@aderis-erp/cli 1.1.0 → 1.1.1

package/dist/commands/access-groups.js

@@ -9,9 +9,9 @@ const NESTED_IMPORTS = [];
 const SUBCOMMANDS = [...["list", "create", "get", "update", "delete"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
 const ENDPOINTS = {
     'list': { method: 'GET', path: '/v1/access-groups', summary: 'List access groups (paginated)', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'create': { method: 'POST', path: '/v1/access-groups', summary: 'Create a new access group', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['types', 'employeeIds'] },
+    'create': { method: 'POST', path: '/v1/access-groups', summary: 'Create a new access group', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['types', 'userIds'] },
     'get': { method: 'GET', path: '/v1/access-groups/{id}', summary: 'Get a single access group by ID', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'update': { method: 'PATCH', path: '/v1/access-groups/{id}', summary: 'Update an existing access group', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['types', 'employeeIds'] },
+    'update': { method: 'PATCH', path: '/v1/access-groups/{id}', summary: 'Update an existing access group', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['types', 'userIds'] },
     'delete': { method: 'DELETE', path: '/v1/access-groups/{id}', summary: 'Delete an access group', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
 };
 export default class AccessGroups extends Command {

package/dist/commands/business-partners.js

@@ -9,10 +9,10 @@ const NESTED_IMPORTS = ["notes", "files", "contacts", "contacts-notes"];
 const SUBCOMMANDS = [...["list", "create", "match-candidates", "get", "update", "delete", "merge", "activate", "get-favicon", "update-favicon", "trigger-favicon-backfill", "list-notes", "create-notes", "get-notes", "update-notes", "delete-notes", "list-files", "create-files", "get-files", "update-files", "delete-files", "files-download", "list-contacts", "create-contacts", "get-contacts", "update-contacts", "delete-contacts", "list-contacts-notes", "create-contacts-notes", "get-contacts-notes", "update-contacts-notes", "delete-contacts-notes"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
 const ENDPOINTS = {
     'list': { method: 'GET', path: '/v1/business-partners', summary: 'Get all business partners with pagination', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'create': { method: 'POST', path: '/v1/business-partners', summary: 'Create a new business partner', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['salesOrderRecipientCc', 'salesOrderRecipientBcc', 'salesInvoiceRecipientCc', 'salesInvoiceRecipientBcc', 'deliveryNoteRecipientCc', 'deliveryNoteRecipientBcc', 'contacts', 'tagIds', 'tagCodes', 'salesEarlyPaymentDiscounts', 'purchaseEarlyPaymentDiscounts', 'notes'] },
+    'create': { method: 'POST', path: '/v1/business-partners', summary: 'Create a new business partner', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['salesOrderRecipientCc', 'salesOrderRecipientBcc', 'salesInvoiceRecipientCc', 'salesInvoiceRecipientBcc', 'deliveryNoteRecipientCc', 'deliveryNoteRecipientBcc', 'dunningRecipientCc', 'dunningRecipientBcc', 'contacts', 'tagIds', 'tagCodes', 'salesEarlyPaymentDiscounts', 'purchaseEarlyPaymentDiscounts', 'notes'] },
     'match-candidates': { method: 'GET', path: '/v1/business-partners/match-candidates', summary: 'Rank the business partners whose names resemble a bank counterparty text', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'get': { method: 'GET', path: '/v1/business-partners/{id}', summary: 'Get a business partner by ID', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'update': { method: 'PATCH', path: '/v1/business-partners/{id}', summary: 'Update a business partner', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['salesOrderRecipientCc', 'salesOrderRecipientBcc', 'salesInvoiceRecipientCc', 'salesInvoiceRecipientBcc', 'deliveryNoteRecipientCc', 'deliveryNoteRecipientBcc', 'contacts', 'tagIds', 'tagCodes', 'salesEarlyPaymentDiscounts', 'purchaseEarlyPaymentDiscounts', 'notes'] },
+    'update': { method: 'PATCH', path: '/v1/business-partners/{id}', summary: 'Update a business partner', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['salesOrderRecipientCc', 'salesOrderRecipientBcc', 'salesInvoiceRecipientCc', 'salesInvoiceRecipientBcc', 'deliveryNoteRecipientCc', 'deliveryNoteRecipientBcc', 'dunningRecipientCc', 'dunningRecipientBcc', 'contacts', 'tagIds', 'tagCodes', 'salesEarlyPaymentDiscounts', 'purchaseEarlyPaymentDiscounts', 'notes'] },
     'delete': { method: 'DELETE', path: '/v1/business-partners/{id}', summary: 'Delete a business partner', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'merge': { method: 'POST', path: '/v1/business-partners/{id}/merge', summary: 'Merge a business partner into another', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'activate': { method: 'POST', path: '/v1/business-partners/{id}/activate', summary: 'Activate a business partner', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },

package/dist/commands/files.js

@@ -14,7 +14,7 @@ const ENDPOINTS = {
     'download': { method: 'GET', path: '/v1/files/{id}/download', summary: 'Get a signed download URL for a file', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'get': { method: 'GET', path: '/v1/files/{id}', summary: 'Get a file by id (permission-scoped)', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'references': { method: 'POST', path: '/v1/files/references', summary: 'Register a file reference to an existing storage object', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'update': { method: 'PATCH', path: '/v1/files/{fileId}', summary: 'Update file metadata (type, parent, sortOrder)', pathParams: ['fileId'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['tags', 'references'] },
+    'update': { method: 'PATCH', path: '/v1/files/{fileId}', summary: 'Update file metadata (type, parent, sortOrder)', pathParams: ['fileId'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['tagIds', 'tagCodes', 'references'] },
     'discard': { method: 'POST', path: '/v1/files/{fileId}/discard', summary: 'Discard a file (sets status DISCARDED; stays readable by id)', pathParams: ['fileId'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'move': { method: 'POST', path: '/v1/files/{fileId}/move', summary: 'Move file between storage zones', pathParams: ['fileId'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'retention': { method: 'POST', path: '/v1/files/{fileId}/retention', summary: 'Set or override retention period on a file', pathParams: ['fileId'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },

package/dist/commands/ledgers.js

@@ -6,12 +6,12 @@ const HAS_IMPORT = true;
 const HAS_EXPORT = true;
 const HAS_CAMT053 = false;
 const NESTED_IMPORTS = ["month-end-closings", "month-end-closings-accruals", "month-end-closings-notes", "notes", "closings"];
-const SUBCOMMANDS = [...["list", "create", "get", "update", "delete", "list-month-end-closings", "create-month-end-closings", "get-month-end-closings", "update-month-end-closings", "delete-month-end-closings", "month-end-closings-complete", "create-month-end-closings-provisional-booking", "delete-month-end-closings-provisional-booking", "month-end-closings-reopen", "list-month-end-closings-accruals", "create-month-end-closings-accruals", "update-month-end-closings-accruals", "delete-month-end-closings-accruals", "month-end-closings-accruals-accept", "month-end-closings-accruals-dismiss", "list-month-end-closings-accrual-accounts", "list-month-end-closings-findings", "update-month-end-closings-findings", "list-month-end-closings-notes", "create-month-end-closings-notes", "get-month-end-closings-notes", "update-month-end-closings-notes", "delete-month-end-closings-notes", "update-month-end-closings-agent-results", "month-end-closings-agent-run", "get-fx-rate", "replace-fx-rate-providers", "list-notes", "create-notes", "get-notes", "update-notes", "delete-notes", "list-closings", "create-closings", "get-closings", "update-closings", "closings-close", "closings-reopen", "list-posting-runs", "create-posting-runs", "posting-runs"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
+const SUBCOMMANDS = [...["list", "create", "get", "update", "delete", "list-month-end-closings", "create-month-end-closings", "get-month-end-closings", "update-month-end-closings", "delete-month-end-closings", "month-end-closings-complete", "create-month-end-closings-provisional-booking", "delete-month-end-closings-provisional-booking", "month-end-closings-reopen", "list-month-end-closings-accruals", "create-month-end-closings-accruals", "update-month-end-closings-accruals", "delete-month-end-closings-accruals", "month-end-closings-accruals-accept", "month-end-closings-accruals-dismiss", "list-month-end-closings-accrual-accounts", "list-month-end-closings-findings", "update-month-end-closings-findings", "list-month-end-closings-notes", "create-month-end-closings-notes", "get-month-end-closings-notes", "update-month-end-closings-notes", "delete-month-end-closings-notes", "update-month-end-closings-agent-results", "month-end-closings-agent-run", "get-fx-rate", "replace-fx-rate-providers", "replace-closing-fx-rate-providers", "list-notes", "create-notes", "get-notes", "update-notes", "delete-notes", "list-closings", "create-closings", "get-closings", "update-closings", "closings-close", "closings-reopen", "list-posting-runs", "create-posting-runs", "posting-runs"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
 const ENDPOINTS = {
     'list': { method: 'GET', path: '/v1/ledgers', summary: 'List all ledgers', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'create': { method: 'POST', path: '/v1/ledgers', summary: 'Create a new ledger', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['notes', 'fxRateProviders'] },
+    'create': { method: 'POST', path: '/v1/ledgers', summary: 'Create a new ledger', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['notes', 'fxRateProviders', 'closingFxRateProviders'] },
     'get': { method: 'GET', path: '/v1/ledgers/{id}', summary: 'Get a ledger by ID', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'update': { method: 'PATCH', path: '/v1/ledgers/{id}', summary: 'Update a ledger', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['fxRateProviders'] },
+    'update': { method: 'PATCH', path: '/v1/ledgers/{id}', summary: 'Update a ledger', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['fxRateProviders', 'closingFxRateProviders'] },
     'delete': { method: 'DELETE', path: '/v1/ledgers/{id}', summary: 'Delete a ledger', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'list-month-end-closings': { method: 'GET', path: '/v1/ledgers/{ledgerId}/month-end-closings', summary: 'List the month-end closings of a ledger, newest month first', pathParams: ['ledgerId'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'create-month-end-closings': { method: 'POST', path: '/v1/ledgers/{ledgerId}/month-end-closings', summary: 'Create a DRAFT month-end closing for one calendar month', pathParams: ['ledgerId'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
@@ -38,8 +38,9 @@ const ENDPOINTS = {
     'delete-month-end-closings-notes': { method: 'DELETE', path: '/v1/ledgers/{ledgerId}/month-end-closings/{id}/notes/{noteId}', summary: 'Delete a note of a month-end closing', pathParams: ['ledgerId', 'id', 'noteId'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'update-month-end-closings-agent-results': { method: 'PUT', path: '/v1/ledgers/{ledgerId}/month-end-closings/{id}/agent-results', summary: 'Write back a month-end agent run\'s explanations and accrual proposals', pathParams: ['ledgerId', 'id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['accounts', 'accruals'] },
     'month-end-closings-agent-run': { method: 'POST', path: '/v1/ledgers/{ledgerId}/month-end-closings/{id}/agent-run', summary: 'Compute the month\'s findings and start a month-end agent run', pathParams: ['ledgerId', 'id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'get-fx-rate': { method: 'GET', path: '/v1/ledgers/{id}/fx-rate', summary: 'Resolve the FX rate this ledger would book for a currency on a day', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
+    'get-fx-rate': { method: 'GET', path: '/v1/ledgers/{id}/fx-rate', summary: 'Resolve the FX rate this ledger would book for a currency on a day, or with purpose=CLOSING the rate its month-end close values a balance at', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'replace-fx-rate-providers': { method: 'PUT', path: '/v1/ledgers/{id}/fx-rate-providers', summary: 'Replace the list of FX rate providers this ledger asks, leaving the rest of the ledger untouched', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['fxRateProviders'] },
+    'replace-closing-fx-rate-providers': { method: 'PUT', path: '/v1/ledgers/{id}/closing-fx-rate-providers', summary: 'Replace the list of FX rate providers the month-end close asks, leaving the rest of the ledger untouched', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['closingFxRateProviders'] },
     'list-notes': { method: 'GET', path: '/v1/ledgers/{ledgerId}/notes', summary: 'Get all notes for a ledger', pathParams: ['ledgerId'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'create-notes': { method: 'POST', path: '/v1/ledgers/{ledgerId}/notes', summary: 'Create a note for a ledger', pathParams: ['ledgerId'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
     'get-notes': { method: 'GET', path: '/v1/ledgers/{ledgerId}/notes/{noteId}', summary: 'Get a specific note for a ledger', pathParams: ['ledgerId', 'noteId'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },

package/dist/commands/support/end.d.ts

@@ -0,0 +1,9 @@
+import { Command } from '@oclif/core';
+export default class SupportEnd extends Command {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        context: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/support/end.js

