@knowttl/mg-axi 0.1.0

package/dist/entra-groups.js

@@ -0,0 +1,336 @@
+import { AxiError } from "axi-sdk-js";
+// READ-02: the Entra group read mapping behind `mg-axi entra group list/show`
+// and `mg-axi entra group member list` / `member-of list` (each with an
+// opt-in `--transitive` flat view). Operation construction stays beside its
+// command; the shared session owns URLs, credentials, paging, retries and
+// error translation, and the SDK owns TOON rendering. This module only maps
+// flags to session calls and projects rows for compact output.
+//
+// Reviewed against the v1.0 group-list, group-get, group-list-members,
+// group-list-transitivemembers, group-list-memberof and
+// group-list-transitivememberof operation documentation on 2026-10-04.
+// Group list/get upstream tables currently mark the write permission
+// Group-NestingSupport.ReadWrite.All least-privileged; the review records the
+// supported read alternatives instead (GroupMember.Read.All for basics,
+// Group.Read.All for further properties). Member and memberOf reads take
+// GroupMember.ReadBasic.All minimum and GroupMember.Read.All for richer
+// access; hidden-membership groups additionally need Member.Read.Hidden and,
+// for delegated callers, a supported role with hidden-member read permission.
+// The server omits hidden members it will not disclose rather than failing,
+// so completion describes pagination, never visibility. Application callers
+// with narrow consent receive limited-information rows carrying only
+// @odata.type and id with other properties null; those rows are preserved,
+// never reinterpreted as empty. The v1.0 members route has a known issue
+// omitting service principals; the documented workarounds are beta or
+// $expand, and neither is used silently here - the limitation rides along as
+// an explicit warning instead. Role-assignable groups surface through
+// isAssignableToRole; changing their membership needs role-management
+// permission and is refused by the membership write
+// (`mg-axi entra group member add`); it belongs to a later write slice.
+// Every group property this slice may request or display, matching the
+// reviewed raw surface. Anything else fails before credentials.
+export const KNOWN_GROUP_FIELDS = [
+    "id",
+    "displayName",
+    "description",
+    "mail",
+    "mailEnabled",
+    "mailNickname",
+    "securityEnabled",
+    "groupTypes",
+    "visibility",
+    "classification",
+    "isAssignableToRole",
+    "createdDateTime",
+    "expirationDateTime",
+    "renewedDateTime",
+    "membershipRule",
+    "membershipRuleProcessingState",
+];
+const KNOWN_GROUPS = new Set(KNOWN_GROUP_FIELDS);
+// Relationship rows are directoryObjects of mixed types; richer per-type
+// member fields need single-object reads, so only these stay selectable.
+export const KNOWN_MEMBER_FIELDS = ["id", "displayName", "mail"];
+const KNOWN_MEMBERS = new Set(KNOWN_MEMBER_FIELDS);
+// @odata.type is preserved on relationship rows without being selectable: it
+// names the member kind and marks limited-information rows.
+const MEMBER_TYPE_PROPERTY = "@odata.type";
+// Compact group rows: identifier, display name, address and kind.
+const DEFAULT_LIST_SELECT = ["id", "displayName", "mail", "groupTypes"];
+// Show rows: the full reviewed group set, including the role-assignable flag.
+const DEFAULT_SHOW_SELECT = [...KNOWN_GROUP_FIELDS];
+// Compact relationship rows: identifier and display name.
+const DEFAULT_MEMBER_SELECT = ["id", "displayName"];
+// GroupMember.Read.All covers group basics and member reads in both modes;
+// hidden members need Member.Read.Hidden and richer group properties may
+// need Group.Read.All, both passed explicitly via --scopes.
+export const DEFAULT_DELEGATED_SCOPES = ["https://graph.microsoft.com/GroupMember.Read.All"];
+const TRUNCATE_AT = 500;
+// Direct relationship operation to its transitive flat-view counterpart.
+// --transitive selects between these two catalogued routes; beta and $expand
+// workarounds are never selected implicitly.
