@aderis-erp/cli 1.1.0 → 1.1.2

package/dist/commands/workflows.js

@@ -39,6 +39,7 @@ export default class Workflows extends Command {
         query: Flags.string({ description: 'Additional query params as JSON' }),
         fields: Flags.string({ description: 'Comma-separated list of fields to return, applied by the API (e.g. --fields=id,name,status)' }),
         sanitize: Flags.boolean({ description: 'Remove null values, audit fields, and duplicate UUIDs from output' }),
+        meta: Flags.boolean({ description: 'Keep the API envelope in JSON output: data plus page, totals and sums' }),
         'show-http-request': Flags.boolean({ description: 'Show HTTP request details (method, URL, body)' }),
     };
     async run() {
@@ -331,9 +332,15 @@ export default class Workflows extends Command {
                 }
                 catch { /* keep as string */ }
             }
-            // Extract data array from paginated wrapper (e.g., { data: [...], total: 3 })
+            // A paginated answer is { data, meta, links, totals }. The records are
+            // unwrapped for output, but what the API said about the page is kept:
+            // dropping it silently let a script read one page as the whole result
+            // (AderisERP/product#61).
+            let envelope;
             if (output && typeof output === 'object' && !Array.isArray(output) && 'data' in output && Array.isArray(output.data)) {
-                output = output.data;
+                const page = output;
+                envelope = page;
+                output = page.data;
             }
             // For table/csv on non-array responses, auto-extract the primary array
             // e.g., { payments: [...], total: 3 } → extract payments array
@@ -350,12 +357,24 @@ export default class Workflows extends Command {
                 output = this.sanitizeOutput(output);
             }
             const fieldList = flags.fields?.split(',').map(f => f.trim());
-            if (flags.csv || flags.output === 'csv')
+            if (envelope)
+                this.warnShortPage(envelope, flags.limit);
+            if (flags.csv || flags.output === 'csv') {
                 this.printCsv(output, fieldList);
-            else if (flags.table || flags.output === 'table')
+            }
+            else if (flags.table || flags.output === 'table') {
                 this.printTable(output, fieldList);
-            else
+                if (envelope)
+                    this.printPageSummary(envelope);
+            }
+            else if (envelope && flags.meta) {
+                // The whole envelope, for a caller that asked for it; the default stays
+                // a bare array so existing scripts are unaffected.
+                this.log(JSON.stringify({ ...envelope, data: output }, null, 2));
+            }
+            else {
                 this.log(JSON.stringify(output, null, 2));
+            }
         }
         catch (error) {
             if (error instanceof ApiError) {
@@ -984,6 +1003,34 @@ export default class Workflows extends Command {
             return `\$${op}`;
         return opRe.test(rest) ? `\$${op}:${this.parseFilterValue(rest)}` : `\$${op}:${rest}`;
     }
+    /** The page line under a table: which page, how many, and any sums the API returned. */
+    printPageSummary(envelope) {
+        const meta = envelope.meta;
+        if (meta && typeof meta.currentPage === 'number' && typeof meta.totalPages === 'number') {
+            const shown = Array.isArray(envelope.data) ? envelope.data.length : 0;
+            this.log(`
+Page ${meta.currentPage}/${meta.totalPages} — ${shown} of ${meta.totalItems ?? '?'} records`);
+        }
+        for (const total of envelope.totals ?? []) {
+            const { currency, ...sums } = total;
+            const parts = Object.entries(sums).map(([column, value]) => `${column} ${value}`).join(', ');
+            this.log(`Total ${currency ?? ''}: ${parts}`.trim());
+        }
+    }
+    /**
+     * The API caps how many records a page may hold. Asking for more and getting
+     * fewer looks like "that is everything" unless it is said out loud.
+     */
+    warnShortPage(envelope, requestedLimit) {
+        const asked = requestedLimit === undefined ? undefined : Number(requestedLimit);
+        const perPage = envelope.meta?.itemsPerPage;
+        if (asked === undefined || Number.isNaN(asked) || typeof perPage !== 'number' || perPage >= asked)
+            return;
+        const pages = envelope.meta?.totalPages;
+        const more = typeof pages === 'number' && pages > 1 ? ` Use --page, or the export action for every page.` : '';
+        process.stderr.write(`! Asked for ${asked} records per page; the API returned at most ${perPage}.${more}
+`);
+    }
     sanitizeOutput(data) {
         const auditFields = ['_type', 'tenantId', 'createdAt', 'updatedAt', 'createdBy', 'updatedBy'];
         const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/lib/auth/constants.d.ts

