@knowttl/mg-axi 0.1.1 → 0.1.3

package/dist/catalogue.js

@@ -91,6 +91,14 @@ const appRoleGrantRead = {
     cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
     scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All; reads never request write-consent scopes" },
 };
+const federatedRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from id, name, issuer, subject, description, audiences; rows carry metadata only, never secret material" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All" },
+};
 const roleRead = {
     filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
     select: { value: "comma-separated-properties", description: "Request server properties from the reviewed role property set" },
@@ -99,6 +107,22 @@ const roleRead = {
     cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
     scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to the operation's least-privileged read scope" },
 };
+const groupAssignmentRead = {
+    filter: { value: "odata-filter", description: "Required OData $filter with an eq clause on groupId or principalId scoping the list; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed group PIM assignment set" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to PrivilegedAssignmentSchedule.Read.AzureADGroup; delegated callers also need owner/member of the group or a supported directory role; PIM for Groups needs P2 or ID Governance" },
+};
+const groupEligibilityRead = {
+    filter: groupAssignmentRead.filter,
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed group PIM eligibility set; request justification text rides only behind an explicit --select" },
+    fields: groupAssignmentRead.fields,
+    full: groupAssignmentRead.full,
+    cursor: groupAssignmentRead.cursor,
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to PrivilegedEligibilitySchedule.Read.AzureADGroup; delegated callers also need owner/member of the group or a supported directory role; PIM for Groups needs P2 or ID Governance" },
+};
 const deviceRead = {
     filter: { value: "odata-filter", description: "OData $filter passed to Graph with ConsistencyLevel eventual; unsupported combinations fail before credentials" },
     select: { value: "comma-separated-properties", description: "Request server properties; directory-device reads need Device.Read.All" },
@@ -311,6 +335,22 @@ const caRead = {
     cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
     scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Policy.Read.All" },
 };
+const caStrengthRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; authentication-strength detail needs Policy.Read.AuthenticationMethod in both modes plus a supported Conditional Access role for delegated access" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Policy.Read.AuthenticationMethod" },
+};
+const caAuthContextRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; authentication-context detail needs AuthenticationContext.Read.All in both modes plus a supported Conditional Access role for delegated access" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AuthenticationContext.Read.All" },
+};
 const providerRead = {
     filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
     select: { value: "comma-separated-properties", description: "Request server properties from the reviewed identity-provider set; secret-bearing fields (clientSecret, certificateData) are never selectable" },
@@ -341,6 +381,29 @@ const dataPolicyRead = {
     cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
     scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to User.Export.All, User.Read.All" },
 };
+const riskPreventionFraudRead = {
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed fraud-protection-provider set; API keys, client secrets and other key material are never selectable; reads need delegated RiskPreventionProviders.Read.All plus a supported Entra role and refuse application profiles" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RiskPreventionProviders.Read.All" },
+};
+const riskPreventionWafRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel contract; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed WAF-provider set; API keys, client secrets and other key material are never selectable; reads need delegated RiskPreventionProviders.Read.All plus a supported Entra role and refuse application profiles" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RiskPreventionProviders.Read.All" },
+};
+const riskPreventionVerificationRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel contract; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from the reviewed WAF-verification set; reads need delegated RiskPreventionProviders.Read.All plus a supported Entra role and refuse application profiles" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RiskPreventionProviders.Read.All" },
+};
 const accessReviewRead = {
     filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; on definitions only contains() over the scope query and eq on status are documented; unsupported combinations fail before credentials" },
     filterReviewer: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter with no $count or ConsistencyLevel; unsupported combinations fail before credentials" },
@@ -415,6 +478,25 @@ const lifecycleTaskReportSubRead = {
     full: lifecycleWorkflowRead.full,
     scopes: lifecycleReportsRead.scopes,
 };
+const lifecycleRunReportsRead = {
+    workflow: { value: "workflow-id", required: true, description: "Parent lifecycle workflow ID owning the run" },
+    run: { value: "run-id", required: true, description: "Parent lifecycle workflow run ID owning the processing result" },
+    filter: lifecycleWorkflowRead.filter,
+    select: lifecycleReportsRead.select,
+    fields: lifecycleWorkflowRead.fields,
+    full: lifecycleWorkflowRead.full,
+    cursor: lifecycleWorkflowRead.cursor,
+    scopes: lifecycleReportsRead.scopes,
+};
+const lifecycleRunSubjectRead = {
+    workflow: { value: "workflow-id", required: true, description: "Parent lifecycle workflow ID owning the run" },
+    run: { value: "run-id", required: true, description: "Parent lifecycle workflow run ID owning the subject processing result" },
+    filter: lifecycleWorkflowRead.filter,
+    fields: lifecycleSubjectRead.fields,
+    full: lifecycleWorkflowRead.full,
+    cursor: lifecycleWorkflowRead.cursor,
+    scopes: lifecycleSubjectRead.scopes,
+};
 export const LEAVES = [
     { path: "home", description: "Show local profile status without authenticating", flags: { profile: common.profile }, examples: ["mg-axi", "mg-axi home --profile soc"] },
     { path: "profile create", description: "Create a dedicated-app profile without signing in", flags: {
@@ -437,6 +519,7 @@ export const LEAVES = [
             scopes: { value: "comma-separated-Graph-scopes", required: true, description: "Explicit delegated permissions using full https://graph.microsoft.com/ scope names" },
         }, examples: ["mg-axi login --profile soc --scopes https://graph.microsoft.com/User.Read", "mg-axi login --profile soc --method device-code --scopes https://graph.microsoft.com/User.Read"] },
     { path: "setup", description: "Show installation, configuration and capability guidance without signing in or writing anything", flags: {}, examples: ["mg-axi setup", "mg-axi setup --help"] },
+    { path: "setup hooks", description: "Install or repair agent SessionStart hooks for mg-axi ambient context", flags: {}, examples: ["mg-axi setup hooks", "mg-axi setup hooks --help"] },
     { path: "doctor", description: "Check each selected profile with one bounded user-list read; never signs in interactively, installs nothing, enables no writes", flags: {
             profile: common.profile,
         }, examples: ["mg-axi doctor", "mg-axi doctor --profile soc", "mg-axi doctor --help"] },
@@ -560,6 +643,72 @@ export const LEAVES = [
             full: roleRead.full,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
         }, examples: ["mg-axi entra directory-role show --id <role-id> --profile soc", "mg-axi entra directory-role show --id <role-id> --profile soc --full"] },
+    { path: "entra directory-role-template list", description: "List directory-role templates (id, displayName, description); templates exist whether or not the role is activated", operation: "GET:/directoryRoleTemplates", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
