@knowttl/mg-axi 0.1.1 → 0.1.2

package/dist/catalogue.js

@@ -99,6 +99,22 @@ const roleRead = {
     cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
     scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to the operation's least-privileged read scope" },
 };
+const groupAssignmentRead = {
+    filter: { value: "odata-filter", description: "Required OData $filter with an eq clause on groupId or principalId scoping the list; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed group PIM assignment set" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to PrivilegedAssignmentSchedule.Read.AzureADGroup; delegated callers also need owner/member of the group or a supported directory role; PIM for Groups needs P2 or ID Governance" },
+};
+const groupEligibilityRead = {
+    filter: groupAssignmentRead.filter,
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed group PIM eligibility set; request justification text rides only behind an explicit --select" },
+    fields: groupAssignmentRead.fields,
+    full: groupAssignmentRead.full,
+    cursor: groupAssignmentRead.cursor,
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to PrivilegedEligibilitySchedule.Read.AzureADGroup; delegated callers also need owner/member of the group or a supported directory role; PIM for Groups needs P2 or ID Governance" },
+};
 const deviceRead = {
     filter: { value: "odata-filter", description: "OData $filter passed to Graph with ConsistencyLevel eventual; unsupported combinations fail before credentials" },
     select: { value: "comma-separated-properties", description: "Request server properties; directory-device reads need Device.Read.All" },
@@ -341,6 +357,29 @@ const dataPolicyRead = {
     cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
     scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to User.Export.All, User.Read.All" },
 };
+const riskPreventionFraudRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed fraud-protection-provider set; API keys, client secrets and other key material are never selectable; reads need delegated RiskPreventionProviders.Read.All plus a supported Entra role and refuse application profiles" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RiskPreventionProviders.Read.All" },
+};
+const riskPreventionWafRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel contract; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed WAF-provider set; API keys, client secrets and other key material are never selectable; reads need delegated RiskPreventionProviders.Read.All plus a supported Entra role and refuse application profiles" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RiskPreventionProviders.Read.All" },
+};
+const riskPreventionVerificationRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel contract; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed WAF-verification set; reads need delegated RiskPreventionProviders.Read.All plus a supported Entra role and refuse application profiles" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RiskPreventionProviders.Read.All" },
+};
 const accessReviewRead = {
     filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; on definitions only contains() over the scope query and eq on status are documented; unsupported combinations fail before credentials" },
     filterReviewer: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel; unsupported combinations fail before credentials" },
@@ -415,6 +454,25 @@ const lifecycleTaskReportSubRead = {
     full: lifecycleWorkflowRead.full,
     scopes: lifecycleReportsRead.scopes,
 };
+const lifecycleRunReportsRead = {
+    workflow: { value: "workflow-id", required: true, description: "Parent lifecycle workflow ID owning the run" },
+    run: { value: "run-id", required: true, description: "Parent lifecycle workflow run ID owning the processing result" },
+    filter: lifecycleWorkflowRead.filter,
+    select: lifecycleReportsRead.select,
+    fields: lifecycleWorkflowRead.fields,
+    full: lifecycleWorkflowRead.full,
+    cursor: lifecycleWorkflowRead.cursor,
+    scopes: lifecycleReportsRead.scopes,
+};
+const lifecycleRunSubjectRead = {
+    workflow: { value: "workflow-id", required: true, description: "Parent lifecycle workflow ID owning the run" },
+    run: { value: "run-id", required: true, description: "Parent lifecycle workflow run ID owning the subject processing result" },
+    filter: lifecycleWorkflowRead.filter,
+    fields: lifecycleSubjectRead.fields,
+    full: lifecycleWorkflowRead.full,
+    cursor: lifecycleWorkflowRead.cursor,
+    scopes: lifecycleSubjectRead.scopes,
+};
 export const LEAVES = [
     { path: "home", description: "Show local profile status without authenticating", flags: { profile: common.profile }, examples: ["mg-axi", "mg-axi home --profile soc"] },
     { path: "profile create", description: "Create a dedicated-app profile without signing in", flags: {
@@ -437,6 +495,7 @@ export const LEAVES = [
             scopes: { value: "comma-separated-Graph-scopes", required: true, description: "Explicit delegated permissions using full https://graph.microsoft.com/ scope names" },