@@ -9,3 +9,15 @@ export declare const FORM_POST_HEADERS: {
     readonly Accept: "application/json";
     readonly 'Content-Type': "application/x-www-form-urlencoded";
 };
+/**
+ * Acting as Aderis Support. The realm mints a second login for the shared
+ * support account through a custom grant, taking the operator's own access
+ * token as the Bearer. The support token names the customer in `tenantId` and
+ * the operator in `impersonatorId`; the backend records that pair on every
+ * write (backend/docs/concepts/2026-09-23-support-impersonator-audit-attribution.md).
+ */
+export declare const SUPPORT_SESSION_GRANT_TYPE = "urn:aderis:params:oauth:grant-type:support-session";
+/** Public client of the support session; like the CLI client it holds no secret. */
+export declare const SUPPORT_CLIENT_ID = "aderis-support-session";
+/** Keycloak ends a support session after this long however active it is. */
+export declare const SUPPORT_SESSION_MAX_LIFESPAN_S: number;

package/dist/lib/auth/constants.js

@@ -9,3 +9,15 @@ export const FORM_POST_HEADERS = {
     Accept: 'application/json',
     'Content-Type': 'application/x-www-form-urlencoded',
 };
+/**
+ * Acting as Aderis Support. The realm mints a second login for the shared
+ * support account through a custom grant, taking the operator's own access
+ * token as the Bearer. The support token names the customer in `tenantId` and
+ * the operator in `impersonatorId`; the backend records that pair on every
+ * write (backend/docs/concepts/2026-09-23-support-impersonator-audit-attribution.md).
+ */
+export const SUPPORT_SESSION_GRANT_TYPE = 'urn:aderis:params:oauth:grant-type:support-session';
+/** Public client of the support session; like the CLI client it holds no secret. */
+export const SUPPORT_CLIENT_ID = 'aderis-support-session';
+/** Keycloak ends a support session after this long however active it is. */
+export const SUPPORT_SESSION_MAX_LIFESPAN_S = 4 * 60 * 60;

package/dist/lib/auth/index.d.ts

@@ -1,6 +1,7 @@
-import { type Context, type TokenData } from '../config.js';
+import { type Context, type SupportSession, type TokenData } from '../config.js';
 import { type FlowHooks } from './flow.js';
 import { type Tenant } from './types.js';
+export { type SupportSession } from '../config.js';
 export { CALLBACK_PORT, REDIRECT_URI } from './constants.js';
 export { AuthError, TenantMismatchError } from './errors.js';
 export { type FlowHooks } from './flow.js';
@@ -17,6 +18,15 @@ export declare function getValidToken(contextName: string): Promise<string>;
  * needed) or `x-api-key` for `api_key`. The one place credentials become headers.
  */
 export declare function getAuthHeaders(contextName: string): Promise<Record<string, string>>;
+/** Customers the operator may act for, as Keycloak lists them. */
+export declare function listSupportTenants(contextName: string): Promise<Tenant[]>;
+/**
+ * Starts a support session on the context and stores it beside the operator's
+ * own login. Subsequent API calls go out as Aderis Support until it is ended.
+ */
+export declare function startSupportSession(contextName: string, tenantId: string): Promise<SupportSession>;
+/** Ends the running support session; the operator's own login is untouched. */
+export declare function endSupportSession(contextName: string): Promise<null | SupportSession>;
 /** The user `/v1/auth/me` resolved for the session; the fields the CLI shows. */
 export interface AuthenticatedUser {
     email?: string;

