healthcloud-cli 3.2.5__tar.gz → 3.3.0__tar.gz

{healthcloud_cli-3.2.5 → healthcloud_cli-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: healthcloud-cli
-Version: 3.2.5
+Version: 3.3.0
 Summary: Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest.
 Project-URL: Issues, https://github.com/healthcloudservices/healthcloud-services/issues
 Project-URL: Repository, https://github.com/healthcloudservices/healthcloud-services
@@ -287,6 +287,54 @@ required; no MCP defaults, admin login, or automatic candidate selection are use
 uv run --frozen hc ams discover --environment dev --tenant-id TENANT_ID
 ```
 
+Read-only agent listing, inspection and export also take explicit flags instead
+of a target file, and log in as tenant admin (`HC_AMS_ADMIN_EMAIL` /
+`HC_AMS_ADMIN_PASSWORD`). Stdout carries bounded metadata only; `adapter` shows
+whether an agent runs from the `file` or `db` config adapter (`unknown` when the
+server does not say). `export` first re-checks the agent/tenant identity, then
+saves the server's own JSON/YAML export byte-for-byte to a new owner-only `--out`
+file, refusing (and leaving no file) when the body is not valid UTF-8. `export`
+needs an AMS build that serves `/agents/{agent_id}/configuration/export`; that
+route is not yet deployed to dev:
+
+```bash
+uv run --frozen hc ams agents list --environment dev --tenant-id TENANT_ID
+uv run --frozen hc ams agents get --environment dev --tenant-id TENANT_ID --agent-id AGENT_ID
+uv run --frozen hc ams agents export --environment dev --tenant-id TENANT_ID --agent-id AGENT_ID \
+  --format yaml --out agent.yaml
+```
+
+Read-only department listing and inspection use the same explicit tenant-admin
+targeting. They emit one versioned JSON result on stdout; failures emit one
+categorized JSON result on stderr. Department descriptions, creator identities,
+and evaluation-suite content are never included in the projection:
+
+```bash
+uv run --frozen hc ams departments list --environment dev --tenant-id TENANT_ID
+uv run --frozen hc ams departments get --environment dev --tenant-id TENANT_ID \
+  --department-id DEPARTMENT_ID
+```
+
+Department reads are complete and unpaged. The CLI does not expose department
+create, update, delete, activate, or deactivate operations.
+
+Read-only team listing and inspection are also complete and unpaged. The bounded
+projection omits descriptions and creator identities; it includes evaluation-suite
+IDs but never suite content. The CLI does not expose team mutations:
+
+```bash
+uv run --frozen hc ams teams list --environment dev --tenant-id TENANT_ID
+uv run --frozen hc ams teams get --environment dev --tenant-id TENANT_ID --team-id TEAM_ID
+```
+
+The organization hierarchy is the backend-built department/team/agent tree. The
+CLI preserves its order and nesting without issuing entity reads, joining records,
+or inferring missing relationships:
+
+```bash
+uv run --frozen hc ams organization hierarchy --environment dev --tenant-id TENANT_ID
+```
+
 Every other command requires an explicit local, non-secret target JSON file.
 Only the canonical HTTPS AMS origin for that environment is accepted; custom
 origins require separately verified support. Target and nested qualification keys

{healthcloud_cli-3.2.5 → healthcloud_cli-3.3.0}/README.md

@@ -269,6 +269,54 @@ required; no MCP defaults, admin login, or automatic candidate selection are use
 uv run --frozen hc ams discover --environment dev --tenant-id TENANT_ID
 ```
 