         }, examples: ["mg-axi login --profile soc --scopes https://graph.microsoft.com/User.Read", "mg-axi login --profile soc --method device-code --scopes https://graph.microsoft.com/User.Read"] },
     { path: "setup", description: "Show installation, configuration and capability guidance without signing in or writing anything", flags: {}, examples: ["mg-axi setup", "mg-axi setup --help"] },
+    { path: "setup hooks", description: "Install or repair agent SessionStart hooks for mg-axi ambient context", flags: {}, examples: ["mg-axi setup hooks", "mg-axi setup hooks --help"] },
     { path: "doctor", description: "Check each selected profile with one bounded user-list read; never signs in interactively, installs nothing, enables no writes", flags: {
             profile: common.profile,
         }, examples: ["mg-axi doctor", "mg-axi doctor --profile soc", "mg-axi doctor --help"] },
@@ -593,6 +652,96 @@ export const LEAVES = [
             cursor: roleRead.cursor,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleAssignmentSchedule.Read.Directory; delegated callers also need a supported PIM read role; PIM needs P2 or ID Governance" },
         }, examples: ["mg-axi entra pim active list --profile soc", "mg-axi entra pim active list --profile soc --filter \"assignmentType eq 'Activated'\""] },
+    { path: "entra pim group-assignment-schedule list", description: "List PIM-for-Groups assignment schedules scoped to one group or principal (id, principalId, groupId, accessId, assignmentType); --filter on groupId or principalId is required", operation: "GET:/identityGovernance/privilegedAccess/group/assignmentSchedules", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: { ...groupAssignmentRead.filter, required: true },
+            select: groupAssignmentRead.select,
+            fields: groupAssignmentRead.fields,
+            full: groupAssignmentRead.full,
+            cursor: groupAssignmentRead.cursor,
+            scopes: groupAssignmentRead.scopes,
+        }, examples: ["mg-axi entra pim group-assignment-schedule list --profile soc --filter \"groupId eq '<group-id>'\"", "mg-axi entra pim group-assignment-schedule list --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra pim group-assignment-schedule show", description: "Show one PIM-for-Groups assignment schedule with the full reviewed property set", operation: "GET:/identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id}", flags: {
+            ...common, id: { value: "assignment-schedule-id", required: true, description: "Assignment schedule ID" },
+            select: groupAssignmentRead.select,
+            fields: groupAssignmentRead.fields,
+            full: groupAssignmentRead.full,
+            scopes: groupAssignmentRead.scopes,
+        }, examples: ["mg-axi entra pim group-assignment-schedule show --id <assignment-schedule-id> --profile soc", "mg-axi entra pim group-assignment-schedule show --id <assignment-schedule-id> --profile soc --full"] },
+    { path: "entra pim group-assignment-instance list", description: "List provisioned PIM-for-Groups assignment windows scoped to one group or principal (id, principalId, groupId, accessId, assignmentType); --filter on groupId or principalId is required", operation: "GET:/identityGovernance/privilegedAccess/group/assignmentScheduleInstances", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: { ...groupAssignmentRead.filter, required: true },
+            select: groupAssignmentRead.select,
+            fields: groupAssignmentRead.fields,
+            full: groupAssignmentRead.full,
+            cursor: groupAssignmentRead.cursor,
+            scopes: groupAssignmentRead.scopes,
+        }, examples: ["mg-axi entra pim group-assignment-instance list --profile soc --filter \"groupId eq '<group-id>'\"", "mg-axi entra pim group-assignment-instance list --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra pim group-assignment-instance show", description: "Show one provisioned PIM-for-Groups assignment window with the full reviewed property set", operation: "GET:/identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id}", flags: {
+            ...common, id: { value: "assignment-instance-id", required: true, description: "Assignment schedule instance ID" },
+            select: groupAssignmentRead.select,
+            fields: groupAssignmentRead.fields,
+            full: groupAssignmentRead.full,
+            scopes: groupAssignmentRead.scopes,
+        }, examples: ["mg-axi entra pim group-assignment-instance show --id <assignment-instance-id> --profile soc", "mg-axi entra pim group-assignment-instance show --id <assignment-instance-id> --profile soc --full"] },
