@knowttl/mg-axi 0.1.0

package/dist/entra-audit-logs.js

@@ -0,0 +1,381 @@
+import { AxiError } from "axi-sdk-js";
+// READ-05: the Entra sign-in and directory-audit read mapping behind
+// `mg-axi entra sign-in list/show` and `mg-axi entra directory-audit
+// list/show`. Operation construction stays beside its command; the shared
+// session owns URLs, credentials, paging, retries and error translation, and
+// the SDK owns TOON rendering. This module only maps flags to session calls,
+// bounds every collection query in time, and projects rows for compact output.
+//
+// Reviewed against the v1.0 signin-list and directoryaudit-list operation
+// documentation on 2026-10-04. Both collections read D/A AuditLog.Read.All;
+// delegated sign-in reads additionally accept Global Reader, Reports Reader,
+// Security Administrator, Security Operator or Security Reader, while
+// delegated directory-audit reads accept Reports Reader, Security
+// Administrator or Security Reader. Graph omits appliedConditionalAccessPolicies
+// without a CA-data permission/role, so an absent property is reported as
+// unavailable rather than invented. Sign-in/audit Graph reporting carries a
+// conservative P1/P2 deployment prerequisite; retention and premium fields
+// stay separate constraints.
+// Every property this slice may request or display. Anything else fails
+// before credentials so typos never become misleading server queries.
+export const KNOWN_SIGNIN_FIELDS = [
+    "id",
+    "createdDateTime",
+    "userId",
+    "userPrincipalName",
+    "userDisplayName",
+    "appDisplayName",
+    "appId",
+    "ipAddress",
+    "location",
+    "status",
+    "conditionalAccessStatus",
+    "appliedConditionalAccessPolicies",
+    "riskDetail",
+    "riskLevelAggregated",
+    "riskLevelDuringSignIn",
+    "riskState",
+    "resourceDisplayName",
+    "resourceId",
+    "clientAppUsed",
+];
+export const KNOWN_AUDIT_FIELDS = [
+    "id",
+    "activityDateTime",
+    "activityDisplayName",
+    "category",
+    "loggedByService",
+    "operationType",
+    "result",
+    "resultReason",
+    "correlationId",
+    "initiatedBy",
+    "targetResources",
+];
+const SIGNIN_KNOWN = new Set(KNOWN_SIGNIN_FIELDS);
+const AUDIT_KNOWN = new Set(KNOWN_AUDIT_FIELDS);
+// Compact list rows: identifier, time, who/what happened, and outcome.
+const DEFAULT_SIGNIN_LIST_SELECT = ["id", "createdDateTime", "userPrincipalName", "appDisplayName"];
+const DEFAULT_AUDIT_LIST_SELECT = ["id", "activityDateTime", "activityDisplayName", "result"];
+// Show rows: the full reviewed server set for one object.
+const DEFAULT_SIGNIN_SHOW_SELECT = [...KNOWN_SIGNIN_FIELDS];
+const DEFAULT_AUDIT_SHOW_SELECT = [...KNOWN_AUDIT_FIELDS];
+export const DEFAULT_DELEGATED_SCOPES = ["https://graph.microsoft.com/AuditLog.Read.All"];
+const TRUNCATE_AT = 500;
+// Graph omits this property without CA-data access instead of failing, so an
+// absent value reports the missing prerequisite rather than an empty result.
