@seliseblocks/cli-os 0.1.1 → 0.1.2

package/dist/index.js

@@ -192,152 +192,152 @@ function toCliError(error) {
     return { code: "command_failed", message };
 }
 function printHelp() {
-    console.log(`Blocks OS CLI
-
-Usage:
-  blocks-os <command> [options]
-
-Global options:
-  --version                 Print CLI version.
-  --json                    Print machine-readable JSON where supported.
-  --api-url <url>           Override Blocks API URL for this command.
-  --account <name>          Use a named account profile; default is implicit.
-  --project <tenantId>      Use a project tenant for project-scoped commands.
-  --dry-run                 Show planned mutation without calling the API.
-  --yes                     Skip mutation confirmation after explicit approval.
-
-Setup and health:
-  blocks-os init
-    Create local Blocks workspace files: blocks.json, data schema/rules folders,
-    release deploy config, and .env.example.
-
-  blocks-os doctor [--json]
-    Check local Node.js, OIDC config, token cache, selected project, and config
-    file locations. Does not mutate cloud resources.
-
-Auth:
-  blocks-os auth:add [account] --client-id <id> --client-secret <secret>
-    Save OIDC client settings for the CLI. Defaults target production Blocks
-    URLs, root tenant, scope, and localhost callback. Secret is stored separately.
-
-  blocks-os login
-    Browser Authorization Code + PKCE login. Opens IAM, captures the localhost
-    callback, stores account access and refresh tokens, and auto-refreshes later.
-
-  blocks-os login:device
-    Device-code login for terminals or agents where a browser callback is not
-    convenient. Uses the same saved account profile.
-
-  blocks-os auth:status [--json]
-    Show configured account, token freshness, refresh-token availability, and
-    selected project without printing secrets.
-
-  blocks-os auth:refresh [--project] [--json]
-    Force account token refresh, or project token refresh with --project.
-
-  blocks-os auth:repair [account] [--dry-run] [--yes] [--json]
-    Clear broken local secure-store auth state while keeping account profile
-    config. Use after OS credential migration, stale DPAPI, or corrupted tokens.
-
-  blocks-os auth:list [--json]
-    List saved account profiles without showing secrets.
-
-  blocks-os auth:show [account]
-    Print one account profile with secret redacted as configured/missing.
-
-  blocks-os auth:use <account>
-    Switch the active named account profile.
-
-  blocks-os auth:remove <account>
-    Remove account config, cached tokens, and stored client secret for that
-    account.
-
-  blocks-os logout
-    Revoke the current refresh token when possible and remove local session data.
-
-Projects:
-  blocks-os projects:list [--json]
-    List accessible Blocks projects via /os/v4/Project/Gets using the account
-    token. Read-only.
-
-  blocks-os projects:get [tenantId] [--json]
-    Read one project from Project/Gets. Uses selected project when tenantId is
-    omitted. Read-only.
-
-  blocks-os projects:create <name> [--env dev] [--yes] [--dry-run] [--json]
-    Create a Blocks project/environment via /os/v4/Project/Create using the
-    account token. Mutating; supports dry-run and confirmation.
-
-  blocks-os use <project-tenant-id>
-    Save the selected project tenant globally and in blocks.json when present.
-    Does not call cloud APIs.
-
-IAM:
-  blocks-os iam:me [--json]
-    Read the current user from IAM using the account token. This is the only IAM
-    admin surface exposed in the MVP.
-
-Data:
-  blocks-os data:validate [--json]
-    Validate local blocks/data/schemas/*.json and blocks/data/rules.json before
-    pushing. Local-only.
-
-  blocks-os data:schema:list [--json]
-    List project schemas via /data/v4/schemas using an impersonated project
-    token. Read-only.
-
-  blocks-os data:schema:pull [--json]
-    Download project schemas into blocks/data/schemas/*.json. Writes local files
-    only.
-
-  blocks-os data:schema:push [--dry-run] [--yes] [--json]
-    Create or update project schemas via /data/v4/schemas/define. Mutating;
-    uses POST for create and PUT for update.
-
-  blocks-os data:rules:pull [--json]
