@knowttl/mg-axi 0.1.2 → 0.1.4

package/dist/entra-identity-providers.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // EXT-03 workforce identity-providers subfamily: the read mapping behind
 // `mg-axi entra identity-provider list/show/count/available-types`. Operation construction
 // stays beside its command; the shared session owns URLs, credentials,
@@ -217,20 +218,22 @@ export async function listIdentityProviders(session, flags, profile, operation,
     if (!result.complete) {
         return {
             identityProviders: providers,
-            count: { returned: providers.length, complete: false, reason: result.reason },
+            ...listTotals(providers.length, result.total, "identity providers", false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, `Resume losslessly with the same flags plus --cursor <cursor-from-output> ${profileHint(profileName)}`, showHint, WORKFORCE_NOTE],
         };
     }
-    const count = { returned: providers.length, complete: true };
     if (!providers.length) {
         return {
             identityProviders: providers,
-            count,
+            ...listTotals(providers.length, result.total, "identity providers", true),
+            complete: true,
             help: [WORKFORCE_NOTE, "0 identity providers matched; the absence of results is the answer, not an error"],
         };
     }
-    return { identityProviders: providers, count, help: [...truncationHints, showHint, WORKFORCE_NOTE] };
+    return { identityProviders: providers, ...listTotals(providers.length, result.total, "identity providers", true), complete: true, help: [...truncationHints, showHint, WORKFORCE_NOTE] };
 }
 export async function showIdentityProvider(session, flags, profile, operation, help, profileName) {
     const { select, fields } = selectedFields(flags, DEFAULT_SHOW_SELECT, help);

package/dist/entra-lifecycle-workflows.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // EXT-02 lifecycle-workflows reads: the read-only workflow, workflow
 // template, task definition and tenant-settings first part, the
 // second-part top-level run and user/subject processing-result reads, the
@@ -403,6 +404,7 @@ function runId(flags, help) {
 const WORKFLOW_LIST = {
     command: "entra lifecycle workflow list",
     key: "workflows",
+    totalsNoun: "workflows",
     known: WORKFLOW_KNOWN,
     knownList: KNOWN_WORKFLOW_FIELDS,
     defaultSelect: DEFAULT_WORKFLOW_LIST_SELECT,
@@ -417,6 +419,7 @@ const WORKFLOW_LIST = {
 const WORKFLOW_TEMPLATE_LIST = {
     command: "entra lifecycle workflow-template list",
     key: "workflowTemplates",
+    totalsNoun: "workflow templates",
     known: WORKFLOW_TEMPLATE_KNOWN,
     knownList: KNOWN_WORKFLOW_TEMPLATE_FIELDS,
     defaultSelect: DEFAULT_WORKFLOW_TEMPLATE_LIST_SELECT,
@@ -431,6 +434,7 @@ const WORKFLOW_TEMPLATE_LIST = {
 const TASK_DEFINITION_LIST = {
     command: "entra lifecycle task-definition list",
     key: "taskDefinitions",
+    totalsNoun: "task definitions",
     known: TASK_DEFINITION_KNOWN,
     knownList: KNOWN_TASK_DEFINITION_FIELDS,
     defaultSelect: DEFAULT_TASK_DEFINITION_LIST_SELECT,
@@ -445,6 +449,7 @@ const TASK_DEFINITION_LIST = {
 const RUN_LIST = {
     command: "entra lifecycle run list",
     key: "runs",
+    totalsNoun: "runs",
     known: RUN_KNOWN,
     knownList: KNOWN_RUN_FIELDS,
     defaultSelect: DEFAULT_RUN_LIST_SELECT,
@@ -459,6 +464,7 @@ const RUN_LIST = {
 const USER_PROCESSING_LIST = {
     command: "entra lifecycle user-processing-result list",
     key: "userProcessingResults",
+    totalsNoun: "user processing results",
     known: USER_PROCESSING_KNOWN,
     knownList: KNOWN_USER_PROCESSING_FIELDS,
     defaultSelect: DEFAULT_USER_PROCESSING_LIST_SELECT,
@@ -473,6 +479,7 @@ const USER_PROCESSING_LIST = {
 const SUBJECT_PROCESSING_LIST = {
     command: "entra lifecycle subject-processing-result list",
     key: "subjectProcessingResults",
+    totalsNoun: "subject processing results",
     known: SUBJECT_PROCESSING_KNOWN,
