@aderis-erp/cli 1.0.15 → 1.1.0

package/dist/commands/workflows.js

@@ -1,5 +1,5 @@
 import { Command, Args, Flags } from '@oclif/core';
-import { apiRequest, ApiError, normalizeSortBy } from '../lib/api-client.js';
+import { apiRequest, ApiError, isTextualMediaType, normalizeSortBy } from '../lib/api-client.js';
 import { getCurrentContext, getContext, getBaseUrls, hasCredentials, missingCredentialsMessage } from '../lib/config.js';
 // Add 'import' action if both create and update exist
 const HAS_IMPORT = false;
@@ -8,9 +8,9 @@ const HAS_CAMT053 = false;
 const NESTED_IMPORTS = [];
 const SUBCOMMANDS = [...["list", "status", "find"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
 const ENDPOINTS = {
-    'list': { method: 'GET', path: '/v1/workflows', summary: 'Get all workflows with their summary', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
-    'status': { method: 'POST', path: '/v1/workflows/status', summary: 'Create a new workflow status update', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
-    'find': { method: 'GET', path: '/v1/workflows/{workflowId}', summary: 'Get workflow details including status updates and entity changes', pathParams: ['workflowId'], hasBody: false, isMultipart: false, isBinaryResponse: false, bodyArrayFields: [] },
+    'list': { method: 'GET', path: '/v1/workflows', summary: 'Get all workflows with their summary', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
+    'status': { method: 'POST', path: '/v1/workflows/status', summary: 'Create a new workflow status update', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
+    'find': { method: 'GET', path: '/v1/workflows/{workflowId}', summary: 'Get workflow details including status updates and entity changes', pathParams: ['workflowId'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
 };
 export default class Workflows extends Command {
     static description = 'Manage workflows';
@@ -37,7 +37,7 @@ export default class Workflows extends Command {
         'sort-by': Flags.string({ description: 'Sort field(s), comma-separated. Direction (:ASC/:DESC) is optional; date-like fields default to DESC, others to ASC.' }),
         filter: Flags.string({ description: 'Filter (e.g. --filter status=ACTIVE). Operators: in:A,B, like:%, gt:, lt:, null:', multiple: true }),
         query: Flags.string({ description: 'Additional query params as JSON' }),
-        fields: Flags.string({ description: 'Comma-separated list of fields to show (e.g. --fields=id,name,status)' }),
+        fields: Flags.string({ description: 'Comma-separated list of fields to return, applied by the API (e.g. --fields=id,name,status)' }),
         sanitize: Flags.boolean({ description: 'Remove null values, audit fields, and duplicate UUIDs from output' }),
         'show-http-request': Flags.boolean({ description: 'Show HTTP request details (method, URL, body)' }),
     };
@@ -109,6 +109,8 @@ export default class Workflows extends Command {
             queryParams.search = flags.search;
         if (flags['sort-by'])
             queryParams.sortBy = normalizeSortBy(flags['sort-by']);
+        if (flags.fields)
+            queryParams.fields = flags.fields;
         if (flags.query) {
             try {
                 Object.assign(queryParams, JSON.parse(flags.query));
@@ -256,10 +258,11 @@ export default class Workflows extends Command {
             process.stderr.write('\n');
         }
         try {
-            // Binary response: download to file
+            // Binary response: to -f / --file, or to stdout when it is redirected.
             if (endpoint.isBinaryResponse) {
-                if (!flags.file) {
-                    this.error(`Endpoint returns a binary file. Specify the output path with -f / --file (e.g. -f report.xlsx).`);
+                const toStdout = !flags.file;
+                if (toStdout && process.stdout.isTTY) {
+                    this.error(`Endpoint returns a binary file. Specify the output path with -f / --file (e.g. -f report.xlsx), or redirect stdout to a file.`);
                 }
                 const binResponse = await apiRequest(endpoint.method, apiPath, {
                     params: Object.keys(queryParams).length > 0 ? queryParams : undefined,
@@ -267,24 +270,55 @@ export default class Workflows extends Command {
                     contextName: flags.context,
                     binary: true,
                 });
-                const fsModule = await import('node:fs');
                 const binData = binResponse.data;
                 const buffer = Buffer.isBuffer(binData)
                     ? binData
                     : Buffer.from(binData);
+                if (toStdout) {
+                    // Nothing else may reach stdout here — it is the file.
+                    process.stdout.write(buffer);
+                    return;
+                }
+                const fsModule = await import('node:fs');
                 fsModule.writeFileSync(flags.file, buffer);
                 this.log(`Saved ${buffer.length} bytes to ${flags.file}`);
                 return;
             }
-            const response = await apiRequest(endpoint.method, apiPath, {
-                params: Object.keys(queryParams).length > 0 ? queryParams : undefined,
-                data,
-                contextName: flags.context,
-                acceptAny: true,
-            });
+            let response;
+            if (endpoint.hasBinaryVariant) {
+                // This route answers JSON or a file depending on the request body, so the
+                // bytes are read first and the response's own content-type decides. Asking
+                // for text here would corrupt an xlsx/pdf before anything could inspect it.
