@aderis-erp/cli 1.0.0

package/dist/hooks/command-not-found.d.ts

@@ -0,0 +1,3 @@
+import { type Hook } from '@oclif/core';
+declare const hook: Hook<'command_not_found'>;
+export default hook;

package/dist/hooks/command-not-found.js

@@ -0,0 +1,57 @@
+import { toConfiguredId } from '@oclif/core';
+import { cyan, yellow } from 'ansis';
+// Simple Levenshtein distance for finding closest match
+function levenshtein(a, b) {
+    const matrix = [];
+    for (let i = 0; i <= b.length; i++)
+        matrix[i] = [i];
+    for (let j = 0; j <= a.length; j++)
+        matrix[0][j] = j;
+    for (let i = 1; i <= b.length; i++) {
+        for (let j = 1; j <= a.length; j++) {
+            matrix[i][j] =
+                b.charAt(i - 1) === a.charAt(j - 1)
+                    ? matrix[i - 1][j - 1]
+                    : Math.min(matrix[i - 1][j - 1] + 1, matrix[i][j - 1] + 1, matrix[i - 1][j] + 1);
+        }
+    }
+    return matrix[b.length][a.length];
+}
+function closest(input, candidates) {
+    let best;
+    let bestDistance = Infinity;
+    for (const candidate of candidates) {
+        const distance = levenshtein(input.toLowerCase(), candidate.toLowerCase());
+        // Only suggest if reasonably close (less than half the length difference)
+        if (distance < bestDistance && distance <= Math.max(input.length, candidate.length) / 2) {
+            bestDistance = distance;
+            best = candidate;
+        }
+    }
+    return best;
+}
+const hook = async function (opts) {
+    const id = opts.id;
+    const hiddenCommandIds = new Set(opts.config.commands.filter((c) => c.hidden).map((c) => c.id));
+    const commandIDs = [...opts.config.commandIDs, ...opts.config.commands.flatMap((c) => c.aliases)].filter((c) => !hiddenCommandIds.has(c));
+    if (commandIDs.length === 0)
+        return;
+    let binHelp = `${opts.config.bin} help`;
+    const idSplit = id.split(':');
+    if (opts.config.findTopic(idSplit[0])) {
+        binHelp = `${binHelp} ${idSplit[0]}`;
+    }
+    // Try to find suggestion based on first part of command (topic)
+    // This handles cases like "svendor-invoices:get:abc" -> "vendor-invoices"
+    const firstPart = idSplit[0];
+    const topics = [...new Set(commandIDs.map((c) => c.split(':')[0]))];
+    const suggestion = closest(firstPart, topics) || closest(id, commandIDs);
+    const originalCmd = toConfiguredId(id, this.config);
+    this.warn(`${yellow(originalCmd)} is not a ${opts.config.bin} command.`);
+    if (suggestion) {
+        const readableSuggestion = toConfiguredId(suggestion, this.config);
+        this.log(`Did you mean ${cyan.bold(readableSuggestion)}?`);
+    }
+    this.error(`Run ${cyan.bold(binHelp)} for a list of available commands.`, { exit: 127 });
+};
+export default hook;

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { run } from '@oclif/core';

package/dist/index.js

@@ -0,0 +1 @@
+export { run } from '@oclif/core';

