@sap/cds-dk 6.6.2 → 6.7.1

package/CHANGELOG.md

@@ -7,6 +7,41 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## Version 6.7.1 - 2023-04-19
+
+### Changed
+
+- `cds init` uses latest Maven Java archetype version 1.33.1 for creating Java projects.
+- Bump `@sap/cds` to 6.7.1
+- Bump `@sap/cds-mtxs` to 1.7.2
+
+### Fixed
+
+- Compatibility with @sap/cds versions >= 4.5 and < 6.2: avoid runtime errors with debugging disabled.
+
+## Version 6.7.0 - 2023-03-28
+
+### Added
+
+- `cds upgrade` enables upgrading a tenant subscribed to a multitenant SaaS app to the latest base model.
+
+### Changed
+
+- `cds env --for` is now used to specify profiles; before it specified project paths, but never worked correctly.
+- `cds add data` now uses comma as CSV separator by default instead of semicolon. This allows using GitHub tabular display.
+- `cds add approuter` doesn't create entries for `authenticationMethod` and `authenticationType` any more, but uses the equivalent `@sap/approuter` defaults.
+- `cds add multitenancy` will now create a sidecar MTX project for Node.js as well.
+- `cds subscribe` and `cds unsubscribe` no longer require a username in case @sap/cds-mtxs is configured with dummy auth.
+- `cds subscribe` and `cds unsubscribe` now rely on @sap/cds-mtxs (version 1.7.0 or higher).
+
+### Fixed
+
+- `cds watch`'s livereload feature may now use a local IPv6 address (`::1`) instead of always `localhost`. This is usually the case on Node.js 17 or higher.
+- In all but `cds compile` errors where not handled correctly, especially compiler errors not displayed in human readable format.
+- `cds init` creates project sample files correctly.
+- CLI commands w/ unknown arguments (`cds --foo`) clearly fail again with a proper error message
+- Reduce console output in case of multitenancy-related command failures.
+
 ## Version 6.6.2 - 2023-03-22
 
 ### Fixed
@@ -24,7 +59,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/).
 ### Fixed
 
 - `cds add helm` fixed html5 cloud service is now read properly.
-- `cds import` now flattens the `@Capabilities` anotation in the CSN for OData V4 files.
+- `cds import` now flattens the `@Capabilities` annotation in the CSN for OData V4 files.
 - `cds import` for OData V4 files now captures the `EnumTypes` information in the CSN according to `UnderlyingType`.
 - `cds import` now captures the `@Common.Text` annotation value properly in the CSN for OData V4 files.
 - `cds init --add java` now uses local Java version when creating new Java project.

package/bin/add.js

@@ -2,7 +2,7 @@
 module.exports = Object.assign(add, {
   options: ['--for', '--out', '--data:for'],
   shortcuts: ['-4', '-o'],
-  flags: ['--force', '--verbose'],
+  flags: ['--force', '--verbose', '--internal-unified-runtime-charts'],
   help: `
 # SYNOPSIS
 
@@ -13,7 +13,9 @@ module.exports = Object.assign(add, {
 
     The following <features> are supported so far:
 
-    *hana*          - adds configuration for SAP HANA deployment
+    *hana*          - adds configuration for SAP HANA databases
+
+    *sqlite*        - adds configuration for SQLite databases
 
     *xsuaa*         - adds configuration for authentication via XSUAA
 
@@ -66,7 +68,7 @@ module.exports = Object.assign(add, {
 # EXAMPLES
 
     *cds add* mta,pipeline
-    *cds add* mtx
+    *cds add* multitenancy
     *cds add* hana,xsuaa --for production
     *cds add* cf-manifest
     *cds add* data --for my.namspace.MyEntity

package/bin/build/all.js

@@ -78,7 +78,7 @@ async function build([project], options = {}) {
         return await cds.build.build(options)
     } catch (e) {
         process.exitCode = 1
-        cds._log(e.errors || e, { 'log-level': cds.env.log.levels.cli })
+        cds._log(e.errors?.length ? e.errors : e, { 'log-level': cds.env.log.levels.cli })
     }
 