@@ -0,0 +1,29 @@
+import { Command, Flags } from '@oclif/core';
+import { endSupportSession } from '../../lib/auth/index.js';
+import { getCurrentContext } from '../../lib/config.js';
+export default class SupportEnd extends Command {
+    static description = 'Stop acting as Aderis Support and return to your own account';
+    static examples = ['<%= config.bin %> support end', '<%= config.bin %> support end --context prod'];
+    static flags = {
+        context: Flags.string({
+            aliases: ['config'],
+            char: 'c',
+            description: 'Context to use, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(SupportEnd);
+        const contextName = flags.context ?? getCurrentContext()?.name;
+        if (!contextName) {
+            this.error('No context configured. Run: aderis auth login --new');
+        }
+        const ended = await endSupportSession(contextName);
+        if (!ended) {
+            this.log(`Context ${contextName} was not acting as Aderis Support.`);
+            return;
+        }
+        this.log(`Stopped acting as Aderis Support in ${ended.tenant_name}.`);
+        this.log(`Context ${contextName} is your own account again; no new login was needed.`);
+    }
+}

package/dist/commands/support/start.d.ts

@@ -0,0 +1,14 @@
+import { Command } from '@oclif/core';
+export default class SupportStart extends Command {
+    static args: {
+        tenantId: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        context: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+    /** Without a tenant id, offer the customers Keycloak says this operator may act for. */
+    private chooseTenant;
+}

package/dist/commands/support/start.js

@@ -0,0 +1,50 @@
+import { select } from '@inquirer/prompts';
+import { Args, Command, Flags } from '@oclif/core';
+import { listSupportTenants, startSupportSession, tenantLabel } from '../../lib/auth/index.js';
+import { getCurrentContext } from '../../lib/config.js';
+export default class SupportStart extends Command {
+    static args = {
+        tenantId: Args.string({ description: 'Customer to act for; prompted for if omitted', required: false }),
+    };
+    static description = 'Act as Aderis Support in a customer tenant';
+    static examples = [
+        '<%= config.bin %> support start',
+        '<%= config.bin %> support start 11839c8b-7ec3-4cc1-9dae-396ced09b928',
+        '<%= config.bin %> support start <tenant-id> --context prod',
+    ];
+    static flags = {
+        context: Flags.string({
+            aliases: ['config'],
+            char: 'c',
+            description: 'Context to use, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(SupportStart);
+        const contextName = flags.context ?? getCurrentContext()?.name;
+        if (!contextName) {
+            this.error('No context configured. Run: aderis auth login --new');
+        }
+        const tenantId = args.tenantId ?? (await this.chooseTenant(contextName));
+        const support = await startSupportSession(contextName, tenantId);
+        this.log(`Acting as Aderis Support in ${support.tenant_name} (${support.tenant_id})`);
+        this.log(`Context: ${contextName}`);
+        this.warn('Every call from this context now goes out as Aderis Support, and every write is recorded against you. ' +
+            'End with: aderis support end');
+    }
+    /** Without a tenant id, offer the customers Keycloak says this operator may act for. */
+    async chooseTenant(contextName) {
+        const tenants = await listSupportTenants(contextName);
+        if (tenants.length === 0) {
+            this.error('There are no customers you may act for.');
+        }
+        if (!process.stdin.isTTY) {
+            this.error(`Name the customer to act for. List them with: aderis support tenants --context ${contextName}`);
+        }
+        return select({
+            choices: tenants.map((t) => ({ name: tenantLabel(t), value: t.tenantId })),
+            message: 'Act as Aderis Support in which customer?',
+        });
+    }
+}

package/dist/commands/support/status.d.ts

@@ -0,0 +1,10 @@
+import { Command } from '@oclif/core';
+export default class SupportStatus extends Command {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        context: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/support/status.js

