@knowttl/mg-axi 0.1.0

package/dist/doctor.js

@@ -0,0 +1,75 @@
+import { AxiError } from "axi-sdk-js";
+import { LEAVES, operationFor } from "./catalogue.js";
+import { listUsers } from "./entra-users.js";
+// PACK-01: explicit release health check over the reviewed read-only session.
+// Doctor performs one documented bounded read per profile (entra user list
+// with a one-row window) and reports configuration, connectivity,
+// authentication and access failures. Credential acquisition stays silent:
+// DelegatedAuth.credential and ApplicationAuth.credential never open a
+// browser or device-code flow, so doctor never signs in interactively.
+// Doctor never auto-installs, changes profiles or enables Graph writes;
+// silent token refresh may update the protected credential cache.
+// See README.md for usage.
+export const DOCTOR_OPERATION = "GET:/users";
+export const DOCTOR_VERSION = "v1.0";
+export const DOCTOR_CHECK = `entra user list --limit 1 (${DOCTOR_VERSION}:${DOCTOR_OPERATION})`;
+export function doctorTargets(store, flag) {
+    if (flag !== undefined)
+        return [store.resolve(flag).name];
+    const items = store.list();
+    if (!items.length)
+        return [];
+    try {
+        return [store.resolve(undefined).name];
+    }
+    catch {
+        return items.map(item => item.name);
+    }
+}
+export async function runDoctor(args) {
+    if (!args.names.length) {
+        throw new AxiError("No profiles are configured", "AUTH_REQUIRED", ["npx -y @knowttl/mg-axi profile create --help", "npx -y @knowttl/mg-axi setup"]);
+    }
+    const leaf = LEAVES.find(item => item.path === "entra user list");
+    const operation = leaf === undefined ? undefined : operationFor(leaf, DOCTOR_VERSION);
+    if (!operation || operation.method !== "GET") {
+        throw new AxiError(`Unknown catalogued Graph operation for ${DOCTOR_CHECK}`, "VALIDATION_ERROR", ["npx -y @knowttl/mg-axi entra user list --help"]);
+    }
+    const profiles = [];
+    for (const name of args.names) {
+        const rerun = `npx -y @knowttl/mg-axi doctor --profile ${name}`;
+        try {
+            const selected = args.store.resolve(name);
+            // The same bounded read the named leaf serves: one fetched page, one
+            // surfaced row, remainder buffered in a discarded cursor. Doctor keeps
+            // no cursor and accepts none; recovery reruns doctor, not the read.
+            const result = (await listUsers(args.session, { limit: "1" }, selected.profile, operation, `npx -y @knowttl/mg-axi ${DOCTOR_CHECK} --help`, name));
+            if (!result.count.complete && result.count.reason !== "row limit reached; buffered remainder is preserved in the cursor") {
+                throw new AxiError(`Doctor read incomplete: ${result.count.reason}`, "GRAPH_ERROR", [rerun]);
+            }
+            profiles.push({ name, mode: selected.profile.mode, check: DOCTOR_CHECK, status: "ok",
+                detail: result.users.length ? "1 user row returned" : "0 users matched; the absence of results is the answer" });
+        }
+        catch (error) {
+            const failure = error instanceof AxiError
+                ? error
+                : new AxiError("Unable to run the doctor check", "GRAPH_ERROR", ["npx -y @knowttl/mg-axi entra user list --help"]);
+            profiles.push({ name, check: DOCTOR_CHECK, status: "failed", code: failure.code, error: failure.message });
+        }
+    }
+    const ok = profiles.filter(row => row.status === "ok");
+    const failed = profiles.filter(row => row.status !== "ok");
+    return {
+        output: {
+            config: args.store.path,
+            check: `${DOCTOR_CHECK} per profile; silent credential acquisition only, no interactive sign-in, no writes`,
+            count: `${ok.length} of ${profiles.length} profiles ok`,
+            profiles,
+            complete: failed.length === 0,
+            help: failed.length
+                ? failed.map(row => `[${String(row.name)}] Check the reported failure, then rerun \`npx -y @knowttl/mg-axi doctor --profile ${String(row.name)}\``)
+                : [`Run \`npx -y @knowttl/mg-axi entra user list --profile ${String(ok[0].name)} --limit 1\` to start reading`],
+        },
+        failed: failed.length > 0,
+    };
+}

package/dist/entra-access-reviews.js

@@ -0,0 +1,425 @@
+import { AxiError } from "axi-sdk-js";
+// EXT-02 access-reviews subfamily: the read-only access-review mapping.
