@knowttl/mg-axi 0.1.0

package/dist/catalogue.js

@@ -0,0 +1,2191 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { resolve, sep } from "node:path";
+import { AxiError } from "axi-sdk-js";
+// Use INV-01 identities and evidence directly; discovery never grants access.
+const schema = JSON.parse(readFileSync(new URL("../inventory/schema.json", import.meta.url), "utf8"));
+export const API_VERSIONS = schema.$defs.version.enum;
+export const DESCRIPTION = "Inspect Microsoft Graph capabilities, read-only by default";
+const common = {
+    profile: { value: "name", description: "Select a configured profile" },
+    "api-version": { value: API_VERSIONS.join("|"), default: "v1.0", description: "Explicit API version; no fallback" },
+};
+const PARSE_MODES = ["delegated", "application"];
+const logRead = {
+    since: { value: "iso-time", description: "Required for a new query: earliest instant bounding the server time range; resume with --cursor instead of repeating it" },
+    until: { value: "iso-time", description: "Latest instant bounding the server time range; must be after --since" },
+    filter: { value: "odata-filter", description: "OData $filter combined with the time bounds; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; CA policy detail additionally needs a policy permission in both modes and a supported CA-data role for delegated access; request delegated policy access with --scopes https://graph.microsoft.com/AuditLog.Read.All,https://graph.microsoft.com/Policy.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction, row caps or time bounds" },
+    cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AuditLog.Read.All" },
+};
+const riskRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the supported risk property set" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction, row caps or time bounds" },
+    cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
+};
+const userRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; richer properties need User.Read.All, accountEnabled needs User.EnableDisableAccount.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to User.Read.All" },
+};
+const groupRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph with ConsistencyLevel eventual; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; richer group properties need Group.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to GroupMember.Read.All, hidden members need Member.Read.Hidden" },
+};
+const appRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph with ConsistencyLevel eventual; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; credential fields carry expiry metadata only, never secret values" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All" },
+};
+const ownerRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph with ConsistencyLevel eventual; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from id, displayName, mail; richer owner fields need single-object reads" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All" },
+};
+const authMethodRead = {
+    select: { value: "comma-separated-properties", description: "Select output properties locally from the reviewed method set; phoneNumber is always redacted; no $select is sent to Graph" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must belong to the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to UserAuthenticationMethod.Read.All" },
+};
+const registrationRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed report set" },
+    fields: authMethodRead.fields,
+    full: authMethodRead.full,
+    cursor: authMethodRead.cursor,
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AuditLog.Read.All" },
+};
+const grantRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from id, clientId, consentType, principalId, resourceId, scope" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Directory.Read.All; reads never request write-consent scopes" },
+};
+const appRoleGrantRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from id, appRoleId, createdDateTime, principalDisplayName, principalId, principalType, resourceDisplayName, resourceId" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All; reads never request write-consent scopes" },
+};
+const roleRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed role property set" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to the operation's least-privileged read scope" },
+};
+const deviceRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph with ConsistencyLevel eventual; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; directory-device reads need Device.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Device.Read.All" },
+};
+const auRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph with ConsistencyLevel eventual; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; administrative-unit reads need AdministrativeUnit.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AdministrativeUnit.Read.All, hidden members need Member.Read.Hidden" },
+};
+const orgRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties; full metadata needs Organization.Read.All (delegated User.Read returns only id, displayName and verifiedDomains, everything else null)" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Organization.Read.All" },
+};
+const brandingRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed non-Stream branding set; Stream image properties need a later piece and fail before credentials" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to User.Read, the documented least-privileged scope; OrganizationalBranding.Read.All is the purpose-built alternative" },
+};
+const domainRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties; domain reads need Domain.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Domain.Read.All" },
+};
+const dnsRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed DNS record set; derived-type detail needs an explicit --select naming the derived property; domain DNS reads need Domain.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Domain.Read.All" },
+};
+const certAuthRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter (eq, startswith); unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; certificate-auth reads need PublicKeyInfrastructure.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to PublicKeyInfrastructure.Read.All" },
+};
+const certAuthorityRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed certificate-authority set; the public-certificate blob (certificate) is omitted by default and needs an explicit --select naming it; reads need PublicKeyInfrastructure.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to PublicKeyInfrastructure.Read.All" },
+};
+const subscriptionRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed subscription set; subscription reads need Organization.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Organization.Read.All" },
+};
+const onPremSyncRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed on-premises-synchronization set; reads need delegated OnPremDirectorySynchronization.Read.All, and application profiles are refused before credentials" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to OnPremDirectorySynchronization.Read.All" },
+};
+const agreementRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter (eq); unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed agreement set; reads need delegated Agreement.Read.All, and application profiles are refused before credentials" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Agreement.Read.All" },
+};
+const acceptanceRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter (eq, ge, le); unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed acceptance set; acceptance records are personal data and default rows stay minimal, so identifying fields need an explicit --select naming them; reads need delegated AgreementAcceptance.Read, and application profiles are refused before credentials" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AgreementAcceptance.Read, the documented least privilege (AgreementAcceptance.Read.All is the higher-privileged alternative)" },
+};
+const directoryObjectRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed base set (id, deletedDateTime); the @odata.type subtype discriminator rides along automatically and subtype properties need the subtype's named reads" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Directory.Read.All" },
+};
+const contactRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph with $count=true and ConsistencyLevel eventual; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed contact set; contacts are personal data and default rows stay minimal (id, displayName, mail, companyName), so identifying fields need an explicit --select naming them" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to OrgContact.Read.All, the documented least privilege" },
+};
+const contactMembershipRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph with $count=true and ConsistencyLevel eventual; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from id, displayName, mail; richer per-type fields need the subtype's single-object reads" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to OrgContact.Read.All, the documented least privilege (transitive reads additionally need Group.Read.All)" },
+    transitive: { description: "Read the flat transitive closure instead of direct memberships" },
+    as: { value: "group|administrativeUnit", description: "Return only this directory-object subtype via the typed cast route" },
+};
+const contactNavRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties from id, displayName, mail; richer per-type fields need the subtype's single-object reads" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to OrgContact.Read.All, the documented least privilege" },
+    as: { value: "user|orgContact", description: "Return only this directory-object subtype via the typed cast route" },
+};
+const lifecycleRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; lifecycle-policy reads need Directory.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Directory.Read.All" },
+};
+const templateRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties; setting-template reads need GroupSettings.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to GroupSettings.Read.All" },
+};
+const contractRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; filtering is documented for customerId, defaultDomainName and displayName; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; contract reads need Directory.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Directory.Read.All" },
+};
+const delegatedAdminRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel contract; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; delegated-admin reads need DelegatedAdminRelationship.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to DelegatedAdminRelationship.Read.All" },
+};
+// serviceManagementDetails documents no query parameters, so these reads
+// declare no --select/--filter and project whole rows locally instead.
+const delegatedAdminQuerylessRead = {
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; rows always arrive whole because Graph documents no query parameters here" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to DelegatedAdminRelationship.Read.All" },
+};
+const multiTenantOrganizationRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties; multi-tenant-organization reads need MultiTenantOrganization.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to MultiTenantOrganization.Read.All" },
+};
+const multiTenantOrganizationTenantRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel contract; unsupported combinations fail before credentials" },
+    select: multiTenantOrganizationRead.select,
+    fields: multiTenantOrganizationRead.fields,
+    full: multiTenantOrganizationRead.full,
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: multiTenantOrganizationRead.scopes,
+};
+const tenantInformationRead = {
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to CrossTenantInformation.ReadBasic.All" },
+};
+const attributeSetRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties; attribute-set reads need CustomSecAttributeDefinition.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to CustomSecAttributeDefinition.Read.All" },
+};
+const customSecurityDefinitionRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter (eq); unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; definition reads need CustomSecAttributeDefinition.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to CustomSecAttributeDefinition.Read.All" },
+};
+const allowedValueRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties; allowed-value reads need CustomSecAttributeDefinition.Read.All" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to CustomSecAttributeDefinition.Read.All" },
+};
+const caRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; policy and location detail needs Policy.Read.All in both modes plus a supported Conditional Access role for delegated access" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Policy.Read.All" },
+};
+const providerRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed identity-provider set; secret-bearing fields (clientSecret, certificateData) are never selectable" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityProvider.Read.All" },
+};
+const federationRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed federation-configuration set; the public signingCertificate blob needs an explicit --select naming it" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Domain.Read.All (available-types defaults to IdentityProvider.Read.All)" },
+};
+const deletedItemRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed per-type deleted-item set; credential collections are never selectable" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to the listed type's least-privileged read scope" },
+};
+const dataPolicyRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed data-policy-operation set; storageLocation always renders redacted and export submission is never sent" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to User.Export.All, User.Read.All" },
+};
+const accessReviewRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; on definitions only contains() over the scope query and eq on status are documented; unsupported combinations fail before credentials" },
+    filterReviewer: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel; unsupported combinations fail before credentials" },
+    filterStage: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter (eq only); unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed access-review set; reads need AccessReview.Read.All in both modes plus a supported Entra role for delegated access" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AccessReview.Read.All" },
+};
+const entitlementRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed entitlement set; reads need EntitlementManagement.Read.All in both modes plus a supported Entra role with catalog visibility for delegated access" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to EntitlementManagement.Read.All" },
+};
+const lifecycleWorkflowRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed workflow set; reads default to LifecycleWorkflows-Workflow.ReadBasic.All in both modes (richer detail may need LifecycleWorkflows-Workflow.Read.All or LifecycleWorkflows.Read.All) plus Global Reader or Lifecycle Workflows Administrator for delegated access" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to LifecycleWorkflows-Workflow.ReadBasic.All" },
+};
+const lifecycleGovernanceRead = {
+    filter: lifecycleWorkflowRead.filter,
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed lifecycle set; reads need LifecycleWorkflows.Read.All in both modes plus Global Reader or Lifecycle Workflows Administrator for delegated access" },
+    fields: lifecycleWorkflowRead.fields,
+    full: lifecycleWorkflowRead.full,
+    cursor: lifecycleWorkflowRead.cursor,
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to LifecycleWorkflows.Read.All" },
+};
+const lifecycleReportsRead = {
+    workflow: { value: "workflow-id", required: true, description: "Parent lifecycle workflow ID owning the run or processing result" },
+    filter: lifecycleWorkflowRead.filter,
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed reporting set; reads default to LifecycleWorkflows-Reports.Read.All in both modes (richer detail may need LifecycleWorkflows.Read.All or LifecycleWorkflows.ReadWrite.All) plus Global Reader or Lifecycle Workflows Administrator for delegated access" },
+    fields: lifecycleWorkflowRead.fields,
+    full: lifecycleWorkflowRead.full,
+    cursor: lifecycleWorkflowRead.cursor,
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to LifecycleWorkflows-Reports.Read.All" },
+};
+const lifecycleSubjectRead = {
+    workflow: { value: "workflow-id", required: true, description: "Parent lifecycle workflow ID owning the subject processing result" },
+    filter: lifecycleWorkflowRead.filter,
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally from the reviewed subject set; Graph documents no $select here so rows always arrive whole" },
+    full: lifecycleWorkflowRead.full,
+    cursor: lifecycleWorkflowRead.cursor,
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to LifecycleWorkflows-Reports.Read.All" },
+};
+const lifecycleTaskReportRead = {
+    workflow: { value: "workflow-id", required: true, description: "Parent lifecycle workflow ID owning the task report" },
+    filter: lifecycleWorkflowRead.filter,
+    select: lifecycleReportsRead.select,
+    fields: lifecycleWorkflowRead.fields,
+    full: lifecycleWorkflowRead.full,
+    cursor: lifecycleWorkflowRead.cursor,
+    scopes: lifecycleReportsRead.scopes,
+};
+const lifecycleTaskReportShow = {
+    workflow: { value: "workflow-id", required: true, description: "Parent lifecycle workflow ID owning the task report" },
+    id: { value: "task-report-id", required: true, description: "Task report ID" },
+    fields: { value: "comma-separated-properties", description: "Project the returned row locally from the reviewed task-report set; Graph documents no query parameters here so rows always arrive whole" },
+    full: lifecycleWorkflowRead.full,
+    scopes: lifecycleReportsRead.scopes,
+};
+const lifecycleTaskReportSubRead = {
+    workflow: { value: "workflow-id", required: true, description: "Parent lifecycle workflow ID owning the task report" },
+    report: { value: "task-report-id", required: true, description: "Parent task report ID owning the task or task definition" },
+    fields: { value: "comma-separated-properties", description: "Project the returned row locally from the reviewed set; Graph documents no query parameters here so rows always arrive whole" },
+    full: lifecycleWorkflowRead.full,
+    scopes: lifecycleReportsRead.scopes,
+};
+export const LEAVES = [
+    { path: "home", description: "Show local profile status without authenticating", flags: { profile: common.profile }, examples: ["mg-axi", "mg-axi home --profile soc"] },
+    { path: "profile create", description: "Create a dedicated-app profile without signing in", flags: {
+            name: { value: "name", required: true, description: "New profile name; existing identities cannot be overwritten" },
+            tenant: { value: "tenant-id", required: true, description: "Explicit workforce tenant UUID" },
+            client: { value: "client-id", required: true, description: "Organization-owned application UUID" },
+            cloud: { value: "commercial", required: true, description: "Explicit cloud; only commercial is supported" },
+            mode: { value: "delegated|application", default: "delegated", description: "Delegated analyst sign-in or application client credentials" },
+            "allow-device-code": { description: "Delegated only: opt in only when permitted by organization policy; never enables fallback" },
+            "certificate-thumbprint": { value: "40-hex-digits", description: "Application only: certificate thumbprint; the private key stays in protected storage" },
+            federated: { description: "Application only: workload federation via the AZURE_FEDERATED_TOKEN_FILE assertion source" },
+        }, examples: ["mg-axi profile create --name soc --tenant <tenant-id> --client <client-id> --cloud commercial", "mg-axi profile create --name batch --tenant <tenant-id> --client <client-id> --cloud commercial --mode application --federated", "mg-axi profile create --help"] },
+    { path: "profile list", description: "List configured profiles without accessing credentials", flags: {}, examples: ["mg-axi profile list", "mg-axi profile list --help"] },
+    { path: "profile show", description: "Show profile policy and credential reference, never credentials", flags: {
+            profile: common.profile,
+        }, examples: ["mg-axi profile show --profile soc", "mg-axi profile show"] },
+    { path: "login", description: "Explicit delegated login; browser by default, no automatic device-code fallback", flags: {
+            profile: common.profile,
+            method: { value: "browser|device-code", default: "browser", description: "Device code additionally requires profile opt-in" },
+            scopes: { value: "comma-separated-Graph-scopes", required: true, description: "Explicit delegated permissions using full https://graph.microsoft.com/ scope names" },