+Read-only agent listing, inspection and export also take explicit flags instead
+of a target file, and log in as tenant admin (`HC_AMS_ADMIN_EMAIL` /
+`HC_AMS_ADMIN_PASSWORD`). Stdout carries bounded metadata only; `adapter` shows
+whether an agent runs from the `file` or `db` config adapter (`unknown` when the
+server does not say). `export` first re-checks the agent/tenant identity, then
+saves the server's own JSON/YAML export byte-for-byte to a new owner-only `--out`
+file, refusing (and leaving no file) when the body is not valid UTF-8. `export`
+needs an AMS build that serves `/agents/{agent_id}/configuration/export`; that
+route is not yet deployed to dev:
+
+```bash
+uv run --frozen hc ams agents list --environment dev --tenant-id TENANT_ID
+uv run --frozen hc ams agents get --environment dev --tenant-id TENANT_ID --agent-id AGENT_ID
+uv run --frozen hc ams agents export --environment dev --tenant-id TENANT_ID --agent-id AGENT_ID \
+  --format yaml --out agent.yaml
+```
+
+Read-only department listing and inspection use the same explicit tenant-admin
+targeting. They emit one versioned JSON result on stdout; failures emit one
+categorized JSON result on stderr. Department descriptions, creator identities,
+and evaluation-suite content are never included in the projection:
+
+```bash
+uv run --frozen hc ams departments list --environment dev --tenant-id TENANT_ID
+uv run --frozen hc ams departments get --environment dev --tenant-id TENANT_ID \
+  --department-id DEPARTMENT_ID
+```
+
+Department reads are complete and unpaged. The CLI does not expose department
+create, update, delete, activate, or deactivate operations.
+
+Read-only team listing and inspection are also complete and unpaged. The bounded
+projection omits descriptions and creator identities; it includes evaluation-suite
+IDs but never suite content. The CLI does not expose team mutations:
+
+```bash
+uv run --frozen hc ams teams list --environment dev --tenant-id TENANT_ID
+uv run --frozen hc ams teams get --environment dev --tenant-id TENANT_ID --team-id TEAM_ID
+```
+
+The organization hierarchy is the backend-built department/team/agent tree. The
+CLI preserves its order and nesting without issuing entity reads, joining records,
+or inferring missing relationships:
+
+```bash
+uv run --frozen hc ams organization hierarchy --environment dev --tenant-id TENANT_ID
+```
+
 Every other command requires an explicit local, non-secret target JSON file.
 Only the canonical HTTPS AMS origin for that environment is accepted; custom
 origins require separately verified support. Target and nested qualification keys

healthcloud_cli-3.3.0/healthcloud_cli/ams/agents/__init__.py

@@ -0,0 +1,5 @@
+"""Read-only AMS agent command domain."""
+
+from .group import create_agents_group
+
+__all__ = ["create_agents_group"]

healthcloud_cli-3.3.0/healthcloud_cli/ams/agents/commands.py

@@ -0,0 +1,83 @@
+"""Fresh Click adapters for read-only agent operations."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import click
+
+from ..compatibility import safe_errors
+from ..context import AmsDependencies, pass_ams, preflight_agents
+from ..output import metadata
+from ..target import TenantTarget
+from .operations import AgentReadRefused, export_agent, get_agent, list_agents
+
+
+def _environment(function):
+    return click.option("--environment", type=click.Choice(["dev", "uat", "prod"]), required=True)(function)
+
+
+def _tenant(function):
+    return click.option("--tenant-id", required=True)(function)
+
+
+def _agent(function):
+    return click.option("--agent-id", required=True)(function)
+
+
+def _run(operation, *args):
+    try:
+        return operation(*args)
+    except AgentReadRefused as exc:
+        raise click.ClickException(str(exc)) from None
+
+
+def create_list_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("list")
+    @_environment
+    @_tenant
+    @pass_ams
+    @safe_errors
+    def command(invocation, environment: str, tenant_id: str) -> None:
+        preflight_agents(invocation)
+        metadata(_run(list_agents, dependencies, TenantTarget(environment, tenant_id)))
+
+    return command
+
+
+def create_get_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("get")
+    @_environment
+    @_tenant
+    @_agent
+    @pass_ams
+    @safe_errors
+    def command(invocation, environment: str, tenant_id: str, agent_id: str) -> None:
+        preflight_agents(invocation)
+        metadata(_run(get_agent, dependencies, TenantTarget(environment, tenant_id), agent_id))
+
+    return command
+
+
+def create_export_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("export")
+    @_environment
+    @_tenant
+    @_agent
+    @click.option("--out", required=True, type=click.Path(path_type=Path, dir_okay=False))
+    @click.option("--format", "export_format", type=click.Choice(["json", "yaml"]), default="json", show_default=True)
+    @pass_ams
+    @safe_errors
+    def command(
+        invocation,
+        environment: str,
+        tenant_id: str,
+        agent_id: str,
+        out: Path,
+        export_format: str,
+    ) -> None:
+        preflight_agents(invocation)
+        target = TenantTarget(environment, tenant_id)
+        metadata(_run(export_agent, dependencies, target, agent_id, out, export_format))
+
+    return command