+// See README.md for the supported commands and usage. Operation construction
+// stays beside its command; the shared session owns URLs, credentials, paging,
+// retries and error translation, and the SDK owns TOON rendering. This
+// module only maps flags to session calls and projects rows for compact
+// output.
+//
+// Reviewed against the v1.0 accessreviewset-list-definitions,
+// accessreviewscheduledefinition-get,
+// accessreviewscheduledefinition-list-instances, accessreviewinstance-get,
+// accessreviewinstance-list-decisions,
+// accessreviewinstancedecisionitem-get,
+// accessreviewinstance-list-contactedreviewers,
+// accessreviewinstance-list-stages and accessreviewstage-get operation
+// documentation, plus the accessReviewReviewer and accessReviewStage
+// resource references, on 2026-10-04. All ten reads take D/A
+// AccessReview.Read.All as the least privileged choice; delegated personal
+// Microsoft accounts are not supported. Delegated callers additionally need
+// a supported administrator role: group or app reviews need the review
+// creator, Global Reader, Security Reader, User Administrator, Identity
+// Governance Administrator or Security Administrator, while Entra-role
+// reviews need Security Reader, Identity Governance Administrator,
+// Privileged Role Administrator or Security Administrator. Definition,
+// instance and decision collections document $select with plain $filter
+// ($orderby/$skip/$top stay server-side paging concerns); contacted-reviewer
+// lists add $orderby to the documented set and stage lists document $filter
+// (eq only), both still passed through as plain $filter with no $count or
+// ConsistencyLevel attached. Singles document $select only; the
+// contacted-reviewer single reuses its list's resource contract because the
+// resource carries no relationships and the list returns all nested
+// properties. None of these collections documents an advanced-query
+// contract.
+//
+// Definitions are review schedules (a series: one recurrence creates one
+// instance per reviewed resource, and a one-time review creates one
+// instance per resource); instances are the occurrences under review; each
+// reviewed principal or resource in an instance carries one decision item.
+// Listing decisions never approves, denies or applies anything: submitting,
+// stopping and every other access-review mutation belongs to later slices,
+// never to these reads. Access reviews need P2 or ID Governance depending
+// on capability, never one uniform licence.
+// Definitions expose the series schedule; the deprecated backupReviewers
+// alias, createdBy, stageSettings and additionalNotificationRecipients carry
+// no documented $select contract and stay out of the reviewed set.
+export const KNOWN_DEFINITION_FIELDS = [
+    "id",
+    "displayName",
+    "status",
+    "createdDateTime",
+    "lastModifiedDateTime",
+    "descriptionForAdmins",
+    "descriptionForReviewers",
+    "scope",
+    "instanceEnumerationScope",
+    "reviewers",
+    "fallbackReviewers",
+    "settings",
+];
+// Instances expose occurrence state; errors carry no documented $select
+// contract and stay out of the reviewed set.
+export const KNOWN_INSTANCE_FIELDS = [
+    "id",
+    "startDateTime",
+    "endDateTime",
+    "status",
+    "scope",
+    "reviewers",
+    "fallbackReviewers",
+];
+// Decisions expose review outcomes; target is the reviewed
+// principal-or-resource item shown in the documented list response, while
+// appliedBy, applyDescription, justification, permission, principalLink and
+// resource carry no documented $select contract and stay out.
+export const KNOWN_DECISION_FIELDS = [
+    "id",
+    "accessReviewId",
+    "decision",
+    "recommendation",
+    "reviewedDateTime",
+    "reviewedBy",
+    "appliedDateTime",
+    "applyResult",
+    "principal",
+    "resourceLink",
+    "target",
+];
+// Contacted reviewers are the reviewer identities recorded on one instance,
+// whether or not they were notified; the resource carries no relationships
+// and the list returns all nested properties, so list and show share one
+// reviewed set.
