@knowttl/mg-axi 0.1.0

package/dist/entra-federation-configurations.js

@@ -0,0 +1,290 @@
+import { AxiError } from "axi-sdk-js";
+// EXT-01 directory federation-configurations subfamily: the read mapping
+// behind `mg-axi entra federation-configuration list/show/count/available-types`.
+// Operation construction stays beside its command; the shared session owns
+// URLs, credentials, paging, retries and error translation, and the SDK owns
+// TOON rendering. This module only maps flags to session calls and projects
+// rows for compact output.
+//
+// Reviewed against the v1.0 samlorwsfedexternaldomainfederation-list,
+// samlorwsfedexternaldomainfederation-get and
+// identityproviderbase-availableprovidertypes operation documentation and
+// the samlOrWsFedExternalDomainFederation, samlOrWsFedProvider and
+// identityProviderBase resource references on 2026-10-05. List, get and
+// count take D/A Domain.Read.All least-privileged
+// (Domain.ReadWrite.All is the documented higher-privileged alternative);
+// available provider types take D/A IdentityProvider.Read.All
+// least-privileged (IdentityProvider.ReadWrite.All higher). Delegated
+// callers additionally need External Identity Provider Administrator, the
+// least-privileged supported role documented for these reads. Personal
+// Microsoft accounts are not supported. No per-operation licence
+// prerequisite is stated for these reads. Workforce context only: domain
+// federationConfiguration sub-reads (/domains/{id}/federationConfiguration),
+// the domains navigation property ($expand stays out), beta routes and every
+// mutation stay out. No mutation lives here.
+//
+// Secrecy by construction: federation configurations carry the public
+// token-signing certificate only, but the base64 `signingCertificate` blob
+// is omitted from every default select and returned only on an explicit
+// --select naming it, still under the truncation marker with a --full
+// escape hatch. No private key material exists on these resources.
+// Every federation-configuration property this slice may request or
+// display, matching the reviewed resource. The domains navigation property
+// needs its own read ($expand is not reviewed here). Anything else fails
+// before credentials.
+export const KNOWN_FEDERATION_FIELDS = [
+    "id",
+    "displayName",
+    "issuerUri",
+    "metadataExchangeUri",
+    "passiveSignInUri",
+    "preferredAuthenticationProtocol",
+    "signingCertificate",
+];
+const KNOWN_FEDERATIONS = new Set(KNOWN_FEDERATION_FIELDS);
+// @odata.type is preserved on federation rows without being selectable: it
+// names the derived configuration kind.
+const FEDERATION_TYPE_PROPERTY = "@odata.type";
+// Compact rows: identifier and name; the kind rides as @odata.type.
+const DEFAULT_LIST_SELECT = ["id", "displayName"];
+// Show rows: the full reviewed set except the public-certificate blob,
+// which needs an explicit --select naming it.
+const DEFAULT_SHOW_SELECT = KNOWN_FEDERATION_FIELDS.filter(field => field !== "signingCertificate");
+// Delegated defaults are operation-specific; application profiles use their
+// configured .default audience and reject --scopes.
+export const DEFAULT_FEDERATION_SCOPES = ["https://graph.microsoft.com/Domain.Read.All"];
+export const DEFAULT_FEDERATION_TYPES_SCOPES = ["https://graph.microsoft.com/IdentityProvider.Read.All"];
+const TRUNCATE_AT = 500;
+function fieldList(raw, flag, help) {
+    const parts = String(raw)
+        .split(",")
+        .map(part => part.trim())
+        .filter(part => part.length > 0);
+    if (!parts.length)
+        throw new AxiError(`--${flag} needs at least one property`, "VALIDATION_ERROR", [help]);
+    const fields = [];
+    for (const part of parts) {
+        if (!KNOWN_FEDERATIONS.has(part)) {
+            throw new AxiError(`Unknown federation-configuration property ${part} in --${flag}`, "VALIDATION_ERROR", [
+                help,
+                `Known federation-configuration properties: ${KNOWN_FEDERATION_FIELDS.join(", ")}`,
+            ]);
+        }
+        if (!fields.includes(part))
+            fields.push(part);
+    }
+    return fields;
+}
+function scopesFor(flags, defaults, profile, help) {
+    if (profile.mode === "application") {
+        if (flags.scopes !== undefined) {
+            throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", [help, "mg-axi profile show --profile <name>"]);
+        }
+        return undefined;
+    }
+    if (flags.scopes === undefined)
+        return [...defaults];
+    const scopes = String(flags.scopes)
+        .split(",")
+        .map(scope => scope.trim())
+        .filter(scope => scope.length > 0);
+    return scopes;
+}
+function truncateValue(value, full) {
+    const truncate = (text) => full || text.length <= TRUNCATE_AT
+        ? { value: text, truncated: false }
+        : { value: `${text.slice(0, TRUNCATE_AT)}... (truncated, ${text.length} chars total)`, truncated: true };
+    if (typeof value === "string")
+        return truncate(value);
+    if (Array.isArray(value) && value.every(entry => typeof entry === "string")) {
+        const projected = value.map(truncate);
+        return { value: projected.map(entry => entry.value), truncated: projected.some(entry => entry.truncated) };
+    }
+    return { value, truncated: false };
+}
+// Local projection preserves Graph's null/missing distinction: an explicit
+// null stays null, an absent property stays absent and is never synthesized.
