@knowttl/mg-axi 0.1.1 → 0.1.2

package/dist/cli.js

@@ -1,5 +1,7 @@
 import { encode } from "@toon-format/toon";
-import { AxiError, runAxiCli } from "axi-sdk-js";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { AxiError, installSessionStartHooks, runAxiCli } from "axi-sdk-js";
 import { LEAVES, home, leafHelp, operationFor, resolveCommand, DESCRIPTION, TOP_LEVEL_HELP } from "./catalogue.js";
 import { VERSION } from "./version.js";
 import { Profiles } from "./profiles.js";
@@ -10,11 +12,12 @@ import { revokeUserSessions } from "./entra-user-revoke-sessions.js";
 import { createMutationCoordinator, mutationFetchTransport } from "./mutations.js";
 import { TRANSITIVE_OPERATION, listGroupMemberOf, listGroupMembers, listGroups, showGroup } from "./entra-groups.js";
 import { listDirectoryRoles, showDirectoryRole, listRoleAssignments, listPimEligible, listPimActive } from "./entra-roles.js";
+import { listGroupAssignmentSchedules, showGroupAssignmentSchedule, listGroupAssignmentInstances, showGroupAssignmentInstance, listGroupEligibilitySchedules, showGroupEligibilitySchedule, listGroupEligibilityInstances, showGroupEligibilityInstance, listGroupEligibilityRequests, showGroupEligibilityRequest } from "./entra-group-pim.js";
 import { listAdministrativeUnitMembers, listAdministrativeUnits, listDevices, showAdministrativeUnit, showDevice } from "./entra-directory.js";
 import { listSignIns, showSignIn, listDirectoryAudits, showDirectoryAudit } from "./entra-audit-logs.js";
 import { listApplicationOwners, listApplications, listServicePrincipalOwners, listServicePrincipals, showApplication, showServicePrincipal } from "./entra-apps.js";
 import { listAppRoleAssignments, listOAuth2Grants } from "./entra-grants.js";
-import { listRiskyUsers, showRiskyUser, listRiskDetections, showRiskDetection } from "./entra-risk.js";
+import { listRiskyUsers, showRiskyUser, listRiskDetections, showRiskDetection, listRiskyServicePrincipals, showRiskyServicePrincipal, listRiskyServicePrincipalHistory, showRiskyServicePrincipalHistory, listServicePrincipalRiskDetections, showServicePrincipalRiskDetection } from "./entra-risk.js";
 import { dismissRiskyUser } from "./entra-risk-dismiss.js";
 import { listPolicies, showPolicy, listNamedLocations, showNamedLocation } from "./entra-conditional-access.js";
 import { listBrandingLocalizations, listOrganizations, showBranding, showBrandingLocalization, showOrganization } from "./entra-organization.js";
@@ -28,7 +31,7 @@ import { listDirectoryObjects, showDirectoryObject, countDirectoryObjects } from
 import { listDeletedItems, showDeletedItem, countDeletedItems } from "./entra-deleted-items.js";
 import { listContacts, showContact, countContacts, showContactManager, listContactDirectReports, showContactDirectReport, countContactDirectReports, castDirectReports, listContactMemberOf, showContactMemberOf, countContactMemberOf, transitMembership, castMembership } from "./entra-contacts.js";
 import { countContracts, listContracts, showContract } from "./entra-contracts.js";
-import { listDelegatedAdminCustomers, showDelegatedAdminCustomer, listDelegatedAdminRelationships, showDelegatedAdminRelationship, listDelegatedAdminAccessAssignments, showDelegatedAdminAccessAssignment, listDelegatedAdminOperations, showDelegatedAdminOperation, listDelegatedAdminRequests, showDelegatedAdminRequest, listDelegatedAdminServiceManagementDetails, showDelegatedAdminServiceManagementDetail } from "./entra-delegated-admin.js";
+import { listDelegatedAdminCustomers, showDelegatedAdminCustomer, listDelegatedAdminRelationships, showDelegatedAdminRelationship, listDelegatedAdminAccessAssignments, showDelegatedAdminAccessAssignment, listDelegatedAdminOperations, showDelegatedAdminOperation, listDelegatedAdminRequests, showDelegatedAdminRequest, listDelegatedAdminServiceManagementDetails, showDelegatedAdminServiceManagementDetail, countDelegatedAdminCustomers, countDelegatedAdminServiceManagementDetails, countDelegatedAdminRelationships, countDelegatedAdminAccessAssignments, countDelegatedAdminOperations, countDelegatedAdminRequests } from "./entra-delegated-admin.js";
 import { listMultiTenantOrganizationTenants, showMultiTenantOrganization, showMultiTenantOrganizationJoinRequest, countMultiTenantOrganizationTenants } from "./entra-multi-tenant-organization.js";
 import { showTenantInformation } from "./entra-tenant-information.js";
 import { countLifecyclePolicies, listLifecyclePolicies, showLifecyclePolicy, countSettingTemplates, listSettingTemplates, showSettingTemplate } from "./entra-group-lifecycle.js";
@@ -36,9 +39,10 @@ import { listAttributeSets, showAttributeSet, countAttributeSets, listCustomSecu
 import { listIdentityProviders, showIdentityProvider, countIdentityProviders, availableIdentityProviderTypes } from "./entra-identity-providers.js";
 import { listFederationConfigurations, showFederationConfiguration, countFederationConfigurations, availableFederationProviderTypes } from "./entra-federation-configurations.js";
 import { listDataPolicyOperations, showDataPolicyOperation, countDataPolicyOperations } from "./entra-data-policy-operations.js";
+import { listFraudProtectionProviders, showFraudProtectionProvider, countFraudProtectionProviders, listWafProviders, showWafProvider, countWafProviders, listWafVerifications, showWafVerification, countWafVerifications, showVerificationProvider } from "./entra-risk-prevention.js";
 import { listDefinitions, showDefinition, listInstances, showInstance, listDecisions, showDecision, listContactedReviewers, showContactedReviewer, listStages, showStage } from "./entra-access-reviews.js";
 import { listCatalogs, showCatalog, countCatalogs, listAccessPackages, showAccessPackage, countAccessPackages, listAssignmentPolicies, showAssignmentPolicy, countAssignmentPolicies, listResourceRoleScopes, showResourceRoleScope, countResourceRoleScopes, listAssignments, showAssignment, countAssignments, listAssignmentRequests, showAssignmentRequest, countAssignmentRequests } from "./entra-entitlement-management.js";
-import { listWorkflows, showWorkflow, countWorkflows, listWorkflowTemplates, showWorkflowTemplate, countWorkflowTemplates, listTaskDefinitions, showTaskDefinition, countTaskDefinitions, showLifecycleSettings, listRuns, showRun, countRuns, listUserProcessingResults, showUserProcessingResult, countUserProcessingResults, listSubjectProcessingResults, showSubjectProcessingResult, countSubjectProcessingResults, listTaskReports, showTaskReport, countTaskReports, showTaskReportTask, showTaskReportTaskDefinition } from "./entra-lifecycle-workflows.js";