+export const KNOWN_CONTACTED_REVIEWER_FIELDS = [
+    "id",
+    "displayName",
+    "userPrincipalName",
+    "createdDateTime",
+];
+// Stages are the sequential phases of one instance (up to three when the
+// definition sets stageSettings); each stage carries its own reviewer
+// scopes, and durationInDays is not a stage property (it folds into
+// endDateTime). Decisions hang off each stage but belong to a later slice.
+export const KNOWN_STAGE_FIELDS = [
+    "id",
+    "startDateTime",
+    "endDateTime",
+    "status",
+    "reviewers",
+    "fallbackReviewers",
+];
+const DEFINITION_KNOWN = new Set(KNOWN_DEFINITION_FIELDS);
+const INSTANCE_KNOWN = new Set(KNOWN_INSTANCE_FIELDS);
+const DECISION_KNOWN = new Set(KNOWN_DECISION_FIELDS);
+const CONTACTED_REVIEWER_KNOWN = new Set(KNOWN_CONTACTED_REVIEWER_FIELDS);
+const STAGE_KNOWN = new Set(KNOWN_STAGE_FIELDS);
+// Compact rows: identifiers plus schedule state, occurrence or stage window,
+// reviewer identity or review outcome. The definition id is the schedule;
+// accessReviewId on a decision names its parent instance.
+const DEFAULT_DEFINITION_LIST_SELECT = ["id", "displayName", "status"];
+const DEFAULT_DEFINITION_SHOW_SELECT = [...KNOWN_DEFINITION_FIELDS];
+const DEFAULT_INSTANCE_LIST_SELECT = ["id", "status", "startDateTime", "endDateTime"];
+const DEFAULT_INSTANCE_SHOW_SELECT = [...KNOWN_INSTANCE_FIELDS];
+const DEFAULT_DECISION_SELECT = ["id", "accessReviewId", "decision", "recommendation"];
+const DEFAULT_DECISION_SHOW_SELECT = [...KNOWN_DECISION_FIELDS];
+const DEFAULT_CONTACTED_REVIEWER_LIST_SELECT = ["id", "displayName", "userPrincipalName"];
+const DEFAULT_CONTACTED_REVIEWER_SHOW_SELECT = [...KNOWN_CONTACTED_REVIEWER_FIELDS];
+const DEFAULT_STAGE_LIST_SELECT = ["id", "status", "startDateTime", "endDateTime"];
+const DEFAULT_STAGE_SHOW_SELECT = [...KNOWN_STAGE_FIELDS];
+export const DEFAULT_ACCESS_REVIEW_SCOPES = ["https://graph.microsoft.com/AccessReview.Read.All"];
+const TRUNCATE_AT = 500;
+function fieldList(raw, flag, known, knownList, help) {
+    const parts = String(raw)
+        .split(",")
+        .map(part => part.trim())
+        .filter(part => part.length > 0);
+    if (!parts.length)
+        throw new AxiError(`--${flag} needs at least one property`, "VALIDATION_ERROR", [help]);
+    const fields = [];
+    for (const part of parts) {
+        if (!known.has(part)) {
+            throw new AxiError(`Unknown property ${part} in --${flag}`, "VALIDATION_ERROR", [
+                help,
+                `Known properties: ${knownList.join(", ")}`,
+            ]);
+        }
+        if (!fields.includes(part))
+            fields.push(part);
+    }
+    return fields;
+}
+function scopesFor(flags, profile, defaults, help) {
+    if (profile.mode === "application") {
+        if (flags.scopes !== undefined) {
+            throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", [help, "mg-axi profile show --profile <name>"]);
+        }
+        return undefined;
+    }
+    if (flags.scopes === undefined)
+        return [...defaults];
+    const scopes = String(flags.scopes)
+        .split(",")
+        .map(scope => scope.trim())
+        .filter(scope => scope.length > 0);
+    return scopes;
+}
+function truncateValue(value, full) {
+    if (full)
+        return { value, truncated: false };
+    if (typeof value === "string" && value.length > TRUNCATE_AT) {
+        return { value: `${value.slice(0, TRUNCATE_AT)}... (truncated, ${value.length} chars total)`, truncated: true };
+    }
+    if (Array.isArray(value)) {
+        const results = value.map(item => truncateValue(item, full));
+        return { value: results.map(result => result.value), truncated: results.some(result => result.truncated) };
+    }
+    if (value !== null && typeof value === "object") {
+        let truncated = false;
+        const entries = Object.entries(value).map(([key, item]) => {
+            const result = truncateValue(item, full);
+            truncated = truncated || result.truncated;
+            return [key, result.value];
+        });
+        return { value: Object.fromEntries(entries), truncated };
+    }
+    return { value, truncated: false };
+}
+// Local projection preserves Graph's null/missing distinction: an explicit
+// null stays null, an absent property stays absent and is never synthesized.
