@knowttl/mg-axi 0.1.1 → 0.1.3

package/dist/cli.js

@@ -1,5 +1,7 @@
 import { encode } from "@toon-format/toon";
-import { AxiError, runAxiCli } from "axi-sdk-js";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { AxiError, installSessionStartHooks, runAxiCli } from "axi-sdk-js";
 import { LEAVES, home, leafHelp, operationFor, resolveCommand, DESCRIPTION, TOP_LEVEL_HELP } from "./catalogue.js";
 import { VERSION } from "./version.js";
 import { Profiles } from "./profiles.js";
@@ -9,14 +11,15 @@ import { updateUserAccount } from "./entra-user-update.js";
 import { revokeUserSessions } from "./entra-user-revoke-sessions.js";
 import { createMutationCoordinator, mutationFetchTransport } from "./mutations.js";
 import { TRANSITIVE_OPERATION, listGroupMemberOf, listGroupMembers, listGroups, showGroup } from "./entra-groups.js";
-import { listDirectoryRoles, showDirectoryRole, listRoleAssignments, listPimEligible, listPimActive } from "./entra-roles.js";
+import { listDirectoryRoles, showDirectoryRole, listDirectoryRoleTemplates, showDirectoryRoleTemplate, listRoleMembers, listScopedMembers, showScopedMember, listScopedRoleMemberships, showScopedRoleMembership, listRoleAssignments, listPimEligible, listPimActive } from "./entra-roles.js";
+import { listGroupAssignmentSchedules, showGroupAssignmentSchedule, listGroupAssignmentInstances, showGroupAssignmentInstance, listGroupEligibilitySchedules, showGroupEligibilitySchedule, listGroupEligibilityInstances, showGroupEligibilityInstance, listGroupEligibilityRequests, showGroupEligibilityRequest } from "./entra-group-pim.js";
 import { listAdministrativeUnitMembers, listAdministrativeUnits, listDevices, showAdministrativeUnit, showDevice } from "./entra-directory.js";
-import { listSignIns, showSignIn, listDirectoryAudits, showDirectoryAudit } from "./entra-audit-logs.js";
-import { listApplicationOwners, listApplications, listServicePrincipalOwners, listServicePrincipals, showApplication, showServicePrincipal } from "./entra-apps.js";
+import { listSignIns, showSignIn, listDirectoryAudits, showDirectoryAudit, listProvisioning, showProvisioning } from "./entra-audit-logs.js";
+import { listApplicationFederatedCredentials, listApplicationOwners, listApplications, listServicePrincipalAssignedTo, listServicePrincipalFederatedCredentials, listServicePrincipalOwners, listServicePrincipals, showApplication, showApplicationFederatedCredential, showServicePrincipal, showServicePrincipalAppRoleAssignment, showServicePrincipalAssignedTo, showServicePrincipalFederatedCredential } from "./entra-apps.js";
 import { listAppRoleAssignments, listOAuth2Grants } from "./entra-grants.js";
-import { listRiskyUsers, showRiskyUser, listRiskDetections, showRiskDetection } from "./entra-risk.js";
+import { listRiskyUsers, showRiskyUser, listRiskDetections, showRiskDetection, listRiskyServicePrincipals, showRiskyServicePrincipal, listRiskyServicePrincipalHistory, showRiskyServicePrincipalHistory, listServicePrincipalRiskDetections, showServicePrincipalRiskDetection } from "./entra-risk.js";
 import { dismissRiskyUser } from "./entra-risk-dismiss.js";
-import { listPolicies, showPolicy, listNamedLocations, showNamedLocation } from "./entra-conditional-access.js";
+import { listPolicies, showPolicy, listNamedLocations, showNamedLocation, listAuthStrengthPolicies, showAuthStrengthPolicy, listCombinationConfigurations, showCombinationConfiguration, listAuthMethodModes, showAuthMethodMode, listTemplates, showTemplate, listAuthContexts, showAuthContext, listDeletedPolicies, showDeletedPolicy, listDeletedNamedLocations, showDeletedNamedLocation } from "./entra-conditional-access.js";
 import { listBrandingLocalizations, listOrganizations, showBranding, showBrandingLocalization, showOrganization } from "./entra-organization.js";
 import { updateCaPolicy } from "./entra-ca-policy-update.js";
 import { listDomains, showDomain, listVerificationDnsRecords, showVerificationDnsRecord, listServiceConfigurationRecords, showServiceConfigurationRecord, listDomainDnsRecords, showDomainDnsRecord } from "./entra-domains.js";
@@ -28,7 +31,7 @@ import { listDirectoryObjects, showDirectoryObject, countDirectoryObjects } from
 import { listDeletedItems, showDeletedItem, countDeletedItems } from "./entra-deleted-items.js";
 import { listContacts, showContact, countContacts, showContactManager, listContactDirectReports, showContactDirectReport, countContactDirectReports, castDirectReports, listContactMemberOf, showContactMemberOf, countContactMemberOf, transitMembership, castMembership } from "./entra-contacts.js";
 import { countContracts, listContracts, showContract } from "./entra-contracts.js";
-import { listDelegatedAdminCustomers, showDelegatedAdminCustomer, listDelegatedAdminRelationships, showDelegatedAdminRelationship, listDelegatedAdminAccessAssignments, showDelegatedAdminAccessAssignment, listDelegatedAdminOperations, showDelegatedAdminOperation, listDelegatedAdminRequests, showDelegatedAdminRequest, listDelegatedAdminServiceManagementDetails, showDelegatedAdminServiceManagementDetail } from "./entra-delegated-admin.js";
