@aderis-erp/cli 1.0.1 → 1.0.3

package/dist/commands/tools.js

@@ -812,32 +812,44 @@ export default class Tools extends Command {
     filterFields(data, fields) {
         const isUnsafeKey = (k) => k === '__proto__' || k === 'constructor' || k === 'prototype';
         const pick = (obj, keys) => {
-            const result = {};
+            // Group keys by their first segment so sibling sub-paths
+            // (e.g. 'items.amount' + 'items._type') resolve in one recursive pass
+            // and don't clobber each other on merge.
+            const directKeys = new Set();
+            const nestedKeys = new Map();
             for (const key of keys) {
                 if (key.split('.').some(isUnsafeKey))
                     continue;
                 if (key.includes('.')) {
-                    // Handle nested fields like 'customer.name' or 'allocations.salesInvoiceId'
                     const [first, ...rest] = key.split('.');
-                    const val = obj[first];
-                    if (val && typeof val === 'object') {
-                        const restKey = rest.join('.');
-                        if (Array.isArray(val)) {
-                            // Map over array elements (e.g., allocations[].salesInvoiceId)
-                            const existing = Array.isArray(result[first]) ? result[first] : [];
-                            result[first] = val.map((item, i) => ({
-                                ...(existing[i] || {}),
-                                ...pick(item, [restKey]),
-                            }));
-                        }
-                        else {
-                            const nested = pick(val, [restKey]);
-                            result[first] = { ...(result[first] || {}), ...nested };
-                        }
+                    if (isUnsafeKey(first))
+                        continue;
+                    const list = nestedKeys.get(first);
+                    if (list) {
+                        list.push(rest.join('.'));
                     }
+                    else {
+                        nestedKeys.set(first, [rest.join('.')]);
+                    }
+                }
+                else {
+                    directKeys.add(key);
                 }
-                else if (key in obj) {
+            }
+            const result = {};
+            for (const key of directKeys) {
+                if (key in obj)
                     result[key] = obj[key];
+            }
+            for (const [first, restKeys] of nestedKeys) {
+                const val = obj[first];
+                if (!val || typeof val !== 'object')
+                    continue;
+                if (Array.isArray(val)) {
+                    result[first] = val.map(item => pick(item, restKeys));
+                }
+                else {
+                    result[first] = pick(val, restKeys);
                 }
             }
             return result;

