@aderis-erp/cli 1.0.14 → 1.0.17

package/dist/commands/audit-log.d.ts

@@ -31,7 +31,6 @@ export default class AuditLog extends Command {
     private runCamt053Import;
     private runNestedImport;
     private parseFilterValue;
-    private filterFields;
     private sanitizeOutput;
     private getColumns;
     private getValue;

package/dist/commands/audit-log.js

@@ -1,6 +1,6 @@
 import { Command, Args, Flags } from '@oclif/core';
 import { apiRequest, ApiError, normalizeSortBy } from '../lib/api-client.js';
-import { getCurrentContext, getContext, getBaseUrls } from '../lib/config.js';
+import { getCurrentContext, getContext, getBaseUrls, hasCredentials, missingCredentialsMessage } from '../lib/config.js';
 // Add 'import' action if both create and update exist
 const HAS_IMPORT = false;
 const HAS_EXPORT = true;
@@ -23,7 +23,7 @@ export default class AuditLog extends Command {
         id: Args.string({ description: 'Resource ID (for get, update, delete operations)', required: false }),
     };
     static flags = {
-        context: Flags.string({ char: 'c', description: 'Context to use' }),
+        context: Flags.string({ char: 'c', aliases: ['config'], env: 'ADERIS_CONTEXT', description: 'Context to use for this command, overriding the current context (alias: --config)' }),
         output: Flags.string({ char: 'o', description: 'Output format (default: table for import, json for other commands)', options: ['json', 'table', 'csv'] }),
         table: Flags.boolean({ char: 't', description: 'Output as table (shortcut for --output table)' }),
         csv: Flags.boolean({ description: 'Output as CSV (shortcut for --output csv)' }),
@@ -37,7 +37,7 @@ export default class AuditLog extends Command {
         'sort-by': Flags.string({ description: 'Sort field(s), comma-separated. Direction (:ASC/:DESC) is optional; date-like fields default to DESC, others to ASC.' }),
         filter: Flags.string({ description: 'Filter (e.g. --filter status=ACTIVE). Operators: in:A,B, like:%, gt:, lt:, null:', multiple: true }),
         query: Flags.string({ description: 'Additional query params as JSON' }),
-        fields: Flags.string({ description: 'Comma-separated list of fields to show (e.g. --fields=id,name,status)' }),
+        fields: Flags.string({ description: 'Comma-separated list of fields to return, applied by the API (e.g. --fields=id,name,status)' }),
         sanitize: Flags.boolean({ description: 'Remove null values, audit fields, and duplicate UUIDs from output' }),
         'show-http-request': Flags.boolean({ description: 'Show HTTP request details (method, URL, body)' }),
     };
@@ -95,9 +95,9 @@ export default class AuditLog extends Command {
         }
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         const queryParams = {};
         if (flags.page)
             queryParams.page = flags.page;
@@ -109,6 +109,8 @@ export default class AuditLog extends Command {
             queryParams.search = flags.search;
         if (flags['sort-by'])
             queryParams.sortBy = normalizeSortBy(flags['sort-by']);
+        if (flags.fields)
+            queryParams.fields = flags.fields;
         if (flags.query) {
             try {
                 Object.assign(queryParams, JSON.parse(flags.query));
@@ -311,11 +313,6 @@ export default class AuditLog extends Command {
                     output = obj[arrayKeys[0]];
                 }
             }
-            // Filter fields if --fields flag is provided
-            if (flags.fields) {
-                const fieldList = flags.fields.split(',').map(f => f.trim());
-                output = this.filterFields(output, fieldList);
-            }
             // Sanitize output if requested
             if (flags.sanitize) {
                 output = this.sanitizeOutput(output);
@@ -340,9 +337,9 @@ export default class AuditLog extends Command {
     async runImport(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         // Get data from file, --data, or --set flags
         let items = [];
         if (flags.file) {
@@ -552,9 +549,9 @@ export default class AuditLog extends Command {
     async runExport(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         const listEndpoint = ENDPOINTS['list'];
         if (!listEndpoint)
             this.error('Export requires a list endpoint');