+                const raw = await apiRequest(endpoint.method, apiPath, {
+                    params: Object.keys(queryParams).length > 0 ? queryParams : undefined,
+                    data,
+                    contextName: flags.context,
+                    binary: true,
+                });
+                const rawType = String(raw.headers['content-type'] || '').toLowerCase();
+                const rawData = raw.data;
+                const buffer = Buffer.isBuffer(rawData) ? rawData : Buffer.from(rawData);
+                if (!isTextualMediaType(rawType)) {
+                    if (process.stdout.isTTY) {
+                        this.error(`The API returned ${rawType || 'binary data'}. Redirect stdout to a file, e.g. ... > report.xlsx`);
+                    }
+                    // Nothing else may reach stdout here — it is the file.
+                    process.stdout.write(buffer);
+                    return;
+                }
+                response = { data: buffer.toString('utf8'), headers: raw.headers, status: raw.status };
+            }
+            else {
+                response = await apiRequest(endpoint.method, apiPath, {
+                    params: Object.keys(queryParams).length > 0 ? queryParams : undefined,
+                    data,
+                    contextName: flags.context,
+                    acceptAny: true,
+                });
+            }
             // Check content-type for non-JSON responses (XML, text, etc.)
             const contentType = (response.headers['content-type'] || '').toLowerCase();
-            if (contentType.includes('xml') || contentType.includes('text/')) {
+            if (isTextualMediaType(contentType) && !contentType.startsWith('application/json')) {
                 // Output raw content for XML/text responses (CSV, plain, HTML, etc.)
                 this.log(String(response.data));
                 return;
@@ -311,11 +345,6 @@ export default class Workflows extends Command {
                     output = obj[arrayKeys[0]];
                 }
             }
-            // Filter fields if --fields flag is provided
-            if (flags.fields) {
-                const fieldList = flags.fields.split(',').map(f => f.trim());
-                output = this.filterFields(output, fieldList);
-            }
             // Sanitize output if requested
             if (flags.sanitize) {
                 output = this.sanitizeOutput(output);
@@ -570,6 +599,8 @@ export default class Workflows extends Command {
             baseParams.sortBy = normalizeSortBy(flags['sort-by']);
         if (flags.include)
             baseParams.include = flags.include;
+        if (flags.fields)
+            baseParams.fields = flags.fields;
         if (flags.query) {
             try {
                 Object.assign(baseParams, JSON.parse(flags.query));
@@ -624,12 +655,7 @@ export default class Workflows extends Command {
             }
         }
         process.stderr.write(' done\n');
-        // Filter fields if specified
         let output = allItems;
-        if (flags.fields) {
-            const fieldList = flags.fields.split(',').map(f => f.trim());
-            output = this.filterFields(allItems, fieldList);
-        }
         // Sanitize output if requested
         if (flags.sanitize) {
             output = this.sanitizeOutput(output);
@@ -958,56 +984,6 @@ export default class Workflows extends Command {
             return `\$${op}`;
         return opRe.test(rest) ? `\$${op}:${this.parseFilterValue(rest)}` : `\$${op}:${rest}`;
     }
-    filterFields(data, fields) {
-        const isUnsafeKey = (k) => k === '__proto__' || k === 'constructor' || k === 'prototype';
-        const pick = (obj, keys) => {
-            // Group keys by their first segment so sibling sub-paths
-            // (e.g. 'items.amount' + 'items._type') resolve in one recursive pass
-            // and don't clobber each other on merge.
-            const directKeys = new Set();
-            const nestedKeys = new Map();
-            for (const key of keys) {
-                if (key.split('.').some(isUnsafeKey))
-                    continue;
-                if (key.includes('.')) {
-                    const [first, ...rest] = key.split('.');
-                    if (isUnsafeKey(first))
-                        continue;
-                    const list = nestedKeys.get(first);
-                    if (list) {
-                        list.push(rest.join('.'));
-                    }
-                    else {
-                        nestedKeys.set(first, [rest.join('.')]);
-                    }
-                }
-                else {
-                    directKeys.add(key);
-                }
-            }
-            const result = {};
-            for (const key of directKeys) {
-                if (key in obj)
-                    result[key] = obj[key];
-            }
-            for (const [first, restKeys] of nestedKeys) {
-                const val = obj[first];
-                if (!val || typeof val !== 'object')
-                    continue;
-                if (Array.isArray(val)) {
-                    result[first] = val.map(item => pick(item, restKeys));
-                }
-                else {
-                    result[first] = pick(val, restKeys);
-                }
-            }
-            return result;
-        };
-        if (Array.isArray(data)) {
-            return data.map(item => pick(item, fields));
-        }
-        return pick(data, fields);
-    }
     sanitizeOutput(data) {
         const auditFields = ['_type', 'tenantId', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'];
         const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/lib/api-client.d.ts