+import { listWorkflows, showWorkflow, countWorkflows, listWorkflowTemplates, showWorkflowTemplate, countWorkflowTemplates, listTaskDefinitions, showTaskDefinition, countTaskDefinitions, showLifecycleSettings, listRuns, showRun, countRuns, listUserProcessingResults, showUserProcessingResult, countUserProcessingResults, listSubjectProcessingResults, showSubjectProcessingResult, countSubjectProcessingResults, listTaskReports, showTaskReport, countTaskReports, showTaskReportTask, showTaskReportTaskDefinition, listRunUserProcessingResults, showRunUserProcessingResult, countRunUserProcessingResults, listRunSubjectProcessingResults, showRunSubjectProcessingResult, countRunSubjectProcessingResults, listRunTaskProcessingResults, showRunTaskProcessingResult, countRunTaskProcessingResults } from "./entra-lifecycle-workflows.js";
 import { listAuthenticationMethods, listRegistrationDetails } from "./entra-auth-methods.js";
 import { addGroupMember } from "./entra-group-member-add.js";
 import { fetchTransport } from "./api.js";
@@ -62,6 +66,36 @@ function localHome(name) {
     output.help.unshift("npx -y @knowttl/mg-axi profile list", "npx -y @knowttl/mg-axi login --help");
     return output;
 }
+// One dispatch for the hook installer: resolve the sibling hook entry point
+// installed next to this binary and register it as the SessionStart command
+// for Claude Code, Codex and OpenCode through the SDK. No config, profile,
+// transport or network is involved; the hook itself prints the local-only
+// summary from src/hook.ts. Install failures throw loudly; hook failures
+// never do.
+function runSetupHooks() {
+    const hookPath = join(dirname(process.argv[1] ?? ""), "mg-axi-hook.js");
+    if (!existsSync(hookPath)) {
+        throw new AxiError("Cannot locate the mg-axi-hook entry point", "HOOK_INSTALL_FAILED", [
+            "Reinstall @knowttl/mg-axi so dist/bin/mg-axi-hook.js sits next to the main entry point",
+            "Run mg-axi setup hooks again after reinstalling",
+        ]);
+    }
+    const failures = [];
+    installSessionStartHooks({
+        marker: "mg-axi-hook",
+        execPath: hookPath,
+        binaryNames: ["mg-axi-hook"],
+        distEntrypoints: ["dist/bin/mg-axi-hook.js"],
+        onError: (message) => { failures.push(message); },
+    });
+    if (failures.length > 0) {
+        throw new AxiError("Failed to install mg-axi agent hooks", "HOOK_INSTALL_FAILED", failures);
+    }
+    return {
+        hooks: { status: "installed", integrations: "Claude Code, Codex, OpenCode" },
+        help: ["Restart your agent session to receive mg-axi ambient context"],
+    };
+}
 async function readCursor(cursor) {
     if (cursor !== "-")
         return cursor;
@@ -98,6 +132,8 @@ export async function executeArgv(argv, overrides = {}) {
         return profiles.resolve(flags.profile);
     if (leaf.path === "setup")
         return setupView(profiles);
+    if (leaf.path === "setup hooks")
+        return runSetupHooks();
     if (leaf.path === "doctor") {
         const names = doctorTargets(profiles, flags.profile);
         let delegated = overrides.delegated;
@@ -238,7 +274,7 @@ export async function executeArgv(argv, overrides = {}) {
             default: return countResourceRoleScopes(session, flags, selected.profile, operation, help, selected.name);
         }
     }
-    if (leaf.path === "entra lifecycle workflow list" || leaf.path === "entra lifecycle workflow show" || leaf.path === "entra lifecycle workflow count" || leaf.path === "entra lifecycle workflow-template list" || leaf.path === "entra lifecycle workflow-template show" || leaf.path === "entra lifecycle workflow-template count" || leaf.path === "entra lifecycle task-definition list" || leaf.path === "entra lifecycle task-definition show" || leaf.path === "entra lifecycle task-definition count" || leaf.path === "entra lifecycle settings show" || leaf.path === "entra lifecycle run list" || leaf.path === "entra lifecycle run show" || leaf.path === "entra lifecycle run count" || leaf.path === "entra lifecycle user-processing-result list" || leaf.path === "entra lifecycle user-processing-result show" || leaf.path === "entra lifecycle user-processing-result count" || leaf.path === "entra lifecycle subject-processing-result list" || leaf.path === "entra lifecycle subject-processing-result show" || leaf.path === "entra lifecycle subject-processing-result count" || leaf.path === "entra lifecycle task-report list" || leaf.path === "entra lifecycle task-report show" || leaf.path === "entra lifecycle task-report count" || leaf.path === "entra lifecycle task-report task show" || leaf.path === "entra lifecycle task-report task-definition show") {
+    if (leaf.path === "entra lifecycle workflow list" || leaf.path === "entra lifecycle workflow show" || leaf.path === "entra lifecycle workflow count" || leaf.path === "entra lifecycle workflow-template list" || leaf.path === "entra lifecycle workflow-template show" || leaf.path === "entra lifecycle workflow-template count" || leaf.path === "entra lifecycle task-definition list" || leaf.path === "entra lifecycle task-definition show" || leaf.path === "entra lifecycle task-definition count" || leaf.path === "entra lifecycle settings show" || leaf.path === "entra lifecycle run list" || leaf.path === "entra lifecycle run show" || leaf.path === "entra lifecycle run count" || leaf.path === "entra lifecycle user-processing-result list" || leaf.path === "entra lifecycle user-processing-result show" || leaf.path === "entra lifecycle user-processing-result count" || leaf.path === "entra lifecycle subject-processing-result list" || leaf.path === "entra lifecycle subject-processing-result show" || leaf.path === "entra lifecycle subject-processing-result count" || leaf.path === "entra lifecycle task-report list" || leaf.path === "entra lifecycle task-report show" || leaf.path === "entra lifecycle task-report count" || leaf.path === "entra lifecycle task-report task show" || leaf.path === "entra lifecycle task-report task-definition show" || leaf.path === "entra lifecycle run user-processing-result list" || leaf.path === "entra lifecycle run user-processing-result show" || leaf.path === "entra lifecycle run user-processing-result count" || leaf.path === "entra lifecycle run subject-processing-result list" || leaf.path === "entra lifecycle run subject-processing-result show" || leaf.path === "entra lifecycle run subject-processing-result count" || leaf.path === "entra lifecycle run task-processing-result list" || leaf.path === "entra lifecycle run task-processing-result show" || leaf.path === "entra lifecycle run task-processing-result count") {