+import { listDelegatedAdminCustomers, showDelegatedAdminCustomer, listDelegatedAdminRelationships, showDelegatedAdminRelationship, listDelegatedAdminAccessAssignments, showDelegatedAdminAccessAssignment, listDelegatedAdminOperations, showDelegatedAdminOperation, listDelegatedAdminRequests, showDelegatedAdminRequest, listDelegatedAdminServiceManagementDetails, showDelegatedAdminServiceManagementDetail, countDelegatedAdminCustomers, countDelegatedAdminServiceManagementDetails, countDelegatedAdminRelationships, countDelegatedAdminAccessAssignments, countDelegatedAdminOperations, countDelegatedAdminRequests } from "./entra-delegated-admin.js";
 import { listMultiTenantOrganizationTenants, showMultiTenantOrganization, showMultiTenantOrganizationJoinRequest, countMultiTenantOrganizationTenants } from "./entra-multi-tenant-organization.js";
 import { showTenantInformation } from "./entra-tenant-information.js";
 import { countLifecyclePolicies, listLifecyclePolicies, showLifecyclePolicy, countSettingTemplates, listSettingTemplates, showSettingTemplate } from "./entra-group-lifecycle.js";
@@ -36,9 +39,10 @@ import { listAttributeSets, showAttributeSet, countAttributeSets, listCustomSecu
 import { listIdentityProviders, showIdentityProvider, countIdentityProviders, availableIdentityProviderTypes } from "./entra-identity-providers.js";
 import { listFederationConfigurations, showFederationConfiguration, countFederationConfigurations, availableFederationProviderTypes } from "./entra-federation-configurations.js";
 import { listDataPolicyOperations, showDataPolicyOperation, countDataPolicyOperations } from "./entra-data-policy-operations.js";
+import { listFraudProtectionProviders, showFraudProtectionProvider, countFraudProtectionProviders, listWafProviders, showWafProvider, countWafProviders, listWafVerifications, showWafVerification, countWafVerifications, showVerificationProvider } from "./entra-risk-prevention.js";
 import { listDefinitions, showDefinition, listInstances, showInstance, listDecisions, showDecision, listContactedReviewers, showContactedReviewer, listStages, showStage } from "./entra-access-reviews.js";
 import { listCatalogs, showCatalog, countCatalogs, listAccessPackages, showAccessPackage, countAccessPackages, listAssignmentPolicies, showAssignmentPolicy, countAssignmentPolicies, listResourceRoleScopes, showResourceRoleScope, countResourceRoleScopes, listAssignments, showAssignment, countAssignments, listAssignmentRequests, showAssignmentRequest, countAssignmentRequests } from "./entra-entitlement-management.js";
-import { listWorkflows, showWorkflow, countWorkflows, listWorkflowTemplates, showWorkflowTemplate, countWorkflowTemplates, listTaskDefinitions, showTaskDefinition, countTaskDefinitions, showLifecycleSettings, listRuns, showRun, countRuns, listUserProcessingResults, showUserProcessingResult, countUserProcessingResults, listSubjectProcessingResults, showSubjectProcessingResult, countSubjectProcessingResults, listTaskReports, showTaskReport, countTaskReports, showTaskReportTask, showTaskReportTaskDefinition } from "./entra-lifecycle-workflows.js";
+import { listWorkflows, showWorkflow, countWorkflows, listWorkflowTemplates, showWorkflowTemplate, countWorkflowTemplates, listTaskDefinitions, showTaskDefinition, countTaskDefinitions, showLifecycleSettings, listRuns, showRun, countRuns, listUserProcessingResults, showUserProcessingResult, countUserProcessingResults, listSubjectProcessingResults, showSubjectProcessingResult, countSubjectProcessingResults, listTaskReports, showTaskReport, countTaskReports, showTaskReportTask, showTaskReportTaskDefinition, listRunUserProcessingResults, showRunUserProcessingResult, countRunUserProcessingResults, listRunSubjectProcessingResults, showRunSubjectProcessingResult, countRunSubjectProcessingResults, listRunTaskProcessingResults, showRunTaskProcessingResult, countRunTaskProcessingResults } from "./entra-lifecycle-workflows.js";
 import { listAuthenticationMethods, listRegistrationDetails } from "./entra-auth-methods.js";
 import { addGroupMember } from "./entra-group-member-add.js";
 import { fetchTransport } from "./api.js";
@@ -62,6 +66,36 @@ function localHome(name) {
     output.help.unshift("npx -y @knowttl/mg-axi profile list", "npx -y @knowttl/mg-axi login --help");
     return output;
 }
+// One dispatch for the hook installer: resolve the sibling hook entry point
+// installed next to this binary and register it as the SessionStart command
+// for Claude Code, Codex and OpenCode through the SDK. No config, profile,
+// transport or network is involved; the hook itself prints the local-only
+// summary from src/hook.ts. Install failures throw loudly; hook failures
+// never do.