healthcloud_cli-3.3.0/healthcloud_cli/ams/agents/group.py

@@ -0,0 +1,18 @@
+"""Fresh agent-domain group assembly."""
+
+from __future__ import annotations
+
+import click
+
+from ..context import AmsDependencies
+from .commands import create_export_command, create_get_command, create_list_command
+
+
+def create_agents_group(dependencies: AmsDependencies) -> click.Group:
+    @click.group("agents")
+    def group() -> None:
+        """Read-only agent listing, inspection and export for one explicit tenant."""
+
+    for factory in (create_list_command, create_get_command, create_export_command):
+        group.add_command(factory(dependencies))
+    return group

healthcloud_cli-3.3.0/healthcloud_cli/ams/agents/operations.py

@@ -0,0 +1,72 @@
+"""Click-free orchestration for agent list, get, and exact-text export."""
+
+from __future__ import annotations
+
+import hashlib
+from pathlib import Path
+from typing import Literal
+
+from ..context import AmsDependencies
+from ..output import private_text_output
+from ..target import TenantTarget
+from .projections import detail, summary
+
+
+class AgentReadRefused(ValueError):
+    """A stable refusal safe for the CLI adapter to expose."""
+
+
+def _agent_id(value: str) -> str:
+    if not isinstance(value, str) or not value.strip():
+        raise AgentReadRefused("Explicit agent ID required.")
+    return value
+
+
+def list_agents(dependencies: AmsDependencies, target: TenantTarget) -> dict:
+    with dependencies.authenticated_sdk_factory(target) as sdk:
+        agents = sdk.ams_admin.list_agents()
+    if any(agent.tenant_id != target.tenant_id for agent in agents):
+        raise AgentReadRefused("Agent/tenant identity mismatch; stopped.")
+    return {
+        "environment": target.environment,
+        "tenant_id": target.tenant_id,
+        "agents": [summary(agent) for agent in agents],
+    }
+
+
+def _verified_agent(sdk, target: TenantTarget, agent_id: str):
+    agent = sdk.ams_admin.get_agent(agent_id)
+    if agent is None or agent.id != agent_id or agent.tenant_id != target.tenant_id:
+        raise AgentReadRefused("Agent/tenant identity mismatch; stopped.")
+    return agent
+
+
+def get_agent(dependencies: AmsDependencies, target: TenantTarget, agent_id: str) -> dict:
+    agent_id = _agent_id(agent_id)
+    with dependencies.authenticated_sdk_factory(target) as sdk:
+        agent = _verified_agent(sdk, target, agent_id)
+    return {"environment": target.environment, "tenant_id": target.tenant_id} | detail(agent)
+
+
+def export_agent(
+    dependencies: AmsDependencies,
+    target: TenantTarget,
+    agent_id: str,
+    output: Path,
+    export_format: Literal["json", "yaml"],
+) -> dict:
+    agent_id = _agent_id(agent_id)
+    if export_format not in ("json", "yaml"):
+        raise AgentReadRefused("Export format must be json or yaml.")
+    with private_text_output(output) as write, dependencies.authenticated_sdk_factory(target) as sdk:
+        _verified_agent(sdk, target, agent_id)
+        text = sdk.ams_admin.export_agent_configuration(agent_id, format=export_format)
+        write(text)
+    return {
+        "environment": target.environment,
+        "tenant_id": target.tenant_id,
+        "agent_id": agent_id,
+        "path": str(output),
+        "format": export_format,
+        "sha256": hashlib.sha256(text.encode("utf-8")).hexdigest(),
+    }

