@knowttl/mg-axi 0.1.1 → 0.1.3

package/dist/entra-apps.js

@@ -1,8 +1,12 @@
 import { AxiError } from "axi-sdk-js";
+import { KNOWN_APP_ROLE_FIELDS } from "./entra-grants.js";
+import { listTotals } from "./list-totals.js";
 import { SAFE_CREDENTIAL_FIELDS } from "./graph-session.js";
 // READ-07: the Entra application and service-principal read mapping behind
 // `mg-axi entra application list/show`, `mg-axi entra service-principal
-// list/show` and the two `owner list` relationship reads. Operation
+// list/show`, the two `owner list` relationship reads, the service-principal
+// `app-role-assigned-to` and `app-role-assignment show` assignment reads and
+// the two `federated-credential` collections. Operation
 // construction stays beside its command; the shared session owns URLs,
 // credentials, paging, retries and error translation, and the SDK owns TOON
 // rendering. This module only maps flags to session calls and projects rows
@@ -13,14 +17,18 @@ import { SAFE_CREDENTIAL_FIELDS } from "./graph-session.js";
 // servicePrincipal-list-owners operation documentation on 2026-10-04.
 // Delegated and application reads take Application.Read.All; the object id
 // (`id`) is never conflated with the client ID (`appId`) - both ride in the
-// compact list defaults so callers can see the distinction. Consent grants
-// (appRoleAssignments, oauth2PermissionGrants) are READ-08 and stay out of
-// this slice; only owners are projected as relationships.
+// compact list defaults so callers can see the distinction. Delegated
+// permission grants (oauth2PermissionGrants) are READ-08 and stay out of
+// this slice; only owners, direct assignments and federated credentials are
+// projected as relationships. Alternate-key lookups by appId and
+// federated-credential lookups by name stay out too: they need a validated
+// function-argument binding the session guard does not have, and widening
+// the guard is out of scope for a read slice.
 //
 // Credential safety belongs to the shared session's SAFE_CREDENTIAL_FIELDS
 // projection, applied before collection buffering and again on cursor decode.
 // Local projection uses that same allowlist for the displayed view.
-// The six GET operations below are the only ones this module ever binds;
+// The thirteen GET operations below are the only ones this module ever binds;
 // secret-minting routes (addPassword, addKey) and every write stay refused before
 // credentials via checkReadOperation.
 // Every application property this slice may request or display. Anything
@@ -51,6 +59,20 @@ export const KNOWN_SP_FIELDS = [
     "passwordCredentials",
 ];
 const KNOWN_SPS = new Set(KNOWN_SP_FIELDS);
+const KNOWN_ASSIGNED = new Set(KNOWN_APP_ROLE_FIELDS);
+// Federated-credential rows carry workload-identity metadata only: issuer,
+// subject and audiences name the trusted token source. There is no secret
+// material on this resource, and the projection still drops anything outside
+// this set so a future property can never leak through.
+export const KNOWN_FEDERATED_FIELDS = [
+    "id",
+    "name",
+    "issuer",
+    "subject",
+    "description",
+    "audiences",
+];
+const KNOWN_FEDERATED = new Set(KNOWN_FEDERATED_FIELDS);
 // Owner rows are directoryObjects of mixed types; richer per-type fields
 // need single-object reads, so only these stay selectable.
 export const KNOWN_OWNER_FIELDS = ["id", "displayName", "mail"];
@@ -67,6 +89,17 @@ const DEFAULT_APP_SHOW_SELECT = [...KNOWN_APP_FIELDS];
 const DEFAULT_SP_SHOW_SELECT = [...KNOWN_SP_FIELDS];
 // Compact owner rows: identifier, display name and address.
 const DEFAULT_OWNER_SELECT = ["id", "displayName", "mail"];
+// Compact federated-credential rows: the credential id, its name and the
+// trusted token source. The full set adds the human description and the
+// audience list.
+const DEFAULT_FEDERATED_LIST_SELECT = ["id", "name", "issuer", "subject"];
+const DEFAULT_FEDERATED_SHOW_SELECT = [...KNOWN_FEDERATED_FIELDS];
+// Compact assignment rows: the assignment id, the granted role and who
+// holds it. principalId is constant for one service principal's
+// appRoleAssignments list but varies across appRoleAssignedTo rows.
