@knowttl/mg-axi 0.1.2 → 0.1.4

package/dist/entra-conditional-access.js

@@ -3,7 +3,11 @@ import { listTotals } from "./list-totals.js";
 // READ-03: the Conditional Access read mapping behind
 // `mg-axi entra conditional-access policy list/show` and
 // `mg-axi entra conditional-access named-location list/show` as separate
-// az-style grammar. Operation construction stays beside its command; the
+// az-style grammar, plus the remaining v1.0 named collections under
+// `identity/conditionalAccess`: authentication-strength policies, each
+// policy's combination configurations, authentication method modes,
+// templates, authentication context class references and the deleted
+// policy and named-location collections. Operation construction stays beside its command; the
 // shared session owns URLs, credentials, paging, retries and error
 // translation, and the SDK owns TOON rendering. This module only maps flags
 // to session calls and projects rows for compact output. No policy mutation
@@ -11,13 +15,45 @@ import { listTotals } from "./list-totals.js";
 //
 // Reviewed against the v1.0 conditionalaccessroot-list-policies,
 // conditionalaccesspolicy-get, conditionalaccessroot-list-namedlocations and
-// countrynamedlocation-get operation documentation on 2026-10-04. All four
-// read D/A Policy.Read.All; delegated callers additionally need a supported
-// directory role (Conditional Access Administrator, Global Reader, Global
-// Secure Access Administrator, Security Administrator or Security Reader).
+// countrynamedlocation-get operation documentation on 2026-10-04, and the
+// authenticationstrengthroot-list-policies,
+// authenticationstrengthpolicy-get,
+// authenticationstrengthpolicy-list-combinationconfigurations,
+// authenticationcombinationconfiguration-get,
+// authenticationstrengthroot-list-authenticationmethodmodes,
+// authenticationmethodmodedetail-get, conditionalaccessroot-list-templates,
+// conditionalaccesstemplate-get, conditionalaccessroot-list-
+// authenticationcontextclassreferences and authenticationcontextclassreference-
+// get operation documentation on 2026-10-06. The deleted policy and
+// named-location collections carry no v1.0 operation-level documentation
+// page; their review follows the beta policyDeletableItem list/get contract
+// for conditional-access objects with the conditionalAccessPolicy,
+// namedLocation and policyDeletableItem resource references.
+// Policy and named-location reads need D/A Policy.Read.All; the
+// authentication-strength family (policies, combination configurations and
+// authentication method modes) reads D/A Policy.Read.AuthenticationMethod
+// instead, and template reads D/A Policy.Read.All. Delegated callers
+// additionally need a supported directory role (Conditional Access
+// Administrator, Security Administrator or Security Reader for the
+// strength family; those plus Global Reader and Global Secure Access
+// Administrator for policies, named locations and templates). The
+// authentication context class references read D/A
+// AuthenticationContext.Read.All with the same broad delegated role set.
+// Deleted policies and named locations read D/A Policy.Read.All with the
+// same broad delegated role set; restore is a beta-only mutation and stays
+// out of scope.
 // Conditional Access needs P1; risk-based Conditional Access needs P2. The
 // reviewed raw surface in src/api.ts carries exactly these routes, fields
 // and access choices; the named commands below reuse that contract.
+//
+// Deferred with reason: the parameterless
+// `authenticationStrength/policies/{id}/usage()` binds no placeholder, so
+// it never passes through the session's validated function-argument
+// binding (FUNCTION_ARGUMENT_BINDINGS covers only named-parameter
+// segments); widening the request-path guard for one function is out of
+// scope. Authentication context class references land here: the former
+// needs an AuthenticationContext.Read.All allowlist addition, now carried
+// in the session's READ_SCOPES set.
 // Every policy property this slice may request or display, matching the
 // reviewed raw surface. Anything else fails before credentials.
 export const KNOWN_POLICY_FIELDS = [
@@ -44,6 +80,61 @@ export const KNOWN_LOCATION_FIELDS = [
 ];
 const POLICY_KNOWN = new Set(KNOWN_POLICY_FIELDS);
 const LOCATION_KNOWN = new Set(KNOWN_LOCATION_FIELDS);
+// Every authentication-strength policy property this slice may request or
+// display, matching the reviewed raw surface.
+export const KNOWN_STRENGTH_FIELDS = [
+    "id",
+    "displayName",
+    "description",
+    "policyType",
+    "requirementsSatisfied",
+    "allowedCombinations",
+    "createdDateTime",
+    "modifiedDateTime",
+];
+// Every combination-configuration property this slice may request or
+// display: the base type carries only an identifier and the combinations
+// it applies to; subtype detail rides on @odata.type instead.