package/dist/lib/api-client.d.ts

@@ -0,0 +1,40 @@
+import { type AxiosInstance } from 'axios';
+export interface ApiResponse<T = unknown> {
+    data: T;
+    headers: Record<string, string>;
+    status: number;
+}
+export interface PaginatedResponse<T> {
+    data: T[];
+    links: {
+        first?: string;
+        last?: string;
+        next?: string;
+        previous?: string;
+    };
+    meta: {
+        currentPage: number;
+        itemCount: number;
+        itemsPerPage: number;
+        totalItems: number;
+        totalPages: number;
+    };
+}
+export declare class ApiError extends Error {
+    status: number;
+    data?: unknown | undefined;
+    constructor(message: string, status: number, data?: unknown | undefined);
+}
+export declare function createApiClient(contextName?: string, acceptAny?: boolean): Promise<AxiosInstance>;
+export declare function apiRequest<T = unknown>(method: string, path: string, options?: {
+    acceptAny?: boolean;
+    contentType?: string;
+    contextName?: string;
+    data?: unknown;
+    params?: Record<string, unknown>;
+}): Promise<ApiResponse<T>>;
+export declare function apiGet<T = unknown>(path: string, params?: Record<string, unknown>, contextName?: string): Promise<ApiResponse<T>>;
+export declare function apiPost<T = unknown>(path: string, data?: unknown, contextName?: string): Promise<ApiResponse<T>>;
+export declare function apiPut<T = unknown>(path: string, data?: unknown, contextName?: string): Promise<ApiResponse<T>>;
+export declare function apiPatch<T = unknown>(path: string, data?: unknown, contextName?: string): Promise<ApiResponse<T>>;
+export declare function apiDelete<T = unknown>(path: string, contextName?: string): Promise<ApiResponse<T>>;

package/dist/lib/api-client.js

@@ -0,0 +1,120 @@
+import axios from 'axios';
+import { getValidToken } from './auth.js';
+import { getBaseUrls, getCurrentContext } from './config.js';
+export class ApiError extends Error {
+    status;
+    data;
+    constructor(message, status, data) {
+        super(message);
+        this.status = status;
+        this.data = data;
+        this.name = 'ApiError';
+    }
+}
+export async function createApiClient(contextName, acceptAny = false) {
+    const context = contextName ? (await import('./config.js')).getContext(contextName) : getCurrentContext();
+    if (!context) {
+        throw new Error('No context configured. Run: aderis auth login --new');
+    }
+    const token = await getValidToken(context.name);
+    const { api: baseURL } = getBaseUrls(context.environment);
+    const client = axios.create({
+        baseURL,
+        headers: {
+            Accept: acceptAny ? '*/*' : 'application/json',
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        // Serialize arrays as repeated params (key=v1&key=v2) instead of bracket format (key[]=v1)
+        paramsSerializer: { indexes: null },
+        // Allow any response type when acceptAny is true
+        responseType: acceptAny ? 'text' : 'json',
+    });
+    // Response interceptor for error handling
+    client.interceptors.response.use((response) => response, (error) => {
+        if (error.response) {
+            // Handle 401 with a clear message
+            if (error.response.status === 401) {
+                throw new ApiError('Session expired. Please run: aderis auth login', 401, error.response.data);
+            }
+            const message = extractErrorMessage(error.response.data);
+            throw new ApiError(message, error.response.status, error.response.data);
+        }
+        throw error;
+    });
+    return client;
+}
+function extractErrorMessage(data) {
+    // If data is a JSON string, try to parse it first
+    if (typeof data === 'string') {
+        try {
+            const parsed = JSON.parse(data);
+            if (typeof parsed === 'object' && parsed !== null) {
+                if (typeof parsed.message === 'string')
+                    return parsed.message;
+                if (Array.isArray(parsed.message))
+                    return parsed.message.join(', ');
+                if (typeof parsed.error === 'string')
+                    return parsed.error;
+            }
+        }
+        catch {
+            // Not JSON, return the string as-is
+            return data;
+        }
+    }
+    if (typeof data === 'object' && data !== null) {
+        const obj = data;
+        if (typeof obj.message === 'string')
+            return obj.message;
+        if (Array.isArray(obj.message))
+            return obj.message.join(', ');
+        if (typeof obj.error === 'string')
+            return obj.error;
+    }
+    return 'Unknown error';
+}
+export async function apiRequest(method, path, options = {}) {
+    const client = await createApiClient(options.contextName, options.acceptAny);
+    const config = {
+        method,
+        url: path,
+    };
+    if (options.params) {
+        config.params = options.params;
+    }
+    if (options.data) {
+        config.data = options.data;
+        // Auto-detect FormData and set appropriate headers
+        if (options.data && typeof options.data === 'object' && 'getHeaders' in options.data) {
+            const formHeaders = options.data.getHeaders();
+            config.headers = { ...config.headers, ...formHeaders };
+        }
+    }
+    // Override Content-Type if specified
+    if (options.contentType) {
+        config.headers = { ...config.headers, 'Content-Type': options.contentType };
+    }
+    const response = await client.request(config);
+    return {
+        data: response.data,
+        headers: response.headers,
+        status: response.status,
+    };
+}
+// Convenience methods
+export async function apiGet(path, params, contextName) {
+    return apiRequest('GET', path, { contextName, params });
+}
+export async function apiPost(path, data, contextName) {
+    return apiRequest('POST', path, { contextName, data });
+}
+export async function apiPut(path, data, contextName) {
+    return apiRequest('PUT', path, { contextName, data });
+}
+export async function apiPatch(path, data, contextName) {
+    return apiRequest('PATCH', path, { contextName, data });
+}
+export async function apiDelete(path, contextName) {
+    return apiRequest('DELETE', path, { contextName });
+}