+// @odata.type survives projection so the configuration kind is never lost.
+function project(row, fields, full) {
+    const source = row !== null && typeof row === "object" && !Array.isArray(row) ? row : {};
+    const projected = {};
+    let truncated = false;
+    for (const field of fields) {
+        if (!Object.hasOwn(source, field))
+            continue;
+        const result = truncateValue(source[field], full);
+        projected[field] = result.value;
+        truncated = truncated || result.truncated;
+    }
+    if (typeof source[FEDERATION_TYPE_PROPERTY] === "string")
+        projected[FEDERATION_TYPE_PROPERTY] = source[FEDERATION_TYPE_PROPERTY];
+    return { row: projected, truncated };
+}
+function selectedFields(flags, defaults, help) {
+    const select = flags.select === undefined ? [...defaults] : fieldList(flags.select, "select", help);
+    const fields = flags.fields === undefined ? [...select] : fieldList(flags.fields, "fields", help);
+    const missing = fields.find(field => !select.includes(field));
+    if (missing) {
+        throw new AxiError(`--fields ${missing} was not fetched; request it with --select`, "VALIDATION_ERROR", [help]);
+    }
+    return { select, fields };
+}
+function profileHint(profileName) {
+    return `--profile ${shellValue(profileName)}`;
+}
+function shellValue(value) {
+    return /^[A-Za-z0-9_.,:/@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function fullHint(command, flags, profileName) {
+    const args = Object.entries({ ...flags, profile: profileName, full: true })
+        .map(([name, value]) => value === true ? `--${name}` : `--${name} ${shellValue(String(value))}`);
+    return `mg-axi ${command} ${args.join(" ")}`;
+}
+// Denials carry the session's generic grant/role/licence cause; each
+// operation adds the scope, roles and licensing that actually unlock it,
+// because a 403 alone never says which prerequisite is missing.