healthcloud_cli-3.3.0/healthcloud_cli/ams/agents/projections.py

@@ -0,0 +1,37 @@
+"""Explicit bounded projections for agent reads."""
+
+from __future__ import annotations
+
+from healthcloud.models.ams_tuning import AgentConfig
+
+from ..output import digest
+
+ASSIGNED_REFERENCES = ("tool_ids", "skill_ids", "guardrail_ids", "policy_ids", "data_source_ids")
+
+
+def _metadata_string(value: object) -> str:
+    return value if isinstance(value, str) and value.strip() else "unknown"
+
+
+def summary(agent: AgentConfig) -> dict:
+    runtime = agent.runtime_configuration if isinstance(agent.runtime_configuration, dict) else {}
+    return {
+        "id": agent.id,
+        "name": agent.name,
+        "key": agent.key,
+        "type": agent.type,
+        "status": agent.status,
+        "active": agent.active,
+        "config_version": agent.config_version,
+        "adapter": _metadata_string(runtime.get("adapter")),
+        "runtime": _metadata_string(runtime.get("runtime")),
+    }
+
+
+def detail(agent: AgentConfig) -> dict:
+    values = {"instructions": agent.instructions, "greetings": agent.greetings}
+    return summary(agent) | {
+        "fields": sorted(values),
+        "field_hashes": {key: digest(value) for key, value in values.items()},
+        "assigned_references": {key: getattr(agent, key) for key in ASSIGNED_REFERENCES},
+    }

{healthcloud_cli-3.2.5 → healthcloud_cli-3.3.0}/healthcloud_cli/ams/auth.py

@@ -8,17 +8,21 @@ import click
 from healthcloud import HCSDK
 from healthcloud_tenantadmin import HCTenantAdminSDK
 
-from .target import AmsTarget
+from .target import AmsTarget, TenantTarget
 
 
 @contextmanager
-def authenticated_sdk(target: AmsTarget):
+def authenticated_sdk(target: AmsTarget | TenantTarget):
     sdk = HCSDK(environment=target.environment, tenant_id=target.tenant_id)
     try:
         if not hasattr(sdk, "ams_admin"):
             raise click.ClickException(
                 "SDK missing ams_admin; use the reviewed local editable SDK checkout (see CLI README)."
             )
+        if isinstance(target, TenantTarget) and not hasattr(sdk.ams_admin, "list_agents"):
+            raise click.ClickException(
+                "SDK missing ams_admin agent listing; use the reviewed local editable SDK checkout (see CLI README)."
+            )
         email = os.environ.get("HC_AMS_ADMIN_EMAIL")
         password = os.environ.get("HC_AMS_ADMIN_PASSWORD")
         if not email or not password:

{healthcloud_cli-3.2.5 → healthcloud_cli-3.3.0}/healthcloud_cli/ams/commands.py

@@ -4,6 +4,7 @@ from .compatibility import safe_errors
 from .group import create_ams_group
 
 ams = create_ams_group()
+agents = ams.commands["agents"]
 discover = ams.commands["discover"]
 inspect = ams.commands["inspect"]
 plan = ams.commands["plan"]
@@ -14,6 +15,7 @@ ui = ams.commands["ui"]
 