     knownList: KNOWN_SUBJECT_PROCESSING_FIELDS,
     defaultSelect: DEFAULT_SUBJECT_PROCESSING_FIELDS,
@@ -488,6 +495,7 @@ const SUBJECT_PROCESSING_LIST = {
 const TASK_REPORT_LIST = {
     command: "entra lifecycle task-report list",
     key: "taskReports",
+    totalsNoun: "task reports",
     known: TASK_REPORT_KNOWN,
     knownList: KNOWN_TASK_REPORT_FIELDS,
     defaultSelect: DEFAULT_TASK_REPORT_LIST_SELECT,
@@ -502,6 +510,7 @@ const TASK_REPORT_LIST = {
 const RUN_USER_PROCESSING_LIST = {
     command: "entra lifecycle run user-processing-result list",
     key: "userProcessingResults",
+    totalsNoun: "user processing results",
     known: USER_PROCESSING_KNOWN,
     knownList: KNOWN_USER_PROCESSING_FIELDS,
     defaultSelect: DEFAULT_USER_PROCESSING_LIST_SELECT,
@@ -516,6 +525,7 @@ const RUN_USER_PROCESSING_LIST = {
 const RUN_SUBJECT_PROCESSING_LIST = {
     command: "entra lifecycle run subject-processing-result list",
     key: "subjectProcessingResults",
+    totalsNoun: "subject processing results",
     known: SUBJECT_PROCESSING_KNOWN,
     knownList: KNOWN_SUBJECT_PROCESSING_FIELDS,
     defaultSelect: DEFAULT_SUBJECT_PROCESSING_FIELDS,
@@ -531,6 +541,7 @@ const RUN_SUBJECT_PROCESSING_LIST = {
 const RUN_TASK_PROCESSING_LIST = {
     command: "entra lifecycle run task-processing-result list",
     key: "taskProcessingResults",
+    totalsNoun: "task processing results",
     known: TASK_PROCESSING_KNOWN,
     knownList: KNOWN_TASK_PROCESSING_FIELDS,
     defaultSelect: DEFAULT_TASK_PROCESSING_LIST_SELECT,
@@ -605,16 +616,17 @@ async function listCollection(shape, session, flags, profile, operation, help, p
     if (!result.complete) {
         return {
             [shape.key]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, shape.totalsNoun, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resume, ...standing],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
-        return { [shape.key]: rows, count, help: [shape.emptyNote, ...standing] };
+        return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.totalsNoun, true), complete: true, help: [shape.emptyNote, ...standing] };
     }
-    return { [shape.key]: rows, count, help: [...truncationHints, ...standing] };
+    return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.totalsNoun, true), complete: true, help: [...truncationHints, ...standing] };
 }
 async function showOne(key, command, known, knownList, defaultSelect, defaultScopes, hints, session, flags, profile, operation, help, profileName, params, malformed, queryless = false) {
     if (queryless && flags.select !== undefined) {

package/dist/entra-multi-tenant-organization.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // EXT-04 multi-tenant-organization subfamily: the read mapping behind
 // `mg-axi entra multi-tenant-organization show`,
 // `mg-axi entra multi-tenant-organization join-request show`,
@@ -276,20 +277,22 @@ export async function listMultiTenantOrganizationTenants(session, flags, profile
     if (!result.complete) {
         return {
             multiTenantOrganizationTenants: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, "tenants", false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resumeHint(profileName), countHint, MTO_NOTE],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
         return {
             multiTenantOrganizationTenants: rows,
-            count,
+            ...listTotals(rows.length, result.total, "tenants", true),
+            complete: true,
             help: ["0 tenants matched; the absence of results is the answer, not an error", MTO_NOTE],
         };
     }
-    return { multiTenantOrganizationTenants: rows, count, help: [...truncationHints, countHint, MTO_NOTE] };
+    return { multiTenantOrganizationTenants: rows, ...listTotals(rows.length, result.total, "tenants", true), complete: true, help: [...truncationHints, countHint, MTO_NOTE] };
 }
 // The $count route returns a text/plain integer scalar rather than a JSON