+function withGuidance(hints, run) {
+    return run().catch(error => {
+        if (error instanceof AxiError && error.code === "GRAPH_ERROR" && /\(403\)/.test(error.message)) {
+            throw new AxiError(error.message, "GRAPH_ERROR", [...hints, ...error.suggestions]);
+        }
+        throw error;
+    });
+}
+const FEDERATION_DENIAL_HINTS = [
+    "Federation-configuration reads need Domain.Read.All least-privileged (Domain.ReadWrite.All is the documented higher-privileged alternative): delegated callers pass one as --scopes, application access needs admin-consented Domain.Read.All on the configured .default audience",
+    "Delegated callers additionally need External Identity Provider Administrator, the least-privileged supported Entra role for these reads",
+    "Personal Microsoft accounts are not supported for federation-configuration reads",
+    "No per-operation licence prerequisite is stated for these reads; never diagnose licence solely from HTTP 403",
+];
+const TYPES_DENIAL_HINTS = [
+    "Available provider types need IdentityProvider.Read.All least-privileged (IdentityProvider.ReadWrite.All is the documented higher-privileged alternative): delegated callers pass one as --scopes, application access needs admin-consented IdentityProvider.Read.All on the configured .default audience",
+    "Delegated callers additionally need External Identity Provider Administrator, the least-privileged supported Entra role for this read",
+    "Personal Microsoft accounts are not supported for available-types reads",
+    "No per-operation licence prerequisite is stated for this read; never diagnose licence solely from HTTP 403",
+];
+const WORKFORCE_NOTE = "Workforce tenant context only; domain federationConfiguration sub-reads and the domains navigation property belong to separate reviews and are never sent here";
+const CERT_BLOB_NOTE = "Public signing-certificate blobs are omitted by default; request signingCertificate explicitly with --select signingCertificate";
+export async function listFederationConfigurations(session, flags, profile, operation, help, profileName) {
+    const cursor = flags.cursor === undefined ? undefined : String(flags.cursor);
+    if (cursor !== undefined && !cursor.trim())
+        throw new AxiError("--cursor needs the opaque cursor from a partial result", "VALIDATION_ERROR", [help]);
+    const saved = cursor === undefined ? undefined : session.cursorQuery(operation, cursor);
+    const { select, fields } = selectedFields(flags, saved?.["$select"] === undefined ? DEFAULT_LIST_SELECT : fieldList(saved["$select"], "select", help), help);
+    const scopes = scopesFor(flags, DEFAULT_FEDERATION_SCOPES, profile, help);
+    const full = flags.full === true;
+    const query = { $select: select.join(",") };
+    const filter = flags.filter === undefined ? saved?.["$filter"] : String(flags.filter);
+    if (filter !== undefined)
+        query.$filter = filter;
+    const args = { profile, operation, query, scopes };
+    if (cursor !== undefined)
+        args.cursor = cursor;
+    if (flags.all === true) {
+        if (flags.limit !== undefined)
+            throw new AxiError("--limit and --all cannot be combined", "VALIDATION_ERROR", [help]);
+    }
+    else {
+        args.limit = flags.limit === undefined ? 100 : Number(flags.limit);
+    }
+    const result = await withGuidance(FEDERATION_DENIAL_HINTS, () => session.collect(args));
+    const effectiveFlags = { ...flags, select: result.query.$select ?? DEFAULT_LIST_SELECT.join(",") };
+    if (result.query.$filter !== undefined)
+        effectiveFlags.filter = result.query.$filter;
+    const configurations = [];
+    let truncated = false;
+    for (const row of result.value) {
+        const projected = project(row, fields, full);
+        configurations.push(projected.row);
+        truncated = truncated || projected.truncated;
+    }
+    const showHint = `mg-axi entra federation-configuration show --id <configuration-id> ${profileHint(profileName)}`;
+    const truncationHints = truncated ? [fullHint("entra federation-configuration list", effectiveFlags, profileName)] : [];
+    if (!result.complete) {
+        return {
+            federationConfigurations: configurations,
+            count: { returned: configurations.length, complete: false, reason: result.reason },
+            cursor: result.cursor,
+            help: [...truncationHints, `Resume losslessly with the same flags plus --cursor <cursor-from-output> ${profileHint(profileName)}`, showHint, CERT_BLOB_NOTE, WORKFORCE_NOTE],
+        };
+    }
+    const count = { returned: configurations.length, complete: true };
+    if (!configurations.length) {
+        return {
+            federationConfigurations: configurations,
+            count,
+            help: ["0 federation configurations matched; no SAML or WS-Fed federation is configured for the tenant, or no row passed --filter", CERT_BLOB_NOTE, WORKFORCE_NOTE],
+        };
+    }
+    return { federationConfigurations: configurations, count, help: [...truncationHints, showHint, CERT_BLOB_NOTE, WORKFORCE_NOTE] };
+}
+export async function showFederationConfiguration(session, flags, profile, operation, help, profileName) {
+    const { select, fields } = selectedFields(flags, DEFAULT_SHOW_SELECT, help);
+    const scopes = scopesFor(flags, DEFAULT_FEDERATION_SCOPES, profile, help);
+    const full = flags.full === true;
+    const id = String(flags.id);
+    if (!id.trim())
+        throw new AxiError("--id needs the federation-configuration object ID", "VALIDATION_ERROR", [help]);
+    const raw = await withGuidance(FEDERATION_DENIAL_HINTS, () => session.execute({
+        profile,
+        operation,
+        params: { "identityProviderBase-id": id },
+        query: { $select: select.join(",") },
+        scopes,
+    }));
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new AxiError("Graph returned a malformed federation-configuration body", "GRAPH_ERROR", [
+            "Single-configuration reads carry one federation configuration object; treat anything else as unknown, not empty",
+        ]);
+    }
+    const { row, truncated } = project(raw, fields, full);
+    const helpHints = [...(truncated ? [fullHint("entra federation-configuration show", flags, profileName)] : []), CERT_BLOB_NOTE, WORKFORCE_NOTE];
+    return { federationConfiguration: row, help: helpHints };
+}
+// The $count route returns a text/plain integer scalar rather than a JSON
+// collection, so the leaf reads it through session.execute with scalar mode
+// and accepts only a non-negative integer. --filter narrows the count
+// server-side; there is no --select/--limit/--cursor contract on the count.
