@aderis-erp/cli 1.0.15 → 1.0.17

package/dist/commands/vendor-invoices.js

@@ -6,25 +6,25 @@ const HAS_IMPORT = true;
 const HAS_EXPORT = true;
 const HAS_CAMT053 = false;
 const NESTED_IMPORTS = ["line-items", "notes", "files", "payments"];
-const SUBCOMMANDS = [...["list", "create", "get", "update", "delete", "submit", "approve", "decline", "book", "rebuild-journal", "cancel", "confirm-cancellation", "change-vendor", "recalculate-payment-status", "validate", "create-line-items", "update-line-items", "delete-line-items", "list-notes", "create-notes", "get-notes", "update-notes", "delete-notes", "list-files", "create-files", "get-files", "update-files", "delete-files", "files-download", "list-payments", "create-payments", "get-payments", "update-payments", "delete-payments", "payments-approve", "payments-cancel"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
+const SUBCOMMANDS = [...["list", "create", "get", "update", "delete", "payment-derivation", "submit", "approve", "decline", "book", "rebuild-journal", "cancel", "change-vendor", "recalculate-payment-status", "validate", "create-line-items", "update-line-items", "delete-line-items", "list-notes", "create-notes", "get-notes", "update-notes", "delete-notes", "list-files", "create-files", "get-files", "update-files", "delete-files", "files-download", "list-payments", "create-payments", "get-payments", "update-payments", "delete-payments", "payments-approve", "payments-reopen", "payments-cancel"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
 const ENDPOINTS = {
     'list': { method: 'GET', path: '/v1/vendor-invoices', summary: 'Get all vendor invoices with pagination', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'create': { method: 'POST', path: '/v1/vendor-invoices', summary: 'Create a new vendor invoice', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: ['earlyPaymentDiscounts', 'totalAmountByTaxRate', 'files', 'notes', 'lineItems', 'tagIds', 'tagCodes', 'payments'] },
     'get': { method: 'GET', path: '/v1/vendor-invoices/{id}', summary: 'Get a vendor invoice by ID', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'update': { method: 'PATCH', path: '/v1/vendor-invoices/{id}', summary: 'Update a vendor invoice', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: ['earlyPaymentDiscounts', 'totalAmountByTaxRate', 'files', 'notes', 'lineItems', 'tagIds', 'tagCodes', 'removeFileIds'] },
     'delete': { method: 'DELETE', path: '/v1/vendor-invoices/{id}', summary: 'Delete a vendor invoice', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
+    'payment-derivation': { method: 'GET', path: '/v1/vendor-invoices/{id}/payment-derivation', summary: 'Explain how a vendor invoice\'s paid amount is derived', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'submit': { method: 'POST', path: '/v1/vendor-invoices/{id}/submit', summary: 'Submit a vendor invoice for approval (transitions DRAFT to PENDING_APPROVAL)', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'approve': { method: 'POST', path: '/v1/vendor-invoices/{id}/approve', summary: 'Approve a vendor invoice (transitions DRAFT/PENDING_APPROVAL to APPROVED)', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: ['earlyPaymentDiscounts', 'totalAmountByTaxRate', 'files', 'notes', 'lineItems', 'tagIds', 'tagCodes', 'removeFileIds'] },
     'decline': { method: 'POST', path: '/v1/vendor-invoices/{id}/decline', summary: 'Decline a vendor invoice (transitions PENDING_APPROVAL to DECLINED)', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'book': { method: 'POST', path: '/v1/vendor-invoices/{id}/book', summary: 'Manually book a vendor invoice (dispatch to ledger-booking-agent)', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'rebuild-journal': { method: 'POST', path: '/v1/vendor-invoices/{id}/rebuild-journal', summary: 'Rebuild a vendor invoice booking journal (dispatch to ledger-booking-agent)', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'cancel': { method: 'POST', path: '/v1/vendor-invoices/{id}/cancel', summary: 'Cancel a vendor invoice', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