         if (String(flags["api-version"] ?? "v1.0") !== "v1.0") {
             throw new AxiError("Lifecycle-workflow reads support v1.0 only; beta needs its own review", "VALIDATION_ERROR", [leafHelp(leaf)]);
         }
@@ -287,6 +323,15 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra lifecycle task-report count": return countTaskReports(session, flags, selected.profile, operation, help, selected.name);
             case "entra lifecycle task-report task show": return showTaskReportTask(session, flags, selected.profile, operation, help, selected.name);
             case "entra lifecycle task-report task-definition show": return showTaskReportTaskDefinition(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run user-processing-result list": return listRunUserProcessingResults(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run user-processing-result show": return showRunUserProcessingResult(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run user-processing-result count": return countRunUserProcessingResults(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run subject-processing-result list": return listRunSubjectProcessingResults(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run subject-processing-result show": return showRunSubjectProcessingResult(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run subject-processing-result count": return countRunSubjectProcessingResults(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run task-processing-result list": return listRunTaskProcessingResults(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run task-processing-result show": return showRunTaskProcessingResult(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run task-processing-result count": return countRunTaskProcessingResults(session, flags, selected.profile, operation, help, selected.name);
             default: return showLifecycleSettings(session, flags, selected.profile, operation, help, selected.name);
         }
     }
@@ -541,6 +586,11 @@ export async function executeArgv(argv, overrides = {}) {
         });
     }
     if (leaf.path === "entra directory-role list" || leaf.path === "entra directory-role show" || leaf.path === "entra role-assignment list" || leaf.path === "entra pim eligible list" || leaf.path === "entra pim active list"
+        || leaf.path === "entra pim group-assignment-schedule list" || leaf.path === "entra pim group-assignment-schedule show"
+        || leaf.path === "entra pim group-assignment-instance list" || leaf.path === "entra pim group-assignment-instance show"
+        || leaf.path === "entra pim group-eligibility-schedule list" || leaf.path === "entra pim group-eligibility-schedule show"
+        || leaf.path === "entra pim group-eligibility-instance list" || leaf.path === "entra pim group-eligibility-instance show"
+        || leaf.path === "entra pim group-eligibility-request list" || leaf.path === "entra pim group-eligibility-request show"
         || leaf.path === "entra device list" || leaf.path === "entra device show"
         || leaf.path === "entra administrative-unit list" || leaf.path === "entra administrative-unit show"
         || leaf.path === "entra administrative-unit member list") {
@@ -569,6 +619,16 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra role-assignment list": return listRoleAssignments(session, flags, selected.profile, operation, help, selected.name);
             case "entra pim eligible list": return listPimEligible(session, flags, selected.profile, operation, help, selected.name);
             case "entra pim active list": return listPimActive(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-assignment-schedule list": return listGroupAssignmentSchedules(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-assignment-schedule show": return showGroupAssignmentSchedule(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-assignment-instance list": return listGroupAssignmentInstances(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-assignment-instance show": return showGroupAssignmentInstance(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-schedule list": return listGroupEligibilitySchedules(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-schedule show": return showGroupEligibilitySchedule(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-instance list": return listGroupEligibilityInstances(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-instance show": return showGroupEligibilityInstance(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-request list": return listGroupEligibilityRequests(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-request show": return showGroupEligibilityRequest(session, flags, selected.profile, operation, help, selected.name);
             case "entra device list": return listDevices(session, flags, selected.profile, operation, help, selected.name);
             case "entra device show": return showDevice(session, flags, selected.profile, operation, help, selected.name);
             case "entra administrative-unit list": return listAdministrativeUnits(session, flags, selected.profile, operation, help, selected.name);
@@ -702,7 +762,7 @@ export async function executeArgv(argv, overrides = {}) {
             help: leafHelp(leaf),
         });
     }
-    if (leaf.path === "entra risky-user list" || leaf.path === "entra risky-user show" || leaf.path === "entra risk-detection list" || leaf.path === "entra risk-detection show") {
+    if (leaf.path === "entra risky-user list" || leaf.path === "entra risky-user show" || leaf.path === "entra risk-detection list" || leaf.path === "entra risk-detection show" || leaf.path === "entra risky-service-principal list" || leaf.path === "entra risky-service-principal show" || leaf.path === "entra risky-service-principal history list" || leaf.path === "entra risky-service-principal history show" || leaf.path === "entra service-principal-risk-detection list" || leaf.path === "entra service-principal-risk-detection show") {