+function runSetupHooks() {
+    const hookPath = join(dirname(process.argv[1] ?? ""), "mg-axi-hook.js");
+    if (!existsSync(hookPath)) {
+        throw new AxiError("Cannot locate the mg-axi-hook entry point", "HOOK_INSTALL_FAILED", [
+            "Reinstall @knowttl/mg-axi so dist/bin/mg-axi-hook.js sits next to the main entry point",
+            "Run mg-axi setup hooks again after reinstalling",
+        ]);
+    }
+    const failures = [];
+    installSessionStartHooks({
+        marker: "mg-axi-hook",
+        execPath: hookPath,
+        binaryNames: ["mg-axi-hook"],
+        distEntrypoints: ["dist/bin/mg-axi-hook.js"],
+        onError: (message) => { failures.push(message); },
+    });
+    if (failures.length > 0) {
+        throw new AxiError("Failed to install mg-axi agent hooks", "HOOK_INSTALL_FAILED", failures);
+    }
+    return {
+        hooks: { status: "installed", integrations: "Claude Code, Codex, OpenCode" },
+        help: ["Restart your agent session to receive mg-axi ambient context"],
+    };
+}
 async function readCursor(cursor) {
     if (cursor !== "-")
         return cursor;
@@ -98,6 +132,8 @@ export async function executeArgv(argv, overrides = {}) {
         return profiles.resolve(flags.profile);
     if (leaf.path === "setup")
         return setupView(profiles);
+    if (leaf.path === "setup hooks")
+        return runSetupHooks();
     if (leaf.path === "doctor") {
         const names = doctorTargets(profiles, flags.profile);
         let delegated = overrides.delegated;
@@ -128,7 +164,7 @@ export async function executeArgv(argv, overrides = {}) {
         const { MsalProvider } = await import("./msal-provider.js");
         return { profile: selected.name, ...await new DelegatedAuth(new MsalProvider()).login(selected.profile, String(flags.method ?? "browser"), String(flags.scopes).split(",")) };
     }
-    if (leaf.path === "entra conditional-access policy list" || leaf.path === "entra conditional-access policy show" || leaf.path === "entra conditional-access named-location list" || leaf.path === "entra conditional-access named-location show") {
+    if (leaf.path === "entra conditional-access policy list" || leaf.path === "entra conditional-access policy show" || leaf.path === "entra conditional-access named-location list" || leaf.path === "entra conditional-access named-location show" || leaf.path === "entra conditional-access auth-strength-policy list" || leaf.path === "entra conditional-access auth-strength-policy show" || leaf.path === "entra conditional-access combination-configuration list" || leaf.path === "entra conditional-access combination-configuration show" || leaf.path === "entra conditional-access auth-method-mode list" || leaf.path === "entra conditional-access auth-method-mode show" || leaf.path === "entra conditional-access template list" || leaf.path === "entra conditional-access template show" || leaf.path === "entra conditional-access auth-context list" || leaf.path === "entra conditional-access auth-context show" || leaf.path === "entra conditional-access deleted-policy list" || leaf.path === "entra conditional-access deleted-policy show" || leaf.path === "entra conditional-access deleted-named-location list" || leaf.path === "entra conditional-access deleted-named-location show") {
         const selected = profiles.resolve(flags.profile);
         const operation = operationFor(leaf, String(flags["api-version"] ?? "v1.0"));
         if (!operation || operation.method !== "GET") {
@@ -154,7 +190,21 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra conditional-access policy list": return listPolicies(session, flags, selected.profile, operation, help, selected.name);
             case "entra conditional-access policy show": return showPolicy(session, flags, selected.profile, operation, help, selected.name);
             case "entra conditional-access named-location list": return listNamedLocations(session, flags, selected.profile, operation, help, selected.name);
-            default: return showNamedLocation(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access named-location show": return showNamedLocation(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-strength-policy list": return listAuthStrengthPolicies(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-strength-policy show": return showAuthStrengthPolicy(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access combination-configuration list": return listCombinationConfigurations(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access combination-configuration show": return showCombinationConfiguration(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-method-mode list": return listAuthMethodModes(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-method-mode show": return showAuthMethodMode(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access template list": return listTemplates(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-context list": return listAuthContexts(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-context show": return showAuthContext(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access deleted-policy list": return listDeletedPolicies(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access deleted-policy show": return showDeletedPolicy(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access deleted-named-location list": return listDeletedNamedLocations(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access deleted-named-location show": return showDeletedNamedLocation(session, flags, selected.profile, operation, help, selected.name);