+    { path: "entra pim group-eligibility-schedule list", description: "List PIM-for-Groups eligibility schedules scoped to one group or principal (id, principalId, groupId, accessId, memberType); --filter on groupId or principalId is required", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilitySchedules", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: { ...groupEligibilityRead.filter, required: true },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            cursor: groupEligibilityRead.cursor,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-schedule list --profile soc --filter \"groupId eq '<group-id>'\"", "mg-axi entra pim group-eligibility-schedule list --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra pim group-eligibility-schedule show", description: "Show one PIM-for-Groups eligibility schedule with the full reviewed property set", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id}", flags: {
+            ...common, id: { value: "eligibility-schedule-id", required: true, description: "Eligibility schedule ID" },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-schedule show --id <eligibility-schedule-id> --profile soc", "mg-axi entra pim group-eligibility-schedule show --id <eligibility-schedule-id> --profile soc --full"] },
+    { path: "entra pim group-eligibility-instance list", description: "List provisioned PIM-for-Groups eligibility windows scoped to one group or principal (id, principalId, groupId, accessId, memberType); --filter on groupId or principalId is required", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: { ...groupEligibilityRead.filter, required: true },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            cursor: groupEligibilityRead.cursor,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-instance list --profile soc --filter \"groupId eq '<group-id>'\"", "mg-axi entra pim group-eligibility-instance list --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra pim group-eligibility-instance show", description: "Show one provisioned PIM-for-Groups eligibility window with the full reviewed property set", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id}", flags: {
+            ...common, id: { value: "eligibility-instance-id", required: true, description: "Eligibility schedule instance ID" },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-instance show --id <eligibility-instance-id> --profile soc", "mg-axi entra pim group-eligibility-instance show --id <eligibility-instance-id> --profile soc --full"] },
+    { path: "entra pim group-eligibility-request list", description: "List PIM-for-Groups eligibility requests scoped to one group or principal (id, action, status, principalId, groupId, accessId); justification text rides only behind an explicit --select; --filter on groupId or principalId is required", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleRequests", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: { ...groupEligibilityRead.filter, required: true },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            cursor: groupEligibilityRead.cursor,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-request list --profile soc --filter \"groupId eq '<group-id>'\"", "mg-axi entra pim group-eligibility-request list --profile soc --filter \"groupId eq '<group-id>'\" --select id,action,status,justification"] },
+    { path: "entra pim group-eligibility-request show", description: "Show one PIM-for-Groups eligibility request with the reviewed ask-plus-outcome set; justification text rides only behind an explicit --select", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id}", flags: {
+            ...common, id: { value: "eligibility-request-id", required: true, description: "Eligibility schedule request ID" },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-request show --id <eligibility-request-id> --profile soc", "mg-axi entra pim group-eligibility-request show --id <eligibility-request-id> --profile soc --select id,action,status,justification --full"] },
     { path: "entra device list", description: "List directory devices with compact properties (id, displayName, operatingSystem, accountEnabled). Directory-device scope only; Intune managed devices are a separately authorized surface", operation: "GET:/devices", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -1248,6 +1397,30 @@ export const LEAVES = [
             full: delegatedAdminQuerylessRead.full,
             scopes: delegatedAdminQuerylessRead.scopes,
         }, examples: ["mg-axi entra delegated-admin-customer show-service-management-detail --id <customer-id> --detail-id <detail-id> --profile soc"] },
+    { path: "entra delegated-admin-customer count", description: "Count delegated-admin customers of the partner tenant as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminCustomers/$count", flags: {
+            ...common,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-customer count --profile soc"] },
+    { path: "entra delegated-admin-customer count-service-management-details", description: "Count one customer's service-management details as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails/$count", flags: {
+            ...common, id: { value: "customer-id", required: true, description: "Delegated-admin customer identifier" },
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-customer count-service-management-details --id <customer-id> --profile soc"] },
