@aderis-erp/cli 1.0.13 → 1.0.15

package/dist/commands/analytics.d.ts

@@ -0,0 +1,40 @@
+import { Command } from '@oclif/core';
+export default class Analytics extends Command {
+    static description: string;
+    static examples: never[];
+    static args: {
+        action: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        id: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        context: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        table: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        csv: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        data: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        set: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        page: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        limit: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        include: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        search: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'sort-by': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        filter: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        query: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        fields: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        sanitize: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'show-http-request': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private runImport;
+    private runExport;
+    private runCamt053Import;
+    private runNestedImport;
+    private parseFilterValue;
+    private filterFields;
+    private sanitizeOutput;
+    private getColumns;
+    private getValue;
+    private printTable;
+    private printCsv;
+}

package/dist/commands/{documents.js → analytics.js}

@@ -1,36 +1,26 @@
 import { Command, Args, Flags } from '@oclif/core';
-import { apiRequest, ApiError } from '../lib/api-client.js';
-import { getCurrentContext, getContext, getBaseUrls } from '../lib/config.js';
+import { apiRequest, ApiError, normalizeSortBy } from '../lib/api-client.js';
+import { getCurrentContext, getContext, getBaseUrls, hasCredentials, missingCredentialsMessage } from '../lib/config.js';
 // Add 'import' action if both create and update exist
-const HAS_IMPORT = true;
-const HAS_EXPORT = true;
+const HAS_IMPORT = false;
+const HAS_EXPORT = false;
 const HAS_CAMT053 = false;
 const NESTED_IMPORTS = [];
-const SUBCOMMANDS = [...["list", "create", "get", "update", "delete", "reclassify"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
+const SUBCOMMANDS = [...["query", "views", "views-name"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
 const ENDPOINTS = {
-    'list': { method: 'GET', path: '/v1/documents', summary: 'List documents (paginated)', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
-    'create': { method: 'POST', path: '/v1/documents', summary: 'Create a new document (letterbox)', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: ['references', 'tags', 'files'] },
-    'get': { method: 'GET', path: '/v1/documents/{id}', summary: 'Get document detail with files, audit log, and notes placeholder', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
-    'update': { method: 'PATCH', path: '/v1/documents/{id}', summary: 'Patch an existing document', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: ['references', 'tags', 'files'] },
-    'delete': { method: 'DELETE', path: '/v1/documents/{id}', summary: 'Soft-delete (discard) a document', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
-    'reclassify': { method: 'POST', path: '/v1/documents/{id}/reclassify', summary: 'Reclassify a document to a new type', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
+    'query': { method: 'POST', path: '/v1/analytics/query', summary: 'Run a structured aggregate query over a reporting view', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: ['measures', 'dimensions', 'filters', 'order'] },
+    'views': { method: 'GET', path: '/v1/analytics/views', summary: 'List the analytics views for discovery', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
+    'views-name': { method: 'GET', path: '/v1/analytics/views/{name}', summary: 'Describe one analytics view with full metadata', pathParams: ['name'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
 };
-export default class Documents extends Command {
-    static description = 'Manage documents';
-    static examples = [
-        '<%= config.bin %> documents list',
-        '<%= config.bin %> documents get <id>',
-        '<%= config.bin %> documents create --data \'{...}\'',
-        '<%= config.bin %> documents update <id> --set field=value',
-        '<%= config.bin %> documents import --file data.json',
-        '<%= config.bin %> documents export --csv > documents.csv',
-    ];
+export default class Analytics extends Command {
+    static description = 'Manage analytics';
+    static examples = [];
     static args = {
         action: Args.string({ description: 'Action: ' + SUBCOMMANDS.join(', '), required: true }),