@@ -28,6 +28,12 @@ export interface PaginatedResponse<T> {
  * into repeated `sortBy=a:ASC&sortBy=b:DESC` params.
  */
 export declare function normalizeSortBy(input: string): string[];
+/**
+ * Whether a response body is text the CLI may decode. Matched on the media type
+ * rather than by substring: application/vnd.openxmlformats-officedocument...
+ * (xlsx) contains "xml" but is a zip, and decoding it corrupts every byte.
+ */
+export declare function isTextualMediaType(contentType: string): boolean;
 export declare class ApiError extends Error {
     status: number;
     data?: unknown | undefined;

package/dist/lib/api-client.js

@@ -1,6 +1,6 @@
 import axios from 'axios';
-import { getAuthHeaders } from './auth.js';
-import { getAuthType, getBaseUrls, getCurrentContext } from './config.js';
+import { getAuthHeaders } from './auth/index.js';
+import { getBaseUrls, getCurrentContext, unauthorizedMessage } from './config.js';
 /**
  * Normalize a --sort-by value: comma-separated fields, each optionally suffixed
  * with `:ASC` or `:DESC`. Fields without an explicit direction default to DESC
@@ -21,6 +21,19 @@ export function normalizeSortBy(input) {
         return `${part}:${dateLike ? 'DESC' : 'ASC'}`;
     });
 }
+/**
+ * Whether a response body is text the CLI may decode. Matched on the media type
+ * rather than by substring: application/vnd.openxmlformats-officedocument...
+ * (xlsx) contains "xml" but is a zip, and decoding it corrupts every byte.
+ */
+export function isTextualMediaType(contentType) {
+    const type = contentType.split(';')[0].trim().toLowerCase();
+    if (type.startsWith('text/'))
+        return true;
+    if (type === 'application/json' || type === 'application/xml')
+        return true;
+    return type.endsWith('+json') || type.endsWith('+xml');
+}
 export class ApiError extends Error {
     status;
     data;
@@ -60,10 +73,7 @@ export async function createApiClient(contextName, options = false) {
             // Handle 401 with a clear message, pointing at the right remedy for the
             // context's auth type — re-login only helps OAuth contexts.
             if (error.response.status === 401) {
-                const message = getAuthType(context) === 'api_key'
-                    ? `API key for context "${context.name}" was rejected. Check the key with: aderis config set-api-key --context ${context.name}`
-                    : 'Session expired. Please run: aderis auth login';
-                throw new ApiError(message, 401, error.response.data);
+                throw new ApiError(unauthorizedMessage(context), 401, error.response.data);
             }
             const message = extractErrorMessage(error.response.data);
             throw new ApiError(message, error.response.status, error.response.data);