+            default: return showTemplate(session, flags, selected.profile, operation, help, selected.name);
         }
     }
     if (leaf.path === "entra access-review definition list" || leaf.path === "entra access-review definition show" || leaf.path === "entra access-review instance list" || leaf.path === "entra access-review instance show" || leaf.path === "entra access-review decision list" || leaf.path === "entra access-review decision show" || leaf.path === "entra access-review contacted-reviewer list" || leaf.path === "entra access-review contacted-reviewer show" || leaf.path === "entra access-review stage list" || leaf.path === "entra access-review stage show") {
@@ -238,7 +288,7 @@ export async function executeArgv(argv, overrides = {}) {
             default: return countResourceRoleScopes(session, flags, selected.profile, operation, help, selected.name);
         }
     }
-    if (leaf.path === "entra lifecycle workflow list" || leaf.path === "entra lifecycle workflow show" || leaf.path === "entra lifecycle workflow count" || leaf.path === "entra lifecycle workflow-template list" || leaf.path === "entra lifecycle workflow-template show" || leaf.path === "entra lifecycle workflow-template count" || leaf.path === "entra lifecycle task-definition list" || leaf.path === "entra lifecycle task-definition show" || leaf.path === "entra lifecycle task-definition count" || leaf.path === "entra lifecycle settings show" || leaf.path === "entra lifecycle run list" || leaf.path === "entra lifecycle run show" || leaf.path === "entra lifecycle run count" || leaf.path === "entra lifecycle user-processing-result list" || leaf.path === "entra lifecycle user-processing-result show" || leaf.path === "entra lifecycle user-processing-result count" || leaf.path === "entra lifecycle subject-processing-result list" || leaf.path === "entra lifecycle subject-processing-result show" || leaf.path === "entra lifecycle subject-processing-result count" || leaf.path === "entra lifecycle task-report list" || leaf.path === "entra lifecycle task-report show" || leaf.path === "entra lifecycle task-report count" || leaf.path === "entra lifecycle task-report task show" || leaf.path === "entra lifecycle task-report task-definition show") {
+    if (leaf.path === "entra lifecycle workflow list" || leaf.path === "entra lifecycle workflow show" || leaf.path === "entra lifecycle workflow count" || leaf.path === "entra lifecycle workflow-template list" || leaf.path === "entra lifecycle workflow-template show" || leaf.path === "entra lifecycle workflow-template count" || leaf.path === "entra lifecycle task-definition list" || leaf.path === "entra lifecycle task-definition show" || leaf.path === "entra lifecycle task-definition count" || leaf.path === "entra lifecycle settings show" || leaf.path === "entra lifecycle run list" || leaf.path === "entra lifecycle run show" || leaf.path === "entra lifecycle run count" || leaf.path === "entra lifecycle user-processing-result list" || leaf.path === "entra lifecycle user-processing-result show" || leaf.path === "entra lifecycle user-processing-result count" || leaf.path === "entra lifecycle subject-processing-result list" || leaf.path === "entra lifecycle subject-processing-result show" || leaf.path === "entra lifecycle subject-processing-result count" || leaf.path === "entra lifecycle task-report list" || leaf.path === "entra lifecycle task-report show" || leaf.path === "entra lifecycle task-report count" || leaf.path === "entra lifecycle task-report task show" || leaf.path === "entra lifecycle task-report task-definition show" || leaf.path === "entra lifecycle run user-processing-result list" || leaf.path === "entra lifecycle run user-processing-result show" || leaf.path === "entra lifecycle run user-processing-result count" || leaf.path === "entra lifecycle run subject-processing-result list" || leaf.path === "entra lifecycle run subject-processing-result show" || leaf.path === "entra lifecycle run subject-processing-result count" || leaf.path === "entra lifecycle run task-processing-result list" || leaf.path === "entra lifecycle run task-processing-result show" || leaf.path === "entra lifecycle run task-processing-result count") {
         if (String(flags["api-version"] ?? "v1.0") !== "v1.0") {
             throw new AxiError("Lifecycle-workflow reads support v1.0 only; beta needs its own review", "VALIDATION_ERROR", [leafHelp(leaf)]);
         }
@@ -287,6 +337,15 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra lifecycle task-report count": return countTaskReports(session, flags, selected.profile, operation, help, selected.name);
             case "entra lifecycle task-report task show": return showTaskReportTask(session, flags, selected.profile, operation, help, selected.name);
             case "entra lifecycle task-report task-definition show": return showTaskReportTaskDefinition(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run user-processing-result list": return listRunUserProcessingResults(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run user-processing-result show": return showRunUserProcessingResult(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run user-processing-result count": return countRunUserProcessingResults(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run subject-processing-result list": return listRunSubjectProcessingResults(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run subject-processing-result show": return showRunSubjectProcessingResult(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run subject-processing-result count": return countRunSubjectProcessingResults(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run task-processing-result list": return listRunTaskProcessingResults(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run task-processing-result show": return showRunTaskProcessingResult(session, flags, selected.profile, operation, help, selected.name);