 __all__ = [
     "ams",
+    "agents",
     "apply",
     "create_ams_group",
     "discover",

healthcloud_cli-3.3.0/healthcloud_cli/ams/context.py

@@ -0,0 +1,143 @@
+"""Typed invocation configuration and deferred AMS operational preflight."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from contextlib import AbstractContextManager
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import click
+
+from healthcloud import HCSDK
+
+from ..context import CliConfig, resolve_config
+from .target import AmsTarget, TenantTarget, load_target
+
+
+@dataclass(frozen=True)
+class AmsDependencies:
+    """Process-local effect adapters used by one assembled AMS command tree."""
+
+    public_sdk_factory: Callable[..., Any]
+    authenticated_sdk_factory: Callable[[AmsTarget | TenantTarget], AbstractContextManager[Any]]
+    process_runner: Callable[..., Any]
+
+
+@dataclass(frozen=True)
+class AmsContext:
+    """Configuration recorded for one AMS command invocation."""
+
+    root_config: CliConfig
+    target_file: Path | None
+    dependencies: AmsDependencies
+
+
+pass_ams = click.make_pass_decorator(AmsContext, ensure=False)
+
+
+def _check_root(invocation: AmsContext) -> CliConfig:
+    cfg = invocation.root_config
+    if cfg.access_token is not None or cfg.base_url is not None:
+        raise click.ClickException("AMS refuses root MCP credentials and base URL settings.")
+    try:
+        resolved = resolve_config(
+            cfg.access_token,
+            cfg.base_url,
+            cfg.profile,
+            cfg.output,
+            False,
+            cfg.verbose,
+        )
+    except click.UsageError, OSError, ValueError, TypeError:
+        raise click.ClickException("AMS root profile is unavailable or invalid; use an explicit target.") from None
+    if resolved.access_token is not None or resolved.base_url is not None:
+        raise click.ClickException("AMS refuses root MCP credentials and base URL settings.")
+    if resolved.output == "raw":
+        raise click.ClickException("Raw output is refused for AMS.")
+    return resolved
+
+
+def preflight_discovery(invocation: AmsContext) -> None:
+    """Validate root options for discovery without loading a target."""
+
+    _check_root(invocation)
+    if invocation.target_file is not None:
+        raise click.ClickException("Discover requires explicit environment/tenant flags, without a target file.")
+
+
+def preflight_agents(invocation: AmsContext) -> None:
+    """Validate root options without loading a tuning target."""
+
+    _check_root(invocation)
+    if invocation.target_file is not None:
+        raise click.ClickException("Agents requires explicit environment/tenant flags, without a target file.")
+
+
+def preflight_departments(invocation: AmsContext, target: TenantTarget) -> None:
+    """Validate root options without loading a tuning target."""
+
+    _check_root(invocation)
+    if invocation.target_file is not None:
+        raise click.ClickException("Departments requires explicit environment/tenant flags, without a target file.")
+    sdk = HCSDK(environment=target.environment, tenant_id=target.tenant_id)
+    try:
+        resource = getattr(getattr(sdk, "ams_admin", None), "departments", None)
+        if (
+            resource is None
+            or not callable(getattr(resource, "list", None))
+            or not callable(getattr(resource, "get", None))
+        ):
+            raise click.ClickException(
+                "SDK missing ams_admin departments; use the reviewed SDK version required by this CLI."
+            )
+    finally:
+        sdk.close()
+
+
+def preflight_teams(invocation: AmsContext, target: TenantTarget) -> None:
+    """Validate local team-read compatibility before login or data reads."""
+
+    _check_root(invocation)
+    if invocation.target_file is not None:
+        raise click.ClickException("Teams requires explicit environment/tenant flags, without a target file.")
+    sdk = HCSDK(environment=target.environment, tenant_id=target.tenant_id)
+    try:
+        resource = getattr(getattr(sdk, "ams_admin", None), "teams", None)
+        if (
+            resource is None
+            or not callable(getattr(resource, "list", None))
+            or not callable(getattr(resource, "get", None))
+        ):
+            raise click.ClickException(
+                "SDK missing ams_admin teams; use the reviewed SDK version required by this CLI."
+            )
+    finally:
+        sdk.close()
+
+
+def preflight_organization(invocation: AmsContext, target: TenantTarget) -> None:
+    """Validate local hierarchy-read compatibility before login or data reads."""
+
+    _check_root(invocation)
+    if invocation.target_file is not None:
+        raise click.ClickException("Organization requires explicit environment/tenant flags, without a target file.")
+    sdk = HCSDK(environment=target.environment, tenant_id=target.tenant_id)
+    try:
+        resource = getattr(getattr(sdk, "ams_admin", None), "organization", None)
+        if resource is None or not callable(getattr(resource, "get_hierarchy", None)):
+            raise click.ClickException(
+                "SDK missing ams_admin organization; use the reviewed SDK version required by this CLI."
+            )
+    finally:
+        sdk.close()
+
+
+def require_target(invocation: AmsContext) -> AmsTarget:
+    """Validate root options and load the explicitly selected AMS target."""
+
+    _check_root(invocation)
+    if invocation.target_file is None:
+        raise click.ClickException("AMS requires an explicit --target-file.")
+    return load_target(invocation.target_file)

healthcloud_cli-3.3.0/healthcloud_cli/ams/departments/__init__.py

@@ -0,0 +1,5 @@
+"""Read-only AMS department CLI domain."""
+
+from .group import create_departments_group
+
+__all__ = ["create_departments_group"]