 }

package/bin/cds.js

@@ -32,7 +32,7 @@ const cli = { //NOSONAR
     if (argv.some(a => this.Shortcuts[a]==='help'))  return this.help (cmd)
 
     const cds_cli = require (_local('@sap/cds/bin/cds'))
-    DEBUG && DEBUG (`[cds] - @sap/cds ${require('../lib/cds').version} loaded: ${require('../lib/cds').home}`)
+    DEBUG?.(`[cds] - @sap/cds ${require('../lib/cds').version} loaded: ${require('../lib/cds').home}`)
 
     const task = this.load (cmd, /*else*/ (f)=> argv.unshift(cmd) && _defaultCompile (argv,f))
     if (task) {
@@ -47,16 +47,18 @@ const cli = { //NOSONAR
         const args = cds_cli.args(task,argv)
         args[0].push(...appendArgs)
         if (args[1]?.['resolve-bindings']) await _resolveBindings()
-        return task.apply(this, args)
+        return await task.apply(this, args)
       } catch (e) {
         process.exitCode = 1
-        console.error (e)
+        if (e.messages) require('../lib/cds')._log (e.messages)
+        else console.error(e)
       }
     }
   },
 
   load (cmd,_default) {
-    return /[^build/][\\/.-@]/.test(cmd) && _default && _default(true) // like `cds ./srv` or `cds @capire/bookshop`
+    if (cmd === 'build/all') return _require ('./'+cmd) // TODO: remove with CDS 7
+    return /[\\/.-@]/.test(cmd) && _default && _default(true) // like `cds ./srv` or `cds @capire/bookshop`
     || /cds/i.test(cmd) && _dieForUnknownCommand (cmd)  // cds cds
     || _require ('./'+cmd)  // cds-dk commands
     || _require ('@sap/cds/bin/'+cmd, {paths:[process.cwd(), __dirname]}) // prefer local cds for the rest
@@ -67,7 +69,7 @@ const cli = { //NOSONAR
   help (cmd) { return this.exec ('help', cmd) }
 }
 
-const DEBUG = /\b(y|all|cli)\b/.test(process.env.DEBUG) && console.debug
+const DEBUG = /\b(y|all|cli)\b/.test(process.env.DEBUG) ? console.debug : undefined
 
 async function _resolveBindings() {
   const cds = require('../lib/cds')
@@ -90,7 +92,7 @@ function _defaultCompile (argv, _force) {
   // Try all arguments if one resolves to a model.  If yes, we assume 'compile' is intended.
   const model = _force || _is_model(argv)
   if (model)  return _require ('./compile')
-  DEBUG && DEBUG (`[cds] - Command is not a model to compile: ${argv}`)
+  DEBUG?.(`[cds] - Command is not a model to compile: ${argv}`)
 }
 
 function _is_model (argv) {
@@ -142,8 +144,8 @@ function _dieForUnknownCommand(cmd) {
 }
 
 function _require (id,o) {
-  try { var resolved = require.resolve(id,o) } catch(e){ DEBUG && DEBUG (`[cds] - Command not found: ${id}`); return }
-  DEBUG && DEBUG (`[cds] - Command resolved: ${resolved}`)
+  try { var resolved = require.resolve(id,o) } catch(e){ DEBUG?.(`[cds] - Command not found: ${id}`); return }
+  DEBUG?.(`[cds] - Command resolved: ${resolved}`)
   return require (resolved)
 }
 

package/bin/env.js

@@ -16,11 +16,7 @@ module.exports = Object.assign (env, {
 
 # OPTIONS
 
-    *-4* | *--for* <path>
-
-       Load configuration from path instead of the current working directory.
-
-    *--profile* <profile,...>
+    *-4* | *--for* | *--profile* <profile,...>
 
        Load configuration for the specified profile(s).
 
@@ -41,13 +37,15 @@ const info = (s) => process.stdout.isTTY ? term.info (s) : s
 
 async function env ([cmd, key, value], options={}) {
 
+  if (options.for) process.env.CDS_ENV = options.for
+
   const cds = require('../lib/cds')
   const fn = (
     options["process-env"] ? processEnvCommands[cmd] :
     commands[cmd] || ((key = cmd), commands.get)
   )
 
-  let env = options.for ? cds.env.for(options.for) : cds.env
+  let env = cds.env
   if (options["resolve-bindings"]) {
     const BindingManager = require('../lib/bind/bindingManager')
     const bindingManager = new BindingManager({ env, silent: true })

package/bin/login.js

@@ -9,9 +9,10 @@ module.exports = Object.assign(login, {
 
     *cds login* [ <app-url> ]
 
-    Simplifies usage of *cds extend* and *cds activate* commands related to multitenant
-    SaaS applications by providing them with automatic authentication: fetches and
-    saves authentication tokens and provides relevant tokens to those commands.
+    Simplifies usage of multitenancy-related commands (e.g. *cds subscribe* and *cds push*)
+    by providing them with automatic authentication: fetches and saves authentication
+    tokens and provides relevant tokens to those commands. Alternatively saves username
+    for apps running locally.
 