+const DEFAULT_ASSIGNED_LIST_SELECT = ["id", "appRoleId", "principalDisplayName", "principalId", "principalType", "resourceDisplayName", "resourceId"];
+;
+const DEFAULT_ASSIGNED_SHOW_SELECT = [...KNOWN_APP_ROLE_FIELDS];
 // Application.Read.All covers applications, service principals and owners in
 // both modes; delegated reads default to it unless --scopes overrides it.
 export const DEFAULT_DELEGATED_SCOPES = ["https://graph.microsoft.com/Application.Read.All"];
@@ -77,9 +110,16 @@ const READ_OPERATIONS = {
     "GET:/applications": "application",
     "GET:/applications/{application-id}": "application",
     "GET:/applications/{application-id}/owners": "application",
+    "GET:/applications/{application-id}/federatedIdentityCredentials": "application",
+    "GET:/applications/{application-id}/federatedIdentityCredentials/{federatedIdentityCredential-id}": "application",
     "GET:/servicePrincipals": "service-principal",
     "GET:/servicePrincipals/{servicePrincipal-id}": "service-principal",
     "GET:/servicePrincipals/{servicePrincipal-id}/owners": "service-principal",
+    "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo": "service-principal",
+    "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo/{appRoleAssignment-id}": "service-principal",
+    "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignments/{appRoleAssignment-id}": "service-principal",
+    "GET:/servicePrincipals/{servicePrincipal-id}/federatedIdentityCredentials": "service-principal",
+    "GET:/servicePrincipals/{servicePrincipal-id}/federatedIdentityCredentials/{federatedIdentityCredential-id}": "service-principal",
 };
 function checkReadOperation(operation, help) {
     // Version stays the session's decision: beta reads remain preview-gated
@@ -87,7 +127,7 @@ function checkReadOperation(operation, help) {
     // fabricated secret-minting or write route can never reach credentials.
     const route = `${operation.method}:${operation.path}`;
     if (operation.method !== "GET" || !Object.hasOwn(READ_OPERATIONS, route)) {
-        throw new AxiError(`Refused non-read route ${operation.id}: READ-07 serves only the six catalogued application and service-principal GETs`, "VALIDATION_ERROR", [
+        throw new AxiError(`Refused non-read route ${operation.id}: READ-07 serves only the thirteen catalogued application and service-principal GETs`, "VALIDATION_ERROR", [
             help,
             "Secret-minting routes (addPassword, addKey) and writes are never constructed here; consent grants belong to READ-08",
         ]);
@@ -270,23 +310,25 @@ async function listCollection(session, flags, profile, operation, help, profileN
     if (!result.complete) {
         return {
             [key]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, emptyNoun, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resumeHint(profileName), showHint],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
         return {
             [key]: rows,
-            count,
+            ...listTotals(rows.length, result.total, emptyNoun, true),
+            complete: true,
             help: [
                 `0 ${emptyNoun} matched; the absence of results is the answer, not an error`,
                 showHint,
             ],
         };
     }
-    return { [key]: rows, count, help: [...truncationHints, showHint] };
+    return { [key]: rows, ...listTotals(rows.length, result.total, emptyNoun, true), complete: true, help: [...truncationHints, showHint] };
 }
 async function showSingle(session, flags, profile, operation, help, profileName, command, key, known, knownList, defaults, param, flag) {
     checkReadOperation(operation, help);
@@ -351,20 +393,22 @@ async function listOwners(session, flags, profile, operation, help, profileName,
     if (!result.complete) {
         return {
             owners: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, "owners", false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, ...limitedHints, resumeHint(profileName)],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
         return {
             owners: rows,
-            count,
+            ...listTotals(rows.length, result.total, "owners", true),
+            complete: true,
             help: [...limitedHints, "0 owners matched; the absence of results is the answer, not an error"],
         };
     }