         const selected = profiles.resolve(flags.profile);
         const operation = operationFor(leaf, String(flags["api-version"] ?? "v1.0"));
         if (!operation || operation.method !== "GET") {
@@ -728,7 +788,13 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra risky-user list": return listRiskyUsers(session, flags, selected.profile, operation, help, selected.name);
             case "entra risky-user show": return showRiskyUser(session, flags, selected.profile, operation, help, selected.name);
             case "entra risk-detection list": return listRiskDetections(session, flags, selected.profile, operation, help, selected.name);
-            default: return showRiskDetection(session, flags, selected.profile, operation, help, selected.name);
+            case "entra risk-detection show": return showRiskDetection(session, flags, selected.profile, operation, help, selected.name);
+            case "entra risky-service-principal list": return listRiskyServicePrincipals(session, flags, selected.profile, operation, help, selected.name);
+            case "entra risky-service-principal show": return showRiskyServicePrincipal(session, flags, selected.profile, operation, help, selected.name);
+            case "entra risky-service-principal history list": return listRiskyServicePrincipalHistory(session, flags, selected.profile, operation, help, selected.name);
+            case "entra risky-service-principal history show": return showRiskyServicePrincipalHistory(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal-risk-detection list": return listServicePrincipalRiskDetections(session, flags, selected.profile, operation, help, selected.name);
+            default: return showServicePrincipalRiskDetection(session, flags, selected.profile, operation, help, selected.name);
         }
     }
     if (leaf.path === "entra domain list" || leaf.path === "entra domain show"
@@ -1106,7 +1172,7 @@ export async function executeArgv(argv, overrides = {}) {
             default: return countContracts(session, flags, selected.profile, operation, help, selected.name);
         }
     }
-    if (leaf.path === "entra delegated-admin-customer list" || leaf.path === "entra delegated-admin-customer show" || leaf.path === "entra delegated-admin-relationship list" || leaf.path === "entra delegated-admin-relationship show" || leaf.path === "entra delegated-admin-relationship list-access-assignments" || leaf.path === "entra delegated-admin-relationship show-access-assignment" || leaf.path === "entra delegated-admin-relationship list-operations" || leaf.path === "entra delegated-admin-relationship show-operation" || leaf.path === "entra delegated-admin-relationship list-requests" || leaf.path === "entra delegated-admin-relationship show-request" || leaf.path === "entra delegated-admin-customer list-service-management-details" || leaf.path === "entra delegated-admin-customer show-service-management-detail") {
+    if (leaf.path === "entra delegated-admin-customer list" || leaf.path === "entra delegated-admin-customer show" || leaf.path === "entra delegated-admin-relationship list" || leaf.path === "entra delegated-admin-relationship show" || leaf.path === "entra delegated-admin-relationship list-access-assignments" || leaf.path === "entra delegated-admin-relationship show-access-assignment" || leaf.path === "entra delegated-admin-relationship list-operations" || leaf.path === "entra delegated-admin-relationship show-operation" || leaf.path === "entra delegated-admin-relationship list-requests" || leaf.path === "entra delegated-admin-relationship show-request" || leaf.path === "entra delegated-admin-customer list-service-management-details" || leaf.path === "entra delegated-admin-customer show-service-management-detail" || leaf.path === "entra delegated-admin-customer count" || leaf.path === "entra delegated-admin-customer count-service-management-details" || leaf.path === "entra delegated-admin-relationship count" || leaf.path === "entra delegated-admin-relationship count-access-assignments" || leaf.path === "entra delegated-admin-relationship count-operations" || leaf.path === "entra delegated-admin-relationship count-requests") {
         if (String(flags["api-version"] ?? "v1.0") !== "v1.0") {
             throw new AxiError("Delegated-admin reads support v1.0 only; beta needs its own review", "VALIDATION_ERROR", [leafHelp(leaf)]);
         }
@@ -1141,6 +1207,12 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra delegated-admin-relationship list-requests": return listDelegatedAdminRequests(session, flags, selected.profile, operation, help, selected.name);
             case "entra delegated-admin-relationship show-request": return showDelegatedAdminRequest(session, flags, selected.profile, operation, help, selected.name);
             case "entra delegated-admin-customer list-service-management-details": return listDelegatedAdminServiceManagementDetails(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-customer count": return countDelegatedAdminCustomers(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-customer count-service-management-details": return countDelegatedAdminServiceManagementDetails(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-relationship count": return countDelegatedAdminRelationships(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-relationship count-access-assignments": return countDelegatedAdminAccessAssignments(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-relationship count-operations": return countDelegatedAdminOperations(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-relationship count-requests": return countDelegatedAdminRequests(session, flags, selected.profile, operation, help, selected.name);
             default: return showDelegatedAdminServiceManagementDetail(session, flags, selected.profile, operation, help, selected.name);
         }
     }
@@ -1288,6 +1360,42 @@ export async function executeArgv(argv, overrides = {}) {
             default: return countDataPolicyOperations(session, flags, selected.profile, operation, help, selected.name);
         }
     }
