@ivora/cli 0.0.0-stage → 0.1.0

package/dist/lib/http.js

@@ -0,0 +1,209 @@
+import { randomUUID } from 'node:crypto';
+import { setTimeout as delay } from 'node:timers/promises';
+import { CliError, ExitCode } from './output.js';
+import { redactBody, redactHeaders } from './secrets.js';
+import { CLI_VERSION } from '../version.js';
+import { validateBaseUrl } from './profiles.js';
+const WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+/** Path prefixes the CLI never calls. The server refuses them for API keys anyway. */
+export const STAFF_PREFIXES = ['/v1/admin', '/v1/host', '/v1/internal'];
+export class ApiError extends CliError {
+    status;
+    code;
+    body;
+    requestId;
+    constructor(status, code, message, body, requestId) {
+        super(message, status === 401 || status === 403 ? ExitCode.Auth : ExitCode.ApiError);
+        this.name = 'ApiError';
+        this.status = status;
+        this.code = code;
+        this.body = body;
+        this.requestId = requestId;
+    }
+}
+/**
+ * Refuses anything but a relative public /v1 path. The check runs on the pathname the URL
+ * parser will actually send (it resolves `%2e%2e`, backslashes and drops `#...`), decoded and
+ * with repeated slashes collapsed, so encodings cannot reach a staff prefix.
+ */
+export function assertPublicPath(path) {
+    if (!path.startsWith('/v1/') && path !== '/v1') {
+        throw new CliError(`Only /v1 paths are supported: ${path}`, ExitCode.Usage);
+    }
+    if (/[\\#]/.test(path) || /%2f|%5c/i.test(path)) {
+        throw new CliError(`Invalid path: ${path}`, ExitCode.Usage);
+    }
+    const pathname = path.split('?', 1)[0] ?? path;
+    let decoded;
+    try {
+        decoded = decodeURIComponent(pathname);
+    }
+    catch {
+        throw new CliError(`Invalid path: ${path}`, ExitCode.Usage);
+    }
+    if (decoded.split('/').some((seg) => seg === '..' || seg === '.')) {
+        throw new CliError(`Invalid path: ${path}`, ExitCode.Usage);
+    }
+    const sent = new URL(pathname, 'https://placeholder.invalid').pathname;
+    const lower = decodeURIComponent(sent)
+        .replace(/\/{2,}/g, '/')
+        .replace(/;.*$/, '')
+        .toLowerCase();
+    for (const prefix of STAFF_PREFIXES) {
+        if (lower === prefix || lower.startsWith(`${prefix}/`)) {
+            throw new CliError(`${prefix} is not part of the public API.`, ExitCode.Usage);
+        }
+    }
+}
+/** Idempotency keys: 8 to 128 printable ASCII characters. */
+export function validateIdempotencyKey(key) {
+    if (!/^[\x21-\x7e]{8,128}$/.test(key)) {
+        throw new CliError('An idempotency key must be 8-128 printable characters without spaces.', ExitCode.Usage);
+    }
+    return key;
+}
+/** Seconds to wait from a Retry-After header (delta-seconds or HTTP date), capped. */
+export function parseRetryAfter(value, now = Date.now(), capSeconds = 60) {
+    if (!value)
+        return 1;
+    const trimmed = value.trim();
+    const seconds = /^\d+$/.test(trimmed) ? Number(trimmed) : (Date.parse(trimmed) - now) / 1000;
+    if (!Number.isFinite(seconds))
+        return 1;
+    return Math.min(Math.max(seconds, 0), capSeconds);
+}
+export class ApiClient {
+    options;
+    constructor(options) {
+        this.options = {
+            fetch: globalThis.fetch,
+            maxRetries: 2,
+            timeoutMs: 30_000,
+            sleep: (ms) => delay(ms),
+            ...options,
+            // https only (plain http just for loopback): the key is never sent in clear text.