-    return { owners: rows, count, help: [...truncationHints, ...limitedHints] };
+    return { owners: rows, ...listTotals(rows.length, result.total, "owners", true), complete: true, help: [...truncationHints, ...limitedHints] };
 }
 export async function listApplicationOwners(session, flags, profile, operation, help, profileName) {
     return listOwners(session, flags, profile, operation, help, profileName, "entra application owner list", "application-id", "application");
@@ -372,3 +416,116 @@ export async function listApplicationOwners(session, flags, profile, operation,
 export async function listServicePrincipalOwners(session, flags, profile, operation, help, profileName) {
     return listOwners(session, flags, profile, operation, help, profileName, "entra service-principal owner list", "servicePrincipal-id", "service-principal");
 }
+async function listChildCollection(session, flags, profile, operation, help, profileName, child, known, knownList, defaults) {
+    checkReadOperation(operation, help);
+    const parent = String(flags[child.parentFlag]);
+    if (!parent.trim())
+        throw new AxiError(`--${child.parentFlag} needs ${child.parentLabel}`, "VALIDATION_ERROR", [help]);
+    const common = collectionCommon(session, flags, known, knownList, defaults, operation, help, profile);
+    const args = collectArgs(profile, operation, common, flags, help);
+    args.params = { [child.parentParam]: parent };
+    const result = await session.collect(args);
+    const effectiveFlags = { ...flags, select: result.query.$select ?? defaults.join(",") };
+    if (result.query.$filter !== undefined)
+        effectiveFlags.filter = result.query.$filter;
+    const rows = [];
+    let truncated = false;
+    for (const row of result.value) {
+        const projected = project(row, common.fields, common.full);
+        rows.push(projected.row);
+        truncated = truncated || projected.truncated;
+    }
+    const truncationHints = truncated ? [fullHint(child.command, effectiveFlags, profileName)] : [];
+    if (!result.complete) {
+        return {
+            [child.key]: rows,
+            ...listTotals(rows.length, result.total, child.emptyNoun, false),
+            complete: false,
+            reason: result.reason,
+            cursor: result.cursor,
+            help: [...truncationHints, resumeHint(profileName), child.showHint],
+        };
+    }
+    if (!rows.length) {
+        return {
+            [child.key]: rows,
+            ...listTotals(rows.length, result.total, child.emptyNoun, true),
+            complete: true,
+            help: [
+                `0 ${child.emptyNoun} matched; the absence of results is the answer, not an error`,
+                child.showHint,
+            ],
+        };
+    }
+    return { [child.key]: rows, ...listTotals(rows.length, result.total, child.emptyNoun, true), complete: true, help: [...truncationHints, child.showHint] };
+}
+async function showChildObject(session, flags, profile, operation, help, profileName, command, key, known, knownList, defaults, parentParam, parentFlag, parentLabel, childParam) {
+    checkReadOperation(operation, help);
+    const parent = String(flags[parentFlag]);
+    if (!parent.trim())
+        throw new AxiError(`--${parentFlag} needs ${parentLabel}`, "VALIDATION_ERROR", [help]);
+    const { select, fields } = selectedFields(flags, known, knownList, defaults, help);
+    const scopes = scopesFor(flags, profile, help);
+    const full = flags.full === true;
+    const raw = await session.execute({
+        profile,
+        operation,
+        params: { [parentParam]: parent, [childParam]: String(flags.id) },
+        query: { $select: select.join(",") },
+        scopes,
+    });
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new AxiError("Graph returned a malformed child object body", "GRAPH_ERROR", [
+            "Single-object reads carry one object; treat anything else as unknown, not empty",
+        ]);
+    }
+    const { row, truncated } = project(raw, fields, full);
+    if (truncated)
+        return { [key]: row, help: [fullHint(command, flags, profileName)] };
+    return { [key]: row };
+}
+export async function listApplicationFederatedCredentials(session, flags, profile, operation, help, profileName) {
+    return listChildCollection(session, flags, profile, operation, help, profileName, {
+        command: "entra application federated-credential list",