-    'confirm-cancellation': { method: 'POST', path: '/v1/vendor-invoices/{id}/confirm-cancellation', summary: 'Confirm bank cancellation for a vendor invoice (PENDING_CANCELLATION to CANCELLED)', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'change-vendor': { method: 'POST', path: '/v1/vendor-invoices/{id}/change-vendor', summary: 'Change the vendor on a vendor invoice', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'recalculate-payment-status': { method: 'POST', path: '/v1/vendor-invoices/{id}/recalculate-payment-status', summary: 'Recalculate a vendor invoice\'s open amount and payment status', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'validate': { method: 'POST', path: '/v1/vendor-invoices/{id}/validate', summary: 'Validate a vendor invoice update without persisting changes', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: ['earlyPaymentDiscounts', 'totalAmountByTaxRate', 'files', 'notes', 'lineItems', 'tagIds', 'tagCodes', 'removeFileIds'] },
-    'create-line-items': { method: 'POST', path: '/v1/vendor-invoices/{invoiceId}/line-items', summary: 'Add a line item to a vendor invoice', pathParams: ['invoiceId'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
-    'update-line-items': { method: 'PATCH', path: '/v1/vendor-invoices/{invoiceId}/line-items/{lineItemId}', summary: 'Update a line item on a vendor invoice', pathParams: ['invoiceId', 'lineItemId'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
+    'create-line-items': { method: 'POST', path: '/v1/vendor-invoices/{invoiceId}/line-items', summary: 'Add a line item to a vendor invoice', pathParams: ['invoiceId'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: ['tagIds', 'tagCodes', 'purchaseOrderLineItems'] },
+    'update-line-items': { method: 'PATCH', path: '/v1/vendor-invoices/{invoiceId}/line-items/{lineItemId}', summary: 'Update a line item on a vendor invoice', pathParams: ['invoiceId', 'lineItemId'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: ['tagIds', 'tagCodes', 'purchaseOrderLineItems'] },
     'delete-line-items': { method: 'DELETE', path: '/v1/vendor-invoices/{invoiceId}/line-items/{lineItemId}', summary: 'Remove a line item from a vendor invoice', pathParams: ['invoiceId', 'lineItemId'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'list-notes': { method: 'GET', path: '/v1/vendor-invoices/{vendorInvoiceId}/notes', summary: 'Get all notes for a vendor invoice', pathParams: ['vendorInvoiceId'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'create-notes': { method: 'POST', path: '/v1/vendor-invoices/{vendorInvoiceId}/notes', summary: 'Create a note for a vendor invoice', pathParams: ['vendorInvoiceId'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
@@ -43,6 +43,7 @@ const ENDPOINTS = {
     'update-payments': { method: 'PATCH', path: '/v1/vendor-invoices/{vendorInvoiceId}/payments/{paymentId}', summary: 'Update a payment for a vendor invoice', pathParams: ['vendorInvoiceId', 'paymentId'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'delete-payments': { method: 'DELETE', path: '/v1/vendor-invoices/{vendorInvoiceId}/payments/{paymentId}', summary: 'Delete a payment from a vendor invoice', pathParams: ['vendorInvoiceId', 'paymentId'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'payments-approve': { method: 'POST', path: '/v1/vendor-invoices/{vendorInvoiceId}/payments/{paymentId}/approve', summary: 'Approve a payment entry (OPEN → APPROVED)', pathParams: ['vendorInvoiceId', 'paymentId'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
+    'payments-reopen': { method: 'POST', path: '/v1/vendor-invoices/{vendorInvoiceId}/payments/{paymentId}/reopen', summary: 'Reopen an approved payment entry (APPROVED → OPEN)', pathParams: ['vendorInvoiceId', 'paymentId'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
     'payments-cancel': { method: 'POST', path: '/v1/vendor-invoices/{vendorInvoiceId}/payments/{paymentId}/cancel', summary: 'Cancel a sent payment entry (SENT -> ERROR)', pathParams: ['vendorInvoiceId', 'paymentId'], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
 };
 export default class VendorInvoices extends Command {
@@ -78,7 +79,7 @@ export default class VendorInvoices extends Command {
         'sort-by': Flags.string({ description: 'Sort field(s), comma-separated. Direction (:ASC/:DESC) is optional; date-like fields default to DESC, others to ASC.' }),
         filter: Flags.string({ description: 'Filter (e.g. --filter status=ACTIVE). Operators: in:A,B, like:%, gt:, lt:, null:', multiple: true }),
         query: Flags.string({ description: 'Additional query params as JSON' }),
-        fields: Flags.string({ description: 'Comma-separated list of fields to show (e.g. --fields=id,name,status)' }),
+        fields: Flags.string({ description: 'Comma-separated list of fields to return, applied by the API (e.g. --fields=id,name,status)' }),