 // collection, so the leaf reads it through session.execute and accepts only

package/dist/entra-on-premises-synchronization.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // EXT-01 on-premises-synchronization subfamily: the read mapping behind
 // `mg-axi entra on-premises-synchronization list/show`. Operation
 // construction stays beside its command; the shared session owns URLs,
@@ -201,16 +202,17 @@ export async function listSynchronizations(session, flags, profile, operation, h
     if (!result.complete) {
         return {
             synchronizations,
-            count: { returned: synchronizations.length, complete: false, reason: result.reason },
+            ...listTotals(synchronizations.length, result.total, "synchronizations", false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resumeHint(profileName), showHint],
         };
     }
-    const count = { returned: synchronizations.length, complete: true };
     if (!synchronizations.length) {
-        return { synchronizations, count, help: [EMPTY_NOTE] };
+        return { synchronizations, ...listTotals(synchronizations.length, result.total, "synchronizations", true), complete: true, help: [EMPTY_NOTE] };
     }
-    return { synchronizations, count, help: [...truncationHints, showHint] };
+    return { synchronizations, ...listTotals(synchronizations.length, result.total, "synchronizations", true), complete: true, help: [...truncationHints, showHint] };
 }
 export async function showSynchronization(session, flags, profile, operation, help, profileName) {
     const { select, fields } = selectedFields(flags, DEFAULT_SHOW_SELECT, help);

package/dist/entra-risk-prevention.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // EXT-03 risk-prevention subfamily: the read mapping behind
 // `mg-axi entra fraud-protection-provider list/show/count`,
 // `mg-axi entra web-application-firewall-provider list/show/count` and
@@ -127,6 +128,7 @@ export const DEFAULT_RISK_SCOPES = ["https://graph.microsoft.com/RiskPreventionP
 const TRUNCATE_AT = 500;
 const FRAUD_KIND = {
     noun: "fraud-protection-provider",
+    totalsNoun: "fraud protection providers",
     known: KNOWN_FRAUD,
     knownList: KNOWN_FRAUD_FIELDS,
     listSelect: DEFAULT_FRAUD_LIST_SELECT,
@@ -137,6 +139,7 @@ const FRAUD_KIND = {
 };
 const WAF_KIND = {
     noun: "web-application-firewall-provider",
+    totalsNoun: "web application firewall providers",
     known: KNOWN_WAF,
     knownList: KNOWN_WAF_FIELDS,
     listSelect: DEFAULT_WAF_LIST_SELECT,
@@ -147,6 +150,7 @@ const WAF_KIND = {
 };
 const VERIFICATION_KIND = {
     noun: "web-application-firewall-verification",
+    totalsNoun: "web application firewall verifications",
     known: KNOWN_VERIFICATIONS,
     knownList: KNOWN_VERIFICATION_FIELDS,
     listSelect: DEFAULT_VERIFICATION_LIST_SELECT,
@@ -344,20 +348,22 @@ async function collectKind(session, flags, kind, command, showCommand, profile,
     if (!result.complete) {
         return {
             [kind.collectionKey]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, kind.totalsNoun, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, resumeHint(profileName), showHint, WORKFORCE_NOTE],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
         return {
             [kind.collectionKey]: rows,
-            count,
+            ...listTotals(rows.length, result.total, kind.totalsNoun, true),
+            complete: true,
             help: [`0 ${kind.noun}s matched; the absence of results is the answer, not an error`, WORKFORCE_NOTE],
         };
     }
-    return { [kind.collectionKey]: rows, count, help: [...truncationHints, showHint, WORKFORCE_NOTE] };
+    return { [kind.collectionKey]: rows, ...listTotals(rows.length, result.total, kind.totalsNoun, true), complete: true, help: [...truncationHints, showHint, WORKFORCE_NOTE] };
 }
 async function showKind(session, flags, kind, command, param, profile, operation, help, profileName) {
     const { select, fields } = selectedFields(flags, kind, kind.showSelect, help);