+            case "entra lifecycle run task-processing-result count": return countRunTaskProcessingResults(session, flags, selected.profile, operation, help, selected.name);
             default: return showLifecycleSettings(session, flags, selected.profile, operation, help, selected.name);
         }
     }
@@ -540,7 +599,12 @@ export async function executeArgv(argv, overrides = {}) {
             help: leafHelp(leaf),
         });
     }
-    if (leaf.path === "entra directory-role list" || leaf.path === "entra directory-role show" || leaf.path === "entra role-assignment list" || leaf.path === "entra pim eligible list" || leaf.path === "entra pim active list"
+    if (leaf.path === "entra directory-role list" || leaf.path === "entra directory-role show" || leaf.path === "entra directory-role-template list" || leaf.path === "entra directory-role-template show" || leaf.path === "entra directory-role member list" || leaf.path === "entra directory-role scoped-member list" || leaf.path === "entra directory-role scoped-member show" || leaf.path === "entra scoped-role-membership list" || leaf.path === "entra scoped-role-membership show" || leaf.path === "entra role-assignment list" || leaf.path === "entra pim eligible list" || leaf.path === "entra pim active list"
+        || leaf.path === "entra pim group-assignment-schedule list" || leaf.path === "entra pim group-assignment-schedule show"
+        || leaf.path === "entra pim group-assignment-instance list" || leaf.path === "entra pim group-assignment-instance show"
+        || leaf.path === "entra pim group-eligibility-schedule list" || leaf.path === "entra pim group-eligibility-schedule show"
+        || leaf.path === "entra pim group-eligibility-instance list" || leaf.path === "entra pim group-eligibility-instance show"
+        || leaf.path === "entra pim group-eligibility-request list" || leaf.path === "entra pim group-eligibility-request show"
         || leaf.path === "entra device list" || leaf.path === "entra device show"
         || leaf.path === "entra administrative-unit list" || leaf.path === "entra administrative-unit show"
         || leaf.path === "entra administrative-unit member list") {
@@ -566,9 +630,26 @@ export async function executeArgv(argv, overrides = {}) {
         switch (leaf.path) {
             case "entra directory-role list": return listDirectoryRoles(session, flags, selected.profile, operation, help, selected.name);
             case "entra directory-role show": return showDirectoryRole(session, flags, selected.profile, operation, help, selected.name);
+            case "entra directory-role-template list": return listDirectoryRoleTemplates(session, flags, selected.profile, operation, help, selected.name);
+            case "entra directory-role-template show": return showDirectoryRoleTemplate(session, flags, selected.profile, operation, help, selected.name);
+            case "entra directory-role member list": return listRoleMembers(session, flags, selected.profile, operation, help, selected.name);
+            case "entra directory-role scoped-member list": return listScopedMembers(session, flags, selected.profile, operation, help, selected.name);
+            case "entra directory-role scoped-member show": return showScopedMember(session, flags, selected.profile, operation, help, selected.name);
+            case "entra scoped-role-membership list": return listScopedRoleMemberships(session, flags, selected.profile, operation, help, selected.name);
+            case "entra scoped-role-membership show": return showScopedRoleMembership(session, flags, selected.profile, operation, help, selected.name);
             case "entra role-assignment list": return listRoleAssignments(session, flags, selected.profile, operation, help, selected.name);
             case "entra pim eligible list": return listPimEligible(session, flags, selected.profile, operation, help, selected.name);
             case "entra pim active list": return listPimActive(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-assignment-schedule list": return listGroupAssignmentSchedules(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-assignment-schedule show": return showGroupAssignmentSchedule(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-assignment-instance list": return listGroupAssignmentInstances(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-assignment-instance show": return showGroupAssignmentInstance(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-schedule list": return listGroupEligibilitySchedules(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-schedule show": return showGroupEligibilitySchedule(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-instance list": return listGroupEligibilityInstances(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-instance show": return showGroupEligibilityInstance(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-request list": return listGroupEligibilityRequests(session, flags, selected.profile, operation, help, selected.name);