         sanitize: Flags.boolean({ description: 'Remove null values, audit fields, and duplicate UUIDs from output' }),
         'show-http-request': Flags.boolean({ description: 'Show HTTP request details (method, URL, body)' }),
     };
@@ -150,6 +151,8 @@ export default class VendorInvoices extends Command {
             queryParams.search = flags.search;
         if (flags['sort-by'])
             queryParams.sortBy = normalizeSortBy(flags['sort-by']);
+        if (flags.fields)
+            queryParams.fields = flags.fields;
         if (flags.query) {
             try {
                 Object.assign(queryParams, JSON.parse(flags.query));
@@ -352,11 +355,6 @@ export default class VendorInvoices extends Command {
                     output = obj[arrayKeys[0]];
                 }
             }
-            // Filter fields if --fields flag is provided
-            if (flags.fields) {
-                const fieldList = flags.fields.split(',').map(f => f.trim());
-                output = this.filterFields(output, fieldList);
-            }
             // Sanitize output if requested
             if (flags.sanitize) {
                 output = this.sanitizeOutput(output);
@@ -611,6 +609,8 @@ export default class VendorInvoices extends Command {
             baseParams.sortBy = normalizeSortBy(flags['sort-by']);
         if (flags.include)
             baseParams.include = flags.include;
+        if (flags.fields)
+            baseParams.fields = flags.fields;
         if (flags.query) {
             try {
                 Object.assign(baseParams, JSON.parse(flags.query));
@@ -665,12 +665,7 @@ export default class VendorInvoices extends Command {
             }
         }
         process.stderr.write(' done\n');
-        // Filter fields if specified
         let output = allItems;
-        if (flags.fields) {
-            const fieldList = flags.fields.split(',').map(f => f.trim());
-            output = this.filterFields(allItems, fieldList);
-        }
         // Sanitize output if requested
         if (flags.sanitize) {
             output = this.sanitizeOutput(output);
@@ -999,56 +994,6 @@ export default class VendorInvoices extends Command {
             return `\$${op}`;
         return opRe.test(rest) ? `\$${op}:${this.parseFilterValue(rest)}` : `\$${op}:${rest}`;
     }
-    filterFields(data, fields) {
-        const isUnsafeKey = (k) => k === '__proto__' || k === 'constructor' || k === 'prototype';
-        const pick = (obj, keys) => {
-            // Group keys by their first segment so sibling sub-paths
-            // (e.g. 'items.amount' + 'items._type') resolve in one recursive pass
-            // and don't clobber each other on merge.
-            const directKeys = new Set();
-            const nestedKeys = new Map();
-            for (const key of keys) {
-                if (key.split('.').some(isUnsafeKey))
-                    continue;
-                if (key.includes('.')) {
-                    const [first, ...rest] = key.split('.');
-                    if (isUnsafeKey(first))
-                        continue;
-                    const list = nestedKeys.get(first);
-                    if (list) {
-                        list.push(rest.join('.'));
-                    }
-                    else {
-                        nestedKeys.set(first, [rest.join('.')]);
-                    }
-                }
-                else {
-                    directKeys.add(key);
-                }
-            }
-            const result = {};
-            for (const key of directKeys) {
-                if (key in obj)
-                    result[key] = obj[key];
-            }
-            for (const [first, restKeys] of nestedKeys) {
-                const val = obj[first];
-                if (!val || typeof val !== 'object')
-                    continue;
-                if (Array.isArray(val)) {
-                    result[first] = val.map(item => pick(item, restKeys));
-                }
-                else {
-                    result[first] = pick(val, restKeys);
-                }
-            }
-            return result;
-        };
-        if (Array.isArray(data)) {
-            return data.map(item => pick(item, fields));
-        }
-        return pick(data, fields);
-    }
     sanitizeOutput(data) {
         const auditFields = ['_type', 'tenantId', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'];
         const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/commands/webhooks.d.ts