+    if (leaf.path === "entra fraud-protection-provider list" || leaf.path === "entra fraud-protection-provider show" || leaf.path === "entra fraud-protection-provider count" || leaf.path === "entra web-application-firewall-provider list" || leaf.path === "entra web-application-firewall-provider show" || leaf.path === "entra web-application-firewall-provider count" || leaf.path === "entra web-application-firewall-verification list" || leaf.path === "entra web-application-firewall-verification show" || leaf.path === "entra web-application-firewall-verification count" || leaf.path === "entra web-application-firewall-verification provider show") {
+        if (String(flags["api-version"] ?? "v1.0") !== "v1.0") {
+            throw new AxiError("Risk-prevention reads support v1.0 only; beta needs its own review", "VALIDATION_ERROR", [leafHelp(leaf)]);
+        }
+        const selected = profiles.resolve(flags.profile);
+        const operation = operationFor(leaf, "v1.0");
+        if (!operation || operation.method !== "GET") {
+            throw new AxiError(`Unknown catalogued Graph operation for ${leaf.path}`, "VALIDATION_ERROR", [leafHelp(leaf)]);
+        }
+        let delegated = overrides.delegated;
+        let application = overrides.application;
+        if (!delegated) {
+            const { DelegatedAuth: Service } = await import("./auth.js");
+            const { MsalProvider } = await import("./msal-provider.js");
+            delegated = new Service(new MsalProvider());
+        }
+        if (!application) {
+            const { ApplicationAuth: Service } = await import("./app-auth.js");
+            const { MsalApplicationProvider } = await import("./msal-app-provider.js");
+            application = new Service(new MsalApplicationProvider());
+        }
+        const session = new GraphSession({ delegated, application, transport: overrides.transport ?? fetchTransport });
+        const help = leafHelp(leaf);
+        switch (leaf.path) {
+            case "entra fraud-protection-provider list": return listFraudProtectionProviders(session, flags, selected.profile, operation, help, selected.name);
+            case "entra fraud-protection-provider show": return showFraudProtectionProvider(session, flags, selected.profile, operation, help, selected.name);
+            case "entra fraud-protection-provider count": return countFraudProtectionProviders(session, flags, selected.profile, operation, help);
+            case "entra web-application-firewall-provider list": return listWafProviders(session, flags, selected.profile, operation, help, selected.name);
+            case "entra web-application-firewall-provider show": return showWafProvider(session, flags, selected.profile, operation, help, selected.name);
+            case "entra web-application-firewall-provider count": return countWafProviders(session, flags, selected.profile, operation, help);
+            case "entra web-application-firewall-verification list": return listWafVerifications(session, flags, selected.profile, operation, help, selected.name);
+            case "entra web-application-firewall-verification show": return showWafVerification(session, flags, selected.profile, operation, help, selected.name);
+            case "entra web-application-firewall-verification count": return countWafVerifications(session, flags, selected.profile, operation, help);
+            default: return showVerificationProvider(session, flags, selected.profile, operation, help, selected.name);
+        }
+    }
     const operation = operationFor(leaf, String(flags["api-version"] ?? "v1.0"));
     throw new AxiError(`Command is not executable: ${operation?.disposition ?? "unavailable"} (${operation?.owningSlice ?? "no inventory mapping"})`, "NOT_IMPLEMENTED", [leafHelp(leaf)]);
 }

package/dist/docs.js

@@ -74,10 +74,15 @@ const READ_AREA_LABELS = [
     ["entra service-principal ", "applications and consent grants"],
     ["entra risky-user ", "risk"],
     ["entra risk-detection ", "risk"],
+    ["entra risky-service-principal ", "risk"],
+    ["entra service-principal-risk-detection ", "risk"],
     ["entra conditional-access ", "Conditional Access"],
     ["entra identity-provider ", "identity providers"],
     ["entra federation-configuration ", "federation configurations"],
     ["entra data-policy-operation ", "data policy operations"],
+    ["entra fraud-protection-provider ", "risk prevention"],
+    ["entra web-application-firewall-provider ", "risk prevention"],
+    ["entra web-application-firewall-verification ", "risk prevention"],
     ["entra access-review ", "access reviews"],
     ["entra entitlement catalog ", "entitlement catalogs and access packages"],
     ["entra entitlement access-package ", "entitlement catalogs and access packages"],
@@ -200,6 +205,19 @@ export function skillDocument() {
         "Configuration defaults to `~/.mg-axi/config.json`; `MG_AXI_CONFIG` selects a separate file.",
         "`mg-axi setup` shows the selected path and writes nothing.",
         "",
+        "Agent discovery has two install paths, and either suffices alone.",
+        "For ambient context at every agent session start instead of the skill, install the CLI globally and opt into the session hook:",
+        "",
+        "```sh",
+        "npm install --global @knowttl/mg-axi",
+        "mg-axi setup hooks",
+        "```",
+        "",
+        "This installs a `SessionStart` hook for Claude Code, Codex and OpenCode that prints a short local-only summary (configured profile names with tenant labels, auth-cache presence, write posture and version).",
+        "The hook makes no network, Graph or sign-in call, and prints a short `not configured` record with exit 0 when unconfigured.",
+        "Restart the agent session after running the installer.",
+        "No other ordinary command installs hooks, plugins or configuration.",
+        "",
         "## Selecting a profile",
         "",
         "Read leaves accept `--profile <name>`.",
@@ -273,6 +291,7 @@ export function capabilityDocument() {
     const deferredProviderRows = rows.filter(row => row.owningSlice === "EXT-03" && row.reason.startsWith("Deferred to a later EXT-03 "));
     const deferredFederationRows = rows.filter(row => row.owningSlice === "EXT-01" && row.reason.startsWith("Deferred by firstmate federation-configuration scope "));
     const deferredDataPolicyRows = rows.filter(row => row.owningSlice === "EXT-03" && row.reason.startsWith("Deferred by firstmate data-policy-operations scope "));