+export async function countFederationConfigurations(session, flags, profile, operation, help, profileName) {
+    void profileName;
+    const scopes = scopesFor(flags, DEFAULT_FEDERATION_SCOPES, profile, help);
+    const query = {};
+    if (flags.filter !== undefined)
+        query.$filter = String(flags.filter);
+    const raw = await withGuidance(FEDERATION_DENIAL_HINTS, () => session.execute({
+        profile,
+        operation,
+        params: {},
+        query,
+        scopes,
+        scalar: true,
+    }));
+    if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 0) {
+        throw new AxiError("Graph returned a malformed federation-configuration count body", "GRAPH_ERROR", [
+            "Federation-configuration counts carry one non-negative integer scalar; treat anything else as unknown, not empty",
+        ]);
+    }
+    if (flags.filter !== undefined) {
+        return {
+            count: { returned: raw, complete: true },
+            help: [`Count reflects --filter ${shellValue(String(flags.filter))}; drop --filter for the tenant total`, WORKFORCE_NOTE],
+        };
+    }
+    return { count: { returned: raw, complete: true }, help: [WORKFORCE_NOTE] };
+}
+export async function availableFederationProviderTypes(session, flags, profile, operation, help) {
+    const scopes = scopesFor(flags, DEFAULT_FEDERATION_TYPES_SCOPES, profile, help);
+    const raw = await withGuidance(TYPES_DENIAL_HINTS, () => session.execute({ profile, operation, scopes }));
+    const value = raw !== null && typeof raw === "object" && !Array.isArray(raw)
+        ? raw.value : undefined;
+    if (!Array.isArray(value) || value.some(type => typeof type !== "string")) {
+        throw new AxiError("Graph returned a malformed available federation provider types body", "GRAPH_ERROR", [
+            "Available-provider-type reads carry a value array of strings; treat anything else as unknown, not empty",
+        ]);
+    }
+    return {
+        availableProviderTypes: value,
+        count: { returned: value.length, complete: true },
+        help: ["Available provider types depend on tenant configuration and licensing; availability does not mean a federation configuration exists", WORKFORCE_NOTE],
+    };
+}

package/dist/entra-grants.js

@@ -0,0 +1,272 @@
+import { AxiError } from "axi-sdk-js";
+// READ-08: the Entra consent-grant read mapping behind
+// `mg-axi entra service-principal oauth2-grant list` and
+// `mg-axi entra service-principal app-role-assignment list` for a named
+// service principal (the client). Operation construction stays beside its
+// command; the shared session owns URLs, credentials, paging, retries and
+// error translation, and the SDK owns TOON rendering. This module only maps
+// flags to session calls and projects rows for compact output.
+//
+// Reviewed against the v1.0 serviceprincipal-list-oauth2permissiongrants,
+// serviceprincipal-list-approleassignments, oauth2permissiongrant-resource
+// and approleassignment-resource operation documentation on 2026-10-04.
+// Delegated-grant reads take D/A Directory.Read.All; app-role reads take
+// D/A Application.Read.All. Delegated callers additionally need a supported
+// administrator role per operation. Reads never request a write-consent
+// scope such as DelegatedPermissionGrant.ReadWrite.All,
+// Application.ReadWrite.All or Directory.ReadWrite.All. Neither collection
+// documents an advanced-query contract, so --filter passes through as plain
+// $filter with no $count or ConsistencyLevel attached.