+export const KNOWN_COMBO_FIELDS = [
+    "id",
+    "appliesToCombinations",
+];
+// Every authentication method mode property this slice may request or
+// display, matching the reviewed raw surface.
+export const KNOWN_MODE_FIELDS = [
+    "id",
+    "displayName",
+    "authenticationMethod",
+];
+// Every Conditional Access template property this slice may request or
+// display, matching the reviewed raw surface.
+export const KNOWN_TEMPLATE_FIELDS = [
+    "id",
+    "name",
+    "description",
+    "scenarios",
+    "details",
+];
+// Every authentication context class reference property this slice may
+// request or display, matching the reviewed v1.0 resource shape.
+export const KNOWN_AUTH_CONTEXT_FIELDS = [
+    "id",
+    "displayName",
+    "description",
+    "isAvailable",
+];
+// Deleted policies and named locations return the underlying policy and
+// location objects with the soft-delete timestamp the policyDeletableItem
+// base type adds, so the reviewed sets extend the live ones.
+export const KNOWN_DELETED_POLICY_FIELDS = [...KNOWN_POLICY_FIELDS, "deletedDateTime"];
+export const KNOWN_DELETED_LOCATION_FIELDS = [...KNOWN_LOCATION_FIELDS, "deletedDateTime"];
+const STRENGTH_KNOWN = new Set(KNOWN_STRENGTH_FIELDS);
+const COMBO_KNOWN = new Set(KNOWN_COMBO_FIELDS);
+const MODE_KNOWN = new Set(KNOWN_MODE_FIELDS);
+const TEMPLATE_KNOWN = new Set(KNOWN_TEMPLATE_FIELDS);
+const AUTH_CONTEXT_KNOWN = new Set(KNOWN_AUTH_CONTEXT_FIELDS);
+const DELETED_POLICY_KNOWN = new Set(KNOWN_DELETED_POLICY_FIELDS);
+const DELETED_LOCATION_KNOWN = new Set(KNOWN_DELETED_LOCATION_FIELDS);
 // @odata.type is preserved on named-location rows without being selectable:
 // it names the location kind (ipNamedLocation versus countryNamedLocation).
 const LOCATION_TYPE_PROPERTY = "@odata.type";
@@ -58,8 +149,44 @@ const DEFAULT_POLICY_SHOW_SELECT = [...KNOWN_POLICY_FIELDS];
 const DEFAULT_LOCATION_LIST_SELECT = ["id", "displayName"];
 // Show rows: the full reviewed location set.
 const DEFAULT_LOCATION_SHOW_SELECT = [...KNOWN_LOCATION_FIELDS];
-// Policy.Read.All covers both families in both modes.
+// Compact strength rows: identifier, name and the built-in/custom kind.
+const DEFAULT_STRENGTH_LIST_SELECT = ["id", "displayName", "policyType"];
+// Fetch the full reviewed strength set for inspection.
+const DEFAULT_STRENGTH_SHOW_SELECT = [...KNOWN_STRENGTH_FIELDS];
+// Compact combination rows: the identifier; the kind rides as @odata.type.
+const DEFAULT_COMBO_LIST_SELECT = ["id"];
+// Show rows: the full reviewed base set.
+const DEFAULT_COMBO_SHOW_SELECT = [...KNOWN_COMBO_FIELDS];
+// Compact mode rows: identifier and name.
+const DEFAULT_MODE_LIST_SELECT = ["id", "displayName"];
+// Show rows: the full reviewed mode set.
+const DEFAULT_MODE_SHOW_SELECT = [...KNOWN_MODE_FIELDS];
+// Compact template rows: identifier and name.
+const DEFAULT_TEMPLATE_LIST_SELECT = ["id", "name"];
+// Show rows: the full reviewed template set.
+const DEFAULT_TEMPLATE_SHOW_SELECT = [...KNOWN_TEMPLATE_FIELDS];
+// Compact authentication-context rows: identifier and name.
+const DEFAULT_AUTH_CONTEXT_LIST_SELECT = ["id", "displayName"];
+// Show rows: the full reviewed authentication-context set.
+const DEFAULT_AUTH_CONTEXT_SHOW_SELECT = [...KNOWN_AUTH_CONTEXT_FIELDS];
+// Compact deleted-policy rows: identifier, name, enforcement state and the
+// soft-delete timestamp, which is the point of the deleted collection.