+        }, examples: ["mg-axi login --profile soc --scopes https://graph.microsoft.com/User.Read", "mg-axi login --profile soc --method device-code --scopes https://graph.microsoft.com/User.Read"] },
+    { path: "setup", description: "Show installation, configuration and capability guidance without signing in or writing anything", flags: {}, examples: ["mg-axi setup", "mg-axi setup --help"] },
+    { path: "doctor", description: "Check each selected profile with one bounded user-list read; never signs in interactively, installs nothing, enables no writes", flags: {
+            profile: common.profile,
+        }, examples: ["mg-axi doctor", "mg-axi doctor --profile soc", "mg-axi doctor --help"] },
+    { path: "entra user list", description: "List users with basic properties (id, displayName, userPrincipalName, mail)", operation: "GET:/users", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: userRead.filter,
+            select: userRead.select,
+            fields: userRead.fields,
+            full: userRead.full,
+            cursor: userRead.cursor,
+            scopes: userRead.scopes,
+        }, examples: ["mg-axi entra user list --profile soc", "mg-axi entra user list --profile soc --limit 10", "mg-axi entra user list --profile soc --filter \"accountEnabled eq true\" --select id,displayName,accountEnabled"] },
+    { path: "entra user show", description: "Show one user with richer default properties", operation: "GET:/users/{user-id}", flags: {
+            ...common, id: { value: "user-id-or-upn", required: true, description: "User object ID or UPN" },
+            select: userRead.select,
+            fields: userRead.fields,
+            full: userRead.full,
+            scopes: userRead.scopes,
+        }, examples: ["mg-axi entra user show --id <user-id-or-upn> --profile soc", "mg-axi entra user show --id <user-id-or-upn> --profile soc --full"] },
+    { path: "entra user update", description: "Set one user's accountEnabled (WRITE-02): desired-state preview, no-op when already set, conflict on reread mismatch; enabling and disabling are disruptive and need typed confirmation", operation: "PATCH:/users/{user-id}", flags: {
+            ...common,
+            user: { value: "user-id-or-upn", required: true, description: "User object ID or UPN whose account is enabled or disabled" },
+            "account-enabled": { value: "true|false", required: true, description: "Desired account state; both enabling and disabling are disruptive" },
+            execute: { description: "Send the PATCH after preview; without it the command only previews the desired-state diff and journals nothing" },
+            confirm: { value: "user-id-or-upn", description: "Required with --execute: repeat the --user value exactly" },
+        }, examples: ["mg-axi entra user update --user <user-id-or-upn> --account-enabled false --profile soc", "mg-axi entra user update --user <user-id-or-upn> --account-enabled false --execute --confirm '<user-id-or-upn>' --profile soc", "mg-axi entra user update --user <user-id-or-upn> --account-enabled true --execute --confirm '<user-id-or-upn>' --profile soc"] },
+    { path: "entra user revoke-sessions", description: "Revoke one user's sign-in sessions (WRITE-03): action preview states what happens and that it cannot be undone; revocation can lag minutes and never touches external users' home-tenant sessions; D/A User.RevokeSessions.All; disruptive, needs typed confirmation", operation: "POST:/users/{user-id}/revokeSignInSessions", flags: {
+            ...common,
+            user: { value: "user-object-id", required: true, description: "User object ID whose sessions are revoked; verified as a user before preview and sending; UPNs are not resolved" },
+            execute: { description: "Send after preview; without it the command only previews the action and journals nothing" },
+            confirm: { value: "user-object-id", description: "Required with --execute: repeat the --user ID exactly" },
+        }, examples: ["mg-axi entra user revoke-sessions --user <user-id> --profile soc", "mg-axi entra user revoke-sessions --user <user-id> --profile soc --execute --confirm <user-id>"] },
+    { path: "entra user authentication-method list", description: "List authentication methods for one named user (id, displayName, createdDateTime); targeted inspection only, never a tenant scan; phone numbers redacted", operation: "GET:/users/{user-id}/authentication/methods", flags: {
+            ...common, user: { value: "user-id-or-upn", required: true, description: "User object ID or UPN whose methods are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: authMethodRead.select,
+            fields: authMethodRead.fields,
+            full: authMethodRead.full,
+            cursor: authMethodRead.cursor,
+            scopes: authMethodRead.scopes,
+        }, examples: ["mg-axi entra user authentication-method list --user <user-id> --profile soc", "mg-axi entra user authentication-method list --user <user-id> --profile soc --select id,displayName,phoneType"] },
+    { path: "entra registration list", description: "List the tenant authentication-method registration report (MFA/SSPR posture); the report does not cover disabled users", operation: "GET:/reports/authenticationMethods/userRegistrationDetails", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: registrationRead.filter,
+            select: registrationRead.select,
+            fields: registrationRead.fields,
+            full: registrationRead.full,
+            cursor: registrationRead.cursor,
+            scopes: registrationRead.scopes,
+        }, examples: ["mg-axi entra registration list --profile soc", "mg-axi entra registration list --profile soc --filter \"isMfaRegistered eq false\""] },
+    { path: "entra group list", description: "List groups with compact properties (id, displayName, mail, groupTypes)", operation: "GET:/groups", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: groupRead.filter,
+            select: groupRead.select,
+            fields: groupRead.fields,
+            full: groupRead.full,
+            cursor: groupRead.cursor,
+            scopes: groupRead.scopes,
+        }, examples: ["mg-axi entra group list --profile soc", "mg-axi entra group list --profile soc --limit 10", "mg-axi entra group list --profile soc --filter \"securityEnabled eq true\" --select id,displayName,isAssignableToRole"] },
+    { path: "entra group show", description: "Show one group with richer default properties including isAssignableToRole", operation: "GET:/groups/{group-id}", flags: {
+            ...common, id: { value: "group-id", required: true, description: "Group object ID" },
+            select: groupRead.select,
+            fields: groupRead.fields,
+            full: groupRead.full,
+            scopes: groupRead.scopes,
+        }, examples: ["mg-axi entra group show --id <group-id> --profile soc", "mg-axi entra group show --id <group-id> --profile soc --full"] },
+    { path: "entra group member list", description: "List direct group members; --transitive flattens nested membership. Hidden members are omitted without Member.Read.Hidden; v1.0 may omit service principals", operation: "GET:/groups/{group-id}/members", flags: {
+            ...common, group: { value: "group-id", required: true, description: "Group object ID whose members are listed" },
+            transitive: { description: "List the flat transitive closure instead of direct members" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: groupRead.filter,
+            select: { value: "comma-separated-properties", description: "Request server properties from id, displayName, mail; richer member fields need single-object reads" },
+            fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+            full: groupRead.full,
+            cursor: groupRead.cursor,
+            scopes: groupRead.scopes,
+        }, examples: ["mg-axi entra group member list --group <group-id> --profile soc", "mg-axi entra group member list --group <group-id> --transitive --profile soc"] },
+    { path: "entra group member-of list", description: "List groups the group is a member of; --transitive flattens nested membership. Hidden memberships are omitted without Member.Read.Hidden", operation: "GET:/groups/{group-id}/memberOf", flags: {
+            ...common, group: { value: "group-id", required: true, description: "Group object ID whose memberships are listed" },
+            transitive: { description: "List the flat transitive closure instead of direct memberships" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: groupRead.filter,
+            select: { value: "comma-separated-properties", description: "Request server properties from id, displayName, mail; richer member fields need single-object reads" },
+            fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+            full: groupRead.full,
+            cursor: groupRead.cursor,
+            scopes: groupRead.scopes,
+        }, examples: ["mg-axi entra group member-of list --group <group-id> --profile soc", "mg-axi entra group member-of list --group <group-id> --transitive --profile soc"] },
+    { path: "entra group member add", description: "Add one user to a non-role-assignable security or Microsoft 365 group (WRITE-01). User members need D/A GroupMember.ReadWrite.All; delegated callers additionally need a groups role such as Groups Administrator. Role-assignable, dynamic and distribution groups are refused before sending; an already-member user is a no-op", operation: "POST:/groups/{group-id}/members/$ref", flags: {
+            ...common,
+            group: { value: "group-id", required: true, description: "Group object ID that gains the member; --confirm repeats this ID" },
+            user: { value: "user-object-id", required: true, description: "User object ID verified before preview and sending; user reads need delegated User.ReadBasic.All or application User.Read.All; the write uses a directoryObjects $ref; UPNs are not resolved" },
+            execute: { description: "Send after preview; without it only previews and journals nothing" },
+            confirm: { value: "group-id", description: "Required with --execute: repeat the --group ID to confirm this access change" },
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to GroupMember.ReadWrite.All" },
+        }, examples: ["mg-axi entra group member add --group <group-id> --user <user-id> --profile soc", "mg-axi entra group member add --group <group-id> --user <user-id> --profile soc --execute --confirm <group-id>"] },
+    { path: "entra directory-role list", description: "List activated directory roles (id, displayName, description, roleTemplateId); roles appear only after activation", operation: "GET:/directoryRoles", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
+        }, examples: ["mg-axi entra directory-role list --profile soc", "mg-axi entra directory-role list --profile soc --filter \"displayName eq 'Global Administrator'\""] },
+    { path: "entra directory-role show", description: "Show one activated directory role with richer default properties", operation: "GET:/directoryRoles/{directoryRole-id}", flags: {
+            ...common, id: { value: "role-id", required: true, description: "Activated directory-role object ID" },
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
+        }, examples: ["mg-axi entra directory-role show --id <role-id> --profile soc", "mg-axi entra directory-role show --id <role-id> --profile soc --full"] },
+    { path: "entra role-assignment list", description: "List current role assignments (id, principalId, roleDefinitionId, directoryScopeId), including direct and PIM-activated assignments; use pim active list for assignmentType Assigned versus Activated", operation: "GET:/roleManagement/directory/roleAssignments", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need Directory Readers, Global Reader or Privileged Role Administrator" },
+        }, examples: ["mg-axi entra role-assignment list --profile soc", "mg-axi entra role-assignment list --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra pim eligible list", description: "List PIM-eligible assignments, which are not active; activation is a PIM workflow outside these reads", operation: "GET:/roleManagement/directory/roleEligibilityScheduleInstances", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleEligibilitySchedule.Read.Directory; delegated callers also need a supported PIM read role; PIM needs P2 or ID Governance" },
+        }, examples: ["mg-axi entra pim eligible list --profile soc", "mg-axi entra pim eligible list --profile soc --filter \"roleDefinitionId eq '<role-definition-id>'\""] },
+    { path: "entra pim active list", description: "List active assignments: directly assigned plus activated eligible, distinguished by assignmentType Assigned versus Activated", operation: "GET:/roleManagement/directory/roleAssignmentScheduleInstances", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleAssignmentSchedule.Read.Directory; delegated callers also need a supported PIM read role; PIM needs P2 or ID Governance" },
+        }, examples: ["mg-axi entra pim active list --profile soc", "mg-axi entra pim active list --profile soc --filter \"assignmentType eq 'Activated'\""] },
+    { path: "entra device list", description: "List directory devices with compact properties (id, displayName, operatingSystem, accountEnabled). Directory-device scope only; Intune managed devices are a separately authorized surface", operation: "GET:/devices", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: deviceRead.filter,
+            select: deviceRead.select,
+            fields: deviceRead.fields,
+            full: deviceRead.full,
+            cursor: deviceRead.cursor,
+            scopes: deviceRead.scopes,
+        }, examples: ["mg-axi entra device list --profile soc", "mg-axi entra device list --profile soc --limit 10", "mg-axi entra device list --profile soc --filter \"isCompliant eq true\" --select id,displayName,isCompliant"] },
+    { path: "entra device show", description: "Show one directory device with the full reviewed property set; deviceId is the directory device identifier and id is the object ID", operation: "GET:/devices/{device-id}", flags: {
+            ...common, id: { value: "device-id", required: true, description: "Device object ID" },
+            select: deviceRead.select,
+            fields: deviceRead.fields,
+            full: deviceRead.full,
+            scopes: deviceRead.scopes,
+        }, examples: ["mg-axi entra device show --id <device-id> --profile soc", "mg-axi entra device show --id <device-id> --profile soc --full"] },
+    { path: "entra administrative-unit list", description: "List administrative units with compact properties (id, displayName, visibility, membershipType)", operation: "GET:/directory/administrativeUnits", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: auRead.filter,
+            select: auRead.select,
+            fields: auRead.fields,
+            full: auRead.full,
+            cursor: auRead.cursor,
+            scopes: auRead.scopes,
+        }, examples: ["mg-axi entra administrative-unit list --profile soc", "mg-axi entra administrative-unit list --profile soc --limit 10", "mg-axi entra administrative-unit list --profile soc --filter \"displayName eq 'Seattle Schools'\""] },
+    { path: "entra administrative-unit show", description: "Show one administrative unit with the full reviewed property set including visibility and membership rule", operation: "GET:/directory/administrativeUnits/{administrativeUnit-id}", flags: {
+            ...common, id: { value: "administrative-unit-id", required: true, description: "Administrative unit object ID" },
+            select: auRead.select,
+            fields: auRead.fields,
+            full: auRead.full,
+            scopes: auRead.scopes,
+        }, examples: ["mg-axi entra administrative-unit show --id <administrative-unit-id> --profile soc", "mg-axi entra administrative-unit show --id <administrative-unit-id> --profile soc --full"] },
+    { path: "entra administrative-unit member list", description: "List administrative-unit members (users, groups, devices). Hidden memberships are omitted without Member.Read.Hidden; app callers with narrow consent receive limited-information rows", operation: "GET:/directory/administrativeUnits/{administrativeUnit-id}/members", flags: {
+            ...common, "administrative-unit": { value: "administrative-unit-id", required: true, description: "Administrative unit object ID whose members are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: auRead.filter,
+            select: { value: "comma-separated-properties", description: "Request server properties from id, displayName, mail; richer member fields need single-object reads" },
+            fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+            full: auRead.full,
+            cursor: auRead.cursor,
+            scopes: auRead.scopes,
+        }, examples: ["mg-axi entra administrative-unit member list --administrative-unit <administrative-unit-id> --profile soc", "mg-axi entra administrative-unit member list --administrative-unit <administrative-unit-id> --profile soc --limit 10"] },
+    { path: "entra organization list", description: "List tenant organizations with compact properties (id, displayName, tenantType, verifiedDomains); exactly one row exists per tenant; --filter is unsupported on /organization (Graph documents $select only)", operation: "GET:/organization", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: orgRead.select,
+            fields: orgRead.fields,
+            full: orgRead.full,
+            cursor: orgRead.cursor,
+            scopes: orgRead.scopes,
+        }, examples: ["mg-axi entra organization list --profile soc", "mg-axi entra organization list --profile soc --select id,displayName,technicalNotificationMails"] },
+    { path: "entra organization show", description: "Show one tenant organization with the full reviewed property set including technical notification mails and privacy profile", operation: "GET:/organization/{organization-id}", flags: {
+            ...common, id: { value: "organization-id", required: true, description: "Tenant organization UUID" },
+            select: orgRead.select,
+            fields: orgRead.fields,
+            full: orgRead.full,
+            scopes: orgRead.scopes,
+        }, examples: ["mg-axi entra organization show --id <organization-id> --profile soc", "mg-axi entra organization show --id <organization-id> --profile soc --full"] },
+    { path: "entra organization branding show", description: "Show the default sign-in branding metadata (non-Stream text and URLs only); Stream image bytes need a later piece; a 404 may indicate unconfigured branding or a missing or inaccessible organization", operation: "GET:/organization/{organization-id}/branding", flags: {
+            ...common, organization: { value: "organization-id", required: true, description: "Tenant organization UUID whose default branding is shown" },
+            select: brandingRead.select,
+            fields: brandingRead.fields,
+            full: brandingRead.full,
+            scopes: brandingRead.scopes,
+        }, examples: ["mg-axi entra organization branding show --organization <organization-id> --profile soc", "mg-axi entra organization branding show --organization <organization-id> --profile soc --select id,signInPageText,usernameHintText"] },
+    { path: "entra organization branding-localization list", description: "List locale branding variants with compact properties (id, signInPageText, usernameHintText, backgroundColor); --filter is unsupported (Graph documents $select only)", operation: "GET:/organization/{organization-id}/branding/localizations", flags: {
+            ...common, organization: { value: "organization-id", required: true, description: "Tenant organization UUID whose locale branding is listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: brandingRead.select,
+            fields: brandingRead.fields,
+            full: brandingRead.full,
+            cursor: brandingRead.cursor,
+            scopes: brandingRead.scopes,
+        }, examples: ["mg-axi entra organization branding-localization list --organization <organization-id> --profile soc"] },
+    { path: "entra organization branding-localization show", description: "Show one locale branding variant with the full reviewed non-Stream property set; Stream image bytes need a later piece", operation: "GET:/organization/{organization-id}/branding/localizations/{organizationalBrandingLocalization-id}", flags: {
+            ...common, organization: { value: "organization-id", required: true, description: "Tenant organization UUID owning the locale branding" },
+            id: { value: "locale-id", required: true, description: "Branding locale id, for example fr-FR" },
+            select: brandingRead.select,
+            fields: brandingRead.fields,
+            full: brandingRead.full,
+            scopes: brandingRead.scopes,
+        }, examples: ["mg-axi entra organization branding-localization show --organization <organization-id> --id fr-FR --profile soc"] },
+    { path: "entra domain list", description: "List tenant domains with compact properties (id, authenticationType, isVerified, isDefault). Domain ids are fully qualified names; --filter is unsupported on /domains (Graph known issue with $search, $top and $filter)", operation: "GET:/domains", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: domainRead.select,