+    { path: "entra delegated-admin-relationship count", description: "Count partner-tenant delegated-admin relationships as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminRelationships/$count", flags: {
+            ...common,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship count --profile soc"] },
+    { path: "entra delegated-admin-relationship count-access-assignments", description: "Count one relationship's delegated-admin access assignments as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/accessAssignments/$count", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship count-access-assignments --id <relationship-id> --profile soc"] },
+    { path: "entra delegated-admin-relationship count-operations", description: "Count one relationship's long-running delegated-admin operations as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/operations/$count", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship count-operations --id <relationship-id> --profile soc"] },
+    { path: "entra delegated-admin-relationship count-requests", description: "Count one relationship's delegated-admin requests as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/requests/$count", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship count-requests --id <relationship-id> --profile soc"] },
     { path: "entra multi-tenant-organization show", description: "Show the tenant multitenant organization with the full reviewed property set (createdDateTime, description, displayName, id, state); at most one exists per tenant and state inactive means no membership", operation: "GET:/tenantRelationships/multiTenantOrganization", flags: {
             ...common,
             select: multiTenantOrganizationRead.select,
@@ -1448,6 +1621,65 @@ export const LEAVES = [
             full: riskRead.full,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskEvent.Read.All" },
         }, examples: ["mg-axi entra risk-detection show --id <risk-detection-id> --profile soc", "mg-axi entra risk-detection show --id <risk-detection-id> --profile soc --full"] },
+    { path: "entra risky-service-principal list", description: "List at-risk service principals with compact risk state (IdentityRiskyServicePrincipal.Read.All; delegated callers also need Global Reader, Security Operator, Security Reader or Security Administrator; the riskyServicePrincipals API requires a Microsoft Entra Workload Identities Premium licence)", operation: "GET:/identityProtection/riskyServicePrincipals", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: riskRead.filter,
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            cursor: riskRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskyServicePrincipal.Read.All" },
+        }, examples: ["mg-axi entra risky-service-principal list --profile soc", "mg-axi entra risky-service-principal list --profile soc --filter \"riskState eq 'atRisk'\" --limit 10", "mg-axi entra risky-service-principal list --profile soc --all"] },
+    { path: "entra risky-service-principal show", description: "Show one at-risk service principal with the full reviewed property set and detection/history correlation guidance; this read never confirms compromise, dismisses or remediates risk", operation: "GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}", flags: {
+            ...common, id: { value: "risky-service-principal-id", required: true, description: "Risky service principal object ID" },
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskyServicePrincipal.Read.All" },
+        }, examples: ["mg-axi entra risky-service-principal show --id <risky-service-principal-id> --profile soc", "mg-axi entra risky-service-principal show --id <risky-service-principal-id> --profile soc --full"] },
+    { path: "entra risky-service-principal history list", description: "List one service principal's risk history with compact risk state (IdentityRiskyServicePrincipal.Read.All; same roles and Workload Identities Premium licence as the parent risky-service-principal read)", operation: "GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}/history", flags: {
+            ...common,
+            "service-principal": { value: "risky-service-principal-id", required: true, description: "Risky-service-principal object ID owning this history" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: riskRead.filter,
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            cursor: riskRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskyServicePrincipal.Read.All" },
+        }, examples: ["mg-axi entra risky-service-principal history list --service-principal <risky-service-principal-id> --profile soc"] },
+    { path: "entra risky-service-principal history show", description: "Show one service-principal risk-history item with the full reviewed property set and detection correlation guidance", operation: "GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}/history/{riskyServicePrincipalHistoryItem-id}", flags: {
+            ...common,