+            baseUrl: validateBaseUrl(options.baseUrl),
+        };
+    }
+    async request(method, path, opts = {}) {
+        assertPublicPath(path);
+        const url = new URL(this.options.baseUrl + path);
+        for (const [k, v] of Object.entries(opts.query ?? {})) {
+            if (v !== undefined)
+                url.searchParams.set(k, String(v));
+        }
+        const isWrite = WRITE_METHODS.has(method) && !opts.readOnly;
+        const idempotencyKey = isWrite
+            ? validateIdempotencyKey(opts.idempotencyKey ?? randomUUID())
+            : undefined;
+        const headers = {
+            Accept: 'application/json',
+            Authorization: `Bearer ${this.options.apiKey}`,
+            'Ivora-Version': this.options.apiVersion,
+            'User-Agent': `ivora-cli/${CLI_VERSION} node/${process.versions.node}`,
+        };
+        if (idempotencyKey)
+            headers['Idempotency-Key'] = idempotencyKey;
+        const body = opts.body === undefined ? undefined : JSON.stringify(opts.body);
+        if (body !== undefined)
+            headers['Content-Type'] = 'application/json';
+        for (let attempt = 0;; attempt++) {
+            const last = attempt >= this.options.maxRetries;
+            this.debug(`> ${method} ${url.pathname}${url.search} ${JSON.stringify(redactHeaders(headers))}`);
+            if (opts.body !== undefined)
+                this.debug(`> body ${JSON.stringify(redactBody(opts.body))}`);
+            let res;
+            try {
+                res = await this.options.fetch(url, {
+                    method,
+                    headers,
+                    body,
+                    redirect: 'error',
+                    signal: AbortSignal.timeout(this.options.timeoutMs),
+                });
+            }
+            catch (err) {
+                const timeout = err instanceof Error && (err.name === 'TimeoutError' || err.name === 'AbortError');
+                // Reads are safe to repeat; writes repeat with the same Idempotency-Key.
+                if (!last) {
+                    this.debug(`< ${timeout ? 'timeout' : 'network error'}, retrying`);
+                    await this.options.sleep(backoffMs(attempt));
+                    continue;
+                }
+                throw new CliError(timeout
+                    ? `Request timed out: ${method} ${path}`
+                    : `Network error: ${err.message}`, timeout ? ExitCode.Timeout : ExitCode.ApiError);
+            }
+            const data = await readBody(res);
+            this.debug(`< ${res.status} ${JSON.stringify(redactBody(data))}`);
+            if (res.ok)
+                return { status: res.status, headers: res.headers, data: data, idempotencyKey };
+            const code = errorCode(data);
+            if (!last && res.status === 429) {
+                await this.options.sleep(parseRetryAfter(res.headers.get('retry-after')) * 1000);
+                continue;
+            }
+            if (!last && res.status === 503 && code === 'outcome_unknown') {
+                await this.options.sleep(backoffMs(attempt));
+                continue;
+            }
+            const requestId = errorRequestId(data, res.headers);
+            const message = errorMessage(res.status, code, data);
+            throw new ApiError(res.status, code, requestId ? `${message} (request id: ${requestId})` : message, data, requestId);
+        }
+    }
+    debug(line) {
+        this.options.debug?.(line);
+    }
+}
+function backoffMs(attempt) {
+    return Math.min(500 * 2 ** attempt, 8_000);
+}
+async function readBody(res) {
+    const text = await res.text();
+    if (text === '')
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function errorCode(data) {
+    if (data && typeof data === 'object') {
+        const obj = data;
+        const error = obj.error;
+        if (error &&
+            typeof error === 'object' &&
+            typeof error.code === 'string') {
+            return error.code;
+        }
+        if (typeof obj.code === 'string')
+            return obj.code;
+    }
+    return undefined;
+}
+/** The request id from the error body (`request_id`), else the `X-Request-Id` header. */
+function errorRequestId(data, headers) {
+    if (data && typeof data === 'object') {
+        const id = data.request_id;
+        if (typeof id === 'string' && id !== '')
+            return id;
+    }
+    return headers.get('x-request-id') ?? undefined;
+}
+function errorMessage(status, code, data) {
+    let detail;
+    if (data && typeof data === 'object') {
+        const obj = data;
+        const error = obj.error;
+        const candidate = error?.message ?? obj.message ?? obj.detail;
+        if (typeof candidate === 'string')
+            detail = candidate;
+    }
+    else if (typeof data === 'string' && data.length < 300) {
+        detail = data;
+    }
+    return [`HTTP ${status}`, code, detail].filter(Boolean).join(': ');
+}

package/dist/lib/output.js

@@ -0,0 +1,101 @@
+import { redact } from './secrets.js';
+/** Process exit codes. Scripts may rely on these. */
+export const ExitCode = {
+    Ok: 0,
+    ApiError: 1,
+    Usage: 2,
+    ConfirmRefused: 3,
+    Timeout: 4,
+    Auth: 5,
+};
+/** An error that ends the command with a specific exit code and a user-facing message. */
+export class CliError extends Error {
+    exitCode;
+    constructor(message, exitCode = ExitCode.ApiError) {
+        super(message);
+        this.name = 'CliError';
+        this.exitCode = exitCode;
+    }
+}
+/**
+ * Where command output goes. Results go to stdout (a table, or JSON with --json); prompts,
+ * progress and errors go to stderr, so `--json` output stays machine-readable.