+            case "entra pim group-eligibility-request show": return showGroupEligibilityRequest(session, flags, selected.profile, operation, help, selected.name);
             case "entra device list": return listDevices(session, flags, selected.profile, operation, help, selected.name);
             case "entra device show": return showDevice(session, flags, selected.profile, operation, help, selected.name);
             case "entra administrative-unit list": return listAdministrativeUnits(session, flags, selected.profile, operation, help, selected.name);
@@ -606,13 +687,13 @@ export async function executeArgv(argv, overrides = {}) {
             default: return showBrandingLocalization(session, flags, selected.profile, operation, help, selected.name);
         }
     }
-    if (leaf.path === "entra sign-in list" || leaf.path === "entra sign-in show" || leaf.path === "entra directory-audit list" || leaf.path === "entra directory-audit show" || leaf.path === "entra application list" || leaf.path === "entra application show" || leaf.path === "entra service-principal list" || leaf.path === "entra service-principal show" || leaf.path === "entra application owner list" || leaf.path === "entra service-principal owner list") {
+    if (leaf.path === "entra sign-in list" || leaf.path === "entra sign-in show" || leaf.path === "entra directory-audit list" || leaf.path === "entra directory-audit show" || leaf.path === "entra provisioning list" || leaf.path === "entra provisioning show" || leaf.path === "entra application list" || leaf.path === "entra application show" || leaf.path === "entra service-principal list" || leaf.path === "entra service-principal show" || leaf.path === "entra application owner list" || leaf.path === "entra service-principal owner list" || leaf.path === "entra application federated-credential list" || leaf.path === "entra application federated-credential show" || leaf.path === "entra service-principal federated-credential list" || leaf.path === "entra service-principal federated-credential show" || leaf.path === "entra service-principal app-role-assigned-to list" || leaf.path === "entra service-principal app-role-assigned-to show" || leaf.path === "entra service-principal app-role-assignment show") {
         const selected = profiles.resolve(flags.profile);
         const operation = operationFor(leaf, String(flags["api-version"] ?? "v1.0"));
         if (!operation || operation.method !== "GET") {
             throw new AxiError(`Unknown catalogued Graph operation for ${leaf.path}`, "VALIDATION_ERROR", [leafHelp(leaf)]);
         }
-        if ((leaf.path.startsWith("entra sign-in ") || leaf.path.startsWith("entra directory-audit ")) && flags.cursor !== undefined)
+        if ((leaf.path.startsWith("entra sign-in ") || leaf.path.startsWith("entra directory-audit ") || leaf.path.startsWith("entra provisioning ")) && flags.cursor !== undefined)
             flags.cursor = (await readCursor(String(flags.cursor)));
         let delegated = overrides.delegated;
         let application = overrides.application;
@@ -633,11 +714,20 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra sign-in show": return showSignIn(session, flags, selected.profile, operation, help, selected.name);
             case "entra directory-audit list": return listDirectoryAudits(session, flags, selected.profile, operation, help, selected.name);
             case "entra directory-audit show": return showDirectoryAudit(session, flags, selected.profile, operation, help, selected.name);
+            case "entra provisioning list": return listProvisioning(session, flags, selected.profile, operation, help, selected.name);
+            case "entra provisioning show": return showProvisioning(session, flags, selected.profile, operation, help, selected.name);
             case "entra application list": return listApplications(session, flags, selected.profile, operation, help, selected.name);
             case "entra application show": return showApplication(session, flags, selected.profile, operation, help, selected.name);
             case "entra service-principal list": return listServicePrincipals(session, flags, selected.profile, operation, help, selected.name);
             case "entra service-principal show": return showServicePrincipal(session, flags, selected.profile, operation, help, selected.name);
             case "entra application owner list": return listApplicationOwners(session, flags, selected.profile, operation, help, selected.name);
+            case "entra application federated-credential list": return listApplicationFederatedCredentials(session, flags, selected.profile, operation, help, selected.name);
+            case "entra application federated-credential show": return showApplicationFederatedCredential(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal federated-credential list": return listServicePrincipalFederatedCredentials(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal federated-credential show": return showServicePrincipalFederatedCredential(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal app-role-assigned-to list": return listServicePrincipalAssignedTo(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal app-role-assigned-to show": return showServicePrincipalAssignedTo(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal app-role-assignment show": return showServicePrincipalAppRoleAssignment(session, flags, selected.profile, operation, help, selected.name);