+        }, examples: ["mg-axi entra directory-role-template list --profile soc", "mg-axi entra directory-role-template list --profile soc --filter \"displayName eq 'Helpdesk Administrator'\""] },
+    { path: "entra directory-role-template show", description: "Show one directory-role template with richer default properties", operation: "GET:/directoryRoleTemplates/{directoryRoleTemplate-id}", flags: {
+            ...common, id: { value: "template-id", required: true, description: "Directory-role template object ID" },
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
+        }, examples: ["mg-axi entra directory-role-template show --id <template-id> --profile soc", "mg-axi entra directory-role-template show --id <template-id> --profile soc --full"] },
+    { path: "entra directory-role member list", description: "List the members of one activated directory role (id, displayName); @odata.type names each member kind", operation: "GET:/directoryRoles/{directoryRole-id}/members", flags: {
+            ...common, role: { value: "role-id", required: true, description: "Activated directory-role object ID whose members are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
+        }, examples: ["mg-axi entra directory-role member list --role <role-id> --profile soc", "mg-axi entra directory-role member list --role <role-id> --profile soc --filter \"displayName eq 'Adele Vance'\""] },
+    { path: "entra directory-role scoped-member list", description: "List the scoped members of one activated directory role (id, principalId, roleId, directoryScopeId); administrative-unit scopes need P1", operation: "GET:/directoryRoles/{directoryRole-id}/scopedMembers", flags: {
+            ...common, role: { value: "role-id", required: true, description: "Activated directory-role object ID whose scoped members are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
+        }, examples: ["mg-axi entra directory-role scoped-member list --role <role-id> --profile soc", "mg-axi entra directory-role scoped-member list --role <role-id> --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra directory-role scoped-member show", description: "Show one scoped member of an activated directory role with richer default properties", operation: "GET:/directoryRoles/{directoryRole-id}/scopedMembers/{scopedRoleMembership-id}", flags: {
+            ...common, role: { value: "role-id", required: true, description: "Activated directory-role object ID owning the scoped member" },
+            id: { value: "scoped-membership-id", required: true, description: "Scoped membership object ID" },
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
+        }, examples: ["mg-axi entra directory-role scoped-member show --role <role-id> --id <scoped-membership-id> --profile soc", "mg-axi entra directory-role scoped-member show --role <role-id> --id <scoped-membership-id> --profile soc --full"] },
+    { path: "entra scoped-role-membership list", description: "List administrative-unit-scoped role memberships (id, principalId, roleId, directoryScopeId); directory-wide assignments live on roleAssignments", operation: "GET:/scopedRoleMemberships", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
+        }, examples: ["mg-axi entra scoped-role-membership list --profile soc", "mg-axi entra scoped-role-membership list --profile soc --filter \"roleId eq '<role-id>'\""] },
+    { path: "entra scoped-role-membership show", description: "Show one administrative-unit-scoped role membership with richer default properties", operation: "GET:/scopedRoleMemberships/{scopedRoleMembership-id}", flags: {
+            ...common, id: { value: "scoped-membership-id", required: true, description: "Scoped membership object ID" },
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
+        }, examples: ["mg-axi entra scoped-role-membership show --id <scoped-membership-id> --profile soc", "mg-axi entra scoped-role-membership show --id <scoped-membership-id> --profile soc --full"] },
     { path: "entra role-assignment list", description: "List current role assignments (id, principalId, roleDefinitionId, directoryScopeId), including direct and PIM-activated assignments; use pim active list for assignmentType Assigned versus Activated", operation: "GET:/roleManagement/directory/roleAssignments", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -593,6 +742,96 @@ export const LEAVES = [
             cursor: roleRead.cursor,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleAssignmentSchedule.Read.Directory; delegated callers also need a supported PIM read role; PIM needs P2 or ID Governance" },
         }, examples: ["mg-axi entra pim active list --profile soc", "mg-axi entra pim active list --profile soc --filter \"assignmentType eq 'Activated'\""] },
+    { path: "entra pim group-assignment-schedule list", description: "List PIM-for-Groups assignment schedules scoped to one group or principal (id, principalId, groupId, accessId, assignmentType); --filter on groupId or principalId is required", operation: "GET:/identityGovernance/privilegedAccess/group/assignmentSchedules", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: { ...groupAssignmentRead.filter, required: true },
+            select: groupAssignmentRead.select,
+            fields: groupAssignmentRead.fields,
+            full: groupAssignmentRead.full,
+            cursor: groupAssignmentRead.cursor,
+            scopes: groupAssignmentRead.scopes,
+        }, examples: ["mg-axi entra pim group-assignment-schedule list --profile soc --filter \"groupId eq '<group-id>'\"", "mg-axi entra pim group-assignment-schedule list --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra pim group-assignment-schedule show", description: "Show one PIM-for-Groups assignment schedule with the full reviewed property set", operation: "GET:/identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id}", flags: {
+            ...common, id: { value: "assignment-schedule-id", required: true, description: "Assignment schedule ID" },
+            select: groupAssignmentRead.select,
+            fields: groupAssignmentRead.fields,
+            full: groupAssignmentRead.full,
+            scopes: groupAssignmentRead.scopes,
+        }, examples: ["mg-axi entra pim group-assignment-schedule show --id <assignment-schedule-id> --profile soc", "mg-axi entra pim group-assignment-schedule show --id <assignment-schedule-id> --profile soc --full"] },
+    { path: "entra pim group-assignment-instance list", description: "List provisioned PIM-for-Groups assignment windows scoped to one group or principal (id, principalId, groupId, accessId, assignmentType); --filter on groupId or principalId is required", operation: "GET:/identityGovernance/privilegedAccess/group/assignmentScheduleInstances", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: { ...groupAssignmentRead.filter, required: true },
+            select: groupAssignmentRead.select,
+            fields: groupAssignmentRead.fields,
+            full: groupAssignmentRead.full,
+            cursor: groupAssignmentRead.cursor,
+            scopes: groupAssignmentRead.scopes,
+        }, examples: ["mg-axi entra pim group-assignment-instance list --profile soc --filter \"groupId eq '<group-id>'\"", "mg-axi entra pim group-assignment-instance list --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra pim group-assignment-instance show", description: "Show one provisioned PIM-for-Groups assignment window with the full reviewed property set", operation: "GET:/identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id}", flags: {
+            ...common, id: { value: "assignment-instance-id", required: true, description: "Assignment schedule instance ID" },
+            select: groupAssignmentRead.select,
+            fields: groupAssignmentRead.fields,
+            full: groupAssignmentRead.full,
+            scopes: groupAssignmentRead.scopes,
+        }, examples: ["mg-axi entra pim group-assignment-instance show --id <assignment-instance-id> --profile soc", "mg-axi entra pim group-assignment-instance show --id <assignment-instance-id> --profile soc --full"] },