+//
+// The two views cover actual granted consent only: oauth2PermissionGrants
+// are the delegated scopes granted to the client (consentType AllPrincipals
+// for every user, Principal for one user named by principalId); an
+// appRoleAssignment whose principal is the named client is an app-only
+// grant of the resource API's app role. The application's requested
+// permissions (requiredResourceAccess) are declared on the application
+// object and are never shown here. Grant creation, revocation and consent
+// belong to later write slices, never to these reads. No P1/P2 prerequisite
+// is stated for these consent reads.
+// Delegated-grant rows carry the full reviewed oAuth2PermissionGrant set:
+// clientId is the authorizing client's object id (not appId).
+export const KNOWN_GRANT_FIELDS = [
+    "id",
+    "clientId",
+    "consentType",
+    "principalId",
+    "resourceId",
+    "scope",
+];
+// App-role rows carry the reviewed appRoleAssignment set minus
+// deletedDateTime: listed assignments are live records, and the deleted
+// timestamp is always null on them.
+export const KNOWN_APP_ROLE_FIELDS = [
+    "id",
+    "appRoleId",
+    "createdDateTime",
+    "principalDisplayName",
+    "principalId",
+    "principalType",
+    "resourceDisplayName",
+    "resourceId",
+];
+const GRANT_KNOWN = new Set(KNOWN_GRANT_FIELDS);
+const APP_ROLE_KNOWN = new Set(KNOWN_APP_ROLE_FIELDS);
+// Compact grant rows: the grant id, who it covers, which API it targets and
+// the granted scopes. clientId is constant for one client's list, while
+// principalId names the covered user on Principal grants and stays an
+// explicit null on AllPrincipals grants.
+const DEFAULT_GRANT_SELECT = ["id", "consentType", "principalId", "resourceId", "scope"];
+// Compact app-role rows: the assignment id, the granted role and the
+// resource API. principalId is constant for one client's list.
+const DEFAULT_APP_ROLE_SELECT = ["id", "appRoleId", "resourceDisplayName", "resourceId"];
+export const DEFAULT_GRANT_SCOPES = ["https://graph.microsoft.com/Directory.Read.All"];
+export const DEFAULT_APP_ROLE_SCOPES = ["https://graph.microsoft.com/Application.Read.All"];
+const TRUNCATE_AT = 500;
+// The only operations this slice ever binds. Anything else - grant creation,
+// revocation, consent, tenant-wide/user/group grant enumerations - is refused
+// before credentials.
+const READ_OPERATIONS = {
+    "GET:/servicePrincipals/{servicePrincipal-id}/oauth2PermissionGrants": "oauth2-grant",
+    "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignments": "app-role-assignment",
+};
+function checkReadOperation(operation, help) {
+    // Version stays the session's decision: beta reads remain preview-gated
+    // there, exactly like every other named slice. This gate only ensures a
+    // fabricated grant-mutating or unrelated route can never reach
+    // credentials.
+    const route = `${operation.method}:${operation.path}`;
+    if (operation.method !== "GET" || !Object.hasOwn(READ_OPERATIONS, route)) {
+        throw new AxiError(`Refused non-read route ${operation.id}: READ-08 serves only the two catalogued service-principal grant GETs`, "VALIDATION_ERROR", [
+            help,
+            "Grant creation, revocation and consent are never constructed here",
+        ]);
+    }
+}
+function fieldList(raw, flag, known, knownList, help) {
+    const parts = String(raw)
+        .split(",")
+        .map(part => part.trim())
+        .filter(part => part.length > 0);
+    if (!parts.length)
+        throw new AxiError(`--${flag} needs at least one property`, "VALIDATION_ERROR", [help]);
+    const fields = [];
+    for (const part of parts) {
+        if (!known.has(part)) {
+            throw new AxiError(`Unknown property ${part} in --${flag}`, "VALIDATION_ERROR", [
+                help,
+                `Known properties: ${knownList.join(", ")}`,
+            ]);
+        }
+        if (!fields.includes(part))
+            fields.push(part);
+    }
+    return fields;
+}
+function scopesFor(flags, profile, defaults, help) {
+    if (profile.mode === "application") {
+        if (flags.scopes !== undefined) {
+            throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", [help, "mg-axi profile show --profile <name>"]);
+        }
+        return undefined;
+    }
+    if (flags.scopes === undefined)
+        return [...defaults];
+    const scopes = String(flags.scopes)
+        .split(",")
+        .map(scope => scope.trim())
+        .filter(scope => scope.length > 0);
+    return scopes;
+}
+function truncateValue(value, full) {
+    if (typeof value === "string" && !full && value.length > TRUNCATE_AT) {
+        return { value: `${value.slice(0, TRUNCATE_AT)}... (truncated, ${value.length} chars total)`, truncated: true };
+    }
+    return { value, truncated: false };
+}
+// Local projection preserves Graph's null/missing distinction: an explicit
+// null (for example principalId on an AllPrincipals grant) stays null, an
+// absent property stays absent and is never synthesized.