+const SIGNIN_UNAVAILABLE = {
+    appliedConditionalAccessPolicies: "unavailable: Graph omits CA policy detail without CA-data access - both modes need Policy.Read.All or Policy.Read.ConditionalAccess in addition to AuditLog.Read.All; delegated also needs Conditional Access Administrator, Global Reader, Security Administrator or Security Reader. For delegated access, log in and repeat this read with --scopes https://graph.microsoft.com/AuditLog.Read.All,https://graph.microsoft.com/Policy.Read.All",
+};
+function fieldList(raw, flag, known, knownList, help) {
+    const parts = String(raw)
+        .split(",")
+        .map(part => part.trim())
+        .filter(part => part.length > 0);
+    if (!parts.length)
+        throw new AxiError(`--${flag} needs at least one property`, "VALIDATION_ERROR", [help]);
+    const fields = [];
+    for (const part of parts) {
+        if (!known.has(part)) {
+            throw new AxiError(`Unknown property ${part} in --${flag}`, "VALIDATION_ERROR", [
+                help,
+                `Known properties: ${knownList.join(", ")}`,
+            ]);
+        }
+        if (!fields.includes(part))
+            fields.push(part);
+    }
+    return fields;
+}
+function scopesFor(flags, profile, help) {
+    if (profile.mode === "application") {
+        if (flags.scopes !== undefined) {
+            throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", [help, "mg-axi profile show --profile <name>"]);
+        }
+        return undefined;
+    }
+    if (flags.scopes === undefined)
+        return [...DEFAULT_DELEGATED_SCOPES];
+    const scopes = String(flags.scopes)
+        .split(",")
+        .map(scope => scope.trim())
+        .filter(scope => scope.length > 0);
+    return scopes;
+}
+function isoInstant(raw, flag, help) {
+    const text = String(raw).trim();
+    const match = /^(\d{4}-\d{2}-\d{2}T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d)(?:\.(\d+))?(Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.exec(text);
+    const local = match === null ? NaN : Date.parse(`${match[1]}Z`);
+    const parsed = match === null ? NaN : Date.parse(`${match[1]}${match[3]}`);
+    if (Number.isNaN(local) || Number.isNaN(parsed) || new Date(local).toISOString().slice(0, 19) !== match[1]
+        || new Date(parsed).toISOString().length !== 24) {
+        throw new AxiError(`--${flag} needs an ISO-8601 instant such as 2026-09-01T00:00:00Z`, "VALIDATION_ERROR", [help]);
+    }
+    const fraction = (match[2] ?? "").replace(/0+$/, "").padEnd(3, "0");
+    return `${new Date(parsed).toISOString().slice(0, 19)}.${fraction}Z`;
+}
+// Every collection query carries an explicit time bound; there is no
+// unbounded default. Returns undefined when the caller passed no time or
+// filter flags so a cursor resume restores the saved query untouched.
+function boundedFilter(dateField, flags, help) {
+    const since = flags.since === undefined ? undefined : isoInstant(flags.since, "since", help);
+    const until = flags.until === undefined ? undefined : isoInstant(flags.until, "until", help);
+    if (since !== undefined && until !== undefined && until.slice(0, -1) <= since.slice(0, -1)) {
+        throw new AxiError("--until must be after --since", "VALIDATION_ERROR", [help]);
+    }
+    const parts = [];
+    if (since !== undefined)
+        parts.push(`${dateField} ge ${since}`);
+    if (until !== undefined)
+        parts.push(`${dateField} le ${until}`);
+    if (flags.filter !== undefined) {
+        const filter = String(flags.filter).trim();
+        if (!filter.length)
+            throw new AxiError("--filter needs a non-empty OData expression", "VALIDATION_ERROR", [help]);
+        let quoted = false;
+        let depth = 0;
+        for (const char of filter) {
+            if (char === "'")
+                quoted = !quoted;
+            else if (!quoted && char === "(")
+                depth++;
+            else if (!quoted && char === ")" && --depth < 0)
+                break;
+        }
+        if (quoted || depth !== 0)
+            throw new AxiError("--filter needs balanced parentheses and quoted strings to preserve the time bounds", "VALIDATION_ERROR", [help]);
+        parts.push(`(${filter})`);
+    }
+    return parts.length ? parts.join(" and ") : undefined;
+}
+function truncateValue(value, full) {
+    const truncate = (text) => full || text.length <= TRUNCATE_AT
+        ? { value: text, truncated: false }
+        : { value: `${text.slice(0, TRUNCATE_AT)}... (truncated, ${text.length} chars total)`, truncated: true };
+    if (typeof value === "string")
+        return truncate(value);
+    if (Array.isArray(value)) {
+        const projected = value.map(entry => truncateValue(entry, full));
+        return { value: projected.map(entry => entry.value), truncated: projected.some(entry => entry.truncated) };
+    }
+    if (value !== null && typeof value === "object") {
+        const projected = Object.entries(value).map(([key, entry]) => [key, truncateValue(entry, full)]);
+        return {
+            value: Object.fromEntries(projected.map(([key, entry]) => [key, entry.value])),
+            truncated: projected.some(([, entry]) => entry.truncated),
+        };
+    }
+    return { value, truncated: false };
+}
+// Local projection preserves Graph's null/missing distinction: an explicit
+// null stays null, an absent base property stays absent and is never
+// synthesized. Properties Graph omits without an entitlement report the
+// missing prerequisite instead.