+ * Everything written passes through secret redaction.
+ */
+export class Output {
+    json;
+    color;
+    stdout;
+    stderr;
+    constructor(options = {}) {
+        const env = options.env ?? process.env;
+        this.json = options.json ?? false;
+        this.stdout = options.stdout ?? process.stdout;
+        this.stderr = options.stderr ?? process.stderr;
+        this.color = !this.json && this.stdout.isTTY === true && !('NO_COLOR' in env);
+    }
+    /** Writes a result: JSON in --json mode, otherwise a table (arrays) or key/value lines. */
+    result(data, columns) {
+        if (this.json) {
+            this.stdout.write(redact(JSON.stringify(data, null, 2)) + '\n');
+            return;
+        }
+        if (Array.isArray(data)) {
+            this.stdout.write(redact(formatTable(data, columns)));
+            return;
+        }
+        if (data !== null && typeof data === 'object') {
+            this.stdout.write(redact(formatKeyValues(data)));
+            return;
+        }
+        this.stdout.write(redact(String(data)) + '\n');
+    }
+    /** Writes any value as pretty JSON, in both modes (for arbitrary API responses). */
+    rawJson(data) {
+        this.stdout.write(redact(JSON.stringify(data ?? null, null, 2)) + '\n');
+    }
+    /** Writes a human line to stdout (not used in --json mode). */
+    line(text) {
+        if (!this.json)
+            this.stdout.write(redact(text) + '\n');
+    }
+    /** Writes progress or diagnostics to stderr. */
+    info(text) {
+        this.stderr.write(redact(text) + '\n');
+    }
+    error(text) {
+        this.stderr.write(redact(`error: ${text}`) + '\n');
+    }
+}
+/** The environment marker shown in prompts and human-mode headers. */
+export function envTag(environment, project) {
+    if (environment === 'live')
+        return project ? `[LIVE] ${project}` : '[LIVE]';
+    return '[TEST]';
+}
+function cell(value) {
+    if (value === null || value === undefined)
+        return '';
+    if (typeof value === 'object')
+        return JSON.stringify(value);
+    return String(value);
+}
+/** Formats rows as a left-aligned, space-padded table with an upper-case header. */
+export function formatTable(rows, columns) {
+    const cols = columns ?? [...new Set(rows.flatMap((row) => Object.keys(row)))];
+    if (cols.length === 0)
+        return '';
+    const header = cols.map((c) => c.toUpperCase());
+    const body = rows.map((row) => cols.map((c) => cell(row[c])));
+    const widths = header.map((h, i) => Math.max(h.length, ...body.map((r) => (r[i] ?? '').length)));
+    const render = (cells) => cells
+        .map((c, i) => (i === cells.length - 1 ? c : c.padEnd(widths[i] ?? 0)))
+        .join('  ')
+        .trimEnd();
+    return [render(header), ...body.map(render)].join('\n') + '\n';
+}
+function formatKeyValues(data) {
+    const keys = Object.keys(data);
+    const width = Math.max(0, ...keys.map((k) => k.length));
+    return keys.map((k) => `${k.padEnd(width)}  ${cell(data[k])}`).join('\n') + '\n';
+}

package/dist/lib/profiles.js

@@ -0,0 +1,195 @@
+import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { CliError, ExitCode } from './output.js';
+export const DEFAULT_PROFILE = 'test';
+/** Production API base, the default for live profiles. */
+export const PRODUCTION_API_BASE = 'https://api.ivoracharge.com';
+/** The environment a key belongs to, from its prefix, or undefined for an unknown format. */
+export function environmentForKey(apiKey) {
+    if (apiKey.startsWith('iv_test_'))
+        return 'test';
+    if (apiKey.startsWith('iv_live_'))
+        return 'live';
+    return undefined;
+}
+/** Refuses a key that does not belong to the profile's environment. */