healthcloud_cli-3.3.0/healthcloud_cli/ams/departments/commands.py

@@ -0,0 +1,59 @@
+"""Fresh Click adapters for department reads."""
+
+from __future__ import annotations
+
+import click
+
+from ..context import AmsDependencies, pass_ams, preflight_departments
+from ..errors import run_domain
+from ..target import TenantTarget
+from .operations import get_department, list_departments
+
+
+def _environment(function):
+    return click.option("--environment", type=click.Choice(["dev", "uat", "prod"]), required=True)(function)
+
+
+def _tenant(function):
+    return click.option("--tenant-id", required=True)(function)
+
+
+def create_list_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("list")
+    @_environment
+    @_tenant
+    @pass_ams
+    def command(invocation, environment: str, tenant_id: str) -> None:
+        target_data = {"environment": environment, "tenant_id": tenant_id}
+
+        def execute():
+            target = TenantTarget(environment, tenant_id)
+            preflight_departments(invocation, target)
+            return list_departments(dependencies, target)
+
+        run_domain("departments.list", target_data, execute)
+
+    return command
+
+
+def create_get_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("get")
+    @_environment
+    @_tenant
+    @click.option("--department-id", required=True)
+    @pass_ams
+    def command(invocation, environment: str, tenant_id: str, department_id: str) -> None:
+        target_data = {
+            "environment": environment,
+            "tenant_id": tenant_id,
+            "department_id": department_id,
+        }
+
+        def execute():
+            target = TenantTarget(environment, tenant_id)
+            preflight_departments(invocation, target)
+            return get_department(dependencies, target, department_id)
+
+        run_domain("departments.get", target_data, execute)
+
+    return command

healthcloud_cli-3.3.0/healthcloud_cli/ams/departments/group.py

@@ -0,0 +1,18 @@
+"""Fresh department-domain group assembly."""
+
+from __future__ import annotations
+
+import click
+
+from ..context import AmsDependencies
+from .commands import create_get_command, create_list_command
+
+
+def create_departments_group(dependencies: AmsDependencies) -> click.Group:
+    @click.group("departments")
+    def group() -> None:
+        """Read-only department listing and inspection for one explicit tenant."""
+
+    for factory in (create_list_command, create_get_command):
+        group.add_command(factory(dependencies))
+    return group

healthcloud_cli-3.3.0/healthcloud_cli/ams/departments/operations.py

@@ -0,0 +1,71 @@
+"""Click-free orchestration for department list and get."""
+
+from __future__ import annotations
+
+from ..context import AmsDependencies
+from ..domain_errors import DomainReadRefused
+from ..results import succeeded
+from ..target import TenantTarget
+from .projections import department_projection
+
+
+class DepartmentReadRefused(DomainReadRefused):
+    """A categorized department refusal safe to expose in a bounded error."""
+
+    pass
+
+
+def _department_id(value: str) -> str:
+    if not isinstance(value, str) or not value.strip():
+        raise DepartmentReadRefused("validation", "Explicit department ID required.")
+    if value in {".", ".."}:
+        raise DepartmentReadRefused("validation", "Department ID must not be a dot segment.")
+    return value
+
+
+def _resource(sdk):
+    admin = getattr(sdk, "ams_admin", None)
+    resource = getattr(admin, "departments", None)
+    if (
+        resource is None
+        or not callable(getattr(resource, "list", None))
+        or not callable(getattr(resource, "get", None))
+    ):
+        raise DepartmentReadRefused("unsupported", "Installed SDK does not support department reads.")
+    return resource
+
+
+def _target(target: TenantTarget, department_id: str | None = None) -> dict:
+    value = {"environment": target.environment, "tenant_id": target.tenant_id}
+    if department_id is not None:
+        value["department_id"] = department_id
+    return value
+
+
+def list_departments(dependencies: AmsDependencies, target: TenantTarget) -> dict:
+    with dependencies.authenticated_sdk_factory(target) as sdk:
+        departments = _resource(sdk).list()
+    if any(department.tenant_id != target.tenant_id for department in departments):
+        raise DepartmentReadRefused("validation", "Department/tenant identity mismatch; stopped.")
+    projections = [department_projection(department) for department in departments]
+    return succeeded(
+        "departments.list",
+        _target(target),
+        {
+            "departments": projections,
+            "page": {"kind": "unpaged", "returned_count": len(projections), "continuation": None},
+        },
+    )
+
+
+def get_department(dependencies: AmsDependencies, target: TenantTarget, department_id: str) -> dict:
+    department_id = _department_id(department_id)
+    with dependencies.authenticated_sdk_factory(target) as sdk:
+        department = _resource(sdk).get(department_id)
+    if department is None or department.id != department_id or department.tenant_id != target.tenant_id:
+        raise DepartmentReadRefused("validation", "Department/tenant identity mismatch; stopped.")
+    return succeeded(
+        "departments.get",
+        _target(target, department_id),
+        {"department": department_projection(department)},
+    )