+const DEFAULT_DELETED_POLICY_LIST_SELECT = ["id", "displayName", "state", "deletedDateTime"];
+// Show rows: the full reviewed deleted-policy set.
+const DEFAULT_DELETED_POLICY_SHOW_SELECT = [...KNOWN_DELETED_POLICY_FIELDS];
+// Compact deleted-location rows: identifier, name and deletion timestamp;
+// the kind rides as @odata.type.
+const DEFAULT_DELETED_LOCATION_LIST_SELECT = ["id", "displayName", "deletedDateTime"];
+// Show rows: the full reviewed deleted-location set.
+const DEFAULT_DELETED_LOCATION_SHOW_SELECT = [...KNOWN_DELETED_LOCATION_FIELDS];
+// Policy.Read.All covers policies, named locations and templates in both modes.
 export const DEFAULT_DELEGATED_SCOPES = ["https://graph.microsoft.com/Policy.Read.All"];
+// Policy.Read.AuthenticationMethod is the least-privileged read for the
+// authentication-strength family in both modes.
+export const DEFAULT_STRENGTH_SCOPES = ["https://graph.microsoft.com/Policy.Read.AuthenticationMethod"];
+// AuthenticationContext.Read.All is the least-privileged read for the
+// authentication context class references in both modes.
+export const DEFAULT_AUTH_CONTEXT_SCOPES = ["https://graph.microsoft.com/AuthenticationContext.Read.All"];
 const TRUNCATE_AT = 500;
 function fieldList(raw, flag, known, knownList, noun, help) {
     const parts = String(raw)
@@ -81,7 +208,7 @@ function fieldList(raw, flag, known, knownList, noun, help) {
     }
     return fields;
 }
-function scopesFor(flags, profile, help) {
+function scopesFor(flags, profile, help, defaults = DEFAULT_DELEGATED_SCOPES) {
     if (profile.mode === "application") {
         if (flags.scopes !== undefined) {
             throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", [help, "mg-axi profile show --profile <name>"]);
@@ -89,7 +216,7 @@ function scopesFor(flags, profile, help) {
         return undefined;
     }
     if (flags.scopes === undefined)
-        return [...DEFAULT_DELEGATED_SCOPES];
+        return [...defaults];
     const scopes = String(flags.scopes)
         .split(",")
         .map(scope => scope.trim())
@@ -180,6 +307,39 @@ const LOCATION_DENIAL_HINTS = [
     "Named-location reads need Policy.Read.All plus a supported directory role: Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader for delegated access, or admin-consented Policy.Read.All for application access",
     "Conditional Access and named locations need P1; risk-based Conditional Access needs P2",
 ];
+// The authentication-strength family (strength policies, combination
+// configurations, authentication method modes) reads the least-privileged
+// Policy.Read.AuthenticationMethod instead of Policy.Read.All, with the
+// narrower Conditional Access Administrator / Security Administrator /
+// Security Reader role set.
+const STRENGTH_DENIAL_HINTS = [
+    "Authentication-strength reads need Policy.Read.AuthenticationMethod plus a supported directory role: Conditional Access Administrator, Security Administrator or Security Reader for delegated access, or admin-consented Policy.Read.AuthenticationMethod for application access",
+    "Conditional Access needs P1",
+];
+const TEMPLATE_DENIAL_HINTS = [
+    "Conditional Access template reads need Policy.Read.All plus a supported directory role: Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader for delegated access, or admin-consented Policy.Read.All for application access",
+    "Conditional Access needs P1",
+];
+// Authentication-context reads carry the least-privileged
+// AuthenticationContext.Read.All with the broad Conditional Access role
+// set shared with policies, named locations and templates.
+const AUTH_CONTEXT_DENIAL_HINTS = [
+    "Authentication-context reads need AuthenticationContext.Read.All plus a supported directory role: Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader for delegated access, or admin-consented AuthenticationContext.Read.All for application access",
+    "Conditional Access needs P1",
+];
+// Deleted policy and named-location reads keep Policy.Read.All with the
+// broad Conditional Access role set; restore is a beta-only mutation, so
+// denial guidance never offers it as a next step.