-    Download data-access policies into blocks/data/rules.json. Writes local
-    files only.
-
-  blocks-os data:rules:deploy [--dry-run] [--yes] [--json]
-    Apply schema security and data-access policies. Mutating; supports dry-run
-    and confirmation.
-
-  blocks-os data:reload [--dry-run] [--yes] [--json]
-    Reload Data schema configuration so staged schema/rule changes become live.
-    Mutating; calls POST /data/v4/schema-configurations/reload.
-
-Localization:
-  blocks-os localization:validate --module <name> --language <culture> [--file <path>] [--json]
-    Validate a local i18n JSON dictionary. Supports nested JSON input and
-    validates the flattened key/value set locally.
-
-  blocks-os localization:push --module <name> --language <culture> [--file <path>] [--route <route>] [--context <text>] [--dry-run] [--yes] [--json]
-    Create or update Localization keys from a local i18n JSON dictionary via
-    /localization/v4/Key/SaveKeys. Creates the module first when it is missing.
-
-  blocks-os localization:pull --module <name> --language <culture> [--out <path>] [--json]
-    Download published cloud localization via
-    /localization/v4/Key/GetCloudUilmFile and write a local JSON dictionary.
-
-Release:
-  blocks-os release:deploy --repo-id <repoId> [--dry-run] [--yes] [--json]
-    Trigger a manual Release build/deploy for a configured repository. Mutating;
-    no artifact upload is performed by this CLI.
-
-  blocks-os release:status <buildId> [--json]
-    Read Release build status by build id. Read-only.
-
-  blocks-os release:builds:list --repo-id <repoId> [--json]
-    List Release build details for a repository. Read-only.
-
-  blocks-os release:builds:get <buildId> [--json]
-    Alias for release:status. Read-only.
-
-Scaffold:
-  blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain> --blocks-api-url <url> [--client-id <oidcClientId>] [--oidc-url <url>]
-    Create a Vite React starter app with a real browser Authorization Code +
-    PKCE login flow against Blocks IAM (login page, /login/callback handler,
-    route guards), plus Data schema listing, Release build lookup, environment
-    config, and safe .gitignore defaults.
+    console.log(`Blocks OS CLI
+
+Usage:
+  blocks-os <command> [options]
+
+Global options:
+  --version                 Print CLI version.
+  --json                    Print machine-readable JSON where supported.
+  --api-url <url>           Override Blocks API URL for this command.
+  --account <name>          Use a named account profile; default is implicit.
+  --project <tenantId>      Use a project tenant for project-scoped commands.
+  --dry-run                 Show planned mutation without calling the API.
+  --yes                     Skip mutation confirmation after explicit approval.
+
+Setup and health:
+  blocks-os init
+    Create local Blocks workspace files: blocks.json, data schema/rules folders,
+    release deploy config, and .env.example.
+
+  blocks-os doctor [--json]
+    Check local Node.js, OIDC config, token cache, selected project, and config
+    file locations. Does not mutate cloud resources.
+
+Auth:
+  blocks-os auth:add [account] --client-id <id> --client-secret <secret>
+    Save OIDC client settings for the CLI. Defaults target production Blocks
+    URLs, root tenant, scope, and localhost callback. Secret is stored separately.
+
+  blocks-os login
+    Browser Authorization Code + PKCE login. Opens IAM, captures the localhost
+    callback, stores account access and refresh tokens, and auto-refreshes later.
+
+  blocks-os login:device
+    Device-code login for terminals or agents where a browser callback is not
+    convenient. Uses the same saved account profile.
+
+  blocks-os auth:status [--json]
+    Show configured account, token freshness, refresh-token availability, and
+    selected project without printing secrets.
+
+  blocks-os auth:refresh [--project] [--json]
+    Force account token refresh, or project token refresh with --project.
+
+  blocks-os auth:repair [account] [--dry-run] [--yes] [--json]
+    Clear broken local secure-store auth state while keeping account profile
+    config. Use after OS credential migration, stale DPAPI, or corrupted tokens.