+            fields: domainRead.fields,
+            full: domainRead.full,
+            cursor: domainRead.cursor,
+            scopes: domainRead.scopes,
+        }, examples: ["mg-axi entra domain list --profile soc", "mg-axi entra domain list --profile soc --limit 10", "mg-axi entra domain list --profile soc --select id,isVerified,supportedServices"] },
+    { path: "entra domain show", description: "Show one domain with the full reviewed property set; unverified domains point at their verification DNS records", operation: "GET:/domains/{domain-id}", flags: {
+            ...common, id: { value: "domain-name", required: true, description: "Fully qualified domain name, for example contoso.com; the domain id is the FQDN" },
+            select: domainRead.select,
+            fields: domainRead.fields,
+            full: domainRead.full,
+            scopes: domainRead.scopes,
+        }, examples: ["mg-axi entra domain show --id contoso.com --profile soc", "mg-axi entra domain show --id contoso.com --profile soc --full"] },
+    { path: "entra domain verification-dns-record list", description: "List the DNS records one domain needs for ownership verification; rows carry @odata.type naming the derived record kind", operation: "GET:/domains/{domain-id}/verificationDnsRecords", flags: {
+            ...common, domain: { value: "domain-name", required: true, description: "Fully qualified domain name whose verification records are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: dnsRead.filter,
+            select: dnsRead.select,
+            fields: dnsRead.fields,
+            full: dnsRead.full,
+            cursor: dnsRead.cursor,
+            scopes: dnsRead.scopes,
+        }, examples: ["mg-axi entra domain verification-dns-record list --domain contoso.com --profile soc"] },
+    { path: "entra domain verification-dns-record show", description: "Show one domain verification DNS record; rows carry @odata.type naming the derived record kind", operation: "GET:/domains/{domain-id}/verificationDnsRecords/{domainDnsRecord-id}", flags: {
+            ...common, domain: { value: "domain-name", required: true, description: "Fully qualified domain name owning the record" },
+            id: { value: "record-id", required: true, description: "DNS record object ID" },
+            select: dnsRead.select,
+            fields: dnsRead.fields,
+            full: dnsRead.full,
+            scopes: dnsRead.scopes,
+        }, examples: ["mg-axi entra domain verification-dns-record show --domain contoso.com --id <record-id> --profile soc"] },
+    { path: "entra domain service-configuration-record list", description: "List the DNS records one domain needs to enable services; rows carry @odata.type naming the derived record kind", operation: "GET:/domains/{domain-id}/serviceConfigurationRecords", flags: {
+            ...common, domain: { value: "domain-name", required: true, description: "Fully qualified domain name whose service records are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: dnsRead.filter,
+            select: dnsRead.select,
+            fields: dnsRead.fields,
+            full: dnsRead.full,
+            cursor: dnsRead.cursor,
+            scopes: dnsRead.scopes,
+        }, examples: ["mg-axi entra domain service-configuration-record list --domain contoso.com --profile soc"] },
+    { path: "entra domain service-configuration-record show", description: "Show one domain service-configuration DNS record; rows carry @odata.type naming the derived record kind", operation: "GET:/domains/{domain-id}/serviceConfigurationRecords/{domainDnsRecord-id}", flags: {
+            ...common, domain: { value: "domain-name", required: true, description: "Fully qualified domain name owning the record" },
+            id: { value: "record-id", required: true, description: "DNS record object ID" },
+            select: dnsRead.select,
+            fields: dnsRead.fields,
+            full: dnsRead.full,
+            scopes: dnsRead.scopes,
+        }, examples: ["mg-axi entra domain service-configuration-record show --domain contoso.com --id <record-id> --profile soc"] },
+    { path: "entra domain-dns-record list", description: "List domain DNS records from the top-level record set; rows carry @odata.type naming the derived record kind", operation: "GET:/domainDnsRecords", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: dnsRead.filter,
+            select: dnsRead.select,
+            fields: dnsRead.fields,
+            full: dnsRead.full,
+            cursor: dnsRead.cursor,
+            scopes: dnsRead.scopes,
+        }, examples: ["mg-axi entra domain-dns-record list --profile soc", "mg-axi entra domain-dns-record list --profile soc --limit 10"] },
+    { path: "entra domain-dns-record show", description: "Show one domain DNS record from the top-level record set; rows carry @odata.type naming the derived record kind", operation: "GET:/domainDnsRecords/{domainDnsRecord-id}", flags: {
+            ...common, id: { value: "record-id", required: true, description: "DNS record object ID" },
+            select: dnsRead.select,
+            fields: dnsRead.fields,
+            full: dnsRead.full,
+            scopes: dnsRead.scopes,
+        }, examples: ["mg-axi entra domain-dns-record show --id <record-id> --profile soc"] },
+    { path: "entra certificate-auth-pki list", description: "List certificate-based-auth PKI configurations with compact properties (id, displayName, status); an empty list may mean certificate-based authentication is not configured; --filter passes through as plain $filter", operation: "GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: certAuthRead.filter,
+            select: certAuthRead.select,
+            fields: certAuthRead.fields,
+            full: certAuthRead.full,
+            cursor: certAuthRead.cursor,
+            scopes: certAuthRead.scopes,
+        }, examples: ["mg-axi entra certificate-auth-pki list --profile soc", "mg-axi entra certificate-auth-pki list --profile soc --limit 10", "mg-axi entra certificate-auth-pki list --profile soc --filter \"displayName eq 'Contoso PKI'\""] },
+    { path: "entra certificate-auth-pki show", description: "Show one certificate-based-auth PKI configuration with the full reviewed property set", operation: "GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}", flags: {
+            ...common, id: { value: "pki-id", required: true, description: "Certificate-auth PKI object ID" },
+            select: certAuthRead.select,
+            fields: certAuthRead.fields,
+            full: certAuthRead.full,
+            scopes: certAuthRead.scopes,
+        }, examples: ["mg-axi entra certificate-auth-pki show --id <pki-id> --profile soc", "mg-axi entra certificate-auth-pki show --id <pki-id> --profile soc --full"] },
+    { path: "entra certificate-auth-pki count", description: "Count certificate-based-auth PKI configurations as a scalar number; --filter narrows the count server-side", operation: "GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/$count", flags: {
+            ...common,
+            filter: certAuthRead.filter,
+            scopes: certAuthRead.scopes,
+        }, examples: ["mg-axi entra certificate-auth-pki count --profile soc", "mg-axi entra certificate-auth-pki count --profile soc --filter \"displayName eq 'Contoso PKI'\""] },
+    { path: "entra certificate-authority list", description: "List the certificate authorities of one PKI configuration with compact properties (id, displayName, certificateAuthorityType, expirationDateTime); public-certificate blobs are omitted by default; --filter passes through as plain $filter", operation: "GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}/certificateAuthorities", flags: {
+            ...common,
+            pki: { value: "pki-id", required: true, description: "Certificate-auth PKI object ID owning the authorities" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: certAuthorityRead.filter,
+            select: certAuthorityRead.select,
+            fields: certAuthorityRead.fields,
+            full: certAuthorityRead.full,
+            cursor: certAuthorityRead.cursor,
+            scopes: certAuthorityRead.scopes,
+        }, examples: ["mg-axi entra certificate-authority list --pki <pki-id> --profile soc", "mg-axi entra certificate-authority list --pki <pki-id> --profile soc --limit 10"] },
+    { path: "entra certificate-authority show", description: "Show one certificate authority with the reviewed property set; the public-certificate blob (certificate) needs an explicit --select naming it", operation: "GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}/certificateAuthorities/{certificateAuthorityDetail-id}", flags: {
+            ...common,
+            pki: { value: "pki-id", required: true, description: "Certificate-auth PKI object ID owning the authority" },
+            id: { value: "authority-id", required: true, description: "Certificate-authority object ID" },
+            select: certAuthorityRead.select,
+            fields: certAuthorityRead.fields,
+            full: certAuthorityRead.full,
+            scopes: certAuthorityRead.scopes,
+        }, examples: ["mg-axi entra certificate-authority show --pki <pki-id> --id <authority-id> --profile soc", "mg-axi entra certificate-authority show --pki <pki-id> --id <authority-id> --profile soc --select id,displayName,certificate"] },
+    { path: "entra certificate-authority count", description: "Count the certificate authorities of one PKI configuration as a scalar number; --filter narrows the count server-side", operation: "GET:/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}/certificateAuthorities/$count", flags: {
+            ...common,
+            pki: { value: "pki-id", required: true, description: "Certificate-auth PKI object ID owning the authorities" },
+            filter: certAuthorityRead.filter,
+            scopes: certAuthorityRead.scopes,
+        }, examples: ["mg-axi entra certificate-authority count --pki <pki-id> --profile soc"] },
+    { path: "entra subscription list", description: "List commercial subscriptions with compact properties (id, skuPartNumber, status, totalLicenses); --filter passes through as plain $filter", operation: "GET:/directory/subscriptions", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: subscriptionRead.filter,
+            select: subscriptionRead.select,
+            fields: subscriptionRead.fields,
+            full: subscriptionRead.full,
+            cursor: subscriptionRead.cursor,
+            scopes: subscriptionRead.scopes,
+        }, examples: ["mg-axi entra subscription list --profile soc", "mg-axi entra subscription list --profile soc --limit 10", "mg-axi entra subscription list --profile soc --filter \"status eq 'Enabled'\""] },
+    { path: "entra subscription show", description: "Show one commercial subscription with the full reviewed property set, by object ID or commerce subscription ID", operation: "GET:/directory/subscriptions/{companySubscription-id}", flags: {
+            ...common,
+            id: { value: "subscription-id", description: "Commercial-subscription object ID; exactly one of --id or --commerce-subscription-id" },
+            "commerce-subscription-id": { value: "commerce-subscription-id", description: "Commerce-system subscription ID; exactly one of --id or --commerce-subscription-id" },
+            select: subscriptionRead.select,
+            fields: subscriptionRead.fields,
+            full: subscriptionRead.full,
+            scopes: subscriptionRead.scopes,
+        }, examples: ["mg-axi entra subscription show --id <subscription-id> --profile soc", "mg-axi entra subscription show --id <subscription-id> --profile soc --full", "mg-axi entra subscription show --commerce-subscription-id <commerce-subscription-id> --profile soc"] },
+    { path: "entra subscription count", description: "Count commercial subscriptions as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/directory/subscriptions/$count", flags: {
+            ...common,
+            scopes: subscriptionRead.scopes,
+        }, examples: ["mg-axi entra subscription count --profile soc"] },
+    { path: "entra on-premises-synchronization list", description: "List on-premises directory synchronization configurations with the reviewed property set (id, configuration, features); Graph documents $select only, so no --filter", operation: "GET:/directory/onPremisesSynchronization", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: onPremSyncRead.select,
+            fields: onPremSyncRead.fields,
+            full: onPremSyncRead.full,
+            cursor: onPremSyncRead.cursor,
+            scopes: onPremSyncRead.scopes,
+        }, examples: ["mg-axi entra on-premises-synchronization list --profile soc", "mg-axi entra on-premises-synchronization list --profile soc --limit 10"] },
+    { path: "entra on-premises-synchronization show", description: "Show one on-premises directory synchronization configuration with the reviewed property set", operation: "GET:/directory/onPremisesSynchronization/{onPremisesDirectorySynchronization-id}", flags: {
+            ...common, id: { value: "synchronization-id", required: true, description: "On-premises-synchronization object ID (the Entra tenant ID)" },
+            select: onPremSyncRead.select,
+            fields: onPremSyncRead.fields,
+            full: onPremSyncRead.full,
+            scopes: onPremSyncRead.scopes,
+        }, examples: ["mg-axi entra on-premises-synchronization show --id <synchronization-id> --profile soc", "mg-axi entra on-premises-synchronization show --id <synchronization-id> --profile soc --full"] },
+    { path: "entra agreement list", description: "List terms-of-use agreements with compact properties (id, displayName); --filter passes through as plain $filter (eq)", operation: "GET:/agreements", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: agreementRead.filter,
+            select: agreementRead.select,
+            fields: agreementRead.fields,
+            full: agreementRead.full,
+            cursor: agreementRead.cursor,
+            scopes: agreementRead.scopes,
+        }, examples: ["mg-axi entra agreement list --profile soc", "mg-axi entra agreement list --profile soc --limit 10"] },
+    { path: "entra agreement show", description: "Show one terms-of-use agreement with the full reviewed metadata set; file contents are never downloaded or printed", operation: "GET:/agreements/{agreement-id}", flags: {
+            ...common, id: { value: "agreement-id", required: true, description: "Agreement identifier" },
+            select: agreementRead.select,
+            fields: agreementRead.fields,
+            full: agreementRead.full,
+            scopes: agreementRead.scopes,
+        }, examples: ["mg-axi entra agreement show --id <agreement-id> --profile soc", "mg-axi entra agreement show --id <agreement-id> --profile soc --full"] },
+    { path: "entra agreement acceptance list", description: "List one agreement's acceptance records with minimal personal-data rows (id, agreementId, state, recordedDateTime); --filter passes through as plain $filter", operation: "GET:/agreements/{agreement-id}/acceptances", flags: {
+            ...common, agreement: { value: "agreement-id", required: true, description: "Agreement whose acceptance records are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: acceptanceRead.filter,
+            select: acceptanceRead.select,
+            fields: acceptanceRead.fields,
+            full: acceptanceRead.full,
+            cursor: acceptanceRead.cursor,
+            scopes: acceptanceRead.scopes,
+        }, examples: ["mg-axi entra agreement acceptance list --agreement <agreement-id> --profile soc", "mg-axi entra agreement acceptance list --agreement <agreement-id> --profile soc --limit 10"] },
+    { path: "entra agreement acceptance show", description: "Show one agreement's acceptance record with minimal personal-data rows; identifying fields need an explicit --select", operation: "GET:/agreements/{agreement-id}/acceptances/{agreementAcceptance-id}", flags: {
+            ...common, agreement: { value: "agreement-id", required: true, description: "Agreement owning the acceptance record" },
+            id: { value: "acceptance-id", required: true, description: "Agreement-acceptance identifier" },
+            select: acceptanceRead.select,
+            fields: acceptanceRead.fields,
+            full: acceptanceRead.full,
+            scopes: acceptanceRead.scopes,
+        }, examples: ["mg-axi entra agreement acceptance show --agreement <agreement-id> --id <acceptance-id> --profile soc"] },
+    { path: "entra agreement-acceptance list", description: "List tenant-wide terms-of-use acceptance records with minimal personal-data rows (id, agreementId, state, recordedDateTime); --filter passes through as plain $filter", operation: "GET:/agreementAcceptances", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: acceptanceRead.filter,
+            select: acceptanceRead.select,
+            fields: acceptanceRead.fields,
+            full: acceptanceRead.full,
+            cursor: acceptanceRead.cursor,
+            scopes: acceptanceRead.scopes,
+        }, examples: ["mg-axi entra agreement-acceptance list --profile soc", "mg-axi entra agreement-acceptance list --profile soc --limit 10"] },
+    { path: "entra agreement-acceptance show", description: "Show one tenant-wide terms-of-use acceptance record with minimal personal-data rows; identifying fields need an explicit --select", operation: "GET:/agreementAcceptances/{agreementAcceptance-id}", flags: {
+            ...common, id: { value: "acceptance-id", required: true, description: "Agreement-acceptance identifier" },
+            select: acceptanceRead.select,
+            fields: acceptanceRead.fields,
+            full: acceptanceRead.full,
+            scopes: acceptanceRead.scopes,
+        }, examples: ["mg-axi entra agreement-acceptance show --id <acceptance-id> --profile soc"] },
+    { path: "entra directory-object list", description: "List directory objects with compact rows (id plus the @odata.type subtype discriminator); Graph documents no List operation page, so no --filter", operation: "GET:/directoryObjects", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: directoryObjectRead.select,
+            fields: directoryObjectRead.fields,
+            full: directoryObjectRead.full,
+            cursor: directoryObjectRead.cursor,
+            scopes: directoryObjectRead.scopes,
+        }, examples: ["mg-axi entra directory-object list --profile soc", "mg-axi entra directory-object list --profile soc --limit 10"] },
+    { path: "entra directory-object show", description: "Show one directory object with the reviewed base properties (id, deletedDateTime) plus the @odata.type subtype discriminator; subtype detail needs the subtype's named reads", operation: "GET:/directoryObjects/{directoryObject-id}", flags: {
+            ...common, id: { value: "object-id", required: true, description: "Directory-object object ID" },
+            select: directoryObjectRead.select,
+            fields: directoryObjectRead.fields,
+            full: directoryObjectRead.full,
+            scopes: directoryObjectRead.scopes,
+        }, examples: ["mg-axi entra directory-object show --id <object-id> --profile soc", "mg-axi entra directory-object show --id <object-id> --profile soc --full"] },
+    { path: "entra directory-object count", description: "Count directory objects as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/directoryObjects/$count", flags: {
+            ...common,
+            scopes: directoryObjectRead.scopes,
+        }, examples: ["mg-axi entra directory-object count --profile soc"] },
+    { path: "entra contact list", description: "List organizational contacts with minimal personal-data rows (id, displayName, mail, companyName); --filter passes through as plain $filter with ConsistencyLevel eventual", operation: "GET:/contacts", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: contactRead.filter,
+            select: contactRead.select,
+            fields: contactRead.fields,
+            full: contactRead.full,
+            cursor: contactRead.cursor,
+            scopes: contactRead.scopes,
+        }, examples: ["mg-axi entra contact list --profile soc", "mg-axi entra contact list --profile soc --limit 10"] },
+    { path: "entra contact show", description: "Show one organizational contact with minimal personal-data rows (id, displayName, mail, companyName); identifying fields need an explicit --select", operation: "GET:/contacts/{orgContact-id}", flags: {
+            ...common, id: { value: "contact-id", required: true, description: "Organizational-contact object ID" },
+            select: contactRead.select,
+            fields: contactRead.fields,
+            full: contactRead.full,
+            scopes: contactRead.scopes,
+        }, examples: ["mg-axi entra contact show --id <contact-id> --profile soc", "mg-axi entra contact show --id <contact-id> --profile soc --full"] },
+    { path: "entra contact count", description: "Count organizational contacts as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/contacts/$count", flags: {
+            ...common,
+            scopes: contactRead.scopes,
+        }, examples: ["mg-axi entra contact count --profile soc"] },
+    { path: "entra contact show-manager", description: "Show one contact's manager as a directory object with type plus minimal rows (id, displayName); mail needs an explicit --select", operation: "GET:/contacts/{orgContact-id}/manager", flags: {