+function project(row, fields, full) {
+    const source = row !== null && typeof row === "object" && !Array.isArray(row) ? row : {};
+    const projected = {};
+    let truncated = false;
+    for (const field of fields) {
+        if (!Object.hasOwn(source, field))
+            continue;
+        const result = truncateValue(source[field], full);
+        projected[field] = result.value;
+        truncated = truncated || result.truncated;
+    }
+    return { row: projected, truncated };
+}
+function selectedFields(flags, defaults, known, knownList, help) {
+    const select = flags.select === undefined ? [...defaults] : fieldList(flags.select, "select", known, knownList, help);
+    const fields = flags.fields === undefined ? [...select] : fieldList(flags.fields, "fields", known, knownList, help);
+    const missing = fields.find(field => !select.includes(field));
+    if (missing) {
+        throw new AxiError(`--fields ${missing} was not fetched; request it with --select`, "VALIDATION_ERROR", [help]);
+    }
+    return { select, fields };
+}
+function profileHint(profileName) {
+    return `--profile ${shellValue(profileName)}`;
+}
+function shellValue(value) {
+    return /^[A-Za-z0-9_.,:/@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function fullHint(command, flags, profileName) {
+    const args = Object.entries({ ...flags, ...(flags.cursor === undefined ? {} : { cursor: "-" }), profile: profileName, full: true })
+        .map(([name, value]) => value === true ? `--${name}` : `--${name} ${shellValue(String(value))}`);
+    return `mg-axi ${command} ${args.join(" ")}`;
+}
+// Denials carry the session's generic grant/role/licence cause; access
+// reviews add the roles and licensing that actually unlock them, because a
+// 403 alone never says which prerequisite is missing.
+function withGuidance(run) {
+    return run().catch(error => {
+        if (error instanceof AxiError && error.code === "GRAPH_ERROR" && /\(403\)/.test(error.message)) {
+            throw new AxiError(error.message, "GRAPH_ERROR", [...ACCESS_REVIEW_DENIAL_HINTS, ...error.suggestions]);
+        }
+        throw error;
+    });
+}
+const ACCESS_REVIEW_DENIAL_HINTS = [
+    "Access-review reads need AccessReview.Read.All plus a supported Microsoft Entra role for delegated access (group or app reviews: the review creator, Global Reader, Security Reader, User Administrator, Identity Governance Administrator or Security Administrator; Entra-role reviews: Security Reader, Identity Governance Administrator, Privileged Role Administrator or Security Administrator), or admin-consented AccessReview.Read.All for application access; delegated personal Microsoft accounts are not supported",
+    "Access reviews need P2 or ID Governance depending on capability, not one uniform licence",
+];
+const DEFINITION_LIST = {
+    command: "entra access-review definition list",
+    key: "definitions",
+    known: DEFINITION_KNOWN,
+    knownList: KNOWN_DEFINITION_FIELDS,
+    defaultSelect: DEFAULT_DEFINITION_LIST_SELECT,
+    denialScopeNote: "Definitions are review schedules (a series), never their occurrences; instances hang off each definition",
+    emptyNote: "0 access-review definitions matched; the absence of results is the answer, not an error",
+    standing: profileName => [
+        "Definitions are review schedules (a series): each recurrence creates one instance per reviewed resource, and a one-time review creates one instance per resource",
+        `Show one schedule: mg-axi entra access-review definition show --id <definition-id> ${profileHint(profileName)}`,
+    ],
+};
+const INSTANCE_LIST = {
+    command: "entra access-review instance list",
+    key: "instances",
+    known: INSTANCE_KNOWN,
+    knownList: KNOWN_INSTANCE_FIELDS,
+    defaultSelect: DEFAULT_INSTANCE_LIST_SELECT,
+    denialScopeNote: "Instances are occurrences of one definition schedule, never schedules themselves",
+    emptyNote: "0 access-review instances matched; the absence of results is the answer, not an error",