package/dist/lib/auth.d.ts

@@ -0,0 +1,20 @@
+import { type Context, type TokenData } from './config.js';
+export declare function login(context: Context): Promise<TokenData>;
+export declare function refreshTokens(contextName: string): Promise<TokenData>;
+export declare function getValidToken(contextName: string): Promise<string>;
+export declare function testAuth(contextName: string): Promise<{
+    email: string;
+    name?: string;
+}>;
+export interface Tenant {
+    createdAt?: string;
+    isDefault?: boolean;
+    name: string;
+    tenantId: string;
+}
+export declare function listTenants(contextName: string): Promise<Tenant[]>;
+export declare function getCurrentTenant(contextName: string): Promise<null | {
+    name?: string;
+    tenantId: string;
+}>;
+export declare function switchTenant(contextName: string, tenantId: string): Promise<TokenData>;

package/dist/lib/auth.js

@@ -0,0 +1,431 @@
+import axios from 'axios';
+import jwt from 'jsonwebtoken';
+import * as crypto from 'node:crypto';
+import * as http from 'node:http';
+import { URL, URLSearchParams } from 'node:url';
+import open from 'open';
+import { getBaseUrls, getContext, saveTokens } from './config.js';
+function buildValidatedUrl(baseUrl) {
+    try {
+        // Minimal path validation
+        if (baseUrl.includes('/../') || /\/%2e%2e\//i.test(baseUrl)) {
+            throw new Error('Invalid path');
+        }
+        const url = new URL(baseUrl);
+        // Protocol + host checks
+        const allowedDomains = [
+            'api.aderis.com', 'api-test.aderis.com', 'api-dev.aderis.com',
+            'auth.aderis.com', 'auth-test.aderis.com', 'auth-dev.aderis.com',
+            'localhost',
+        ];
+        if (!allowedDomains.includes(url.hostname)) {
+            throw new Error(`Invalid host: ${url.hostname}`);
+        }
+        if (!['http:', 'https:'].includes(url.protocol)) {
+            throw new Error('Invalid protocol');
+        }
+        return url.href;
+    }
+    catch {
+        throw new Error('Invalid URL');
+    }
+}
+const CALLBACK_PORT = 8085;
+const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}/oauth/callback`;
+const ADERIS_LOGO_URL = 'https://public.aderis.com/69da47c9-274a-4103-bc3e-d9123fd13fac.png';
+const ADERIS_ACCENT_COLOR = '#9687f5';
+function renderAuthPage(type, title, message) {
+    const isSuccess = type === 'success';
+    const iconColor = isSuccess ? ADERIS_ACCENT_COLOR : '#dc2626';
+    const icon = isSuccess
+        ? `<svg width="64" height="64" viewBox="0 0 24 24" fill="none" stroke="${iconColor}" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><path d="m9 12 2 2 4-4"/></svg>`
+        : `<svg width="64" height="64" viewBox="0 0 24 24" fill="none" stroke="${iconColor}" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><line x1="15" y1="9" x2="9" y2="15"/><line x1="9" y1="9" x2="15" y2="15"/></svg>`;
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>${title} - Aderis CLI</title>
+  <style>
+    * {
+      margin: 0;
+      padding: 0;
+      box-sizing: border-box;
+    }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      background: linear-gradient(135deg, #f8f7ff 0%, #f0eeff 100%);
+      padding: 20px;
+    }
+    .container {
+      background: white;
+      border-radius: 16px;
+      box-shadow: 0 4px 24px rgba(150, 135, 245, 0.15);
+      padding: 48px;
+      text-align: center;
+      max-width: 440px;
+      width: 100%;
+    }
+    .logo {
+      margin-bottom: 32px;
+    }
+    .logo img {
+      height: 40px;
+      width: auto;
+    }
+    .icon {
+      margin-bottom: 24px;
+    }
+    h1 {
+      font-size: 24px;
+      font-weight: 600;
+      color: #1a1a2e;
+      margin-bottom: 12px;
+    }
+    .message {
+      font-size: 16px;
+      color: #6b7280;
+      line-height: 1.6;
+      margin-bottom: 8px;
+    }
+    .message strong {
+      color: #1a1a2e;
+    }
+    .hint {
+      font-size: 14px;
+      color: #9ca3af;
+      margin-top: 24px;
+    }
+    .divider {
+      height: 1px;
+      background: linear-gradient(90deg, transparent, #e5e7eb, transparent);
+      margin: 24px 0;
+    }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="logo">
+      <img src="${ADERIS_LOGO_URL}" alt="Aderis" />