package/dist/lib/auth/constants.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Loopback redirect (RFC 8252 §7.3). The Keycloak client registers
+ * `http://localhost:*`; one shared port keeps every context on a registered redirect.
+ */
+export declare const CALLBACK_PORT = 8085;
+export declare const REDIRECT_URI = "http://localhost:8085/oauth/callback";
+/** Headers for `application/x-www-form-urlencoded` token endpoint requests (RFC 6749 §4.1.3). */
+export declare const FORM_POST_HEADERS: {
+    readonly Accept: "application/json";
+    readonly 'Content-Type': "application/x-www-form-urlencoded";
+};

package/dist/lib/auth/constants.js

@@ -0,0 +1,11 @@
+/**
+ * Loopback redirect (RFC 8252 §7.3). The Keycloak client registers
+ * `http://localhost:*`; one shared port keeps every context on a registered redirect.
+ */
+export const CALLBACK_PORT = 8085;
+export const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}/oauth/callback`;
+/** Headers for `application/x-www-form-urlencoded` token endpoint requests (RFC 6749 §4.1.3). */
+export const FORM_POST_HEADERS = {
+    Accept: 'application/json',
+    'Content-Type': 'application/x-www-form-urlencoded',
+};

package/dist/lib/auth/errors.d.ts

@@ -0,0 +1,17 @@
+/**
+ * An authentication-protocol failure reported to the user, distinct from
+ * transport errors (axios) and from `ApiError`. Never wraps the axios error:
+ * its request config carries the form body (refresh token, PKCE verifier,
+ * client secret).
+ */
+export declare class AuthError extends Error {
+    /** HTTP status of the response that caused this error, when there was one. */
+    readonly status?: number;
+    constructor(message: string, options?: {
+        status?: number;
+    });
+}
+/** The token that ended a tenant switch is not for the requested tenant; shown as "Tenant Switch Failed" (HTTP 400). */
+export declare class TenantMismatchError extends AuthError {
+    constructor(message: string);
+}

package/dist/lib/auth/errors.js

@@ -0,0 +1,22 @@
+/**
+ * An authentication-protocol failure reported to the user, distinct from
+ * transport errors (axios) and from `ApiError`. Never wraps the axios error:
+ * its request config carries the form body (refresh token, PKCE verifier,
+ * client secret).
+ */
+export class AuthError extends Error {
+    /** HTTP status of the response that caused this error, when there was one. */
+    status;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = 'AuthError';
+        this.status = options.status;
+    }
+}
+/** The token that ended a tenant switch is not for the requested tenant; shown as "Tenant Switch Failed" (HTTP 400). */
+export class TenantMismatchError extends AuthError {
+    constructor(message) {
+        super(message);
+        this.name = 'TenantMismatchError';
+    }
+}