package/dist/commands/vendor-invoices.js

@@ -6,7 +6,7 @@ const HAS_IMPORT = true;
 const HAS_EXPORT = true;
 const HAS_CAMT053 = false;
 const NESTED_IMPORTS = ["line-items", "notes", "files", "payments"];
-const SUBCOMMANDS = [...["list", "create", "get", "update", "delete", "submit", "approve", "decline", "cancel", "confirm-cancellation", "validate", "create-line-items", "update-line-items", "delete-line-items", "list-notes", "create-notes", "get-notes", "update-notes", "delete-notes", "list-files", "create-files", "get-files", "update-files", "delete-files", "files-download", "list-payments", "create-payments", "get-payments", "update-payments", "delete-payments", "payments-approve", "payments-cancel"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
+const SUBCOMMANDS = [...["list", "create", "get", "update", "delete", "submit", "approve", "decline", "book", "cancel", "confirm-cancellation", "change-vendor", "validate", "create-line-items", "update-line-items", "delete-line-items", "list-notes", "create-notes", "get-notes", "update-notes", "delete-notes", "list-files", "create-files", "get-files", "update-files", "delete-files", "files-download", "list-payments", "create-payments", "get-payments", "update-payments", "delete-payments", "payments-approve", "payments-cancel"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
 const ENDPOINTS = {
     'list': { method: 'GET', path: '/v1/vendor-invoices', summary: 'Get all vendor invoices with pagination', pathParams: [], hasBody: false, isMultipart: false },
     'create': { method: 'POST', path: '/v1/vendor-invoices', summary: 'Create a new vendor invoice', pathParams: [], hasBody: true, isMultipart: false },
@@ -16,8 +16,10 @@ const ENDPOINTS = {
     'submit': { method: 'POST', path: '/v1/vendor-invoices/{id}/submit', summary: 'Submit a vendor invoice for approval (transitions DRAFT to PENDING_APPROVAL)', pathParams: ['id'], hasBody: false, isMultipart: false },
     'approve': { method: 'POST', path: '/v1/vendor-invoices/{id}/approve', summary: 'Approve a vendor invoice (transitions DRAFT/PENDING_APPROVAL to APPROVED)', pathParams: ['id'], hasBody: true, isMultipart: false },
     'decline': { method: 'POST', path: '/v1/vendor-invoices/{id}/decline', summary: 'Decline a vendor invoice (transitions PENDING_APPROVAL to DECLINED)', pathParams: ['id'], hasBody: true, isMultipart: false },
+    'book': { method: 'POST', path: '/v1/vendor-invoices/{id}/book', summary: 'Manually book a vendor invoice (dispatch to ledger-booking-agent)', pathParams: ['id'], hasBody: false, isMultipart: false },
     'cancel': { method: 'POST', path: '/v1/vendor-invoices/{id}/cancel', summary: 'Cancel a vendor invoice', pathParams: ['id'], hasBody: true, isMultipart: false },
     'confirm-cancellation': { method: 'POST', path: '/v1/vendor-invoices/{id}/confirm-cancellation', summary: 'Confirm bank cancellation for a vendor invoice (PENDING_CANCELLATION to CANCELLED)', pathParams: ['id'], hasBody: true, isMultipart: false },
+    'change-vendor': { method: 'POST', path: '/v1/vendor-invoices/{id}/change-vendor', summary: 'Change the vendor on a vendor invoice', pathParams: ['id'], hasBody: true, isMultipart: false },
     'validate': { method: 'POST', path: '/v1/vendor-invoices/{id}/validate', summary: 'Validate a vendor invoice update without persisting changes', pathParams: ['id'], hasBody: true, isMultipart: false },
     'create-line-items': { method: 'POST', path: '/v1/vendor-invoices/{invoiceId}/line-items', summary: 'Add a line item to a vendor invoice', pathParams: ['invoiceId'], hasBody: true, isMultipart: false },
     'update-line-items': { method: 'PATCH', path: '/v1/vendor-invoices/{invoiceId}/line-items/{lineItemId}', summary: 'Update a line item on a vendor invoice', pathParams: ['invoiceId', 'lineItemId'], hasBody: true, isMultipart: false },
@@ -850,32 +852,44 @@ export default class VendorInvoices extends Command {
     filterFields(data, fields) {
         const isUnsafeKey = (k) => k === '__proto__' || k === 'constructor' || k === 'prototype';
         const pick = (obj, keys) => {
-            const result = {};
+            // Group keys by their first segment so sibling sub-paths
+            // (e.g. 'items.amount' + 'items._type') resolve in one recursive pass
+            // and don't clobber each other on merge.
+            const directKeys = new Set();
+            const nestedKeys = new Map();
             for (const key of keys) {
                 if (key.split('.').some(isUnsafeKey))
                     continue;
                 if (key.includes('.')) {
-                    // Handle nested fields like 'customer.name' or 'allocations.salesInvoiceId'
                     const [first, ...rest] = key.split('.');
-                    const val = obj[first];
-                    if (val && typeof val === 'object') {
-                        const restKey = rest.join('.');
-                        if (Array.isArray(val)) {
-                            // Map over array elements (e.g., allocations[].salesInvoiceId)
-                            const existing = Array.isArray(result[first]) ? result[first] : [];
-                            result[first] = val.map((item, i) => ({
-                                ...(existing[i] || {}),
-                                ...pick(item, [restKey]),
-                            }));
-                        }
-                        else {
-                            const nested = pick(val, [restKey]);
-                            result[first] = { ...(result[first] || {}), ...nested };
-                        }
+                    if (isUnsafeKey(first))
+                        continue;
+                    const list = nestedKeys.get(first);
+                    if (list) {
+                        list.push(rest.join('.'));
                     }
+                    else {
+                        nestedKeys.set(first, [rest.join('.')]);
+                    }
+                }
+                else {
+                    directKeys.add(key);
                 }
-                else if (key in obj) {
+            }
+            const result = {};
+            for (const key of directKeys) {
+                if (key in obj)
                     result[key] = obj[key];
+            }
+            for (const [first, restKeys] of nestedKeys) {
+                const val = obj[first];
+                if (!val || typeof val !== 'object')
+                    continue;
+                if (Array.isArray(val)) {
+                    result[first] = val.map(item => pick(item, restKeys));
+                }
+                else {
+                    result[first] = pick(val, restKeys);
                 }
             }
             return result;