+    </div>
+    <div class="icon">
+      ${icon}
+    </div>
+    <h1>${title}</h1>
+    <p class="message">${message}</p>
+    <div class="divider"></div>
+    <p class="hint">You can close this window and return to the CLI.</p>
+  </div>
+</body>
+</html>`;
+}
+function generatePKCE() {
+    const verifier = crypto.randomBytes(32).toString('base64url');
+    const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+    return { challenge, verifier };
+}
+function generateState() {
+    return crypto.randomBytes(16).toString('hex');
+}
+export async function login(context) {
+    const { auth: authUrl } = getBaseUrls(context.environment);
+    const pkce = generatePKCE();
+    const state = generateState();
+    // Build authorization URL
+    const authorizationUrl = new URL(`${authUrl}/oauth/authorize`);
+    authorizationUrl.searchParams.set('client_id', context.client_id);
+    authorizationUrl.searchParams.set('redirect_uri', REDIRECT_URI);
+    authorizationUrl.searchParams.set('response_type', 'code');
+    authorizationUrl.searchParams.set('state', state);
+    authorizationUrl.searchParams.set('code_challenge', pkce.challenge);
+    authorizationUrl.searchParams.set('code_challenge_method', 'S256');
+    authorizationUrl.searchParams.set('scope', 'openid profile email offline_access');
+    return new Promise((resolve, reject) => {
+        const connections = new Set();
+        let timeoutId;
+        const server = http.createServer(async (req, res) => {
+            const url = new URL(req.url || '', `http://localhost:${CALLBACK_PORT}`);
+            if (url.pathname !== '/oauth/callback') {
+                res.writeHead(404);
+                res.end('Not Found');
+                return;
+            }
+            const code = url.searchParams.get('code');
+            const returnedState = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            const errorDescription = url.searchParams.get('error_description');
+            if (error) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('error', 'Authentication Failed', errorDescription || error));
+                closeServer();
+                reject(new Error(errorDescription || error));
+                return;
+            }
+            if (!code || returnedState !== state) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('error', 'Authentication Failed', 'Invalid response from authorization server.'));
+                closeServer();
+                reject(new Error('Invalid authorization response'));
+                return;
+            }
+            try {
+                // Exchange code for tokens
+                const tokens = await exchangeCodeForTokens(context, code, pkce.verifier);
+                res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('success', 'Authentication Successful', `You have been logged in to <strong>${context.name}</strong> (${context.environment}).`));
+                // Save tokens immediately
+                saveTokens(context.name, tokens);
+                // Use setImmediate to let the response flush, then close
+                setImmediate(() => {
+                    closeServer();
+                    resolve(tokens);
+                });
+            }
+            catch (error_) {
+                res.writeHead(500, { 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('error', 'Authentication Failed', error_ instanceof Error ? error_.message : 'Unknown error'));
+                closeServer();
+                reject(error_);
+            }
+        });
+        // Track connections so we can force-close them
+        server.on('connection', (socket) => {
+            connections.add(socket);
+            socket.on('close', () => connections.delete(socket));
+        });
+        const closeServer = () => {
+            // Clear the timeout to allow process to exit
+            clearTimeout(timeoutId);
+            // Destroy all open connections
+            for (const socket of connections) {
+                socket.destroy();
+            }
+            connections.clear();
+            server.close();
+        };
+        server.listen(CALLBACK_PORT, () => {
+            console.log(`Opening browser for authentication...`);