package/dist/entra-risk.js

@@ -1,4 +1,5 @@
 import { AxiError } from "axi-sdk-js";
+import { listTotals } from "./list-totals.js";
 // READ-06: the Entra risky-user and risk-detection read mapping behind
 // `mg-axi entra risky-user list/show` and `mg-axi entra risk-detection
 // list/show`, extended with the workload-identity surface behind
@@ -313,6 +314,7 @@ function parentServicePrincipal(flags, help) {
 const RISKY_USER_LIST = {
     noun: "risky-user",
     key: "riskyUsers",
+    totalsNoun: "risky users",
     known: RISKY_USER_KNOWN,
     knownList: KNOWN_RISKY_USER_FIELDS,
     defaultSelect: DEFAULT_RISKY_USER_LIST_SELECT,
@@ -329,6 +331,7 @@ const RISKY_USER_LIST = {
 const RISK_DETECTION_LIST = {
     noun: "risk-detection",
     key: "riskDetections",
+    totalsNoun: "risk detections",
     dateField: "detectedDateTime",
     known: RISK_DETECTION_KNOWN,
     knownList: KNOWN_RISK_DETECTION_FIELDS,
@@ -354,6 +357,7 @@ const DEFAULT_SP_DETECTION_SHOW_SELECT = [...KNOWN_SP_DETECTION_FIELDS];
 const RISKY_SP_LIST = {
     noun: "risky-service-principal",
     key: "riskyServicePrincipals",
+    totalsNoun: "risky service principals",
     known: RISKY_SP_KNOWN,
     knownList: KNOWN_RISKY_SP_FIELDS,
     defaultSelect: DEFAULT_RISKY_SP_LIST_SELECT,
@@ -370,6 +374,7 @@ const RISKY_SP_LIST = {
 const RISKY_SP_HISTORY_LIST = {
     noun: "risky-service-principal history",
     key: "riskyServicePrincipalHistory",
+    totalsNoun: "history items",
     pathParams: parentServicePrincipal,
     known: RISKY_SP_HISTORY_KNOWN,
     knownList: KNOWN_RISKY_SP_HISTORY_FIELDS,
@@ -386,6 +391,7 @@ const RISKY_SP_HISTORY_LIST = {
 const SP_DETECTION_LIST = {
     noun: "service-principal-risk-detection",
     key: "servicePrincipalRiskDetections",
+    totalsNoun: "service principal risk detections",
     dateField: "detectedDateTime",
     known: SP_DETECTION_KNOWN,
     knownList: KNOWN_SP_DETECTION_FIELDS,
@@ -468,16 +474,17 @@ async function listRisk(shape, session, flags, profile, operation, help, profile
     if (!result.complete) {
         return {
             [shape.key]: rows,
-            count: { returned: rows.length, complete: false, reason: result.reason },
+            ...listTotals(rows.length, result.total, shape.totalsNoun, false),
+            complete: false,
+            reason: result.reason,
             cursor: result.cursor,
             help: [...truncationHints, `Resume losslessly with the same flags plus --cursor - ${profileHint(profileName)} and supply the returned cursor on stdin`, showHint, ...shape.extraHelp(profileName)],
         };
     }
-    const count = { returned: rows.length, complete: true };
     if (!rows.length) {
-        return { [shape.key]: rows, count, help: shape.emptyHints(profileName) };
+        return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.totalsNoun, true), complete: true, help: shape.emptyHints(profileName) };
     }
-    return { [shape.key]: rows, count, help: [...truncationHints, showHint, ...shape.extraHelp(profileName)] };
+    return { [shape.key]: rows, ...listTotals(rows.length, result.total, shape.totalsNoun, true), complete: true, help: [...truncationHints, showHint, ...shape.extraHelp(profileName)] };
 }
 const RISKY_USER_SHOW = {
     noun: "risky-user",

package/dist/entra-roles.js

@@ -1,27 +1,41 @@
 import { AxiError } from "axi-sdk-js";
 import { listTotals } from "./list-totals.js";
 // READ-09: the Entra directory-role and PIM read mapping behind
-// `mg-axi entra directory-role list/show`, `mg-axi entra role-assignment
-// list`, `mg-axi entra pim eligible list` and `mg-axi entra pim active list`.
+// `mg-axi entra directory-role list/show`, `mg-axi entra directory-role-template
+// list/show`, `mg-axi entra directory-role member list`, `mg-axi entra
+// directory-role scoped-member list/show`, `mg-axi entra scoped-role-membership
+// list/show`, `mg-axi entra role-assignment list`, `mg-axi entra pim eligible
+// list` and `mg-axi entra pim active list`.