package/dist/commands/webhooks.js

@@ -821,32 +821,44 @@ export default class Webhooks extends Command {
     filterFields(data, fields) {
         const isUnsafeKey = (k) => k === '__proto__' || k === 'constructor' || k === 'prototype';
         const pick = (obj, keys) => {
-            const result = {};
+            // Group keys by their first segment so sibling sub-paths
+            // (e.g. 'items.amount' + 'items._type') resolve in one recursive pass
+            // and don't clobber each other on merge.
+            const directKeys = new Set();
+            const nestedKeys = new Map();
             for (const key of keys) {
                 if (key.split('.').some(isUnsafeKey))
                     continue;
                 if (key.includes('.')) {
-                    // Handle nested fields like 'customer.name' or 'allocations.salesInvoiceId'
                     const [first, ...rest] = key.split('.');
-                    const val = obj[first];
-                    if (val && typeof val === 'object') {
-                        const restKey = rest.join('.');
-                        if (Array.isArray(val)) {
-                            // Map over array elements (e.g., allocations[].salesInvoiceId)
-                            const existing = Array.isArray(result[first]) ? result[first] : [];
-                            result[first] = val.map((item, i) => ({
-                                ...(existing[i] || {}),
-                                ...pick(item, [restKey]),
-                            }));
-                        }
-                        else {
-                            const nested = pick(val, [restKey]);
-                            result[first] = { ...(result[first] || {}), ...nested };
-                        }
+                    if (isUnsafeKey(first))
+                        continue;
+                    const list = nestedKeys.get(first);
+                    if (list) {
+                        list.push(rest.join('.'));
                     }
+                    else {
+                        nestedKeys.set(first, [rest.join('.')]);
+                    }
+                }
+                else {
+                    directKeys.add(key);
                 }
-                else if (key in obj) {
+            }
+            const result = {};
+            for (const key of directKeys) {
+                if (key in obj)
                     result[key] = obj[key];
+            }
+            for (const [first, restKeys] of nestedKeys) {
+                const val = obj[first];
+                if (!val || typeof val !== 'object')
+                    continue;
+                if (Array.isArray(val)) {
+                    result[first] = val.map(item => pick(item, restKeys));
+                }
+                else {
+                    result[first] = pick(val, restKeys);
                 }
             }
             return result;

package/dist/commands/workflows.js

@@ -813,32 +813,44 @@ export default class Workflows extends Command {
     filterFields(data, fields) {
         const isUnsafeKey = (k) => k === '__proto__' || k === 'constructor' || k === 'prototype';
         const pick = (obj, keys) => {
-            const result = {};
+            // Group keys by their first segment so sibling sub-paths
+            // (e.g. 'items.amount' + 'items._type') resolve in one recursive pass
+            // and don't clobber each other on merge.
+            const directKeys = new Set();
+            const nestedKeys = new Map();
             for (const key of keys) {
                 if (key.split('.').some(isUnsafeKey))
                     continue;
                 if (key.includes('.')) {
-                    // Handle nested fields like 'customer.name' or 'allocations.salesInvoiceId'
                     const [first, ...rest] = key.split('.');
-                    const val = obj[first];
-                    if (val && typeof val === 'object') {
-                        const restKey = rest.join('.');
-                        if (Array.isArray(val)) {
-                            // Map over array elements (e.g., allocations[].salesInvoiceId)
-                            const existing = Array.isArray(result[first]) ? result[first] : [];
-                            result[first] = val.map((item, i) => ({
-                                ...(existing[i] || {}),
-                                ...pick(item, [restKey]),
-                            }));
-                        }
-                        else {
-                            const nested = pick(val, [restKey]);
-                            result[first] = { ...(result[first] || {}), ...nested };
-                        }
+                    if (isUnsafeKey(first))
+                        continue;
+                    const list = nestedKeys.get(first);
+                    if (list) {
+                        list.push(rest.join('.'));
                     }
+                    else {
+                        nestedKeys.set(first, [rest.join('.')]);
+                    }
+                }
+                else {
+                    directKeys.add(key);
                 }
-                else if (key in obj) {
+            }
+            const result = {};
+            for (const key of directKeys) {
+                if (key in obj)
                     result[key] = obj[key];
+            }
+            for (const [first, restKeys] of nestedKeys) {
+                const val = obj[first];
+                if (!val || typeof val !== 'object')
+                    continue;
+                if (Array.isArray(val)) {
+                    result[first] = val.map(item => pick(item, restKeys));
+                }
+                else {
+                    result[first] = pick(val, restKeys);
                 }
             }
             return result;