+export function assertKeyMatchesProfile(apiKey, profile) {
+    const env = environmentForKey(apiKey);
+    if (env === undefined) {
+        throw new CliError('This does not look like an Ivora API key (iv_test_... or iv_live_...).', ExitCode.Usage);
+    }
+    if (env !== profile.environment) {
+        throw new CliError(`A ${env} key cannot be used with the ${profile.environment} profile "${profile.name}".` +
+            (env === 'live' ? ' Use `ivora login --live` for live keys.' : ''), ExitCode.Usage);
+    }
+}
+/** Directory of the CLI config: $XDG_CONFIG_HOME/ivora, ~/.config/ivora, or %APPDATA%\ivora. */
+export function configDir(env = process.env, platform = process.platform, home = homedir()) {
+    if (env.XDG_CONFIG_HOME)
+        return join(env.XDG_CONFIG_HOME, 'ivora');
+    if (platform === 'win32' && env.APPDATA)
+        return join(env.APPDATA, 'ivora');
+    return join(home, '.config', 'ivora');
+}
+export function configPath(env = process.env) {
+    return join(configDir(env), 'config.toml');
+}
+const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+export function validateProfileName(name) {
+    if (!PROFILE_NAME.test(name)) {
+        throw new CliError(`Invalid profile name "${name}": use 1-32 lower-case letters, digits, "-" or "_".`, ExitCode.Usage);
+    }
+    return name;
+}
+/** The secret-store reference for a profile's key. */
+export function keyRefFor(name) {
+    return `profile:${name}`;
+}
+/** Serialises the config as a small TOML subset (string values only). No secrets. */
+export function serializeConfig(config) {
+    const q = (v) => JSON.stringify(v);
+    const lines = [];
+    if (config.current)
+        lines.push(`current = ${q(config.current)}`, '');
+    for (const name of Object.keys(config.profiles).sort()) {
+        const p = config.profiles[name];
+        if (!p)
+            continue;
+        lines.push(`[profiles.${name}]`, `environment = ${q(p.environment)}`);
+        if (p.baseUrl)
+            lines.push(`base_url = ${q(p.baseUrl)}`);
+        if (p.keyRef)
+            lines.push(`key_ref = ${q(p.keyRef)}`);
+        if (p.tenantId)
+            lines.push(`tenant_id = ${q(p.tenantId)}`);
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+/** Parses the subset written by serializeConfig. Unknown keys are ignored. */
+export function parseConfig(text) {
+    const config = { profiles: {} };
+    let section;
+    const sections = new Map();
+    for (const [i, raw] of text.split(/\r?\n/).entries()) {
+        const line = raw.trim();
+        if (line === '' || line.startsWith('#'))
+            continue;
+        const bad = () => {
+            throw new CliError(`Invalid config file at line ${i + 1}.`, ExitCode.Usage);
+        };
+        const header = /^\[profiles\.([a-z0-9_-]+)\]$/.exec(line);
+        if (header) {
+            const name = validateProfileName(header[1] ?? '');
+            section = {};
+            sections.set(name, section);
+            continue;
+        }
+        const kv = /^([a-z_]+)\s*=\s*("(?:[^"\\]|\\.)*")$/.exec(line);
+        if (!kv)
+            return bad();
+        let value;
+        try {
+            value = JSON.parse(kv[2] ?? '');
+        }
+        catch {
+            return bad();
+        }
+        if (section)
+            section[kv[1] ?? ''] = value;
+        else if (kv[1] === 'current')
+            config.current = value;
+    }
+    for (const [name, f] of sections) {
+        if (f.environment !== 'test' && f.environment !== 'live') {
+            throw new CliError(`Profile "${name}" has no valid environment.`, ExitCode.Usage);
+        }
+        config.profiles[name] = {