+    const deferredRiskPreventionRows = rows.filter(row => row.owningSlice === "EXT-03" && row.reason.startsWith("Deferred by firstmate risk-prevention scope "));
     const unavailableInvitationRows = rows.filter(row => row.owningSlice === "EXT-03" && row.reason.startsWith("Marked unavailable by firstmate EXT-03b decision: "));
     const deferredOrganizationRows = rows.filter(row => row.owningSlice === "EXT-01" && row.reason.startsWith("Deferred by firstmate organization scope "));
     const unavailableCertAuthRows = rows.filter(row => row.owningSlice === "EXT-01" && row.reason.startsWith("Marked unavailable by firstmate mg-ext-01d decision: "));
@@ -285,6 +304,7 @@ export function capabilityDocument() {
     const deferredContractRows = rows.filter(row => row.owningSlice === "EXT-04" && row.reason.startsWith("Deferred by firstmate contracts scope "));
     const deferredDelegatedAdminRows = rows.filter(row => row.owningSlice === "EXT-04" && row.reason.startsWith("Deferred by firstmate delegated-admin scope "));
     const deferredMtoRows = rows.filter(row => row.owningSlice === "EXT-04" && row.reason.startsWith("Deferred by firstmate multi-tenant-organization scope "));
+    const deferredReportsRows = rows.filter(row => row.owningSlice === "EXT-04" && row.reason.startsWith("Deferred by firstmate reports scope "));
     const deferredGroupLifecycleRows = rows.filter(row => row.owningSlice === "EXT-01" && row.reason.startsWith("Deferred by firstmate group-lifecycle scope "));
     const deferredCustomSecurityRows = rows.filter(row => row.owningSlice === "EXT-01" && row.reason.startsWith("Deferred by firstmate custom-security-attributes scope "));
     const deferredAccessReviewRows = rows.filter(row => row.owningSlice === "EXT-02c");
@@ -364,6 +384,18 @@ export function capabilityDocument() {
         "|---|---|---|---|",
         ...deferredDataPolicyRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
         "",
+        "## EXT-03 risk-prevention scope decisions",
+        "",
+        "This change covers the ten v1.0 workforce risk-prevention reads above (fraud-protection-provider list, show and count; web-application-firewall-provider list, show and count; web-application-firewall-verification list, show, count and provider show).",
+        "The eleven beta operations below remain scheduled with an explicit deferred disposition to a later EXT-03 subfamily; no new commands or raw access are approved.",
+        "Risk-prevention reads support v1.0 only; beta needs its own review.",
+        "API keys, client secrets and other key material (Arkose privateKey/publicKey, HUMAN serverToken, Akamai clientSecret/clientToken/accessToken, Cloudflare apiToken) are never selectable and never projected; application profiles are refused before credentials because Graph documents no supported application permission.",
+        "Workforce context only; no external-customer support is claimed.",
+        "",
+        "| Inventory operation | Disposition | Owning slice | Deferral reason |",
+        "|---|---|---|---|",
+        ...deferredRiskPreventionRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        "",
         "## EXT-03 invitations scope decisions",
         "",
         "Firstmate decision (mg-ext-03b inbox 001): do not implement these reads and add no scope.",
@@ -495,9 +527,9 @@ export function capabilityDocument() {
         ...deferredContractRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`), "",
         "## EXT-04 delegated-admin scope decisions",
         "",
-        "Firstmate scope: approve narrowing this change to the twelve v1.0 delegated-admin reads above (customer list/show, relationship list/show, access-assignment list/show, operation list/show, request list/show and service-management-detail list/show).",
+        "Firstmate scope: approve narrowing this change to the eighteen v1.0 delegated-admin reads above (customer list/show/count, relationship list/show/count, access-assignment list/show/count, operation list/show/count, request list/show/count and service-management-detail list/show/count).",
         "The operations below remain scheduled with an explicit deferred disposition to a later EXT-04 subfamily; no new commands or raw access are approved.",
-        "Scalar counts need a separate query and response contract from the approved list/show reads; the tenantRelationship container root needs its own projection review; multi-tenant-organization reads shipped in the section below, and tenant-lookup functions ship as tenant-information show under the mg-ext-04e function-argument contract.",
+        "The tenantRelationship container root needs its own projection review; multi-tenant-organization reads shipped in the section below, and tenant-lookup functions ship as tenant-information show under the mg-ext-04e function-argument contract.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
@@ -510,6 +542,14 @@ export function capabilityDocument() {
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
         ...deferredMtoRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`), "",
+        "## EXT-04 reports scope decisions",
+        "",
+        "Firstmate scope: approve deferring the v1.0 relying-party summary read below; no named command or raw access is approved for it.",
+        "The relying-party summary read below remains scheduled with an explicit deferred disposition: its period function argument needs a new session-guard function-argument binding beyond the three allowlisted tenant-lookup/commerce routes, and the request-path guard must stay byte-identical to origin/main apart from READ_SCOPES additions, so no named command or raw access is approved for it until its own guard review lands.",
+        "",
+        "| Inventory operation | Disposition | Owning slice | Deferral reason |",
+        "|---|---|---|---|",
+        ...deferredReportsRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`), "",
         "## EXT-04 tenant-lookup scope decisions",
         "",
         "Firstmate scope: approve the mg-ext-04e function-argument contract with the three v1.0 reads it unblocks (tenant-information show by domain name or tenant ID, subscription show by commerce subscription ID).",
@@ -538,9 +578,9 @@ export function capabilityDocument() {
         "",
         "## EXT-02 lifecycle-workflows scope decisions",
         "",