+export const TRANSITIVE_OPERATION = {
+    "GET:/groups/{group-id}/members": "GET:/groups/{group-id}/transitiveMembers",
+    "GET:/groups/{group-id}/memberOf": "GET:/groups/{group-id}/transitiveMemberOf",
+};
+// Sourced v1.0 limitation: service principals may be absent from direct
+// member results even when pagination completes.
+export const SERVICE_PRINCIPAL_WARNING = "Microsoft Graph v1.0 may omit service principals from group members; completed pagination does not establish complete membership.";
+function fieldList(raw, known, knownList, flag, help) {
+    const parts = String(raw)
+        .split(",")
+        .map(part => part.trim())
+        .filter(part => part.length > 0);
+    if (!parts.length)
+        throw new AxiError(`--${flag} needs at least one property`, "VALIDATION_ERROR", [help]);
+    const fields = [];
+    for (const part of parts) {
+        if (!known.has(part)) {
+            throw new AxiError(`Unknown group property ${part} in --${flag}`, "VALIDATION_ERROR", [
+                help,
+                `Known group properties: ${knownList.join(", ")}`,
+            ]);
+        }
+        if (!fields.includes(part))
+            fields.push(part);
+    }
+    return fields;
+}
+function scopesFor(flags, profile, help) {
+    if (profile.mode === "application") {
+        if (flags.scopes !== undefined) {
+            throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", [help, "mg-axi profile show --profile <name>"]);
+        }
+        return undefined;
+    }
+    if (flags.scopes === undefined)
+        return [...DEFAULT_DELEGATED_SCOPES];
+    const scopes = String(flags.scopes)
+        .split(",")
+        .map(scope => scope.trim())
+        .filter(scope => scope.length > 0);
+    return scopes;
+}
+function truncateValue(value, full) {
+    const truncate = (text) => full || text.length <= TRUNCATE_AT
+        ? { value: text, truncated: false }
+        : { value: `${text.slice(0, TRUNCATE_AT)}... (truncated, ${text.length} chars total)`, truncated: true };
+    if (typeof value === "string")
+        return truncate(value);
+    if (Array.isArray(value) && value.every(entry => typeof entry === "string")) {
+        const projected = value.map(truncate);
+        return { value: projected.map(entry => entry.value), truncated: projected.some(entry => entry.truncated) };
+    }
+    return { value, truncated: false };
+}
+// Local projection preserves Graph's null/missing distinction: an explicit
+// null stays null, an absent property stays absent and is never synthesized.
+function project(row, fields, full) {
+    const source = row !== null && typeof row === "object" && !Array.isArray(row) ? row : {};
+    const projected = {};
+    let truncated = false;
+    for (const field of fields) {
+        if (!Object.hasOwn(source, field))
+            continue;
+        const result = truncateValue(source[field], full);
+        projected[field] = result.value;
+        truncated = truncated || result.truncated;
+    }
+    return { row: projected, truncated };
+}
+// Relationship projection additionally preserves @odata.type so the member
+// kind and limited-information rows survive local projection.