+const DELETED_POLICY_DENIAL_HINTS = [
+    "Deleted-policy reads need Policy.Read.All plus a supported directory role: Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader for delegated access, or admin-consented Policy.Read.All for application access",
+    "Deleted policies restore within 30 days; restore is a beta-only mutation outside mg-axi scope",
+    "Conditional Access needs P1",
+];
+const DELETED_LOCATION_DENIAL_HINTS = [
+    "Deleted named-location reads need Policy.Read.All plus a supported directory role: Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader for delegated access, or admin-consented Policy.Read.All for application access",
+    "Deleted named locations restore within 30 days; restore is a beta-only mutation outside mg-axi scope",
+    "Conditional Access and named locations need P1",
+];
 const POLICY_LIST = {
     command: "entra conditional-access policy list",
     key: "policies",
@@ -188,6 +348,7 @@ const POLICY_LIST = {
     known: POLICY_KNOWN,
     knownList: KNOWN_POLICY_FIELDS,
     defaultSelect: DEFAULT_POLICY_LIST_SELECT,
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
     denialHints: POLICY_DENIAL_HINTS,
     showHint: "mg-axi entra conditional-access policy show --id <policy-id>",
     emptyHint: "0 conditional-access policies matched; the absence of results is the answer, not an error",
@@ -201,6 +362,7 @@ const LOCATION_LIST = {
     known: LOCATION_KNOWN,
     knownList: KNOWN_LOCATION_FIELDS,
     defaultSelect: DEFAULT_LOCATION_LIST_SELECT,
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
     denialHints: LOCATION_DENIAL_HINTS,
     showHint: "mg-axi entra conditional-access named-location show --id <named-location-id>",
     emptyHint: "0 named locations matched; the absence of results is the answer, not an error",
@@ -212,12 +374,19 @@ async function listCollection(shape, session, flags, profile, operation, help, p
         throw new AxiError("--cursor needs the opaque cursor from a partial result", "VALIDATION_ERROR", [help]);
     const savedSelect = cursor === undefined ? undefined : session.cursorQuery(operation, cursor).$select;
     const { select, fields } = selectedFields(flags, savedSelect === undefined ? shape.defaultSelect : fieldList(savedSelect, "select", shape.known, shape.knownList, shape.noun, help), shape.known, shape.knownList, shape.noun, help);
-    const scopes = scopesFor(flags, profile, help);
+    const scopes = scopesFor(flags, profile, help, shape.defaultScopes);
     const full = flags.full === true;
     const query = { $select: select.join(",") };
     if (flags.filter !== undefined)
         query.$filter = String(flags.filter);
     const args = { profile, operation, query, scopes };
+    if (shape.parent !== undefined) {
+        const raw = flags[shape.parent.flag];
+        if (raw === undefined || !String(raw).trim()) {
+            throw new AxiError(`--${shape.parent.flag} needs the ${shape.parent.label}`, "VALIDATION_ERROR", [help]);
+        }
+        args.params = { [shape.parent.param]: String(raw) };
+    }
     if (cursor !== undefined)
         args.cursor = cursor;
     if (flags.all === true) {
@@ -273,6 +442,7 @@ const POLICY_SHOW = {
     known: POLICY_KNOWN,
     knownList: KNOWN_POLICY_FIELDS,
     defaultSelect: DEFAULT_POLICY_SHOW_SELECT,
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
     denialHints: POLICY_DENIAL_HINTS,
     preserveType: false,
 };
@@ -284,17 +454,26 @@ const LOCATION_SHOW = {
     known: LOCATION_KNOWN,
     knownList: KNOWN_LOCATION_FIELDS,
     defaultSelect: DEFAULT_LOCATION_SHOW_SELECT,
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
     denialHints: LOCATION_DENIAL_HINTS,
     preserveType: true,
 };
 async function showSingle(shape, session, flags, profile, operation, help, profileName) {
     const { select, fields } = selectedFields(flags, shape.defaultSelect, shape.known, shape.knownList, shape.noun, help);
-    const scopes = scopesFor(flags, profile, help);
+    const scopes = scopesFor(flags, profile, help, shape.defaultScopes);
     const full = flags.full === true;
+    const params = { [shape.param]: String(flags.id) };
+    if (shape.parent !== undefined) {
+        const raw = flags[shape.parent.flag];
+        if (raw === undefined || !String(raw).trim()) {
+            throw new AxiError(`--${shape.parent.flag} needs the ${shape.parent.label}`, "VALIDATION_ERROR", [help]);
+        }
+        params[shape.parent.param] = String(raw);
+    }
     const raw = await withGuidance(shape.denialHints, () => session.execute({