 // Operation construction stays beside its command; the shared session owns
 // URLs, credentials, paging, retries and error translation, and the SDK owns
 // TOON rendering. This module only maps flags to session calls and projects
 // rows for compact output.
 //
 // Reviewed against the v1.0 directoryrole-list, directoryrole-get,
+// directoryroletemplate-list, directoryroletemplate-get,
+// directoryrole-list-members, directoryrole-list-scopedmembers,
+// scopedrolemembership-list, scopedrolemembership-get,
 // rbacapplication-list-roleassignments,
 // rbacapplication-list-roleeligibilityscheduleinstances and
 // rbacapplication-list-roleassignmentscheduleinstances operation
-// documentation on 2026-10-04. Directory-role reads and role
-// assignments read D/A RoleManagement.Read.Directory; eligible PIM reads
+// documentation on 2026-10-04 (roles, assignments and PIM) and 2026-10-06
+// (templates, members, scoped members and scoped memberships). Directory-role reads, role
+// assignments, templates, members, scoped members and scoped memberships
+// read D/A RoleManagement.Read.Directory; eligible PIM reads
 // D/A RoleEligibilitySchedule.Read.Directory; active PIM reads D/A
 // RoleAssignmentSchedule.Read.Directory. Delegated callers additionally need
 // a supported administrator role per operation. None of these collections
 // documents an advanced-query contract, so --filter passes through as plain
 // $filter with no $count or ConsistencyLevel attached.
 //
-// The four views cover: directoryRoles are activated role
+// The views cover: directoryRoles are activated role
 // instances only (a role appears here after activation, never before);
+// directoryRoleTemplates describe every role definition whether activated or
+// not; members are the principals assigned to one activated role (@odata.type
+// names each member kind: user, group, device or service principal); scoped
+// members bind one role to one principal within one directory scope;
+// scopedRoleMemberships are the administrative-unit-scoped admin assignments
+// (directory-wide assignments live on roleAssignments);
 // roleAssignments include direct and PIM-activated assignments; eligible schedule
 // instances are PIM-eligible but not active; active schedule instances cover
 // both directly assigned (assignmentType Assigned) and activated eligible
@@ -57,10 +71,31 @@ export const KNOWN_ELIGIBLE_FIELDS = [
     "endDateTime",
 ];
 export const KNOWN_ACTIVE_FIELDS = [...KNOWN_ELIGIBLE_FIELDS, "assignmentType"];
+export const KNOWN_TEMPLATE_FIELDS = [
+    "id",
+    "displayName",
+    "description",
+];
+export const KNOWN_ROLE_MEMBER_FIELDS = [
+    "id",
+    "displayName",
+    "mail",
+    "userPrincipalName",
+];
+export const KNOWN_SCOPED_MEMBER_FIELDS = [
+    "id",
+    "principalId",
+    "roleId",
+    "directoryScopeId",
+    "administrativeUnitId",
+];
 const ROLE_KNOWN = new Set(KNOWN_ROLE_FIELDS);
 const ASSIGNMENT_KNOWN = new Set(KNOWN_ASSIGNMENT_FIELDS);
 const ELIGIBLE_KNOWN = new Set(KNOWN_ELIGIBLE_FIELDS);
 const ACTIVE_KNOWN = new Set(KNOWN_ACTIVE_FIELDS);
+const TEMPLATE_KNOWN = new Set(KNOWN_TEMPLATE_FIELDS);
+const MEMBER_KNOWN = new Set(KNOWN_ROLE_MEMBER_FIELDS);
+const SCOPED_KNOWN = new Set(KNOWN_SCOPED_MEMBER_FIELDS);
 // Compact rows: identifiers plus the correlation keys. For built-in roles
 // the unified roleDefinitionId matches the directory-role roleTemplateId.