+function project(row, fields, unavailable, full) {
+    const source = row !== null && typeof row === "object" && !Array.isArray(row) ? row : {};
+    const projected = {};
+    let truncated = false;
+    for (const field of fields) {
+        if (!Object.hasOwn(source, field)) {
+            if (unavailable[field] !== undefined)
+                projected[field] = unavailable[field];
+            continue;
+        }
+        const result = truncateValue(source[field], full);
+        projected[field] = result.value;
+        truncated = truncated || result.truncated;
+    }
+    return { row: projected, truncated };
+}
+function selectedFields(flags, defaults, known, knownList, help) {
+    const select = flags.select === undefined ? [...defaults] : fieldList(flags.select, "select", known, knownList, help);
+    const fields = flags.fields === undefined ? [...select] : fieldList(flags.fields, "fields", known, knownList, help);
+    const missing = fields.find(field => !select.includes(field));
+    if (missing) {
+        throw new AxiError(`--fields ${missing} was not fetched; request it with --select`, "VALIDATION_ERROR", [help]);
+    }
+    return { select, fields };
+}
+function profileHint(profileName) {
+    return `--profile ${shellValue(profileName)}`;
+}
+function shellValue(value) {
+    return /^[A-Za-z0-9_.,:/@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function fullHint(noun, action, flags, profileName) {
+    const args = Object.entries({ ...flags, ...(flags.cursor === undefined ? {} : { cursor: "-" }), profile: profileName, full: true })
+        .map(([name, value]) => value === true ? `--${name}` : `--${name} ${shellValue(String(value))}`);
+    return `mg-axi entra ${noun} ${action} ${args.join(" ")}`;
+}
+// Denials carry the session's generic grant/role/licence cause; each
+// operation adds the roles and licensing that actually unlock it, because a
+// 403 alone never says which prerequisite is missing.
+function withGuidance(hints, run) {
+    return run().catch(error => {
+        if (error instanceof AxiError && error.code === "GRAPH_ERROR" && /\(403\)/.test(error.message)) {
+            throw new AxiError(error.message, "GRAPH_ERROR", [...hints, ...error.suggestions]);
+        }
+        throw error;
+    });
+}
+const SIGNIN_DENIAL_HINTS = [
+    "Sign-in reads need AuditLog.Read.All plus a supported directory role: Global Reader, Reports Reader, Security Administrator, Security Operator or Security Reader for delegated access, or admin-consented AuditLog.Read.All for application access",
+    "Sign-in Graph reporting carries a conservative P1/P2 deployment prerequisite; retention and premium fields stay separate constraints",
+];
+const AUDIT_DENIAL_HINTS = [
+    "Directory-audit reads need AuditLog.Read.All plus a supported directory role: Reports Reader, Security Administrator or Security Reader for delegated access, or admin-consented AuditLog.Read.All for application access",
+    "Audit Graph reporting carries a conservative P1/P2 deployment prerequisite; retention stays a separate constraint",
+];
+const SIGNIN_LIST = {
+    noun: "sign-in",
+    key: "signIns",
+    dateField: "createdDateTime",
+    known: SIGNIN_KNOWN,
+    knownList: KNOWN_SIGNIN_FIELDS,
+    defaultSelect: DEFAULT_SIGNIN_LIST_SELECT,
+    unavailable: SIGNIN_UNAVAILABLE,
+    denialHints: SIGNIN_DENIAL_HINTS,
+    showHint: "mg-axi entra sign-in show --id <sign-in-id>",
+    emptyHints: profileName => [
+        `mg-axi entra sign-in list --since <earlier-iso-time> ${profileHint(profileName)}`,
+        "0 sign-ins matched in this window; widen --since/--until or loosen --filter - the absence of results is the answer, not an error",
+    ],
+};
+const AUDIT_LIST = {
+    noun: "directory-audit",
+    key: "directoryAudits",
+    dateField: "activityDateTime",
+    known: AUDIT_KNOWN,
+    knownList: KNOWN_AUDIT_FIELDS,
+    defaultSelect: DEFAULT_AUDIT_LIST_SELECT,
+    unavailable: {},
+    denialHints: AUDIT_DENIAL_HINTS,
+    showHint: "mg-axi entra directory-audit show --id <directory-audit-id>",
+    emptyHints: profileName => [
+        `mg-axi entra directory-audit list --since <earlier-iso-time> ${profileHint(profileName)}`,
+        "0 directory audits matched in this window; widen --since/--until or loosen --filter - the absence of results is the answer, not an error",