+    { path: "entra pim group-eligibility-schedule list", description: "List PIM-for-Groups eligibility schedules scoped to one group or principal (id, principalId, groupId, accessId, memberType); --filter on groupId or principalId is required", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilitySchedules", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: { ...groupEligibilityRead.filter, required: true },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            cursor: groupEligibilityRead.cursor,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-schedule list --profile soc --filter \"groupId eq '<group-id>'\"", "mg-axi entra pim group-eligibility-schedule list --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra pim group-eligibility-schedule show", description: "Show one PIM-for-Groups eligibility schedule with the full reviewed property set", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id}", flags: {
+            ...common, id: { value: "eligibility-schedule-id", required: true, description: "Eligibility schedule ID" },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-schedule show --id <eligibility-schedule-id> --profile soc", "mg-axi entra pim group-eligibility-schedule show --id <eligibility-schedule-id> --profile soc --full"] },
+    { path: "entra pim group-eligibility-instance list", description: "List provisioned PIM-for-Groups eligibility windows scoped to one group or principal (id, principalId, groupId, accessId, memberType); --filter on groupId or principalId is required", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: { ...groupEligibilityRead.filter, required: true },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            cursor: groupEligibilityRead.cursor,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-instance list --profile soc --filter \"groupId eq '<group-id>'\"", "mg-axi entra pim group-eligibility-instance list --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra pim group-eligibility-instance show", description: "Show one provisioned PIM-for-Groups eligibility window with the full reviewed property set", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id}", flags: {
+            ...common, id: { value: "eligibility-instance-id", required: true, description: "Eligibility schedule instance ID" },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-instance show --id <eligibility-instance-id> --profile soc", "mg-axi entra pim group-eligibility-instance show --id <eligibility-instance-id> --profile soc --full"] },
+    { path: "entra pim group-eligibility-request list", description: "List PIM-for-Groups eligibility requests scoped to one group or principal (id, action, status, principalId, groupId, accessId); justification text rides only behind an explicit --select; --filter on groupId or principalId is required", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleRequests", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: { ...groupEligibilityRead.filter, required: true },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            cursor: groupEligibilityRead.cursor,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-request list --profile soc --filter \"groupId eq '<group-id>'\"", "mg-axi entra pim group-eligibility-request list --profile soc --filter \"groupId eq '<group-id>'\" --select id,action,status,justification"] },
+    { path: "entra pim group-eligibility-request show", description: "Show one PIM-for-Groups eligibility request with the reviewed ask-plus-outcome set; justification text rides only behind an explicit --select", operation: "GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id}", flags: {
+            ...common, id: { value: "eligibility-request-id", required: true, description: "Eligibility schedule request ID" },
+            select: groupEligibilityRead.select,
+            fields: groupEligibilityRead.fields,
+            full: groupEligibilityRead.full,
+            scopes: groupEligibilityRead.scopes,
+        }, examples: ["mg-axi entra pim group-eligibility-request show --id <eligibility-request-id> --profile soc", "mg-axi entra pim group-eligibility-request show --id <eligibility-request-id> --profile soc --select id,action,status,justification --full"] },
     { path: "entra device list", description: "List directory devices with compact properties (id, displayName, operatingSystem, accountEnabled). Directory-device scope only; Intune managed devices are a separately authorized surface", operation: "GET:/devices", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -1248,6 +1487,30 @@ export const LEAVES = [
             full: delegatedAdminQuerylessRead.full,
             scopes: delegatedAdminQuerylessRead.scopes,
         }, examples: ["mg-axi entra delegated-admin-customer show-service-management-detail --id <customer-id> --detail-id <detail-id> --profile soc"] },
+    { path: "entra delegated-admin-customer count", description: "Count delegated-admin customers of the partner tenant as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminCustomers/$count", flags: {
+            ...common,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-customer count --profile soc"] },
+    { path: "entra delegated-admin-customer count-service-management-details", description: "Count one customer's service-management details as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminCustomers/{delegatedAdminCustomer-id}/serviceManagementDetails/$count", flags: {
+            ...common, id: { value: "customer-id", required: true, description: "Delegated-admin customer identifier" },
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-customer count-service-management-details --id <customer-id> --profile soc"] },
+    { path: "entra delegated-admin-relationship count", description: "Count partner-tenant delegated-admin relationships as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminRelationships/$count", flags: {
+            ...common,
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship count --profile soc"] },
+    { path: "entra delegated-admin-relationship count-access-assignments", description: "Count one relationship's delegated-admin access assignments as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/accessAssignments/$count", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship count-access-assignments --id <relationship-id> --profile soc"] },
+    { path: "entra delegated-admin-relationship count-operations", description: "Count one relationship's long-running delegated-admin operations as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/operations/$count", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship count-operations --id <relationship-id> --profile soc"] },
+    { path: "entra delegated-admin-relationship count-requests", description: "Count one relationship's delegated-admin requests as one scalar; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/tenantRelationships/delegatedAdminRelationships/{delegatedAdminRelationship-id}/requests/$count", flags: {
+            ...common, id: { value: "relationship-id", required: true, description: "Delegated-admin relationship identifier" },
+            scopes: delegatedAdminRead.scopes,
+        }, examples: ["mg-axi entra delegated-admin-relationship count-requests --id <relationship-id> --profile soc"] },
     { path: "entra multi-tenant-organization show", description: "Show the tenant multitenant organization with the full reviewed property set (createdDateTime, description, displayName, id, state); at most one exists per tenant and state inactive means no membership", operation: "GET:/tenantRelationships/multiTenantOrganization", flags: {
             ...common,
             select: multiTenantOrganizationRead.select,
@@ -1324,6 +1587,26 @@ export const LEAVES = [
             full: logRead.full,
             scopes: logRead.scopes,
         }, examples: ["mg-axi entra directory-audit show --id <directory-audit-id> --profile soc", "mg-axi entra directory-audit show --id <directory-audit-id> --profile soc --full"] },
+    { path: "entra provisioning list", description: "List provisioning-log events in a bounded time window (AuditLog.Read.All and Directory.Read.All; delegated callers also need Global Reader, Reports Reader, Security Administrator, Security Operator or Security Reader; Entra ID P1/P2 licence prerequisite)", operation: "GET:/auditLogs/provisioning", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            since: { ...logRead.since, description: "Required for a new query (resume with --cursor instead): earliest activityDateTime bounding the server time range" },
+            until: logRead.until,
+            filter: logRead.filter,
+            select: { value: "comma-separated-properties", description: "Request server properties from the supported provisioning-log property set" },
+            fields: logRead.fields,
+            full: logRead.full,