+            name,
+            environment: f.environment,
+            ...(f.base_url ? { baseUrl: f.base_url } : {}),
+            ...(f.key_ref ? { keyRef: f.key_ref } : {}),
+            ...(f.tenant_id ? { tenantId: f.tenant_id } : {}),
+        };
+    }
+    return config;
+}
+export async function loadConfig(env = process.env) {
+    let text;
+    try {
+        text = await readFile(configPath(env), 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return { profiles: {} };
+        throw err;
+    }
+    return parseConfig(text);
+}
+/** Writes the config atomically with owner-only permissions. */
+export async function saveConfig(config, env = process.env) {
+    const dir = configDir(env);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    const tmp = join(dir, `config.toml.${process.pid}.tmp`);
+    await writeFile(tmp, serializeConfig(config), { mode: 0o600 });
+    await chmod(tmp, 0o600);
+    await rename(tmp, configPath(env));
+}
+/** Selects the profile: --profile, then --live, then the config's current profile, then "test". */
+export function selectProfileName(options, config) {
+    if (options.profile)
+        return options.profile;
+    if (options.live)
+        return 'live';
+    const current = config.current;
+    // A live profile is never picked implicitly, even from a hand-edited config.
+    if (current && config.profiles[current]?.environment !== 'live')
+        return current;
+    return DEFAULT_PROFILE;
+}
+/**
+ * The API base URL for a profile. A test profile uses `IVORA_API_BASE`, then its own URL; without
+ * either it is a usage error. A live profile ignores `IVORA_API_BASE`, so a leftover test URL never
+ * receives a live key: it uses its own stored URL or the production default, and `note` is told
+ * when `IVORA_API_BASE` was ignored.
+ */
+export function resolveBaseUrl(profile, env = process.env, note) {
+    let candidate;
+    if (profile.environment === 'live') {
+        candidate = profile.baseUrl ?? PRODUCTION_API_BASE;
+        if (env.IVORA_API_BASE) {
+            note?.(`IVORA_API_BASE is ignored for the live profile "${profile.name}"; using ${candidate}.`);
+        }
+    }
+    else {
+        candidate = env.IVORA_API_BASE ?? profile.baseUrl;
+    }
+    if (candidate === undefined) {
+        throw new CliError(`No API base URL for the ${profile.environment} profile "${profile.name}". Set IVORA_API_BASE.`, ExitCode.Usage);
+    }
+    return validateBaseUrl(candidate);
+}
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** Requires https (plain http only for loopback), no credentials, path or query. */
+export function validateBaseUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new CliError(`Invalid API base URL: ${value}`, ExitCode.Usage);
+    }
+    const loopback = LOOPBACK.has(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) {
+        throw new CliError('The API base URL must use https.', ExitCode.Usage);
+    }
+    if (url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        (url.pathname !== '/' && url.pathname !== '')) {
+        throw new CliError('The API base URL must be an origin only, e.g. https://api.example.com.', ExitCode.Usage);
+    }
+    return url.origin;
+}

package/dist/lib/resource.js

@@ -0,0 +1,115 @@
+import { Command } from 'commander';
+import { findOperation } from '../catalog.js';
+import { accessTenantIds } from './access.js';
+import { CliError, ExitCode } from './output.js';
+import { openSession } from './session.js';
+/**
+ * Calls a cataloged operation by its operationId. The path comes from the catalog and the
+ * `{param}` values are encoded here, so a command never builds a path by hand.