+    ],
+};
+async function listLogs(shape, session, flags, profile, operation, help, profileName) {
+    const cursor = flags.cursor === undefined ? undefined : String(flags.cursor);
+    if (cursor !== undefined && !cursor.trim())
+        throw new AxiError("--cursor needs the opaque cursor from a partial result", "VALIDATION_ERROR", [help]);
+    const saved = cursor === undefined ? undefined : session.cursorQuery(operation, cursor);
+    const bounds = saved === undefined ? undefined : new RegExp(`^${shape.dateField} ge (\\S+)(?: and ${shape.dateField} le (\\S+))?(?: and \\(([\\s\\S]*)\\))?$`).exec(saved.$filter ?? "");
+    const savedFlags = bounds ? {
+        since: bounds[1],
+        ...(bounds[2] === undefined ? {} : { until: bounds[2] }),
+        ...(bounds[3] === undefined ? {} : { filter: bounds[3] }),
+    } : undefined;
+    if ((saved === undefined && flags.since === undefined)
+        || (saved !== undefined && (savedFlags === undefined || boundedFilter(shape.dateField, savedFlags, help) !== saved.$filter))) {
+        throw new AxiError(`Log queries are bounded in time: pass --since <ISO-time> to bound ${shape.dateField}`, "VALIDATION_ERROR", [
+            help,
+            "Start a new query with --since instead of resuming a cursor without a valid saved time bound",
+            `Example: mg-axi entra ${shape.noun} list --since 2026-09-01T00:00:00Z ${profileHint(profileName)}`,
+        ]);
+    }
+    const savedSelect = saved?.$select;
+    const { select, fields } = selectedFields(flags, savedSelect === undefined ? shape.defaultSelect : fieldList(savedSelect, "select", shape.known, shape.knownList, help), shape.known, shape.knownList, help);
+    const scopes = scopesFor(flags, profile, help);
+    const full = flags.full === true;
+    const filter = boundedFilter(shape.dateField, flags, help);
+    const query = { $select: select.join(",") };
+    const explicitFilter = filter !== undefined;
+    if (explicitFilter)
+        query.$filter = filter;
+    const args = { profile, operation, query, scopes };
+    if (cursor !== undefined)
+        args.cursor = cursor;
+    if (flags.all === true) {
+        if (flags.limit !== undefined)
+            throw new AxiError("--limit and --all cannot be combined", "VALIDATION_ERROR", [help]);
+    }
+    else {
+        args.limit = flags.limit === undefined ? 100 : Number(flags.limit);
+    }
+    const result = await withGuidance(shape.denialHints, () => session.collect(args));
+    // The hint replays the caller's own time flags (or the cursor alone, which
+    // restores the saved query); copying back the composed $filter would wrap
+    // it a second time and conflict with the cursor context.
+    const effectiveFlags = { ...flags, select: result.query.$select ?? shape.defaultSelect.join(",") };
+    const rows = [];
+    let truncated = false;
+    for (const row of result.value) {
+        const projected = project(row, fields, shape.unavailable, full);
+        rows.push(projected.row);
+        truncated = truncated || projected.truncated;
+    }
+    const showHint = `${shape.showHint} ${profileHint(profileName)}`;
+    const truncationHints = truncated ? [fullHint(shape.noun, "list", effectiveFlags, profileName)] : [];
+    if (truncated && cursor !== undefined)
+        truncationHints.push("Supply the original input cursor on stdin to replay this result with --full");
+    if (!result.complete) {
+        return {
+            [shape.key]: rows,
+            count: { returned: rows.length, complete: false, reason: result.reason },
+            cursor: result.cursor,
+            help: [...truncationHints, `Resume losslessly with the same flags plus --cursor - ${profileHint(profileName)} and supply the returned cursor on stdin`, showHint],
+        };
+    }
+    const count = { returned: rows.length, complete: true };
+    if (!rows.length) {
+        return { [shape.key]: rows, count, help: shape.emptyHints(profileName) };
+    }
+    return { [shape.key]: rows, count, help: [...truncationHints, showHint] };
+}
+const SIGNIN_SHOW = {
+    noun: "sign-in",
+    key: "signIn",
+    param: "signIn-id",
+    known: SIGNIN_KNOWN,
+    knownList: KNOWN_SIGNIN_FIELDS,
+    defaultSelect: DEFAULT_SIGNIN_SHOW_SELECT,
+    unavailable: SIGNIN_UNAVAILABLE,