package/dist/index 2.js

@@ -0,0 +1 @@
+export { run } from '@oclif/core';

package/dist/index.d 2.ts

@@ -0,0 +1 @@
+export { run } from '@oclif/core';

package/dist/lib/auth.d.ts

@@ -1,5 +1,7 @@
 import { type Context, type TokenData } from './config.js';
-export declare function login(context: Context): Promise<TokenData>;
+export declare function login(context: Context, options?: {
+    prompt?: 'login' | 'none';
+}): Promise<TokenData>;
 export declare function refreshTokens(contextName: string): Promise<TokenData>;
 export declare function getValidToken(contextName: string): Promise<string>;
 export declare function testAuth(contextName: string): Promise<{
@@ -18,3 +20,16 @@ export declare function getCurrentTenant(contextName: string): Promise<null | {
     tenantId: string;
 }>;
 export declare function switchTenant(contextName: string, tenantId: string): Promise<TokenData>;
+/**
+ * Combined login + tenant switch flow that uses a single browser tab.
+ *
+ * Two PKCE rounds run against one local callback server. After the first round
+ * completes (which gives us tokens we can use to PUT the new active tenant),
+ * the server responds with HTML that meta-refreshes the same browser tab to a
+ * second `/oauth/authorize` URL. The second round mints tokens scoped to the
+ * new active tenant.
+ *
+ * Used by `aderis switch` when the user's session is expired AND they want to
+ * end up on a different tenant — avoids the previous two-separate-tab UX.
+ */
+export declare function loginAndSwitchTenant(context: Context, tenantId: string): Promise<TokenData>;