+    standing: () => [
+        "Instances are occurrences of one definition schedule: each recurrence and each reviewed resource gets its own instance",
+    ],
+};
+const DECISION_LIST = {
+    command: "entra access-review decision list",
+    key: "decisions",
+    known: DECISION_KNOWN,
+    knownList: KNOWN_DECISION_FIELDS,
+    defaultSelect: DEFAULT_DECISION_SELECT,
+    denialScopeNote: "Decisions are read-only here: listing never approves, denies or applies anything",
+    emptyNote: "0 access-review decisions matched; an instance with no reviewed principals has no decision items, which is the answer, not an error",
+    standing: () => [
+        "Decisions are read-only here: listing never approves, denies or applies anything; submitting decisions belongs to a later slice",
+    ],
+};
+const CONTACTED_REVIEWER_LIST = {
+    command: "entra access-review contacted-reviewer list",
+    key: "contactedReviewers",
+    known: CONTACTED_REVIEWER_KNOWN,
+    knownList: KNOWN_CONTACTED_REVIEWER_FIELDS,
+    defaultSelect: DEFAULT_CONTACTED_REVIEWER_LIST_SELECT,
+    denialScopeNote: "Contacted reviewers are the reviewer identities recorded on one instance, whether or not they were notified; they never carry review outcomes",
+    emptyNote: "0 contacted reviewers matched; the absence of results is the answer, not an error",
+    standing: profileName => [
+        "Contacted reviewers are identities recorded on one instance, never review outcomes or notification receipts",
+        `Show one contacted reviewer: mg-axi entra access-review contacted-reviewer show --definition <definition-id> --instance <instance-id> --id <reviewer-id> ${profileHint(profileName)}`,
+    ],
+};
+const STAGE_LIST = {
+    command: "entra access-review stage list",
+    key: "stages",
+    known: STAGE_KNOWN,
+    knownList: KNOWN_STAGE_FIELDS,
+    defaultSelect: DEFAULT_STAGE_LIST_SELECT,
+    denialScopeNote: "Stages are sequential phases of one instance (up to three when stageSettings is defined), never definitions or decisions",
+    emptyNote: "0 access-review stages matched; an instance without stageSettings has no stages, which is the answer, not an error",
+    standing: profileName => [
+        "Stages are sequential phases of one instance: each stage carries its own reviewer scopes, and per-stage decisions belong to a later slice",
+        `Show one stage: mg-axi entra access-review stage show --definition <definition-id> --instance <instance-id> --id <stage-id> ${profileHint(profileName)}`,
+    ],
+};
+function parentId(flags, flag, noun, help) {
+    const value = String(flags[flag] ?? "");
+    if (!value.trim())
+        throw new AxiError(`--${flag} needs the parent ${noun} ID`, "VALIDATION_ERROR", [help]);
+    return value;
+}
+async function listCollection(shape, session, flags, profile, operation, help, profileName, params, resumeHint) {
+    const cursor = flags.cursor === undefined ? undefined : String(flags.cursor);
+    if (cursor !== undefined && !cursor.trim())
+        throw new AxiError("--cursor needs the opaque cursor from a partial result", "VALIDATION_ERROR", [help]);
+    const saved = cursor === undefined ? undefined : session.cursorQuery(operation, cursor);
+    const savedSelect = saved?.$select;
+    const { select, fields } = selectedFields(flags, savedSelect === undefined ? shape.defaultSelect : fieldList(savedSelect, "select", shape.known, shape.knownList, help), shape.known, shape.knownList, help);
+    const savedFilter = saved?.$filter;
+    const filter = flags.filter === undefined ? savedFilter : String(flags.filter);
+    const scopes = scopesFor(flags, profile, DEFAULT_ACCESS_REVIEW_SCOPES, help);
+    const full = flags.full === true;
+    // These collections document $select/$filter only (plus server-side
+    // $orderby/$skip/$top paging concerns), so --filter passes through as
+    // plain $filter with no $count or ConsistencyLevel.