package/dist/lib/auth/flow.d.ts

@@ -0,0 +1,27 @@
+import { type Context, type TokenData } from '../config.js';
+import { type PageMessage } from './pages.js';
+import { type AuthProvider, type AuthRound } from './types.js';
+export interface BrowserFlowOptions {
+    /** Line logger for the "Opening browser…" hints. Defaults to `console.log`. */
+    log?: (line: string) => void;
+    /** Opens the authorize URL. Defaults to the system browser; tests inject a stub. */
+    openBrowser?: (url: string) => Promise<unknown>;
+    /** Page shown after the last round succeeds. */
+    success: {
+        message: PageMessage | string;
+        title: string;
+    };
+}
+/** The injectable parts of a browser flow. */
+export type FlowHooks = Pick<BrowserFlowOptions, 'log' | 'openBrowser'>;
+/**
+ * Runs one or more authorization rounds through a single local callback server
+ * and a single browser tab. Per round: the browser lands on `/oauth/callback`,
+ * the code is exchanged via the provider, the tokens are saved to the context
+ * and the round's `afterExchange` hook runs (tokens it returns are saved and
+ * become the round's result). A following round is entered via
+ * a meta-refresh into its authorize URL; the last round answers the success
+ * page and resolves with its tokens. A callback whose `state` is not the
+ * expected round's is rejected.
+ */
+export declare function runBrowserFlow(context: Context, provider: AuthProvider, rounds: AuthRound[], options: BrowserFlowOptions): Promise<TokenData>;