package/dist/lib/auth.js

@@ -4,8 +4,8 @@ import * as crypto from 'node:crypto';
 import * as http from 'node:http';
 import { URL, URLSearchParams } from 'node:url';
 import open from 'open';
-import { getBaseUrls, getContext, saveTokens } from './config.js';
-function buildValidatedUrl(baseUrl) {
+import { getBaseUrls, getContext, saveCachedTenants, saveTokens, } from './config.js';
+function buildValidatedUrl(baseUrl, path) {
     try {
         // Minimal path validation
         if (baseUrl.includes('/../') || /\/%2e%2e\//i.test(baseUrl)) {
@@ -24,6 +24,15 @@ function buildValidatedUrl(baseUrl) {
         if (!['http:', 'https:'].includes(url.protocol)) {
             throw new Error('Invalid protocol');
         }
+        // Add path if provided
+        if (path) {
+            if (path.includes('/../') || /\/%2e%2e\//i.test(path)) {
+                throw new Error('Invalid path');
+            }
+            // Ensure path starts with / and append to pathname
+            const cleanPath = path.startsWith('/') ? path : '/' + path;
+            url.pathname = url.pathname.replace(/\/$/, '') + cleanPath;
+        }
         return url.href;
     }
     catch {
@@ -131,19 +140,24 @@ function generatePKCE() {
 function generateState() {
     return crypto.randomBytes(16).toString('hex');
 }
-export async function login(context) {
+function buildAuthorizeUrl(context, pkce, state, options = {}) {
     const { auth: authUrl } = getBaseUrls(context.environment);
+    const url = new URL(`${authUrl}/oauth/authorize`);
+    url.searchParams.set('client_id', context.client_id);
+    url.searchParams.set('redirect_uri', REDIRECT_URI);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('state', state);
+    url.searchParams.set('code_challenge', pkce.challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('scope', 'openid profile email offline_access');
+    if (options.prompt)
+        url.searchParams.set('prompt', options.prompt);
+    return url.toString();
+}
+export async function login(context, options = {}) {
     const pkce = generatePKCE();
     const state = generateState();
-    // Build authorization URL
-    const authorizationUrl = new URL(`${authUrl}/oauth/authorize`);
-    authorizationUrl.searchParams.set('client_id', context.client_id);
-    authorizationUrl.searchParams.set('redirect_uri', REDIRECT_URI);
-    authorizationUrl.searchParams.set('response_type', 'code');
-    authorizationUrl.searchParams.set('state', state);
-    authorizationUrl.searchParams.set('code_challenge', pkce.challenge);
-    authorizationUrl.searchParams.set('code_challenge_method', 'S256');
-    authorizationUrl.searchParams.set('scope', 'openid profile email offline_access');
+    const authorizationUrl = buildAuthorizeUrl(context, pkce, state, options);
     return new Promise((resolve, reject) => {
         const connections = new Set();
         let timeoutId;
@@ -209,8 +223,8 @@ export async function login(context) {
         };
         server.listen(CALLBACK_PORT, () => {
             console.log(`Opening browser for authentication...`);
-            console.log(`If the browser doesn't open, visit: ${authorizationUrl.toString()}`);
-            open(authorizationUrl.toString());
+            console.log(`If the browser doesn't open, visit: ${authorizationUrl}`);
+            open(authorizationUrl);
         });
         server.on('error', (err) => {
             closeServer();
@@ -234,7 +248,7 @@ async function exchangeCodeForTokens(context, code, codeVerifier) {
     if (context.client_secret) {
         params.set('client_secret', context.client_secret);
     }
-    const response = await axios.post(buildValidatedUrl(`${authUrl}/oauth/token`), params.toString(), {
+    const response = await axios.post(buildValidatedUrl(authUrl, '/oauth/token'), params.toString(), {
         headers: {
             Accept: 'application/json',
             'Content-Type': 'application/x-www-form-urlencoded',
@@ -267,7 +281,7 @@ export async function refreshTokens(contextName) {
     }
     let response;
     try {
-        response = await axios.post(buildValidatedUrl(`${authUrl}/oauth/token`), params.toString(), {
+        response = await axios.post(buildValidatedUrl(authUrl, '/oauth/token'), params.toString(), {
             headers: {
                 Accept: 'application/json',
                 'Content-Type': 'application/x-www-form-urlencoded',
@@ -316,7 +330,7 @@ export async function testAuth(contextName) {
     }
     const token = await getValidToken(contextName);
     const { api: apiUrl } = getBaseUrls(context.environment);
-    const response = await axios.get(buildValidatedUrl(`${apiUrl}/v1/auth/me`), {
+    const response = await axios.get(buildValidatedUrl(apiUrl, '/v1/auth/me'), {
         headers: {
             Accept: 'application/json',
             Authorization: `Bearer ${token}`,
@@ -334,7 +348,7 @@ export async function listTenants(contextName) {
     let response;
     try {
         // Frontegg endpoint to list user's tenants
-        response = await axios.get(buildValidatedUrl(`${authUrl}/identity/resources/users/v2/me/tenants`), {
+        response = await axios.get(buildValidatedUrl(authUrl, '/identity/resources/users/v2/me/tenants'), {
             headers: {
                 Accept: 'application/json',
                 Authorization: `Bearer ${token}`,
@@ -348,12 +362,16 @@ export async function listTenants(contextName) {
         throw error;
     }
     // Normalize the response - Frontegg may use different field names
-    return response.data.map((t) => ({
+    const tenants = response.data.map((t) => ({
         createdAt: t.createdAt,
         isDefault: t.isDefault,
         name: t.name || t.tenantName || t.tenantId,
         tenantId: t.tenantId,
     }));
+    // Cache for use when the access token is expired (e.g. session-expired branch
+    // of `aderis switch`, where we want to show the picker before re-authenticating).
+    saveCachedTenants(contextName, tenants.map((t) => ({ name: t.name, tenantId: t.tenantId })));
+    return tenants;
 }
 export async function getCurrentTenant(contextName) {
     const context = getContext(contextName);
@@ -389,38 +407,14 @@ export async function switchTenant(contextName, tenantId) {
     if (!context.tokens?.refresh_token) {
         throw new Error('No refresh token available. Please login again.');
     }
-    const { auth: authUrl } = getBaseUrls(context.environment);
-    const token = await getValidToken(contextName);
     try {
-        // Step 1: PUT to switch the user's active tenant
-        await axios.put(buildValidatedUrl(`${authUrl}/identity/resources/users/v1/tenant`), { tenantId }, {
-            headers: {
-                Accept: 'application/json',
-                Authorization: `Bearer ${token}`,
-                'Content-Type': 'application/json',
-            },
-        });
-        // Step 2: Refresh tokens to get new tokens for the switched tenant
-        const response = await axios.post(buildValidatedUrl(`${authUrl}/oauth/token`), new URLSearchParams({
-            client_id: context.client_id,
-            grant_type: 'refresh_token',
-            refresh_token: context.tokens.refresh_token,
-        }).toString(), {
-            headers: {
-                Accept: 'application/json',
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-        });
-        const tokens = response.data;