+            ...common, id: { value: "contact-id", required: true, description: "Organizational-contact object ID" },
+            select: contactNavRead.select,
+            fields: contactNavRead.fields,
+            full: contactNavRead.full,
+            scopes: contactNavRead.scopes,
+        }, examples: ["mg-axi entra contact show-manager --id <contact-id> --profile soc"] },
+    { path: "entra contact list-direct-reports", description: "List one contact's direct reports as directory objects with type plus minimal rows (id, displayName); --as selects the user or contact cast route", operation: "GET:/contacts/{orgContact-id}/directReports", flags: {
+            ...common, id: { value: "contact-id", required: true, description: "Organizational-contact object ID" },
+            as: contactNavRead.as,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: contactNavRead.select,
+            fields: contactNavRead.fields,
+            full: contactNavRead.full,
+            cursor: contactNavRead.cursor,
+            scopes: contactNavRead.scopes,
+        }, examples: ["mg-axi entra contact list-direct-reports --id <contact-id> --profile soc", "mg-axi entra contact list-direct-reports --id <contact-id> --as user --profile soc"] },
+    { path: "entra contact show-direct-report", description: "Show one direct report as a directory object with type plus minimal rows (id, displayName); --as selects the user or contact cast route", operation: "GET:/contacts/{orgContact-id}/directReports/{directoryObject-id}", flags: {
+            ...common, id: { value: "contact-id", required: true, description: "Organizational-contact object ID" },
+            "report-id": { value: "report-id", required: true, description: "Direct-report directory-object ID" },
+            as: contactNavRead.as,
+            select: contactNavRead.select,
+            fields: contactNavRead.fields,
+            full: contactNavRead.full,
+            scopes: contactNavRead.scopes,
+        }, examples: ["mg-axi entra contact show-direct-report --id <contact-id> --report-id <report-id> --profile soc"] },
+    { path: "entra contact count-direct-reports", description: "Count one contact's direct reports as one scalar; the $count route takes no --select, --limit or --cursor; --as selects the user or contact cast route", operation: "GET:/contacts/{orgContact-id}/directReports/$count", flags: {
+            ...common, id: { value: "contact-id", required: true, description: "Organizational-contact object ID" },
+            as: contactNavRead.as,
+            scopes: contactNavRead.scopes,
+        }, examples: ["mg-axi entra contact count-direct-reports --id <contact-id> --profile soc"] },
+    { path: "entra contact list-member-of", description: "List groups and administrative units one contact belongs to as directory objects with type plus minimal rows (id, displayName); --transitive flattens nested membership; --as selects the group or administrativeUnit cast route", operation: "GET:/contacts/{orgContact-id}/memberOf", flags: {
+            ...common, id: { value: "contact-id", required: true, description: "Organizational-contact object ID" },
+            transitive: contactMembershipRead.transitive,
+            as: contactMembershipRead.as,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: contactMembershipRead.filter,
+            select: contactMembershipRead.select,
+            fields: contactMembershipRead.fields,
+            full: contactMembershipRead.full,
+            cursor: contactMembershipRead.cursor,
+            scopes: contactMembershipRead.scopes,
+        }, examples: ["mg-axi entra contact list-member-of --id <contact-id> --profile soc", "mg-axi entra contact list-member-of --id <contact-id> --transitive --profile soc"] },
+    { path: "entra contact show-member-of", description: "Show one membership as a directory object with type plus minimal rows (id, displayName); --transitive reads the transitive closure; --as selects the group or administrativeUnit cast route", operation: "GET:/contacts/{orgContact-id}/memberOf/{directoryObject-id}", flags: {
+            ...common, id: { value: "contact-id", required: true, description: "Organizational-contact object ID" },
+            "member-id": { value: "membership-id", required: true, description: "Membership directory-object ID" },
+            transitive: contactMembershipRead.transitive,
+            as: contactMembershipRead.as,
+            select: contactMembershipRead.select,
+            fields: contactMembershipRead.fields,
+            full: contactMembershipRead.full,
+            scopes: contactMembershipRead.scopes,
+        }, examples: ["mg-axi entra contact show-member-of --id <contact-id> --member-id <membership-id> --profile soc"] },
+    { path: "entra contact count-member-of", description: "Count one contact's memberships as one scalar; the $count route takes no --select, --limit or --cursor; --transitive counts the transitive closure; --as selects the group or administrativeUnit cast route", operation: "GET:/contacts/{orgContact-id}/memberOf/$count", flags: {
+            ...common, id: { value: "contact-id", required: true, description: "Organizational-contact object ID" },
+            transitive: contactMembershipRead.transitive,
+            as: contactMembershipRead.as,
+            scopes: contactMembershipRead.scopes,
+        }, examples: ["mg-axi entra contact count-member-of --id <contact-id> --profile soc"] },
+    { path: "entra group-lifecycle-policy list", description: "List group lifecycle (expiry) policies with compact properties (id, groupLifetimeInDays, managedGroupTypes); --filter passes through as plain $filter", operation: "GET:/groupLifecyclePolicies", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleRead.filter,
+            select: lifecycleRead.select,
+            fields: lifecycleRead.fields,
+            full: lifecycleRead.full,
+            cursor: lifecycleRead.cursor,
+            scopes: lifecycleRead.scopes,
+        }, examples: ["mg-axi entra group-lifecycle-policy list --profile soc", "mg-axi entra group-lifecycle-policy list --profile soc --limit 10"] },
+    { path: "entra group-lifecycle-policy show", description: "Show one group lifecycle policy with the full reviewed property set (id, alternateNotificationEmails, groupLifetimeInDays, managedGroupTypes)", operation: "GET:/groupLifecyclePolicies/{groupLifecyclePolicy-id}", flags: {
+            ...common, id: { value: "policy-id", required: true, description: "Lifecycle policy identifier" },
+            select: lifecycleRead.select,
+            fields: lifecycleRead.fields,
+            full: lifecycleRead.full,
+            scopes: lifecycleRead.scopes,
+        }, examples: ["mg-axi entra group-lifecycle-policy show --id <policy-id> --profile soc", "mg-axi entra group-lifecycle-policy show --id <policy-id> --profile soc --full"] },
+    { path: "entra group-lifecycle-policy count", description: "Count group lifecycle policies as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/groupLifecyclePolicies/$count", flags: {
+            ...common,
+            scopes: lifecycleRead.scopes,
+        }, examples: ["mg-axi entra group-lifecycle-policy count --profile soc"] },
+    { path: "entra group-setting-template list", description: "List group setting templates with compact properties (id, displayName, description); --filter is unsupported on /groupSettingTemplates (Graph documents $select only)", operation: "GET:/groupSettingTemplates", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: templateRead.select,
+            fields: templateRead.fields,
+            full: templateRead.full,
+            cursor: templateRead.cursor,
+            scopes: templateRead.scopes,
+        }, examples: ["mg-axi entra group-setting-template list --profile soc", "mg-axi entra group-setting-template list --profile soc --limit 10"] },
+    { path: "entra group-setting-template show", description: "Show one group setting template with the full reviewed property set including the values collection of setting names, types and defaults", operation: "GET:/groupSettingTemplates/{groupSettingTemplate-id}", flags: {
+            ...common, id: { value: "template-id", required: true, description: "Setting template identifier" },
+            select: templateRead.select,
+            fields: templateRead.fields,
+            full: templateRead.full,
+            scopes: templateRead.scopes,
+        }, examples: ["mg-axi entra group-setting-template show --id <template-id> --profile soc", "mg-axi entra group-setting-template show --id <template-id> --profile soc --full"] },
+    { path: "entra group-setting-template count", description: "Count group setting templates as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/groupSettingTemplates/$count", flags: {
+            ...common,
+            scopes: templateRead.scopes,
+        }, examples: ["mg-axi entra group-setting-template count --profile soc"] },
+    { path: "entra attribute-set list", description: "List custom-security attribute sets with the reviewed properties (id, description, maxAttributesPerSet); --filter is unsupported on /directory/attributeSets (Graph documents $select, $top and $orderby only)", operation: "GET:/directory/attributeSets", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: attributeSetRead.select,
+            fields: attributeSetRead.fields,
+            full: attributeSetRead.full,
+            cursor: attributeSetRead.cursor,
+            scopes: attributeSetRead.scopes,
+        }, examples: ["mg-axi entra attribute-set list --profile soc", "mg-axi entra attribute-set list --profile soc --limit 10"] },
+    { path: "entra attribute-set show", description: "Show one custom-security attribute set with the reviewed property set (id, description, maxAttributesPerSet)", operation: "GET:/directory/attributeSets/{attributeSet-id}", flags: {
+            ...common, id: { value: "set-id", required: true, description: "Attribute-set identifier" },
+            select: attributeSetRead.select,
+            fields: attributeSetRead.fields,
+            full: attributeSetRead.full,
+            scopes: attributeSetRead.scopes,
+        }, examples: ["mg-axi entra attribute-set show --id <set-id> --profile soc", "mg-axi entra attribute-set show --id <set-id> --profile soc --full"] },
+    { path: "entra attribute-set count", description: "Count custom-security attribute sets as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/directory/attributeSets/$count", flags: {
+            ...common,
+            scopes: attributeSetRead.scopes,
+        }, examples: ["mg-axi entra attribute-set count --profile soc"] },
+    { path: "entra custom-security-attribute-definition list", description: "List custom security attribute definitions with compact properties (id, attributeSet, name, status, type); --filter passes through as plain $filter (eq)", operation: "GET:/directory/customSecurityAttributeDefinitions", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: customSecurityDefinitionRead.filter,
+            select: customSecurityDefinitionRead.select,
+            fields: customSecurityDefinitionRead.fields,
+            full: customSecurityDefinitionRead.full,
+            cursor: customSecurityDefinitionRead.cursor,
+            scopes: customSecurityDefinitionRead.scopes,
+        }, examples: ["mg-axi entra custom-security-attribute-definition list --profile soc", "mg-axi entra custom-security-attribute-definition list --profile soc --limit 10", "mg-axi entra custom-security-attribute-definition list --profile soc --filter \"status eq 'Available'\""] },
+    { path: "entra custom-security-attribute-definition show", description: "Show one custom security attribute definition with the full reviewed property set; allowed values have their own list/show commands", operation: "GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}", flags: {
+            ...common, id: { value: "definition-id", required: true, description: "Custom-security-attribute-definition identifier (<attributeSet>_<name>)" },
+            select: customSecurityDefinitionRead.select,
+            fields: customSecurityDefinitionRead.fields,
+            full: customSecurityDefinitionRead.full,
+            scopes: customSecurityDefinitionRead.scopes,
+        }, examples: ["mg-axi entra custom-security-attribute-definition show --id <definition-id> --profile soc", "mg-axi entra custom-security-attribute-definition show --id <definition-id> --profile soc --full"] },
+    { path: "entra custom-security-attribute-definition count", description: "Count custom security attribute definitions as a scalar number; --filter narrows the count server-side", operation: "GET:/directory/customSecurityAttributeDefinitions/$count", flags: {
+            ...common,
+            filter: customSecurityDefinitionRead.filter,
+            scopes: customSecurityDefinitionRead.scopes,
+        }, examples: ["mg-axi entra custom-security-attribute-definition count --profile soc", "mg-axi entra custom-security-attribute-definition count --profile soc --filter \"status eq 'Available'\""] },
+    { path: "entra allowed-value list", description: "List the predefined allowed values of one custom security attribute definition with the reviewed properties (id, isActive); --filter is unsupported on allowedValues (Graph documents $select only)", operation: "GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}/allowedValues", flags: {
+            ...common,
+            definition: { value: "definition-id", required: true, description: "Custom-security-attribute-definition identifier owning the allowed values" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: allowedValueRead.select,
+            fields: allowedValueRead.fields,
+            full: allowedValueRead.full,
+            cursor: allowedValueRead.cursor,
+            scopes: allowedValueRead.scopes,
+        }, examples: ["mg-axi entra allowed-value list --definition <definition-id> --profile soc", "mg-axi entra allowed-value list --definition <definition-id> --profile soc --limit 10"] },
+    { path: "entra allowed-value show", description: "Show one predefined allowed value with the reviewed property set (id, isActive)", operation: "GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}/allowedValues/{allowedValue-id}", flags: {
+            ...common,
+            definition: { value: "definition-id", required: true, description: "Custom-security-attribute-definition identifier owning the allowed value" },
+            id: { value: "value-id", required: true, description: "Allowed-value identifier" },
+            select: allowedValueRead.select,
+            fields: allowedValueRead.fields,
+            full: allowedValueRead.full,
+            scopes: allowedValueRead.scopes,
+        }, examples: ["mg-axi entra allowed-value show --definition <definition-id> --id <value-id> --profile soc"] },
+    { path: "entra allowed-value count", description: "Count the predefined allowed values of one custom security attribute definition as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinition-id}/allowedValues/$count", flags: {
+            ...common,
+            definition: { value: "definition-id", required: true, description: "Custom-security-attribute-definition identifier owning the allowed values" },
+            scopes: allowedValueRead.scopes,
+        }, examples: ["mg-axi entra allowed-value count --definition <definition-id> --profile soc"] },
+    { path: "entra contract list", description: "List partner-tenant customer contracts with compact properties (id, displayName, contractType, defaultDomainName); contracts exist in partner tenants only; --filter passes through as plain $filter", operation: "GET:/contracts", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: contractRead.filter,
+            select: contractRead.select,
+            fields: contractRead.fields,
+            full: contractRead.full,
+            cursor: contractRead.cursor,
+            scopes: contractRead.scopes,
+        }, examples: ["mg-axi entra contract list --profile soc", "mg-axi entra contract list --profile soc --limit 10", "mg-axi entra contract list --profile soc --filter \"contractType eq 'ResellerPartner'\""] },
+    { path: "entra contract show", description: "Show one partner contract with the full reviewed property set (contractType, customerId, defaultDomainName, displayName, id)", operation: "GET:/contracts/{contract-id}", flags: {
+            ...common, id: { value: "contract-id", required: true, description: "Contract partnership identifier" },
+            select: contractRead.select,
+            fields: contractRead.fields,
+            full: contractRead.full,
+            scopes: contractRead.scopes,
+        }, examples: ["mg-axi entra contract show --id <contract-id> --profile soc", "mg-axi entra contract show --id <contract-id> --profile soc --full"] },
+    { path: "entra contract count", description: "Count partner-tenant customer contracts as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/contracts/$count", flags: {
+            ...common,
+            scopes: contractRead.scopes,
+        }, examples: ["mg-axi entra contract count --profile soc"] },
+    { path: "entra delegated-admin-customer list", description: "List delegated-admin customers of the partner tenant with compact properties (id, displayName, tenantId); delegated-admin reads run in the partner tenant; --filter passes through as plain $filter", operation: "GET:/tenantRelationships/delegatedAdminCustomers", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: delegatedAdminRead.filter,
+            select: delegatedAdminRead.select,
+            fields: delegatedAdminRead.fields,
+            full: delegatedAdminRead.full,
+            cursor: delegatedAdminRead.cursor,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-customer list --profile soc", "mg-axi entra delegated-admin-customer list --profile soc --limit 10", "mg-axi entra delegated-admin-customer list --profile soc --filter \"displayName eq 'Contoso'\""] },
+    { path: "entra delegated-admin-customer show", description: "Show one delegated-admin customer with the full reviewed property set (displayName, id, tenantId)", operation: "GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}", flags: {
+            ...common, id: { value: "customer-id", required: true, description: "Delegated-admin customer identifier" },
+            select: delegatedAdminRead.select,
+            fields: delegatedAdminRead.fields,
+            full: delegatedAdminRead.full,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-customer show --id <customer-id> --profile soc", "mg-axi entra delegated-admin-customer show --id <customer-id> --profile soc --full"] },
+    { path: "entra delegated-admin-relationship list", description: "List partner-tenant delegated-admin relationships with compact properties (id, displayName, status, customer, endDateTime); --filter passes through as plain $filter", operation: "GET:/tenantRelationships/delegatedAdminRelationships", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: delegatedAdminRead.filter,
+            select: delegatedAdminRead.select,
+            fields: delegatedAdminRead.fields,
+            full: delegatedAdminRead.full,
+            cursor: delegatedAdminRead.cursor,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship list --profile soc", "mg-axi entra delegated-admin-relationship list --profile soc --limit 10", "mg-axi entra delegated-admin-relationship list --profile soc --filter \"status eq 'active'\""] },
+    { path: "entra delegated-admin-relationship show", description: "Show one delegated-admin relationship with the full reviewed property set (accessDetails, activatedDateTime, autoExtendDuration, createdDateTime, customer, displayName, duration, endDateTime, id, lastModifiedDateTime, status)", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            select: delegatedAdminRead.select,
+            fields: delegatedAdminRead.fields,
+            full: delegatedAdminRead.full,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship show --id <relationship-id> --profile soc", "mg-axi entra delegated-admin-relationship show --id <relationship-id> --profile soc --full"] },
+    { path: "entra delegated-admin-relationship list-access-assignments", description: "List one relationship's delegated-admin access assignments with compact properties (id, status, accessContainer, accessDetails); --filter passes through as plain $filter", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/accessAssignments", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: delegatedAdminRead.filter,
+            select: delegatedAdminRead.select,
+            fields: delegatedAdminRead.fields,
+            full: delegatedAdminRead.full,
+            cursor: delegatedAdminRead.cursor,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship list-access-assignments --id <relationship-id> --profile soc", "mg-axi entra delegated-admin-relationship list-access-assignments --id <relationship-id> --profile soc --limit 10"] },
+    { path: "entra delegated-admin-relationship show-access-assignment", description: "Show one delegated-admin access assignment with the full reviewed property set (accessContainer, accessDetails, createdDateTime, id, lastModifiedDateTime, status)", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/accessAssignments/{delegatedAdminAccessAssignment-id}", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            "assignment-id": { value: "assignment-id", required: true, description: "Delegated-admin access-assignment identifier" },