+function projectMember(row, select, fields, full) {
+    const { row: projected, truncated } = project(row, fields, full);
+    const source = row !== null && typeof row === "object" && !Array.isArray(row) ? row : {};
+    if (typeof source[MEMBER_TYPE_PROPERTY] === "string")
+        projected[MEMBER_TYPE_PROPERTY] = source[MEMBER_TYPE_PROPERTY];
+    const descriptive = [...new Set([...select, ...Object.keys(source)])]
+        .filter(field => field !== "id" && !field.startsWith("@"));
+    const limitedInfo = Object.hasOwn(source, "id") && descriptive.length > 0
+        && descriptive.every(field => source[field] === null || source[field] === undefined || !Object.hasOwn(source, field));
+    return { row: projected, truncated, limitedInfo };
+}
+function selectedFields(flags, known, knownList, defaults, help) {
+    const select = flags.select === undefined ? [...defaults] : fieldList(flags.select, known, knownList, "select", help);
+    const fields = flags.fields === undefined ? [...select] : fieldList(flags.fields, known, knownList, "fields", help);
+    const missing = fields.find(field => !select.includes(field));
+    if (missing) {
+        throw new AxiError(`--fields ${missing} was not fetched; request it with --select`, "VALIDATION_ERROR", [help]);
+    }
+    return { select, fields };
+}
+function profileHint(profileName) {
+    return `--profile ${shellValue(profileName)}`;
+}
+function shellValue(value) {
+    return /^[A-Za-z0-9_.,:/@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function fullHint(command, flags, profileName) {
+    const args = Object.entries({ ...flags, profile: profileName, full: true })
+        .map(([name, value]) => value === true ? `--${name}` : `--${name} ${shellValue(String(value))}`);
+    return `mg-axi ${command} ${args.join(" ")}`;
+}
+// Relationship $filter runs through advanced query on every group route:
+// $filter on members/memberOf/transitive collections requires
+// ConsistencyLevel eventual, and group list tolerates it, so an effective
+// filter always carries eventual consistency. Restoring the saved filter
+// keeps cursor resumes lossless when --filter is omitted.
+function collectionCommon(session, flags, known, knownList, defaults, operation, help, profile) {
+    const cursor = flags.cursor === undefined ? undefined : String(flags.cursor);
+    if (cursor !== undefined && !cursor.trim())
+        throw new AxiError("--cursor needs the opaque cursor from a partial result", "VALIDATION_ERROR", [help]);
+    const saved = cursor === undefined ? undefined : session.cursorQuery(operation, cursor);
+    const { select, fields } = selectedFields(flags, known, knownList, saved?.["$select"] === undefined ? defaults : fieldList(saved["$select"], known, knownList, "select", help), help);
+    const filter = flags.filter === undefined ? saved?.["$filter"] : String(flags.filter);
+    return { cursor, select, fields, scopes: scopesFor(flags, profile, help), full: flags.full === true, filter };
+}
+function collectArgs(profile, operation, common, flags, help) {
+    const query = { $select: common.select.join(",") };
+    if (common.filter !== undefined) {
+        query.$filter = common.filter;
+        query.$count = "true";
+    }
+    const args = { profile, operation, query, scopes: common.scopes };
+    if (common.filter !== undefined)
+        args.consistencyLevel = "eventual";
+    if (common.cursor !== undefined)
+        args.cursor = common.cursor;
+    if (flags.all === true) {
+        if (flags.limit !== undefined)
+            throw new AxiError("--limit and --all cannot be combined", "VALIDATION_ERROR", [help]);
+    }
+    else {
+        args.limit = flags.limit === undefined ? 100 : Number(flags.limit);
+    }
+    return args;
+}
+function resumeHint(profileName) {
+    return `Resume losslessly with the same flags plus --cursor <cursor-from-output> ${profileHint(profileName)}`;
+}
+export async function listGroups(session, flags, profile, operation, help, profileName) {
+    const common = collectionCommon(session, flags, KNOWN_GROUPS, KNOWN_GROUP_FIELDS, DEFAULT_LIST_SELECT, operation, help, profile);
+    const result = await session.collect(collectArgs(profile, operation, common, flags, help));
+    const effectiveFlags = { ...flags, select: result.query.$select ?? DEFAULT_LIST_SELECT.join(",") };
+    if (result.query.$filter !== undefined)
+        effectiveFlags.filter = result.query.$filter;
+    const groups = [];
+    let truncated = false;
+    for (const row of result.value) {
+        const projected = project(row, common.fields, common.full);
+        groups.push(projected.row);
+        truncated = truncated || projected.truncated;
+    }
+    const showHint = `mg-axi entra group show --id <group-id> ${profileHint(profileName)}`;
+    const truncationHints = truncated ? [fullHint("entra group list", effectiveFlags, profileName)] : [];
+    if (!result.complete) {
+        return {
+            groups,
+            count: { returned: groups.length, complete: false, reason: result.reason },