+function project(row, fields, full) {
+    const source = row !== null && typeof row === "object" && !Array.isArray(row) ? row : {};
+    const projected = {};
+    let truncated = false;
+    for (const field of fields) {
+        if (!Object.hasOwn(source, field))
+            continue;
+        const result = truncateValue(source[field], full);
+        projected[field] = result.value;
+        truncated = truncated || result.truncated;
+    }
+    return { row: projected, truncated };
+}
+function selectedFields(flags, defaults, known, knownList, help) {
+    const select = flags.select === undefined ? [...defaults] : fieldList(flags.select, "select", known, knownList, help);
+    const fields = flags.fields === undefined ? [...select] : fieldList(flags.fields, "fields", known, knownList, help);
+    const missing = fields.find(field => !select.includes(field));
+    if (missing) {
+        throw new AxiError(`--fields ${missing} was not fetched; request it with --select`, "VALIDATION_ERROR", [help]);
+    }
+    return { select, fields };
+}
+function profileHint(profileName) {
+    return `--profile ${shellValue(profileName)}`;
+}
+function shellValue(value) {
+    return /^[A-Za-z0-9_.,:/@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function fullHint(command, flags, profileName) {
+    const args = Object.entries({ ...flags, profile: profileName, full: true })
+        .map(([name, value]) => value === true ? `--${name}` : `--${name} ${shellValue(String(value))}`);
+    return `mg-axi ${command} ${args.join(" ")}`;
+}
+// Denials carry the session's generic grant/role/licence cause; each
+// operation adds the roles and read scopes that actually unlock it, because
+// a 403 alone never says which prerequisite is missing. Write-consent
+// scopes are named only to warn against requesting them for reads.
+function withGuidance(hints, run) {
+    return run().catch(error => {
+        if (error instanceof AxiError && error.code === "GRAPH_ERROR" && /\(403\)/.test(error.message)) {
+            throw new AxiError(error.message, "GRAPH_ERROR", [...hints, ...error.suggestions]);
+        }
+        throw error;
+    });
+}
+const GRANT_DENIAL_HINTS = [
+    "Delegated-grant reads need Directory.Read.All plus a supported directory role (for example Directory Readers, Global Reader or Application Administrator) for delegated access, or admin-consented Directory.Read.All for application access; reads never request DelegatedPermissionGrant.ReadWrite.All or Directory.ReadWrite.All",
+];
+const APP_ROLE_DENIAL_HINTS = [
+    "App-role reads need Application.Read.All plus a supported directory role (for example Directory Readers, Application Administrator or Cloud Application Administrator) for delegated access, or admin-consented Application.Read.All for application access; reads never request Application.ReadWrite.All or Directory.ReadWrite.All",
+];
+const OAUTH2_GRANT_LIST = {
+    command: "entra service-principal oauth2-grant list",
+    key: "oauth2PermissionGrants",
+    known: GRANT_KNOWN,
+    knownList: KNOWN_GRANT_FIELDS,
+    defaultSelect: DEFAULT_GRANT_SELECT,
+    defaultScopes: DEFAULT_GRANT_SCOPES,
+    denialHints: GRANT_DENIAL_HINTS,
+    scopeNote: "These rows are granted delegated consent for the named client; the application's requested permissions (requiredResourceAccess) are declared on the application object and are not shown here",
+    emptyNote: "0 delegated grants matched; the absence of results is the answer, not an error",
+};
+const APP_ROLE_LIST = {
+    command: "entra service-principal app-role-assignment list",
+    key: "appRoleAssignments",
+    known: APP_ROLE_KNOWN,
+    knownList: KNOWN_APP_ROLE_FIELDS,
+    defaultSelect: DEFAULT_APP_ROLE_SELECT,
+    defaultScopes: DEFAULT_APP_ROLE_SCOPES,
+    denialHints: APP_ROLE_DENIAL_HINTS,
+    scopeNote: "These rows are granted app-only consent for the named client; the application's requested permissions (requiredResourceAccess) are declared on the application object and are not shown here",