@@ -31,7 +31,6 @@ export default class Webhooks extends Command {
     private runCamt053Import;
     private runNestedImport;
     private parseFilterValue;
-    private filterFields;
     private sanitizeOutput;
     private getColumns;
     private getValue;

package/dist/commands/webhooks.js

@@ -45,7 +45,7 @@ export default class Webhooks extends Command {
         'sort-by': Flags.string({ description: 'Sort field(s), comma-separated. Direction (:ASC/:DESC) is optional; date-like fields default to DESC, others to ASC.' }),
         filter: Flags.string({ description: 'Filter (e.g. --filter status=ACTIVE). Operators: in:A,B, like:%, gt:, lt:, null:', multiple: true }),
         query: Flags.string({ description: 'Additional query params as JSON' }),
-        fields: Flags.string({ description: 'Comma-separated list of fields to show (e.g. --fields=id,name,status)' }),
+        fields: Flags.string({ description: 'Comma-separated list of fields to return, applied by the API (e.g. --fields=id,name,status)' }),
         sanitize: Flags.boolean({ description: 'Remove null values, audit fields, and duplicate UUIDs from output' }),
         'show-http-request': Flags.boolean({ description: 'Show HTTP request details (method, URL, body)' }),
     };
@@ -117,6 +117,8 @@ export default class Webhooks extends Command {
             queryParams.search = flags.search;
         if (flags['sort-by'])
             queryParams.sortBy = normalizeSortBy(flags['sort-by']);
+        if (flags.fields)
+            queryParams.fields = flags.fields;
         if (flags.query) {
             try {
                 Object.assign(queryParams, JSON.parse(flags.query));
@@ -319,11 +321,6 @@ export default class Webhooks extends Command {
                     output = obj[arrayKeys[0]];
                 }
             }
-            // Filter fields if --fields flag is provided
-            if (flags.fields) {
-                const fieldList = flags.fields.split(',').map(f => f.trim());
-                output = this.filterFields(output, fieldList);
-            }
             // Sanitize output if requested
             if (flags.sanitize) {
                 output = this.sanitizeOutput(output);
@@ -578,6 +575,8 @@ export default class Webhooks extends Command {
             baseParams.sortBy = normalizeSortBy(flags['sort-by']);
         if (flags.include)
             baseParams.include = flags.include;
+        if (flags.fields)
+            baseParams.fields = flags.fields;
         if (flags.query) {
             try {
                 Object.assign(baseParams, JSON.parse(flags.query));
@@ -632,12 +631,7 @@ export default class Webhooks extends Command {
             }
         }
         process.stderr.write(' done\n');
-        // Filter fields if specified
         let output = allItems;
-        if (flags.fields) {
-            const fieldList = flags.fields.split(',').map(f => f.trim());
-            output = this.filterFields(allItems, fieldList);
-        }
         // Sanitize output if requested
         if (flags.sanitize) {
             output = this.sanitizeOutput(output);
@@ -966,56 +960,6 @@ export default class Webhooks extends Command {
             return `\$${op}`;
         return opRe.test(rest) ? `\$${op}:${this.parseFilterValue(rest)}` : `\$${op}:${rest}`;
     }
-    filterFields(data, fields) {
-        const isUnsafeKey = (k) => k === '__proto__' || k === 'constructor' || k === 'prototype';
-        const pick = (obj, keys) => {
-            // Group keys by their first segment so sibling sub-paths
-            // (e.g. 'items.amount' + 'items._type') resolve in one recursive pass
-            // and don't clobber each other on merge.
-            const directKeys = new Set();
-            const nestedKeys = new Map();
-            for (const key of keys) {
-                if (key.split('.').some(isUnsafeKey))
-                    continue;
-                if (key.includes('.')) {
-                    const [first, ...rest] = key.split('.');
-                    if (isUnsafeKey(first))
-                        continue;
-                    const list = nestedKeys.get(first);
-                    if (list) {
-                        list.push(rest.join('.'));
-                    }
-                    else {
-                        nestedKeys.set(first, [rest.join('.')]);
-                    }
-                }
-                else {
-                    directKeys.add(key);
-                }
-            }
-            const result = {};
-            for (const key of directKeys) {
-                if (key in obj)
-                    result[key] = obj[key];
-            }
-            for (const [first, restKeys] of nestedKeys) {
-                const val = obj[first];
-                if (!val || typeof val !== 'object')
-                    continue;
-                if (Array.isArray(val)) {
-                    result[first] = val.map(item => pick(item, restKeys));
-                }
-                else {
-                    result[first] = pick(val, restKeys);
-                }
-            }
-            return result;
-        };
-        if (Array.isArray(data)) {
-            return data.map(item => pick(item, fields));
-        }
-        return pick(data, fields);
-    }
     sanitizeOutput(data) {
         const auditFields = ['_type', 'tenantId', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'];
         const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/commands/workflows.d.ts