+        key: "federatedCredentials",
+        emptyNoun: "federated credentials",
+        showHint: `mg-axi entra application federated-credential show --application <application-object-id> --id <credential-id> ${profileHint(profileName)}`,
+        parentParam: "application-id",
+        parentFlag: "application",
+        parentLabel: "the owning application object ID",
+    }, KNOWN_FEDERATED, KNOWN_FEDERATED_FIELDS, DEFAULT_FEDERATED_LIST_SELECT);
+}
+export async function showApplicationFederatedCredential(session, flags, profile, operation, help, profileName) {
+    return showChildObject(session, flags, profile, operation, help, profileName, "entra application federated-credential show", "federatedCredential", KNOWN_FEDERATED, KNOWN_FEDERATED_FIELDS, DEFAULT_FEDERATED_SHOW_SELECT, "application-id", "application", "the owning application object ID", "federatedIdentityCredential-id");
+}
+export async function listServicePrincipalFederatedCredentials(session, flags, profile, operation, help, profileName) {
+    return listChildCollection(session, flags, profile, operation, help, profileName, {
+        command: "entra service-principal federated-credential list",
+        key: "federatedCredentials",
+        emptyNoun: "federated credentials",
+        showHint: `mg-axi entra service-principal federated-credential show --service-principal <service-principal-object-id> --id <credential-id> ${profileHint(profileName)}`,
+        parentParam: "servicePrincipal-id",
+        parentFlag: "service-principal",
+        parentLabel: "the owning service-principal object ID",
+    }, KNOWN_FEDERATED, KNOWN_FEDERATED_FIELDS, DEFAULT_FEDERATED_LIST_SELECT);
+}
+export async function showServicePrincipalFederatedCredential(session, flags, profile, operation, help, profileName) {
+    return showChildObject(session, flags, profile, operation, help, profileName, "entra service-principal federated-credential show", "federatedCredential", KNOWN_FEDERATED, KNOWN_FEDERATED_FIELDS, DEFAULT_FEDERATED_SHOW_SELECT, "servicePrincipal-id", "service-principal", "the owning service-principal object ID", "federatedIdentityCredential-id");
+}
+export async function listServicePrincipalAssignedTo(session, flags, profile, operation, help, profileName) {
+    return listChildCollection(session, flags, profile, operation, help, profileName, {
+        command: "entra service-principal app-role-assigned-to list",
+        key: "appRoleAssignedTo",
+        emptyNoun: "app role assignments",
+        showHint: `mg-axi entra service-principal app-role-assigned-to show --service-principal <service-principal-object-id> --id <assignment-id> ${profileHint(profileName)}`,
+        parentParam: "servicePrincipal-id",
+        parentFlag: "service-principal",
+        parentLabel: "the resource service-principal object ID",
+    }, KNOWN_ASSIGNED, KNOWN_APP_ROLE_FIELDS, DEFAULT_ASSIGNED_LIST_SELECT);
+}
+export async function showServicePrincipalAssignedTo(session, flags, profile, operation, help, profileName) {
+    return showChildObject(session, flags, profile, operation, help, profileName, "entra service-principal app-role-assigned-to show", "appRoleAssignedTo", KNOWN_ASSIGNED, KNOWN_APP_ROLE_FIELDS, DEFAULT_ASSIGNED_SHOW_SELECT, "servicePrincipal-id", "service-principal", "the resource service-principal object ID", "appRoleAssignment-id");
+}
+export async function showServicePrincipalAppRoleAssignment(session, flags, profile, operation, help, profileName) {
+    return showChildObject(session, flags, profile, operation, help, profileName, "entra service-principal app-role-assignment show", "appRoleAssignment", KNOWN_ASSIGNED, KNOWN_APP_ROLE_FIELDS, DEFAULT_ASSIGNED_SHOW_SELECT, "servicePrincipal-id", "service-principal", "the client service-principal object ID", "appRoleAssignment-id");
+}

package/dist/entra-audit-logs.js

@@ -1,17 +1,24 @@
 import { AxiError } from "axi-sdk-js";
-// READ-05: the Entra sign-in and directory-audit read mapping behind
-// `mg-axi entra sign-in list/show` and `mg-axi entra directory-audit
-// list/show`. Operation construction stays beside its command; the shared
+import { listTotals } from "./list-totals.js";
+// READ-05: the Entra sign-in, directory-audit and provisioning-log read
+// mapping behind `mg-axi entra sign-in list/show`, `mg-axi entra
+// directory-audit list/show` and `mg-axi entra provisioning list/show`.