 const DEFAULT_ROLE_LIST_SELECT = ["id", "displayName", "description", "roleTemplateId"];
@@ -68,6 +103,11 @@ const DEFAULT_ROLE_SHOW_SELECT = [...KNOWN_ROLE_FIELDS];
 const DEFAULT_ASSIGNMENT_SELECT = ["id", "principalId", "roleDefinitionId", "directoryScopeId"];
 const DEFAULT_ELIGIBLE_SELECT = ["id", "principalId", "roleDefinitionId", "memberType"];
 const DEFAULT_ACTIVE_SELECT = ["id", "principalId", "roleDefinitionId", "assignmentType", "memberType"];
+const DEFAULT_TEMPLATE_LIST_SELECT = ["id", "displayName", "description"];
+const DEFAULT_TEMPLATE_SHOW_SELECT = [...KNOWN_TEMPLATE_FIELDS];
+const DEFAULT_MEMBER_SELECT = ["id", "displayName"];
+const DEFAULT_SCOPED_LIST_SELECT = ["id", "principalId", "roleId", "directoryScopeId"];
+const DEFAULT_SCOPED_SHOW_SELECT = [...KNOWN_SCOPED_MEMBER_FIELDS];
 export const DEFAULT_ROLE_SCOPES = ["https://graph.microsoft.com/RoleManagement.Read.Directory"];
 export const DEFAULT_ELIGIBLE_SCOPES = ["https://graph.microsoft.com/RoleEligibilitySchedule.Read.Directory"];
 export const DEFAULT_ACTIVE_SCOPES = ["https://graph.microsoft.com/RoleAssignmentSchedule.Read.Directory"];
@@ -115,9 +155,14 @@ function truncateValue(value, full) {
 }
 // Local projection preserves Graph's null/missing distinction: an explicit
 // null stays null, an absent property stays absent and is never synthesized.
-function project(row, fields, full) {
+function project(row, fields, full, keepODataType = false) {
     const source = row !== null && typeof row === "object" && !Array.isArray(row) ? row : {};
     const projected = {};
+    // Heterogeneous member rows carry their kind in @odata.type, which is
+    // structural rather than a selectable property, so it rides along first.
+    if (keepODataType && typeof source["@odata.type"] === "string") {
+        projected["@odata.type"] = source["@odata.type"];
+    }
     let truncated = false;
     for (const field of fields) {
         if (!Object.hasOwn(source, field))
@@ -175,6 +220,10 @@ const ACTIVE_DENIAL_HINTS = [
     "Active PIM reads need RoleAssignmentSchedule.Read.Directory plus Global Reader, Security Operator, Security Reader, Security Administrator or Privileged Role Administrator for delegated access, or admin-consented RoleAssignmentSchedule.Read.Directory for application access",
     "PIM reads need P2 or ID Governance, not only P2",
 ];
+const SCOPED_DENIAL_HINTS = [
+    "Scoped membership reads need RoleManagement.Read.Directory plus Global Reader, Security Reader or Privileged Role Administrator for delegated access, or admin-consented RoleManagement.Read.Directory for application access",
+    "Administrative-unit-scoped memberships need P1",
+];
 const ROLE_LIST = {
     command: "entra directory-role list",
     key: "directoryRoles",
@@ -223,10 +272,68 @@ const PIM_ACTIVE = {
     scopeNote: "Active distinguishes directly assigned (assignmentType Assigned) and activated eligible (assignmentType Activated) assignments",
     emptyNote: "0 active assignments matched; the absence of results is the answer, not an error",
 };
+const TEMPLATE_LIST = {
+    command: "entra directory-role-template list",
+    key: "directoryRoleTemplates",
+    noun: "directory-role templates",
+    known: TEMPLATE_KNOWN,
+    knownList: KNOWN_TEMPLATE_FIELDS,
+    defaultSelect: DEFAULT_TEMPLATE_LIST_SELECT,
+    defaultScopes: DEFAULT_ROLE_SCOPES,
+    denialHints: ROLE_DENIAL_HINTS,
+    scopeNote: "Templates describe every role definition; activation state lives on directoryRoles, which appear only after activation",
+    emptyNote: "0 directory-role templates matched; the absence of results is the answer, not an error",
+};
+const MEMBER_LIST = {
+    command: "entra directory-role member list",
+    key: "roleMembers",
+    noun: "role members",
+    known: MEMBER_KNOWN,
+    knownList: KNOWN_ROLE_MEMBER_FIELDS,
+    defaultSelect: DEFAULT_MEMBER_SELECT,
+    defaultScopes: DEFAULT_ROLE_SCOPES,
+    denialHints: ROLE_DENIAL_HINTS,
+    scopeNote: "Members are the principals assigned to the activated role; @odata.type names each member kind (user, group, device or service principal)",