+            select: delegatedAdminRead.select,
+            fields: delegatedAdminRead.fields,
+            full: delegatedAdminRead.full,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship show-access-assignment --id <relationship-id> --assignment-id <assignment-id> --profile soc"] },
+    { path: "entra delegated-admin-relationship list-operations", description: "List one relationship's long-running delegated-admin operations with compact properties (id, operationType, status, lastModifiedDateTime); --filter passes through as plain $filter", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/operations", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: delegatedAdminRead.filter,
+            select: delegatedAdminRead.select,
+            fields: delegatedAdminRead.fields,
+            full: delegatedAdminRead.full,
+            cursor: delegatedAdminRead.cursor,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship list-operations --id <relationship-id> --profile soc", "mg-axi entra delegated-admin-relationship list-operations --id <relationship-id> --profile soc --filter \"status eq 'succeeded'\""] },
+    { path: "entra delegated-admin-relationship show-operation", description: "Show one delegated-admin relationship operation with the full reviewed property set (createdDateTime, data, id, lastModifiedDateTime, operationType, status); the data payload is a JSON-encoded string", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/operations/{delegatedAdminRelationshipOperation-id}", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            "operation-id": { value: "operation-id", required: true, description: "Delegated-admin relationship-operation identifier" },
+            select: delegatedAdminRead.select,
+            fields: delegatedAdminRead.fields,
+            full: delegatedAdminRead.full,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship show-operation --id <relationship-id> --operation-id <operation-id> --profile soc"] },
+    { path: "entra delegated-admin-relationship list-requests", description: "List one relationship's delegated-admin requests with compact properties (id, action, status, lastModifiedDateTime); --filter passes through as plain $filter", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/requests", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: delegatedAdminRead.filter,
+            select: delegatedAdminRead.select,
+            fields: delegatedAdminRead.fields,
+            full: delegatedAdminRead.full,
+            cursor: delegatedAdminRead.cursor,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship list-requests --id <relationship-id> --profile soc", "mg-axi entra delegated-admin-relationship list-requests --id <relationship-id> --profile soc --limit 10"] },
+    { path: "entra delegated-admin-relationship show-request", description: "Show one delegated-admin relationship request with the full reviewed property set (action, createdDateTime, id, lastModifiedDateTime, status)", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/requests/{delegatedAdminRelationshipRequest-id}", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            "request-id": { value: "request-id", required: true, description: "Delegated-admin relationship-request identifier" },
+            select: delegatedAdminRead.select,
+            fields: delegatedAdminRead.fields,
+            full: delegatedAdminRead.full,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship show-request --id <relationship-id> --request-id <request-id> --profile soc"] },
+    { path: "entra delegated-admin-customer list-service-management-details", description: "List one customer's service-management details (id, serviceName, serviceManagementUrl); Graph documents no query parameters here, so --select and --filter are unsupported and rows project locally", operation: "GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails", flags: {
+            ...common, id: { value: "customer-id", required: true, description: "Delegated-admin customer identifier" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            fields: delegatedAdminQuerylessRead.fields,
+            full: delegatedAdminQuerylessRead.full,
+            cursor: delegatedAdminQuerylessRead.cursor,
+            scopes: delegatedAdminQuerylessRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-customer list-service-management-details --id <customer-id> --profile soc"] },
+    { path: "entra delegated-admin-customer show-service-management-detail", description: "Show one service-management detail with the reviewed property set (id, serviceManagementUrl, serviceName); Graph documents no query parameters here, so --select is unsupported and rows project locally", operation: "GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails/{delegatedAdminServiceManagementDetail-id}", flags: {
+            ...common, id: { value: "customer-id", required: true, description: "Delegated-admin customer identifier" },
+            "detail-id": { value: "detail-id", required: true, description: "Delegated-admin service-management-detail identifier" },
+            fields: delegatedAdminQuerylessRead.fields,
+            full: delegatedAdminQuerylessRead.full,
+            scopes: delegatedAdminQuerylessRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-customer show-service-management-detail --id <customer-id> --detail-id <detail-id> --profile soc"] },
+    { path: "entra multi-tenant-organization show", description: "Show the tenant multitenant organization with the full reviewed property set (createdDateTime, description, displayName, id, state); at most one exists per tenant and state inactive means no membership", operation: "GET:/tenantRelationships/multiTenantOrganization", flags: {
+            ...common,
+            select: multiTenantOrganizationRead.select,
+            fields: multiTenantOrganizationRead.fields,
+            full: multiTenantOrganizationRead.full,
+            scopes: multiTenantOrganizationRead.scopes,
+        }, examples: ["mg-axi entra multi-tenant-organization show --profile soc", "mg-axi entra multi-tenant-organization show --profile soc --full"] },
+    { path: "entra multi-tenant-organization join-request show", description: "Show the tenant join-request record with the full reviewed property set (addedByTenantId, id, memberState, role, transitionDetails)", operation: "GET:/tenantRelationships/multiTenantOrganization/joinRequest", flags: {
+            ...common,
+            select: multiTenantOrganizationRead.select,
+            fields: multiTenantOrganizationRead.fields,
+            full: multiTenantOrganizationRead.full,
+            scopes: multiTenantOrganizationRead.scopes,
+        }, examples: ["mg-axi entra multi-tenant-organization join-request show --profile soc", "mg-axi entra multi-tenant-organization join-request show --profile soc --full"] },
+    { path: "entra multi-tenant-organization tenant list", description: "List member tenants of the multitenant organization with compact properties (tenantId, displayName, role, state); --filter passes through as plain $filter", operation: "GET:/tenantRelationships/multiTenantOrganization/tenants", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: multiTenantOrganizationTenantRead.filter,
+            select: multiTenantOrganizationTenantRead.select,
+            fields: multiTenantOrganizationTenantRead.fields,
+            full: multiTenantOrganizationTenantRead.full,
+            cursor: multiTenantOrganizationTenantRead.cursor,
+            scopes: multiTenantOrganizationTenantRead.scopes,
+        }, examples: ["mg-axi entra multi-tenant-organization tenant list --profile soc", "mg-axi entra multi-tenant-organization tenant list --profile soc --limit 10", "mg-axi entra multi-tenant-organization tenant list --profile soc --filter \"state eq 'active'\""] },
+    { path: "entra multi-tenant-organization tenant count", description: "Count member tenants of the multitenant organization as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/multiTenantOrganization/tenants/$count", flags: {
+            ...common,
+            scopes: multiTenantOrganizationRead.scopes,
+        }, examples: ["mg-axi entra multi-tenant-organization tenant count --profile soc"] },
+    { path: "entra tenant-information show", description: "Show tenant information for one Microsoft Entra tenant by domain name or tenant ID, with the full reviewed tenantInformation set (defaultDomainName, displayName, federationBrandName, tenantId); no Entra role is required and the lookup takes no --select, --filter, --limit or --cursor", operation: "GET:/tenantRelationships/findTenantInformationByDomainName(domainName='{domainName}')", flags: {
+            ...common,
+            "domain-name": { value: "domain-name", description: "Primary domain name of the tenant; exactly one of --domain-name or --tenant-id" },
+            "tenant-id": { value: "tenant-guid", description: "Unique tenant identifier (GUID); exactly one of --domain-name or --tenant-id" },
+            full: tenantInformationRead.full,
+            scopes: tenantInformationRead.scopes,
+        }, examples: ["mg-axi entra tenant-information show --domain-name example.invalid --profile soc", "mg-axi entra tenant-information show --tenant-id <tenant-id> --profile soc"] },
+    { path: "entra sign-in list", description: "List sign-ins in a bounded time window (AuditLog.Read.All; delegated callers also need Global Reader, Reports Reader, Security Administrator, Security Operator or Security Reader; conservative P1/P2 deployment prerequisite)", operation: "GET:/auditLogs/signIns", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            since: { ...logRead.since, description: "Required for a new query (resume with --cursor instead): earliest createdDateTime bounding the server time range" },
+            until: logRead.until,
+            filter: logRead.filter,
+            select: logRead.select,
+            fields: logRead.fields,
+            full: logRead.full,
+            cursor: logRead.cursor,
+            scopes: logRead.scopes,
+        }, examples: ["mg-axi entra sign-in list --profile soc --since 2026-09-01T00:00:00Z", "mg-axi entra sign-in list --profile soc --since 2026-09-01T00:00:00Z --filter \"status/errorCode ne 0\" --limit 10", "mg-axi entra sign-in list --profile soc --since 2026-09-01T00:00:00Z --until 2026-09-08T00:00:00Z --all"] },
+    { path: "entra sign-in show", description: "Show one sign-in with the full reviewed property set; absent CA policy detail reports its required policy permission and delegated role instead of an empty value", operation: "GET:/auditLogs/signIns/{signIn-id}", flags: {
+            ...common, id: { value: "sign-in-id", required: true, description: "Sign-in object ID" },
+            select: logRead.select,
+            fields: logRead.fields,
+            full: logRead.full,
+            scopes: logRead.scopes,
+        }, examples: ["mg-axi entra sign-in show --id <sign-in-id> --profile soc", "mg-axi entra sign-in show --id <sign-in-id> --profile soc --full"] },
+    { path: "entra directory-audit list", description: "List directory audits in a bounded time window (AuditLog.Read.All; delegated callers also need Reports Reader, Security Administrator or Security Reader; conservative P1/P2 deployment prerequisite)", operation: "GET:/auditLogs/directoryAudits", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            since: { ...logRead.since, description: "Required for a new query (resume with --cursor instead): earliest activityDateTime bounding the server time range" },
+            until: logRead.until,
+            filter: logRead.filter,
+            select: logRead.select,
+            fields: logRead.fields,
+            full: logRead.full,
+            cursor: logRead.cursor,
+            scopes: logRead.scopes,
+        }, examples: ["mg-axi entra directory-audit list --profile soc --since 2026-09-01T00:00:00Z", "mg-axi entra directory-audit list --profile soc --since 2026-09-01T00:00:00Z --filter \"category eq 'UserManagement'\"", "mg-axi entra directory-audit list --profile soc --since 2026-09-01T00:00:00Z --all"] },
+    { path: "entra directory-audit show", description: "Show one directory audit with the full reviewed property set", operation: "GET:/auditLogs/directoryAudits/{directoryAudit-id}", flags: {
+            ...common, id: { value: "directory-audit-id", required: true, description: "Directory audit object ID" },
+            select: logRead.select,
+            fields: logRead.fields,
+            full: logRead.full,
+            scopes: logRead.scopes,
+        }, examples: ["mg-axi entra directory-audit show --id <directory-audit-id> --profile soc", "mg-axi entra directory-audit show --id <directory-audit-id> --profile soc --full"] },
+    { path: "entra application list", description: "List applications with compact properties (id, appId, displayName); appId is the client ID, distinct from the object id", operation: "GET:/applications", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: appRead.filter,
+            select: appRead.select,
+            fields: appRead.fields,
+            full: appRead.full,
+            cursor: appRead.cursor,
+            scopes: appRead.scopes,
+        }, examples: ["mg-axi entra application list --profile soc", "mg-axi entra application list --profile soc --limit 10", "mg-axi entra application list --profile soc --filter \"startswith(displayName,'A')\""] },
+    { path: "entra application show", description: "Show one application with credential expiry metadata only; never any secret value, hint or key material", operation: "GET:/applications/{application-id}", flags: {
+            ...common, id: { value: "application-object-id", required: true, description: "Application object ID; appId is the client ID, not the object ID" },
+            select: appRead.select,
+            fields: appRead.fields,
+            full: appRead.full,
+            scopes: appRead.scopes,
+        }, examples: ["mg-axi entra application show --id <application-object-id> --profile soc", "mg-axi entra application show --id <application-object-id> --profile soc --full"] },
+    { path: "entra service-principal list", description: "List service principals with compact properties (id, appId, displayName); appId is the client ID, distinct from the object id", operation: "GET:/servicePrincipals", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: appRead.filter,
+            select: appRead.select,
+            fields: appRead.fields,
+            full: appRead.full,
+            cursor: appRead.cursor,
+            scopes: appRead.scopes,
+        }, examples: ["mg-axi entra service-principal list --profile soc", "mg-axi entra service-principal list --profile soc --limit 10"] },
+    { path: "entra service-principal show", description: "Show one service principal with richer default properties including servicePrincipalType", operation: "GET:/servicePrincipals/{servicePrincipal-id}", flags: {
+            ...common, id: { value: "service-principal-object-id", required: true, description: "Service principal object ID; appId is the client ID, not the object ID" },
+            select: appRead.select,
+            fields: appRead.fields,
+            full: appRead.full,
+            scopes: appRead.scopes,
+        }, examples: ["mg-axi entra service-principal show --id <service-principal-object-id> --profile soc"] },
+    { path: "entra application owner list", description: "List owners of one application; rows carry @odata.type naming the owner kind", operation: "GET:/applications/{application-id}/owners", flags: {
+            ...common, application: { value: "application-object-id", required: true, description: "Application object ID whose owners are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: ownerRead.filter,
+            select: ownerRead.select,
+            fields: ownerRead.fields,
+            full: ownerRead.full,
+            cursor: ownerRead.cursor,
+            scopes: ownerRead.scopes,
+        }, examples: ["mg-axi entra application owner list --application <application-object-id> --profile soc"] },
+    { path: "entra service-principal owner list", description: "List owners of one service principal; rows carry @odata.type naming the owner kind", operation: "GET:/servicePrincipals/{servicePrincipal-id}/owners", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Service principal object ID whose owners are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: ownerRead.filter,
+            select: ownerRead.select,
+            fields: ownerRead.fields,
+            full: ownerRead.full,
+            cursor: ownerRead.cursor,
+            scopes: ownerRead.scopes,
+        }, examples: ["mg-axi entra service-principal owner list --service-principal <service-principal-object-id> --profile soc"] },
+    { path: "entra service-principal oauth2-grant list", description: "List delegated permission grants for one client service principal; rows are granted consent, distinct from the application's requested permissions", operation: "GET:/servicePrincipals/{servicePrincipal-id}/oauth2PermissionGrants", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Client service-principal object ID whose delegated grants are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: grantRead.filter,
+            select: grantRead.select,
+            fields: grantRead.fields,
+            full: grantRead.full,
+            cursor: grantRead.cursor,
+            scopes: grantRead.scopes,
+        }, examples: ["mg-axi entra service-principal oauth2-grant list --service-principal <service-principal-object-id> --profile soc", "mg-axi entra service-principal oauth2-grant list --service-principal <service-principal-object-id> --profile soc --filter \"consentType eq 'AllPrincipals'\""] },
+    { path: "entra service-principal app-role-assignment list", description: "List app-only role assignments granted to one client service principal; rows are granted consent, distinct from the application's requested permissions", operation: "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignments", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Client service-principal object ID whose app-only grants are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: appRoleGrantRead.filter,
+            select: appRoleGrantRead.select,
+            fields: appRoleGrantRead.fields,
+            full: appRoleGrantRead.full,
+            cursor: appRoleGrantRead.cursor,
+            scopes: appRoleGrantRead.scopes,
+        }, examples: ["mg-axi entra service-principal app-role-assignment list --service-principal <service-principal-object-id> --profile soc"] },
+    { path: "entra risky-user list", description: "List at-risk users with compact risk state (IdentityRiskyUser.Read.All; delegated callers also need Global Reader, Security Operator, Security Reader or Security Administrator; the riskyUsers API requires P2)", operation: "GET:/identityProtection/riskyUsers", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: riskRead.filter,
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            cursor: riskRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskyUser.Read.All" },
+        }, examples: ["mg-axi entra risky-user list --profile soc", "mg-axi entra risky-user list --profile soc --filter \"riskState eq 'atRisk'\" --limit 10", "mg-axi entra risky-user list --profile soc --all"] },
+    { path: "entra risky-user show", description: "Show one at-risk user with the full reviewed property set and detection/sign-in correlation guidance; this read never confirms, dismisses or remediates risk", operation: "GET:/identityProtection/riskyUsers/{riskyUser-id}", flags: {
+            ...common, id: { value: "risky-user-id", required: true, description: "Risky user object ID" },
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskyUser.Read.All" },
+        }, examples: ["mg-axi entra risky-user show --id <risky-user-id> --profile soc", "mg-axi entra risky-user show --id <risky-user-id> --profile soc --full"] },
+    { path: "entra risky-user dismiss", description: "Dismiss one user's risk (WRITE-05): single-user POST with the current risk state previewed through the risky-user show route; dismissal is not remediation (it resets no credential and revokes no session); D/A IdentityRiskyUser.ReadWrite.All plus Security Administrator for delegated callers; the riskyUsers API requires P2", operation: "POST:/identityProtection/riskyUsers/dismiss", flags: {
+            ...common,
+            user: { value: "risky-user-id", required: true, description: "Exactly one risky-user ID to dismiss; there is no bulk form" },
+            execute: { description: "Send the dismissal after preview; without it the command only previews the current risk state and journals nothing" },
+            confirm: { value: "risky-user-id", description: "Required with --execute: repeat the --user value exactly" },
+        }, examples: ["mg-axi entra risky-user dismiss --user <risky-user-id> --profile soc", "mg-axi entra risky-user dismiss --user <risky-user-id> --execute --confirm '<risky-user-id>' --profile soc"] },