+            cursor: logRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AuditLog.Read.All,Directory.Read.All" },
+        }, examples: ["mg-axi entra provisioning list --profile soc --since 2026-09-01T00:00:00Z", "mg-axi entra provisioning list --profile soc --since 2026-09-01T00:00:00Z --filter \"provisioningStatusInfo/status eq 'failure'\" --limit 10", "mg-axi entra provisioning list --profile soc --since 2026-09-01T00:00:00Z --until 2026-09-08T00:00:00Z --all"] },
+    { path: "entra provisioning show", description: "Show one provisioning-log event with the full reviewed property set", operation: "GET:/auditLogs/provisioning/{provisioningObjectSummary-id}", flags: {
+            ...common, id: { value: "provisioning-id", required: true, description: "Provisioning-log event object ID" },
+            select: { value: "comma-separated-properties", description: "Request server properties from the supported provisioning-log property set" },
+            fields: logRead.fields,
+            full: logRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AuditLog.Read.All,Directory.Read.All" },
+        }, examples: ["mg-axi entra provisioning show --id <provisioning-id> --profile soc", "mg-axi entra provisioning show --id <provisioning-id> --profile soc --full"] },
     { path: "entra application list", description: "List applications with compact properties (id, appId, displayName); appId is the client ID, distinct from the object id", operation: "GET:/applications", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -1404,6 +1687,71 @@ export const LEAVES = [
             cursor: appRoleGrantRead.cursor,
             scopes: appRoleGrantRead.scopes,
         }, examples: ["mg-axi entra service-principal app-role-assignment list --service-principal <service-principal-object-id> --profile soc"] },
+    { path: "entra service-principal app-role-assignment show", description: "Show one app-only role assignment granted to a client service principal", operation: "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignments/{appRoleAssignment-id}", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Client service-principal object ID holding the assignment" },
+            id: { value: "assignment-object-id", required: true, description: "App role assignment object ID" },
+            select: appRoleGrantRead.select,
+            fields: appRoleGrantRead.fields,
+            full: appRoleGrantRead.full,
+            scopes: appRoleGrantRead.scopes,
+        }, examples: ["mg-axi entra service-principal app-role-assignment show --service-principal <service-principal-object-id> --id <assignment-object-id> --profile soc"] },
+    { path: "entra service-principal app-role-assigned-to list", description: "List principals assigned to one resource service principal; rows are granted assignments, distinct from the application's requested permissions", operation: "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Resource service-principal object ID whose assignees are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: appRoleGrantRead.filter,
+            select: appRoleGrantRead.select,
+            fields: appRoleGrantRead.fields,
+            full: appRoleGrantRead.full,
+            cursor: appRoleGrantRead.cursor,
+            scopes: appRoleGrantRead.scopes,
+        }, examples: ["mg-axi entra service-principal app-role-assigned-to list --service-principal <service-principal-object-id> --profile soc"] },
+    { path: "entra service-principal app-role-assigned-to show", description: "Show one principal assignment on a resource service principal", operation: "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo/{appRoleAssignment-id}", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Resource service-principal object ID holding the assignment" },
+            id: { value: "assignment-object-id", required: true, description: "App role assignment object ID" },
+            select: appRoleGrantRead.select,
+            fields: appRoleGrantRead.fields,
+            full: appRoleGrantRead.full,
+            scopes: appRoleGrantRead.scopes,
+        }, examples: ["mg-axi entra service-principal app-role-assigned-to show --service-principal <service-principal-object-id> --id <assignment-object-id> --profile soc"] },
+    { path: "entra application federated-credential list", description: "List federated identity credentials of one application; rows carry issuer, subject and audience metadata only, never secret material", operation: "GET:/applications/{application-id}/federatedIdentityCredentials", flags: {
+            ...common, application: { value: "application-object-id", required: true, description: "Application object ID whose federated credentials are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: federatedRead.filter,
+            select: federatedRead.select,
+            fields: federatedRead.fields,
+            full: federatedRead.full,
+            cursor: federatedRead.cursor,
+            scopes: federatedRead.scopes,
+        }, examples: ["mg-axi entra application federated-credential list --application <application-object-id> --profile soc"] },
+    { path: "entra application federated-credential show", description: "Show one federated identity credential of an application; metadata only, never secret material", operation: "GET:/applications/{application-id}/federatedIdentityCredentials/{federatedIdentityCredential-id}", flags: {
+            ...common, application: { value: "application-object-id", required: true, description: "Application object ID holding the credential" },
+            id: { value: "credential-object-id", required: true, description: "Federated identity credential object ID" },
+            select: federatedRead.select,
+            fields: federatedRead.fields,
+            full: federatedRead.full,
+            scopes: federatedRead.scopes,
+        }, examples: ["mg-axi entra application federated-credential show --application <application-object-id> --id <credential-object-id> --profile soc"] },
+    { path: "entra service-principal federated-credential list", description: "List federated identity credentials of one service principal; rows carry issuer, subject and audience metadata only, never secret material", operation: "GET:/servicePrincipals/{servicePrincipal-id}/federatedIdentityCredentials", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Service-principal object ID whose federated credentials are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: federatedRead.filter,
+            select: federatedRead.select,
+            fields: federatedRead.fields,
+            full: federatedRead.full,
+            cursor: federatedRead.cursor,
+            scopes: federatedRead.scopes,
+        }, examples: ["mg-axi entra service-principal federated-credential list --service-principal <service-principal-object-id> --profile soc"] },
+    { path: "entra service-principal federated-credential show", description: "Show one federated identity credential of a service principal; metadata only, never secret material", operation: "GET:/servicePrincipals/{servicePrincipal-id}/federatedIdentityCredentials/{federatedIdentityCredential-id}", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Service-principal object ID holding the credential" },
+            id: { value: "credential-object-id", required: true, description: "Federated identity credential object ID" },
+            select: federatedRead.select,
+            fields: federatedRead.fields,
+            full: federatedRead.full,
+            scopes: federatedRead.scopes,
+        }, examples: ["mg-axi entra service-principal federated-credential show --service-principal <service-principal-object-id> --id <credential-object-id> --profile soc"] },
     { path: "entra risky-user list", description: "List at-risk users with compact risk state (IdentityRiskyUser.Read.All; delegated callers also need Global Reader, Security Operator, Security Reader or Security Administrator; the riskyUsers API requires P2)", operation: "GET:/identityProtection/riskyUsers", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -1448,6 +1796,65 @@ export const LEAVES = [
             full: riskRead.full,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskEvent.Read.All" },
         }, examples: ["mg-axi entra risk-detection show --id <risk-detection-id> --profile soc", "mg-axi entra risk-detection show --id <risk-detection-id> --profile soc --full"] },