+    denialHints: SIGNIN_DENIAL_HINTS,
+    idFlag: "<sign-in-id>",
+};
+const AUDIT_SHOW = {
+    noun: "directory-audit",
+    key: "directoryAudit",
+    param: "directoryAudit-id",
+    known: AUDIT_KNOWN,
+    knownList: KNOWN_AUDIT_FIELDS,
+    defaultSelect: DEFAULT_AUDIT_SHOW_SELECT,
+    unavailable: {},
+    denialHints: AUDIT_DENIAL_HINTS,
+    idFlag: "<directory-audit-id>",
+};
+async function showLog(shape, session, flags, profile, operation, help, profileName) {
+    const { select, fields } = selectedFields(flags, shape.defaultSelect, shape.known, shape.knownList, help);
+    const scopes = scopesFor(flags, profile, help);
+    const full = flags.full === true;
+    const raw = await withGuidance(shape.denialHints, () => session.execute({
+        profile,
+        operation,
+        params: { [shape.param]: String(flags.id) },
+        query: { $select: select.join(",") },
+        scopes,
+    }));
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new AxiError("Graph returned a malformed log body", "GRAPH_ERROR", [
+            "Single-object reads carry one object; treat anything else as unknown, not empty",
+        ]);
+    }
+    const { row, truncated } = project(raw, fields, shape.unavailable, full);
+    if (truncated)
+        return { [shape.key]: row, help: [fullHint(shape.noun, "show", flags, profileName)] };
+    return { [shape.key]: row };
+}
+export async function listSignIns(session, flags, profile, operation, help, profileName) {
+    return listLogs(SIGNIN_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showSignIn(session, flags, profile, operation, help, profileName) {
+    return showLog(SIGNIN_SHOW, session, flags, profile, operation, help, profileName);
+}
+export async function listDirectoryAudits(session, flags, profile, operation, help, profileName) {
+    return listLogs(AUDIT_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showDirectoryAudit(session, flags, profile, operation, help, profileName) {
+    return showLog(AUDIT_SHOW, session, flags, profile, operation, help, profileName);
+}

package/dist/entra-auth-methods.js

@@ -0,0 +1,296 @@
+import { AxiError } from "axi-sdk-js";
+// READ-04: the Entra authentication-method and registration-report read
+// mapping behind `mg-axi entra user authentication-method list` and
+// `mg-axi entra registration list`. Operation construction stays beside its
+// command; the shared session owns URLs, credentials, paging, retries and
+// error translation, and the SDK owns TOON rendering. This module only maps
+// flags to session calls and projects rows for compact output.
+//
+// Reviewed against the v1.0 authentication-list-methods and
+// authenticationmethodsroot-list-userregistrationdetails operation
+// documentation on 2026-10-04. Per-user method reads take D/A
+// UserAuthenticationMethod.Read.All for other users (delegated self-reads use
+// UserAuthenticationMethod.Read); delegated callers acting on another user
+// additionally need Global Reader, Authentication Administrator or Privileged
+// Authentication Administrator. The registration report reads D/A
+// AuditLog.Read.All; delegated callers additionally need Reports Reader,
+// Security Reader, Security Administrator or Global Reader.
+//
+// Upstream discourages iterating per-user methods across the tenant for
+// auditing; aggregate coverage belongs to the registration report. This slice
+// therefore serves one named user per method-list call and offers no tenant
+// scan: there is no command that loops users, and the standing help points
+// aggregate questions at the report. The report itself does not work for
+// disabled users, so absence from it is never proof of no MFA; that gap rides
+// in the leaf help and every report output.
+//
+// Phone numbers are protected values: the shared session replaces them with
+// the redaction marker before collection buffering and on cursor decode, so
+// neither output nor resume cursors ever carry one. Method rows additionally
+// preserve @odata.type (naming the method kind) without making it selectable.
+// No method registration or deletion is constructed here.
+// Every authentication-method property this slice may select locally,
+// matching the reviewed API-01 field set. Anything else fails before
+// credentials so typos never become misleading output projections.