+            cursor: result.cursor,
+            help: [...truncationHints, resumeHint(profileName), showHint],
+        };
+    }
+    const count = { returned: groups.length, complete: true };
+    if (!groups.length) {
+        return {
+            groups,
+            count,
+            help: [
+                `mg-axi entra group list --filter <odata-filter> ${profileHint(profileName)}`,
+                "0 groups matched; the absence of results is the answer, not an error",
+            ],
+        };
+    }
+    return { groups, count, help: [...truncationHints, showHint] };
+}
+export async function showGroup(session, flags, profile, operation, help, profileName) {
+    const { select, fields } = selectedFields(flags, KNOWN_GROUPS, KNOWN_GROUP_FIELDS, DEFAULT_SHOW_SELECT, help);
+    const scopes = scopesFor(flags, profile, help);
+    const full = flags.full === true;
+    const raw = await session.execute({
+        profile,
+        operation,
+        params: { "group-id": String(flags.id) },
+        query: { $select: select.join(",") },
+        scopes,
+    });
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new AxiError("Graph returned a malformed group body", "GRAPH_ERROR", [
+            "Single-group reads carry one group object; treat anything else as unknown, not empty",
+        ]);
+    }
+    const { row, truncated } = project(raw, fields, full);
+    const helpHints = truncated ? [fullHint("entra group show", flags, profileName)] : [];
+    if (row["isAssignableToRole"] === true) {
+        helpHints.push("Role-assignable group: `mg-axi entra group member add` supports non-role-assignable groups only; role-assignable membership needs role-management permission and belongs to a later slice, never to this read");
+    }
+    if (helpHints.length)
+        return { group: row, help: helpHints };
+    return { group: row };
+}
+async function listRelationship(session, flags, profile, operation, help, profileName, command, key, emptyNoun, transitive, directWarning) {
+    const group = String(flags.group);
+    if (!group.trim())
+        throw new AxiError("--group needs the group object ID", "VALIDATION_ERROR", [help]);
+    const common = collectionCommon(session, flags, KNOWN_MEMBERS, KNOWN_MEMBER_FIELDS, DEFAULT_MEMBER_SELECT, operation, help, profile);
+    const args = collectArgs(profile, operation, common, flags, help);
+    args.params = { "group-id": group };
+    const result = await session.collect(args);
+    const effectiveFlags = { ...flags, select: result.query.$select ?? DEFAULT_MEMBER_SELECT.join(",") };
+    if (result.query.$filter !== undefined)
+        effectiveFlags.filter = result.query.$filter;
+    const rows = [];
+    let truncated = false;
+    let limitedInfo = 0;
+    for (const row of result.value) {
+        const projected = projectMember(row, common.select, common.fields, common.full);
+        rows.push(projected.row);
+        truncated = truncated || projected.truncated;
+        if (projected.limitedInfo)
+            limitedInfo += 1;
+    }
+    const scopeHint = transitive
+        ? `Direct relationships only: mg-axi ${command} --group ${shellValue(group)} ${profileHint(profileName)}`
+        : `Flat nested view: mg-axi ${command} --group ${shellValue(group)} --transitive ${profileHint(profileName)}`;
+    const truncationHints = truncated ? [fullHint(command, effectiveFlags, profileName)] : [];
+    const limitedHints = limitedInfo > 0
+        ? [`${limitedInfo} of ${rows.length} rows have no non-null selected descriptive properties; this may reflect limited read consent or unset properties`]
+        : [];
+    const hiddenHint = "Hidden members are omitted without Member.Read.Hidden; completion describes pagination, not visibility";
+    const warnings = directWarning === undefined ? undefined : { warnings: [directWarning] };
+    if (!result.complete) {
+        return {
+            [key]: rows,
+            count: { returned: rows.length, complete: false, reason: result.reason },
+            cursor: result.cursor,
+            ...warnings,
+            help: [...truncationHints, ...limitedHints, hiddenHint, resumeHint(profileName), scopeHint],
+        };
+    }
+    const count = { returned: rows.length, complete: true };
+    if (!rows.length) {
+        return {
+            [key]: rows,
+            count,
+            ...warnings,
+            help: [
+                ...limitedHints,
+                hiddenHint,
+                `0 ${emptyNoun} matched; the absence of results is the answer, not an error`,
+                scopeHint,
+            ],
+        };
+    }
+    return { [key]: rows, count, ...warnings, help: [...truncationHints, ...limitedHints, hiddenHint, scopeHint] };
+}
+export async function listGroupMembers(session, flags, profile, operation, help, profileName) {
+    const transitive = flags.transitive === true;
+    // The v1.0 service-principal omission is sourced for direct members only;
+    // transitive results carry no such claim.