+
+  blocks-os auth:list [--json]
+    List saved account profiles without showing secrets.
+
+  blocks-os auth:show [account]
+    Print one account profile with secret redacted as configured/missing.
+
+  blocks-os auth:use <account>
+    Switch the active named account profile.
+
+  blocks-os auth:remove <account>
+    Remove account config, cached tokens, and stored client secret for that
+    account.
+
+  blocks-os logout
+    Revoke the current refresh token when possible and remove local session data.
+
+Projects:
+  blocks-os projects:list [--json]
+    List accessible Blocks projects via /os/v4/Project/Gets using the account
+    token. Read-only.
+
+  blocks-os projects:get [tenantId] [--json]
+    Read one project from Project/Gets. Uses selected project when tenantId is
+    omitted. Read-only.
+
+  blocks-os projects:create <name> [--env dev] [--yes] [--dry-run] [--json]
+    Create a Blocks project/environment via /os/v4/Project/Create using the
+    account token. Mutating; supports dry-run and confirmation.
+
+  blocks-os use <project-tenant-id>
+    Save the selected project tenant globally and in blocks.json when present.
+    Does not call cloud APIs.
+
+IAM:
+  blocks-os iam:me [--json]
+    Read the current user from IAM using the account token. This is the only IAM
+    admin surface exposed in the MVP.
+
+Data:
+  blocks-os data:validate [--json]
+    Validate local blocks/data/schemas/*.json and blocks/data/rules.json before
+    pushing. Local-only.
+
+  blocks-os data:schema:list [--json]
+    List project schemas via /data/v4/schemas using an impersonated project
+    token. Read-only.
+
+  blocks-os data:schema:pull [--json]
+    Download project schemas into blocks/data/schemas/*.json. Writes local files
+    only.
+
+  blocks-os data:schema:push [--dry-run] [--yes] [--json]
+    Create or update project schemas via /data/v4/schemas/define. Mutating;
+    uses POST for create and PUT for update.
+
+  blocks-os data:rules:pull [--json]
+    Download data-access policies into blocks/data/rules.json. Writes local
+    files only.
+
+  blocks-os data:rules:deploy [--dry-run] [--yes] [--json]
+    Apply schema security and data-access policies. Mutating; supports dry-run
+    and confirmation.
+
+  blocks-os data:reload [--dry-run] [--yes] [--json]
+    Reload Data schema configuration so staged schema/rule changes become live.
+    Mutating; calls POST /data/v4/schema-configurations/reload.
+
+Localization:
+  blocks-os localization:validate --module <name> --language <culture> [--file <path>] [--json]
+    Validate a local i18n JSON dictionary. Supports nested JSON input and
+    validates the flattened key/value set locally.
+
+  blocks-os localization:push --module <name> --language <culture> [--file <path>] [--route <route>] [--context <text>] [--dry-run] [--yes] [--json]
+    Create or update Localization keys from a local i18n JSON dictionary via
+    /localization/v4/Key/SaveKeys. Creates the module first when it is missing.
+
+  blocks-os localization:pull --module <name> --language <culture> [--out <path>] [--json]
+    Download published cloud localization via
+    /localization/v4/Key/GetCloudUilmFile and write a local JSON dictionary.
+
+Release:
+  blocks-os release:deploy --repo-id <repoId> [--dry-run] [--yes] [--json]
+    Trigger a manual Release build/deploy for a configured repository. Mutating;
+    no artifact upload is performed by this CLI.
+
+  blocks-os release:status <buildId> [--json]
+    Read Release build status by build id. Read-only.
+
+  blocks-os release:builds:list --repo-id <repoId> [--json]
+    List Release build details for a repository. Read-only.
+
+  blocks-os release:builds:get <buildId> [--json]
+    Alias for release:status. Read-only.
+
+Scaffold:
+  blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain> --blocks-api-url <url> [--client-id <oidcClientId>] [--oidc-url <url>]
+    Create a Vite React starter app with a real browser Authorization Code +
+    PKCE login flow against Blocks IAM (login page, /login/callback handler,
+    route guards), plus Data schema listing, Release build lookup, environment
+    config, and safe .gitignore defaults.
 `);
 }