+export const KNOWN_METHOD_FIELDS = [
+    "id",
+    "createdDateTime",
+    "displayName",
+    "phoneNumber",
+    "phoneType",
+    "smsSignInState",
+    "emailAddress",
+];
+const KNOWN_METHODS = new Set(KNOWN_METHOD_FIELDS);
+// Every registration-report property this slice may request or display,
+// matching the reviewed API-01 field set.
+export const KNOWN_REPORT_FIELDS = [
+    "id",
+    "userPrincipalName",
+    "userDisplayName",
+    "userType",
+    "isAdmin",
+    "isMfaRegistered",
+    "isMfaCapable",
+    "isPasswordlessCapable",
+    "isSsprRegistered",
+    "isSsprEnabled",
+    "isSsprCapable",
+    "userPreferredMethodForSecondaryAuthentication",
+    "lastUpdatedDateTime",
+];
+const KNOWN_REPORT = new Set(KNOWN_REPORT_FIELDS);
+// @odata.type is preserved on method rows without being selectable: it names
+// the method kind (phone, email, fido2 and the other derived types).
+const METHOD_TYPE_PROPERTY = "@odata.type";
+// Compact method rows: identifier, display name and registration time. The
+// method kind rides along via @odata.type; phoneNumber stays out of the
+// default selection and is redacted whenever it is fetched.
+const DEFAULT_METHOD_SELECT = ["id", "displayName", "createdDateTime"];
+// Compact report rows: identifier, user keys and the headline MFA posture.
+const DEFAULT_REPORT_SELECT = ["id", "userPrincipalName", "userDisplayName", "isMfaRegistered"];
+// UserAuthenticationMethod.Read.All covers other-user reads in both modes;
+// delegated self-reads may use UserAuthenticationMethod.Read instead.
+export const DEFAULT_METHOD_SCOPES = ["https://graph.microsoft.com/UserAuthenticationMethod.Read.All"];
+// AuditLog.Read.All covers the registration report in both modes.
+export const DEFAULT_REPORT_SCOPES = ["https://graph.microsoft.com/AuditLog.Read.All"];
+const TRUNCATE_AT = 500;
+// The only operations this slice ever binds. Method registration, deletion
+// and every other route are refused before credentials.
+const READ_OPERATIONS = {
+    "GET:/users/{user-id}/authentication/methods": "method",
+    "GET:/reports/authenticationMethods/userRegistrationDetails": "report",
+};
+function checkReadOperation(operation, help) {
+    // Version stays the session's decision: beta reads remain preview-gated
+    // there, exactly like every other named slice. This gate only ensures a
+    // registration/deletion route or any other non-read can never reach
+    // credentials from this module.
+    const route = `${operation.method}:${operation.path}`;
+    if (operation.method !== "GET" || !Object.hasOwn(READ_OPERATIONS, route)) {
+        throw new AxiError(`Refused non-read route ${operation.id}: READ-04 serves only the catalogued per-user method list and registration report`, "VALIDATION_ERROR", [
+            help,
+            "Method registration and deletion belong to no read slice; aggregate coverage belongs to the registration report",
+        ]);
+    }
+}
+function fieldList(raw, known, knownList, flag, help) {
+    const parts = String(raw)
+        .split(",")
+        .map(part => part.trim())
+        .filter(part => part.length > 0);
+    if (!parts.length)
+        throw new AxiError(`--${flag} needs at least one property`, "VALIDATION_ERROR", [help]);
+    const fields = [];
+    for (const part of parts) {
+        if (!known.has(part)) {
+            throw new AxiError(`Unknown property ${part} in --${flag}`, "VALIDATION_ERROR", [
+                help,
+                `Known properties: ${knownList.join(", ")}`,
+            ]);
+        }
+        if (!fields.includes(part))
+            fields.push(part);
+    }
+    return fields;
+}
+function scopesFor(flags, profile, defaults, help) {
+    if (profile.mode === "application") {
+        if (flags.scopes !== undefined) {
+            throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", [help, "mg-axi profile show --profile <name>"]);
+        }
+        return undefined;
+    }
+    if (flags.scopes === undefined)
+        return [...defaults];
+    const scopes = String(flags.scopes)
+        .split(",")
+        .map(scope => scope.trim())
+        .filter(scope => scope.length > 0);
+    return scopes;
+}
+function truncateValue(value, full) {
+    if (typeof value === "string" && !full && value.length > TRUNCATE_AT) {
+        return { value: `${value.slice(0, TRUNCATE_AT)}... (truncated, ${value.length} chars total)`, truncated: true };
+    }
+    return { value, truncated: false };
+}
+// Local projection preserves Graph's null/missing distinction: an explicit
+// null stays null, an absent property stays absent and is never synthesized.