@@ -570,6 +567,8 @@ export default class AuditLog extends Command {
             baseParams.sortBy = normalizeSortBy(flags['sort-by']);
         if (flags.include)
             baseParams.include = flags.include;
+        if (flags.fields)
+            baseParams.fields = flags.fields;
         if (flags.query) {
             try {
                 Object.assign(baseParams, JSON.parse(flags.query));
@@ -624,12 +623,7 @@ export default class AuditLog extends Command {
             }
         }
         process.stderr.write(' done\n');
-        // Filter fields if specified
         let output = allItems;
-        if (flags.fields) {
-            const fieldList = flags.fields.split(',').map(f => f.trim());
-            output = this.filterFields(allItems, fieldList);
-        }
         // Sanitize output if requested
         if (flags.sanitize) {
             output = this.sanitizeOutput(output);
@@ -646,9 +640,9 @@ export default class AuditLog extends Command {
     async runCamt053Import(flags) {
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         if (!flags.file) {
             this.error('CAMT.053 import requires --file (-f) flag with path to XML file');
         }
@@ -736,9 +730,9 @@ export default class AuditLog extends Command {
         }
         const context = flags.context ? getContext(flags.context) : getCurrentContext();
         if (!context)
-            this.error('No context configured. Run: aderis auth login --new');
-        if (!context.tokens)
-            this.error('Not logged in. Run: aderis auth login');
+            this.error(flags.context ? `Context "${flags.context}" not found. List contexts with: aderis config list` : 'No context configured. Run: aderis auth login --new');
+        if (!hasCredentials(context))
+            this.error(missingCredentialsMessage(context));
         // Get data from file, --data, or --set flags
         let items = [];
         if (flags.file) {
@@ -958,56 +952,6 @@ export default class AuditLog extends Command {
             return `\$${op}`;
         return opRe.test(rest) ? `\$${op}:${this.parseFilterValue(rest)}` : `\$${op}:${rest}`;
     }
-    filterFields(data, fields) {
-        const isUnsafeKey = (k) => k === '__proto__' || k === 'constructor' || k === 'prototype';
-        const pick = (obj, keys) => {
-            // Group keys by their first segment so sibling sub-paths
-            // (e.g. 'items.amount' + 'items._type') resolve in one recursive pass
-            // and don't clobber each other on merge.
-            const directKeys = new Set();
-            const nestedKeys = new Map();
-            for (const key of keys) {
-                if (key.split('.').some(isUnsafeKey))
-                    continue;
-                if (key.includes('.')) {
-                    const [first, ...rest] = key.split('.');
-                    if (isUnsafeKey(first))
-                        continue;
-                    const list = nestedKeys.get(first);
-                    if (list) {
-                        list.push(rest.join('.'));
-                    }
-                    else {
-                        nestedKeys.set(first, [rest.join('.')]);
-                    }
-                }
-                else {
-                    directKeys.add(key);
-                }
-            }
-            const result = {};
-            for (const key of directKeys) {
-                if (key in obj)
-                    result[key] = obj[key];
-            }
-            for (const [first, restKeys] of nestedKeys) {
-                const val = obj[first];
-                if (!val || typeof val !== 'object')
-                    continue;
-                if (Array.isArray(val)) {
-                    result[first] = val.map(item => pick(item, restKeys));
-                }
-                else {
-                    result[first] = pick(val, restKeys);
-                }
-            }
-            return result;
-        };
-        if (Array.isArray(data)) {
-            return data.map(item => pick(item, fields));
-        }
-        return pick(data, fields);
-    }
     sanitizeOutput(data) {
         const auditFields = ['_type', 'tenantId', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'];
         const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/commands/auth/login.d.ts