         profile,
         operation,
-        params: { [shape.param]: String(flags.id) },
+        params,
         query: { $select: select.join(",") },
         scopes,
     }));
@@ -320,3 +499,229 @@ export async function listNamedLocations(session, flags, profile, operation, hel
 export async function showNamedLocation(session, flags, profile, operation, help, profileName) {
     return showSingle(LOCATION_SHOW, session, flags, profile, operation, help, profileName);
 }
+const STRENGTH_LIST = {
+    command: "entra conditional-access auth-strength-policy list",
+    key: "authStrengthPolicies",
+    noun: "auth-strength-policy",
+    known: STRENGTH_KNOWN,
+    knownList: KNOWN_STRENGTH_FIELDS,
+    defaultSelect: DEFAULT_STRENGTH_LIST_SELECT,
+    defaultScopes: DEFAULT_STRENGTH_SCOPES,
+    denialHints: STRENGTH_DENIAL_HINTS,
+    showHint: "mg-axi entra conditional-access auth-strength-policy show --id <auth-strength-policy-id>",
+    emptyHint: "0 authentication-strength policies matched; the absence of results is the answer, not an error",
+    preserveType: false,
+    plural: "auth-strength policies",
+};
+const COMBO_LIST = {
+    command: "entra conditional-access combination-configuration list",
+    key: "combinationConfigurations",
+    noun: "combination-configuration",
+    known: COMBO_KNOWN,
+    knownList: KNOWN_COMBO_FIELDS,
+    defaultSelect: DEFAULT_COMBO_LIST_SELECT,
+    defaultScopes: DEFAULT_STRENGTH_SCOPES,
+    denialHints: STRENGTH_DENIAL_HINTS,
+    showHint: "mg-axi entra conditional-access combination-configuration show --policy <auth-strength-policy-id> --id <combination-configuration-id>",
+    emptyHint: "0 combination configurations matched; the absence of results is the answer, not an error",
+    preserveType: true,
+    parent: { param: "authenticationStrengthPolicy-id", flag: "policy", label: "authentication-strength policy ID owning the combination configurations" },
+    plural: "combination configurations",
+};
+const MODE_LIST = {
+    command: "entra conditional-access auth-method-mode list",
+    key: "authMethodModes",
+    noun: "auth-method-mode",
+    known: MODE_KNOWN,
+    knownList: KNOWN_MODE_FIELDS,
+    defaultSelect: DEFAULT_MODE_LIST_SELECT,
+    defaultScopes: DEFAULT_STRENGTH_SCOPES,
+    denialHints: STRENGTH_DENIAL_HINTS,
+    showHint: "mg-axi entra conditional-access auth-method-mode show --id <auth-method-mode-id>",
+    emptyHint: "0 authentication method modes matched; the absence of results is the answer, not an error",
+    preserveType: false,
+    plural: "auth-method modes",
+};
+const TEMPLATE_LIST = {
+    command: "entra conditional-access template list",
+    key: "templates",
+    noun: "template",
+    known: TEMPLATE_KNOWN,
+    knownList: KNOWN_TEMPLATE_FIELDS,
+    defaultSelect: DEFAULT_TEMPLATE_LIST_SELECT,
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
+    denialHints: TEMPLATE_DENIAL_HINTS,
+    showHint: "mg-axi entra conditional-access template show --id <template-id>",
+    emptyHint: "0 Conditional Access templates matched; the absence of results is the answer, not an error",
+    preserveType: false,
+    plural: "templates",
+};
+const STRENGTH_SHOW = {
+    command: "entra conditional-access auth-strength-policy show",
+    key: "authStrengthPolicy",
+    param: "authenticationStrengthPolicy-id",
+    noun: "auth-strength-policy",
+    known: STRENGTH_KNOWN,
+    knownList: KNOWN_STRENGTH_FIELDS,
+    defaultSelect: DEFAULT_STRENGTH_SHOW_SELECT,
+    defaultScopes: DEFAULT_STRENGTH_SCOPES,
+    denialHints: STRENGTH_DENIAL_HINTS,
+    preserveType: false,
+};
+const COMBO_SHOW = {
+    command: "entra conditional-access combination-configuration show",
+    key: "combinationConfiguration",
+    param: "authenticationCombinationConfiguration-id",
+    noun: "combination-configuration",
+    known: COMBO_KNOWN,
+    knownList: KNOWN_COMBO_FIELDS,
+    defaultSelect: DEFAULT_COMBO_SHOW_SELECT,
+    defaultScopes: DEFAULT_STRENGTH_SCOPES,
+    denialHints: STRENGTH_DENIAL_HINTS,
+    preserveType: true,
+    parent: { param: "authenticationStrengthPolicy-id", flag: "policy", label: "authentication-strength policy ID owning the combination configuration" },
+};
+const MODE_SHOW = {
+    command: "entra conditional-access auth-method-mode show",
+    key: "authMethodMode",
+    param: "authenticationMethodModeDetail-id",
+    noun: "auth-method-mode",
+    known: MODE_KNOWN,
+    knownList: KNOWN_MODE_FIELDS,
+    defaultSelect: DEFAULT_MODE_SHOW_SELECT,
