryRoles/{directoryRole-id}/scopedMembers/{scopedRoleMembership-id}", flags: {
             ...common, role: { value: "role-id", required: true, description: "Activated directory-role object ID owning the scoped member" },
             id: { value: "scoped-membership-id", required: true, description: "Scoped membership object ID" },
@@ -696,7 +696,7 @@ export const LEAVES = [
             full: roleRead.full,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
         }, examples: ["mg-axi entra directory-role scoped-member show --role <role-id> --id <scoped-membership-id> --profile soc", "mg-axi entra directory-role scoped-member show --role <role-id> --id <scoped-membership-id> --profile soc --full"] },
-    { path: "entra scoped-role-membership list", description: "List administrative-unit-scoped role memberships (id, principalId, roleId, directoryScopeId); directory-wide assignments live on roleAssignments", operation: "GET:/scopedRoleMemberships", flags: {
+    { path: "entra scoped-role-membership list", description: "Unsupported by Graph v1.0; use directory-role scoped-member list --role <role-id>", operation: "GET:/scopedRoleMemberships", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
@@ -707,7 +707,7 @@ export const LEAVES = [
             cursor: roleRead.cursor,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
         }, examples: ["mg-axi entra scoped-role-membership list --profile soc", "mg-axi entra scoped-role-membership list --profile soc --filter \"roleId eq '<role-id>'\""] },
-    { path: "entra scoped-role-membership show", description: "Show one administrative-unit-scoped role membership with richer default properties", operation: "GET:/scopedRoleMemberships/{scopedRoleMembership-id}", flags: {
+    { path: "entra scoped-role-membership show", description: "Unsupported by Graph v1.0; use directory-role scoped-member show --role <role-id> --id <scoped-membership-id>", operation: "GET:/scopedRoleMemberships/{scopedRoleMembership-id}", flags: {
             ...common, id: { value: "scoped-membership-id", required: true, description: "Scoped membership object ID" },
             select: roleRead.select,
             fields: roleRead.fields,
@@ -981,7 +981,7 @@ export const LEAVES = [
             full: dnsRead.full,
             scopes: dnsRead.scopes,
         }, examples: ["mg-axi entra domain service-configuration-record show --domain contoso.com --id <record-id> --profile soc"] },
-    { path: "entra domain-dns-record list", description: "List domain DNS records from the top-level record set; rows carry @odata.type naming the derived record kind", operation: "GET:/domainDnsRecords", flags: {
+    { path: "entra domain-dns-record list", description: "Unsupported by Graph v1.0; use domain verification-dns-record list or domain service-configuration-record list with --domain <domain-id>", operation: "GET:/domainDnsRecords", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
@@ -1145,7 +1145,7 @@ export const LEAVES = [
             full: acceptanceRead.full,
             scopes: acceptanceRead.scopes,
         }, examples: ["mg-axi entra agreement-acceptance show --id <acceptance-id> --profile soc"] },
-    { path: "entra directory-object list", description: "List directory objects with compact rows (id plus the @odata.type subtype discriminator); Graph documents no List operation page, so no --filter", operation: "GET:/directoryObjects", flags: {
+    { path: "entra directory-object list", description: "Unsupported by Graph v1.0; use directory-object show --id <object-id> or a named user, group, device, application or service-principal list", operation: "GET:/directoryObjects", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
@@ -1254,7 +1254,7 @@ export const LEAVES = [
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
             filter: lifecycleRead.filter,
-            select: lifecycleRead.select,
+            select: { value: "comma-separated-properties", description: "Select output properties locally; no $select is sent to Graph" },
             fields: lifecycleRead.fields,
             full: lifecycleRead.full,
             cursor: lifecycleRead.cursor,
@@ -1599,7 +1599,7 @@ export const LEAVES = [
             since: { ...logRead.since, description: "Required for a new query (resume with --cursor instead): earliest activityDateTime bounding the server time range" },
             until: logRead.until,
             filter: logRead.filter,
-            select: { value: "comma-separated-properties", description: "Request server properties from the supported provisioning-log property set" },
+            select: { value: "comma-separated-properties", description: "Select output properties locally from the provisioning-log set, including provisioningAction; no $select is sent to Graph" },
             fields: logRead.fields,
             full: logRead.full,
             cursor: logRead.cursor,
@@ -1921,7 +1921,7 @@ export const LEAVES = [
         }, examples: ["mg-axi entra conditional-access auth-strength-policy list --profile soc", "mg-axi entra conditional-access auth-strength-policy list --profile soc --limit 10", "mg-axi entra conditional-access auth-strength-policy list --profile soc --filter \"policyType eq 'builtIn'\" --select id,displayName,policyType"] },
     { path: "entra conditional-access auth-strength-policy show", description: "Show one authentication-strength policy with the full reviewed property set", operation: "GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}", flags: {
             ...common, id: { value: "auth-strength-policy-id", required: true, description: "Authentication-strength policy object ID" },
-            select: caStrengthRead.select,
+            select: { value: "comma-separated-properties", description: "Select output properties locally; no $select is sent to Graph" },
             fields: caStrengthRead.fields,
             full: caStrengthRead.full,
             scopes: caStrengthRead.scopes,
@@ -1987,7 +1987,7 @@ export const LEAVES = [
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
             all: { description: "Follow pages within request, byte and deadline budgets" },
             filter: caAuthContextRead.filter,
-            select: caAuthContextRead.select,
+            select: { value: "comma-separated-properties", description: "Select output properties locally; no $select is sent to Graph" },
             fields: caAuthContextRead.fields,
             full: caAuthContextRead.full,
             cursor: caAuthContextRead.cursor,