+    { path: "entra risky-service-principal list", description: "List at-risk service principals with compact risk state (IdentityRiskyServicePrincipal.Read.All; delegated callers also need Global Reader, Security Operator, Security Reader or Security Administrator; the riskyServicePrincipals API requires a Microsoft Entra Workload Identities Premium licence)", operation: "GET:/identityProtection/riskyServicePrincipals", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: riskRead.filter,
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            cursor: riskRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskyServicePrincipal.Read.All" },
+        }, examples: ["mg-axi entra risky-service-principal list --profile soc", "mg-axi entra risky-service-principal list --profile soc --filter \"riskState eq 'atRisk'\" --limit 10", "mg-axi entra risky-service-principal list --profile soc --all"] },
+    { path: "entra risky-service-principal show", description: "Show one at-risk service principal with the full reviewed property set and detection/history correlation guidance; this read never confirms compromise, dismisses or remediates risk", operation: "GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}", flags: {
+            ...common, id: { value: "risky-service-principal-id", required: true, description: "Risky service principal object ID" },
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskyServicePrincipal.Read.All" },
+        }, examples: ["mg-axi entra risky-service-principal show --id <risky-service-principal-id> --profile soc", "mg-axi entra risky-service-principal show --id <risky-service-principal-id> --profile soc --full"] },
+    { path: "entra risky-service-principal history list", description: "List one service principal's risk history with compact risk state (IdentityRiskyServicePrincipal.Read.All; same roles and Workload Identities Premium licence as the parent risky-service-principal read)", operation: "GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}/history", flags: {
+            ...common,
+            "service-principal": { value: "risky-service-principal-id", required: true, description: "Risky-service-principal object ID owning this history" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: riskRead.filter,
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            cursor: riskRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskyServicePrincipal.Read.All" },
+        }, examples: ["mg-axi entra risky-service-principal history list --service-principal <risky-service-principal-id> --profile soc"] },
+    { path: "entra risky-service-principal history show", description: "Show one service-principal risk-history item with the full reviewed property set and detection correlation guidance", operation: "GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}/history/{riskyServicePrincipalHistoryItem-id}", flags: {
+            ...common,
+            "service-principal": { value: "risky-service-principal-id", required: true, description: "Risky-service-principal object ID owning this history" },
+            id: { value: "history-item-id", required: true, description: "Risk-history item object ID" },
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskyServicePrincipal.Read.All" },
+        }, examples: ["mg-axi entra risky-service-principal history show --service-principal <risky-service-principal-id> --id <history-item-id> --profile soc"] },
+    { path: "entra service-principal-risk-detection list", description: "List service-principal risk detections in a bounded time window (IdentityRiskEvent.Read.All; delegated callers also need Global Reader, Security Operator, Security Reader or Security Administrator; Workload Identities Premium, with riskDetail and riskLevel hidden without it)", operation: "GET:/identityProtection/servicePrincipalRiskDetections", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            since: { ...logRead.since, description: "Required for a new query (resume with --cursor instead): earliest detectedDateTime bounding the server time range" },
+            until: logRead.until,
+            filter: logRead.filter,
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            cursor: riskRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskEvent.Read.All" },
+        }, examples: ["mg-axi entra service-principal-risk-detection list --profile soc --since 2026-09-01T00:00:00Z", "mg-axi entra service-principal-risk-detection list --profile soc --since 2026-09-01T00:00:00Z --filter \"riskState eq 'atRisk'\" --limit 10", "mg-axi entra service-principal-risk-detection list --profile soc --since 2026-09-01T00:00:00Z --all"] },
+    { path: "entra service-principal-risk-detection show", description: "Show one service-principal risk detection with the full reviewed property set; a null correlationId means no sign-in is associated", operation: "GET:/identityProtection/servicePrincipalRiskDetections/{servicePrincipalRiskDetection-id}", flags: {
+            ...common, id: { value: "service-principal-risk-detection-id", required: true, description: "Service-principal risk detection object ID" },
+            select: riskRead.select,
+            fields: riskRead.fields,
+            full: riskRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to IdentityRiskEvent.Read.All" },
+        }, examples: ["mg-axi entra service-principal-risk-detection show --id <service-principal-risk-detection-id> --profile soc", "mg-axi entra service-principal-risk-detection show --id <service-principal-risk-detection-id> --profile soc --full"] },
     { path: "entra conditional-access policy list", description: "List Conditional Access policies with compact properties (id, displayName, state)", operation: "GET:/identity/conditionalAccess/policies", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -1496,6 +1903,134 @@ export const LEAVES = [
             full: caRead.full,
             scopes: caRead.scopes,
         }, examples: ["mg-axi entra conditional-access named-location show --id <named-location-id> --profile soc", "mg-axi entra conditional-access named-location show --id <named-location-id> --profile soc --full"] },
+    { path: "entra conditional-access auth-strength-policy list", description: "List authentication-strength policies with compact properties (id, displayName, policyType)", operation: "GET:/identity/conditionalAccess/authenticationStrength/policies", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caStrengthRead.filter,
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            cursor: caStrengthRead.cursor,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-strength-policy list --profile soc", "mg-axi entra conditional-access auth-strength-policy list --profile soc --limit 10", "mg-axi entra conditional-access auth-strength-policy list --profile soc --filter \"policyType eq 'builtIn'\" --select id,displayName,policyType"] },
+    { path: "entra conditional-access auth-strength-policy show", description: "Show one authentication-strength policy with the full reviewed property set", operation: "GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}", flags: {
+            ...common, id: { value: "auth-strength-policy-id", required: true, description: "Authentication-strength policy object ID" },
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-strength-policy show --id <auth-strength-policy-id> --profile soc", "mg-axi entra conditional-access auth-strength-policy show --id <auth-strength-policy-id> --profile soc --full"] },
+    { path: "entra conditional-access combination-configuration list", description: "List the combination configurations of one authentication-strength policy", operation: "GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}/combinationConfigurations", flags: {
+            ...common,
+            policy: { value: "auth-strength-policy-id", required: true, description: "Authentication-strength policy object ID owning the combination configurations" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caStrengthRead.filter,
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            cursor: caStrengthRead.cursor,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access combination-configuration list --policy <auth-strength-policy-id> --profile soc", "mg-axi entra conditional-access combination-configuration list --policy <auth-strength-policy-id> --profile soc --limit 10"] },