+    return listRelationship(session, flags, profile, operation, help, profileName, "entra group member list", "members", "members", transitive, transitive ? undefined : SERVICE_PRINCIPAL_WARNING);
+}
+export async function listGroupMemberOf(session, flags, profile, operation, help, profileName) {
+    const transitive = flags.transitive === true;
+    return listRelationship(session, flags, profile, operation, help, profileName, "entra group member-of list", "memberOf", "memberships", transitive, undefined);
+}

package/dist/entra-identity-providers.js

@@ -0,0 +1,297 @@
+import { AxiError } from "axi-sdk-js";
+// EXT-03 workforce identity-providers subfamily: the read mapping behind
+// `mg-axi entra identity-provider list/show/count/available-types`. Operation construction
+// stays beside its command; the shared session owns URLs, credentials,
+// paging, retries and error translation, and the SDK owns TOON rendering.
+// This module only maps flags to session calls and projects rows for compact
+// output.
+//
+// Reviewed against the v1.0 identitycontainer-list-identityproviders,
+// identityproviderbase-get and identityproviderbase-availableprovidertypes
+// operation documentation cited in inventory/operations.json on 2026-10-04.
+// List, get and count take D/A IdentityProvider.Read.All; delegated callers
+// additionally need a directory role that can read federation configuration
+// (Global Reader is the least-privileged read-only directory role).
+// Personal Microsoft accounts are not supported. No per-operation licence
+// prerequisite is stated for these reads; available provider types follow
+// the tenant's external-identities configuration. Workforce context only:
+// external-customer (B2C/External ID) user flows, authentication event
+// flows, invitations, cross-tenant access, trust framework and provisioning
+// are separate later EXT-03 pieces and no support for them is claimed here.
+// No mutation lives here.
+//
+// Secrecy by construction: clientSecret (write-only on social providers)
+// and certificateData (key material on Apple providers) are not selectable,
+// so --select/--fields naming them fails before credentials, and rows the
+// server returns carrying either key are scrubbed before projection. Secrets
+// therefore can never reach stdout, errors, previews or logs through this
+// slice. @odata.type is preserved on every row without being selectable: it
+// names the provider kind (for example
+// #microsoft.graph.socialIdentityProvider).
+// Every provider property this slice may request or display, matching the
+// reviewed raw surface. Anything else fails before credentials. The base
+// properties ride on every row; the remaining properties are returned by the
+// server only on rows of that provider kind.
+export const KNOWN_PROVIDER_FIELDS = [
+    "id",
+    "displayName",
+    "identityProviderType",
+    "clientId",
+];
+const KNOWN_PROVIDERS = new Set(KNOWN_PROVIDER_FIELDS);
+// @odata.type is preserved on provider rows without being selectable: it
+// names the derived provider kind.
+const PROVIDER_TYPE_PROPERTY = "@odata.type";
+// Secret-bearing keys are never selectable and never projected. The server
+// is not expected to return them on GET, but any row carrying them is
+// scrubbed before projection so key material can never reach output.
+const SECRET_PROVIDER_FIELDS = ["clientSecret", "certificateData"];
+// Compact rows: identifier and name; the kind rides as @odata.type.
+const DEFAULT_LIST_SELECT = ["id", "displayName"];
+// Show rows: the full reviewed provider set.