package/dist/docs.js

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import { DESCRIPTION, HOME_HELP, LEAVES } from "./catalogue.js";
+const UNSUPPORTED_READ_NOTE = "Graph v1.0 does not support the legacy `entra scoped-role-membership list/show`, `entra domain-dns-record list` or `entra directory-object list` routes; those commands fail locally with supported alternatives and their root routes are not available through `api get`.";
 // PACK-01: single source for generated release records. The committed
 // skills/mg-axi/SKILL.md and docs/coverage.md are generated from the templates
 // below, the executable catalogue and the discovery inventory, so help, skill
@@ -174,6 +175,7 @@ export function skillDocument() {
         "Its effect is `read` for Graph read leaves and the doctor health check, `write` for the gated named writes, or `local` for home, profile, auth, config path, login-alias and setup views.",
         "Doctor acquires credentials silently and contacts Graph; only its help view stays offline.",
         "The list below records current executable leaves; it makes no coverage claim for other Graph operations.",
+        UNSUPPORTED_READ_NOTE,
         "See `docs/coverage.md` for the per-operation disposition records.",
         "`docs/coverage.md` and this file are generated from the same catalogue and inventory sources; `node tools/generate-docs.mjs --check` fails when they are stale.",
         "",
@@ -419,9 +421,12 @@ export function capabilityDocument() {
         "| `mg-axi api get` | reviewed raw reads (see src/api.ts) | reviewed-raw-read catalogue | API-01 |",
         "| `mg-axi doctor` | bounded `GET:/users` health check | uses the named user-list read | PACK-01 |",
         "",
+        UNSUPPORTED_READ_NOTE,
+        "",
         "## EXT-01 domain scope decisions",
         "",
         "Firstmate decision R1: approve narrowing this change to the eight v1.0 domain reads above.",
+        "The root domain-dns-record list is now explicitly unsupported; use verification-dns-record or service-configuration-record list with a parent domain.",
         "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Federation stays out because it can carry signing-certificate material.",
         "Firstmate decision R2: keep the write-family status section as the coverage fix added to scope (resolved-kept).",
@@ -560,10 +565,10 @@ export function capabilityDocument() {
         "",
         "## EXT-01 directory-objects scope decisions",
         "",
-        "This change covers the three v1.0 directory-object reads above (directory-object list, show and count).",
+        "Directory-object show and count are available. Graph v1.0 rejects directory-object list; the legacy command fails locally and points to show or a typed list command.",
         "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Directory-object reads support v1.0 only; beta needs its own review.",
-        "Delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads; the POST lookup and validation actions need their own request and projection review.",
+        "Delta-token sync needs its own change-tracking contract beyond the approved show/count reads; the POST lookup and validation actions need their own request and projection review.",
         "Rows are polymorphic: only the base-type properties plus the @odata.type discriminator are projected, so subtype secrets or credentials can never appear.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",