package/dist/lib/auth/flow.js

@@ -0,0 +1,163 @@
+import * as http from 'node:http';
+import { URL } from 'node:url';
+import open from 'open';
+import { saveTokens } from '../config.js';
+import { CALLBACK_PORT } from './constants.js';
+import { TenantMismatchError } from './errors.js';
+import { renderAuthPage, renderRedirectPage } from './pages.js';
+import { generateNonce, generatePkce, generateState } from './pkce.js';
+const FLOW_TIMEOUT_MS = 5 * 60 * 1000;
+async function prepareRounds(context, provider, rounds) {
+    const prepared = [];
+    for (const round of rounds) {
+        const pkce = generatePkce();
+        const state = generateState();
+        const nonce = generateNonce();
+        const authorizeUrl = await provider.buildAuthorizeUrl(context, {
+            codeChallenge: pkce.challenge,
+            nonce,
+            prompt: round.prompt,
+            state,
+        });
+        prepared.push({ ...round, authorizeUrl, codeVerifier: pkce.verifier, nonce, state });
+    }
+    return prepared;
+}
+/**
+ * Runs one or more authorization rounds through a single local callback server
+ * and a single browser tab. Per round: the browser lands on `/oauth/callback`,
+ * the code is exchanged via the provider, the tokens are saved to the context
+ * and the round's `afterExchange` hook runs (tokens it returns are saved and
+ * become the round's result). A following round is entered via
+ * a meta-refresh into its authorize URL; the last round answers the success
+ * page and resolves with its tokens. A callback whose `state` is not the
+ * expected round's is rejected.
+ */
+export async function runBrowserFlow(context, provider, rounds, options) {
+    if (rounds.length === 0) {
+        throw new Error('A browser flow needs at least one authorization round');
+    }
+    const log = options.log ?? console.log;
+    const openBrowser = options.openBrowser ?? ((url) => open(url));
+    const prepared = await prepareRounds(context, provider, rounds);
+    return new Promise((resolve, reject) => {
+        const connections = new Set();
+        let currentRound = 0;
+        // States whose callback has been taken: a duplicate arriving while its
+        // exchange is in flight is answered, not redeemed again.
+        const redeemed = new Set();
+        // Holder: closeServer references the timer before it exists.
+        const timeout = {};
+        const closeServer = () => {
+            if (timeout.id)
+                clearTimeout(timeout.id);
+            for (const socket of connections) {
+                socket.destroy();
+            }
+            connections.clear();
+            server.close();
+            process.off('SIGINT', onSigint);
+        };
+        const onSigint = () => {
+            closeServer();
+            // Exit with the SIGINT status so the parent shell sees the termination.
+            // eslint-disable-next-line unicorn/no-process-exit, n/no-process-exit
+            process.exit(130);
+        };
+        const fail = (res, status, title, error) => {
+            res.writeHead(status, { 'Content-Type': 'text/html' });
+            res.end(renderAuthPage('error', title, error.message));
+            // Let the page reach the browser before the connection is torn down.
+            setImmediate(() => {
+                closeServer();
+                reject(error);
+            });
+        };
+        const server = http.createServer(async (req, res) => {
+            const url = new URL(req.url || '', `http://localhost:${CALLBACK_PORT}`);
+            if (url.pathname !== '/oauth/callback') {
+                res.writeHead(404);
+                res.end('Not Found');
+                return;
+            }
+            const code = url.searchParams.get('code');
+            const returnedState = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            const errorDescription = url.searchParams.get('error_description');
+            if (error) {
+                fail(res, 400, 'Authentication Failed', new Error(errorDescription || error));
+                return;
+            }
+            // A callback already taken (a browser retry, or a late one after the last
+            // round) has nothing to redeem and must not abort the flow.
+            const round = prepared[currentRound];
+            if (!round || (returnedState && redeemed.has(returnedState))) {
+                res.writeHead(400, { 'Content-Type': 'text/plain' });
+                res.end('This authorization response has already been used');
+                return;
+            }
+            if (!code || returnedState !== round.state) {
+                fail(res, 400, 'Authentication Failed', new Error('Invalid authorization response'));
+                return;
+            }
+            redeemed.add(round.state);
+            try {
+                const exchanged = await provider.exchangeCode(context, {
+                    code,
+                    codeVerifier: round.codeVerifier,
+                    nonce: round.nonce,
+                });
+                saveTokens(context.name, exchanged);
+                const tokens = (await round.afterExchange?.(exchanged)) ?? exchanged;
+                if (tokens !== exchanged)
+                    saveTokens(context.name, tokens);
+                currentRound += 1;
+                const next = prepared[currentRound];
+                if (next) {
+                    res.writeHead(200, { 'Content-Type': 'text/html' });
+                    res.end(renderRedirectPage(next.authorizeUrl));
+                    return;
+                }
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end(renderAuthPage('success', options.success.title, options.success.message));
+                // Let the response flush before tearing the server down.
+                setImmediate(() => {
+                    closeServer();
+                    resolve(tokens);
+                });
+            }
+            catch (error_) {
+                const failure = error_ instanceof Error ? error_ : new Error(String(error_));
+                if (failure instanceof TenantMismatchError) {
+                    fail(res, 400, 'Tenant Switch Failed', failure);
+                }
+                else {
+                    fail(res, 500, 'Authentication Failed', failure);
+                }
+            }
+        });
+        // Tracked so closeServer can destroy them.
+        server.on('connection', (socket) => {
+            connections.add(socket);
+            socket.on('close', () => connections.delete(socket));
+        });
+        server.on('error', (err) => {
+            closeServer();
+            reject(new Error(`Failed to start local server: ${err.message}`));
+        });
+        process.once('SIGINT', onSigint);
+        server.listen(CALLBACK_PORT, () => {
+            const first = prepared[0].authorizeUrl;
+            log('Opening browser for authentication...');
+            log(`If the browser doesn't open, visit: ${first}`);
+            openBrowser(first).catch((error) => {
+                // The URL was printed above, so a browser that fails to launch is not fatal.
+                log(`Could not open the browser automatically: ${error instanceof Error ? error.message : String(error)}`);
+            });
+        });
+        timeout.id = setTimeout(() => {
+            closeServer();
+            reject(new Error('Authentication timed out'));
+        }, FLOW_TIMEOUT_MS);
+    });
+}

package/dist/lib/auth/guards.d.ts

@@ -0,0 +1,5 @@
+import { type Context } from '../config.js';
+/** Guard for OAuth-only flows (browser login, token refresh, tenant switching); API keys are issued per tenant. */
+export declare function requireOAuthContext(context: Context, action: string): void;
+/** `client_id` is optional on Context (API-key contexts have none), so OAuth flows must assert it. */
+export declare function requireClientId(context: Context): string;