+            console.log(`If the browser doesn't open, visit: ${authorizationUrl.toString()}`);
+            open(authorizationUrl.toString());
+        });
+        server.on('error', (err) => {
+            closeServer();
+            reject(new Error(`Failed to start local server: ${err.message}`));
+        });
+        // Timeout after 5 minutes
+        timeoutId = setTimeout(() => {
+            closeServer();
+            reject(new Error('Authentication timed out'));
+        }, 5 * 60 * 1000);
+    });
+}
+async function exchangeCodeForTokens(context, code, codeVerifier) {
+    const { auth: authUrl } = getBaseUrls(context.environment);
+    const params = new URLSearchParams();
+    params.set('grant_type', 'authorization_code');
+    params.set('client_id', context.client_id);
+    params.set('code', code);
+    params.set('redirect_uri', REDIRECT_URI);
+    params.set('code_verifier', codeVerifier);
+    if (context.client_secret) {
+        params.set('client_secret', context.client_secret);
+    }
+    const response = await axios.post(buildValidatedUrl(`${authUrl}/oauth/token`), params.toString(), {
+        headers: {
+            Accept: 'application/json',
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+    });
+    const tokens = response.data;
+    const decoded = jwt.decode(tokens.access_token);
+    return {
+        access_token: tokens.access_token,
+        expires_at: tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined,
+        refresh_token: tokens.refresh_token,
+        tenant_id: decoded?.tenantId || decoded?.tenant_id,
+    };
+}
+export async function refreshTokens(contextName) {
+    const context = getContext(contextName);
+    if (!context) {
+        throw new Error(`Context "${contextName}" not found`);
+    }
+    if (!context.tokens?.refresh_token) {
+        throw new Error('No refresh token available. Please login again.');
+    }
+    const { auth: authUrl } = getBaseUrls(context.environment);
+    const params = new URLSearchParams();
+    params.set('grant_type', 'refresh_token');
+    params.set('client_id', context.client_id);
+    params.set('refresh_token', context.tokens.refresh_token);
+    if (context.client_secret) {
+        params.set('client_secret', context.client_secret);
+    }
+    let response;
+    try {
+        response = await axios.post(buildValidatedUrl(`${authUrl}/oauth/token`), params.toString(), {
+            headers: {
+                Accept: 'application/json',
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+        });
+    }
+    catch (error) {
+        if (axios.isAxiosError(error) && (error.response?.status === 401 || error.response?.status === 400)) {
+            throw new Error('Session expired. Please run: aderis auth login');
+        }
+        throw error;
+    }
+    const tokens = response.data;
+    const decoded = jwt.decode(tokens.access_token);
+    const tokenData = {
+        access_token: tokens.access_token,
+        expires_at: tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined,
+        refresh_token: tokens.refresh_token || context.tokens.refresh_token,
+        tenant_id: decoded?.tenantId || decoded?.tenant_id,
+    };
+    saveTokens(contextName, tokenData);
+    return tokenData;
+}
+export async function getValidToken(contextName) {
+    const context = getContext(contextName);
+    if (!context) {
+        throw new Error(`Context "${contextName}" not found`);
+    }
+    if (!context.tokens?.access_token) {
+        throw new Error('Not logged in. Please run: aderis auth login');
+    }
+    // Check if token is expired (with 60 second buffer)
+    if (context.tokens.expires_at && context.tokens.expires_at < Date.now() + 60_000) {
+        if (context.tokens.refresh_token) {
+            const newTokens = await refreshTokens(contextName);
+            return newTokens.access_token;
+        }
+        throw new Error('Token expired. Please run: aderis auth login');
+    }
+    return context.tokens.access_token;
+}
+export async function testAuth(contextName) {
+    const context = getContext(contextName);
+    if (!context) {
+        throw new Error(`Context "${contextName}" not found`);
+    }
+    const token = await getValidToken(contextName);