+    { path: "entra conditional-access combination-configuration show", description: "Show one combination configuration of an authentication-strength policy; @odata.type names the configuration kind", operation: "GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}/combinationConfigurations/{authenticationCombinationConfiguration-id}", flags: {
+            ...common, policy: { value: "auth-strength-policy-id", required: true, description: "Authentication-strength policy object ID owning the combination configuration" },
+            id: { value: "combination-configuration-id", required: true, description: "Combination configuration object ID" },
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access combination-configuration show --policy <auth-strength-policy-id> --id <combination-configuration-id> --profile soc", "mg-axi entra conditional-access combination-configuration show --policy <auth-strength-policy-id> --id <combination-configuration-id> --profile soc --full"] },
+    { path: "entra conditional-access auth-method-mode list", description: "List authentication method modes with compact properties (id, displayName)", operation: "GET:/identity/conditionalAccess/authenticationStrength/authenticationMethodModes", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caStrengthRead.filter,
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            cursor: caStrengthRead.cursor,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-method-mode list --profile soc", "mg-axi entra conditional-access auth-method-mode list --profile soc --limit 10"] },
+    { path: "entra conditional-access auth-method-mode show", description: "Show one authentication method mode with the full reviewed property set", operation: "GET:/identity/conditionalAccess/authenticationStrength/authenticationMethodModes/{authenticationMethodModeDetail-id}", flags: {
+            ...common, id: { value: "auth-method-mode-id", required: true, description: "Authentication method mode object ID" },
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-method-mode show --id <auth-method-mode-id> --profile soc", "mg-axi entra conditional-access auth-method-mode show --id <auth-method-mode-id> --profile soc --full"] },
+    { path: "entra conditional-access template list", description: "List Conditional Access templates with compact properties (id, name)", operation: "GET:/identity/conditionalAccess/templates", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caRead.filter,
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            cursor: caRead.cursor,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access template list --profile soc", "mg-axi entra conditional-access template list --profile soc --limit 10"] },
+    { path: "entra conditional-access template show", description: "Show one Conditional Access template with the full reviewed property set", operation: "GET:/identity/conditionalAccess/templates/{conditionalAccessTemplate-id}", flags: {
+            ...common, id: { value: "template-id", required: true, description: "Conditional Access template object ID" },
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access template show --id <template-id> --profile soc", "mg-axi entra conditional-access template show --id <template-id> --profile soc --full"] },
+    { path: "entra conditional-access auth-context list", description: "List authentication context class references with compact properties (id, displayName)", operation: "GET:/identity/conditionalAccess/authenticationContextClassReferences", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caAuthContextRead.filter,
+            select: caAuthContextRead.select,
+            fields: caAuthContextRead.fields,
+            full: caAuthContextRead.full,
+            cursor: caAuthContextRead.cursor,
+            scopes: caAuthContextRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-context list --profile soc", "mg-axi entra conditional-access auth-context list --profile soc --limit 10"] },
+    { path: "entra conditional-access auth-context show", description: "Show one authentication context class reference with the full reviewed property set", operation: "GET:/identity/conditionalAccess/authenticationContextClassReferences/{authenticationContextClassReference-id}", flags: {
+            ...common, id: { value: "auth-context-id", required: true, description: "Authentication context class reference object ID" },
+            select: caAuthContextRead.select,
+            fields: caAuthContextRead.fields,
+            full: caAuthContextRead.full,
+            scopes: caAuthContextRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-context show --id <auth-context-id> --profile soc", "mg-axi entra conditional-access auth-context show --id <auth-context-id> --profile soc --full"] },
+    { path: "entra conditional-access deleted-policy list", description: "List soft-deleted Conditional Access policies with compact properties (id, displayName, state, deletedDateTime); restore stays out of scope", operation: "GET:/identity/conditionalAccess/deletedItems/policies", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caRead.filter,
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            cursor: caRead.cursor,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access deleted-policy list --profile soc", "mg-axi entra conditional-access deleted-policy list --profile soc --limit 10"] },
+    { path: "entra conditional-access deleted-policy show", description: "Show one soft-deleted Conditional Access policy with the full reviewed property set; restore stays out of scope", operation: "GET:/identity/conditionalAccess/deletedItems/policies/{conditionalAccessPolicy-id}", flags: {
+            ...common, id: { value: "deleted-policy-id", required: true, description: "Soft-deleted Conditional Access policy object ID" },
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access deleted-policy show --id <deleted-policy-id> --profile soc", "mg-axi entra conditional-access deleted-policy show --id <deleted-policy-id> --profile soc --full"] },
+    { path: "entra conditional-access deleted-named-location list", description: "List soft-deleted Conditional Access named locations with compact properties (id, displayName, deletedDateTime); restore stays out of scope", operation: "GET:/identity/conditionalAccess/deletedItems/namedLocations", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caRead.filter,
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            cursor: caRead.cursor,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access deleted-named-location list --profile soc", "mg-axi entra conditional-access deleted-named-location list --profile soc --limit 10"] },
+    { path: "entra conditional-access deleted-named-location show", description: "Show one soft-deleted Conditional Access named location with the full reviewed property set; restore stays out of scope", operation: "GET:/identity/conditionalAccess/deletedItems/namedLocations/{namedLocation-id}", flags: {
+            ...common, id: { value: "deleted-named-location-id", required: true, description: "Soft-deleted named location object ID" },
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access deleted-named-location show --id <deleted-named-location-id> --profile soc", "mg-axi entra conditional-access deleted-named-location show --id <deleted-named-location-id> --profile soc --full"] },
     { path: "entra identity-provider list", description: "List workforce identity providers with compact properties (id, displayName); rows carry @odata.type naming the provider kind; client secrets and key material are never returned", operation: "GET:/identity/identityProviders", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -1648,6 +2183,78 @@ export const LEAVES = [
             ...common,
             scopes: dataPolicyRead.scopes,
         }, examples: ["mg-axi entra data-policy-operation count --profile soc"] },
+    { path: "entra fraud-protection-provider list", description: "List workforce fraud-protection providers with compact properties (id, displayName); rows carry @odata.type naming the provider kind; API keys, client secrets and other key material are never returned; Graph documents $select only, so no --filter", operation: "GET:/identity/riskPrevention/fraudProtectionProviders", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            select: riskPreventionFraudRead.select,
+            fields: riskPreventionFraudRead.fields,
+            full: riskPreventionFraudRead.full,
+            cursor: riskPreventionFraudRead.cursor,