         id: Args.string({ description: 'Resource ID (for get, update, delete operations)', required: false }),
     };
     static flags = {
-        context: Flags.string({ char: 'c', description: 'Context to use' }),
+        context: Flags.string({ char: 'c', aliases: ['config'], env: 'ADERIS_CONTEXT', description: 'Context to use for this command, overriding the current context (alias: --config)' }),
         output: Flags.string({ char: 'o', description: 'Output format (default: table for import, json for other commands)', options: ['json', 'table', 'csv'] }),
         table: Flags.boolean({ char: 't', description: 'Output as table (shortcut for --output table)' }),
         csv: Flags.boolean({ description: 'Output as CSV (shortcut for --output csv)' }),
@@ -41,7 +31,7 @@ export default class Documents extends Command {
         limit: Flags.string({ description: 'Items per page' }),
         include: Flags.string({ description: 'Relations to include' }),
         search: Flags.string({ description: 'Search term' }),
-        'sort-by': Flags.string({ description: 'Sort field' }),
+        'sort-by': Flags.string({ description: 'Sort field(s), comma-separated. Direction (:ASC/:DESC) is optional; date-like fields default to DESC, others to ASC.' }),
         filter: Flags.string({ description: 'Filter (e.g. --filter status=ACTIVE). Operators: in:A,B, like:%, gt:, lt:, null:', multiple: true }),
         query: Flags.string({ description: 'Additional query params as JSON' }),
         fields: Flags.string({ description: 'Comma-separated list of fields to show (e.g. --fields=id,name,status)' }),
@@ -49,7 +39,7 @@ export default class Documents extends Command {
         'show-http-request': Flags.boolean({ description: 'Show HTTP request details (method, URL, body)' }),
     };
     async run() {
-        const { args, flags } = await this.parse(Documents);
+        const { args, flags } = await this.parse(Analytics);
         // Handle import action specially
         if (args.action === 'import') {
             if (!HAS_IMPORT)
@@ -90,7 +80,7 @@ export default class Documents extends Command {
                 // First path param always comes from positional argument
                 value = args.id;
                 if (!value)
-                    this.error('Missing required argument: id. Usage: aderis documents <action> <id>');
+                    this.error('Missing required argument: id. Usage: aderis analytics <action> <id>');
             }
             else {
                 const flagName = param.replace(/\./g, '-').replace(/([A-Z])/g, '-$1').toLowerCase().replace(/^-/, '');
@@ -102,9 +92,9 @@ export default class Documents extends Command {
         }
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         const queryParams = {};
         if (flags.page)
             queryParams.page = flags.page;
@@ -115,7 +105,7 @@ export default class Documents extends Command {
         if (flags.search)
             queryParams.search = flags.search;
         if (flags['sort-by'])
-            queryParams.sortBy = flags['sort-by'];
+            queryParams.sortBy = normalizeSortBy(flags['sort-by']);
         if (flags.query) {
             try {
                 Object.assign(queryParams, JSON.parse(flags.query));
@@ -347,9 +337,9 @@ export default class Documents extends Command {
     async runImport(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         // Get data from file, --data, or --set flags
         let items = [];
         if (flags.file) {
@@ -559,9 +549,9 @@ export default class Documents extends Command {
     async runExport(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         const listEndpoint = ENDPOINTS['list'];
         if (!listEndpoint)
             this.error('Export requires a list endpoint');
@@ -574,7 +564,7 @@ export default class Documents extends Command {
         if (flags.search)
             baseParams.search = flags.search;
         if (flags['sort-by'])
-            baseParams.sortBy = flags['sort-by'];
+            baseParams.sortBy = normalizeSortBy(flags['sort-by']);
         if (flags.include)
             baseParams.include = flags.include;
         if (flags.query) {
@@ -653,9 +643,9 @@ export default class Documents extends Command {
     async runCamt053Import(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         if (!flags.file) {
             this.error('CAMT.053 import requires --file (-f) flag with path to XML file');
         }
@@ -739,13 +729,13 @@ export default class Documents extends Command {
     }
     async runNestedImport(suffix, parentId, flags) {
         if (!parentId) {
-            this.error(`Missing required argument: id. Usage: aderis documents import-${suffix} <parent-id> --file data.json`);
+            this.error(`Missing required argument: id. Usage: aderis analytics import-${suffix} <parent-id> --file data.json`);
         }
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         // Get data from file, --data, or --set flags
         let items = [];
         if (flags.file) {