+            "service-principal": { value: "risky-service-principal-id", required: true, description: "Risky-service-principal object ID owning this history" },
+            id: { value: "history-item-id", required: true, description: "Risk-history item object ID" },
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskyServicePrincipal.Read.All" },
+        }, examples: ["mg-axi entra risky-service-principal history show --service-principal <risky-service-principal-id> --id <history-item-id> --profile soc"] },
+    { path: "entra service-principal-risk-detection list", description: "List service-principal risk detections in a bounded time window (IdentityRiskEvent.Read.All; delegated callers also need Global Reader, Security Operator, Security Reader or Security Administrator; Workload Identities Premium, with riskDetail and riskLevel hidden without it)", operation: "GET:/identityProtection/servicePrincipalRiskDetections", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            since: { ...logRead.since, description: "Required for a new query (resume with --cursor instead): earliest detectedDateTime bounding the server time range" },
+            until: logRead.until,
+            filter: logRead.filter,
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            cursor: riskRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskEvent.Read.All" },
+        }, examples: ["mg-axi entra service-principal-risk-detection list --profile soc --since 2026-09-01T00:00:00Z", "mg-axi entra service-principal-risk-detection list --profile soc --since 2026-09-01T00:00:00Z --filter \"riskState eq 'atRisk'\" --limit 10", "mg-axi entra service-principal-risk-detection list --profile soc --since 2026-09-01T00:00:00Z --all"] },
+    { path: "entra service-principal-risk-detection show", description: "Show one service-principal risk detection with the full reviewed property set; a null correlationId means no sign-in is associated", operation: "GET:/identityProtection/servicePrincipalRiskDetections/{servicePrincipalRiskDetection-id}", flags: {
+            ...common, id: { value: "service-principal-risk-detection-id", required: true, description: "Service-principal risk detection object ID" },
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskEvent.Read.All" },
+        }, examples: ["mg-axi entra service-principal-risk-detection show --id <service-principal-risk-detection-id> --profile soc", "mg-axi entra service-principal-risk-detection show --id <service-principal-risk-detection-id> --profile soc --full"] },
     { path: "entra conditional-access policy list", description: "List Conditional Access policies with compact properties (id, displayName, state)", operation: "GET:/identity/conditionalAccess/policies", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -1648,6 +1880,78 @@ export const LEAVES = [
             ...common,
             scopes: dataPolicyRead.scopes,
         }, examples: ["mg-axi entra data-policy-operation count --profile soc"] },
+    { path: "entra fraud-protection-provider list", description: "List workforce fraud-protection providers with compact properties (id, displayName); rows carry @odata.type naming the provider kind; API keys, client secrets and other key material are never returned; Graph documents $select only, so no --filter", operation: "GET:/identity/riskPrevention/fraudProtectionProviders", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: riskPreventionFraudRead.select,
+            fields: riskPreventionFraudRead.fields,
+            full: riskPreventionFraudRead.full,
+            cursor: riskPreventionFraudRead.cursor,
+            scopes: riskPreventionFraudRead.scopes,
+        }, examples: ["mg-axi entra fraud-protection-provider list --profile soc", "mg-axi entra fraud-protection-provider list --profile soc --limit 10"] },
+    { path: "entra fraud-protection-provider show", description: "Show one workforce fraud-protection provider with the full reviewed property set; API keys, client secrets and other key material are never returned", operation: "GET:/identity/riskPrevention/fraudProtectionProviders/{fraudProtectionProvider-id}", flags: {
+            ...common, id: { value: "provider-id", required: true, description: "Fraud-protection-provider ID" },
+            select: riskPreventionFraudRead.select,
+            fields: riskPreventionFraudRead.fields,
+            full: riskPreventionFraudRead.full,
+            scopes: riskPreventionFraudRead.scopes,
+        }, examples: ["mg-axi entra fraud-protection-provider show --id <provider-id> --profile soc", "mg-axi entra fraud-protection-provider show --id <provider-id> --profile soc --full"] },
+    { path: "entra fraud-protection-provider count", description: "Count workforce fraud-protection providers as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identity/riskPrevention/fraudProtectionProviders/$count", flags: {
+            ...common,
+            scopes: riskPreventionFraudRead.scopes,
+        }, examples: ["mg-axi entra fraud-protection-provider count --profile soc"] },