+            scopes: riskPreventionFraudRead.scopes,
+        }, examples: ["mg-axi entra fraud-protection-provider list --profile soc", "mg-axi entra fraud-protection-provider list --profile soc --limit 10"] },
+    { path: "entra fraud-protection-provider show", description: "Show one workforce fraud-protection provider with the full reviewed property set; API keys, client secrets and other key material are never returned", operation: "GET:/identity/riskPrevention/fraudProtectionProviders/{fraudProtectionProvider-id}", flags: {
+            ...common, id: { value: "provider-id", required: true, description: "Fraud-protection-provider ID" },
+            select: riskPreventionFraudRead.select,
+            fields: riskPreventionFraudRead.fields,
+            full: riskPreventionFraudRead.full,
+            scopes: riskPreventionFraudRead.scopes,
+        }, examples: ["mg-axi entra fraud-protection-provider show --id <provider-id> --profile soc", "mg-axi entra fraud-protection-provider show --id <provider-id> --profile soc --full"] },
+    { path: "entra fraud-protection-provider count", description: "Count workforce fraud-protection providers as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identity/riskPrevention/fraudProtectionProviders/$count", flags: {
+            ...common,
+            scopes: riskPreventionFraudRead.scopes,
+        }, examples: ["mg-axi entra fraud-protection-provider count --profile soc"] },
+    { path: "entra web-application-firewall-provider list", description: "List workforce web-application-firewall providers with compact properties (id, displayName); rows carry @odata.type naming the provider kind; API keys, client secrets and other key material are never returned", operation: "GET:/identity/riskPrevention/webApplicationFirewallProviders", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: riskPreventionWafRead.filter,
+            select: riskPreventionWafRead.select,
+            fields: riskPreventionWafRead.fields,
+            full: riskPreventionWafRead.full,
+            cursor: riskPreventionWafRead.cursor,
+            scopes: riskPreventionWafRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-provider list --profile soc", "mg-axi entra web-application-firewall-provider list --profile soc --limit 10", "mg-axi entra web-application-firewall-provider list --profile soc --filter \"displayName eq 'Example'\""] },
+    { path: "entra web-application-firewall-provider show", description: "Show one workforce web-application-firewall provider with the full reviewed property set; API keys, client secrets and other key material are never returned", operation: "GET:/identity/riskPrevention/webApplicationFirewallProviders/{webApplicationFirewallProvider-id}", flags: {
+            ...common, id: { value: "provider-id", required: true, description: "Web-application-firewall-provider ID" },
+            select: riskPreventionWafRead.select,
+            fields: riskPreventionWafRead.fields,
+            full: riskPreventionWafRead.full,
+            scopes: riskPreventionWafRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-provider show --id <provider-id> --profile soc", "mg-axi entra web-application-firewall-provider show --id <provider-id> --profile soc --full"] },
+    { path: "entra web-application-firewall-provider count", description: "Count workforce web-application-firewall providers as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identity/riskPrevention/webApplicationFirewallProviders/$count", flags: {
+            ...common,
+            scopes: riskPreventionWafRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-provider count --profile soc"] },
+    { path: "entra web-application-firewall-verification list", description: "List workforce web-application-firewall verifications with compact properties (id, verifiedHost, providerType); rows never carry provider detail, which has its own sub-read", operation: "GET:/identity/riskPrevention/webApplicationFirewallVerifications", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: riskPreventionVerificationRead.filter,
+            select: riskPreventionVerificationRead.select,
+            fields: riskPreventionVerificationRead.fields,
+            full: riskPreventionVerificationRead.full,
+            cursor: riskPreventionVerificationRead.cursor,
+            scopes: riskPreventionVerificationRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-verification list --profile soc", "mg-axi entra web-application-firewall-verification list --profile soc --limit 10", "mg-axi entra web-application-firewall-verification list --profile soc --filter \"providerType eq 'cloudflare'\""] },
+    { path: "entra web-application-firewall-verification show", description: "Show one workforce web-application-firewall verification with the full reviewed property set; the row never carries provider detail, which has its own sub-read", operation: "GET:/identity/riskPrevention/webApplicationFirewallVerifications/{webApplicationFirewallVerificationModel-id}", flags: {
+            ...common, id: { value: "verification-id", required: true, description: "Web-application-firewall-verification ID" },
+            select: riskPreventionVerificationRead.select,
+            fields: riskPreventionVerificationRead.fields,
+            full: riskPreventionVerificationRead.full,
+            scopes: riskPreventionVerificationRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-verification show --id <verification-id> --profile soc", "mg-axi entra web-application-firewall-verification show --id <verification-id> --profile soc --full"] },
+    { path: "entra web-application-firewall-verification count", description: "Count workforce web-application-firewall verifications as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identity/riskPrevention/webApplicationFirewallVerifications/$count", flags: {
+            ...common,
+            scopes: riskPreventionVerificationRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-verification count --profile soc"] },
+    { path: "entra web-application-firewall-verification provider show", description: "Show the web-application-firewall provider behind one verification with the full reviewed provider set; API keys, client secrets and other key material are never returned", operation: "GET:/identity/riskPrevention/webApplicationFirewallVerifications/{webApplicationFirewallVerificationModel-id}/provider", flags: {
+            ...common, id: { value: "verification-id", required: true, description: "Web-application-firewall-verification ID owning the provider" },
+            select: riskPreventionWafRead.select,
+            fields: riskPreventionWafRead.fields,
+            full: riskPreventionWafRead.full,
+            scopes: riskPreventionWafRead.scopes,
+        }, examples: ["mg-axi entra web-application-firewall-verification provider show --id <verification-id> --profile soc"] },
     { path: "entra access-review definition list", description: "List access-review definitions with compact properties (id, displayName, status); definitions are review schedules (a series), never their occurrences", operation: "GET:/identityGovernance/accessReviews/definitions", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -2084,14 +2691,98 @@ export const LEAVES = [
             full: lifecycleTaskReportSubRead.full,
             scopes: lifecycleTaskReportSubRead.scopes,
         }, examples: ["mg-axi entra lifecycle task-report task-definition show --workflow <workflow-id> --report <report-id> --profile soc"] },
-    { path: "api get", description: "Reviewed read-only raw Graph GET (API-01, v1.0 only): users, groups, conditional access, authentication methods, audit/sign-in, risk, apps, roles/PIM, devices, administrative units, domains, domain DNS records, identity providers, organizations, branding, access reviews, entitlement catalogs and access packages, lifecycle workflows, workflow templates, task definitions, lifecycle settings, workflow runs, user/subject processing results and task reports, and partner contracts; unreviewed, secret-value, mail/file-content, beta and write routes are refused before credentials", positional: { name: "path", description: "Server-relative Graph path, e.g. /users" }, flags: {
+    { path: "entra lifecycle run user-processing-result list", description: "List user processing results of one lifecycle workflow run with minimal personal-data properties (id, processingStatus, task counts); the subject link is never requested", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleRunReportsRead.filter,