+const DEFAULT_SHOW_SELECT = [...KNOWN_PROVIDER_FIELDS];
+// Delegated defaults are operation-specific; application profiles use their
+// configured .default audience and reject --scopes.
+export const DEFAULT_PROVIDER_SCOPES = ["https://graph.microsoft.com/IdentityProvider.Read.All"];
+const TRUNCATE_AT = 500;
+function fieldList(raw, flag, help) {
+    const parts = String(raw)
+        .split(",")
+        .map(part => part.trim())
+        .filter(part => part.length > 0);
+    if (!parts.length)
+        throw new AxiError(`--${flag} needs at least one property`, "VALIDATION_ERROR", [help]);
+    const fields = [];
+    for (const part of parts) {
+        if (!KNOWN_PROVIDERS.has(part)) {
+            const secret = SECRET_PROVIDER_FIELDS.includes(part);
+            throw new AxiError(secret
+                ? `--${flag} cannot request ${part}: secret-bearing provider fields are never returned`
+                : `Unknown provider property ${part} in --${flag}`, "VALIDATION_ERROR", [
+                help,
+                `Known provider properties: ${KNOWN_PROVIDER_FIELDS.join(", ")}`,
+            ]);
+        }
+        if (!fields.includes(part))
+            fields.push(part);
+    }
+    return fields;
+}
+function scopesFor(flags, profile, help) {
+    if (profile.mode === "application") {
+        if (flags.scopes !== undefined) {
+            throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", [help, "mg-axi profile show --profile <name>"]);
+        }
+        return undefined;
+    }
+    if (flags.scopes === undefined)
+        return [...DEFAULT_PROVIDER_SCOPES];
+    const scopes = String(flags.scopes)
+        .split(",")
+        .map(scope => scope.trim())
+        .filter(scope => scope.length > 0);
+    return scopes;
+}
+function truncateValue(value, full) {
+    const truncate = (text) => full || text.length <= TRUNCATE_AT
+        ? { value: text, truncated: false }
+        : { value: `${text.slice(0, TRUNCATE_AT)}... (truncated, ${text.length} chars total)`, truncated: true };
+    if (typeof value === "string")
+        return truncate(value);
+    if (Array.isArray(value)) {
+        const projected = value.map(entry => truncateValue(entry, full));
+        return { value: projected.map(entry => entry.value), truncated: projected.some(entry => entry.truncated) };
+    }
+    if (value !== null && typeof value === "object") {
+        const projected = Object.entries(value).map(([key, entry]) => [key, truncateValue(entry, full)]);
+        return {
+            value: Object.fromEntries(projected.map(([key, entry]) => [key, entry.value])),
+            truncated: projected.some(([, entry]) => entry.truncated),
+        };
+    }
+    return { value, truncated: false };
+}
+// Scrubbing runs before projection: any secret-bearing key the server
+// returned is dropped so it can never be selected, rendered or leaked.
+function scrub(row) {
+    const source = row !== null && typeof row === "object" && !Array.isArray(row) ? row : {};
+    const cleaned = {};
+    for (const [key, value] of Object.entries(source)) {
+        if (SECRET_PROVIDER_FIELDS.includes(key))
+            continue;
+        cleaned[key] = value;
+    }
+    return cleaned;
+}
+// Local projection preserves Graph's null/missing distinction: an explicit
+// null stays null, an absent property stays absent and is never synthesized.
+// @odata.type survives projection so the provider kind is never lost.