             default: return listServicePrincipalOwners(session, flags, selected.profile, operation, help, selected.name);
         }
     }
@@ -702,7 +792,7 @@ export async function executeArgv(argv, overrides = {}) {
             help: leafHelp(leaf),
         });
     }
-    if (leaf.path === "entra risky-user list" || leaf.path === "entra risky-user show" || leaf.path === "entra risk-detection list" || leaf.path === "entra risk-detection show") {
+    if (leaf.path === "entra risky-user list" || leaf.path === "entra risky-user show" || leaf.path === "entra risk-detection list" || leaf.path === "entra risk-detection show" || leaf.path === "entra risky-service-principal list" || leaf.path === "entra risky-service-principal show" || leaf.path === "entra risky-service-principal history list" || leaf.path === "entra risky-service-principal history show" || leaf.path === "entra service-principal-risk-detection list" || leaf.path === "entra service-principal-risk-detection show") {
         const selected = profiles.resolve(flags.profile);
         const operation = operationFor(leaf, String(flags["api-version"] ?? "v1.0"));
         if (!operation || operation.method !== "GET") {
@@ -728,7 +818,13 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra risky-user list": return listRiskyUsers(session, flags, selected.profile, operation, help, selected.name);
             case "entra risky-user show": return showRiskyUser(session, flags, selected.profile, operation, help, selected.name);
             case "entra risk-detection list": return listRiskDetections(session, flags, selected.profile, operation, help, selected.name);
-            default: return showRiskDetection(session, flags, selected.profile, operation, help, selected.name);
+            case "entra risk-detection show": return showRiskDetection(session, flags, selected.profile, operation, help, selected.name);
+            case "entra risky-service-principal list": return listRiskyServicePrincipals(session, flags, selected.profile, operation, help, selected.name);
+            case "entra risky-service-principal show": return showRiskyServicePrincipal(session, flags, selected.profile, operation, help, selected.name);
+            case "entra risky-service-principal history list": return listRiskyServicePrincipalHistory(session, flags, selected.profile, operation, help, selected.name);
+            case "entra risky-service-principal history show": return showRiskyServicePrincipalHistory(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal-risk-detection list": return listServicePrincipalRiskDetections(session, flags, selected.profile, operation, help, selected.name);
+            default: return showServicePrincipalRiskDetection(session, flags, selected.profile, operation, help, selected.name);
         }
     }
     if (leaf.path === "entra domain list" || leaf.path === "entra domain show"
@@ -1106,7 +1202,7 @@ export async function executeArgv(argv, overrides = {}) {
             default: return countContracts(session, flags, selected.profile, operation, help, selected.name);
         }
     }
-    if (leaf.path === "entra delegated-admin-customer list" || leaf.path === "entra delegated-admin-customer show" || leaf.path === "entra delegated-admin-relationship list" || leaf.path === "entra delegated-admin-relationship show" || leaf.path === "entra delegated-admin-relationship list-access-assignments" || leaf.path === "entra delegated-admin-relationship show-access-assignment" || leaf.path === "entra delegated-admin-relationship list-operations" || leaf.path === "entra delegated-admin-relationship show-operation" || leaf.path === "entra delegated-admin-relationship list-requests" || leaf.path === "entra delegated-admin-relationship show-request" || leaf.path === "entra delegated-admin-customer list-service-management-details" || leaf.path === "entra delegated-admin-customer show-service-management-detail") {
+    if (leaf.path === "entra delegated-admin-customer list" || leaf.path === "entra delegated-admin-customer show" || leaf.path === "entra delegated-admin-relationship list" || leaf.path === "entra delegated-admin-relationship show" || leaf.path === "entra delegated-admin-relationship list-access-assignments" || leaf.path === "entra delegated-admin-relationship show-access-assignment" || leaf.path === "entra delegated-admin-relationship list-operations" || leaf.path === "entra delegated-admin-relationship show-operation" || leaf.path === "entra delegated-admin-relationship list-requests" || leaf.path === "entra delegated-admin-relationship show-request" || leaf.path === "entra delegated-admin-customer list-service-management-details" || leaf.path === "entra delegated-admin-customer show-service-management-detail" || leaf.path === "entra delegated-admin-customer count" || leaf.path === "entra delegated-admin-customer count-service-management-details" || leaf.path === "entra delegated-admin-relationship count" || leaf.path === "entra delegated-admin-relationship count-access-assignments" || leaf.path === "entra delegated-admin-relationship count-operations" || leaf.path === "entra delegated-admin-relationship count-requests") {
         if (String(flags["api-version"] ?? "v1.0") !== "v1.0") {
             throw new AxiError("Delegated-admin reads support v1.0 only; beta needs its own review", "VALIDATION_ERROR", [leafHelp(leaf)]);
         }