package/dist/lib/auth/index.js

@@ -3,7 +3,7 @@
  * Keycloak; the protocol details live in `keycloak-provider.ts`.
  */
 import axios from 'axios';
-import { getAuthType, getBaseUrls, getContext, missingCredentialsMessage, saveCachedTenants, saveTokens, SESSION_EXPIRED_MESSAGE, unauthorizedMessage, } from '../config.js';
+import { clearSupportSession, getAuthType, getBaseUrls, getContext, getSupportSession, missingCredentialsMessage, saveCachedTenants, saveSupportSession, saveTokens, SESSION_EXPIRED_MESSAGE, unauthorizedMessage, } from '../config.js';
 import { AuthError, TenantMismatchError } from './errors.js';
 import { runBrowserFlow } from './flow.js';
 import { requireOAuthContext } from './guards.js';
@@ -15,6 +15,8 @@ export { CALLBACK_PORT, REDIRECT_URI } from './constants.js';
 export { AuthError, TenantMismatchError } from './errors.js';
 export { keycloakBaseUrlOf, keycloakProvider, parseKeycloakBaseUrl } from './keycloak-provider.js';
 export { buildValidatedUrl } from './validated-url.js';
+/** A token this close to expiry is refreshed rather than sent. */
+const EXPIRY_BUFFER_MS = 60_000;
 function requireContext(contextName) {
     const context = getContext(contextName);
     if (!context) {
@@ -82,7 +84,7 @@ export async function getValidToken(contextName) {
     if (!context.tokens?.access_token) {
         throw new Error('Not logged in. Please run: aderis auth login');
     }
-    if (context.tokens.expires_at && context.tokens.expires_at < Date.now() + 60_000) {
+    if (context.tokens.expires_at && context.tokens.expires_at < Date.now() + EXPIRY_BUFFER_MS) {
         if (context.tokens.refresh_token) {
             const newTokens = await refreshTokens(contextName);
             return newTokens.access_token;
@@ -103,8 +105,94 @@ export async function getAuthHeaders(contextName) {
         }
         return { 'x-api-key': context.api_key };
     }
+    // While acting as Aderis Support every call goes out as the support account,
+    // and the operator is told so — a write made here is attributed to them.
+    const support = getSupportSession(context);
+    if (support) {
+        const token = await validSupportToken(contextName, support);
+        warnActingAsSupport(context.name, support);
+        return { Authorization: `Bearer ${token}` };
+    }
     return { Authorization: `Bearer ${await getValidToken(contextName)}` };
 }
+/** Printed once per process, to stderr so it never lands in piped output. */
+let warnedAboutSupport = false;
+function warnActingAsSupport(contextName, support) {
+    if (warnedAboutSupport)
+        return;
+    warnedAboutSupport = true;
+    process.stderr.write(`! Acting as Aderis Support in ${support.tenant_name} (context ${contextName}). ` +
+        `Everything you do is recorded against you. End with: aderis support end\n`);
+}
+/** The support access token, refreshed when it is within the expiry buffer. */
+async function validSupportToken(contextName, support) {
+    if (support.tokens.expires_at && support.tokens.expires_at < Date.now() + EXPIRY_BUFFER_MS) {
+        if (!support.tokens.refresh_token) {
+            throw new AuthError('The support session has ended. Start a new one with: aderis support start <tenant-id>');
+        }
+        const context = requireContext(contextName);
+        const refreshed = await keycloakProvider.refreshSupportSession(context, support.tokens.refresh_token);
+        const tokens = { ...refreshed, refresh_token: refreshed.refresh_token || support.tokens.refresh_token };
+        saveSupportSession(contextName, { ...support, tokens });
+        return tokens.access_token;
+    }
+    return support.tokens.access_token;
+}
+/** Customers the operator may act for, as Keycloak lists them. */
+export async function listSupportTenants(contextName) {
+    const context = requireContext(contextName);
+    requireOAuthContext(context, 'Support sessions');
+    if (getSupportSession(context)) {
+        throw new AuthError('A support session is already running. End it first with: aderis support end');
+    }
+    return keycloakProvider.listSupportTenants(context, await getValidToken(contextName));
+}
+/**
+ * Starts a support session on the context and stores it beside the operator's
+ * own login. Subsequent API calls go out as Aderis Support until it is ended.
+ */
+export async function startSupportSession(contextName, tenantId) {
+    const context = requireContext(contextName);
+    requireOAuthContext(context, 'Support sessions');
+    if (getSupportSession(context)) {
+        throw new AuthError('A support session is already running. End it first with: aderis support end');
+    }
+    const operatorToken = await getValidToken(contextName);
+    const operatorSub = decodedSub(operatorToken);
+    const tenants = await keycloakProvider.listSupportTenants(context, operatorToken);
+    const chosen = tenants.find((t) => t.tenantId === tenantId);
+    if (!chosen) {
+        throw new AuthError(`Tenant ${tenantId} is not one you may act for. List them with: aderis support tenants --context ${contextName}`);
+    }
+    const tokens = await keycloakProvider.startSupportSession(context, operatorToken, tenantId);
+    const support = {
+        operator_sub: operatorSub,
+        tenant_id: tenantId,
+        tenant_name: chosen.name,
+        tokens,
+    };
+    saveSupportSession(contextName, support);
+    return support;
+}
+/** Ends the running support session; the operator's own login is untouched. */
+export async function endSupportSession(contextName) {
+    const context = requireContext(contextName);
+    const support = getSupportSession(context);
+    if (!support)
+        return null;
+    if (support.tokens.refresh_token) {
+        // Keycloak may have ended it already; the local session goes either way.
+        await keycloakProvider.endSupportSession(context, support.tokens.refresh_token).catch(() => { });
+    }
+    clearSupportSession(contextName);
+    return support;
+}
+/** The operator's own `sub`, read from a token the realm signed. */
+function decodedSub(accessToken) {
+    const [, payload] = accessToken.split('.');
+    const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    return claims.sub ?? '';
+}
 export async function testAuth(contextName) {
     const context = requireContext(contextName);
     const { api: apiUrl } = getBaseUrls(context.environment);