package/dist/entra-audit-logs.js

@@ -72,7 +72,7 @@ export const KNOWN_PROVISIONING_FIELDS = [
     "jobId",
     "cycleId",
     "changeId",
-    "action",
+    "provisioningAction",
     "durationInMilliseconds",
     "sourceSystem",
     "sourceIdentity",
@@ -88,7 +88,7 @@ const PROVISIONING_KNOWN = new Set(KNOWN_PROVISIONING_FIELDS);
 // Compact list rows: identifier, time, who/what happened, and outcome.
 const DEFAULT_SIGNIN_LIST_SELECT = ["id", "createdDateTime", "userPrincipalName", "appDisplayName"];
 const DEFAULT_AUDIT_LIST_SELECT = ["id", "activityDateTime", "activityDisplayName", "result"];
-const DEFAULT_PROVISIONING_LIST_SELECT = ["id", "activityDateTime", "action", "provisioningStatusInfo"];
+const DEFAULT_PROVISIONING_LIST_SELECT = ["id", "activityDateTime", "provisioningAction", "provisioningStatusInfo"];
 // Show rows: the full reviewed server set for one object.
 const DEFAULT_SIGNIN_SHOW_SELECT = [...KNOWN_SIGNIN_FIELDS];
 const DEFAULT_AUDIT_SHOW_SELECT = [...KNOWN_AUDIT_FIELDS];
@@ -344,7 +344,8 @@ async function listLogs(shape, session, flags, profile, operation, help, profile
     const scopes = scopesFor(flags, profile, help, shape.defaultScopes);
     const full = flags.full === true;
     const filter = boundedFilter(shape.dateField, flags, help);
-    const query = { $select: select.join(",") };
+    // Provisioning lists reject $select; selection remains a local projection.
+    const query = shape.noun === "provisioning" ? {} : { $select: select.join(",") };
     const explicitFilter = filter !== undefined;
     if (explicitFilter)
         query.$filter = filter;
@@ -362,7 +363,7 @@ async function listLogs(shape, session, flags, profile, operation, help, profile
     // The hint replays the caller's own time flags (or the cursor alone, which
     // restores the saved query); copying back the composed $filter would wrap
     // it a second time and conflict with the cursor context.
-    const effectiveFlags = { ...flags, select: result.query.$select ?? shape.defaultSelect.join(",") };
+    const effectiveFlags = { ...flags, select: result.query.$select ?? select.join(",") };
     const rows = [];
     let truncated = false;
     for (const row of result.value) {

package/dist/entra-conditional-access.js

@@ -376,7 +376,8 @@ async function listCollection(shape, session, flags, profile, operation, help, p
     const { select, fields } = selectedFields(flags, savedSelect === undefined ? shape.defaultSelect : fieldList(savedSelect, "select", shape.known, shape.knownList, shape.noun, help), shape.known, shape.knownList, shape.noun, help);
     const scopes = scopesFor(flags, profile, help, shape.defaultScopes);
     const full = flags.full === true;
-    const query = { $select: select.join(",") };
+    // Authentication contexts reject $select; selection remains a local projection.
+    const query = shape.noun === "auth-context" ? {} : { $select: select.join(",") };
     if (flags.filter !== undefined)
         query.$filter = String(flags.filter);
     const args = { profile, operation, query, scopes };
@@ -397,7 +398,7 @@ async function listCollection(shape, session, flags, profile, operation, help, p
         args.limit = flags.limit === undefined ? 100 : Number(flags.limit);
     }
     const result = await withGuidance(shape.denialHints, () => session.collect(args));
-    const effectiveFlags = { ...flags, select: result.query.$select ?? shape.defaultSelect.join(",") };
+    const effectiveFlags = { ...flags, select: result.query.$select ?? select.join(",") };
     if (result.query.$filter !== undefined)
         effectiveFlags.filter = result.query.$filter;
     const rows = [];
@@ -474,7 +475,7 @@ async function showSingle(shape, session, flags, profile, operation, help, profi
         profile,
         operation,
         params,
-        query: { $select: select.join(",") },
+        query: shape.noun === "auth-strength-policy" ? {} : { $select: select.join(",") },
         scopes,
     }));
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {

package/dist/entra-directory-objects.js

@@ -1,7 +1,7 @@
 import { AxiError } from "axi-sdk-js";
 import { listTotals } from "./list-totals.js";
 // EXT-01 directory-objects subfamily: the read mapping behind
-// `mg-axi entra directory-object list/show/count`. Operation construction
+// `mg-axi entra directory-object show/count`. Operation construction
 // stays beside its command; the shared session owns URLs, credentials,
 // paging, retries and error translation, and the SDK owns TOON rendering.
 // This module only maps flags to session calls and projects rows for compact
@@ -10,10 +10,9 @@ import { listTotals } from "./list-totals.js";
 // Reviewed against the v1.0 directoryobject-get operation documentation and
 // the directoryObject resource reference on 2026-10-05. There is no dedicated
 // List operation page: the resource Methods table documents Get, delta,
-// Delete and the lookup/validation functions only, so the collection GET
-// follows the sibling get contract and the resource reference (both name
-// Directory.Read.All), with $select-only queries because collection filter
-// support is unreviewed. Both reads take delegated or application
+// Delete and the lookup/validation functions only. Graph rejects the root
+// collection GET, so the session refuses the legacy list command with
+// supported alternatives. Detail and count reads take delegated or application
 // Directory.Read.All, the documented least privilege in each mode; personal
 // Microsoft accounts are not supported. No delegated role and no P1/P2
 // prerequisite are stated for these reads. The $count scalar carries no

package/dist/entra-domains.js

@@ -2,7 +2,7 @@ import { AxiError } from "axi-sdk-js";
 import { listTotals } from "./list-totals.js";
 // EXT-01 domains subfamily: the read mapping behind `mg-axi entra domain
 // list/show`, the per-domain verification and service-configuration DNS
-// record reads, and the top-level domain DNS record reads. Operation
+// record reads, and the top-level domain DNS record show. Operation
 // construction stays beside its command; the shared session owns URLs,
 // credentials, paging, retries and error translation, and the SDK owns TOON
 // rendering. This module only maps flags to session calls and projects rows
@@ -17,7 +17,7 @@ import { listTotals } from "./list-totals.js";
 // domain list/get support those plus Directory Readers and other directory
 // roles). Personal Microsoft accounts are not supported. No P1/P2
 // prerequisite is stated for these reads. The single-record GETs and the
-// top-level /domainDnsRecords GETs carry no operation-level documentation
+// top-level /domainDnsRecords/{id} GET carries no operation-level documentation
 // page; they read the same domainDnsRecord resource through the same
 // permission contract, so the review cites the parent list documentation
 // alongside the domainDnsRecord resource reference. Domain ids are fully
@@ -28,6 +28,8 @@ import { listTotals } from "./list-totals.js";
 // no $count or ConsistencyLevel contract. No domain mutation exists in this
 // slice: verify, forceDelete, promote, federation and shared-email surfaces
 // belong to later pieces.
+// Graph rejects the root /domainDnsRecords collection. The session refuses
+// its legacy list command and points to the parent-domain DNS collections.
 // Every domain property this slice may request or display, matching the
 // reviewed raw surface. Anything else fails before credentials.
 export const KNOWN_DOMAIN_FIELDS = [

package/dist/entra-group-lifecycle.js

@@ -186,7 +186,8 @@ function collectionCommon(session, flags, known, knownList, defaults, defaultSco
     return { cursor, select, fields, scopes: scopesFor(flags, defaultScopes, profile, help), full: flags.full === true, filter };
 }
 function collectArgs(profile, operation, common, flags, help) {
-    const query = { $select: common.select.join(",") };
+    // Lifecycle-policy lists reject $select; keep the selected output fields local.
+    const query = operation.path === "/groupLifecyclePolicies" ? {} : { $select: common.select.join(",") };
     if (common.filter !== undefined)
         query.$filter = common.filter;
     const args = { profile, operation, query, scopes: common.scopes };
@@ -227,7 +228,7 @@ function singleResult(raw, fields, full, kind) {
 export async function listLifecyclePolicies(session, flags, profile, operation, help, profileName) {
     const common = collectionCommon(session, flags, KNOWN_LIFECYCLE, KNOWN_LIFECYCLE_FIELDS, DEFAULT_LIFECYCLE_LIST_SELECT, DEFAULT_LIFECYCLE_SCOPES, operation, help, profile, true);
     const result = await withGuidance(LIFECYCLE_DENIAL_HINTS, () => session.collect(collectArgs(profile, operation, common, flags, help)));
-    const effectiveFlags = { ...flags, select: result.query.$select ?? DEFAULT_LIFECYCLE_LIST_SELECT.join(",") };
+    const effectiveFlags = { ...flags, select: result.query.$select ?? common.select.join(",") };
     if (result.query.$filter !== undefined)
         effectiveFlags.filter = result.query.$filter;
     const policies = [];