package/dist/commands/audit-log.js

@@ -1,21 +1,21 @@
 import { Command, Args, Flags } from '@oclif/core';
-import { apiRequest, ApiError } from '../lib/api-client.js';
-import { getCurrentContext, getContext, getBaseUrls } from '../lib/config.js';
+import { apiRequest, ApiError, normalizeSortBy } from '../lib/api-client.js';
+import { getCurrentContext, getContext, getBaseUrls, hasCredentials, missingCredentialsMessage } from '../lib/config.js';
 // Add 'import' action if both create and update exist
 const HAS_IMPORT = false;
 const HAS_EXPORT = true;
 const HAS_CAMT053 = false;
 const NESTED_IMPORTS = [];
-const SUBCOMMANDS = [...["list", "find-entity", "find-workflow"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
+const SUBCOMMANDS = [...["list", "get"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
 const ENDPOINTS = {
     'list': { method: 'GET', path: '/v1/audit-logs', summary: 'Get audit log entries', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
-    'find-entity': { method: 'GET', path: '/v1/audit-logs/entity/{entityId}', summary: 'Get audit history for a specific entity', pathParams: ['entityId'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
-    'find-workflow': { method: 'GET', path: '/v1/audit-logs/workflow/{workflowId}', summary: 'Get audit log entries for a specific workflow', pathParams: ['workflowId'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
+    'get': { method: 'GET', path: '/v1/audit-logs/{id}', summary: 'Get a single audit log entry', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
 };
 export default class AuditLog extends Command {
     static description = 'Manage audit log';
     static examples = [
         '<%= config.bin %> audit-log list',
+        '<%= config.bin %> audit-log get <id>',
         '<%= config.bin %> audit-log export --csv > audit-log.csv',
     ];
     static args = {
@@ -23,7 +23,7 @@ export default class AuditLog extends Command {
         id: Args.string({ description: 'Resource ID (for get, update, delete operations)', required: false }),
     };
     static flags = {
-        context: Flags.string({ char: 'c', description: 'Context to use' }),
+        context: Flags.string({ char: 'c', aliases: ['config'], env: 'ADERIS_CONTEXT', description: 'Context to use for this command, overriding the current context (alias: --config)' }),
         output: Flags.string({ char: 'o', description: 'Output format (default: table for import, json for other commands)', options: ['json', 'table', 'csv'] }),
         table: Flags.boolean({ char: 't', description: 'Output as table (shortcut for --output table)' }),
         csv: Flags.boolean({ description: 'Output as CSV (shortcut for --output csv)' }),
@@ -34,7 +34,7 @@ export default class AuditLog extends Command {
         limit: Flags.string({ description: 'Items per page' }),
         include: Flags.string({ description: 'Relations to include' }),
         search: Flags.string({ description: 'Search term' }),
-        'sort-by': Flags.string({ description: 'Sort field' }),
+        'sort-by': Flags.string({ description: 'Sort field(s), comma-separated. Direction (:ASC/:DESC) is optional; date-like fields default to DESC, others to ASC.' }),
         filter: Flags.string({ description: 'Filter (e.g. --filter status=ACTIVE). Operators: in:A,B, like:%, gt:, lt:, null:', multiple: true }),
         query: Flags.string({ description: 'Additional query params as JSON' }),
         fields: Flags.string({ description: 'Comma-separated list of fields to show (e.g. --fields=id,name,status)' }),
@@ -95,9 +95,9 @@ export default class AuditLog extends Command {
         }
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         const queryParams = {};
         if (flags.page)
             queryParams.page = flags.page;
@@ -108,7 +108,7 @@ export default class AuditLog extends Command {
         if (flags.search)
             queryParams.search = flags.search;
         if (flags['sort-by'])
-            queryParams.sortBy = flags['sort-by'];
+            queryParams.sortBy = normalizeSortBy(flags['sort-by']);
         if (flags.query) {
             try {
                 Object.assign(queryParams, JSON.parse(flags.query));
@@ -340,9 +340,9 @@ export default class AuditLog extends Command {
     async runImport(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         // Get data from file, --data, or --set flags
         let items = [];
         if (flags.file) {
@@ -552,9 +552,9 @@ export default class AuditLog extends Command {
     async runExport(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         const listEndpoint = ENDPOINTS['list'];
         if (!listEndpoint)
             this.error('Export requires a list endpoint');
@@ -567,7 +567,7 @@ export default class AuditLog extends Command {
         if (flags.search)
             baseParams.search = flags.search;
         if (flags['sort-by'])
-            baseParams.sortBy = flags['sort-by'];
+            baseParams.sortBy = normalizeSortBy(flags['sort-by']);
         if (flags.include)
             baseParams.include = flags.include;
         if (flags.query) {
@@ -646,9 +646,9 @@ export default class AuditLog extends Command {
     async runCamt053Import(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         if (!flags.file) {
             this.error('CAMT.053 import requires --file (-f) flag with path to XML file');
         }
@@ -736,9 +736,9 @@ export default class AuditLog extends Command {
         }
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         // Get data from file, --data, or --set flags
         let items = [];
         if (flags.file) {