package/dist/lib/auth/keycloak-provider.d.ts

@@ -16,6 +16,8 @@ export declare const KEYCLOAK_SCOPE = "openid profile email offline_access";
 /** The subset of the OIDC discovery document (RFC 8414 / OIDC Discovery 1.0) the CLI uses. */
 export interface OidcDiscovery {
     authorization_endpoint: string;
+    /** Ends one session without touching the operator's own login. */
+    end_session_endpoint: string;
     issuer: string;
     /** Where the realm publishes the signing keys every issued token is checked against. */
     jwks_uri: string;
@@ -45,7 +47,18 @@ export declare class KeycloakProvider implements AuthProvider {
      * validated against the host allowlist; a failed fetch is not cached.
      */
     discover(target: KeycloakTarget): Promise<OidcDiscovery>;
+    /**
+     * Ends exactly the support session. The operator's own login is a different
+     * Keycloak session and is left running.
+     */
+    endSupportSession(context: Context, refreshToken: string): Promise<void>;
     exchangeCode(context: Context, { code, codeVerifier, nonce }: ExchangeParams): Promise<TokenData>;
+    /**
+     * Customers this operator may act for. Served by the realm's tenant-claims
+     * mapper against the operator's own Bearer, so Keycloak — not the CLI —
+     * decides who is an operator and which customers they may pick.
+     */
+    listSupportTenants(context: Context, operatorAccessToken: string): Promise<Tenant[]>;
     /** The access token's `availableTenants` claim lists every tenant the user may act in, read once its signature checks out. */
     listTenants(context: Context, accessToken: string): Promise<Tenant[]>;
     /**
@@ -56,6 +69,15 @@ export declare class KeycloakProvider implements AuthProvider {
      */
     readClaims(context: Context, accessToken: string): Promise<DecodedToken>;
     refresh(context: Context, refreshToken: string): Promise<TokenData>;
+    /** Refreshes a support session. No tenant is named: the session never moves customer. */
+    refreshSupportSession(context: Context, refreshToken: string): Promise<TokenData>;
+    /**
+     * Starts a support session for `tenantId`, authorised by the operator's own
+     * access token. The returned tokens belong to the shared support account and
+     * name the operator in `impersonatorId`; they are a second login, so the
+     * operator's own tokens stay valid and untouched.
+     */
+    startSupportSession(context: Context, operatorAccessToken: string, tenantId: string): Promise<TokenData>;
     /**
      * One refresh-token grant with the `tenant_id` form field, read by the
      * realm's tenant-claims mapper: the minted token's `tenantId` becomes this