@@ -1,4 +1,5 @@
 import { Command } from '@oclif/core';
+import { type FlowHooks } from '../../lib/auth/index.js';
 export default class AuthLogin extends Command {
     static description: string;
     static examples: string[];
@@ -6,9 +7,17 @@ export default class AuthLogin extends Command {
         'client-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         context: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         environment: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'keycloak-url': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         name: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         new: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /** Prompts for a tenant; throws {@link NoTerminalError} without a terminal, which `run()` turns into the hint. */
+    private chooseTenant;
+    /** Browser-flow hooks: the defaults here, overridden by tests. */
+    protected flowHooks(): FlowHooks;
+    private printSession;
+    /** Validates `--keycloak-url` before the context is stored. */
+    private resolveKeycloakBaseUrl;
     private createNewContext;
 }

package/dist/commands/auth/login.js

@@ -1,27 +1,33 @@
 import { input, select } from '@inquirer/prompts';
 import { Command, Flags } from '@oclif/core';
 import ora from 'ora';
-import { login, testAuth } from '../../lib/auth.js';
-import { addContext, DEFAULT_CLIENT_IDS, getContext, getCurrentContext, } from '../../lib/config.js';
+import { completeTenantSelection, login, parseKeycloakBaseUrl, tenantLabel, testAuth, } from '../../lib/auth/index.js';
+import { addContext, DEFAULT_KEYCLOAK_CLIENT_ID, getAuthType, getContext, getCurrentContext, } from '../../lib/config.js';
 export default class AuthLogin extends Command {
     static description = 'Login to an Aderis environment using OAuth';
     static examples = [
         '<%= config.bin %> auth login',
         '<%= config.bin %> auth login --context my-client',
         '<%= config.bin %> auth login --new --name my-client --environment dev',
+        '<%= config.bin %> auth login --new --name test-kc --environment test',
     ];
     static flags = {
         'client-id': Flags.string({
             description: 'OAuth client ID (uses default if not specified)',
         }),
         context: Flags.string({
+            aliases: ['config'],
             char: 'c',
-            description: 'Context to login with (uses current context if not specified)',
+            description: 'Context to login with, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
         }),
         environment: Flags.string({
             char: 'e',
-            description: 'Environment (dev, staging, live)',
-            options: ['dev', 'staging', 'live'],
+            description: 'Environment (dev, test, staging, live)',
+            options: ['dev', 'test', 'staging', 'live'],
+        }),
+        'keycloak-url': Flags.string({
+            description: 'Keycloak origin for a new context instead of the default host for the environment (--new only; https, allowlisted)',
         }),
         name: Flags.string({
             description: 'Name for the new context (required with --new)',
@@ -35,6 +41,9 @@ export default class AuthLogin extends Command {
     async run() {
         const { flags } = await this.parse(AuthLogin);
         let context = null;
+        if (flags['keycloak-url'] && !flags.new) {
+            this.error('--keycloak-url only applies when creating a context with --new; an existing context keeps its stored Keycloak URL.');
+        }
         if (flags.new) {
             context = await this.createNewContext(flags);
         }
@@ -51,25 +60,70 @@ export default class AuthLogin extends Command {
                 context = await this.createNewContext(flags);
             }
         }
+        // API-key contexts have no browser flow; sending them through OAuth would
+        // fail deeper in with a less useful error.
+        if (getAuthType(context) === 'api_key') {
+            this.error(`Context "${context.name}" authenticates with an API key, so there is nothing to log in to.\n` +
+                `Set or rotate the key with: aderis config set-api-key --context ${context.name}`);
+        }
         const spinner = ora(`Logging in to ${context.name} (${context.environment})...`).start();
         try {
             spinner.text = 'Waiting for browser authentication...';
-            await login(context);
-            spinner.text = 'Verifying authentication...';
+            await login(context, this.flowHooks());
+            // The tenant prompt needs the terminal, so the spinner pauses around it.