+// Operation construction stays beside its command; the shared
 // session owns URLs, credentials, paging, retries and error translation, and
 // the SDK owns TOON rendering. This module only maps flags to session calls,
 // bounds every collection query in time, and projects rows for compact output.
 //
 // Reviewed against the v1.0 signin-list and directoryaudit-list operation
-// documentation on 2026-10-04. Both collections read D/A AuditLog.Read.All;
-// delegated sign-in reads additionally accept Global Reader, Reports Reader,
-// Security Administrator, Security Operator or Security Reader, while
-// delegated directory-audit reads accept Reports Reader, Security
-// Administrator or Security Reader. Graph omits appliedConditionalAccessPolicies
+// documentation on 2026-10-04 and the provisioningobjectsummary-list
+// documentation on 2026-10-06. Sign-in and directory-audit collections read
+// D/A AuditLog.Read.All; delegated sign-in reads additionally accept Global
+// Reader, Reports Reader, Security Administrator, Security Operator or
+// Security Reader, while delegated directory-audit reads accept Reports
+// Reader, Security Administrator or Security Reader. The provisioning
+// collection reads D/A AuditLog.Read.All and Directory.Read.All together;
+// delegated reads accept the same five roles as sign-ins, Reports Reader is
+// the least privileged role for the logs, and the tenant needs a P1 or P2
+// licence. Graph omits appliedConditionalAccessPolicies
 // without a CA-data permission/role, so an absent property is reported as
 // unavailable rather than invented. Sign-in/audit Graph reporting carries a
 // conservative P1/P2 deployment prerequisite; retention and premium fields
@@ -54,13 +61,45 @@ export const KNOWN_AUDIT_FIELDS = [
 ];
 const SIGNIN_KNOWN = new Set(KNOWN_SIGNIN_FIELDS);
 const AUDIT_KNOWN = new Set(KNOWN_AUDIT_FIELDS);
+// The full reviewed provisioningObjectSummary property set. None of these
+// is credential material (no password, key or secret properties), and the
+// known-set gate rejects anything else before credentials; the session's
+// shared redaction stays the backstop for secret-shaped values.
+export const KNOWN_PROVISIONING_FIELDS = [
+    "id",
+    "activityDateTime",
+    "tenantId",
+    "jobId",
+    "cycleId",
+    "changeId",
+    "action",
+    "durationInMilliseconds",
+    "sourceSystem",
+    "sourceIdentity",
+    "targetSystem",
+    "targetIdentity",
+    "provisioningStatusInfo",
+    "provisioningSteps",
+    "modifiedProperties",
+    "servicePrincipal",
+    "initiatedBy",
+];
+const PROVISIONING_KNOWN = new Set(KNOWN_PROVISIONING_FIELDS);
 // Compact list rows: identifier, time, who/what happened, and outcome.
 const DEFAULT_SIGNIN_LIST_SELECT = ["id", "createdDateTime", "userPrincipalName", "appDisplayName"];
 const DEFAULT_AUDIT_LIST_SELECT = ["id", "activityDateTime", "activityDisplayName", "result"];
+const DEFAULT_PROVISIONING_LIST_SELECT = ["id", "activityDateTime", "action", "provisioningStatusInfo"];
 // Show rows: the full reviewed server set for one object.
 const DEFAULT_SIGNIN_SHOW_SELECT = [...KNOWN_SIGNIN_FIELDS];
 const DEFAULT_AUDIT_SHOW_SELECT = [...KNOWN_AUDIT_FIELDS];
+const DEFAULT_PROVISIONING_SHOW_SELECT = [...KNOWN_PROVISIONING_FIELDS];
 export const DEFAULT_DELEGATED_SCOPES = ["https://graph.microsoft.com/AuditLog.Read.All"];
+// Provisioning reads need both directory scopes; the pair is the documented
+// least-privileged delegated set and both names already sit in READ_SCOPES.
