@seliseblocks/cli-os 0.1.2 → 0.1.3

package/AI_USAGE_GUIDE.md

@@ -27,58 +27,38 @@ For local package development only, contributors may run `node bin/run.js ...` f
 - Prefer `--json` for automation and parsing.
 - Use `--dry-run` before any mutating command.
 - Do not run real mutating cloud commands unless the user explicitly approved the exact action.
-- Never print, commit, scaffold, or document client secrets, access tokens, refresh tokens, cookies, or JWTs.
+- Never print, commit, scaffold, or document access tokens, refresh tokens, cookies, JWTs, or other secrets.
 - Treat any secret pasted into chat or logs as exposed and rotate it before production use.
-- Generated apps must not contain CLI client secrets or CLI tokens.
+- Generated apps must not contain CLI tokens.
 - If a CLI command returns an error, fix or report the CLI path. Do not bypass the CLI with a one-off API request when the command exists.
 
-## Account Setup
-
-Add the CLI OIDC account:
-
-```bash
-blocks-os auth:add --client-id <clientId> --client-secret <clientSecret>
-```
-
-Normal production defaults are built in:
-
-```text
-API URL: https://api.seliseblocks.com
-OIDC URL: https://iam.seliseblocks.com
-OS portal URL: https://os.seliseblocks.com
-Redirect URI: http://127.0.0.1:8976/callback
-Scope: openid profile offline_access
-Root tenant: d7e5554c758541db8a18694b64ef423d
-```
-
-The CLI stores client secrets and OAuth tokens in the OS credential backend when available. Do not manually copy token files between machines.
-
 ## Login
 
-Use browser login when an interactive browser is available:
+Device-code login uses the packaged OS client id. It prints a verification URL and user code, opens the browser to the verification page when possible, then polls until approved:
 
 ```bash
 blocks-os login
 ```
 
-Use device login when a browser callback is not convenient:
+Check current auth state:
 
 ```bash
-blocks-os login:device
+blocks-os auth:status --json
 ```
 
-Check current auth state:
+If local auth state is stale or corrupted (Windows profile change, machine migration, Keychain reset), clear local auth state and log in again:
 
 ```bash
-blocks-os auth:status --json
+blocks-os auth:remove <account>
+blocks-os login
 ```
 
-Repair stale or corrupted local auth storage:
+Use `blocks-os logout` to revoke the current refresh token when possible and remove local session data. Use `blocks-os auth:refresh --json` to force account token refresh, and `blocks-os auth:refresh --project --json` after a project session already exists.
+
+Run health checks without mutation:
 
 ```bash
-blocks-os auth:repair --yes
-blocks-os auth:add --client-id <clientId> --client-secret <clientSecret>
-blocks-os login
+blocks-os doctor --json
 ```
 
 ## Project Workflow
@@ -113,17 +93,15 @@ blocks-os projects:get --json
 Generate a React/Vite Blocks app:
 
 ```bash
-blocks-os new web <appName> --x-blocks-key <projectTenantId> --app-domain <appDomainOrUrl> --blocks-api-url https://api.seliseblocks.com
+blocks-os new web <appName> --x-blocks-key <projectTenantId> --app-domain <appDomainOrUrl>
 ```
 
 If a public browser OIDC client exists for the app, include it:
 
 ```bash
-blocks-os new web <appName> --x-blocks-key <projectTenantId> --app-domain <appDomainOrUrl> --blocks-api-url https://api.seliseblocks.com --client-id <publicOidcClientId>
+blocks-os new web <appName> --x-blocks-key <projectTenantId> --app-domain <appDomainOrUrl> --client-id <publicOidcClientId>
 ```
 
-Use `--oidc-url <url>` only for non-production IAM authority overrides; it defaults to `https://iam.seliseblocks.com`.
-
 Validate the scaffold:
 
 ```bash
@@ -132,7 +110,7 @@ npm install
 npm run build
 ```
 
-Do not pass the CLI client secret to the scaffolded app. Browser apps must use a public OIDC client and the SDK hosted IdP flow: `blocksClient.auth.idp.redirectToProvider()` on login click and `blocksClient.auth.idp.callback()` on `/login/callback`.
+Do not pass CLI auth state to the scaffolded app. Browser apps must use a public OIDC client and the SDK hosted IdP flow: `blocksClient.auth.idp.redirectToProvider()` on login click and `blocksClient.auth.idp.callback()` on `/login/callback`.
 
 `--app-domain` is the app's real Blocks domain/origin, for example `https://dbpdba.seliseblocks.com`. The generated `.env` keeps that full value as `VITE_BLOCKS_APP_DOMAIN` and derives the local dev host without a scheme as `VITE_BLOCKS_DEV_HOST=dbpdba.seliseblocks.com`.
 