+    const query = { $select: select.join(",") };
+    if (filter !== undefined)
+        query.$filter = filter;
+    const args = { profile, operation, params, query, scopes };
+    if (cursor !== undefined)
+        args.cursor = cursor;
+    if (flags.all === true) {
+        if (flags.limit !== undefined)
+            throw new AxiError("--limit and --all cannot be combined", "VALIDATION_ERROR", [help]);
+    }
+    else {
+        args.limit = flags.limit === undefined ? 100 : Number(flags.limit);
+    }
+    const result = await withGuidance(() => session.collect(args));
+    const effectiveFlags = { ...flags, select: result.query.$select ?? shape.defaultSelect.join(",") };
+    if (result.query.$filter !== undefined)
+        effectiveFlags.filter = result.query.$filter;
+    const rows = [];
+    let truncated = false;
+    for (const row of result.value) {
+        const projected = project(row, fields, full);
+        rows.push(projected.row);
+        truncated = truncated || projected.truncated;
+    }
+    const truncationHints = truncated ? [fullHint(shape.command, effectiveFlags, profileName)] : [];
+    if (truncated && cursor !== undefined)
+        truncationHints.push("Supply the original input cursor on stdin to replay this result with --full");
+    const standing = [shape.denialScopeNote, ...shape.standing(profileName)];
+    if (!result.complete) {
+        return {
+            [shape.key]: rows,
+            count: { returned: rows.length, complete: false, reason: result.reason },
+            cursor: result.cursor,
+            help: [...truncationHints, resumeHint, ...standing],
+        };
+    }
+    const count = { returned: rows.length, complete: true };
+    if (!rows.length) {
+        return { [shape.key]: rows, count, help: [shape.emptyNote, ...standing] };
+    }
+    return { [shape.key]: rows, count, help: [...truncationHints, ...standing] };
+}
+async function showOne(key, command, known, knownList, defaultSelect, session, flags, profile, operation, help, profileName, params, malformed) {
+    const { select, fields } = selectedFields(flags, defaultSelect, known, knownList, help);
+    const scopes = scopesFor(flags, profile, DEFAULT_ACCESS_REVIEW_SCOPES, help);
+    const full = flags.full === true;
+    const raw = await withGuidance(() => session.execute({
+        profile,
+        operation,
+        params,
+        query: { $select: select.join(",") },
+        scopes,
+    }));
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new AxiError(malformed, "GRAPH_ERROR", [
+            "Single-object reads carry one object; treat anything else as unknown, not empty",
+        ]);
+    }
+    const { row, truncated } = project(raw, fields, full);
+    if (truncated)
+        return { [key]: row, help: [fullHint(command, flags, profileName)] };
+    return { [key]: row };
+}
+export async function listDefinitions(session, flags, profile, operation, help, profileName) {
+    return listCollection(DEFINITION_LIST, session, flags, profile, operation, help, profileName, {}, `Resume losslessly with the same flags plus --cursor - ${profileHint(profileName)} and supply the returned cursor on stdin`);
+}
+export async function showDefinition(session, flags, profile, operation, help, profileName) {
+    return showOne("definition", "entra access-review definition show", DEFINITION_KNOWN, KNOWN_DEFINITION_FIELDS, DEFAULT_DEFINITION_SHOW_SELECT, session, flags, profile, operation, help, profileName, { "accessReviewScheduleDefinition-id": String(flags.id) }, "Graph returned a malformed access-review definition body");
+}
+export async function listInstances(session, flags, profile, operation, help, profileName) {
+    const definition = parentId(flags, "definition", "access-review definition", help);
+    return listCollection(INSTANCE_LIST, session, flags, profile, operation, help, profileName, { "accessReviewScheduleDefinition-id": definition }, `Resume losslessly with the same --definition and flags plus --cursor - ${profileHint(profileName)} and supply the returned cursor on stdin`);
+}
+export async function showInstance(session, flags, profile, operation, help, profileName) {
+    const definition = parentId(flags, "definition", "access-review definition", help);