+ */
+export async function callOperation(s, operationId, params, opts = {}) {
+    const op = findOperation(operationId);
+    if (!op)
+        throw new CliError(`Unknown operation: ${operationId}`, ExitCode.Usage);
+    const path = op.path.replace(/\{([^}]+)\}/g, (_m, name) => {
+        const value = params[name];
+        if (value === undefined || value === '') {
+            throw new CliError(`Missing value for ${name}.`, ExitCode.Usage);
+        }
+        return encodeURIComponent(value);
+    });
+    return s.client.request(op.method, path, {
+        ...(opts.query ? { query: opts.query } : {}),
+        ...(opts.body !== undefined ? { body: opts.body } : {}),
+        ...(opts.readOnly ? { readOnly: true } : {}),
+    });
+}
+/** The tenant for a command: `--tenant`, else the profile's, else the key's only tenant. */
+export async function resolveTenant(ctx, s, flag) {
+    const given = flag ?? s.profile.tenantId;
+    if (given !== undefined) {
+        if (!/^\d+$/.test(given))
+            throw new CliError('A tenant id is a number.', ExitCode.Usage);
+        return given;
+    }
+    const res = await callOperation(s, 'access_and_api_keys_discover_current_csms_access', {});
+    const ids = accessTenantIds(res.data ?? {});
+    if (ids.length === 1)
+        return ids[0];
+    throw new CliError(ids.length === 0
+        ? 'This key has no tenant.'
+        : `This key can reach several tenants (${ids.join(', ')}): pass --tenant <id>.`, ExitCode.Usage);
+}
+export function addTenantOption(cmd) {
+    return cmd.option('--tenant <id>', 'tenant id (default: the key’s only tenant)');
+}
+export function parseIntOption(name, value) {
+    if (value === undefined)
+        return undefined;
+    if (!/^\d+$/.test(value) || Number(value) < 1) {
+        throw new CliError(`${name} must be a positive integer.`, ExitCode.Usage);
+    }
+    return Number(value);
+}
+const MAX_PAGES = 100;
+/** Lists a collection: one page, or every page with `--all`; prints a table or JSON. */
+export async function runList(ctx, spec, opts, filters) {
+    const s = await openSession(ctx);
+    const tenant = await resolveTenant(ctx, s, opts.tenant);
+    const limit = parseIntOption('--limit', opts.limit);
+    const cursorOpt = opts[spec.cursorParam];
+    let cursor = typeof cursorOpt === 'string' ? cursorOpt : undefined;
+    const rows = [];
+    // The API's next_cursor, kept with its type (an integer for some collections). Undefined
+    // means the listing reached its end.
+    let next;
+    for (let pages = 0;; pages++) {
+        const res = await callOperation(s, spec.operationId, { tenant_id: tenant }, { query: { ...filters, limit, [spec.cursorParam]: cursor } });
+        const body = res.data ?? {};
+        const pageRows = Array.isArray(body.data) ? body.data : [];
+        rows.push(...pageRows);
+        next = cursorValue(body.next_cursor);
+        // Some collections never return a null cursor: on the last page they echo the cursor that
+        // was sent. Treat an empty page, an echoed cursor or a short page as the end.
+        const last = next === undefined ||
+            pageRows.length === 0 ||
+            String(next) === cursor ||
+            (limit !== undefined && pageRows.length < limit);
+        if (last) {
+            next = undefined;
+            break;
+        }
+        // Keep `next` when one page was asked for, or when MAX_PAGES cut the listing short.
+        if (!opts.all || pages + 1 >= MAX_PAGES)
+            break;
+        cursor = String(next);
+    }
+    const out = ctx.out();
+    if (out.json) {
+        out.result({ data: rows, next_cursor: next ?? null });
+        return;
+    }
+    out.result(rows, spec.columns);
+    if (next !== undefined)
+        out.info(`More results: pass --${spec.cursorParam} ${next} (or --all).`);
+}
+function cursorValue(nc) {
+    if (typeof nc === 'number' && Number.isFinite(nc))
+        return nc;
+    if (typeof nc === 'string' && nc !== '')
+        return nc;
+    return undefined;
+}
+export function addListOptions(cmd, cursorParam) {
+    return addTenantOption(cmd)
+        .option('--limit <n>', 'page size')
+        .option(`--${cursorParam} <cursor>`, 'continue from the cursor of the previous page')
+        .option('--all', 'follow every page');
+}
+/** Fetches one resource by id and prints it. */
+export async function runGet(ctx, operationId, paramName, id, tenantFlag) {
+    const s = await openSession(ctx);
+    const tenant = await resolveTenant(ctx, s, tenantFlag);
+    const res = await callOperation(s, operationId, { tenant_id: tenant, [paramName]: id });
+    ctx.out().result(res.data ?? {});
+}