@@ -278,7 +256,9 @@ blocks-os release:builds:list --repo-id <repoId> --json
 ## Agent Failure Handling
 
 - `not_logged_in`: run `blocks-os login`.
-- `auth_repair_required`: run `blocks-os auth:repair --yes`, re-add credentials, then login.
+- `refresh_token_rejected`: run `blocks-os login`.
+- `refresh_network_error`: check the network and configured OIDC URL, then retry.
+- `auth_repair_required`: inspect `blocks-os auth:status --json`; if local storage is unreadable or stale, run `blocks-os auth:remove <account>`, then `blocks-os auth:status --json` and `blocks-os login`.
 - `project_not_selected`: run `blocks-os use <projectTenantId>`.
 - `api_auth_failed`: run `blocks-os auth:status --json`, then login again.
 - HTML returned from an API command means the command endpoint path is wrong and must be fixed in the CLI.

package/README.md

@@ -14,28 +14,12 @@ npm install -g @seliseblocks/cli-os
 blocks-os --version
 ```
 
-Configure one OIDC account once:
-
-```bash
-blocks-os auth:add --client-id <cli-client-id> --client-secret <cli-client-secret>
-```
-
-The CLI fixes these defaults unless you pass advanced override flags:
-
-```text
-API URL: https://api.seliseblocks.com
-OIDC URL: https://iam.seliseblocks.com
-OS portal URL: https://os.seliseblocks.com
-Redirect URI: http://127.0.0.1:8976/callback
-Scope: openid profile offline_access
-Root tenant: d7e5554c758541db8a18694b64ef423d
-```
-
-Then use either login method with the same account:
+Then log in (device-code flow - prints a verification URL and code, opens
+your browser to the verification page when possible so you only need to
+click approve, then polls until approved):
 