package/dist/lib/auth/keycloak-provider.js

@@ -1,8 +1,8 @@
 import { URL } from 'node:url';
-import { REDIRECT_URI } from './constants.js';
+import { FORM_POST_HEADERS, REDIRECT_URI, SUPPORT_CLIENT_ID, SUPPORT_SESSION_GRANT_TYPE } from './constants.js';
 import { AuthError } from './errors.js';
 import { requireClientId } from './guards.js';
-import { authHttp, toAuthError } from './http.js';
+import { authHttp, httpStatusOf, toAuthError } from './http.js';
 import { verifyToken } from './jwks.js';
 import { exchangeAuthorizationCode, redeemRefreshToken, tenantIdOf, tenantsOf, toTokenData, } from './tokens.js';
 import { buildValidatedUrl } from './validated-url.js';
@@ -84,14 +84,25 @@ function validateDiscovery(url, data) {
             throw new AuthError(`Keycloak discovery document at ${url} advertises a ${field} outside the allowed hosts: ${value}`);
         }
     };
-    // `end_session_endpoint` is unused: logout is local-only.
     return {
         authorization_endpoint: requireEndpoint('authorization_endpoint'),
+        end_session_endpoint: requireEndpoint('end_session_endpoint'),
         issuer: requireString('issuer'),
         jwks_uri: requireEndpoint('jwks_uri'),
         token_endpoint: requireEndpoint('token_endpoint'),
     };
 }
+/** `{id, name}` entries from the realm's support-tenant list; an entry without a usable id is dropped. */
+function parseSupportTenants(body) {
+    if (!Array.isArray(body))
+        return [];
+    return body.flatMap((entry) => {
+        const { id, name } = (entry ?? {});
+        if (typeof id !== 'string' || !id)
+            return [];
+        return [{ name: typeof name === 'string' && name ? name : id, tenantId: id }];
+    });
+}
 /**
  * Authorization Code + PKCE S256 with `state` and `nonce` against the public
  * `aderis-cli-login` client, endpoints from OIDC discovery. Tenants come from
@@ -131,6 +142,23 @@ export class KeycloakProvider {
         this.discoveryCache.set(key, pending);
         return pending;
     }
+    /**
+     * Ends exactly the support session. The operator's own login is a different
+     * Keycloak session and is left running.
+     */
+    async endSupportSession(context, refreshToken) {
+        const discovery = await this.discover(context);
+        const params = new URLSearchParams({ client_id: SUPPORT_CLIENT_ID, refresh_token: refreshToken });
+        try {
+            await authHttp.post(discovery.end_session_endpoint, params.toString(), { headers: FORM_POST_HEADERS });
+        }
+        catch (error) {
+            // A session Keycloak has already forgotten is the state we wanted.
+            const status = httpStatusOf(error);
+            if (status !== 400 && status !== 401 && status !== 404)
+                throw toAuthError(error, 'Support session logout');
+        }
+    }
     async exchangeCode(context, { code, codeVerifier, nonce }) {
         const discovery = await this.discover(context);
         const response = await exchangeAuthorizationCode(discovery.token_endpoint, context, { code, codeVerifier });
@@ -138,6 +166,28 @@ export class KeycloakProvider {
         const claims = await this.verifyAccessToken(discovery, response.access_token);
         return this.requireTenant(toTokenData(response, claims), claims);
     }
+    /**
+     * Customers this operator may act for. Served by the realm's tenant-claims
+     * mapper against the operator's own Bearer, so Keycloak — not the CLI —
+     * decides who is an operator and which customers they may pick.
+     */
+    async listSupportTenants(context, operatorAccessToken) {
+        const discovery = await this.discover(context);
+        const url = buildValidatedUrl(new URL(discovery.issuer).origin, `${new URL(discovery.issuer).pathname}/aderis-tenant-claims/me/support/tenants`);
+        let response;
+        try {
+            response = await authHttp.get(url, {
+                headers: { Accept: 'application/json', Authorization: `Bearer ${operatorAccessToken}` },
+            });
+        }
+        catch (error) {
+            if (httpStatusOf(error) === 403) {
+                throw new AuthError('Your account is not an Aderis Support operator, so it cannot act for a customer.');
+            }
+            throw toAuthError(error, 'Support tenant list');
+        }
+        return parseSupportTenants(response.data);
+    }
     /** The access token's `availableTenants` claim lists every tenant the user may act in, read once its signature checks out. */
     async listTenants(context, accessToken) {
         const decoded = await this.readClaims(context, accessToken);
@@ -168,6 +218,61 @@ export class KeycloakProvider {
     refresh(context, refreshToken) {
         return this.redeem(context, refreshToken);
     }
+    /** Refreshes a support session. No tenant is named: the session never moves customer. */
+    async refreshSupportSession(context, refreshToken) {
+        const discovery = await this.discover(context);
+        const params = new URLSearchParams({
+            client_id: SUPPORT_CLIENT_ID,
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+        });
+        let response;
+        try {
+            response = await authHttp.post(discovery.token_endpoint, params.toString(), {
+                headers: FORM_POST_HEADERS,
+            });
+        }
+        catch (error) {
+            const status = httpStatusOf(error);
+            if (status === 400 || status === 401) {
+                throw new AuthError('The support session has ended. Start a new one with: aderis support start <tenant-id>', {
+                    status,
+                });
+            }
+            throw toAuthError(error, 'Support session refresh');
+        }
+        const claims = await this.verifyAccessToken(discovery, response.data.access_token);
+        return toTokenData(response.data, claims);
+    }
+    /**
+     * Starts a support session for `tenantId`, authorised by the operator's own
+     * access token. The returned tokens belong to the shared support account and
+     * name the operator in `impersonatorId`; they are a second login, so the
+     * operator's own tokens stay valid and untouched.
+     */
+    async startSupportSession(context, operatorAccessToken, tenantId) {
+        const discovery = await this.discover(context);
+        const params = new URLSearchParams({
+            client_id: SUPPORT_CLIENT_ID,
+            grant_type: SUPPORT_SESSION_GRANT_TYPE,
+            tenant_id: tenantId,
+        });
+        let response;
+        try {
+            response = await authHttp.post(discovery.token_endpoint, params.toString(), {
+                headers: { ...FORM_POST_HEADERS, Authorization: `Bearer ${operatorAccessToken}` },
+            });
+        }
+        catch (error) {
+            const status = httpStatusOf(error);
+            if (status === 400 || status === 401 || status === 403) {
+                throw new AuthError(`Keycloak refused a support session for tenant ${tenantId}. Check that your account is a support operator and that the customer is one you may act for.`, { status });
+            }
+            throw toAuthError(error, 'Support session');
+        }
+        const claims = await this.verifyAccessToken(discovery, response.data.access_token);
+        return toTokenData(response.data, claims);
+    }
     /**
      * One refresh-token grant with the `tenant_id` form field, read by the
      * realm's tenant-claims mapper: the minted token's `tenantId` becomes this