+    { path: "entra risk-detection list", description: "List risk detections in a bounded time window (IdentityRiskEvent.Read.All; delegated callers also need Global Reader, Security Operator, Security Reader or Security Administrator; P1 or P2, with premium detail limited without P2)", operation: "GET:/identityProtection/riskDetections", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            since: { ...logRead.since, description: "Required for a new query (resume with --cursor instead): earliest detectedDateTime bounding the server time range" },
+            until: logRead.until,
+            filter: logRead.filter,
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            cursor: riskRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskEvent.Read.All" },
+        }, examples: ["mg-axi entra risk-detection list --profile soc --since 2026-09-01T00:00:00Z", "mg-axi entra risk-detection list --profile soc --since 2026-09-01T00:00:00Z --filter \"riskState eq 'atRisk'\" --limit 10", "mg-axi entra risk-detection list --profile soc --since 2026-09-01T00:00:00Z --all"] },
+    { path: "entra risk-detection show", description: "Show one risk detection with the full reviewed property set and sign-in correlation guidance; a null correlationId means no sign-in is associated and there is no riskySignIns endpoint", operation: "GET:/identityProtection/riskDetections/{riskDetection-id}", flags: {
+            ...common, id: { value: "risk-detection-id", required: true, description: "Risk detection object ID" },
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskEvent.Read.All" },
+        }, examples: ["mg-axi entra risk-detection show --id <risk-detection-id> --profile soc", "mg-axi entra risk-detection show --id <risk-detection-id> --profile soc --full"] },
+    { path: "entra conditional-access policy list", description: "List Conditional Access policies with compact properties (id, displayName, state)", operation: "GET:/identity/conditionalAccess/policies", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caRead.filter,
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            cursor: caRead.cursor,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access policy list --profile soc", "mg-axi entra conditional-access policy list --profile soc --limit 10", "mg-axi entra conditional-access policy list --profile soc --filter \"state eq 'enabled'\" --select id,displayName,state"] },
+    { path: "entra conditional-access policy show", description: "Show one Conditional Access policy with the full reviewed condition and control set", operation: "GET:/identity/conditionalAccess/policies/{conditionalAccessPolicy-id}", flags: {
+            ...common, id: { value: "policy-id", required: true, description: "Conditional Access policy object ID" },
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access policy show --id <policy-id> --profile soc", "mg-axi entra conditional-access policy show --id <policy-id> --profile soc --full"] },
+    { path: "entra conditional-access policy update", description: "Update one Conditional Access policy with reviewed fields only (WRITE-04): current-versus-proposed preview, lockout analysis, no concurrency promise; disruptive and needs typed confirmation", operation: "PATCH:/identity/conditionalAccess/policies/{conditionalAccessPolicy-id}", flags: {
+            ...common,
+            id: { value: "policy-id", required: true, description: "Conditional Access policy object ID to update" },
+            "display-name": { value: "name", description: "Reviewed field: new policy display name" },
+            state: { value: "enabled|enabledForReportingButNotEnforced|disabled", description: "Reviewed field: desired enforcement state" },
+            conditions: { value: "json-object", description: "Reviewed field: full conditions block as a JSON object" },
+            "grant-controls": { value: "json-object", description: "Reviewed field: full grantControls block as a JSON object" },
+            "session-controls": { value: "json-object", description: "Reviewed field: full sessionControls block as a JSON object" },
+            execute: { description: "Send the PATCH after preview; without it the command only previews the diff and lockout analysis and journals nothing" },
+            confirm: { value: "policy-id", description: "Required with --execute: repeat the --id value exactly" },
+            "acknowledge-lockout-risk": { description: "Required with --execute when the preview reports elevated lockout risk" },
+        }, examples: ["mg-axi entra conditional-access policy update --id <policy-id> --state disabled --profile soc", "mg-axi entra conditional-access policy update --id <policy-id> --state enabled --execute --confirm '<policy-id>' --profile soc"] },
+    { path: "entra conditional-access named-location list", description: "List Conditional Access named locations with compact properties (id, displayName)", operation: "GET:/identity/conditionalAccess/namedLocations", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caRead.filter,
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            cursor: caRead.cursor,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access named-location list --profile soc", "mg-axi entra conditional-access named-location list --profile soc --limit 10", "mg-axi entra conditional-access named-location list --profile soc --filter \"isTrusted eq true\""] },
+    { path: "entra conditional-access named-location show", description: "Show one Conditional Access named location with the full reviewed property set", operation: "GET:/identity/conditionalAccess/namedLocations/{namedLocation-id}", flags: {
+            ...common, id: { value: "named-location-id", required: true, description: "Named location object ID" },
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access named-location show --id <named-location-id> --profile soc", "mg-axi entra conditional-access named-location show --id <named-location-id> --profile soc --full"] },
+    { path: "entra identity-provider list", description: "List workforce identity providers with compact properties (id, displayName); rows carry @odata.type naming the provider kind; client secrets and key material are never returned", operation: "GET:/identity/identityProviders", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: providerRead.filter,
+            select: providerRead.select,
+            fields: providerRead.fields,
+            full: providerRead.full,
+            cursor: providerRead.cursor,
+            scopes: providerRead.scopes,
+        }, examples: ["mg-axi entra identity-provider list --profile soc", "mg-axi entra identity-provider list --profile soc --limit 10", "mg-axi entra identity-provider list --profile soc --filter \"identityProviderType eq 'Google'\""] },
+    { path: "entra identity-provider show", description: "Show one workforce identity provider with the full reviewed property set; client secrets and key material are never returned", operation: "GET:/identity/identityProviders/{identityProviderBase-id}", flags: {
+            ...common, id: { value: "provider-id", required: true, description: "Identity provider object ID" },
+            select: providerRead.select,
+            fields: providerRead.fields,
+            full: providerRead.full,
+            scopes: providerRead.scopes,
+        }, examples: ["mg-axi entra identity-provider show --id <provider-id> --profile soc", "mg-axi entra identity-provider show --id <provider-id> --profile soc --full"] },
+    { path: "entra identity-provider count", description: "Count workforce identity providers as a scalar number; --filter narrows the count server-side", operation: "GET:/identity/identityProviders/$count", flags: {
+            ...common,
+            filter: providerRead.filter,
+            scopes: providerRead.scopes,
+        }, examples: ["mg-axi entra identity-provider count --profile soc", "mg-axi entra identity-provider count --profile soc --filter \"identityProviderType eq 'Google'\""] },
+    { path: "entra identity-provider available-types", description: "List available workforce identity-provider types for the tenant; availability does not mean a provider is configured", operation: "GET:/identity/identityProviders/availableProviderTypes()", flags: {
+            ...common,
+            scopes: providerRead.scopes,
+        }, examples: ["mg-axi entra identity-provider available-types --profile soc"] },
+    { path: "entra federation-configuration list", description: "List workforce federation configurations with compact properties (id, displayName); rows carry @odata.type naming the configuration kind; signing-certificate blobs are omitted by default", operation: "GET:/directory/federationConfigurations", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: federationRead.filter,
+            select: federationRead.select,
+            fields: federationRead.fields,
+            full: federationRead.full,
+            cursor: federationRead.cursor,
+            scopes: federationRead.scopes,
+        }, examples: ["mg-axi entra federation-configuration list --profile soc", "mg-axi entra federation-configuration list --profile soc --limit 10"] },
+    { path: "entra federation-configuration show", description: "Show one workforce federation configuration with the full reviewed property set except the signing-certificate blob, which needs an explicit --select", operation: "GET:/directory/federationConfigurations/{identityProviderBase-id}", flags: {
+            ...common, id: { value: "configuration-id", required: true, description: "Federation configuration object ID" },
+            select: federationRead.select,
+            fields: federationRead.fields,
+            full: federationRead.full,
+            scopes: federationRead.scopes,
+        }, examples: ["mg-axi entra federation-configuration show --id <configuration-id> --profile soc", "mg-axi entra federation-configuration show --id <configuration-id> --profile soc --full"] },
+    { path: "entra federation-configuration count", description: "Count workforce federation configurations as a scalar number; --filter narrows the count server-side", operation: "GET:/directory/federationConfigurations/$count", flags: {
+            ...common,
+            filter: federationRead.filter,
+            scopes: federationRead.scopes,
+        }, examples: ["mg-axi entra federation-configuration count --profile soc"] },
+    { path: "entra federation-configuration available-types", description: "List available workforce federation provider types for the tenant; availability does not mean a federation configuration exists", operation: "GET:/directory/federationConfigurations/availableProviderTypes()", flags: {
+            ...common,
+            scopes: federationRead.scopes,
+        }, examples: ["mg-axi entra federation-configuration available-types --profile soc"] },
+    { path: "entra deleted-user list", description: "List soft-deleted users in the directory recycle bin with compact rows (id, displayName, deletedDateTime); rows carry @odata.type naming the kind; Graph requires the user cast, so no untyped list", operation: "GET:/directory/deletedItems/graph.user", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: { value: "comma-separated-properties", description: "Request server properties from the reviewed deleted-user set (id, displayName, userPrincipalName, mail, userType, deletedDateTime); deleted users are personal data and defaults stay minimal" },
+            fields: deletedItemRead.fields,
+            full: deletedItemRead.full,
+            cursor: deletedItemRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to User.Read.All" },
+        }, examples: ["mg-axi entra deleted-user list --profile soc", "mg-axi entra deleted-user list --profile soc --limit 10"] },
+    { path: "entra deleted-user count", description: "Count soft-deleted users as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/directory/deletedItems/graph.user/$count", flags: {
+            ...common,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to User.Read.All" },
+        }, examples: ["mg-axi entra deleted-user count --profile soc"] },
+    { path: "entra deleted-group list", description: "List soft-deleted groups in the directory recycle bin with compact rows (id, displayName, deletedDateTime); rows carry @odata.type naming the kind; read groupTypes to name the real kind", operation: "GET:/directory/deletedItems/graph.group", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: { value: "comma-separated-properties", description: "Request server properties from the reviewed deleted-group set (id, displayName, mail, mailNickname, groupTypes, visibility, securityEnabled, deletedDateTime)" },
+            fields: deletedItemRead.fields,
+            full: deletedItemRead.full,
+            cursor: deletedItemRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Group.Read.All" },
+        }, examples: ["mg-axi entra deleted-group list --profile soc", "mg-axi entra deleted-group list --profile soc --limit 10"] },
+    { path: "entra deleted-group count", description: "Count soft-deleted groups as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/directory/deletedItems/graph.group/$count", flags: {
+            ...common,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Group.Read.All" },
+        }, examples: ["mg-axi entra deleted-group count --profile soc"] },
+    { path: "entra deleted-application list", description: "List soft-deleted applications in the directory recycle bin with compact rows (id, appId, displayName, deletedDateTime); appId (client ID) is distinct from the object id; credential collections are never selectable", operation: "GET:/directory/deletedItems/graph.application", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: { value: "comma-separated-properties", description: "Request server properties from the reviewed deleted-application set (id, appId, displayName, publisherDomain, signInAudience, deletedDateTime); credential collections are never selectable" },
+            fields: deletedItemRead.fields,
+            full: deletedItemRead.full,
+            cursor: deletedItemRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All" },
+        }, examples: ["mg-axi entra deleted-application list --profile soc", "mg-axi entra deleted-application list --profile soc --limit 10"] },
+    { path: "entra deleted-application count", description: "Count soft-deleted applications as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/directory/deletedItems/graph.application/$count", flags: {
+            ...common,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All" },
+        }, examples: ["mg-axi entra deleted-application count --profile soc"] },
+    { path: "entra deleted-service-principal list", description: "List soft-deleted service principals in the directory recycle bin with compact rows (id, appId, displayName, deletedDateTime); appId (client ID) is distinct from the object id", operation: "GET:/directory/deletedItems/graph.servicePrincipal", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: { value: "comma-separated-properties", description: "Request server properties from the reviewed deleted-service-principal set (id, appId, displayName, servicePrincipalType, accountEnabled, deletedDateTime)" },
+            fields: deletedItemRead.fields,
+            full: deletedItemRead.full,
+            cursor: deletedItemRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All" },
+        }, examples: ["mg-axi entra deleted-service-principal list --profile soc", "mg-axi entra deleted-service-principal list --profile soc --limit 10"] },
+    { path: "entra deleted-service-principal count", description: "Count soft-deleted service principals as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/directory/deletedItems/graph.servicePrincipal/$count", flags: {
+            ...common,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All" },
+        }, examples: ["mg-axi entra deleted-service-principal count --profile soc"] },
+    { path: "entra deleted-administrative-unit list", description: "List soft-deleted administrative units in the directory recycle bin with compact rows (id, displayName, deletedDateTime); rows carry @odata.type naming the kind", operation: "GET:/directory/deletedItems/graph.administrativeUnit", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: { value: "comma-separated-properties", description: "Request server properties from the reviewed deleted-administrative-unit set (id, displayName, description, visibility, membershipType, deletedDateTime)" },
+            fields: deletedItemRead.fields,
+            full: deletedItemRead.full,
+            cursor: deletedItemRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AdministrativeUnit.Read.All" },
+        }, examples: ["mg-axi entra deleted-administrative-unit list --profile soc", "mg-axi entra deleted-administrative-unit list --profile soc --limit 10"] },
+    { path: "entra deleted-administrative-unit count", description: "Count soft-deleted administrative units as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/directory/deletedItems/graph.administrativeUnit/$count", flags: {
+            ...common,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AdministrativeUnit.Read.All" },
+        }, examples: ["mg-axi entra deleted-administrative-unit count --profile soc"] },
+    { path: "entra deleted-item show", description: "Show one soft-deleted directory object by id with the cross-type safe properties (id, displayName, deletedDateTime) plus the @odata.type discriminator; per-type detail comes from the typed lists", operation: "GET:/directory/deletedItems/{directoryObject-id}", flags: {
+            ...common, id: { value: "object-id", required: true, description: "Deleted object ID" },
+            select: deletedItemRead.select,
+            fields: deletedItemRead.fields,
+            full: deletedItemRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only and required for delegated access: pass the scope matching the object's type (User.Read.All, Group.Read.All, Application.Read.All or AdministrativeUnit.Read.All) using full https://graph.microsoft.com/ names" },
+        }, examples: ["mg-axi entra deleted-item show --id <object-id> --profile soc --scopes https://graph.microsoft.com/User.Read.All"] },
+    { path: "entra data-policy-operation list", description: "List workforce data-policy operations with compact properties (id, status, userId, submittedDateTime); storageLocation always renders redacted and export submission is never sent; Graph documents $select only, so no --filter", operation: "GET:/dataPolicyOperations", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: dataPolicyRead.select,
+            fields: dataPolicyRead.fields,
+            full: dataPolicyRead.full,
+            cursor: dataPolicyRead.cursor,
+            scopes: dataPolicyRead.scopes,
+        }, examples: ["mg-axi entra data-policy-operation list --profile soc", "mg-axi entra data-policy-operation list --profile soc --limit 10"] },
+    { path: "entra data-policy-operation show", description: "Show one workforce data-policy operation with the full reviewed property set; storageLocation always renders redacted and export submission is never sent", operation: "GET:/dataPolicyOperations/{dataPolicyOperation-id}", flags: {
+            ...common, id: { value: "operation-id", required: true, description: "Data-policy-operation ID" },
+            select: dataPolicyRead.select,
+            fields: dataPolicyRead.fields,
+            full: dataPolicyRead.full,
+            scopes: dataPolicyRead.scopes,
+        }, examples: ["mg-axi entra data-policy-operation show --id <operation-id> --profile soc", "mg-axi entra data-policy-operation show --id <operation-id> --profile soc --full"] },
+    { path: "entra data-policy-operation count", description: "Count workforce data-policy operations as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/dataPolicyOperations/$count", flags: {
+            ...common,
+            scopes: dataPolicyRead.scopes,
+        }, examples: ["mg-axi entra data-policy-operation count --profile soc"] },
+    { path: "entra access-review definition list", description: "List access-review definitions with compact properties (id, displayName, status); definitions are review schedules (a series), never their occurrences", operation: "GET:/identityGovernance/accessReviews/definitions", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: accessReviewRead.filter,
+            select: accessReviewRead.select,
+            fields: accessReviewRead.fields,
+            full: accessReviewRead.full,
+            cursor: accessReviewRead.cursor,
+            scopes: accessReviewRead.scopes,
+        }, examples: ["mg-axi entra access-review definition list --profile soc", "mg-axi entra access-review definition list --profile soc --limit 10", "mg-axi entra access-review definition list --profile soc --filter \"status eq 'InProgress'\""] },
+    { path: "entra access-review definition show", description: "Show one access-review definition with the full reviewed schedule set; a definition never carries its instances", operation: "GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}", flags: {
+            ...common, id: { value: "definition-id", required: true, description: "Access-review definition ID" },
+            select: accessReviewRead.select,
+            fields: accessReviewRead.fields,
+            full: accessReviewRead.full,
+            scopes: accessReviewRead.scopes,
+        }, examples: ["mg-axi entra access-review definition show --id <definition-id> --profile soc", "mg-axi entra access-review definition show --id <definition-id> --profile soc --full"] },