@@ -31,7 +31,6 @@ export default class Workflows extends Command {
     private runCamt053Import;
     private runNestedImport;
     private parseFilterValue;
-    private filterFields;
     private sanitizeOutput;
     private getColumns;
     private getValue;

package/dist/commands/workflows.js

@@ -37,7 +37,7 @@ export default class Workflows extends Command {
         'sort-by': Flags.string({ description: 'Sort field(s), comma-separated. Direction (:ASC/:DESC) is optional; date-like fields default to DESC, others to ASC.' }),
         filter: Flags.string({ description: 'Filter (e.g. --filter status=ACTIVE). Operators: in:A,B, like:%, gt:, lt:, null:', multiple: true }),
         query: Flags.string({ description: 'Additional query params as JSON' }),
-        fields: Flags.string({ description: 'Comma-separated list of fields to show (e.g. --fields=id,name,status)' }),
+        fields: Flags.string({ description: 'Comma-separated list of fields to return, applied by the API (e.g. --fields=id,name,status)' }),
         sanitize: Flags.boolean({ description: 'Remove null values, audit fields, and duplicate UUIDs from output' }),
         'show-http-request': Flags.boolean({ description: 'Show HTTP request details (method, URL, body)' }),
     };
@@ -109,6 +109,8 @@ export default class Workflows extends Command {
             queryParams.search = flags.search;
         if (flags['sort-by'])
             queryParams.sortBy = normalizeSortBy(flags['sort-by']);
+        if (flags.fields)
+            queryParams.fields = flags.fields;
         if (flags.query) {
             try {
                 Object.assign(queryParams, JSON.parse(flags.query));
@@ -311,11 +313,6 @@ export default class Workflows extends Command {
                     output = obj[arrayKeys[0]];
                 }
             }
-            // Filter fields if --fields flag is provided
-            if (flags.fields) {
-                const fieldList = flags.fields.split(',').map(f => f.trim());
-                output = this.filterFields(output, fieldList);
-            }
             // Sanitize output if requested
             if (flags.sanitize) {
                 output = this.sanitizeOutput(output);
@@ -570,6 +567,8 @@ export default class Workflows extends Command {
             baseParams.sortBy = normalizeSortBy(flags['sort-by']);
         if (flags.include)
             baseParams.include = flags.include;
+        if (flags.fields)
+            baseParams.fields = flags.fields;
         if (flags.query) {
             try {
                 Object.assign(baseParams, JSON.parse(flags.query));
@@ -624,12 +623,7 @@ export default class Workflows extends Command {
             }
         }
         process.stderr.write(' done\n');
-        // Filter fields if specified
         let output = allItems;
-        if (flags.fields) {
-            const fieldList = flags.fields.split(',').map(f => f.trim());
-            output = this.filterFields(allItems, fieldList);
-        }
         // Sanitize output if requested
         if (flags.sanitize) {
             output = this.sanitizeOutput(output);
@@ -958,56 +952,6 @@ export default class Workflows extends Command {
             return `\$${op}`;
         return opRe.test(rest) ? `\$${op}:${this.parseFilterValue(rest)}` : `\$${op}:${rest}`;
     }
-    filterFields(data, fields) {
-        const isUnsafeKey = (k) => k === '__proto__' || k === 'constructor' || k === 'prototype';