+    emptyNote: "0 app-role assignments matched; the absence of results is the answer, not an error",
+};
+async function listCollection(shape, session, flags, profile, operation, help, profileName) {
+    checkReadOperation(operation, help);
+    const client = String(flags["service-principal"] ?? "");
+    if (!client.trim())
+        throw new AxiError("--service-principal needs the client service-principal object ID", "VALIDATION_ERROR", [help]);
+    const cursor = flags.cursor === undefined ? undefined : String(flags.cursor);
+    if (cursor !== undefined && !cursor.trim())
+        throw new AxiError("--cursor needs the opaque cursor from a partial result", "VALIDATION_ERROR", [help]);
+    const saved = cursor === undefined ? undefined : session.cursorQuery(operation, cursor);
+    const savedSelect = saved?.$select;
+    const { select, fields } = selectedFields(flags, savedSelect === undefined ? shape.defaultSelect : fieldList(savedSelect, "select", shape.known, shape.knownList, help), shape.known, shape.knownList, help);
+    const savedFilter = saved?.$filter;
+    const filter = flags.filter === undefined ? savedFilter : String(flags.filter);
+    const scopes = scopesFor(flags, profile, shape.defaultScopes, help);
+    const full = flags.full === true;
+    // These collections document $select/$filter only, so --filter passes
+    // through as plain $filter with no $count or ConsistencyLevel.
+    const query = { $select: select.join(",") };
+    if (filter !== undefined)
+        query.$filter = filter;
+    const args = {
+        profile,
+        operation,
+        params: { "servicePrincipal-id": client },
+        query,
+        scopes,
+    };
+    if (cursor !== undefined)
+        args.cursor = cursor;
+    if (flags.all === true) {
+        if (flags.limit !== undefined)
+            throw new AxiError("--limit and --all cannot be combined", "VALIDATION_ERROR", [help]);
+    }
+    else {
+        args.limit = flags.limit === undefined ? 100 : Number(flags.limit);
+    }
+    const result = await withGuidance(shape.denialHints, () => session.collect(args));
+    const effectiveFlags = { ...flags, select: result.query.$select ?? shape.defaultSelect.join(",") };
+    if (result.query.$filter !== undefined)
+        effectiveFlags.filter = result.query.$filter;
+    const rows = [];
+    let truncated = false;
+    for (const row of result.value) {
+        const projected = project(row, fields, full);
+        rows.push(projected.row);
+        truncated = truncated || projected.truncated;
+    }
+    const clientHint = `mg-axi entra service-principal show --id ${shellValue(client)} ${profileHint(profileName)}`;
+    const truncationHints = truncated ? [fullHint(shape.command, effectiveFlags, profileName)] : [];
+    const standing = [shape.scopeNote, clientHint];
+    if (!result.complete) {
+        return {
+            [shape.key]: rows,
+            count: { returned: rows.length, complete: false, reason: result.reason },
+            cursor: result.cursor,
+            help: [...truncationHints, `Resume losslessly with the same flags plus --cursor <cursor-from-output> ${profileHint(profileName)}`, ...standing],
+        };
+    }
+    const count = { returned: rows.length, complete: true };
+    if (!rows.length) {
+        return { [shape.key]: rows, count, help: [shape.emptyNote, ...standing] };
+    }
+    return { [shape.key]: rows, count, help: [...truncationHints, ...standing] };
+}
+export async function listOAuth2Grants(session, flags, profile, operation, help, profileName) {
+    return listCollection(OAUTH2_GRANT_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function listAppRoleAssignments(session, flags, profile, operation, help, profileName) {
+    return listCollection(APP_ROLE_LIST, session, flags, profile, operation, help, profileName);
+}