+export const DEFAULT_PROVISIONING_SCOPES = [
+    "https://graph.microsoft.com/AuditLog.Read.All",
+    "https://graph.microsoft.com/Directory.Read.All",
+];
 const TRUNCATE_AT = 500;
 // Graph omits this property without CA-data access instead of failing, so an
 // absent value reports the missing prerequisite rather than an empty result.
@@ -87,7 +126,7 @@ function fieldList(raw, flag, known, knownList, help) {
     }
     return fields;
 }
-function scopesFor(flags, profile, help) {
+function scopesFor(flags, profile, help, defaultScopes = DEFAULT_DELEGATED_SCOPES) {
     if (profile.mode === "application") {
         if (flags.scopes !== undefined) {
             throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", [help, "mg-axi profile show --profile <name>"]);
@@ -95,7 +134,7 @@ function scopesFor(flags, profile, help) {
         return undefined;
     }
     if (flags.scopes === undefined)
-        return [...DEFAULT_DELEGATED_SCOPES];
+        return [...defaultScopes];
     const scopes = String(flags.scopes)
         .split(",")
         .map(scope => scope.trim())
@@ -226,10 +265,16 @@ const AUDIT_DENIAL_HINTS = [
     "Directory-audit reads need AuditLog.Read.All plus a supported directory role: Reports Reader, Security Administrator or Security Reader for delegated access, or admin-consented AuditLog.Read.All for application access",
     "Audit Graph reporting carries a conservative P1/P2 deployment prerequisite; retention stays a separate constraint",
 ];
+const PROVISIONING_DENIAL_HINTS = [
+    "Provisioning-log reads need AuditLog.Read.All and Directory.Read.All plus a supported directory role: Global Reader, Reports Reader, Security Administrator, Security Operator or Security Reader for delegated access, or admin-consented AuditLog.Read.All and Directory.Read.All for application access",
+    "Provisioning logs need a Microsoft Entra ID P1 or P2 licence on the tenant; retention is 30 days on premium and 7 days on free",
+];
 const SIGNIN_LIST = {
     noun: "sign-in",
+    plural: "sign-ins",
     key: "signIns",
     dateField: "createdDateTime",
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
     known: SIGNIN_KNOWN,
     knownList: KNOWN_SIGNIN_FIELDS,
     defaultSelect: DEFAULT_SIGNIN_LIST_SELECT,
@@ -243,8 +288,10 @@ const SIGNIN_LIST = {
 };
 const AUDIT_LIST = {
     noun: "directory-audit",
+    plural: "directory audits",
     key: "directoryAudits",
     dateField: "activityDateTime",
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
     known: AUDIT_KNOWN,
     knownList: KNOWN_AUDIT_FIELDS,
     defaultSelect: DEFAULT_AUDIT_LIST_SELECT,
@@ -256,6 +303,23 @@ const AUDIT_LIST = {
         "0 directory audits matched in this window; widen --since/--until or loosen --filter - the absence of results is the answer, not an error",
     ],
 };
+const PROVISIONING_LIST = {
+    noun: "provisioning",
+    plural: "provisioning events",
+    key: "provisioning",
+    dateField: "activityDateTime",
+    defaultScopes: DEFAULT_PROVISIONING_SCOPES,
+    known: PROVISIONING_KNOWN,
+    knownList: KNOWN_PROVISIONING_FIELDS,
+    defaultSelect: DEFAULT_PROVISIONING_LIST_SELECT,
+    unavailable: {},
+    denialHints: PROVISIONING_DENIAL_HINTS,
+    showHint: "mg-axi entra provisioning show --id <provisioning-id>",
+    emptyHints: profileName => [
+        `mg-axi entra provisioning list --since <earlier-iso-time> ${profileHint(profileName)}`,
+        "0 provisioning events matched in this window; widen --since/--until or loosen --filter - the absence of results is the answer, not an error",
+    ],
+};
 async function listLogs(shape, session, flags, profile, operation, help, profileName) {
     const cursor = flags.cursor === undefined ? undefined : String(flags.cursor);
     if (cursor !== undefined && !cursor.trim())
@@ -277,7 +341,7 @@ async function listLogs(shape, session, flags, profile, operation, help, profile
     }
     const savedSelect = saved?.$select;
     const { select, fields } = selectedFields(flags, savedSelect === undefined ? shape.defaultSelect : fieldList(savedSelect, "select", shape.known, shape.knownList, help), shape.known, shape.knownList, help);
-    const scopes = scopesFor(flags, profile, help);