package/dist/lib/auth/guards.js

@@ -0,0 +1,14 @@
+import { getAuthType } from '../config.js';
+/** Guard for OAuth-only flows (browser login, token refresh, tenant switching); API keys are issued per tenant. */
+export function requireOAuthContext(context, action) {
+    if (getAuthType(context) === 'api_key') {
+        throw new Error(`${action} requires OAuth. Context "${context.name}" authenticates with an API key, which is already scoped to one tenant.`);
+    }
+}
+/** `client_id` is optional on Context (API-key contexts have none), so OAuth flows must assert it. */
+export function requireClientId(context) {
+    if (!context.client_id) {
+        throw new Error(`Context "${context.name}" has no OAuth client ID. Recreate it with: aderis config add`);
+    }
+    return context.client_id;
+}

package/dist/lib/auth/http.d.ts

@@ -0,0 +1,16 @@
+import { AuthError } from './errors.js';
+/**
+ * Upper bound for every auth-layer HTTP request (OIDC discovery, token
+ * endpoint); the browser-flow timer only starts after discovery.
+ */
+export declare const HTTP_TIMEOUT_MS = 10000;
+/** The one axios instance the auth layer uses, so the timeout applies everywhere. */
+export declare const authHttp: import("axios").AxiosInstance;
+/** HTTP status behind an error, whether axios raised it or an {@link AuthError} wrapped it. */
+export declare function httpStatusOf(error: unknown): number | undefined;
+/**
+ * Turns any failure of an auth-layer request into an {@link AuthError} naming
+ * `what` was attempted and what came back (status and OAuth error code, timeout
+ * or transport message), never the request itself. An {@link AuthError} passes through.
+ */
+export declare function toAuthError(error: unknown, what: string): AuthError;

package/dist/lib/auth/http.js

@@ -0,0 +1,49 @@
+import axios from 'axios';
+import { AuthError } from './errors.js';
+/**
+ * Upper bound for every auth-layer HTTP request (OIDC discovery, token
+ * endpoint); the browser-flow timer only starts after discovery.
+ */
+export const HTTP_TIMEOUT_MS = 10_000;
+/** The one axios instance the auth layer uses, so the timeout applies everywhere. */
+export const authHttp = axios.create({ timeout: HTTP_TIMEOUT_MS });
+/** HTTP status behind an error, whether axios raised it or an {@link AuthError} wrapped it. */
+export function httpStatusOf(error) {
+    if (error instanceof AuthError)
+        return error.status;
+    if (axios.isAxiosError(error))
+        return error.response?.status;
+    return undefined;
+}
+function isTimeout(error) {
+    return error.code === 'ECONNABORTED' || error.code === 'ETIMEDOUT';
+}
+/** `error` / `error_description` from an OAuth error body (RFC 6749 §5.2), when the server sent them. */
+function describeErrorBody(data) {
+    if (!data || typeof data !== 'object')
+        return '';
+    const { error, error_description: description } = data;
+    if (typeof error !== 'string' || !error)
+        return '';
+    return typeof description === 'string' && description ? `: ${error} (${description})` : `: ${error}`;
+}
+/**
+ * Turns any failure of an auth-layer request into an {@link AuthError} naming
+ * `what` was attempted and what came back (status and OAuth error code, timeout
+ * or transport message), never the request itself. An {@link AuthError} passes through.
+ */
+export function toAuthError(error, what) {
+    if (error instanceof AuthError)
+        return error;
+    if (axios.isAxiosError(error)) {
+        if (error.response) {
+            const { status } = error.response;
+            return new AuthError(`${what} failed with HTTP ${status}${describeErrorBody(error.response.data)}`, { status });
+        }
+        if (isTimeout(error)) {
+            return new AuthError(`${what} timed out after ${error.config?.timeout ?? HTTP_TIMEOUT_MS} ms`);
+        }
+        return new AuthError(`${what} failed: ${error.message}`);
+    }
+    return new AuthError(`${what} failed: ${error instanceof Error ? error.message : String(error)}`);
+}