+// Redacted phone numbers arrive from the session as the redaction marker and
+// pass through unchanged; truncation never hides the marker.
+function project(row, fields, full) {
+    const source = row !== null && typeof row === "object" && !Array.isArray(row) ? row : {};
+    const projected = {};
+    let truncated = false;
+    for (const field of fields) {
+        if (!Object.hasOwn(source, field))
+            continue;
+        const result = truncateValue(source[field], full);
+        projected[field] = result.value;
+        truncated = truncated || result.truncated;
+    }
+    return { row: projected, truncated };
+}
+// Method projection additionally preserves @odata.type so the method kind
+// survives local projection.
+function projectMethod(row, fields, full) {
+    const { row: projected, truncated } = project(row, fields, full);
+    const source = row !== null && typeof row === "object" && !Array.isArray(row) ? row : {};
+    if (typeof source[METHOD_TYPE_PROPERTY] === "string")
+        projected[METHOD_TYPE_PROPERTY] = source[METHOD_TYPE_PROPERTY];
+    return { row: projected, truncated };
+}
+function selectedFields(flags, defaults, known, knownList, help) {
+    const select = flags.select === undefined ? [...defaults] : fieldList(flags.select, known, knownList, "select", help);
+    const fields = flags.fields === undefined ? [...select] : fieldList(flags.fields, known, knownList, "fields", help);
+    const missing = fields.find(field => !select.includes(field));
+    if (missing) {
+        throw new AxiError(`--fields ${missing} was not selected; request it with --select`, "VALIDATION_ERROR", [help]);
+    }
+    return { select, fields };
+}
+function profileHint(profileName) {
+    return `--profile ${shellValue(profileName)}`;
+}
+function shellValue(value) {
+    return /^[A-Za-z0-9_.,:/@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function fullHint(command, flags, profileName) {
+    const args = Object.entries({ ...flags, profile: profileName, full: true })
+        .map(([name, value]) => value === true ? `--${name}` : `--${name} ${shellValue(String(value))}`);
+    return `mg-axi ${command} ${args.join(" ")}`;
+}
+// Denials carry the session's generic grant/role/licence cause; each
+// operation adds the roles that actually unlock it, because a 403 alone
+// never says which prerequisite is missing.
+function withGuidance(hints, run) {
+    return run().catch(error => {
+        if (error instanceof AxiError && error.code === "GRAPH_ERROR" && /\(403\)/.test(error.message)) {
+            throw new AxiError(error.message, "GRAPH_ERROR", [...hints, ...error.suggestions]);
+        }
+        throw error;
+    });
+}
+const METHOD_DENIAL_HINTS = [
+    "Authentication-method reads need UserAuthenticationMethod.Read.All plus Global Reader, Authentication Administrator or Privileged Authentication Administrator for delegated access to another user (delegated self-reads use UserAuthenticationMethod.Read), or admin-consented UserAuthenticationMethod.Read.All for application access",
+    "Phone numbers stay redacted for every role; an Authentication Administrator additionally sees masked phone numbers server-side",
+];
+const REPORT_DENIAL_HINTS = [
+    "Registration-report reads need AuditLog.Read.All plus Reports Reader, Security Reader, Security Administrator or Global Reader for delegated access, or admin-consented AuditLog.Read.All for application access",
+    "The report does not cover disabled users; a 403 is a grant or role denial, never evidence about a disabled account",
+];
+const METHOD_LIST = {
+    command: "entra user authentication-method list",
+    key: "authenticationMethods",
+    known: KNOWN_METHODS,
+    knownList: KNOWN_METHOD_FIELDS,
+    defaultSelect: DEFAULT_METHOD_SELECT,
+    defaultScopes: DEFAULT_METHOD_SCOPES,
+    denialHints: METHOD_DENIAL_HINTS,
+    standing: profileName => [
+        "Targeted inspection of one named user only; for tenant-wide MFA coverage use "
+            + `mg-axi entra registration list ${profileHint(profileName)}, never a scan across users`,
+    ],
+    emptyNote: "0 authentication methods matched; the absence of results is the answer, not an error",
+    preserveType: true,