+            spinner.stop();
+            await completeTenantSelection(context.name, (tenants) => this.chooseTenant(tenants));
+            spinner.start('Verifying authentication...');
             const user = await testAuth(context.name);
             spinner.succeed(`Successfully logged in as ${user.email || user.name || 'user'}`);
-            this.log(`\nContext: ${context.name}`);
-            this.log(`Environment: ${context.environment}`);
-            if (context.tenant_id) {
-                this.log(`Tenant ID: ${context.tenant_id}`);
+            this.printSession(context);
+            // `context` predates the stored tokens; re-read it for the tenant they carry.
+            const tenantId = getContext(context.name)?.tenant_id;
+            if (tenantId) {
+                this.log(`Tenant ID: ${tenantId}`);
             }
         }
         catch (error) {
-            spinner.fail('Login failed');
-            if (error instanceof Error) {
-                this.error(error.message);
+            if (error instanceof NoTerminalError) {
+                // The login is stored and only the tenant pick is deferred; the session
+                // check is skipped because a token without a tenant is always rejected.
+                spinner.stop();
+                this.printSession(context);
+                this.warn(`Your user reaches ${error.tenants.length} tenants and none is selected yet. Pick one with: aderis auth tenant switch <tenant-id> --context ${context.name}\n` +
+                    error.tenants.map((t) => `  ${tenantLabel(t)}`).join('\n'));
+                return;
             }
-            throw error;
+            spinner.fail('Login failed');
+            this.error(error instanceof Error ? error.message : String(error));
+        }
+    }
+    /** Prompts for a tenant; throws {@link NoTerminalError} without a terminal, which `run()` turns into the hint. */
+    async chooseTenant(tenants) {
+        if (!process.stdin.isTTY) {
+            throw new NoTerminalError(tenants);
+        }
+        return select({
+            choices: tenants.map((t) => ({ name: tenantLabel(t), value: t.tenantId })),
+            message: 'Your user reaches several tenants. Select the one to work in:',
+        });
+    }
+    /** Browser-flow hooks: the defaults here, overridden by tests. */
+    flowHooks() {
+        return {};
+    }
+    printSession(context) {
+        this.log(`\nContext: ${context.name}`);
+        this.log(`Environment: ${context.environment}`);
+    }
+    /** Validates `--keycloak-url` before the context is stored. */
+    resolveKeycloakBaseUrl(flag) {
+        if (flag === undefined)
+            return undefined;
+        try {
+            return parseKeycloakBaseUrl(flag);
+        }
+        catch (error) {
+            this.error(`Invalid --keycloak-url: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
     async createNewContext(flags) {
@@ -93,19 +147,18 @@ export default class AuthLogin extends Command {
         const environment = flags.environment ? flags.environment : (await select({
             choices: [
                 { description: 'Development environment', name: 'dev', value: 'dev' },
+                { description: 'QA environment', name: 'test', value: 'test' },
                 { description: 'Staging environment', name: 'staging', value: 'staging' },
                 { description: 'Production environment', name: 'live', value: 'live' },
             ],
             message: 'Environment:',
         }));
-        const defaultClientId = DEFAULT_CLIENT_IDS[environment];
-        const clientId = flags['client-id'] || defaultClientId;
-        if (!clientId) {
-            this.error(`No default client ID configured for ${environment} environment. Please provide --client-id`);
-        }
+        const keycloakBaseUrl = this.resolveKeycloakBaseUrl(flags['keycloak-url']);
         const context = {
-            client_id: clientId,
+            auth_type: 'oauth2',
+            client_id: flags['client-id'] || DEFAULT_KEYCLOAK_CLIENT_ID,
             environment,
+            keycloak_base_url: keycloakBaseUrl,
             name: contextName,
         };
         addContext(context);
@@ -113,3 +166,12 @@ export default class AuthLogin extends Command {
         return context;
     }
 }
+/** Thrown by the tenant chooser when there is no terminal; the login stays stored. */
+class NoTerminalError extends Error {
+    tenants;
+    constructor(tenants) {
+        super('No terminal available to select a tenant');
+        this.tenants = tenants;
+        this.name = 'NoTerminalError';
+    }
+}