package/dist/lib/config.d.ts

@@ -26,6 +26,18 @@ export interface CachedTenant {
     name: string;
     tenantId: string;
 }
+/**
+ * A running "act as Aderis Support" session, held beside the operator's own
+ * login rather than replacing it: ending it returns to the operator without a
+ * new browser login, exactly as the web app does.
+ */
+export interface SupportSession {
+    /** The operator's Keycloak `sub`; a session started by someone else is not reused. */
+    operator_sub: string;
+    tenant_id: string;
+    tenant_name: string;
+    tokens: TokenData;
+}
 export interface Context {
     api_key?: string;
     auth_type?: AuthType;
@@ -41,6 +53,8 @@ export interface Context {
      */
     keycloak_base_url?: string;
     name: string;
+    /** Set while acting as Aderis Support; the operator's own tokens stay in `tokens`. */
+    support?: SupportSession;
     tenant_id?: string;
     tokens?: TokenData;
 }
@@ -63,6 +77,10 @@ export declare function saveCachedTenants(contextName: string, tenants: CachedTe
 export declare function getCachedTenants(contextName: string): CachedTenant[] | undefined;
 export declare function getTokens(contextName: string): null | TokenData;
 export declare function clearTokens(contextName: string): void;
+export declare function saveSupportSession(contextName: string, support: SupportSession): void;
+export declare function clearSupportSession(contextName: string): void;
+/** The running support session of a context, if any. */
+export declare function getSupportSession(context: Context): SupportSession | undefined;
 export declare function saveApiKey(contextName: string, apiKey: string): void;
 export declare function clearApiKey(contextName: string): void;
 /**

package/dist/lib/config.js

@@ -128,6 +128,16 @@ export function getTokens(contextName) {
 export function clearTokens(contextName) {
     updateContext(contextName, { tokens: undefined });
 }
+export function saveSupportSession(contextName, support) {
+    updateContext(contextName, { support });
+}
+export function clearSupportSession(contextName) {
+    updateContext(contextName, { support: undefined });
+}
+/** The running support session of a context, if any. */
+export function getSupportSession(context) {
+    return context.support;
+}
 export function saveApiKey(contextName, apiKey) {
     updateContext(contextName, { api_key: apiKey, auth_type: 'api_key' });
 }