+    { path: "entra web-application-firewall-provider list", description: "List workforce web-application-firewall providers with compact properties (id, displayName); rows carry @odata.type naming the provider kind; API keys, client secrets and other key material are never returned", operation: "GET:/identity/riskPrevention/webApplicationFirewallProviders", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: riskPreventionWafRead.filter,
+            select: riskPreventionWafRead.select,
+            fields: riskPreventionWafRead.fields,
+            full: riskPreventionWafRead.full,
+            cursor: riskPreventionWafRead.cursor,
+            scopes: riskPreventionWafRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-provider list --profile soc", "mg-axi entra web-application-firewall-provider list --profile soc --limit 10", "mg-axi entra web-application-firewall-provider list --profile soc --filter \"displayName eq 'Example'\""] },
+    { path: "entra web-application-firewall-provider show", description: "Show one workforce web-application-firewall provider with the full reviewed property set; API keys, client secrets and other key material are never returned", operation: "GET:/identity/riskPrevention/webApplicationFirewallProviders/{webApplicationFirewallProvider-id}", flags: {
+            ...common, id: { value: "provider-id", required: true, description: "Web-application-firewall-provider ID" },
+            select: riskPreventionWafRead.select,
+            fields: riskPreventionWafRead.fields,
+            full: riskPreventionWafRead.full,
+            scopes: riskPreventionWafRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-provider show --id <provider-id> --profile soc", "mg-axi entra web-application-firewall-provider show --id <provider-id> --profile soc --full"] },
+    { path: "entra web-application-firewall-provider count", description: "Count workforce web-application-firewall providers as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identity/riskPrevention/webApplicationFirewallProviders/$count", flags: {
+            ...common,
+            scopes: riskPreventionWafRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-provider count --profile soc"] },
+    { path: "entra web-application-firewall-verification list", description: "List workforce web-application-firewall verifications with compact properties (id, verifiedHost, providerType); rows never carry provider detail, which has its own sub-read", operation: "GET:/identity/riskPrevention/webApplicationFirewallVerifications", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: riskPreventionVerificationRead.filter,
+            select: riskPreventionVerificationRead.select,
+            fields: riskPreventionVerificationRead.fields,
+            full: riskPreventionVerificationRead.full,
+            cursor: riskPreventionVerificationRead.cursor,
+            scopes: riskPreventionVerificationRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-verification list --profile soc", "mg-axi entra web-application-firewall-verification list --profile soc --limit 10", "mg-axi entra web-application-firewall-verification list --profile soc --filter \"providerType eq 'cloudflare'\""] },
+    { path: "entra web-application-firewall-verification show", description: "Show one workforce web-application-firewall verification with the full reviewed property set; the row never carries provider detail, which has its own sub-read", operation: "GET:/identity/riskPrevention/webApplicationFirewallVerifications/{webApplicationFirewallVerificationModel-id}", flags: {
+            ...common, id: { value: "verification-id", required: true, description: "Web-application-firewall-verification ID" },
+            select: riskPreventionVerificationRead.select,
+            fields: riskPreventionVerificationRead.fields,
+            full: riskPreventionVerificationRead.full,
+            scopes: riskPreventionVerificationRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-verification show --id <verification-id> --profile soc", "mg-axi entra web-application-firewall-verification show --id <verification-id> --profile soc --full"] },
+    { path: "entra web-application-firewall-verification count", description: "Count workforce web-application-firewall verifications as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identity/riskPrevention/webApplicationFirewallVerifications/$count", flags: {
+            ...common,
+            scopes: riskPreventionVerificationRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-verification count --profile soc"] },
+    { path: "entra web-application-firewall-verification provider show", description: "Show the web-application-firewall provider behind one verification with the full reviewed provider set; API keys, client secrets and other key material are never returned", operation: "GET:/identity/riskPrevention/webApplicationFirewallVerifications/{webApplicationFirewallVerificationModel-id}/provider", flags: {
+            ...common, id: { value: "verification-id", required: true, description: "Web-application-firewall-verification ID owning the provider" },