-        const pick = (obj, keys) => {
-            // Group keys by their first segment so sibling sub-paths
-            // (e.g. 'items.amount' + 'items._type') resolve in one recursive pass
-            // and don't clobber each other on merge.
-            const directKeys = new Set();
-            const nestedKeys = new Map();
-            for (const key of keys) {
-                if (key.split('.').some(isUnsafeKey))
-                    continue;
-                if (key.includes('.')) {
-                    const [first, ...rest] = key.split('.');
-                    if (isUnsafeKey(first))
-                        continue;
-                    const list = nestedKeys.get(first);
-                    if (list) {
-                        list.push(rest.join('.'));
-                    }
-                    else {
-                        nestedKeys.set(first, [rest.join('.')]);
-                    }
-                }
-                else {
-                    directKeys.add(key);
-                }
-            }
-            const result = {};
-            for (const key of directKeys) {
-                if (key in obj)
-                    result[key] = obj[key];
-            }
-            for (const [first, restKeys] of nestedKeys) {
-                const val = obj[first];
-                if (!val || typeof val !== 'object')
-                    continue;
-                if (Array.isArray(val)) {
-                    result[first] = val.map(item => pick(item, restKeys));
-                }
-                else {
-                    result[first] = pick(val, restKeys);
-                }
-            }
-            return result;
-        };
-        if (Array.isArray(data)) {
-            return data.map(item => pick(item, fields));
-        }
-        return pick(data, fields);
-    }
     sanitizeOutput(data) {
         const auditFields = ['_type', 'tenantId', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'];
         const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/lib/api-client.js

@@ -1,6 +1,6 @@
 import axios from 'axios';
-import { getAuthHeaders } from './auth.js';
-import { getAuthType, getBaseUrls, getCurrentContext } from './config.js';
+import { getAuthHeaders } from './auth/index.js';
+import { getBaseUrls, getCurrentContext, unauthorizedMessage } from './config.js';
 /**
  * Normalize a --sort-by value: comma-separated fields, each optionally suffixed
  * with `:ASC` or `:DESC`. Fields without an explicit direction default to DESC
@@ -60,10 +60,7 @@ export async function createApiClient(contextName, options = false) {
             // Handle 401 with a clear message, pointing at the right remedy for the
             // context's auth type — re-login only helps OAuth contexts.
             if (error.response.status === 401) {
-                const message = getAuthType(context) === 'api_key'
-                    ? `API key for context "${context.name}" was rejected. Check the key with: aderis config set-api-key --context ${context.name}`
-                    : 'Session expired. Please run: aderis auth login';
-                throw new ApiError(message, 401, error.response.data);
+                throw new ApiError(unauthorizedMessage(context), 401, error.response.data);
             }
             const message = extractErrorMessage(error.response.data);
             throw new ApiError(message, error.response.status, error.response.data);