+function project(row, fields, full) {
+    const source = scrub(row);
+    const projected = {};
+    let truncated = false;
+    for (const field of fields) {
+        if (!Object.hasOwn(source, field))
+            continue;
+        const result = truncateValue(source[field], full);
+        projected[field] = result.value;
+        truncated = truncated || result.truncated;
+    }
+    if (typeof source[PROVIDER_TYPE_PROPERTY] === "string")
+        projected[PROVIDER_TYPE_PROPERTY] = source[PROVIDER_TYPE_PROPERTY];
+    return { row: projected, truncated };
+}
+function selectedFields(flags, defaults, help) {
+    const select = flags.select === undefined ? [...defaults] : fieldList(flags.select, "select", help);
+    const fields = flags.fields === undefined ? [...select] : fieldList(flags.fields, "fields", help);
+    const missing = fields.find(field => !select.includes(field));
+    if (missing) {
+        throw new AxiError(`--fields ${missing} was not fetched; request it with --select`, "VALIDATION_ERROR", [help]);
+    }
+    return { select, fields };
+}
+function profileHint(profileName) {
+    return `--profile ${shellValue(profileName)}`;
+}
+function shellValue(value) {
+    return /^[A-Za-z0-9_.,:/@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function fullHint(command, flags, profileName) {
+    const args = Object.entries({ ...flags, profile: profileName, full: true })
+        .map(([name, value]) => value === true ? `--${name}` : `--${name} ${shellValue(String(value))}`);
+    return `mg-axi ${command} ${args.join(" ")}`;
+}
+// Denials carry the session's generic grant/role/licence cause; provider
+// reads add the scope, roles and licensing that actually unlock them,
+// because a 403 alone never says which prerequisite is missing.
+function withGuidance(hints, run) {
+    return run().catch(error => {
+        if (error instanceof AxiError && error.code === "GRAPH_ERROR" && /\(403\)/.test(error.message)) {
+            throw new AxiError(error.message, "GRAPH_ERROR", [...hints, ...error.suggestions]);
+        }
+        throw error;
+    });
+}
+const PROVIDER_DENIAL_HINTS = [
+    "Identity-provider reads need IdentityProvider.Read.All: delegated callers pass it as --scopes, application access needs admin-consented IdentityProvider.Read.All on the configured .default audience",
+    "Delegated callers additionally need a directory role that can read federation configuration (Global Reader is the least-privileged read-only directory role)",
+    "Personal Microsoft accounts are not supported for identity-provider reads",
+    "No per-operation licence prerequisite is stated for these reads; never diagnose licence solely from HTTP 403",
+];
+const WORKFORCE_NOTE = "Workforce tenant context only; external-customer (B2C/External ID) user flows are separate scheduled operations";
+export async function listIdentityProviders(session, flags, profile, operation, help, profileName) {
+    const cursor = flags.cursor === undefined ? undefined : String(flags.cursor);
+    if (cursor !== undefined && !cursor.trim())
+        throw new AxiError("--cursor needs the opaque cursor from a partial result", "VALIDATION_ERROR", [help]);
+    const saved = cursor === undefined ? undefined : session.cursorQuery(operation, cursor);
+    const { select, fields } = selectedFields(flags, saved?.["$select"] === undefined ? DEFAULT_LIST_SELECT : fieldList(saved["$select"], "select", help), help);
+    const scopes = scopesFor(flags, profile, help);
+    const full = flags.full === true;
+    const query = { $select: select.join(",") };
+    const filter = flags.filter === undefined ? saved?.["$filter"] : String(flags.filter);
+    if (filter !== undefined)
+        query.$filter = filter;
+    const args = { profile, operation, query, scopes };
+    if (cursor !== undefined)
+        args.cursor = cursor;
+    if (flags.all === true) {
+        if (flags.limit !== undefined)
+            throw new AxiError("--limit and --all cannot be combined", "VALIDATION_ERROR", [help]);
+    }
+    else {
+        args.limit = flags.limit === undefined ? 100 : Number(flags.limit);
+    }
+    const result = await withGuidance(PROVIDER_DENIAL_HINTS, () => session.collect(args));
+    const effectiveFlags = { ...flags, select: result.query.$select ?? DEFAULT_LIST_SELECT.join(",") };
+    if (result.query.$filter !== undefined)
+        effectiveFlags.filter = result.query.$filter;
+    const providers = [];