@@ -0,0 +1,45 @@
+import { Command, Flags } from '@oclif/core';
+import { getContext, getCurrentContext, getSupportSession } from '../../lib/config.js';
+export default class SupportStatus extends Command {
+    static description = 'Show whether this context is acting as Aderis Support';
+    static examples = ['<%= config.bin %> support status', '<%= config.bin %> support status --context prod'];
+    static flags = {
+        context: Flags.string({
+            aliases: ['config'],
+            char: 'c',
+            description: 'Context to check, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
+        }),
+        json: Flags.boolean({ default: false, description: 'Output as JSON' }),
+    };
+    async run() {
+        const { flags } = await this.parse(SupportStatus);
+        const contextName = flags.context ?? getCurrentContext()?.name;
+        if (!contextName) {
+            this.error('No context configured. Run: aderis auth login --new');
+        }
+        const context = getContext(contextName);
+        if (!context) {
+            this.error(`Context "${contextName}" not found.`);
+        }
+        const support = getSupportSession(context);
+        if (flags.json) {
+            this.log(JSON.stringify({ context: contextName, supportSession: support ? supportJson(support) : null }, null, 2));
+            return;
+        }
+        if (!support) {
+            this.log(`Context ${contextName} is acting as yourself.`);
+            return;
+        }
+        this.log(`Acting as Aderis Support in ${support.tenant_name} (${support.tenant_id})`);
+        this.log(`Context: ${contextName}`);
+        if (support.tokens.expires_at) {
+            const expires = new Date(support.tokens.expires_at);
+            this.log(`Token expires: ${expires.toLocaleString()}${expires < new Date() ? ' (refreshes on next call)' : ''}`);
+        }
+        this.log('\nEverything you do is recorded against you. End with: aderis support end');
+    }
+}
+function supportJson(support) {
+    return { expiresAt: support.tokens.expires_at ?? null, tenantId: support.tenant_id, tenantName: support.tenant_name };
+}

package/dist/commands/support/tenants.d.ts

@@ -0,0 +1,10 @@
+import { Command } from '@oclif/core';
+export default class SupportTenants extends Command {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        context: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/support/tenants.js

@@ -0,0 +1,39 @@
+import { Command, Flags } from '@oclif/core';
+import { listSupportTenants, tenantLabel } from '../../lib/auth/index.js';
+import { getCurrentContext } from '../../lib/config.js';
+export default class SupportTenants extends Command {
+    static description = 'List the customers you may act for as Aderis Support';
+    static examples = [
+        '<%= config.bin %> support tenants',
+        '<%= config.bin %> support tenants --context prod --json',
+    ];
+    static flags = {
+        context: Flags.string({
+            aliases: ['config'],
+            char: 'c',
+            description: 'Context to use, overriding the current context (alias: --config)',
+            env: 'ADERIS_CONTEXT',
+        }),
+        json: Flags.boolean({ default: false, description: 'Output as JSON' }),
+    };
+    async run() {
+        const { flags } = await this.parse(SupportTenants);
+        const contextName = flags.context ?? getCurrentContext()?.name;
+        if (!contextName) {
+            this.error('No context configured. Run: aderis auth login --new');
+        }
+        const tenants = await listSupportTenants(contextName);
+        if (flags.json) {
+            this.log(JSON.stringify(tenants, null, 2));
+            return;
+        }
+        if (tenants.length === 0) {
+            this.log('No customers available to act for.');
+            return;
+        }
+        this.log('Customers you may act for:\n');
+        for (const tenant of tenants)
+            this.log(`  ${tenantLabel(tenant)}`);
+        this.log(`\nStart with: aderis support start <tenant-id> --context ${contextName}`);
+    }
+}

package/dist/commands/tags.js

@@ -6,13 +6,14 @@ const HAS_IMPORT = true;
 const HAS_EXPORT = true;
 const HAS_CAMT053 = false;
 const NESTED_IMPORTS = [];
-const SUBCOMMANDS = [...["list", "create", "get", "update", "delete"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
+const SUBCOMMANDS = [...["list", "create", "get", "update", "delete", "journal-coverage"], ...(HAS_IMPORT ? ['import'] : []), ...(HAS_EXPORT ? ['export'] : []), ...NESTED_IMPORTS.map(n => `import-${n}`)];
 const ENDPOINTS = {
     'list': { method: 'GET', path: '/v1/tags', summary: 'Get all tags with pagination', pathParams: [], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'create': { method: 'POST', path: '/v1/tags', summary: 'Create a new tag', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
+    'create': { method: 'POST', path: '/v1/tags', summary: 'Create a new tag', pathParams: [], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['rules'] },
     'get': { method: 'GET', path: '/v1/tags/{id}', summary: 'Get a tag by ID', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
-    'update': { method: 'PATCH', path: '/v1/tags/{id}', summary: 'Update a tag', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
+    'update': { method: 'PATCH', path: '/v1/tags/{id}', summary: 'Update a tag', pathParams: ['id'], hasBody: true, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: ['rules'] },
     'delete': { method: 'DELETE', path: '/v1/tags/{id}', summary: 'Delete a tag', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
+    'journal-coverage': { method: 'GET', path: '/v1/tags/{id}/journal-coverage', summary: 'How much of the journal-line amount in scope carries one of the tags below this tag', pathParams: ['id'], hasBody: false, isMultipart: false, isBinaryResponse: false, hasBinaryVariant: false, bodyArrayFields: [] },
 };
 export default class Tags extends Command {
     static description = 'Manage tags';