package/dist/commands/auth/login.js

@@ -2,7 +2,7 @@ import { input, select } from '@inquirer/prompts';
 import { Command, Flags } from '@oclif/core';
 import ora from 'ora';
 import { login, testAuth } from '../../lib/auth.js';
-import { addContext, DEFAULT_CLIENT_IDS, getContext, getCurrentContext, } from '../../lib/config.js';
+import { addContext, DEFAULT_CLIENT_IDS, getAuthType, getContext, getCurrentContext, } from '../../lib/config.js';
 export default class AuthLogin extends Command {
     static description = 'Login to an Aderis environment using OAuth';
     static examples = [
@@ -15,8 +15,10 @@ export default class AuthLogin extends Command {
             description: 'OAuth client ID (uses default if not specified)',
         }),
         context: Flags.string({
+            aliases: ['config'],
             char: 'c',
-            description: 'Context to login with (uses current context if not specified)',
+            description: 'Context to login with, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
         }),
         environment: Flags.string({
             char: 'e',
@@ -51,6 +53,12 @@ export default class AuthLogin extends Command {
                 context = await this.createNewContext(flags);
             }
         }
+        // API-key contexts have no browser flow; sending them through OAuth would
+        // fail deeper in with a less useful error.
+        if (getAuthType(context) === 'api_key') {
+            this.error(`Context "${context.name}" authenticates with an API key, so there is nothing to log in to.\n` +
+                `Set or rotate the key with: aderis config set-api-key --context ${context.name}`);
+        }
         const spinner = ora(`Logging in to ${context.name} (${context.environment})...`).start();
         try {
             spinner.text = 'Waiting for browser authentication...';
@@ -104,6 +112,7 @@ export default class AuthLogin extends Command {
             this.error(`No default client ID configured for ${environment} environment. Please provide --client-id`);
         }
         const context = {
+            auth_type: 'oauth2',
             client_id: clientId,
             environment,
             name: contextName,

package/dist/commands/auth/logout.d.ts

@@ -7,4 +7,6 @@ export default class AuthLogout extends Command {
         context: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    /** Drop whichever credential the context holds — OAuth tokens or an API key. */
+    private clearCredentials;
 }

package/dist/commands/auth/logout.js

@@ -1,5 +1,5 @@
 import { Command, Flags } from '@oclif/core';
-import { clearTokens, getContext, getCurrentContext } from '../../lib/config.js';
+import { clearApiKey, clearTokens, getAuthType, getContext, getCurrentContext, hasCredentials, } from '../../lib/config.js';
 export default class AuthLogout extends Command {
     static description = 'Logout from the current or specified context';
     static examples = [
@@ -14,8 +14,10 @@ export default class AuthLogout extends Command {
             description: 'Logout from all contexts',
         }),
         context: Flags.string({
+            aliases: ['config'],
             char: 'c',
-            description: 'Specific context to logout from',
+            description: 'Context to logout from, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
         }),
     };
     async run() {
@@ -24,8 +26,8 @@ export default class AuthLogout extends Command {
         if (flags.all) {
             const contexts = listContexts();
             for (const ctx of contexts) {
-                if (ctx.tokens) {
-                    clearTokens(ctx.name);
+                if (hasCredentials(ctx)) {
+                    this.clearCredentials(ctx.name);
                     this.log(`Logged out from ${ctx.name}`);
                 }
             }
@@ -48,11 +50,22 @@ export default class AuthLogout extends Command {
             contextName = current.name;
         }
         const context = getContext(contextName);
-        if (!context?.tokens) {
+        if (!context || !hasCredentials(context)) {
             this.log(`Already logged out from ${contextName}`);
             return;
         }
+        this.clearCredentials(contextName);
+        this.log(getAuthType(context) === 'api_key'
+            ? `Removed API key from ${contextName}`
+            : `Successfully logged out from ${contextName}`);
+    }
+    /** Drop whichever credential the context holds — OAuth tokens or an API key. */
+    clearCredentials(contextName) {
+        const context = getContext(contextName);
+        if (context && getAuthType(context) === 'api_key') {
+            clearApiKey(contextName);
+            return;
+        }
         clearTokens(contextName);
-        this.log(`Successfully logged out from ${contextName}`);
     }
 }