+            select: riskPreventionWafRead.select,
+            fields: riskPreventionWafRead.fields,
+            full: riskPreventionWafRead.full,
+            scopes: riskPreventionWafRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-verification provider show --id <verification-id> --profile soc"] },
     { path: "entra access-review definition list", description: "List access-review definitions with compact properties (id, displayName, status); definitions are review schedules (a series), never their occurrences", operation: "GET:/identityGovernance/accessReviews/definitions", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -2084,14 +2388,98 @@ export const LEAVES = [
             full: lifecycleTaskReportSubRead.full,
             scopes: lifecycleTaskReportSubRead.scopes,
         }, examples: ["mg-axi entra lifecycle task-report task-definition show --workflow <workflow-id> --report <report-id> --profile soc"] },
-    { path: "api get", description: "Reviewed read-only raw Graph GET (API-01, v1.0 only): users, groups, conditional access, authentication methods, audit/sign-in, risk, apps, roles/PIM, devices, administrative units, domains, domain DNS records, identity providers, organizations, branding, access reviews, entitlement catalogs and access packages, lifecycle workflows, workflow templates, task definitions, lifecycle settings, workflow runs, user/subject processing results and task reports, and partner contracts; unreviewed, secret-value, mail/file-content, beta and write routes are refused before credentials", positional: { name: "path", description: "Server-relative Graph path, e.g. /users" }, flags: {
+    { path: "entra lifecycle run user-processing-result list", description: "List user processing results of one lifecycle workflow run with minimal personal-data properties (id, processingStatus, task counts); the subject link is never requested", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleRunReportsRead.filter,
+            select: lifecycleRunReportsRead.select,
+            fields: lifecycleRunReportsRead.fields,
+            full: lifecycleRunReportsRead.full,
+            cursor: lifecycleRunReportsRead.cursor,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run user-processing-result list --workflow <workflow-id> --run <run-id> --profile soc", "mg-axi entra lifecycle run user-processing-result list --workflow <workflow-id> --run <run-id> --profile soc --limit 10"] },
+    { path: "entra lifecycle run user-processing-result show", description: "Show one run user processing result with minimal personal-data properties; the subject link stays out", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults/{userProcessingResult-id}", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            id: { value: "user-processing-result-id", required: true, description: "User processing result ID" },
+            select: lifecycleRunReportsRead.select,
+            fields: lifecycleRunReportsRead.fields,
+            full: lifecycleRunReportsRead.full,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run user-processing-result show --workflow <workflow-id> --run <run-id> --id <result-id> --profile soc"] },
+    { path: "entra lifecycle run user-processing-result count", description: "Count user processing results of one lifecycle workflow run as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults/$count", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run user-processing-result count --workflow <workflow-id> --run <run-id> --profile soc"] },
+    { path: "entra lifecycle run subject-processing-result list", description: "List subject processing results of one lifecycle workflow run with minimal personal-data properties; Graph documents no $select here so rows always arrive whole", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults", flags: {
+            ...common,
+            workflow: lifecycleRunSubjectRead.workflow,
+            run: lifecycleRunSubjectRead.run,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleRunSubjectRead.filter,
+            fields: lifecycleRunSubjectRead.fields,
+            full: lifecycleRunSubjectRead.full,
+            cursor: lifecycleRunSubjectRead.cursor,
+            scopes: lifecycleRunSubjectRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run subject-processing-result list --workflow <workflow-id> --run <run-id> --profile soc", "mg-axi entra lifecycle run subject-processing-result list --workflow <workflow-id> --run <run-id> --profile soc --limit 10"] },
+    { path: "entra lifecycle run subject-processing-result show", description: "Show one run subject processing result with minimal personal-data properties; the get documents $expand only so the row always arrives whole and the subject navigation stays out", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults/{subjectProcessingResult-id}", flags: {
+            ...common,
+            workflow: lifecycleRunSubjectRead.workflow,
+            run: lifecycleRunSubjectRead.run,