+    { path: "entra access-review instance list", description: "List instances of one access-review definition (id, status, startDateTime, endDateTime); instances are occurrences of the schedule, never schedules themselves", operation: "GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances", flags: {
+            ...common, definition: { value: "definition-id", required: true, description: "Parent access-review definition ID whose instances are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: accessReviewRead.filter,
+            select: accessReviewRead.select,
+            fields: accessReviewRead.fields,
+            full: accessReviewRead.full,
+            cursor: accessReviewRead.cursor,
+            scopes: accessReviewRead.scopes,
+        }, examples: ["mg-axi entra access-review instance list --definition <definition-id> --profile soc", "mg-axi entra access-review instance list --definition <definition-id> --profile soc --filter \"status eq 'InProgress'\""] },
+    { path: "entra access-review instance show", description: "Show one access-review instance with the full reviewed occurrence set", operation: "GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}", flags: {
+            ...common, definition: { value: "definition-id", required: true, description: "Parent access-review definition ID" },
+            id: { value: "instance-id", required: true, description: "Access-review instance ID" },
+            select: accessReviewRead.select,
+            fields: accessReviewRead.fields,
+            full: accessReviewRead.full,
+            scopes: accessReviewRead.scopes,
+        }, examples: ["mg-axi entra access-review instance show --definition <definition-id> --id <instance-id> --profile soc", "mg-axi entra access-review instance show --definition <definition-id> --id <instance-id> --profile soc --full"] },
+    { path: "entra access-review decision list", description: "List decision items of one access-review instance (id, accessReviewId, decision, recommendation); decisions are read-only here and listing never approves, denies or applies anything", operation: "GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions", flags: {
+            ...common, definition: { value: "definition-id", required: true, description: "Parent access-review definition ID" },
+            instance: { value: "instance-id", required: true, description: "Parent access-review instance ID whose decisions are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: accessReviewRead.filter,
+            select: accessReviewRead.select,
+            fields: accessReviewRead.fields,
+            full: accessReviewRead.full,
+            cursor: accessReviewRead.cursor,
+            scopes: accessReviewRead.scopes,
+        }, examples: ["mg-axi entra access-review decision list --definition <definition-id> --instance <instance-id> --profile soc", "mg-axi entra access-review decision list --definition <definition-id> --instance <instance-id> --profile soc --filter \"decision eq 'NotReviewed'\""] },
+    { path: "entra access-review decision show", description: "Show one access-review decision item with the full reviewed outcome set; showing never approves, denies or applies anything", operation: "GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/decisions/{accessReviewInstanceDecisionItem-id}", flags: {
+            ...common, definition: { value: "definition-id", required: true, description: "Parent access-review definition ID" },
+            instance: { value: "instance-id", required: true, description: "Parent access-review instance ID" },
+            id: { value: "decision-id", required: true, description: "Access-review decision item ID" },
+            select: accessReviewRead.select,
+            fields: accessReviewRead.fields,
+            full: accessReviewRead.full,
+            scopes: accessReviewRead.scopes,
+        }, examples: ["mg-axi entra access-review decision show --definition <definition-id> --instance <instance-id> --id <decision-id> --profile soc"] },
+    { path: "entra access-review contacted-reviewer list", description: "List contacted reviewers of one access-review instance (id, displayName, userPrincipalName); reviewers recorded on the instance, whether or not notified, never review outcomes", operation: "GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/contactedReviewers", flags: {
+            ...common, definition: { value: "definition-id", required: true, description: "Parent access-review definition ID" },
+            instance: { value: "instance-id", required: true, description: "Parent access-review instance ID whose contacted reviewers are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: accessReviewRead.filterReviewer,
+            select: accessReviewRead.select,
+            fields: accessReviewRead.fields,
+            full: accessReviewRead.full,
+            cursor: accessReviewRead.cursor,
+            scopes: accessReviewRead.scopes,
+        }, examples: ["mg-axi entra access-review contacted-reviewer list --definition <definition-id> --instance <instance-id> --profile soc"] },
+    { path: "entra access-review contacted-reviewer show", description: "Show one contacted reviewer with the full reviewed identity set", operation: "GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/contactedReviewers/{accessReviewReviewer-id}", flags: {
+            ...common, definition: { value: "definition-id", required: true, description: "Parent access-review definition ID" },
+            instance: { value: "instance-id", required: true, description: "Parent access-review instance ID" },
+            id: { value: "reviewer-id", required: true, description: "Contacted reviewer ID" },
+            select: accessReviewRead.select,
+            fields: accessReviewRead.fields,
+            full: accessReviewRead.full,
+            scopes: accessReviewRead.scopes,
+        }, examples: ["mg-axi entra access-review contacted-reviewer show --definition <definition-id> --instance <instance-id> --id <reviewer-id> --profile soc"] },
+    { path: "entra access-review stage list", description: "List stages of one access-review instance (id, status, startDateTime, endDateTime); stages are sequential phases, present only when the definition sets stageSettings", operation: "GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages", flags: {
+            ...common, definition: { value: "definition-id", required: true, description: "Parent access-review definition ID" },
+            instance: { value: "instance-id", required: true, description: "Parent access-review instance ID whose stages are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: accessReviewRead.filterStage,
+            select: accessReviewRead.select,
+            fields: accessReviewRead.fields,
+            full: accessReviewRead.full,
+            cursor: accessReviewRead.cursor,
+            scopes: accessReviewRead.scopes,
+        }, examples: ["mg-axi entra access-review stage list --definition <definition-id> --instance <instance-id> --profile soc", "mg-axi entra access-review stage list --definition <definition-id> --instance <instance-id> --profile soc --filter \"status eq 'InProgress'\""] },
+    { path: "entra access-review stage show", description: "Show one access-review stage with the full reviewed phase set including reviewer scopes; per-stage decisions belong to a later slice", operation: "GET:/identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinition-id}/instances/{accessReviewInstance-id}/stages/{accessReviewStage-id}", flags: {
+            ...common, definition: { value: "definition-id", required: true, description: "Parent access-review definition ID" },
+            instance: { value: "instance-id", required: true, description: "Parent access-review instance ID" },
+            id: { value: "stage-id", required: true, description: "Access-review stage ID" },
+            select: accessReviewRead.select,
+            fields: accessReviewRead.fields,
+            full: accessReviewRead.full,
+            scopes: accessReviewRead.scopes,
+        }, examples: ["mg-axi entra access-review stage show --definition <definition-id> --instance <instance-id> --id <stage-id> --profile soc"] },
+    { path: "entra entitlement catalog list", description: "List entitlement catalogs with compact properties (id, displayName, state, catalogType); catalogs are package containers and never carry their access packages", operation: "GET:/identityGovernance/entitlementManagement/catalogs", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: entitlementRead.filter,
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            cursor: entitlementRead.cursor,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement catalog list --profile soc", "mg-axi entra entitlement catalog list --profile soc --limit 10", "mg-axi entra entitlement catalog list --profile soc --filter \"state eq 'Published'\""] },
+    { path: "entra entitlement catalog show", description: "Show one entitlement catalog with the full reviewed container set", operation: "GET:/identityGovernance/entitlementManagement/catalogs/{accessPackageCatalog-id}", flags: {
+            ...common,
+            id: { value: "catalog-id", required: true, description: "Entitlement catalog ID" },
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement catalog show --id <catalog-id> --profile soc", "mg-axi entra entitlement catalog show --id <catalog-id> --profile soc --full"] },
+    { path: "entra entitlement catalog count", description: "Count entitlement catalogs as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/entitlementManagement/catalogs/$count", flags: {
+            ...common,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement catalog count --profile soc"] },
+    { path: "entra entitlement access-package list", description: "List access packages with compact properties (id, displayName, isHidden); assignment and request detail lives on the assignment reads, never on these reads", operation: "GET:/identityGovernance/entitlementManagement/accessPackages", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: entitlementRead.filter,
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            cursor: entitlementRead.cursor,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement access-package list --profile soc", "mg-axi entra entitlement access-package list --profile soc --limit 10", "mg-axi entra entitlement access-package list --profile soc --filter \"isHidden eq false\""] },
+    { path: "entra entitlement access-package show", description: "Show one access package with the full reviewed bundle set", operation: "GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}", flags: {
+            ...common,
+            id: { value: "access-package-id", required: true, description: "Access package ID" },
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement access-package show --id <access-package-id> --profile soc", "mg-axi entra entitlement access-package show --id <access-package-id> --profile soc --full"] },
+    { path: "entra entitlement access-package count", description: "Count access packages as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/entitlementManagement/accessPackages/$count", flags: {
+            ...common,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement access-package count --profile soc"] },
+    { path: "entra entitlement assignment-policy list", description: "List assignment policies of one access package (id, displayName, allowedTargetScope); policies name who may request and how approval and review run", operation: "GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies", flags: {
+            ...common,
+            "access-package": { value: "access-package-id", required: true, description: "Parent access package ID whose assignment policies are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: entitlementRead.filter,
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            cursor: entitlementRead.cursor,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement assignment-policy list --access-package <access-package-id> --profile soc", "mg-axi entra entitlement assignment-policy list --access-package <access-package-id> --profile soc --filter \"allowedTargetScope eq 'specificDirectoryUsers'\""] },
+    { path: "entra entitlement assignment-policy show", description: "Show one assignment policy with the full reviewed request, approval and review set; questions and custom-extension stages belong to a later slice", operation: "GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}", flags: {
+            ...common,
+            "access-package": { value: "access-package-id", required: true, description: "Parent access package ID" },
+            id: { value: "policy-id", required: true, description: "Assignment policy ID" },
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement assignment-policy show --access-package <access-package-id> --id <policy-id> --profile soc"] },
+    { path: "entra entitlement assignment-policy count", description: "Count the assignment policies of one access package as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/$count", flags: {
+            ...common,
+            "access-package": { value: "access-package-id", required: true, description: "Parent access package ID whose assignment policies are counted" },
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement assignment-policy count --access-package <access-package-id> --profile soc"] },
+    { path: "entra entitlement resource-role-scope list", description: "List resource-role scopes of one access package (id, createdDateTime); the linked role and scope detail needs $expand and belongs to a later slice", operation: "GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes", flags: {
+            ...common,
+            "access-package": { value: "access-package-id", required: true, description: "Parent access package ID whose resource-role scopes are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: entitlementRead.filter,
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            cursor: entitlementRead.cursor,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement resource-role-scope list --access-package <access-package-id> --profile soc"] },
+    { path: "entra entitlement resource-role-scope show", description: "Show one resource-role scope with the reviewed pairing set", operation: "GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}", flags: {
+            ...common,
+            "access-package": { value: "access-package-id", required: true, description: "Parent access package ID" },
+            id: { value: "scope-id", required: true, description: "Resource-role scope ID" },
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement resource-role-scope show --access-package <access-package-id> --id <scope-id> --profile soc"] },
+    { path: "entra entitlement resource-role-scope count", description: "Count the resource-role scopes of one access package as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/$count", flags: {
+            ...common,
+            "access-package": { value: "access-package-id", required: true, description: "Parent access package ID whose resource-role scopes are counted" },
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement resource-role-scope count --access-package <access-package-id> --profile soc"] },
+    { path: "entra entitlement assignment list", description: "List access-package assignments with compact linkage rows (id, state, targetId, targetDisplayName, accessPackageId, dates); rows flatten one fixed documented $expand and carry no justification or answers", operation: "GET:/identityGovernance/entitlementManagement/assignments", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: entitlementRead.filter,
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            cursor: entitlementRead.cursor,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement assignment list --profile soc", "mg-axi entra entitlement assignment list --profile soc --limit 10", "mg-axi entra entitlement assignment list --profile soc --filter \"state eq 'Delivered'\""] },
+    { path: "entra entitlement assignment show", description: "Show one assignment with the full reviewed grant set and flattened target and access-package linkage", operation: "GET:/identityGovernance/entitlementManagement/assignments/{accessPackageAssignment-id}", flags: {
+            ...common,
+            id: { value: "assignment-id", required: true, description: "Access-package assignment ID" },
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement assignment show --id <assignment-id> --profile soc"] },
+    { path: "entra entitlement assignment count", description: "Count assignments as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/entitlementManagement/assignments/$count", flags: {
+            ...common,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement assignment count --profile soc"] },
+    { path: "entra entitlement assignment-request list", description: "List access-package assignment requests with compact linkage rows (id, requestType, state, accessPackageId, assignmentId, dates); justification text and answers ride only behind an explicit --select", operation: "GET:/identityGovernance/entitlementManagement/assignmentRequests", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: entitlementRead.filter,
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            cursor: entitlementRead.cursor,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement assignment-request list --profile soc", "mg-axi entra entitlement assignment-request list --profile soc --limit 10", "mg-axi entra entitlement assignment-request list --profile soc --filter \"state eq 'Delivered'\""] },
+    { path: "entra entitlement assignment-request show", description: "Show one assignment request with the reviewed processing set and flattened linkage; justification and answers stay behind an explicit --select even here", operation: "GET:/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}", flags: {
+            ...common,
+            id: { value: "request-id", required: true, description: "Access-package assignment request ID" },
+            select: entitlementRead.select,
+            fields: entitlementRead.fields,
+            full: entitlementRead.full,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement assignment-request show --id <request-id> --profile soc"] },
+    { path: "entra entitlement assignment-request count", description: "Count assignment requests as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/entitlementManagement/assignmentRequests/$count", flags: {
+            ...common,
+            scopes: entitlementRead.scopes,
+        }, examples: ["mg-axi entra entitlement assignment-request count --profile soc"] },
+    { path: "entra lifecycle workflow list", description: "List lifecycle workflows with compact properties (id, displayName, category, isEnabled, isSchedulingEnabled); rows never carry tasks, runs or processing results", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleWorkflowRead.filter,
+            select: lifecycleWorkflowRead.select,
+            fields: lifecycleWorkflowRead.fields,
+            full: lifecycleWorkflowRead.full,
+            cursor: lifecycleWorkflowRead.cursor,
+            scopes: lifecycleWorkflowRead.scopes,
+        }, examples: ["mg-axi entra lifecycle workflow list --profile soc", "mg-axi entra lifecycle workflow list --profile soc --limit 10", "mg-axi entra lifecycle workflow list --profile soc --filter \"category eq 'leaver'\""] },
+    { path: "entra lifecycle workflow show", description: "Show one lifecycle workflow with the full reviewed scalar set; tasks, runs and processing results belong to later slices", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}", flags: {
+            ...common,
+            id: { value: "workflow-id", required: true, description: "Lifecycle workflow ID" },
+            select: lifecycleWorkflowRead.select,
+            fields: lifecycleWorkflowRead.fields,
+            full: lifecycleWorkflowRead.full,
+            scopes: lifecycleWorkflowRead.scopes,
+        }, examples: ["mg-axi entra lifecycle workflow show --id <workflow-id> --profile soc"] },
+    { path: "entra lifecycle workflow count", description: "Count lifecycle workflows as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/$count", flags: {
+            ...common,
+            scopes: lifecycleWorkflowRead.scopes,
+        }, examples: ["mg-axi entra lifecycle workflow count --profile soc"] },
+    { path: "entra lifecycle workflow-template list", description: "List lifecycle workflow templates with compact properties (id, displayName, category); template tasks belong to a later slice", operation: "GET:/identityGovernance/lifecycleWorkflows/workflowTemplates", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleGovernanceRead.filter,
+            select: lifecycleGovernanceRead.select,
+            fields: lifecycleGovernanceRead.fields,
+            full: lifecycleGovernanceRead.full,
+            cursor: lifecycleGovernanceRead.cursor,
+            scopes: lifecycleGovernanceRead.scopes,
+        }, examples: ["mg-axi entra lifecycle workflow-template list --profile soc", "mg-axi entra lifecycle workflow-template list --profile soc --limit 10", "mg-axi entra lifecycle workflow-template list --profile soc --filter \"category eq 'joiner'\""] },