+    defaultScopes: DEFAULT_STRENGTH_SCOPES,
+    denialHints: STRENGTH_DENIAL_HINTS,
+    preserveType: false,
+};
+const TEMPLATE_SHOW = {
+    command: "entra conditional-access template show",
+    key: "template",
+    param: "conditionalAccessTemplate-id",
+    noun: "template",
+    known: TEMPLATE_KNOWN,
+    knownList: KNOWN_TEMPLATE_FIELDS,
+    defaultSelect: DEFAULT_TEMPLATE_SHOW_SELECT,
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
+    denialHints: TEMPLATE_DENIAL_HINTS,
+    preserveType: false,
+};
+export async function listAuthStrengthPolicies(session, flags, profile, operation, help, profileName) {
+    return listCollection(STRENGTH_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showAuthStrengthPolicy(session, flags, profile, operation, help, profileName) {
+    return showSingle(STRENGTH_SHOW, session, flags, profile, operation, help, profileName);
+}
+export async function listCombinationConfigurations(session, flags, profile, operation, help, profileName) {
+    return listCollection(COMBO_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showCombinationConfiguration(session, flags, profile, operation, help, profileName) {
+    return showSingle(COMBO_SHOW, session, flags, profile, operation, help, profileName);
+}
+export async function listAuthMethodModes(session, flags, profile, operation, help, profileName) {
+    return listCollection(MODE_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showAuthMethodMode(session, flags, profile, operation, help, profileName) {
+    return showSingle(MODE_SHOW, session, flags, profile, operation, help, profileName);
+}
+export async function listTemplates(session, flags, profile, operation, help, profileName) {
+    return listCollection(TEMPLATE_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showTemplate(session, flags, profile, operation, help, profileName) {
+    return showSingle(TEMPLATE_SHOW, session, flags, profile, operation, help, profileName);
+}
+const AUTH_CONTEXT_LIST = {
+    command: "entra conditional-access auth-context list",
+    key: "authContexts",
+    noun: "auth-context",
+    plural: "auth contexts",
+    known: AUTH_CONTEXT_KNOWN,
+    knownList: KNOWN_AUTH_CONTEXT_FIELDS,
+    defaultSelect: DEFAULT_AUTH_CONTEXT_LIST_SELECT,
+    defaultScopes: DEFAULT_AUTH_CONTEXT_SCOPES,
+    denialHints: AUTH_CONTEXT_DENIAL_HINTS,
+    showHint: "mg-axi entra conditional-access auth-context show --id <auth-context-id>",
+    emptyHint: "0 authentication context class references matched; the absence of results is the answer, not an error",
+    preserveType: false,
+};
+const DELETED_POLICY_LIST = {
+    command: "entra conditional-access deleted-policy list",
+    key: "deletedPolicies",
+    noun: "deleted-policy",
+    plural: "deleted policies",
+    known: DELETED_POLICY_KNOWN,
+    knownList: KNOWN_DELETED_POLICY_FIELDS,
+    defaultSelect: DEFAULT_DELETED_POLICY_LIST_SELECT,
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
+    denialHints: DELETED_POLICY_DENIAL_HINTS,
+    showHint: "mg-axi entra conditional-access deleted-policy show --id <deleted-policy-id>",
+    emptyHint: "0 deleted policies matched; the absence of results is the answer, not an error",
+    preserveType: false,
+};
+const DELETED_LOCATION_LIST = {
+    command: "entra conditional-access deleted-named-location list",
+    key: "deletedNamedLocations",
+    noun: "deleted-named-location",
+    plural: "deleted named locations",
+    known: DELETED_LOCATION_KNOWN,
+    knownList: KNOWN_DELETED_LOCATION_FIELDS,
+    defaultSelect: DEFAULT_DELETED_LOCATION_LIST_SELECT,
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
+    denialHints: DELETED_LOCATION_DENIAL_HINTS,
+    showHint: "mg-axi entra conditional-access deleted-named-location show --id <deleted-named-location-id>",
+    emptyHint: "0 deleted named locations matched; the absence of results is the answer, not an error",
+    preserveType: true,
+};
+const AUTH_CONTEXT_SHOW = {
+    command: "entra conditional-access auth-context show",
+    key: "authContext",
+    param: "authenticationContextClassReference-id",
+    noun: "auth-context",
+    known: AUTH_CONTEXT_KNOWN,
+    knownList: KNOWN_AUTH_CONTEXT_FIELDS,
+    defaultSelect: DEFAULT_AUTH_CONTEXT_SHOW_SELECT,
+    defaultScopes: DEFAULT_AUTH_CONTEXT_SCOPES,
+    denialHints: AUTH_CONTEXT_DENIAL_HINTS,
+    preserveType: false,
+};
+const DELETED_POLICY_SHOW = {
+    command: "entra conditional-access deleted-policy show",
+    key: "deletedPolicy",