-        const decoded = jwt.decode(tokens.access_token);
-        const tokenData = {
-            access_token: tokens.access_token,
-            expires_at: tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined,
-            refresh_token: tokens.refresh_token || context.tokens.refresh_token,
-            tenant_id: decoded?.tenantId || decoded?.tenant_id,
-        };
-        saveTokens(contextName, tokenData);
-        return tokenData;
+        // Delegate to the two-round PKCE flow. Round 1 issues a token for whatever
+        // tenant Frontegg's session cookie currently holds (which forces Frontegg
+        // to refresh its session state), then we PUT the requested tenant, and
+        // round 2 — reached via meta-refresh on the same browser tab — issues a
+        // token scoped to the new tenant. No re-authentication is required because
+        // the user's Frontegg session cookie is still valid.
+        return await loginAndSwitchTenant(context, tenantId);
     }
     catch (error) {
         if (axios.isAxiosError(error) && (error.response?.status === 401 || error.response?.status === 400)) {
@@ -429,3 +423,126 @@ export async function switchTenant(contextName, tenantId) {
         throw error;
     }
 }
+/**
+ * Combined login + tenant switch flow that uses a single browser tab.
+ *
+ * Two PKCE rounds run against one local callback server. After the first round
+ * completes (which gives us tokens we can use to PUT the new active tenant),
+ * the server responds with HTML that meta-refreshes the same browser tab to a
+ * second `/oauth/authorize` URL. The second round mints tokens scoped to the
+ * new active tenant.
+ *
+ * Used by `aderis switch` when the user's session is expired AND they want to
+ * end up on a different tenant — avoids the previous two-separate-tab UX.
+ */
+export async function loginAndSwitchTenant(context, tenantId) {
+    const { auth: authUrl } = getBaseUrls(context.environment);
+    const pkce1 = generatePKCE();
+    const state1 = generateState();
+    const pkce2 = generatePKCE();
+    const state2 = generateState();
+    const authorizeUrl1 = buildAuthorizeUrl(context, pkce1, state1);
+    const authorizeUrl2 = buildAuthorizeUrl(context, pkce2, state2);
+    return new Promise((resolve, reject) => {
+        const connections = new Set();
+        const timeoutRef = {};
+        const closeServer = () => {
+            if (timeoutRef.id)
+                clearTimeout(timeoutRef.id);
+            for (const socket of connections) {
+                socket.destroy();
+            }
+            connections.clear();
+            server.close();
+        };
+        const server = http.createServer(async (req, res) => {
+            const url = new URL(req.url || '', `http://localhost:${CALLBACK_PORT}`);
+            if (url.pathname !== '/oauth/callback') {
+                res.writeHead(404);
+                res.end('Not Found');
+                return;
+            }
+            const code = url.searchParams.get('code');
+            const returnedState = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            const errorDescription = url.searchParams.get('error_description');
+            if (error || !code || !returnedState) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('error', 'Authentication Failed', errorDescription || error || 'Invalid response'));
+                closeServer();
+                reject(new Error(errorDescription || error || 'Invalid authorization response'));
+                return;
+            }
+            try {
+                if (returnedState === state1) {
+                    // Round 1: fresh login → tokens for whatever tenant Frontegg considers
+                    // active for this user. PUT to set the requested tenant, then redirect
+                    // the SAME browser tab to authorize URL #2 so Frontegg re-mints tokens.
+                    const tokens1 = await exchangeCodeForTokens(context, code, pkce1.verifier);
+                    saveTokens(context.name, tokens1);
+                    await axios.put(buildValidatedUrl(authUrl, '/identity/resources/users/v1/tenant'), { tenantId }, {
+                        headers: {
+                            Accept: 'application/json',
+                            Authorization: `Bearer ${tokens1.access_token}`,
+                            'Content-Type': 'application/json',
+                        },
+                    });
+                    res.writeHead(200, { 'Content-Type': 'text/html' });
+                    res.end(`<!DOCTYPE html>
+<html><head>
+<meta charset="UTF-8">
+<meta http-equiv="refresh" content="0; url=${authorizeUrl2}">
+<title>Switching tenant…</title>
+</head><body><p>Switching tenant…</p></body></html>`);
+                    return;
+                }
+                if (returnedState === state2) {
+                    // Round 2: tokens scoped to the new tenant.
+                    const tokens2 = await exchangeCodeForTokens(context, code, pkce2.verifier);
+                    saveTokens(context.name, tokens2);
+                    if (tokens2.tenant_id !== tenantId) {
+                        res.writeHead(400, { 'Content-Type': 'text/html' });
+                        res.end(renderAuthPage('error', 'Tenant Switch Failed', `Frontegg returned a token for tenant ${tokens2.tenant_id} instead of ${tenantId}.`));
+                        closeServer();
+                        reject(new Error(`Tenant switch did not propagate. Frontegg returned tenant ${tokens2.tenant_id} instead of ${tenantId}. Please try again in a few seconds.`));
+                        return;
+                    }
+                    res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html' });
+                    res.end(renderAuthPage('success', 'Tenant Switched', `You have been logged in to <strong>${context.name}</strong> on the selected tenant.`));
+                    setImmediate(() => {
+                        closeServer();
+                        resolve(tokens2);
+                    });
+                    return;
+                }
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('error', 'Authentication Failed', 'Invalid state parameter.'));
+                closeServer();
+                reject(new Error('Invalid state in callback'));
+            }
+            catch (error_) {
+                res.writeHead(500, { 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('error', 'Authentication Failed', error_ instanceof Error ? error_.message : 'Unknown error'));
+                closeServer();
+                reject(error_);
+            }
+        });
+        server.on('connection', (socket) => {
+            connections.add(socket);
+            socket.on('close', () => connections.delete(socket));
+        });
+        server.listen(CALLBACK_PORT, () => {
+            console.log('Opening browser for authentication…');
+            console.log(`If the browser doesn't open, visit: ${authorizeUrl1}`);
+            open(authorizeUrl1);
+        });
+        server.on('error', (err) => {
+            closeServer();
+            reject(new Error(`Failed to start local server: ${err.message}`));
+        });
+        timeoutRef.id = setTimeout(() => {
+            closeServer();
+            reject(new Error('Authentication timed out'));
+        }, 5 * 60 * 1000);
+    });
+}