+    { path: "entra lifecycle workflow-template show", description: "Show one lifecycle workflow template with the reviewed set; Graph documents no query parameters here so rows always arrive whole", operation: "GET:/identityGovernance/lifecycleWorkflows/workflowTemplates/{workflowTemplate-id}", flags: {
+            ...common,
+            id: { value: "template-id", required: true, description: "Workflow template ID" },
+            fields: lifecycleGovernanceRead.fields,
+            full: lifecycleGovernanceRead.full,
+            scopes: lifecycleGovernanceRead.scopes,
+        }, examples: ["mg-axi entra lifecycle workflow-template show --id <template-id> --profile soc"] },
+    { path: "entra lifecycle workflow-template count", description: "Count lifecycle workflow templates as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflowTemplates/$count", flags: {
+            ...common,
+            scopes: lifecycleGovernanceRead.scopes,
+        }, examples: ["mg-axi entra lifecycle workflow-template count --profile soc"] },
+    { path: "entra lifecycle task-definition list", description: "List lifecycle task definitions with compact properties (id, displayName, category, version); definitions carry no relationships", operation: "GET:/identityGovernance/lifecycleWorkflows/taskDefinitions", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleGovernanceRead.filter,
+            select: lifecycleGovernanceRead.select,
+            fields: lifecycleGovernanceRead.fields,
+            full: lifecycleGovernanceRead.full,
+            cursor: lifecycleGovernanceRead.cursor,
+            scopes: lifecycleGovernanceRead.scopes,
+        }, examples: ["mg-axi entra lifecycle task-definition list --profile soc", "mg-axi entra lifecycle task-definition list --profile soc --limit 10", "mg-axi entra lifecycle task-definition list --profile soc --filter \"category eq 'joiner'\""] },
+    { path: "entra lifecycle task-definition show", description: "Show one lifecycle task definition with the full reviewed parameter set", operation: "GET:/identityGovernance/lifecycleWorkflows/taskDefinitions/{taskDefinition-id}", flags: {
+            ...common,
+            id: { value: "task-definition-id", required: true, description: "Task definition ID" },
+            select: lifecycleGovernanceRead.select,
+            fields: lifecycleGovernanceRead.fields,
+            full: lifecycleGovernanceRead.full,
+            scopes: lifecycleGovernanceRead.scopes,
+        }, examples: ["mg-axi entra lifecycle task-definition show --id <task-definition-id> --profile soc"] },
+    { path: "entra lifecycle task-definition count", description: "Count lifecycle task definitions as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/taskDefinitions/$count", flags: {
+            ...common,
+            scopes: lifecycleGovernanceRead.scopes,
+        }, examples: ["mg-axi entra lifecycle task-definition count --profile soc"] },
+    { path: "entra lifecycle settings show", description: "Show the lifecycle-workflows tenant settings (schedule interval, email and quarantine configuration); updating settings belongs to no read slice", operation: "GET:/identityGovernance/lifecycleWorkflows/settings", flags: {
+            ...common,
+            select: lifecycleGovernanceRead.select,
+            fields: lifecycleGovernanceRead.fields,
+            full: lifecycleGovernanceRead.full,
+            scopes: lifecycleGovernanceRead.scopes,
+        }, examples: ["mg-axi entra lifecycle settings show --profile soc"] },
+    { path: "entra lifecycle run list", description: "List runs of one lifecycle workflow with compact properties (id, processingStatus, user counts); rows never carry processing results", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs", flags: {
+            ...common,
+            workflow: lifecycleReportsRead.workflow,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleReportsRead.filter,
+            select: lifecycleReportsRead.select,
+            fields: lifecycleReportsRead.fields,
+            full: lifecycleReportsRead.full,
+            cursor: lifecycleReportsRead.cursor,
+            scopes: lifecycleReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run list --workflow <workflow-id> --profile soc", "mg-axi entra lifecycle run list --workflow <workflow-id> --profile soc --limit 10", "mg-axi entra lifecycle run list --workflow <workflow-id> --profile soc --filter \"processingStatus eq 'completed'\""] },
+    { path: "entra lifecycle run show", description: "Show one lifecycle workflow run with the full reviewed scalar set; processing results belong to later slices", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}", flags: {
+            ...common,
+            workflow: lifecycleReportsRead.workflow,
+            id: { value: "run-id", required: true, description: "Lifecycle workflow run ID" },
+            select: lifecycleReportsRead.select,
+            fields: lifecycleReportsRead.fields,
+            full: lifecycleReportsRead.full,
+            scopes: lifecycleReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run show --workflow <workflow-id> --id <run-id> --profile soc"] },
+    { path: "entra lifecycle run count", description: "Count runs of one lifecycle workflow as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/$count", flags: {
+            ...common,
+            workflow: lifecycleReportsRead.workflow,
+            scopes: lifecycleReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run count --workflow <workflow-id> --profile soc"] },
+    { path: "entra lifecycle user-processing-result list", description: "List user processing results of one lifecycle workflow with minimal personal-data properties (id, processingStatus, task counts); the subject link is never requested", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/userProcessingResults", flags: {
+            ...common,
+            workflow: lifecycleReportsRead.workflow,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleReportsRead.filter,
+            select: lifecycleReportsRead.select,
+            fields: lifecycleReportsRead.fields,
+            full: lifecycleReportsRead.full,
+            cursor: lifecycleReportsRead.cursor,
+            scopes: lifecycleReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle user-processing-result list --workflow <workflow-id> --profile soc", "mg-axi entra lifecycle user-processing-result list --workflow <workflow-id> --profile soc --limit 10"] },
+    { path: "entra lifecycle user-processing-result show", description: "Show one user processing result with minimal personal-data properties; the subject link stays out", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/userProcessingResults/{userProcessingResult-id}", flags: {
+            ...common,
+            workflow: lifecycleReportsRead.workflow,
+            id: { value: "user-processing-result-id", required: true, description: "User processing result ID" },
+            select: lifecycleReportsRead.select,
+            fields: lifecycleReportsRead.fields,
+            full: lifecycleReportsRead.full,
+            scopes: lifecycleReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle user-processing-result show --workflow <workflow-id> --id <result-id> --profile soc"] },
+    { path: "entra lifecycle user-processing-result count", description: "Count user processing results of one lifecycle workflow as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/userProcessingResults/$count", flags: {
+            ...common,
+            workflow: lifecycleReportsRead.workflow,
+            scopes: lifecycleReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle user-processing-result count --workflow <workflow-id> --profile soc"] },
+    { path: "entra lifecycle subject-processing-result list", description: "List subject processing results of one lifecycle workflow with minimal personal-data properties; Graph documents no $select here so rows always arrive whole", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/subjectProcessingResults", flags: {
+            ...common,
+            workflow: lifecycleSubjectRead.workflow,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleSubjectRead.filter,
+            fields: lifecycleSubjectRead.fields,
+            full: lifecycleSubjectRead.full,
+            cursor: lifecycleSubjectRead.cursor,
+            scopes: lifecycleSubjectRead.scopes,
+        }, examples: ["mg-axi entra lifecycle subject-processing-result list --workflow <workflow-id> --profile soc", "mg-axi entra lifecycle subject-processing-result list --workflow <workflow-id> --profile soc --limit 10"] },
+    { path: "entra lifecycle subject-processing-result show", description: "Show one subject processing result with minimal personal-data properties; the get documents $expand only so the row always arrives whole and the subject navigation stays out", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/subjectProcessingResults/{subjectProcessingResult-id}", flags: {
+            ...common,
+            workflow: lifecycleSubjectRead.workflow,
+            id: { value: "subject-processing-result-id", required: true, description: "Subject processing result ID" },
+            fields: lifecycleSubjectRead.fields,
+            full: lifecycleSubjectRead.full,
+            scopes: lifecycleSubjectRead.scopes,
+        }, examples: ["mg-axi entra lifecycle subject-processing-result show --workflow <workflow-id> --id <result-id> --profile soc"] },
+    { path: "entra lifecycle subject-processing-result count", description: "Count subject processing results of one lifecycle workflow as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/subjectProcessingResults/$count", flags: {
+            ...common,
+            workflow: lifecycleSubjectRead.workflow,
+            scopes: lifecycleSubjectRead.scopes,
+        }, examples: ["mg-axi entra lifecycle subject-processing-result count --workflow <workflow-id> --profile soc"] },
+    { path: "entra lifecycle task-report list", description: "List task reports of one lifecycle workflow with compact properties (id, runId, processingStatus, user counts); rows never carry task, task-definition or processing-result detail", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports", flags: {
+            ...common,
+            workflow: lifecycleTaskReportRead.workflow,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleTaskReportRead.filter,
+            select: lifecycleTaskReportRead.select,
+            fields: lifecycleTaskReportRead.fields,
+            full: lifecycleTaskReportRead.full,
+            cursor: lifecycleTaskReportRead.cursor,
+            scopes: lifecycleTaskReportRead.scopes,
+        }, examples: ["mg-axi entra lifecycle task-report list --workflow <workflow-id> --profile soc", "mg-axi entra lifecycle task-report list --workflow <workflow-id> --profile soc --limit 10", "mg-axi entra lifecycle task-report list --workflow <workflow-id> --profile soc --filter \"processingStatus eq 'completed'\""] },
+    { path: "entra lifecycle task-report show", description: "Show one task report with the full reviewed scalar set; Graph documents no query parameters here so the row always arrives whole and task, task-definition and processing-result detail belongs to later slices", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/{taskReport-id}", flags: {
+            ...common,
+            workflow: lifecycleTaskReportShow.workflow,
+            id: lifecycleTaskReportShow.id,
+            fields: lifecycleTaskReportShow.fields,
+            full: lifecycleTaskReportShow.full,
+            scopes: lifecycleTaskReportShow.scopes,
+        }, examples: ["mg-axi entra lifecycle task-report show --workflow <workflow-id> --id <report-id> --profile soc"] },
+    { path: "entra lifecycle task-report count", description: "Count task reports of one lifecycle workflow as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/$count", flags: {
+            ...common,
+            workflow: lifecycleTaskReportRead.workflow,
+            scopes: lifecycleTaskReportRead.scopes,
+        }, examples: ["mg-axi entra lifecycle task-report count --workflow <workflow-id> --profile soc"] },
+    { path: "entra lifecycle task-report task show", description: "Show the workflow task behind one task report with the full reviewed set including arguments; Graph documents no query parameters here so the row always arrives whole and task processing results belong to a later slice", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/{taskReport-id}/task", flags: {
+            ...common,
+            workflow: lifecycleTaskReportSubRead.workflow,
+            report: lifecycleTaskReportSubRead.report,
+            fields: lifecycleTaskReportSubRead.fields,
+            full: lifecycleTaskReportSubRead.full,
+            scopes: lifecycleTaskReportSubRead.scopes,
+        }, examples: ["mg-axi entra lifecycle task-report task show --workflow <workflow-id> --report <report-id> --profile soc"] },
+    { path: "entra lifecycle task-report task-definition show", description: "Show the task definition behind one task report with the full reviewed parameter set; Graph documents no query parameters here so the row always arrives whole", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/taskReports/{taskReport-id}/taskDefinition", flags: {
+            ...common,
+            workflow: lifecycleTaskReportSubRead.workflow,
+            report: lifecycleTaskReportSubRead.report,
+            fields: lifecycleTaskReportSubRead.fields,
+            full: lifecycleTaskReportSubRead.full,
+            scopes: lifecycleTaskReportSubRead.scopes,
+        }, examples: ["mg-axi entra lifecycle task-report task-definition show --workflow <workflow-id> --report <report-id> --profile soc"] },
+    { path: "api get", description: "Reviewed read-only raw Graph GET (API-01, v1.0 only): users, groups, conditional access, authentication methods, audit/sign-in, risk, apps, roles/PIM, devices, administrative units, domains, domain DNS records, identity providers, organizations, branding, access reviews, entitlement catalogs and access packages, lifecycle workflows, workflow templates, task definitions, lifecycle settings, workflow runs, user/subject processing results and task reports, and partner contracts; unreviewed, secret-value, mail/file-content, beta and write routes are refused before credentials", positional: { name: "path", description: "Server-relative Graph path, e.g. /users" }, flags: {
+            ...common,
+            odata: { value: "k=v&k2=v2", description: "OData query reviewed per route ($select/$filter/$top/$orderby on collections; $select on singles); defaults to reviewed fields" },
+            cursor: { value: "token|-", description: "Resume a partial collection; - reads the token from stdin (16 MB ceiling for either input); use the same path, profile and scopes, and omit --odata to reuse its query" },
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit full https://graph.microsoft.com/ scope names; application profiles use the .default audience" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; use --all to follow pages within budget" },
+            all: { description: "Follow @odata.nextLink pages within the request budget" },
+            full: { description: "Disable 4000-character string truncation; never disables redaction or row caps" },
+        }, examples: ["mg-axi api get /users --scopes https://graph.microsoft.com/User.Read.All", "mg-axi api get /groups --odata '$filter=securityEnabled eq true&$top=5' --scopes https://graph.microsoft.com/GroupMember.Read.All", "mg-axi api get /users --cursor - --all --scopes https://graph.microsoft.com/User.Read.All < cursor.txt"] },
+];
+export function leafHelp(leaf) {
+    return [
+        `mg-axi ${leaf.path}${leaf.positional ? ` <${leaf.positional.name}>` : ""}`, leaf.description,
+        ...(leaf.positional ? [`<${leaf.positional.name}>: ${leaf.positional.description}`] : []),
+        ...Object.entries(leaf.flags).map(([name, flag]) => `--${name}${flag.value ? ` <${flag.value}>` : ""}: ${flag.description}${flag.default ? ` (default: ${flag.default})` : ""}${flag.required ? " (required)" : ""}`),
+        "--help: Show this reference",
+        ...leaf.examples,
+    ].join("\n");
+}
+export const TOP_LEVEL_HELP = [DESCRIPTION, ...LEAVES.map(leaf => leafHelp(leaf)), "-v, -V, --version: Print the bare version"].join("\n\n");
+export function resolveCommand(argv) {
+    const words = argv.slice(0, argv.findIndex(arg => arg.startsWith("-")) < 0 ? argv.length : argv.findIndex(arg => arg.startsWith("-")));
+    const path = words.join(" ") || "home";
+    let leaf = LEAVES.find(item => item.path === path);
+    let positional;
+    let flagStart = words.length;
+    if (!leaf) {
+        if (words[0] !== "api")
+            throw new AxiError("unknown or incomplete command", "VALIDATION_ERROR", [TOP_LEVEL_HELP]);
+        leaf = LEAVES.find(item => item.path === "api get");
+        const help = leafHelp(leaf);
+        const verb = words[1];
+        if (verb === undefined)
+            throw new AxiError("unknown or incomplete command", "VALIDATION_ERROR", [TOP_LEVEL_HELP]);
+        if (verb.toLowerCase() !== "get")
+            throw new AxiError(`mg-axi api serves reviewed GET reads only; got api ${verb}`, "VALIDATION_ERROR", [help]);
+        if (words.length < 3 || words[2].startsWith("-"))
+            throw new AxiError("missing path for `mg-axi api get`", "VALIDATION_ERROR", ["Example: mg-axi api get /users --scopes https://graph.microsoft.com/User.Read.All", help]);
+        if (words.length > 3)
+            throw new AxiError(`unexpected argument \`${words[3]}\` for \`mg-axi api get\``, "VALIDATION_ERROR", ["Pass one path before flags: mg-axi api get <path> [--odata 'k=v']", help]);
+        positional = words[2];
+        flagStart = 3;
+    }
+    const help = leafHelp(leaf);
+    const fail = (message) => { throw new AxiError(message, "VALIDATION_ERROR", [help]); };
+    const flags = Object.create(null);
+    for (let i = flagStart; i < argv.length; i++) {
+        const arg = argv[i];
+        const match = /^--([a-z-]+)(?:=(.*))?$/.exec(arg);
+        if (!match)
+            fail("unexpected argument or short flag");
+        const name = match[1];
+        const flag = Object.hasOwn(leaf.flags, name) ? leaf.flags[name] : name === "help" ? { description: "Help" } : undefined;
+        if (!flag)
+            fail(leaf.path === "api get" && name === "query" ? "--query is reserved for output queries; use --odata for server OData parameters" : `unknown flag --${name}`);
+        if (Object.hasOwn(flags, name))
+            fail(`duplicate flag --${name}`);
+        if (flag.value) {
+            const value = match[2] ?? argv[++i];
+            if (!value?.trim() || (value.startsWith("-") && !(name === "cursor" && value === "-" && String(flag.value ?? "").includes("|-"))))
+                fail(`--${name} requires a non-empty value`);
+            flags[name] = value;
+        }
+        else {
+            if (match[2] !== undefined)
+                fail(`--${name} does not take a value`);
+            flags[name] = true;
+        }
+    }
+    if (flags["api-version"] && !API_VERSIONS.includes(String(flags["api-version"])))
+        fail(`--api-version must be ${API_VERSIONS.join(" or ")}`);
+    if (flags.mode && !PARSE_MODES.includes(String(flags.mode)))
+        fail("--mode must be delegated or application");
+    if (flags.limit && (!/^[1-9]\d*$/.test(String(flags.limit)) || !Number.isSafeInteger(Number(flags.limit))))
+        fail("--limit must be a positive safe integer");
+    if (flags.limit && flags.all)
+        fail("--limit and --all cannot be combined");
+    if (!flags.help)
+        for (const [name, flag] of Object.entries(leaf.flags))
+            if (flag.required && !flags[name])
+                fail(`--${name} is required`);
+    if (!flags.help && leaf.positional && positional === undefined)
+        fail(`missing ${leaf.positional.name} for \`mg-axi ${leaf.path}\``);
+    return { leaf, flags, positional };
+}
+export function operationFor(leaf, version) {
+    const inventory = JSON.parse(readFileSync(new URL("../inventory/operations.json", import.meta.url), "utf8"));
+    return inventory.operations.find((row) => row.id === `${version}:${leaf.operation}`);
+}
+// Next-step hints shared by the no-args home view and the installable
+// skill, so the two cannot drift apart. home() prints them alongside live
+// profile status; skillDocument() in docs.ts reprints them.
+export const HOME_HELP = ["npx -y @knowttl/mg-axi setup", "npx -y @knowttl/mg-axi doctor", "npx -y @knowttl/mg-axi entra user list --help", "npx -y @knowttl/mg-axi entra user show --help", "npx -y @knowttl/mg-axi entra group list --help", "npx -y @knowttl/mg-axi entra group member list --help", "npx -y @knowttl/mg-axi entra application list --help", "npx -y @knowttl/mg-axi entra service-principal list --help", "npx -y @knowttl/mg-axi entra conditional-access policy list --help", "npx -y @knowttl/mg-axi api get --help"];
+// A useful local status, without treating unavailable tenant summaries as zeros.
+export function home() {
+    const bin = resolve(process.argv[1]);
+    return {
+        bin: bin.startsWith(`${homedir()}${sep}`) ? `~${bin.slice(homedir().length)}` : bin,
+        description: DESCRIPTION,
+        profile: "unavailable: no profile configured",
+        tenant: "unavailable: no tenant selected",
+        domains: [{ name: "entra", status: "scheduled", summary: "Tenant summaries await Graph execution" }],
+        help: [...HOME_HELP],
+    };
+}