+    emptyNote: "0 role members matched; the absence of results is the answer, not an error",
+    parent: { param: "directoryRole-id", flag: "role", label: "activated directory-role object ID whose members are listed" },
+    keepODataType: true,
+};
+const SCOPED_LIST = {
+    command: "entra directory-role scoped-member list",
+    key: "scopedMembers",
+    noun: "scoped members",
+    known: SCOPED_KNOWN,
+    knownList: KNOWN_SCOPED_MEMBER_FIELDS,
+    defaultSelect: DEFAULT_SCOPED_LIST_SELECT,
+    defaultScopes: DEFAULT_ROLE_SCOPES,
+    denialHints: SCOPED_DENIAL_HINTS,
+    scopeNote: "Scoped members bind one role to one principal within one directory scope; administrative-unit scopes need P1",
+    emptyNote: "0 scoped members matched; the absence of results is the answer, not an error",
+    parent: { param: "directoryRole-id", flag: "role", label: "activated directory-role object ID whose scoped members are listed" },
+};
+const MEMBERSHIP_LIST = {
+    command: "entra scoped-role-membership list",
+    key: "scopedRoleMemberships",
+    noun: "scoped role memberships",
+    known: SCOPED_KNOWN,
+    knownList: KNOWN_SCOPED_MEMBER_FIELDS,
+    defaultSelect: DEFAULT_SCOPED_LIST_SELECT,
+    defaultScopes: DEFAULT_ROLE_SCOPES,
+    denialHints: SCOPED_DENIAL_HINTS,
+    scopeNote: "Scoped role memberships are administrative-unit-scoped admin assignments; directory-wide assignments live on roleAssignments",
+    emptyNote: "0 scoped role memberships matched; the absence of results is the answer, not an error",
+};
 async function listCollection(shape, session, flags, profile, operation, help, profileName) {
     const cursor = flags.cursor === undefined ? undefined : String(flags.cursor);
     if (cursor !== undefined && !cursor.trim())
         throw new AxiError("--cursor needs the opaque cursor from a partial result", "VALIDATION_ERROR", [help]);
+    let params;
+    if (shape.parent !== undefined) {
+        const parentId = String(flags[shape.parent.flag] ?? "");
+        if (!parentId.trim())
+            throw new AxiError(`--${shape.parent.flag} needs the ${shape.parent.label}`, "VALIDATION_ERROR", [help]);
+        params = { [shape.parent.param]: parentId };
+    }
     const saved = cursor === undefined ? undefined : session.cursorQuery(operation, cursor);
     const savedSelect = saved?.$select;
     const { select, fields } = selectedFields(flags, savedSelect === undefined ? shape.defaultSelect : fieldList(savedSelect, "select", shape.known, shape.knownList, help), shape.known, shape.knownList, help);
@@ -240,6 +347,8 @@ async function listCollection(shape, session, flags, profile, operation, help, p
     if (filter !== undefined)
         query.$filter = filter;
     const args = { profile, operation, query, scopes };
+    if (params !== undefined)
+        args.params = params;
     if (cursor !== undefined)
         args.cursor = cursor;
     if (flags.all === true) {
@@ -256,11 +365,13 @@ async function listCollection(shape, session, flags, profile, operation, help, p
     const rows = [];
     let truncated = false;
     for (const row of result.value) {
-        const projected = project(row, fields, full);
+        const projected = project(row, fields, full, shape.keepODataType === true);
         rows.push(projected.row);
         truncated = truncated || projected.truncated;
     }
-    const showHint = shape.key === "directoryRoles" ? `mg-axi entra directory-role show --id <role-id> ${profileHint(profileName)}` : undefined;
+    const showHint = shape.key === "directoryRoles" ? `mg-axi entra directory-role show --id <role-id> ${profileHint(profileName)}`
+        : shape.key === "directoryRoleTemplates" ? `mg-axi entra directory-role-template show --id <template-id> ${profileHint(profileName)}`
+            : undefined;
     const correlateHint = shape.key === "directoryRoles"
         ? undefined
         : `For built-in roles, roleDefinitionId matches the directory-role roleTemplateId: mg-axi entra directory-role list ${profileHint(profileName)}`;