@@ -1141,6 +1237,12 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra delegated-admin-relationship list-requests": return listDelegatedAdminRequests(session, flags, selected.profile, operation, help, selected.name);
             case "entra delegated-admin-relationship show-request": return showDelegatedAdminRequest(session, flags, selected.profile, operation, help, selected.name);
             case "entra delegated-admin-customer list-service-management-details": return listDelegatedAdminServiceManagementDetails(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-customer count": return countDelegatedAdminCustomers(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-customer count-service-management-details": return countDelegatedAdminServiceManagementDetails(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-relationship count": return countDelegatedAdminRelationships(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-relationship count-access-assignments": return countDelegatedAdminAccessAssignments(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-relationship count-operations": return countDelegatedAdminOperations(session, flags, selected.profile, operation, help, selected.name);
+            case "entra delegated-admin-relationship count-requests": return countDelegatedAdminRequests(session, flags, selected.profile, operation, help, selected.name);
             default: return showDelegatedAdminServiceManagementDetail(session, flags, selected.profile, operation, help, selected.name);
         }
     }
@@ -1288,6 +1390,42 @@ export async function executeArgv(argv, overrides = {}) {
             default: return countDataPolicyOperations(session, flags, selected.profile, operation, help, selected.name);
         }
     }
+    if (leaf.path === "entra fraud-protection-provider list" || leaf.path === "entra fraud-protection-provider show" || leaf.path === "entra fraud-protection-provider count" || leaf.path === "entra web-application-firewall-provider list" || leaf.path === "entra web-application-firewall-provider show" || leaf.path === "entra web-application-firewall-provider count" || leaf.path === "entra web-application-firewall-verification list" || leaf.path === "entra web-application-firewall-verification show" || leaf.path === "entra web-application-firewall-verification count" || leaf.path === "entra web-application-firewall-verification provider show") {
+        if (String(flags["api-version"] ?? "v1.0") !== "v1.0") {
+            throw new AxiError("Risk-prevention reads support v1.0 only; beta needs its own review", "VALIDATION_ERROR", [leafHelp(leaf)]);
+        }
+        const selected = profiles.resolve(flags.profile);
+        const operation = operationFor(leaf, "v1.0");
+        if (!operation || operation.method !== "GET") {
+            throw new AxiError(`Unknown catalogued Graph operation for ${leaf.path}`, "VALIDATION_ERROR", [leafHelp(leaf)]);
+        }
+        let delegated = overrides.delegated;
+        let application = overrides.application;
+        if (!delegated) {
+            const { DelegatedAuth: Service } = await import("./auth.js");
+            const { MsalProvider } = await import("./msal-provider.js");
+            delegated = new Service(new MsalProvider());
+        }
+        if (!application) {
+            const { ApplicationAuth: Service } = await import("./app-auth.js");
+            const { MsalApplicationProvider } = await import("./msal-app-provider.js");
+            application = new Service(new MsalApplicationProvider());
+        }
+        const session = new GraphSession({ delegated, application, transport: overrides.transport ?? fetchTransport });
+        const help = leafHelp(leaf);
+        switch (leaf.path) {
+            case "entra fraud-protection-provider list": return listFraudProtectionProviders(session, flags, selected.profile, operation, help, selected.name);
+            case "entra fraud-protection-provider show": return showFraudProtectionProvider(session, flags, selected.profile, operation, help, selected.name);
+            case "entra fraud-protection-provider count": return countFraudProtectionProviders(session, flags, selected.profile, operation, help);
+            case "entra web-application-firewall-provider list": return listWafProviders(session, flags, selected.profile, operation, help, selected.name);
+            case "entra web-application-firewall-provider show": return showWafProvider(session, flags, selected.profile, operation, help, selected.name);
+            case "entra web-application-firewall-provider count": return countWafProviders(session, flags, selected.profile, operation, help);
+            case "entra web-application-firewall-verification list": return listWafVerifications(session, flags, selected.profile, operation, help, selected.name);
+            case "entra web-application-firewall-verification show": return showWafVerification(session, flags, selected.profile, operation, help, selected.name);
+            case "entra web-application-firewall-verification count": return countWafVerifications(session, flags, selected.profile, operation, help);
+            default: return showVerificationProvider(session, flags, selected.profile, operation, help, selected.name);
+        }
+    }
     const operation = operationFor(leaf, String(flags["api-version"] ?? "v1.0"));
     throw new AxiError(`Command is not executable: ${operation?.disposition ?? "unavailable"} (${operation?.owningSlice ?? "no inventory mapping"})`, "NOT_IMPLEMENTED", [leafHelp(leaf)]);
 }