     Saves further settings for the current project (<app-url>, <tenant-subdomain>, and
     URLs for passcodes and tokens).
@@ -110,7 +111,8 @@ module.exports = Object.assign(login, {
 
 # SEE ALSO
 
-    *cds logout* to remove any authentication data
+    Supported commands: *cds subscribe*, *cds upgrade*, *cds pull*, *cds push*, and *cds unsubscribe*.
+    *cds logout* to remove any authentication data.
     https://cap.cloud.sap/docs/guides/extensibility/customization?q=mock#mock-users for information on suitable mock users.
 
 `}});

package/bin/migrate.js

@@ -41,7 +41,6 @@ module.exports = Object.assign(migrate, {
 
         Resolve remote service bindings configured via *cds bind*.
 
-# SEE ALSO
 `})
 
 async function migrate (param, options = {}) {

package/bin/repl.js

@@ -9,7 +9,7 @@ module.exports = Object.assign (repl, { options: [], help: `
 
 # SEE ALSO
 
-    *cds eval*  to evaluate and execute JavaScript
+    *cds eval*  to evaluate and execute JavaScript.
 `})
 
 function repl (_, options={}) {

package/bin/serve.js

@@ -0,0 +1,7 @@
+// allows executing `cds serve` even when `cds` executable is removed from `@sap/cds`
+
+module.exports = require(_local('@sap/cds/bin/serve'))
+
+function _local (id) {
+  return require.resolve (id, { paths: [ process.cwd(), __dirname ] })
+}

package/bin/subscribe.js

@@ -1,5 +1,5 @@
 module.exports = Object.assign(subscribe, {
-    init: on => new (require('../lib/client/subscription'))(on),
+    init: cmd => new (require('../lib/client/tenant_action'))(cmd),
     options: ['--to', '--user'],
     flags: ['--local'],
     shortcuts: ['-2', '-u', '-l'],
@@ -23,8 +23,8 @@ module.exports = Object.assign(subscribe, {
     *-u* | *--user* <name>[:[<password>]]
 
         Username and optionally password for authentication with Basic Auth in test scenarios.
-        Required setting if URL is given. (Tokens saved with *cds login* are not used because they
-        are unsuitable for this command.)
+        Only relevant if <url> is given. May be omitted in case of dummy authentication.
+        Tokens saved with *cds login* are not used for this command.
 
     *-l* | *--local*
 
@@ -35,7 +35,7 @@ module.exports = Object.assign(subscribe, {
 # SEE ALSO
 
     *cds login* for more information on authentication options.
-    *cds login* to save project settings, simplifying multiple runs of this command.
+    *cds login* to save project settings and Basic-Auth data, simplifying multiple runs of this command.
 
 `});
 
@@ -59,7 +59,7 @@ async function subscribe([tenant], options = {}) {
     const [username, password] = options.user?.split(':') ?? [];
     delete options.user;
 
-    await subscribe.init(true).run({
+    await subscribe.init('subscribe').run({
         ...options,
         username,
         password

package/bin/unsubscribe.js

@@ -1,5 +1,5 @@
 module.exports = Object.assign(unsubscribe, {
-    init: on => new (require('../lib/client/subscription'))(on),
+    init: cmd => new (require('../lib/client/tenant_action'))(cmd),
     options: ['--from', '--user'],
     flags: ['--local'],
     shortcuts: ['-f', '-u', '-l'],
@@ -23,8 +23,7 @@ module.exports = Object.assign(unsubscribe, {
     *-u* | *--user* <name>[:[<password>]]
 
         Username and optionally password for authentication with Basic Auth in test scenarios.
-        Required setting if URL is given. (Tokens saved with *cds login* are not used because they
-        are unsuitable for this command.)
+        Only relevant if <url> is given. Tokens saved with *cds login* are not used for this command.
 
     *-l* | *--local*
 
@@ -35,7 +34,7 @@ module.exports = Object.assign(unsubscribe, {
 # SEE ALSO
 
     *cds login* for more information on authentication options.
-    *cds login* to save project settings, simplifying multiple runs of this command.
+    *cds login* to save project settings and Basic-Auth data, simplifying multiple runs of this command.
 