+    const { api: apiUrl } = getBaseUrls(context.environment);
+    const response = await axios.get(buildValidatedUrl(`${apiUrl}/v1/auth/me`), {
+        headers: {
+            Accept: 'application/json',
+            Authorization: `Bearer ${token}`,
+        },
+    });
+    return response.data;
+}
+export async function listTenants(contextName) {
+    const context = getContext(contextName);
+    if (!context) {
+        throw new Error(`Context "${contextName}" not found`);
+    }
+    const token = await getValidToken(contextName);
+    const { auth: authUrl } = getBaseUrls(context.environment);
+    let response;
+    try {
+        // Frontegg endpoint to list user's tenants
+        response = await axios.get(buildValidatedUrl(`${authUrl}/identity/resources/users/v2/me/tenants`), {
+            headers: {
+                Accept: 'application/json',
+                Authorization: `Bearer ${token}`,
+            },
+        });
+    }
+    catch (error) {
+        if (axios.isAxiosError(error) && error.response?.status === 401) {
+            throw new Error('Session expired. Please run: aderis auth login');
+        }
+        throw error;
+    }
+    // Normalize the response - Frontegg may use different field names
+    return response.data.map((t) => ({
+        createdAt: t.createdAt,
+        isDefault: t.isDefault,
+        name: t.name || t.tenantName || t.tenantId,
+        tenantId: t.tenantId,
+    }));
+}
+export async function getCurrentTenant(contextName) {
+    const context = getContext(contextName);
+    if (!context) {
+        throw new Error(`Context "${contextName}" not found`);
+    }
+    if (!context.tokens?.access_token) {
+        return null;
+    }
+    const decoded = jwt.decode(context.tokens.access_token);
+    const tenantId = decoded?.tenantId || decoded?.tenant_id;
+    if (!tenantId) {
+        return null;
+    }
+    // Try to get tenant name from the list
+    try {
+        const tenants = await listTenants(contextName);
+        const tenant = tenants.find((t) => t.tenantId === tenantId);
+        return {
+            name: tenant?.name,
+            tenantId,
+        };
+    }
+    catch {
+        return { tenantId };
+    }
+}
+export async function switchTenant(contextName, tenantId) {
+    const context = getContext(contextName);
+    if (!context) {
+        throw new Error(`Context "${contextName}" not found`);
+    }
+    if (!context.tokens?.refresh_token) {
+        throw new Error('No refresh token available. Please login again.');
+    }
+    const { auth: authUrl } = getBaseUrls(context.environment);
+    const token = await getValidToken(contextName);
+    try {
+        // Step 1: PUT to switch the user's active tenant
+        await axios.put(buildValidatedUrl(`${authUrl}/identity/resources/users/v1/tenant`), { tenantId }, {
+            headers: {
+                Accept: 'application/json',
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json',
+            },
+        });
+        // Step 2: Refresh tokens to get new tokens for the switched tenant
+        const response = await axios.post(buildValidatedUrl(`${authUrl}/oauth/token`), new URLSearchParams({
+            client_id: context.client_id,
+            grant_type: 'refresh_token',
+            refresh_token: context.tokens.refresh_token,
+        }).toString(), {
+            headers: {
+                Accept: 'application/json',
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+        });
+        const tokens = response.data;
+        const decoded = jwt.decode(tokens.access_token);
+        const tokenData = {
+            access_token: tokens.access_token,
+            expires_at: tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined,
+            refresh_token: tokens.refresh_token || context.tokens.refresh_token,
+            tenant_id: decoded?.tenantId || decoded?.tenant_id,
+        };
+        saveTokens(contextName, tokenData);
+        return tokenData;
+    }
+    catch (error) {
+        if (axios.isAxiosError(error) && (error.response?.status === 401 || error.response?.status === 400)) {
+            throw new Error('Session expired. Please run: aderis auth login');
+        }
+        throw error;
+    }
+}