package/dist/lib/config.d.ts

@@ -12,7 +12,12 @@ export interface TokenData {
     refresh_token?: string;
     tenant_id?: string;
 }
+export interface CachedTenant {
+    name: string;
+    tenantId: string;
+}
 export interface Context {
+    cachedTenants?: CachedTenant[];
     client_id: string;
     client_secret?: string;
     environment: Environment;
@@ -34,6 +39,8 @@ export declare function addContext(context: Context): void;
 export declare function updateContext(name: string, updates: Partial<Context>): void;
 export declare function deleteContext(name: string): void;
 export declare function saveTokens(contextName: string, tokens: TokenData): void;
+export declare function saveCachedTenants(contextName: string, tenants: CachedTenant[]): void;
+export declare function getCachedTenants(contextName: string): CachedTenant[] | undefined;
 export declare function getTokens(contextName: string): null | TokenData;
 export declare function clearTokens(contextName: string): void;
 export declare function getBaseUrls(environment: Environment): BaseUrls;

package/dist/lib/config.js

@@ -100,6 +100,12 @@ export function saveTokens(contextName, tokens) {
         tokens,
     });
 }
+export function saveCachedTenants(contextName, tenants) {
+    updateContext(contextName, { cachedTenants: tenants });
+}
+export function getCachedTenants(contextName) {
+    return getContext(contextName)?.cachedTenants;
+}
 export function getTokens(contextName) {
     const context = getContext(contextName);
     return context?.tokens || null;