+};
+const REPORT_LIST = {
+    command: "entra registration list",
+    key: "registrationDetails",
+    known: KNOWN_REPORT,
+    knownList: KNOWN_REPORT_FIELDS,
+    defaultSelect: DEFAULT_REPORT_SELECT,
+    defaultScopes: DEFAULT_REPORT_SCOPES,
+    denialHints: REPORT_DENIAL_HINTS,
+    standing: () => [
+        "The registration report does not cover disabled users; absence from this report is not proof of no MFA",
+    ],
+    emptyNote: "0 registration rows matched; the absence of results is the answer, not an error",
+    preserveType: false,
+};
+async function listCollection(shape, session, flags, profile, operation, help, profileName, params) {
+    checkReadOperation(operation, help);
+    const cursor = flags.cursor === undefined ? undefined : String(flags.cursor);
+    if (cursor !== undefined && !cursor.trim())
+        throw new AxiError("--cursor needs the opaque cursor from a partial result", "VALIDATION_ERROR", [help]);
+    const saved = cursor === undefined ? undefined : session.cursorQuery(operation, cursor);
+    const savedSelect = saved?.$select;
+    const { select, fields } = selectedFields(flags, savedSelect === undefined ? shape.defaultSelect : fieldList(savedSelect, shape.known, shape.knownList, "select", help), shape.known, shape.knownList, help);
+    const savedFilter = saved?.$filter;
+    const filter = flags.filter === undefined ? savedFilter : String(flags.filter);
+    if (shape.preserveType && filter !== undefined)
+        throw new AxiError("Authentication-method reads do not support --filter", "VALIDATION_ERROR", [help]);
+    const scopes = scopesFor(flags, profile, shape.defaultScopes, help);
+    const full = flags.full === true;
+    const query = { $select: select.join(",") };
+    if (filter !== undefined)
+        query.$filter = filter;
+    const args = { profile, operation, query, scopes };
+    if (params)
+        args.params = params;
+    if (cursor !== undefined)
+        args.cursor = cursor;
+    if (flags.all === true) {
+        if (flags.limit !== undefined)
+            throw new AxiError("--limit and --all cannot be combined", "VALIDATION_ERROR", [help]);
+    }
+    else {
+        args.limit = flags.limit === undefined ? 100 : Number(flags.limit);
+    }
+    const result = await withGuidance(shape.denialHints, () => session.collect(args));
+    const effectiveFlags = { ...flags, select: result.query.$select ?? shape.defaultSelect.join(",") };
+    if (!shape.preserveType && result.query.$filter !== undefined)
+        effectiveFlags.filter = result.query.$filter;
+    const rows = [];
+    let truncated = false;
+    for (const row of result.value) {
+        const projected = shape.preserveType ? projectMethod(row, fields, full) : project(row, fields, full);
+        rows.push(projected.row);
+        truncated = truncated || projected.truncated;
+    }
+    const truncationHints = truncated ? [fullHint(shape.command, effectiveFlags, profileName)] : [];
+    const standing = shape.standing(profileName);
+    if (!result.complete) {
+        return {
+            [shape.key]: rows,
+            count: { returned: rows.length, complete: false, reason: result.reason },
+            cursor: result.cursor,
+            help: [...truncationHints, `Resume losslessly with the same flags plus --cursor <cursor-from-output> ${profileHint(profileName)}`, ...standing],
+        };
+    }
+    const count = { returned: rows.length, complete: true };
+    if (!rows.length) {
+        return { [shape.key]: rows, count, help: [shape.emptyNote, ...standing] };
+    }
+    return { [shape.key]: rows, count, help: [...truncationHints, ...standing] };
+}
+export async function listAuthenticationMethods(session, flags, profile, operation, help, profileName) {
+    const user = String(flags.user);
+    if (!user.trim())
+        throw new AxiError("--user needs the target user ID or UPN", "VALIDATION_ERROR", [help]);
+    return listCollection(METHOD_LIST, session, flags, profile, operation, help, profileName, { "user-id": user });
+}
+export async function listRegistrationDetails(session, flags, profile, operation, help, profileName) {
+    return listCollection(REPORT_LIST, session, flags, profile, operation, help, profileName);
+}