+    const scopes = scopesFor(flags, profile, help, shape.defaultScopes);
     const full = flags.full === true;
     const filter = boundedFilter(shape.dateField, flags, help);
     const query = { $select: select.join(",") };
@@ -313,21 +377,23 @@ async function listLogs(shape, session, flags, profile, operation, help, profile
     if (!result.complete) {
         return {
             [shape.key]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, shape.plural, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, `Resume losslessly with the same flags plus --cursor - ${profileHint(profileName)} and supply the returned cursor on stdin`, showHint],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
-        return { [shape.key]: rows, count, help: shape.emptyHints(profileName) };
+        return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.plural, true), complete: true, help: shape.emptyHints(profileName) };
     }
-    return { [shape.key]: rows, count, help: [...truncationHints, showHint] };
+    return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.plural, true), complete: true, help: [...truncationHints, showHint] };
 }
 const SIGNIN_SHOW = {
     noun: "sign-in",
     key: "signIn",
     param: "signIn-id",
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
     known: SIGNIN_KNOWN,
     knownList: KNOWN_SIGNIN_FIELDS,
     defaultSelect: DEFAULT_SIGNIN_SHOW_SELECT,
@@ -339,6 +405,7 @@ const AUDIT_SHOW = {
     noun: "directory-audit",
     key: "directoryAudit",
     param: "directoryAudit-id",
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
     known: AUDIT_KNOWN,
     knownList: KNOWN_AUDIT_FIELDS,
     defaultSelect: DEFAULT_AUDIT_SHOW_SELECT,
@@ -346,9 +413,21 @@ const AUDIT_SHOW = {
     denialHints: AUDIT_DENIAL_HINTS,
     idFlag: "<directory-audit-id>",
 };
+const PROVISIONING_SHOW = {
+    noun: "provisioning",
+    key: "provisioning",
+    param: "provisioningObjectSummary-id",
+    defaultScopes: DEFAULT_PROVISIONING_SCOPES,
+    known: PROVISIONING_KNOWN,
+    knownList: KNOWN_PROVISIONING_FIELDS,
+    defaultSelect: DEFAULT_PROVISIONING_SHOW_SELECT,
+    unavailable: {},
+    denialHints: PROVISIONING_DENIAL_HINTS,
+    idFlag: "<provisioning-id>",
+};
 async function showLog(shape, session, flags, profile, operation, help, profileName) {
     const { select, fields } = selectedFields(flags, shape.defaultSelect, shape.known, shape.knownList, help);
-    const scopes = scopesFor(flags, profile, help);
+    const scopes = scopesFor(flags, profile, help, shape.defaultScopes);
     const full = flags.full === true;
     const raw = await withGuidance(shape.denialHints, () => session.execute({
         profile,
@@ -379,3 +458,9 @@ export async function listDirectoryAudits(session, flags, profile, operation, he
 export async function showDirectoryAudit(session, flags, profile, operation, help, profileName) {
     return showLog(AUDIT_SHOW, session, flags, profile, operation, help, profileName);
 }
+export async function listProvisioning(session, flags, profile, operation, help, profileName) {
+    return listLogs(PROVISIONING_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showProvisioning(session, flags, profile, operation, help, profileName) {
+    return showLog(PROVISIONING_SHOW, session, flags, profile, operation, help, profileName);
+}

package/dist/entra-auth-methods.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // READ-04: the Entra authentication-method and registration-report read
 // mapping behind `mg-axi entra user authentication-method list` and
 // `mg-axi entra registration list`. Operation construction stays beside its
@@ -203,6 +204,7 @@ const REPORT_DENIAL_HINTS = [
 const METHOD_LIST = {
     command: "entra user authentication-method list",
     key: "authenticationMethods",
+    noun: "authentication methods",
     known: KNOWN_METHODS,
     knownList: KNOWN_METHOD_FIELDS,
     defaultSelect: DEFAULT_METHOD_SELECT,
@@ -218,6 +220,7 @@ const METHOD_LIST = {
 const REPORT_LIST = {
     command: "entra registration list",
     key: "registrationDetails",
+    noun: "registration rows",
     known: KNOWN_REPORT,
     knownList: KNOWN_REPORT_FIELDS,