@@ -314,3 +425,78 @@ export async function listPimEligible(session, flags, profile, operation, help,
 export async function listPimActive(session, flags, profile, operation, help, profileName) {
     return listCollection(PIM_ACTIVE, session, flags, profile, operation, help, profileName);
 }
+const TEMPLATE_SINGLE = {
+    command: "entra directory-role-template show",
+    key: "directoryRoleTemplate",
+    noun: "directory-role template",
+    known: TEMPLATE_KNOWN,
+    knownList: KNOWN_TEMPLATE_FIELDS,
+    defaultSelect: DEFAULT_TEMPLATE_SHOW_SELECT,
+    defaultScopes: DEFAULT_ROLE_SCOPES,
+    denialHints: ROLE_DENIAL_HINTS,
+};
+const SCOPED_SINGLE = {
+    command: "entra directory-role scoped-member show",
+    key: "scopedMember",
+    noun: "scoped member",
+    known: SCOPED_KNOWN,
+    knownList: KNOWN_SCOPED_MEMBER_FIELDS,
+    defaultSelect: DEFAULT_SCOPED_SHOW_SELECT,
+    defaultScopes: DEFAULT_ROLE_SCOPES,
+    denialHints: SCOPED_DENIAL_HINTS,
+};
+const MEMBERSHIP_SINGLE = {
+    command: "entra scoped-role-membership show",
+    key: "scopedRoleMembership",
+    noun: "scoped role membership",
+    known: SCOPED_KNOWN,
+    knownList: KNOWN_SCOPED_MEMBER_FIELDS,
+    defaultSelect: DEFAULT_SCOPED_SHOW_SELECT,
+    defaultScopes: DEFAULT_ROLE_SCOPES,
+    denialHints: SCOPED_DENIAL_HINTS,
+};
+async function showSingle(shape, params, session, flags, profile, operation, help, profileName) {
+    const { select, fields } = selectedFields(flags, shape.defaultSelect, shape.known, shape.knownList, help);
+    const scopes = scopesFor(flags, profile, shape.defaultScopes, help);
+    const full = flags.full === true;
+    const raw = await withGuidance(shape.denialHints, () => session.execute({
+        profile,
+        operation,
+        params,
+        query: { $select: select.join(",") },
+        scopes,
+    }));
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new AxiError(`Graph returned a malformed ${shape.noun} body`, "GRAPH_ERROR", [
+            `Single-${shape.noun} reads carry one object; treat anything else as unknown, not empty`,
+        ]);
+    }
+    const { row, truncated } = project(raw, fields, full);
+    if (truncated)
+        return { [shape.key]: row, help: [fullHint(shape.command, flags, profileName)] };
+    return { [shape.key]: row };
+}
+export async function listDirectoryRoleTemplates(session, flags, profile, operation, help, profileName) {
+    return listCollection(TEMPLATE_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showDirectoryRoleTemplate(session, flags, profile, operation, help, profileName) {
+    return showSingle(TEMPLATE_SINGLE, { "directoryRoleTemplate-id": String(flags.id) }, session, flags, profile, operation, help, profileName);
+}
+export async function listRoleMembers(session, flags, profile, operation, help, profileName) {
+    return listCollection(MEMBER_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function listScopedMembers(session, flags, profile, operation, help, profileName) {
+    return listCollection(SCOPED_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showScopedMember(session, flags, profile, operation, help, profileName) {
+    const roleId = String(flags.role ?? "");
+    if (!roleId.trim())
+        throw new AxiError("--role needs the activated directory-role object ID owning the scoped member", "VALIDATION_ERROR", [help]);
+    return showSingle(SCOPED_SINGLE, { "directoryRole-id": roleId, "scopedRoleMembership-id": String(flags.id) }, session, flags, profile, operation, help, profileName);
+}
+export async function listScopedRoleMemberships(session, flags, profile, operation, help, profileName) {
+    return listCollection(MEMBERSHIP_LIST, session, flags, profile, operation, help, profileName);
+}
+export async function showScopedRoleMembership(session, flags, profile, operation, help, profileName) {
+    return showSingle(MEMBERSHIP_SINGLE, { "scopedRoleMembership-id": String(flags.id) }, session, flags, profile, operation, help, profileName);
+}