+    let truncated = false;
+    for (const row of result.value) {
+        const projected = project(row, fields, full);
+        providers.push(projected.row);
+        truncated = truncated || projected.truncated;
+    }
+    const showHint = `mg-axi entra identity-provider show --id <provider-id> ${profileHint(profileName)}`;
+    const truncationHints = truncated ? [fullHint("entra identity-provider list", effectiveFlags, profileName)] : [];
+    if (!result.complete) {
+        return {
+            identityProviders: providers,
+            count: { returned: providers.length, complete: false, reason: result.reason },
+            cursor: result.cursor,
+            help: [...truncationHints, `Resume losslessly with the same flags plus --cursor <cursor-from-output> ${profileHint(profileName)}`, showHint, WORKFORCE_NOTE],
+        };
+    }
+    const count = { returned: providers.length, complete: true };
+    if (!providers.length) {
+        return {
+            identityProviders: providers,
+            count,
+            help: [WORKFORCE_NOTE, "0 identity providers matched; the absence of results is the answer, not an error"],
+        };
+    }
+    return { identityProviders: providers, count, help: [...truncationHints, showHint, WORKFORCE_NOTE] };
+}
+export async function showIdentityProvider(session, flags, profile, operation, help, profileName) {
+    const { select, fields } = selectedFields(flags, DEFAULT_SHOW_SELECT, help);
+    const scopes = scopesFor(flags, profile, help);
+    const full = flags.full === true;
+    const raw = await withGuidance(PROVIDER_DENIAL_HINTS, () => session.execute({
+        profile,
+        operation,
+        params: { "identityProviderBase-id": String(flags.id) },
+        query: { $select: select.join(",") },
+        scopes,
+    }));
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new AxiError("Graph returned a malformed identity-provider body", "GRAPH_ERROR", [
+            "Single-provider reads carry one provider object; treat anything else as unknown, not empty",
+        ]);
+    }
+    const { row, truncated } = project(raw, fields, full);
+    if (truncated)
+        return { identityProvider: row, help: [fullHint("entra identity-provider show", flags, profileName), WORKFORCE_NOTE] };
+    return { identityProvider: row, help: [WORKFORCE_NOTE] };
+}
+export async function countIdentityProviders(session, flags, profile, operation, help, profileName) {
+    const scopes = scopesFor(flags, profile, help);
+    const query = {};
+    if (flags.filter !== undefined)
+        query.$filter = String(flags.filter);
+    const raw = await withGuidance(PROVIDER_DENIAL_HINTS, () => session.execute({
+        profile,
+        operation,
+        params: {},
+        query,
+        scopes,
+        scalar: true,
+    }));
+    if (typeof raw !== "number" || !Number.isSafeInteger(raw)) {
+        throw new AxiError("Graph returned a malformed identity-provider count body", "GRAPH_ERROR", [
+            "Scalar count reads carry a plain number; treat anything else as unknown, not empty",
+        ]);
+    }
+    if (flags.filter !== undefined) {
+        return {
+            count: { returned: raw, complete: true },
+            help: [`Count reflects --filter ${shellValue(String(flags.filter))}; drop --filter for the tenant total`, WORKFORCE_NOTE],
+        };
+    }
+    return { count: { returned: raw, complete: true }, help: [WORKFORCE_NOTE] };
+}
+export async function availableIdentityProviderTypes(session, flags, profile, operation, help) {
+    const scopes = scopesFor(flags, profile, help);
+    const raw = await withGuidance(PROVIDER_DENIAL_HINTS, () => session.execute({ profile, operation, scopes }));
+    const value = raw !== null && typeof raw === "object" && !Array.isArray(raw)
+        ? raw.value : undefined;
+    if (!Array.isArray(value) || value.some(type => typeof type !== "string")) {
+        throw new AxiError("Graph returned a malformed available identity-provider types body", "GRAPH_ERROR", [
+            "Available-provider-type reads carry a value array of strings; treat anything else as unknown, not empty",
+        ]);
+    }
+    return {
+        availableProviderTypes: value,
+        count: { returned: value.length, complete: true },
+        help: ["Available provider types depend on tenant configuration and licensing; availability does not mean a provider is configured", WORKFORCE_NOTE],
+    };
+}