package/dist/entra-roles.js

@@ -3,8 +3,8 @@ import { listTotals } from "./list-totals.js";
 // READ-09: the Entra directory-role and PIM read mapping behind
 // `mg-axi entra directory-role list/show`, `mg-axi entra directory-role-template
 // list/show`, `mg-axi entra directory-role member list`, `mg-axi entra
-// directory-role scoped-member list/show`, `mg-axi entra scoped-role-membership
-// list/show`, `mg-axi entra role-assignment list`, `mg-axi entra pim eligible
+// directory-role scoped-member list/show`, `mg-axi entra role-assignment
+// list`, `mg-axi entra pim eligible
 // list` and `mg-axi entra pim active list`.
 // Operation construction stays beside its command; the shared session owns
 // URLs, credentials, paging, retries and error translation, and the SDK owns
@@ -44,6 +44,8 @@ import { listTotals } from "./list-totals.js";
 // every other PIM mutation belongs to later write slices, never to these
 // reads. Built-in roles are base inventory; custom role assignments need P1;
 // PIM reads need P2 or ID Governance.
+// Direct /scopedRoleMemberships queries are unsupported by Graph v1.0;
+// the session refuses the legacy commands with parent-role alternatives.
 // Eligible and active instances need separate reviewed property sets:
 // only active instances expose assignmentType.
 export const KNOWN_ROLE_FIELDS = [
@@ -84,9 +86,8 @@ export const KNOWN_ROLE_MEMBER_FIELDS = [
 ];
 export const KNOWN_SCOPED_MEMBER_FIELDS = [
     "id",
-    "principalId",
+    "roleMemberInfo",
     "roleId",
-    "directoryScopeId",
     "administrativeUnitId",
 ];
 const ROLE_KNOWN = new Set(KNOWN_ROLE_FIELDS);
@@ -106,7 +107,7 @@ const DEFAULT_ACTIVE_SELECT = ["id", "principalId", "roleDefinitionId", "assignm
 const DEFAULT_TEMPLATE_LIST_SELECT = ["id", "displayName", "description"];
 const DEFAULT_TEMPLATE_SHOW_SELECT = [...KNOWN_TEMPLATE_FIELDS];
 const DEFAULT_MEMBER_SELECT = ["id", "displayName"];
-const DEFAULT_SCOPED_LIST_SELECT = ["id", "principalId", "roleId", "directoryScopeId"];
+const DEFAULT_SCOPED_LIST_SELECT = ["id", "roleMemberInfo", "roleId", "administrativeUnitId"];
 const DEFAULT_SCOPED_SHOW_SELECT = [...KNOWN_SCOPED_MEMBER_FIELDS];
 export const DEFAULT_ROLE_SCOPES = ["https://graph.microsoft.com/RoleManagement.Read.Directory"];
 export const DEFAULT_ELIGIBLE_SCOPES = ["https://graph.microsoft.com/RoleEligibilitySchedule.Read.Directory"];