package/dist/lib/auth/constants.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Loopback redirect (RFC 8252 §7.3). The Keycloak client registers
+ * `http://localhost:*`; one shared port keeps every context on a registered redirect.
+ */
+export declare const CALLBACK_PORT = 8085;
+export declare const REDIRECT_URI = "http://localhost:8085/oauth/callback";
+/** Headers for `application/x-www-form-urlencoded` token endpoint requests (RFC 6749 §4.1.3). */
+export declare const FORM_POST_HEADERS: {
+    readonly Accept: "application/json";
+    readonly 'Content-Type': "application/x-www-form-urlencoded";
+};

package/dist/lib/auth/constants.js

@@ -0,0 +1,11 @@
+/**
+ * Loopback redirect (RFC 8252 §7.3). The Keycloak client registers
+ * `http://localhost:*`; one shared port keeps every context on a registered redirect.
+ */
+export const CALLBACK_PORT = 8085;
+export const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}/oauth/callback`;
+/** Headers for `application/x-www-form-urlencoded` token endpoint requests (RFC 6749 §4.1.3). */
+export const FORM_POST_HEADERS = {
+    Accept: 'application/json',
+    'Content-Type': 'application/x-www-form-urlencoded',
+};

package/dist/lib/auth/errors.d.ts

@@ -0,0 +1,17 @@
+/**
+ * An authentication-protocol failure reported to the user, distinct from
+ * transport errors (axios) and from `ApiError`. Never wraps the axios error:
+ * its request config carries the form body (refresh token, PKCE verifier,
+ * client secret).
+ */
+export declare class AuthError extends Error {
+    /** HTTP status of the response that caused this error, when there was one. */
+    readonly status?: number;
+    constructor(message: string, options?: {
+        status?: number;
+    });
+}
+/** The token that ended a tenant switch is not for the requested tenant; shown as "Tenant Switch Failed" (HTTP 400). */
+export declare class TenantMismatchError extends AuthError {
+    constructor(message: string);
+}

package/dist/lib/auth/errors.js

@@ -0,0 +1,22 @@
+/**
+ * An authentication-protocol failure reported to the user, distinct from
+ * transport errors (axios) and from `ApiError`. Never wraps the axios error:
+ * its request config carries the form body (refresh token, PKCE verifier,
+ * client secret).
+ */
+export class AuthError extends Error {
+    /** HTTP status of the response that caused this error, when there was one. */
+    status;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = 'AuthError';
+        this.status = options.status;
+    }
+}
+/** The token that ended a tenant switch is not for the requested tenant; shown as "Tenant Switch Failed" (HTTP 400). */
+export class TenantMismatchError extends AuthError {
+    constructor(message) {
+        super(message);
+        this.name = 'TenantMismatchError';
+    }
+}

package/dist/lib/auth/flow.d.ts

@@ -0,0 +1,27 @@
+import { type Context, type TokenData } from '../config.js';
+import { type PageMessage } from './pages.js';
+import { type AuthProvider, type AuthRound } from './types.js';
+export interface BrowserFlowOptions {
+    /** Line logger for the "Opening browser…" hints. Defaults to `console.log`. */
+    log?: (line: string) => void;
+    /** Opens the authorize URL. Defaults to the system browser; tests inject a stub. */
+    openBrowser?: (url: string) => Promise<unknown>;
+    /** Page shown after the last round succeeds. */
+    success: {
+        message: PageMessage | string;
+        title: string;
+    };
+}
+/** The injectable parts of a browser flow. */
+export type FlowHooks = Pick<BrowserFlowOptions, 'log' | 'openBrowser'>;
+/**
+ * Runs one or more authorization rounds through a single local callback server
+ * and a single browser tab. Per round: the browser lands on `/oauth/callback`,
+ * the code is exchanged via the provider, the tokens are saved to the context
+ * and the round's `afterExchange` hook runs (tokens it returns are saved and
+ * become the round's result). A following round is entered via
+ * a meta-refresh into its authorize URL; the last round answers the success
+ * page and resolves with its tokens. A callback whose `state` is not the
+ * expected round's is rejected.
+ */
+export declare function runBrowserFlow(context: Context, provider: AuthProvider, rounds: AuthRound[], options: BrowserFlowOptions): Promise<TokenData>;