package/dist/commands/auth/logout.d.ts

@@ -1,4 +1,8 @@
 import { Command } from '@oclif/core';
+/**
+ * Deletes the stored credential only; the provider's browser session
+ * (`end_session_endpoint`) is left in place.
+ */
 export default class AuthLogout extends Command {
     static description: string;
     static examples: string[];
@@ -7,4 +11,6 @@ export default class AuthLogout extends Command {
         context: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    /** Drop whichever credential the context holds — OAuth tokens or an API key. */
+    private clearCredentials;
 }

package/dist/commands/auth/logout.js

@@ -1,5 +1,9 @@
 import { Command, Flags } from '@oclif/core';
-import { clearTokens, getContext, getCurrentContext } from '../../lib/config.js';
+import { clearApiKey, clearTokens, getAuthType, getContext, getCurrentContext, hasCredentials, } from '../../lib/config.js';
+/**
+ * Deletes the stored credential only; the provider's browser session
+ * (`end_session_endpoint`) is left in place.
+ */
 export default class AuthLogout extends Command {
     static description = 'Logout from the current or specified context';
     static examples = [
@@ -14,8 +18,10 @@ export default class AuthLogout extends Command {
             description: 'Logout from all contexts',
         }),
         context: Flags.string({
+            aliases: ['config'],
             char: 'c',
-            description: 'Specific context to logout from',
+            description: 'Context to logout from, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
         }),
     };
     async run() {
@@ -24,8 +30,8 @@ export default class AuthLogout extends Command {
         if (flags.all) {
             const contexts = listContexts();
             for (const ctx of contexts) {
-                if (ctx.tokens) {
-                    clearTokens(ctx.name);
+                if (hasCredentials(ctx)) {
+                    this.clearCredentials(ctx.name);
                     this.log(`Logged out from ${ctx.name}`);
                 }
             }
@@ -48,11 +54,22 @@ export default class AuthLogout extends Command {
             contextName = current.name;
         }
         const context = getContext(contextName);
-        if (!context?.tokens) {
+        if (!context || !hasCredentials(context)) {
             this.log(`Already logged out from ${contextName}`);
             return;
         }
+        this.clearCredentials(contextName);
+        this.log(getAuthType(context) === 'api_key'
+            ? `Removed API key from ${contextName}`
+            : `Successfully logged out from ${contextName}`);
+    }
+    /** Drop whichever credential the context holds — OAuth tokens or an API key. */
+    clearCredentials(contextName) {
+        const context = getContext(contextName);
+        if (context && getAuthType(context) === 'api_key') {
+            clearApiKey(contextName);
+            return;
+        }
         clearTokens(contextName);
-        this.log(`Successfully logged out from ${contextName}`);
     }
 }

package/dist/commands/auth/status.js

@@ -1,6 +1,6 @@
 import { Command, Flags } from '@oclif/core';
-import { testAuth } from '../../lib/auth.js';
-import { getContext, getCurrentContext, listContexts } from '../../lib/config.js';
+import { keycloakBaseUrlOf, testAuth } from '../../lib/auth/index.js';
+import { getAuthType, getContext, getCurrentContext, hasCredentials, listContexts, maskApiKey, missingCredentialsMessage, } from '../../lib/config.js';
 export default class AuthStatus extends Command {
     static description = 'Show authentication status for contexts';
     static examples = [
@@ -15,8 +15,10 @@ export default class AuthStatus extends Command {
             description: 'Show status for all contexts',
         }),
         context: Flags.string({
+            aliases: ['config'],
             char: 'c',
-            description: 'Specific context to check',
+            description: 'Context to check, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
         }),
     };
     async run() {
@@ -56,7 +58,10 @@ export default class AuthStatus extends Command {
         for (const ctx of contexts) {
             const isCurrent = current?.name === ctx.name;
             const prefix = isCurrent ? '* ' : '  ';
-            const status = ctx.tokens ? '✓ logged in' : '✗ not logged in';
+            const isApiKey = getAuthType(ctx) === 'api_key';
+            const status = hasCredentials(ctx)
+                ? (isApiKey ? '✓ api key set' : '✓ logged in')
+                : (isApiKey ? '✗ no api key' : '✗ not logged in');
             this.log(`${prefix}${ctx.name} (${ctx.environment}) - ${status}`);
         }
         this.log('\n* = current context');
@@ -68,33 +73,51 @@ export default class AuthStatus extends Command {
             this.error(`Context "${name}" not found.`);
         }
         const isCurrent = current?.name === name;
+        const authType = getAuthType(context);
         this.log(`Context: ${context.name}${isCurrent ? ' (current)' : ''}`);
         this.log(`Environment: ${context.environment}`);
-        this.log(`Client ID: ${context.client_id}`);
-        if (!context.tokens) {
-            this.log(`Status: Not logged in`);
-            this.log(`\nRun: aderis auth login${isCurrent ? '' : ` --context ${name}`}`);
-            return;
+        this.log(`Auth: ${authType === 'api_key' ? 'API key (x-api-key)' : 'oauth2'}`);
+        if (authType === 'oauth2') {
+            this.log(`Keycloak URL: ${keycloakBaseUrlOf(context)}`);
+            this.log(`Client ID: ${context.client_id ?? 'N/A'}`);
         }
-        this.log(`Tenant ID: ${context.tenant_id || 'N/A'}`);
-        if (context.tokens.expires_at) {
-            const expiresAt = new Date(context.tokens.expires_at);
-            const isExpired = expiresAt < new Date();
-            this.log(`Token expires: ${expiresAt.toLocaleString()}${isExpired ? ' (EXPIRED)' : ''}`);
+        if (!hasCredentials(context)) {
+            this.log(`Status: ${authType === 'api_key' ? 'No API key set' : 'Not logged in'}`);
+            this.log(`\n${missingCredentialsMessage(context)}`);
+            return;
         }
+        // `testAuth` refreshes an access token that is within the expiry buffer, so
+        // it runs before the expiry is printed — otherwise a session that was just
+        // renewed still shows the stale timestamp, labelled (EXPIRED).
+        let checked;
         if (detailed) {
             try {
-                const user = await testAuth(name);
-                this.log(`\nLogged in as: ${user.email || user.name || 'Unknown'}`);
-                this.log('Status: ✓ Authenticated');
+                checked = await testAuth(name);
             }
             catch (error) {
-                if (error instanceof Error) {
-                    this.log(`\nStatus: ✗ ${error.message}`);
-                }
-                else {
-                    this.log('\nStatus: ✗ Authentication error');
-                }
+                checked = error instanceof Error ? error : new Error('Authentication error');
+            }
+        }
+        // Re-read: a refresh during the check replaced the stored tokens.
+        const fresh = getContext(name) ?? context;
+        if (authType === 'api_key') {
+            this.log(`API key: ${maskApiKey(fresh.api_key)}`);
+        }
+        else {
+            this.log(`Tenant ID: ${fresh.tenant_id || 'N/A'}`);
+            if (fresh.tokens?.expires_at) {
+                const expiresAt = new Date(fresh.tokens.expires_at);
+                const isExpired = expiresAt < new Date();
+                this.log(`Token expires: ${expiresAt.toLocaleString()}${isExpired ? ' (EXPIRED)' : ''}`);
+            }
+        }
+        if (checked !== undefined) {
+            if (checked instanceof Error) {
+                this.log(`\nStatus: ✗ ${checked.message}`);
+            }
+            else {
+                this.log(`\nLogged in as: ${checked.email || checked.name || 'Unknown'}`);
+                this.log('Status: ✓ Authenticated');
             }
         }
     }