-        "This change covers the twenty-four v1.0 lifecycle-workflows first-, second- and third-part reads above (workflow, workflow-template and task-definition list/show/count reads, the tenant settings show, top-level run and user/subject processing-result list/show/count reads, plus task-report list/show/count reads with the task and taskDefinition singles).",
-        "Run-nested and third-level processing results, taskProcessingResults sub-reads, reprocessed runs, subject sub-reads, workflow tasks, template tasks, versions, insights, deleted items and custom task extensions stay scheduled for follow-up parts with no new commands or raw access approved; so do the six top-level summary functions, which stay deferred because they need bracketed start/end arguments outside the session-guard function-binding allowlist while the request-path guard cannot change beyond READ_SCOPES additions. Every beta operation and every mutation (no workflow create/update/delete/activate/run, no settings update, no restore) stays out.",
-        "No new commands or raw access are approved for any lifecycle-workflows row outside the twenty-four above.",
+        "This change covers the thirty-three v1.0 lifecycle-workflows first-, second-, third- and fourth-part reads above (workflow, workflow-template and task-definition list/show/count reads, the tenant settings show, top-level run and user/subject processing-result list/show/count reads, task-report list/show/count reads with the task and taskDefinition singles, plus run-nested user/subject/task processing-result list/show/count reads).",
+        "Third-level processing results, taskProcessingResults sub-reads under a user or subject result, reprocessed runs, subject sub-reads, workflow tasks, template tasks, versions, insights, deleted items and custom task extensions stay scheduled for follow-up parts with no new commands or raw access approved; so do the six summary functions (the run user/subject summaries plus the four top-level ones), which stay deferred because they need bracketed start/end arguments outside the session-guard function-binding allowlist while the request-path guard cannot change beyond READ_SCOPES additions. Every beta operation and every mutation (no workflow create/update/delete/activate/run, no settings update, no restore) stays out.",
+        "No new commands or raw access are approved for any lifecycle-workflows row outside the thirty-three above.",
         "",
         "## Named writes",
         "",

package/dist/doctor.js

@@ -44,8 +44,8 @@ export async function runDoctor(args) {
             // surfaced row, remainder buffered in a discarded cursor. Doctor keeps
             // no cursor and accepts none; recovery reruns doctor, not the read.
             const result = (await listUsers(args.session, { limit: "1" }, selected.profile, operation, `npx -y @knowttl/mg-axi ${DOCTOR_CHECK} --help`, name));
-            if (!result.count.complete && result.count.reason !== "row limit reached; buffered remainder is preserved in the cursor") {
-                throw new AxiError(`Doctor read incomplete: ${result.count.reason}`, "GRAPH_ERROR", [rerun]);
+            if (!result.complete && result.reason !== "row limit reached; buffered remainder is preserved in the cursor") {
+                throw new AxiError(`Doctor read incomplete: ${result.reason}`, "GRAPH_ERROR", [rerun]);
             }
             profiles.push({ name, mode: selected.profile.mode, check: DOCTOR_CHECK, status: "ok",
                 detail: result.users.length ? "1 user row returned" : "0 users matched; the absence of results is the answer" });

package/dist/entra-access-reviews.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // EXT-02 access-reviews subfamily: the read-only access-review mapping.
 // See README.md for the supported commands and usage. Operation construction
 // stays beside its command; the shared session owns URLs, credentials, paging,
@@ -236,6 +237,7 @@ const ACCESS_REVIEW_DENIAL_HINTS = [
 const DEFINITION_LIST = {
     command: "entra access-review definition list",
     key: "definitions",
+    noun: "access-review definitions",
     known: DEFINITION_KNOWN,
     knownList: KNOWN_DEFINITION_FIELDS,
     defaultSelect: DEFAULT_DEFINITION_LIST_SELECT,
@@ -249,6 +251,7 @@ const DEFINITION_LIST = {
 const INSTANCE_LIST = {
     command: "entra access-review instance list",
     key: "instances",
+    noun: "access-review instances",
     known: INSTANCE_KNOWN,
     knownList: KNOWN_INSTANCE_FIELDS,
     defaultSelect: DEFAULT_INSTANCE_LIST_SELECT,
@@ -261,6 +264,7 @@ const INSTANCE_LIST = {
 const DECISION_LIST = {
     command: "entra access-review decision list",
     key: "decisions",
+    noun: "access-review decisions",
     known: DECISION_KNOWN,
     knownList: KNOWN_DECISION_FIELDS,
     defaultSelect: DEFAULT_DECISION_SELECT,
@@ -273,6 +277,7 @@ const DECISION_LIST = {
 const CONTACTED_REVIEWER_LIST = {
     command: "entra access-review contacted-reviewer list",
     key: "contactedReviewers",
+    noun: "contacted reviewers",
     known: CONTACTED_REVIEWER_KNOWN,
     knownList: KNOWN_CONTACTED_REVIEWER_FIELDS,
     defaultSelect: DEFAULT_CONTACTED_REVIEWER_LIST_SELECT,
@@ -286,6 +291,7 @@ const CONTACTED_REVIEWER_LIST = {
 const STAGE_LIST = {
     command: "entra access-review stage list",
     key: "stages",
+    noun: "access-review stages",
     known: STAGE_KNOWN,
     knownList: KNOWN_STAGE_FIELDS,
     defaultSelect: DEFAULT_STAGE_LIST_SELECT,
@@ -347,16 +353,17 @@ async function listCollection(shape, session, flags, profile, operation, help, p
     if (!result.complete) {
         return {
             [shape.key]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, shape.noun, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resumeHint, ...standing],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
-        return { [shape.key]: rows, count, help: [shape.emptyNote, ...standing] };
+        return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.noun, true), complete: true, help: [shape.emptyNote, ...standing] };
     }
-    return { [shape.key]: rows, count, help: [...truncationHints, ...standing] };
+    return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.noun, true), complete: true, help: [...truncationHints, ...standing] };
 }