package/dist/graph-session.js

@@ -228,6 +228,15 @@ function checkOperation(operation) {
             "Resolve the operation from inventory/operations.json before executing it",
         ]);
     }
+    const unsupported = {
+        "/domainDnsRecords": ["mg-axi entra domain verification-dns-record list --domain <domain-id>", "mg-axi entra domain service-configuration-record list --domain <domain-id>"],
+        "/directoryObjects": ["mg-axi entra directory-object show --id <object-id>", "Use the named user, group, device, application or service-principal list command"],
+        "/scopedRoleMemberships": ["mg-axi entra directory-role scoped-member list --role <role-id>"],
+        "/scopedRoleMemberships/{scopedRoleMembership-id}": ["mg-axi entra directory-role scoped-member show --role <role-id> --id <scoped-membership-id>"],
+    };
+    const alternatives = unsupported[operation.path];
+    if (alternatives)
+        throw new AxiError(`GET ${operation.path} is not supported by Microsoft Graph v1.0`, "VALIDATION_ERROR", alternatives);
 }
 const UNSAFE_PARAM = /[%/?\\{}()]/;
 const CONTROL = /[\s\x00-\x1f\x7f]/;
@@ -446,10 +455,10 @@ function faultBody(body) {
     try {
         const parsed = redact(JSON.parse(body));
         const code = typeof parsed?.error?.code === "string" ? parsed.error.code : null;
-        if (!code)
-            return "";
         const message = typeof parsed?.error?.message === "string" ? parsed.error.message.slice(0, 300) : "";
-        return `: graph ${code}${message ? ` ${message}` : ""}`;
+        if (!code && !message)
+            return "";
+        return `: graph${code ? ` ${code}` : ""}${message ? ` ${message}` : ""}`;
     }
     catch {
         return "";
@@ -625,6 +634,7 @@ export class GraphSession {
         this.files = files;
     }
     cursorQuery(operation, cursor) {
+        checkOperation(operation);
         return decodeCursor(operation, cursor).query;
     }
     async execute(args) {
@@ -757,6 +767,7 @@ export class GraphSession {
         const headersFor = () => ({
             Authorization: `Bearer ${token}`,
             Accept: "application/json",
+            "Accept-Language": "en-US",
             "client-request-id": randomUUID(),
             ...(consistencyLevel === "eventual" ? { ConsistencyLevel: "eventual" } : {}),
         });
@@ -942,6 +953,7 @@ export class GraphSession {
         const headersFor = () => ({
             Authorization: `Bearer ${token}`,
             Accept: "application/json",
+            "Accept-Language": "en-US",
             "client-request-id": randomUUID(),
             ...(opts.consistencyLevel === "eventual" ? { ConsistencyLevel: "eventual" } : {}),
             // The branding GET documents Accept-Language as required; 0 selects

package/docs/coverage.md

@@ -316,9 +316,12 @@ The declined EXT-02c access-review history reads (ReadWrite least privilege, SAS
 | `mg-axi api get` | reviewed raw reads (see src/api.ts) | reviewed-raw-read catalogue | API-01 |
 | `mg-axi doctor` | bounded `GET:/users` health check | uses the named user-list read | PACK-01 |
 
+Graph v1.0 does not support the legacy `entra scoped-role-membership list/show`, `entra domain-dns-record list` or `entra directory-object list` routes; those commands fail locally with supported alternatives and their root routes are not available through `api get`.
+
 ## EXT-01 domain scope decisions
 
 Firstmate decision R1: approve narrowing this change to the eight v1.0 domain reads above.
+The root domain-dns-record list is now explicitly unsupported; use verification-dns-record or service-configuration-record list with a parent domain.
 The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.
 Federation stays out because it can carry signing-certificate material.
 Firstmate decision R2: keep the write-family status section as the coverage fix added to scope (resolved-kept).
@@ -644,10 +647,10 @@ Scalar counts need a separate query and response contract from the approved list
 
 ## EXT-01 directory-objects scope decisions
 
-This change covers the three v1.0 directory-object reads above (directory-object list, show and count).
+Directory-object show and count are available. Graph v1.0 rejects directory-object list; the legacy command fails locally and points to show or a typed list command.
 The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.
 Directory-object reads support v1.0 only; beta needs its own review.
-Delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads; the POST lookup and validation actions need their own request and projection review.
+Delta-token sync needs its own change-tracking contract beyond the approved show/count reads; the POST lookup and validation actions need their own request and projection review.
 Rows are polymorphic: only the base-type properties plus the @odata.type discriminator are projected, so subtype secrets or credentials can never appear.
 
 | Inventory operation | Disposition | Owning slice | Deferral reason |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/mg-axi",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Agent-facing Microsoft Graph CLI, read-only by default",
   "type": "module",
   "bin": {

package/skills/mg-axi/SKILL.md

@@ -26,6 +26,7 @@ Its capability label is `native` (implemented by an mg-axi handler).
 Its effect is `read` for Graph read leaves and the doctor health check, `write` for the gated named writes, or `local` for home, profile, auth, config path, login-alias and setup views.
 Doctor acquires credentials silently and contacts Graph; only its help view stays offline.
 The list below records current executable leaves; it makes no coverage claim for other Graph operations.
+Graph v1.0 does not support the legacy `entra scoped-role-membership list/show`, `entra domain-dns-record list` or `entra directory-object list` routes; those commands fail locally with supported alternatives and their root routes are not available through `api get`.
 See `docs/coverage.md` for the per-operation disposition records.
 `docs/coverage.md` and this file are generated from the same catalogue and inventory sources; `node tools/generate-docs.mjs --check` fails when they are stale.