+    return showOne("instance", "entra access-review instance show", INSTANCE_KNOWN, KNOWN_INSTANCE_FIELDS, DEFAULT_INSTANCE_SHOW_SELECT, session, flags, profile, operation, help, profileName, { "accessReviewScheduleDefinition-id": definition, "accessReviewInstance-id": String(flags.id) }, "Graph returned a malformed access-review instance body");
+}
+export async function listDecisions(session, flags, profile, operation, help, profileName) {
+    const definition = parentId(flags, "definition", "access-review definition", help);
+    const instance = parentId(flags, "instance", "access-review instance", help);
+    return listCollection(DECISION_LIST, session, flags, profile, operation, help, profileName, { "accessReviewScheduleDefinition-id": definition, "accessReviewInstance-id": instance }, `Resume losslessly with the same --definition, --instance and flags plus --cursor - ${profileHint(profileName)} and supply the returned cursor on stdin`);
+}
+export async function showDecision(session, flags, profile, operation, help, profileName) {
+    const definition = parentId(flags, "definition", "access-review definition", help);
+    const instance = parentId(flags, "instance", "access-review instance", help);
+    return showOne("decision", "entra access-review decision show", DECISION_KNOWN, KNOWN_DECISION_FIELDS, DEFAULT_DECISION_SHOW_SELECT, session, flags, profile, operation, help, profileName, { "accessReviewScheduleDefinition-id": definition, "accessReviewInstance-id": instance, "accessReviewInstanceDecisionItem-id": String(flags.id) }, "Graph returned a malformed access-review decision body");
+}
+export async function listContactedReviewers(session, flags, profile, operation, help, profileName) {
+    const definition = parentId(flags, "definition", "access-review definition", help);
+    const instance = parentId(flags, "instance", "access-review instance", help);
+    return listCollection(CONTACTED_REVIEWER_LIST, session, flags, profile, operation, help, profileName, { "accessReviewScheduleDefinition-id": definition, "accessReviewInstance-id": instance }, `Resume losslessly with the same --definition, --instance and flags plus --cursor - ${profileHint(profileName)} and supply the returned cursor on stdin`);
+}
+export async function showContactedReviewer(session, flags, profile, operation, help, profileName) {
+    const definition = parentId(flags, "definition", "access-review definition", help);
+    const instance = parentId(flags, "instance", "access-review instance", help);
+    return showOne("contactedReviewer", "entra access-review contacted-reviewer show", CONTACTED_REVIEWER_KNOWN, KNOWN_CONTACTED_REVIEWER_FIELDS, DEFAULT_CONTACTED_REVIEWER_SHOW_SELECT, session, flags, profile, operation, help, profileName, { "accessReviewScheduleDefinition-id": definition, "accessReviewInstance-id": instance, "accessReviewReviewer-id": String(flags.id) }, "Graph returned a malformed contacted-reviewer body");
+}
+export async function listStages(session, flags, profile, operation, help, profileName) {
+    const definition = parentId(flags, "definition", "access-review definition", help);
+    const instance = parentId(flags, "instance", "access-review instance", help);
+    return listCollection(STAGE_LIST, session, flags, profile, operation, help, profileName, { "accessReviewScheduleDefinition-id": definition, "accessReviewInstance-id": instance }, `Resume losslessly with the same --definition, --instance and flags plus --cursor - ${profileHint(profileName)} and supply the returned cursor on stdin`);
+}
+export async function showStage(session, flags, profile, operation, help, profileName) {
+    const definition = parentId(flags, "definition", "access-review definition", help);
+    const instance = parentId(flags, "instance", "access-review instance", help);
+    return showOne("stage", "entra access-review stage show", STAGE_KNOWN, KNOWN_STAGE_FIELDS, DEFAULT_STAGE_SHOW_SELECT, session, flags, profile, operation, help, profileName, { "accessReviewScheduleDefinition-id": definition, "accessReviewInstance-id": instance, "accessReviewStage-id": String(flags.id) }, "Graph returned a malformed access-review stage body");
+}