 async function showOne(key, command, known, knownList, defaultSelect, session, flags, profile, operation, help, profileName, params, malformed) {
     const { select, fields } = selectedFields(flags, defaultSelect, known, knownList, help);

package/dist/entra-apps.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 import { SAFE_CREDENTIAL_FIELDS } from "./graph-session.js";
 // READ-07: the Entra application and service-principal read mapping behind
 // `mg-axi entra application list/show`, `mg-axi entra service-principal
@@ -270,23 +271,25 @@ async function listCollection(session, flags, profile, operation, help, profileN
     if (!result.complete) {
         return {
             [key]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, emptyNoun, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resumeHint(profileName), showHint],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
         return {
             [key]: rows,
-            count,
+            ...listTotals(rows.length, result.total, emptyNoun, true),
+            complete: true,
             help: [
                 `0 ${emptyNoun} matched; the absence of results is the answer, not an error`,
                 showHint,
             ],
         };
     }
-    return { [key]: rows, count, help: [...truncationHints, showHint] };
+    return { [key]: rows, ...listTotals(rows.length, result.total, emptyNoun, true), complete: true, help: [...truncationHints, showHint] };
 }
 async function showSingle(session, flags, profile, operation, help, profileName, command, key, known, knownList, defaults, param, flag) {
     checkReadOperation(operation, help);
@@ -351,20 +354,22 @@ async function listOwners(session, flags, profile, operation, help, profileName,
     if (!result.complete) {
         return {
             owners: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, "owners", false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, ...limitedHints, resumeHint(profileName)],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
         return {
             owners: rows,
-            count,
+            ...listTotals(rows.length, result.total, "owners", true),
+            complete: true,
             help: [...limitedHints, "0 owners matched; the absence of results is the answer, not an error"],
         };
     }
-    return { owners: rows, count, help: [...truncationHints, ...limitedHints] };
+    return { owners: rows, ...listTotals(rows.length, result.total, "owners", true), complete: true, help: [...truncationHints, ...limitedHints] };
 }
 export async function listApplicationOwners(session, flags, profile, operation, help, profileName) {
     return listOwners(session, flags, profile, operation, help, profileName, "entra application owner list", "application-id", "application");

package/dist/entra-audit-logs.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // READ-05: the Entra sign-in and directory-audit read mapping behind
 // `mg-axi entra sign-in list/show` and `mg-axi entra directory-audit
 // list/show`. Operation construction stays beside its command; the shared
@@ -228,6 +229,7 @@ const AUDIT_DENIAL_HINTS = [
 ];
 const SIGNIN_LIST = {
     noun: "sign-in",
+    plural: "sign-ins",
     key: "signIns",
     dateField: "createdDateTime",
     known: SIGNIN_KNOWN,
@@ -243,6 +245,7 @@ const SIGNIN_LIST = {
 };
 const AUDIT_LIST = {
     noun: "directory-audit",
+    plural: "directory audits",
     key: "directoryAudits",
     dateField: "activityDateTime",
     known: AUDIT_KNOWN,
@@ -313,16 +316,17 @@ async function listLogs(shape, session, flags, profile, operation, help, profile
     if (!result.complete) {
         return {
             [shape.key]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, shape.plural, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, `Resume losslessly with the same flags plus --cursor - ${profileHint(profileName)} and supply the returned cursor on stdin`, showHint],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
-        return { [shape.key]: rows, count, help: shape.emptyHints(profileName) };
+        return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.plural, true), complete: true, help: shape.emptyHints(profileName) };
     }
-    return { [shape.key]: rows, count, help: [...truncationHints, showHint] };
+    return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.plural, true), complete: true, help: [...truncationHints, showHint] };
 }
 const SIGNIN_SHOW = {
     noun: "sign-in",

package/dist/entra-auth-methods.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // READ-04: the Entra authentication-method and registration-report read
 // mapping behind `mg-axi entra user authentication-method list` and
 // `mg-axi entra registration list`. Operation construction stays beside its
@@ -203,6 +204,7 @@ const REPORT_DENIAL_HINTS = [
 const METHOD_LIST = {
     command: "entra user authentication-method list",
     key: "authenticationMethods",
+    noun: "authentication methods",
     known: KNOWN_METHODS,
     knownList: KNOWN_METHOD_FIELDS,
     defaultSelect: DEFAULT_METHOD_SELECT,
@@ -218,6 +220,7 @@ const METHOD_LIST = {
 const REPORT_LIST = {
     command: "entra registration list",
     key: "registrationDetails",
+    noun: "registration rows",
     known: KNOWN_REPORT,
     knownList: KNOWN_REPORT_FIELDS,
     defaultSelect: DEFAULT_REPORT_SELECT,
@@ -274,16 +277,17 @@ async function listCollection(shape, session, flags, profile, operation, help, p
     if (!result.complete) {
         return {
             [shape.key]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, shape.noun, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, `Resume losslessly with the same flags plus --cursor <cursor-from-output> ${profileHint(profileName)}`, ...standing],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
-        return { [shape.key]: rows, count, help: [shape.emptyNote, ...standing] };
+        return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.noun, true), complete: true, help: [shape.emptyNote, ...standing] };
     }
-    return { [shape.key]: rows, count, help: [...truncationHints, ...standing] };
+    return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.noun, true), complete: true, help: [...truncationHints, ...standing] };
 }
 export async function listAuthenticationMethods(session, flags, profile, operation, help, profileName) {
     const user = String(flags.user);