+            select: lifecycleRunReportsRead.select,
+            fields: lifecycleRunReportsRead.fields,
+            full: lifecycleRunReportsRead.full,
+            cursor: lifecycleRunReportsRead.cursor,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run user-processing-result list --workflow <workflow-id> --run <run-id> --profile soc", "mg-axi entra lifecycle run user-processing-result list --workflow <workflow-id> --run <run-id> --profile soc --limit 10"] },
+    { path: "entra lifecycle run user-processing-result show", description: "Show one run user processing result with minimal personal-data properties; the subject link stays out", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults/{userProcessingResult-id}", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            id: { value: "user-processing-result-id", required: true, description: "User processing result ID" },
+            select: lifecycleRunReportsRead.select,
+            fields: lifecycleRunReportsRead.fields,
+            full: lifecycleRunReportsRead.full,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run user-processing-result show --workflow <workflow-id> --run <run-id> --id <result-id> --profile soc"] },
+    { path: "entra lifecycle run user-processing-result count", description: "Count user processing results of one lifecycle workflow run as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults/$count", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run user-processing-result count --workflow <workflow-id> --run <run-id> --profile soc"] },
+    { path: "entra lifecycle run subject-processing-result list", description: "List subject processing results of one lifecycle workflow run with minimal personal-data properties; Graph documents no $select here so rows always arrive whole", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults", flags: {
+            ...common,
+            workflow: lifecycleRunSubjectRead.workflow,
+            run: lifecycleRunSubjectRead.run,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleRunSubjectRead.filter,
+            fields: lifecycleRunSubjectRead.fields,
+            full: lifecycleRunSubjectRead.full,
+            cursor: lifecycleRunSubjectRead.cursor,
+            scopes: lifecycleRunSubjectRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run subject-processing-result list --workflow <workflow-id> --run <run-id> --profile soc", "mg-axi entra lifecycle run subject-processing-result list --workflow <workflow-id> --run <run-id> --profile soc --limit 10"] },
+    { path: "entra lifecycle run subject-processing-result show", description: "Show one run subject processing result with minimal personal-data properties; the get documents $expand only so the row always arrives whole and the subject navigation stays out", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults/{subjectProcessingResult-id}", flags: {
+            ...common,
+            workflow: lifecycleRunSubjectRead.workflow,
+            run: lifecycleRunSubjectRead.run,
+            id: { value: "subject-processing-result-id", required: true, description: "Subject processing result ID" },
+            fields: lifecycleRunSubjectRead.fields,
+            full: lifecycleRunSubjectRead.full,
+            scopes: lifecycleRunSubjectRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run subject-processing-result show --workflow <workflow-id> --run <run-id> --id <result-id> --profile soc"] },
+    { path: "entra lifecycle run subject-processing-result count", description: "Count subject processing results of one lifecycle workflow run as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults/$count", flags: {
+            ...common,
+            workflow: lifecycleRunSubjectRead.workflow,
+            run: lifecycleRunSubjectRead.run,
+            scopes: lifecycleRunSubjectRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run subject-processing-result count --workflow <workflow-id> --run <run-id> --profile soc"] },
+    { path: "entra lifecycle run task-processing-result list", description: "List task processing results of one lifecycle workflow run with compact properties (id, processingStatus, failureReason); rows never carry subject, task or workflowSubject detail", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: lifecycleRunReportsRead.filter,
+            select: lifecycleRunReportsRead.select,
+            fields: lifecycleRunReportsRead.fields,
+            full: lifecycleRunReportsRead.full,
+            cursor: lifecycleRunReportsRead.cursor,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run task-processing-result list --workflow <workflow-id> --run <run-id> --profile soc", "mg-axi entra lifecycle run task-processing-result list --workflow <workflow-id> --run <run-id> --profile soc --limit 10"] },
+    { path: "entra lifecycle run task-processing-result show", description: "Show one run task processing result with the full reviewed scalar set including failure detail; Graph documents no query parameters here so the row always arrives whole and subject, task and workflowSubject detail belongs to later slices", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults/{taskProcessingResult-id}", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            id: { value: "task-processing-result-id", required: true, description: "Task processing result ID" },
+            fields: lifecycleRunReportsRead.fields,
+            full: lifecycleRunReportsRead.full,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run task-processing-result show --workflow <workflow-id> --run <run-id> --id <result-id> --profile soc"] },
+    { path: "entra lifecycle run task-processing-result count", description: "Count task processing results of one lifecycle workflow run as a scalar number; the $count route takes no --filter, --select, --limit or --cursor", operation: "GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults/$count", flags: {
+            ...common,
+            workflow: lifecycleRunReportsRead.workflow,
+            run: lifecycleRunReportsRead.run,
+            scopes: lifecycleRunReportsRead.scopes,
+        }, examples: ["mg-axi entra lifecycle run task-processing-result count --workflow <workflow-id> --run <run-id> --profile soc"] },
+    { path: "api get", description: "Reviewed read-only raw Graph GET (API-01, v1.0 only): users, groups, conditional access, authentication methods, audit/sign-in, risk, apps, roles/PIM, devices, administrative units, domains, domain DNS records, identity providers, organizations, branding, access reviews, entitlement catalogs and access packages, lifecycle workflows, workflow templates, task definitions, lifecycle settings, workflow runs, user/subject processing results, task reports and run user/subject/task processing results, and partner contracts; unreviewed, secret-value, mail/file-content, beta and write routes are refused before credentials", positional: { name: "path", description: "Server-relative Graph path, e.g. /users" }, flags: {
             ...common,
             odata: { value: "k=v&k2=v2", description: "OData query reviewed per route ($select/$filter/$top/$orderby on collections; $select on singles); defaults to reviewed fields" },
             cursor: { value: "token|-", description: "Resume a partial collection; - reads the token from stdin (16 MB ceiling for either input); use the same path, profile and scopes, and omit --odata to reuse its query" },
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit full https://graph.microsoft.com/ scope names; application profiles use the .default audience" },
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; use --all to follow pages within budget" },
             all: { description: "Follow @odata.nextLink pages within the request budget" },
-            full: { description: "Disable 4000-character string truncation; never disables redaction or row caps" },
+            full: { description: "Disable 500-character string truncation; never disables redaction or row caps" },
         }, examples: ["mg-axi api get /users --scopes https://graph.microsoft.com/User.Read.All", "mg-axi api get /groups --odata '$filter=securityEnabled eq true&$top=5' --scopes https://graph.microsoft.com/GroupMember.Read.All", "mg-axi api get /users --cursor - --all --scopes https://graph.microsoft.com/User.Read.All < cursor.txt"] },
 ];
 export function leafHelp(leaf) {