+    param: "conditionalAccessPolicy-id",
+    noun: "deleted-policy",
+    known: DELETED_POLICY_KNOWN,
+    knownList: KNOWN_DELETED_POLICY_FIELDS,
+    defaultSelect: DEFAULT_DELETED_POLICY_SHOW_SELECT,
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
+    denialHints: DELETED_POLICY_DENIAL_HINTS,
+    preserveType: false,
+};
+const DELETED_LOCATION_SHOW = {
+    command: "entra conditional-access deleted-named-location show",
+    key: "deletedNamedLocation",
+    param: "namedLocation-id",
+    noun: "deleted-named-location",
+    known: DELETED_LOCATION_KNOWN,
+    knownList: KNOWN_DELETED_LOCATION_FIELDS,
+    defaultSelect: DEFAULT_DELETED_LOCATION_SHOW_SELECT,
+    defaultScopes: DEFAULT_DELEGATED_SCOPES,
+    denialHints: DELETED_LOCATION_DENIAL_HINTS,
+    preserveType: true,
+};
+export async function listAuthContexts(session, flags, profile, operation, help, profileName) {
+    return listCollection(AUTH_CONTEXT_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showAuthContext(session, flags, profile, operation, help, profileName) {
+    return showSingle(AUTH_CONTEXT_SHOW, session, flags, profile, operation, help, profileName);
+}
+export async function listDeletedPolicies(session, flags, profile, operation, help, profileName) {
+    return listCollection(DELETED_POLICY_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showDeletedPolicy(session, flags, profile, operation, help, profileName) {
+    return showSingle(DELETED_POLICY_SHOW, session, flags, profile, operation, help, profileName);
+}
+export async function listDeletedNamedLocations(session, flags, profile, operation, help, profileName) {
+    return listCollection(DELETED_LOCATION_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showDeletedNamedLocation(session, flags, profile, operation, help, profileName) {
+    return showSingle(DELETED_LOCATION_SHOW, session, flags, profile, operation, help, profileName);
+}

package/dist/entra-federation-configurations.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // EXT-01 directory federation-configurations subfamily: the read mapping
 // behind `mg-axi entra federation-configuration list/show/count/available-types`.
 // Operation construction stays beside its command; the shared session owns
@@ -203,20 +204,22 @@ export async function listFederationConfigurations(session, flags, profile, oper
     if (!result.complete) {
         return {
             federationConfigurations: configurations,
-            count: { returned: configurations.length, complete: false, reason: result.reason },
+            ...listTotals(configurations.length, result.total, "federation configurations", false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, `Resume losslessly with the same flags plus --cursor <cursor-from-output> ${profileHint(profileName)}`, showHint, CERT_BLOB_NOTE, WORKFORCE_NOTE],
         };
     }
-    const count = { returned: configurations.length, complete: true };
     if (!configurations.length) {
         return {
             federationConfigurations: configurations,
-            count,
+            ...listTotals(configurations.length, result.total, "federation configurations", true),
+            complete: true,
             help: ["0 federation configurations matched; no SAML or WS-Fed federation is configured for the tenant, or no row passed --filter", CERT_BLOB_NOTE, WORKFORCE_NOTE],
         };
     }
-    return { federationConfigurations: configurations, count, help: [...truncationHints, showHint, CERT_BLOB_NOTE, WORKFORCE_NOTE] };
+    return { federationConfigurations: configurations, ...listTotals(configurations.length, result.total, "federation configurations", true), complete: true, help: [...truncationHints, showHint, CERT_BLOB_NOTE, WORKFORCE_NOTE] };
 }
 export async function showFederationConfiguration(session, flags, profile, operation, help, profileName) {
     const { select, fields } = selectedFields(flags, DEFAULT_SHOW_SELECT, help);

package/dist/entra-grants.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // READ-08: the Entra consent-grant read mapping behind
 // `mg-axi entra service-principal oauth2-grant list` and
 // `mg-axi entra service-principal app-role-assignment list` for a named
@@ -181,6 +182,7 @@ const APP_ROLE_DENIAL_HINTS = [
 const OAUTH2_GRANT_LIST = {
     command: "entra service-principal oauth2-grant list",
     key: "oauth2PermissionGrants",
+    noun: "oauth2 grants",
     known: GRANT_KNOWN,
     knownList: KNOWN_GRANT_FIELDS,
     defaultSelect: DEFAULT_GRANT_SELECT,
@@ -192,6 +194,7 @@ const OAUTH2_GRANT_LIST = {