package/dist/lib/auth/constants.d.ts

@@ -9,3 +9,15 @@ export declare const FORM_POST_HEADERS: {
     readonly Accept: "application/json";
     readonly 'Content-Type': "application/x-www-form-urlencoded";
 };
+/**
+ * Acting as Aderis Support. The realm mints a second login for the shared
+ * support account through a custom grant, taking the operator's own access
+ * token as the Bearer. The support token names the customer in `tenantId` and
+ * the operator in `impersonatorId`; the backend records that pair on every
+ * write (backend/docs/concepts/2026-09-23-support-impersonator-audit-attribution.md).
+ */
+export declare const SUPPORT_SESSION_GRANT_TYPE = "urn:aderis:params:oauth:grant-type:support-session";
+/** Public client of the support session; like the CLI client it holds no secret. */
+export declare const SUPPORT_CLIENT_ID = "aderis-support-session";
+/** Keycloak ends a support session after this long however active it is. */
+export declare const SUPPORT_SESSION_MAX_LIFESPAN_S: number;

package/dist/lib/auth/constants.js

@@ -9,3 +9,15 @@ export const FORM_POST_HEADERS = {
     Accept: 'application/json',
     'Content-Type': 'application/x-www-form-urlencoded',
 };
+/**
+ * Acting as Aderis Support. The realm mints a second login for the shared
+ * support account through a custom grant, taking the operator's own access
+ * token as the Bearer. The support token names the customer in `tenantId` and
+ * the operator in `impersonatorId`; the backend records that pair on every
+ * write (backend/docs/concepts/2026-09-23-support-impersonator-audit-attribution.md).
+ */
+export const SUPPORT_SESSION_GRANT_TYPE = 'urn:aderis:params:oauth:grant-type:support-session';
+/** Public client of the support session; like the CLI client it holds no secret. */
+export const SUPPORT_CLIENT_ID = 'aderis-support-session';
+/** Keycloak ends a support session after this long however active it is. */
+export const SUPPORT_SESSION_MAX_LIFESPAN_S = 4 * 60 * 60;

package/dist/lib/auth/index.d.ts

@@ -1,6 +1,7 @@
-import { type Context, type TokenData } from '../config.js';
+import { type Context, type SupportSession, type TokenData } from '../config.js';
 import { type FlowHooks } from './flow.js';
 import { type Tenant } from './types.js';
+export { type SupportSession } from '../config.js';
 export { CALLBACK_PORT, REDIRECT_URI } from './constants.js';
 export { AuthError, TenantMismatchError } from './errors.js';
 export { type FlowHooks } from './flow.js';
@@ -17,6 +18,15 @@ export declare function getValidToken(contextName: string): Promise<string>;
  * needed) or `x-api-key` for `api_key`. The one place credentials become headers.
  */
 export declare function getAuthHeaders(contextName: string): Promise<Record<string, string>>;
+/** Customers the operator may act for, as Keycloak lists them. */
+export declare function listSupportTenants(contextName: string): Promise<Tenant[]>;
+/**
+ * Starts a support session on the context and stores it beside the operator's
+ * own login. Subsequent API calls go out as Aderis Support until it is ended.
+ */
+export declare function startSupportSession(contextName: string, tenantId: string): Promise<SupportSession>;
+/** Ends the running support session; the operator's own login is untouched. */
+export declare function endSupportSession(contextName: string): Promise<null | SupportSession>;
 /** The user `/v1/auth/me` resolved for the session; the fields the CLI shows. */
 export interface AuthenticatedUser {
     email?: string;