 `});
 
@@ -59,7 +58,7 @@ async function unsubscribe([tenant], options = {}) {
     const [username, password] = options.user?.split(':') ?? [];
     delete options.user;
 
-    await unsubscribe.init(false).run({
+    await unsubscribe.init('unsubscribe').run({
         ...options,
         username,
         password

package/bin/upgrade.js

@@ -0,0 +1,67 @@
+module.exports = Object.assign(upgrade, {
+    init: cmd => new (require('../lib/client/tenant_action'))(cmd),
+    options: ['--at', '--user'],
+    flags: ['--local'],
+    shortcuts: ['-a', '-u', '-l'],
+    help: `
+# SYNOPSIS
+
+    *cds upgrade* <tenant>
+
+    Upgrade a tenant subscribed to a multitenant SaaS app to its latest base model.
+
+    Running *cds upgrade* with a URL is intended for non-productive use only, including against
+    SaaS apps running on localhost with mock authentication.
+
+# OPTIONS
+
+    *-a* | *--at* <url>
+
+        Specify the URL of the SaaS app. Determined from the current user's active CDS or
+        Cloud Foundry login by default.
+
+    *-u* | *--user* <name>[:[<password>]]
+
+        Username and optionally password for authentication with Basic Auth in test scenarios.
+        Only relevant if <url> is given. May be omitted in case of dummy authentication.
+        Tokens saved with *cds login* are not used for this command.
+
+    *-l* | *--local*
+
+        Run a locally-installed @sap/cds-mtxs and connect to it instead of a URL. Ignore settings
+        saved with *cds login*.
+
+
+# SEE ALSO
+
+    *cds login* for more information on authentication options.
+    *cds login* to save project settings and Basic-Auth data, simplifying multiple runs of this command.
+
+`});
+
+
+async function upgrade([tenant], options = {}) {
+    const { CliError } = require('../lib/client/helper/errors');
+    if (!tenant) {
+        throw new CliError('Tenant not given.', { command: 'upgrade' });
+    }
+    const libOptions = { tenant };
+    if (options.local) {
+        libOptions.local = true;
+        delete options.local;
+        if (options.user) {
+            throw new CliError('Username cannot be specified when running @sap/cds-mtxs locally.', { command: 'upgrade' });
+        }
+        if (options.at) {
+            throw new CliError('URL cannot be specified when running @sap/cds-mtxs locally.', { command: 'upgrade' });
+        }
+    }
+    const [username, password] = options.user?.split(':') ?? [];
+    delete options.user;
+
+    await upgrade.init('upgrade').run({
+        ...options,
+        username,
+        password
+    }, libOptions);
+}

package/bin/watch.js

@@ -39,11 +39,12 @@ module.exports = Object.assign ( watch, {
 
 # SEE ALSO
 
-  *cds serve --help* for the different start options
+  *cds serve --help* for the different start options.
 
 `})
 
-const DEBUG = /\b(y|all|cli|watch)\b/.test(process.env.DEBUG) && console.debug
+const cds = require('../lib/cds')
+const DEBUG = cds.debug('cli|watch')
 const {delimiter,dirname,relative,resolve,sep} = require ('path')
 const fs = require ('fs')
 
@@ -109,7 +110,7 @@ async function watch ([cwd], {
   }
   log ()
   log (`${t.bold}cds ${args.join(' ')}`)
-  log (process.pid, 'watching:', ext, '...')
+  DEBUG && log (process.pid, 'watching:', ext, '...')
   if (includes) DEBUG && log (`also watching: ${includes.source}`)
   if (liveReload) log (`live reload enabled for browsers`)
 
@@ -124,7 +125,7 @@ async function watch ([cwd], {
     delay: parseInt(process.env.CDS_WATCH_DELAY) || 200,
     options
   }).on('restart', (files)=>{
-    log (`\n${t.bold}        ___________________________\n\n`)
+    log (`\n${t.bold}        ___________________________\n`)
     if (liveReload) liveReload.markPending(files)
     if (this.delayed) clearTimeout (this.delayed)
     this.delayed = setTimeout(()=>{
@@ -209,7 +210,9 @@ if (!module.parent) (async()=>{ // launched by nodemon
     case 'NO_SERVICES_FOUND': return _no_services_found(e)
     case 'MODEL_NOT_FOUND': return _no_models_found(e)
     case 'EADDRINUSE': return process.send(e)  //> tell cds watch
-    default: console.error('\n❗️ Error on server start: ❗️'); throw e
+    default: if (!e.messages) { // compiler messages have been written by cli already
+      console.error('\n❗️ ERROR on server start: ❗️\n\n', e)
+    }
   }}
   function _no_models_found(e) { console.log (`
     No models found in ${cds.resolve(e.model||'*',false)}.