     defaultSelect: DEFAULT_REPORT_SELECT,
@@ -274,16 +277,17 @@ async function listCollection(shape, session, flags, profile, operation, help, p
     if (!result.complete) {
         return {
             [shape.key]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, shape.noun, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, `Resume losslessly with the same flags plus --cursor <cursor-from-output> ${profileHint(profileName)}`, ...standing],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
-        return { [shape.key]: rows, count, help: [shape.emptyNote, ...standing] };
+        return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.noun, true), complete: true, help: [shape.emptyNote, ...standing] };
     }
-    return { [shape.key]: rows, count, help: [...truncationHints, ...standing] };
+    return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.noun, true), complete: true, help: [...truncationHints, ...standing] };
 }
 export async function listAuthenticationMethods(session, flags, profile, operation, help, profileName) {
     const user = String(flags.user);

package/dist/entra-certificate-auth.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // EXT-01 certificate-auth subfamily: the read mapping behind
 // `mg-axi entra certificate-auth-pki list/show/count` and
 // `mg-axi entra certificate-authority list/show/count`. Operation
@@ -242,16 +243,17 @@ export async function listCertificateAuthPkis(session, flags, profile, operation
     if (!result.complete) {
         return {
             certificateAuthPkis: pkis,
-            count: { returned: pkis.length, complete: false, reason: result.reason },
+            ...listTotals(pkis.length, result.total, "PKI configurations", false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resumeHint(profileName), showHint, EMPTY_PKI_NOTE],
         };
     }
-    const count = { returned: pkis.length, complete: true };
     if (!pkis.length) {
-        return { certificateAuthPkis: pkis, count, help: [EMPTY_PKI_NOTE] };
+        return { certificateAuthPkis: pkis, ...listTotals(pkis.length, result.total, "PKI configurations", true), complete: true, help: [EMPTY_PKI_NOTE] };
     }
-    return { certificateAuthPkis: pkis, count, help: [...truncationHints, showHint, EMPTY_PKI_NOTE] };
+    return { certificateAuthPkis: pkis, ...listTotals(pkis.length, result.total, "PKI configurations", true), complete: true, help: [...truncationHints, showHint, EMPTY_PKI_NOTE] };
 }
 export async function showCertificateAuthPki(session, flags, profile, operation, help, profileName) {
     const { select, fields } = selectedFields(flags, KNOWN_PKIS, KNOWN_PKI_FIELDS, DEFAULT_PKI_SHOW_SELECT, help, "PKI");
@@ -324,20 +326,22 @@ export async function listCertificateAuthorities(session, flags, profile, operat
     if (!result.complete) {
         return {
             certificateAuthorities: authorities,
-            count: { returned: authorities.length, complete: false, reason: result.reason },
+            ...listTotals(authorities.length, result.total, "certificate authorities", false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resumeHint(profileName), showHint, CERT_BLOB_NOTE],
         };
     }
-    const count = { returned: authorities.length, complete: true };
     if (!authorities.length) {
         return {
             certificateAuthorities: authorities,
-            count,
+            ...listTotals(authorities.length, result.total, "certificate authorities", true),
+            complete: true,
             help: ["0 certificate authorities matched; the absence of results is the answer, not an error", CERT_BLOB_NOTE],
         };
     }
-    return { certificateAuthorities: authorities, count, help: [...truncationHints, showHint, CERT_BLOB_NOTE] };
+    return { certificateAuthorities: authorities, ...listTotals(authorities.length, result.total, "certificate authorities", true), complete: true, help: [...truncationHints, showHint, CERT_BLOB_NOTE] };
 }
 export async function showCertificateAuthority(session, flags, profile, operation, help, profileName) {
     const { select, fields } = selectedFields(flags, KNOWN_CAS, KNOWN_CA_FIELDS, DEFAULT_CA_SHOW_SELECT, help, "certificate-authority");