package/dist/lib/auth/index.js

@@ -3,7 +3,7 @@
  * Keycloak; the protocol details live in `keycloak-provider.ts`.
  */
 import axios from 'axios';
-import { getAuthType, getBaseUrls, getContext, missingCredentialsMessage, saveCachedTenants, saveTokens, SESSION_EXPIRED_MESSAGE, unauthorizedMessage, } from '../config.js';
+import { clearSupportSession, getAuthType, getBaseUrls, getContext, getSupportSession, missingCredentialsMessage, saveCachedTenants, saveSupportSession, saveTokens, SESSION_EXPIRED_MESSAGE, unauthorizedMessage, } from '../config.js';
 import { AuthError, TenantMismatchError } from './errors.js';
 import { runBrowserFlow } from './flow.js';
 import { requireOAuthContext } from './guards.js';
@@ -15,6 +15,8 @@ export { CALLBACK_PORT, REDIRECT_URI } from './constants.js';
 export { AuthError, TenantMismatchError } from './errors.js';
 export { keycloakBaseUrlOf, keycloakProvider, parseKeycloakBaseUrl } from './keycloak-provider.js';
 export { buildValidatedUrl } from './validated-url.js';
+/** A token this close to expiry is refreshed rather than sent. */
+const EXPIRY_BUFFER_MS = 60_000;
 function requireContext(contextName) {
     const context = getContext(contextName);
     if (!context) {
@@ -82,7 +84,7 @@ export async function getValidToken(contextName) {
     if (!context.tokens?.access_token) {
         throw new Error('Not logged in. Please run: aderis auth login');
     }
-    if (context.tokens.expires_at && context.tokens.expires_at < Date.now() + 60_000) {
+    if (context.tokens.expires_at && context.tokens.expires_at < Date.now() + EXPIRY_BUFFER_MS) {
         if (context.tokens.refresh_token) {
             const newTokens = await refreshTokens(contextName);
             return newTokens.access_token;
@@ -103,8 +105,94 @@ export async function getAuthHeaders(contextName) {
         }
         return { 'x-api-key': context.api_key };
     }
+    // While acting as Aderis Support every call goes out as the support account,
+    // and the operator is told so — a write made here is attributed to them.
+    const support = getSupportSession(context);
+    if (support) {
+        const token = await validSupportToken(contextName, support);
+        warnActingAsSupport(context.name, support);
+        return { Authorization: `Bearer ${token}` };
+    }
     return { Authorization: `Bearer ${await getValidToken(contextName)}` };
 }
+/** Printed once per process, to stderr so it never lands in piped output. */
+let warnedAboutSupport = false;
+function warnActingAsSupport(contextName, support) {
+    if (warnedAboutSupport)
+        return;
+    warnedAboutSupport = true;
+    process.stderr.write(`! Acting as Aderis Support in ${support.tenant_name} (context ${contextName}). ` +
+        `Everything you do is recorded against you. End with: aderis support end\n`);
+}
+/** The support access token, refreshed when it is within the expiry buffer. */
+async function validSupportToken(contextName, support) {
+    if (support.tokens.expires_at && support.tokens.expires_at < Date.now() + EXPIRY_BUFFER_MS) {
+        if (!support.tokens.refresh_token) {
+            throw new AuthError('The support session has ended. Start a new one with: aderis support start <tenant-id>');
+        }
+        const context = requireContext(contextName);
+        const refreshed = await keycloakProvider.refreshSupportSession(context, support.tokens.refresh_token);
+        const tokens = { ...refreshed, refresh_token: refreshed.refresh_token || support.tokens.refresh_token };
+        saveSupportSession(contextName, { ...support, tokens });
+        return tokens.access_token;
+    }
+    return support.tokens.access_token;
+}
+/** Customers the operator may act for, as Keycloak lists them. */
+export async function listSupportTenants(contextName) {
+    const context = requireContext(contextName);
+    requireOAuthContext(context, 'Support sessions');
+    if (getSupportSession(context)) {
+        throw new AuthError('A support session is already running. End it first with: aderis support end');
+    }
+    return keycloakProvider.listSupportTenants(context, await getValidToken(contextName));
+}
+/**
+ * Starts a support session on the context and stores it beside the operator's
+ * own login. Subsequent API calls go out as Aderis Support until it is ended.
+ */
+export async function startSupportSession(contextName, tenantId) {
+    const context = requireContext(contextName);
+    requireOAuthContext(context, 'Support sessions');
+    if (getSupportSession(context)) {
+        throw new AuthError('A support session is already running. End it first with: aderis support end');
+    }
+    const operatorToken = await getValidToken(contextName);
+    const operatorSub = decodedSub(operatorToken);
+    const tenants = await keycloakProvider.listSupportTenants(context, operatorToken);
+    const chosen = tenants.find((t) => t.tenantId === tenantId);
+    if (!chosen) {
+        throw new AuthError(`Tenant ${tenantId} is not one you may act for. List them with: aderis support tenants --context ${contextName}`);
+    }
+    const tokens = await keycloakProvider.startSupportSession(context, operatorToken, tenantId);
+    const support = {
+        operator_sub: operatorSub,
+        tenant_id: tenantId,
+        tenant_name: chosen.name,
+        tokens,
+    };
+    saveSupportSession(contextName, support);
+    return support;
+}
+/** Ends the running support session; the operator's own login is untouched. */
+export async function endSupportSession(contextName) {
+    const context = requireContext(contextName);
+    const support = getSupportSession(context);
+    if (!support)
+        return null;
+    if (support.tokens.refresh_token) {
+        // Keycloak may have ended it already; the local session goes either way.
+        await keycloakProvider.endSupportSession(context, support.tokens.refresh_token).catch(() => { });
+    }
+    clearSupportSession(contextName);
+    return support;
+}
+/** The operator's own `sub`, read from a token the realm signed. */
+function decodedSub(accessToken) {
+    const [, payload] = accessToken.split('.');
+    const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    return claims.sub ?? '';
+}
 export async function testAuth(contextName) {
     const context = requireContext(contextName);
     const { api: apiUrl } = getBaseUrls(context.environment);