 const APP_ROLE_LIST = {
     command: "entra service-principal app-role-assignment list",
     key: "appRoleAssignments",
+    noun: "app role assignments",
     known: APP_ROLE_KNOWN,
     knownList: KNOWN_APP_ROLE_FIELDS,
     defaultSelect: DEFAULT_APP_ROLE_SELECT,
@@ -253,16 +256,17 @@ async function listCollection(shape, session, flags, profile, operation, help, p
     if (!result.complete) {
         return {
             [shape.key]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, shape.noun, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, `Resume losslessly with the same flags plus --cursor <cursor-from-output> ${profileHint(profileName)}`, ...standing],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
-        return { [shape.key]: rows, count, help: [shape.emptyNote, ...standing] };
+        return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.noun, true), complete: true, help: [shape.emptyNote, ...standing] };
     }
-    return { [shape.key]: rows, count, help: [...truncationHints, ...standing] };
+    return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.noun, true), complete: true, help: [...truncationHints, ...standing] };
 }
 export async function listOAuth2Grants(session, flags, profile, operation, help, profileName) {
     return listCollection(OAUTH2_GRANT_LIST, session, flags, profile, operation, help, profileName);

package/dist/entra-group-lifecycle.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // EXT-01 group lifecycle subfamily: the read mapping behind
 // `mg-axi entra group-lifecycle-policy list/show/count` and
 // `mg-axi entra group-setting-template list/show/count`. Operation
@@ -241,20 +242,22 @@ export async function listLifecyclePolicies(session, flags, profile, operation,
     if (!result.complete) {
         return {
             groupLifecyclePolicies: policies,
-            count: { returned: policies.length, complete: false, reason: result.reason },
+            ...listTotals(policies.length, result.total, "lifecycle policies", false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resumeHint(profileName), showHint],
         };
     }
-    const count = { returned: policies.length, complete: true };
     if (!policies.length) {
         return {
             groupLifecyclePolicies: policies,
-            count,
+            ...listTotals(policies.length, result.total, "lifecycle policies", true),
+            complete: true,
             help: ["0 lifecycle policies matched; the absence of results is the answer, not an error"],
         };
     }
-    return { groupLifecyclePolicies: policies, count, help: [...truncationHints, showHint] };
+    return { groupLifecyclePolicies: policies, ...listTotals(policies.length, result.total, "lifecycle policies", true), complete: true, help: [...truncationHints, showHint] };
 }
 export async function showLifecyclePolicy(session, flags, profile, operation, help, profileName) {
     const { select, fields } = selectedFields(flags, KNOWN_LIFECYCLE, KNOWN_LIFECYCLE_FIELDS, DEFAULT_LIFECYCLE_SHOW_SELECT, help);
@@ -305,20 +308,22 @@ export async function listSettingTemplates(session, flags, profile, operation, h
     if (!result.complete) {
         return {
             groupSettingTemplates: templates,
-            count: { returned: templates.length, complete: false, reason: result.reason },
+            ...listTotals(templates.length, result.total, "setting templates", false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resumeHint(profileName), showHint, filterNote],
         };
     }
-    const count = { returned: templates.length, complete: true };
     if (!templates.length) {
         return {
             groupSettingTemplates: templates,
-            count,
+            ...listTotals(templates.length, result.total, "setting templates", true),
+            complete: true,
             help: [filterNote, "0 setting templates matched; the absence of results is the answer, not an error"],
         };
     }
-    return { groupSettingTemplates: templates, count, help: [...truncationHints, showHint, filterNote] };
+    return { groupSettingTemplates: templates, ...listTotals(templates.length, result.total, "setting templates", true), complete: true, help: [...truncationHints, showHint, filterNote] };
 }
 export async function showSettingTemplate(session, flags, profile, operation, help, profileName) {
     const { select, fields } = selectedFields(flags, KNOWN_TEMPLATES, KNOWN_TEMPLATE_FIELDS, DEFAULT_TEMPLATE_SHOW_SELECT, help);