package/dist/commands/auth/tenant.js

@@ -1,7 +1,7 @@
 import { select } from '@inquirer/prompts';
 import { Args, Command, Flags } from '@oclif/core';
-import { getCurrentTenant, listTenants, switchTenant } from '../../lib/auth.js';
-import { getContext, getCurrentContext } from '../../lib/config.js';
+import { getCurrentTenant, listTenants, switchTenant, tenantLabel } from '../../lib/auth/index.js';
+import { getAuthType, getContext, getCurrentContext } from '../../lib/config.js';
 export default class AuthTenant extends Command {
     static args = {
         action: Args.string({
@@ -23,8 +23,10 @@ export default class AuthTenant extends Command {
     ];
     static flags = {
         context: Flags.string({
+            aliases: ['config'],
             char: 'c',
-            description: 'Context to use',
+            description: 'Context to use, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
         }),
         json: Flags.boolean({
             default: false,
@@ -38,7 +40,14 @@ export default class AuthTenant extends Command {
             this.error('No context configured. Run: aderis auth login --new');
         }
         const context = getContext(contextName);
-        if (!context?.tokens) {
+        if (!context) {
+            this.error(`Context "${contextName}" not found.`);
+        }
+        // API keys are issued per tenant, so there is nothing to list or switch.
+        if (getAuthType(context) === 'api_key') {
+            this.error(`Context "${contextName}" authenticates with an API key, which is already scoped to a single tenant. Tenant switching requires OAuth login.`);
+        }
+        if (!context.tokens) {
             this.error('Not logged in. Run: aderis auth login');
         }
         const action = args.action || 'interactive';
@@ -98,7 +107,7 @@ export default class AuthTenant extends Command {
                 tags.push('default');
             const tagStr = tags.length > 0 ? ` (${tags.join(', ')})` : '';
             return {
-                name: `${t.name}${tagStr}`,
+                name: `${tenantLabel(t)}${tagStr}`,
                 value: t.tenantId,
             };
         });
@@ -175,10 +184,7 @@ export default class AuthTenant extends Command {
             this.log(`Successfully switched to tenant ${display}`);
         }
         catch (error) {
-            if (error instanceof Error) {
-                this.error(`Failed to switch tenant: ${error.message}`);
-            }
-            throw error;
+            this.error(`Failed to switch tenant: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
 }

package/dist/commands/auth.d.ts

@@ -24,7 +24,6 @@ export default class Auth extends Command {
         table: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
-    private filterFields;
     private getColumns;
     private getValue;
     private printCsv;