package/lib/bind/bindingManager.js

@@ -1,6 +1,7 @@
 const bindingResolver = require('./bindingResolver')
 const { logger } = require('./bindingUtil')
-const DEBUG = /\b(all|cli)\b/.test(process.env.DEBUG)
+const cds = require('../cds')
+const DEBUG = cds.debug('cli')
 
 class BindingManager {
     constructor(options = {}) {
@@ -85,4 +86,4 @@ class BindingManager {
         }
 }
 
-module.exports = BindingManager
+module.exports = BindingManager

package/lib/bind/cfKeyProvider.js

@@ -3,7 +3,8 @@ const fsp = require('fs').promises;
 const os = require('os');
 const util = require('util');
 
-const DEBUG = /\b(y|all|cli)\b/.test(process.env.DEBUG) && console.debug
+const cds = require('../cds');
+const DEBUG = cds.debug('cli')
 
 const axios = require('axios');
 const { URL } = require('url');
@@ -16,7 +17,7 @@ const IS_WIN = os.platform() === 'win32';
 
 class CFKeyProvider {
     async _cfRead(...args) {
-        DEBUG && DEBUG(`_cfRead: cf ${args}`);
+        DEBUG?.(`_cfRead: cf ${args}`);
 
         const result = await execAsync(`cf ${args}`, {
             shell: IS_WIN,
@@ -47,7 +48,7 @@ class CFKeyProvider {
                 }
             }
         } catch (err) {
-            DEBUG && DEBUG(`getCfTargetFromConfigFile: ${err}`);
+            DEBUG?.(`getCfTargetFromConfigFile: ${err}`);
         }
     }
 
@@ -66,7 +67,7 @@ class CFKeyProvider {
     }
 
     async getCfSpaceInfo() {
-        DEBUG && DEBUG('getting space info');
+        DEBUG?.('getting space info');
 
         const target = await this.getCfTarget();
         const authorization = await this.getCfAuthorization();
@@ -91,7 +92,7 @@ class CFKeyProvider {
     }
 
     async getCfAuthorization() {
-        DEBUG && DEBUG('getting authorization');
+        DEBUG?.('getting authorization');
         return this._cfRead('oauth-token');
     }
 
@@ -297,7 +298,7 @@ class BatchRequest {
 
     static async req(target, urlPath) {
         const url = new URL(urlPath, target.apiEndpoint);
-        DEBUG && DEBUG(`_req: ${url.toString()}`);
+        DEBUG?.(`_req: ${url.toString()}`);
 
         const result = await axios.get(url.toString(), {
             headers: {

package/lib/bind/userCdsrcJsonStorageProvider.js

@@ -2,11 +2,12 @@ const os = require('os');
 const path = require('path');
 const readline = require('readline');
 
-const DEBUG = /\b(y|all|cli)\b/.test(process.env.DEBUG)  && console.debug
+const cds = require('../cds');
+const DEBUG = cds.debug('cli');
 
 const fs = require('fs').promises;
 const { highlight } = require('../util/term');
-const { logger } = require('./bindingUtil')
+const { logger } = require('./bindingUtil');
 
 const commandUtil = require('../init/util/commandUtil');
 
@@ -39,12 +40,12 @@ class UserCdsrcJsonStorageProvider {
             return; // file is git ignored
         } catch (err) {
             if (err.code === 'ENOENT') {   // git command not found
-                DEBUG && DEBUG('git command not found');
+                DEBUG?.('git command not found');
                 return;
             }
 
             if (!err.stdLog.match(/::/)) {   // included or not a git repo
-                DEBUG && DEBUG(err);
+                DEBUG?.(err);
                 return;
             }
         }

package/lib/cds.js

@@ -7,6 +7,18 @@ const cds = module.exports = _local ('@sap/cds')
 cds._log = _local ('@sap/cds/bin/utils/log')
 cds._local = _local
 