package/dist/lib/auth/keycloak-provider.d.ts

@@ -16,6 +16,8 @@ export declare const KEYCLOAK_SCOPE = "openid profile email offline_access";
 /** The subset of the OIDC discovery document (RFC 8414 / OIDC Discovery 1.0) the CLI uses. */
 export interface OidcDiscovery {
     authorization_endpoint: string;
+    /** Ends one session without touching the operator's own login. */
+    end_session_endpoint: string;
     issuer: string;
     /** Where the realm publishes the signing keys every issued token is checked against. */
     jwks_uri: string;
@@ -45,7 +47,18 @@ export declare class KeycloakProvider implements AuthProvider {
      * validated against the host allowlist; a failed fetch is not cached.
      */
     discover(target: KeycloakTarget): Promise<OidcDiscovery>;
+    /**
+     * Ends exactly the support session. The operator's own login is a different
+     * Keycloak session and is left running.
+     */
+    endSupportSession(context: Context, refreshToken: string): Promise<void>;
     exchangeCode(context: Context, { code, codeVerifier, nonce }: ExchangeParams): Promise<TokenData>;
+    /**
+     * Customers this operator may act for. Served by the realm's tenant-claims
+     * mapper against the operator's own Bearer, so Keycloak — not the CLI —
+     * decides who is an operator and which customers they may pick.
+     */
+    listSupportTenants(context: Context, operatorAccessToken: string): Promise<Tenant[]>;
     /** The access token's `availableTenants` claim lists every tenant the user may act in, read once its signature checks out. */
     listTenants(context: Context, accessToken: string): Promise<Tenant[]>;
     /**
@@ -56,6 +69,15 @@ export declare class KeycloakProvider implements AuthProvider {
      */
     readClaims(context: Context, accessToken: string): Promise<DecodedToken>;
     refresh(context: Context, refreshToken: string): Promise<TokenData>;
+    /** Refreshes a support session. No tenant is named: the session never moves customer. */
+    refreshSupportSession(context: Context, refreshToken: string): Promise<TokenData>;
+    /**
+     * Starts a support session for `tenantId`, authorised by the operator's own
+     * access token. The returned tokens belong to the shared support account and
+     * name the operator in `impersonatorId`; they are a second login, so the
+     * operator's own tokens stay valid and untouched.
+     */
+    startSupportSession(context: Context, operatorAccessToken: string, tenantId: string): Promise<TokenData>;
     /**
      * One refresh-token grant with the `tenant_id` form field, read by the
      * realm's tenant-claims mapper: the minted token's `tenantId` becomes this