package/dist/lib/config.d.ts

@@ -15,6 +15,7 @@ export type TokenSet = {
     expiresAt?: string;
     idToken?: string;
     refreshToken?: string;
+    refreshTokenExpiresAt?: string;
     scope?: string;
     tokenType?: string;
 };

package/dist/lib/token.d.ts

@@ -8,12 +8,15 @@ export type TokenResponse = {
     expires_in?: number;
     id_token?: string;
     refresh_token?: string;
+    refresh_expires_in?: number;
+    refresh_token_expires_in?: number;
     scope?: string;
     token_type?: string;
 };
 export declare function randomState(): string;
 export declare function expiresAtFromToken(response: TokenResponse, accessToken: string): string | undefined;
 export declare function expiresAtFromJwtFirst(response: TokenResponse, accessToken: string): string | undefined;
+export declare function refreshExpiresAtFromToken(response: TokenResponse, refreshToken?: string): string | undefined;
 export declare function isExpiring(expiresAt?: string): boolean;
 export declare function applyAccountToken(config: BlocksCliConfig, store: BlocksTokenStore, account: string, clientId: string, response: TokenResponse): {
     config: BlocksCliConfig;

package/dist/lib/token.js

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { decodeJwtPayload, tenantFromToken } from "./jwt.js";
 const EXPIRY_SKEW_MS = 60_000;
+const DEFAULT_REFRESH_TOKEN_LIFETIME_SECONDS = 30 * 60;
 export function randomState() {
     return randomBytes(24).toString("base64url");
 }
@@ -21,6 +22,26 @@ export function expiresAtFromJwtFirst(response, accessToken) {
     }
     return expiresAtFromToken(response, accessToken);
 }
+export function refreshExpiresAtFromToken(response, refreshToken) {
+    if (refreshToken) {
+        try {
+            const payload = decodeJwtPayload(refreshToken);
+            if (typeof payload.exp === "number") {
+                return new Date(payload.exp * 1000).toISOString();
+            }
+        }
+        catch {
+            // Opaque refresh tokens have no JWT payload; use server metadata or the configured lifetime.
+        }
+    }
+    const expiresIn = response.refresh_expires_in ?? response.refresh_token_expires_in;
+    if (typeof expiresIn === "number" && expiresIn > 0) {
+        return new Date(Date.now() + expiresIn * 1000).toISOString();
+    }
+    return refreshToken
+        ? new Date(Date.now() + DEFAULT_REFRESH_TOKEN_LIFETIME_SECONDS * 1000).toISOString()
+        : undefined;
+}
 export function isExpiring(expiresAt) {
     if (!expiresAt)
         return true;
@@ -34,12 +55,17 @@ export function applyAccountToken(config, store, account, clientId, response) {
     // rotate it (still valid, just not reissued) -- fall back to the previous
     // one instead of overwriting a working refresh token with undefined.
     const previousRefreshToken = store.accounts[account]?.account?.refreshToken;
+    const previousRefreshTokenExpiresAt = store.accounts[account]?.account?.refreshTokenExpiresAt;
+    const refreshToken = response.refresh_token ?? previousRefreshToken;
     const tokenSet = {
         accessToken: response.access_token,
         accountTenant: tenantFromToken(response.access_token),
-        expiresAt: expiresAtFromToken(response, response.access_token),
+        expiresAt: expiresAtFromJwtFirst(response, response.access_token),
         idToken: response.id_token,
-        refreshToken: response.refresh_token ?? previousRefreshToken,
+        refreshToken,
+        refreshTokenExpiresAt: response.refresh_token
+            ? refreshExpiresAtFromToken(response, response.refresh_token)
+            : previousRefreshTokenExpiresAt,
         scope: response.scope,
         tokenType: response.token_type ?? "Bearer"
     };
@@ -72,10 +98,15 @@ export function applyProjectToken(config, store, account, tenantId, response) {
         throw new Error(response.error_description ?? response.error ?? "Project token response did not include an access token");
     }
     const previousRefreshToken = store.accounts[account]?.projects?.[tenantId]?.refreshToken;
+    const previousRefreshTokenExpiresAt = store.accounts[account]?.projects?.[tenantId]?.refreshTokenExpiresAt;
+    const refreshToken = response.refresh_token ?? previousRefreshToken;
     const tokenSet = {
         accessToken: response.access_token,
         expiresAt: expiresAtFromJwtFirst(response, response.access_token),
-        refreshToken: response.refresh_token ?? previousRefreshToken,
+        refreshToken,
+        refreshTokenExpiresAt: response.refresh_token
+            ? refreshExpiresAtFromToken(response, response.refresh_token)
+            : previousRefreshTokenExpiresAt,
         scope: response.scope,
         tokenType: response.token_type ?? "Bearer"
     };

package/package.json

@@ -1,47 +1,47 @@
-{
-  "name": "@seliseblocks/cli-os",
-  "version": "0.1.1",
-  "description": "CLI for SELISE Blocks OS project setup and configuration.",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "blocks-os": "./bin/run.js"
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "sideEffects": false,
-  "files": [
-    "bin",
-    "dist",
-    "README.md",
-    "AI_USAGE_GUIDE.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.json",
-    "dev": "tsx src/index.ts",
-    "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && node --test test/*.test.mjs",
-    "prepack": "npm run build",
-    "prepublishOnly": "npm test"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "tsx": "^4.16.0",
-    "typescript": "^5.5.0"
-  },
-  "engines": {
-    "node": ">=20"
-  }
-}
+{
+  "name": "@seliseblocks/cli-os",
+  "version": "0.1.2",
+  "description": "CLI for SELISE Blocks OS project setup and configuration.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "blocks-os": "bin/run.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "files": [
+    "bin",
+    "dist",
+    "README.md",
+    "AI_USAGE_GUIDE.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "dev": "tsx src/index.ts",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm test"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.16.0",
+    "typescript": "^5.5.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}