+if (/^(4\.[56]|5|6\.[01])\b/.test(cds.version)) {
+  // cds.debug may return false as of @sap/cds@(>=4.5 && < 6.2).
+  // Patch this to be able to call `cds.debug(label)?.(message)`.
+  // REVISIT remove once we no longer support these versions
+  Object.defineProperty(cds, 'debug', {
+    value: function cds_debug_patched (module, options) {
+      const L = cds.log (module, options)
+      if (L._debug) return L.debug
+    }
+  })
+}
+
 function _resolve (id) {
   return require.resolve (id, {paths:[
     process.cwd(), // project-local module is preferred

package/lib/client/activate.js

@@ -2,7 +2,8 @@ const fs = require('fs').promises;
 const path = require('path');
 const axios = require('axios');
 
-const log = require('./helper/logging');
+const cds = require('../cds');
+const DEBUG = cds.debug('cli');
 const { collectFileContent, collectFiles, toUnixPath } = require('./helper/fs_helper');
 const { CliError } = require('./helper/errors');
 
@@ -102,7 +103,7 @@ module.exports = class Activate extends BaseCommand {
             if (! entry.startsWith(projectFolder)) {
                 /* Current file might be below the base model's node_modules, in which case compilation on server should succeed.
                    Otherwise, compilation will probably fail, with this message giving a hint. */
-                log.debug(`Source file outside project folder will not be uploaded: ${entry}`);
+                DEBUG?.(`Source file outside project folder will not be uploaded: ${entry}`);
                 return false;
             }
             const unixFilename = toUnixPath(entry);
@@ -188,7 +189,7 @@ module.exports = class Activate extends BaseCommand {
                 throw new CliError(`Job ${jobId} failed: did not receive job-status path`);
             }
 
-            log.debug(`Job ID: ${jobId}`);
+            DEBUG?.(`Job ID: ${jobId}`);
 
             return new Promise((resolve, reject) => {
                 const statusUrl = this.concatUrls(params.get('appUrl'), statusPath);

package/lib/client/auth_manager.js

@@ -1,6 +1,7 @@
 const axios = require('axios');
 
-const log = require('./helper/logging');
+const cds = require('../cds');
+const DEBUG = cds.debug('cli');
 const { SettingsManager } = require('./settings_manager');
 const { ParamCollection } = require('./params');
 const { CliError } = require('./helper/errors');
@@ -39,7 +40,7 @@ function getTokenUrl(params) {
 async function retrieveTokenOrPasscodeUrl(params) {
     if (params.has('token')) {
         if (params.get('renewLogin') || params.get('tokenExpirationDate') <= Date.now()) {
-            log.debug((params.get('renewLogin') ? 'Renewing' : 'Refreshing expired') + ' authentication token');
+            DEBUG?.((params.get('renewLogin') ? 'Renewing' : 'Refreshing expired') + ' authentication token');
             params.delete('token');
             params.delete('tokenExpirationDate');
         } else {
@@ -54,7 +55,7 @@ async function retrieveTokenOrPasscodeUrl(params) {
     let authData;
     do {
         const tokenUrl = getTokenUrl(params);
-        log.debug(`Getting authentication token or passcode URL from ${(params.obfuscateQueryParams(tokenUrl))}`);
+        DEBUG?.(`Getting authentication token or passcode URL from ${(params.obfuscateQueryParams(tokenUrl))}`);
 
         let response;
         try {

package/lib/client/base_command.js

@@ -20,9 +20,9 @@ module.exports = class BaseCommand {
         const prefix = `Request to ${url} failed`;
         switch (error.response?.status) {
             case 401:
-                throw new CliError(`${prefix}: invalid authentication. Retry with valid passcode${
+                throw new CliError(`${prefix}: invalid authentication.\nRetry with valid passcode${
                     params.has('passcodeUrl') ? ` from ${params.get('passcodeUrl')}` : ''
-                }.`, { error, command });
+                } or username/password (required if SaaS app is configured with mocked-auth).`, { error, command });
             case 403:
                 throw new CliError(prefix + ': insufficient authorization. Ensure client has all necessary roles.', { error, command });
             case 404:
@@ -32,6 +32,11 @@ module.exports = class BaseCommand {
                 throw new CliError(prefix + '.', { error, command });
             default:
                 // Unexpected error should be transparent to user.
+                if (!require('..').debug('axios')) {
+                    error.config?.auth && (error.config.auth = '...'); // TODO use &&= with Node > 14
+                    delete error.request;
+                    delete error.response;
+                }
                 throw error;
         }
     }