+            id: { value: "subject-processing-result-id", required: true, description: "Subject processing result ID" },
+            fields: lifecycleRunSubjectRead.fields,
+            full: lifecycleRunSubjectRead.full,
+            scopes: lifecycleRunSubjectRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run subject-processing-result show --workflow <workflow-id> --run <run-id> --id <result-id> --profile soc"] },
+    { path: "entra lifecycle run subject-processing-result count", description: "Count subject processing results of one lifecycle workflow run as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults/$count", flags: {
+            ...common,
+            workflow: lifecycleRunSubjectRead.workflow,
+            run: lifecycleRunSubjectRead.run,
+            scopes: lifecycleRunSubjectRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run subject-processing-result count --workflow <workflow-id> --run <run-id> --profile soc"] },
+    { path: "entra lifecycle run task-processing-result list", description: "List task processing results of one lifecycle workflow run with compact properties (id, processingStatus, failureReason); rows never carry subject, task or workflowSubject detail", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleRunReportsRead.filter,
+            select: lifecycleRunReportsRead.select,
+            fields: lifecycleRunReportsRead.fields,
+            full: lifecycleRunReportsRead.full,
+            cursor: lifecycleRunReportsRead.cursor,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run task-processing-result list --workflow <workflow-id> --run <run-id> --profile soc", "mg-axi entra lifecycle run task-processing-result list --workflow <workflow-id> --run <run-id> --profile soc --limit 10"] },
+    { path: "entra lifecycle run task-processing-result show", description: "Show one run task processing result with the full reviewed scalar set including failure detail; Graph documents no query parameters here so the row always arrives whole and subject, task and workflowSubject detail belongs to later slices", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults/{taskProcessingResult-id}", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            id: { value: "task-processing-result-id", required: true, description: "Task processing result ID" },
+            fields: lifecycleRunReportsRead.fields,
+            full: lifecycleRunReportsRead.full,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run task-processing-result show --workflow <workflow-id> --run <run-id> --id <result-id> --profile soc"] },
+    { path: "entra lifecycle run task-processing-result count", description: "Count task processing results of one lifecycle workflow run as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults/$count", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run task-processing-result count --workflow <workflow-id> --run <run-id> --profile soc"] },
+    { path: "api get", description: "Reviewed read-only raw Graph GET (API-01, v1.0 only): users, groups, conditional access, authentication methods, audit/sign-in, risk, apps, roles/PIM, devices, administrative units, domains, domain DNS records, identity providers, organizations, branding, access reviews, entitlement catalogs and access packages, lifecycle workflows, workflow templates, task definitions, lifecycle settings, workflow runs, user/subject processing results, task reports and run user/subject/task processing results, and partner contracts; unreviewed, secret-value, mail/file-content, beta and write routes are refused before credentials", positional: { name: "path", description: "Server-relative Graph path, e.g. /users" }, flags: {
             ...common,
             odata: { value: "k=v&k2=v2", description: "OData query reviewed per route ($select/$filter/$top/$orderby on collections; $select on singles); defaults to reviewed fields" },
             cursor: { value: "token|-", description: "Resume a partial collection; - reads the token from stdin (16 MB ceiling for either input); use the same path, profile and scopes, and omit --odata to reuse its query" },
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit full https://graph.microsoft.com/ scope names; application profiles use the .default audience" },
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; use --all to follow pages within budget" },
             all: { description: "Follow @odata.nextLink pages within the request budget" },
-            full: { description: "Disable 4000-character string truncation; never disables redaction or row caps" },
+            full: { description: "Disable 500-character string truncation; never disables redaction or row caps" },
         }, examples: ["mg-axi api get /users --scopes https://graph.microsoft.com/User.Read.All", "mg-axi api get /groups --odata '$filter=securityEnabled eq true&$top=5' --scopes https://graph.microsoft.com/GroupMember.Read.All", "mg-axi api get /users --cursor - --all --scopes https://graph.microsoft.com/User.Read.All < cursor.txt"] },
 ];
 export function leafHelp(leaf) {