package/dist/commands/auth/status.js

@@ -1,6 +1,6 @@
 import { Command, Flags } from '@oclif/core';
 import { testAuth } from '../../lib/auth.js';
-import { getContext, getCurrentContext, listContexts } from '../../lib/config.js';
+import { getAuthType, getContext, getCurrentContext, hasCredentials, listContexts, maskApiKey, missingCredentialsMessage, } from '../../lib/config.js';
 export default class AuthStatus extends Command {
     static description = 'Show authentication status for contexts';
     static examples = [
@@ -15,8 +15,10 @@ export default class AuthStatus extends Command {
             description: 'Show status for all contexts',
         }),
         context: Flags.string({
+            aliases: ['config'],
             char: 'c',
-            description: 'Specific context to check',
+            description: 'Context to check, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
         }),
     };
     async run() {
@@ -56,7 +58,10 @@ export default class AuthStatus extends Command {
         for (const ctx of contexts) {
             const isCurrent = current?.name === ctx.name;
             const prefix = isCurrent ? '* ' : '  ';
-            const status = ctx.tokens ? '✓ logged in' : '✗ not logged in';
+            const isApiKey = getAuthType(ctx) === 'api_key';
+            const status = hasCredentials(ctx)
+                ? (isApiKey ? '✓ api key set' : '✓ logged in')
+                : (isApiKey ? '✗ no api key' : '✗ not logged in');
             this.log(`${prefix}${ctx.name} (${ctx.environment}) - ${status}`);
         }
         this.log('\n* = current context');
@@ -68,19 +73,28 @@ export default class AuthStatus extends Command {
             this.error(`Context "${name}" not found.`);
         }
         const isCurrent = current?.name === name;
+        const authType = getAuthType(context);
         this.log(`Context: ${context.name}${isCurrent ? ' (current)' : ''}`);
         this.log(`Environment: ${context.environment}`);
-        this.log(`Client ID: ${context.client_id}`);
-        if (!context.tokens) {
-            this.log(`Status: Not logged in`);
-            this.log(`\nRun: aderis auth login${isCurrent ? '' : ` --context ${name}`}`);
+        this.log(`Auth: ${authType === 'api_key' ? 'API key (x-api-key)' : 'oauth2'}`);
+        if (authType === 'oauth2') {
+            this.log(`Client ID: ${context.client_id ?? 'N/A'}`);
+        }
+        if (!hasCredentials(context)) {
+            this.log(`Status: ${authType === 'api_key' ? 'No API key set' : 'Not logged in'}`);
+            this.log(`\n${missingCredentialsMessage(context)}`);
             return;
         }
-        this.log(`Tenant ID: ${context.tenant_id || 'N/A'}`);
-        if (context.tokens.expires_at) {
-            const expiresAt = new Date(context.tokens.expires_at);
-            const isExpired = expiresAt < new Date();
-            this.log(`Token expires: ${expiresAt.toLocaleString()}${isExpired ? ' (EXPIRED)' : ''}`);
+        if (authType === 'api_key') {
+            this.log(`API key: ${maskApiKey(context.api_key)}`);
+        }
+        else {
+            this.log(`Tenant ID: ${context.tenant_id || 'N/A'}`);
+            if (context.tokens?.expires_at) {
+                const expiresAt = new Date(context.tokens.expires_at);
+                const isExpired = expiresAt < new Date();
+                this.log(`Token expires: ${expiresAt.toLocaleString()}${isExpired ? ' (EXPIRED)' : ''}`);
+            }
         }
         if (detailed) {
             try {

package/dist/commands/auth/tenant.js

@@ -1,7 +1,7 @@
 import { select } from '@inquirer/prompts';
 import { Args, Command, Flags } from '@oclif/core';
 import { getCurrentTenant, listTenants, switchTenant } from '../../lib/auth.js';
-import { getContext, getCurrentContext } from '../../lib/config.js';
+import { getAuthType, getContext, getCurrentContext } from '../../lib/config.js';
 export default class AuthTenant extends Command {
     static args = {
         action: Args.string({
@@ -23,8 +23,10 @@ export default class AuthTenant extends Command {
     ];
     static flags = {
         context: Flags.string({
+            aliases: ['config'],
             char: 'c',
-            description: 'Context to use',
+            description: 'Context to use, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
         }),
         json: Flags.boolean({
             default: false,
@@ -38,7 +40,14 @@ export default class AuthTenant extends Command {
             this.error('No context configured. Run: aderis auth login --new');
         }
         const context = getContext(contextName);
-        if (!context?.tokens) {
+        if (!context) {
+            this.error(`Context "${contextName}" not found.`);
+        }
+        // API keys are issued per tenant, so there is nothing to list or switch.
+        if (getAuthType(context) === 'api_key') {
+            this.error(`Context "${contextName}" authenticates with an API key, which is already scoped to a single tenant. Tenant switching requires OAuth login.`);
+        }
+        if (!context.tokens) {
             this.error('Not logged in. Run: aderis auth login');
         }
         const action = args.action || 'interactive';