 ```bash
 blocks-os login
-blocks-os login:device
 ```
 
 For source development in this repository:
@@ -52,16 +36,10 @@ node bin/run.js --version
 |---|---|
 | `blocks-os init` | Create local Blocks workspace files: `blocks.json`, data schema/rules folders, release deploy config, and `.env.example`. |
 | `blocks-os doctor [--json]` | Check Node.js, OIDC config, token cache, selected project, and config file locations. Does not mutate cloud resources. |
-| `blocks-os auth:add [account] --client-id <id> --client-secret <secret>` | Save OIDC client settings for the CLI. Defaults target production Blocks URLs, root tenant, scope, and localhost callback. Secret is stored separately. |
-| `blocks-os login` | Browser Authorization Code + PKCE login. Opens IAM, captures the localhost callback, stores account tokens, and auto-refreshes later. |
-| `blocks-os login:device` | Device-code login for terminals or agents where a browser callback is not convenient. Uses the same saved account profile. |
-| `blocks-os auth:status [--json]` | Show account config, token freshness, refresh-token availability, and selected project without printing secrets. |
+| `blocks-os login` | Device-code login. Prints a verification URL and user code, opens the browser to the verification page when possible so you only need to click approve, then polls until the device is authorized; stores account tokens and auto-refreshes later. |
+| `blocks-os auth:status [--json]` | Show only whether account/project access and refresh tokens are missing, valid, expired, or available. Does not print account config values. |
 | `blocks-os auth:refresh [--project] [--json]` | Force account token refresh, or project token refresh with `--project`. |
-| `blocks-os auth:repair [account] [--dry-run] [--yes] [--json]` | Clear broken local secure-store auth state while keeping account profile config. Use after OS credential migration, stale DPAPI, or corrupted tokens. |
-| `blocks-os auth:list [--json]` | List saved account profiles without showing secrets. |
-| `blocks-os auth:show [account]` | Print one account profile with secret redacted as `configured` or `missing`. |
-| `blocks-os auth:use <account>` | Switch the active named account profile. Normal single-account use does not need this. |
-| `blocks-os auth:remove <account>` | Remove account config, cached tokens, and stored client secret for that account. |
+| `blocks-os auth:remove <account>` | Clear cached tokens and stored local credentials for that account. The packaged default OS account is restored from package defaults. |
 | `blocks-os logout` | Revoke the current refresh token when possible and remove local session data. |
 | `blocks-os projects:list [--json]` | List accessible Blocks projects via `/os/v4/Project/Gets` using the account token. Read-only. |
 | `blocks-os projects:get [tenantId] [--json]` | Read one project from `Project/Gets`. Uses selected project when `tenantId` is omitted. Read-only. |
@@ -82,7 +60,7 @@ node bin/run.js --version
 | `blocks-os release:status <buildId> [--json]` | Read Release build status by build id. Read-only. |
 | `blocks-os release:builds:list --repo-id <repoId> [--json]` | List Release build details for a repository. Read-only. |
 | `blocks-os release:builds:get <buildId> [--json]` | Alias for `release:status`. Read-only. |
-| `blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain-or-url> --blocks-api-url <url> [--client-id <oidcClientId>] [--oidc-url <url>]` | Create a Vite React starter app that talks to Blocks exclusively through `@seliseblocks/client` (a single `createBlocksClient()` instance) using the SDK hosted IdP flow: `blocksClient.auth.idp.redirectToProvider()` on login click and `blocksClient.auth.idp.callback()` on `/login/callback`. Includes route guards, auto-refresh through `auth.oidc.refreshToken()`, live `auth`/`iam`/`data`/`localization` SDK examples, environment config, and safe `.gitignore` defaults. Register a **public** OIDC client with redirect URIs for both your local HTTPS dev origin and `--app-domain`, then pass its id as `--client-id` (or set `VITE_BLOCKS_OIDC_CLIENT_ID` in `.env` afterwards). `--oidc-url` defaults to `https://iam.seliseblocks.com`. |
+| `blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain-or-url> [--client-id <oidcClientId>]` | Create a Vite React starter app that talks to Blocks exclusively through `@seliseblocks/client` (a single `createBlocksClient()` instance) using the SDK hosted IdP flow: `blocksClient.auth.idp.redirectToProvider()` on login click and `blocksClient.auth.idp.callback()` on `/login/callback`. Includes route guards, auto-refresh through `auth.oidc.refreshToken()`, live `auth`/`iam`/`data`/`localization` SDK examples, environment config, and safe `.gitignore` defaults. Register a **public** OIDC client with redirect URIs for both your local HTTPS dev origin and `--app-domain`, then pass its id as `--client-id` (or set `VITE_BLOCKS_OIDC_CLIENT_ID` in `.env` afterwards). |
 
 Use `--json` on commands when AI or automation needs machine-readable output. Use `--dry-run` before mutations and `--yes` only after approval.
 
@@ -109,24 +87,23 @@ Add the generated `VITE_BLOCKS_DEV_HOST` to your hosts file, for example:
 
 Then open `https://<VITE_BLOCKS_DEV_HOST>:5173`, not plain `http://`. The generated cert script uses a Node dependency, so it works from normal PowerShell after `npm install`; OpenSSL/Git Bash is not required.
 
-OIDC account settings are saved in the OS-specific config directory. Access and refresh tokens are stored in the same OS-aware secure backend as client secrets when available, and are refreshed automatically before cloud commands when a refresh token is available.
+OIDC account settings are saved in the OS-specific config directory. Access and refresh tokens are stored in an OS-aware secure backend when available, and are refreshed automatically before cloud commands when a refresh token is available.
 
-Client secrets and OAuth tokens use an OS-aware credential backend:
+OAuth tokens use an OS-aware credential backend:
 
-| OS | Secret backend |
+| OS | Credential backend |
 |---|---|
 | Windows | DPAPI-encrypted value in the CLI secret metadata file, scoped to the current Windows user. |
 | macOS | Keychain generic password for the `seliseblocks-cli-os` service. |
 | Linux | Secret Service through `secret-tool` when available. |
 | Fallback | `0600` file storage in the CLI config directory. Set `BLOCKS_OS_SECRET_STORE=file` to force this mode for CI or minimal containers. |
 
-Use `blocks-os doctor` or `blocks-os auth:status` to see which backend is active. Secrets and tokens are never printed by CLI status/show commands.
+Use `blocks-os doctor` or `blocks-os auth:status` to see which backend is active. Tokens are never printed by CLI status commands.
 
-If the active OS credential backend cannot decrypt old local auth state after a Windows profile change, machine migration, Keychain reset, or corrupted token cache, repair local state and login again:
+If the active OS credential backend cannot decrypt old local auth state after a Windows profile change, machine migration, Keychain reset, or corrupted token cache, clear local auth state and log in again:
 
 ```bash
-blocks-os auth:repair --yes
-blocks-os auth:add --client-id <cli-client-id> --client-secret <cli-client-secret>
+blocks-os auth:remove <account>
 blocks-os login
 ```
 

package/dist/commands/auth/status.js

@@ -1,75 +1,36 @@
 import { parseFlags, stringFlag } from "../../lib/args.js";
 import { getAccountProfile, readConfig } from "../../lib/config.js";
 import { isExpiring } from "../../lib/token.js";
-import { readTokenStore, tokenStoreInfo } from "../../lib/token-store.js";
+import { readTokenStore } from "../../lib/token-store.js";
 import { writeOutput } from "../../lib/output.js";
-import { getClientSecret, secretStoreInfo } from "../../lib/secret-store.js";
 export async function authStatus(argv = []) {
     const { flags } = parseFlags(argv);
     const config = await readConfig();
     const store = await readTokenStore();
-    const tokenInfo = await tokenStoreInfo();
-    const accountOverride = stringFlag(flags, "account");
-    if (Object.keys(config.accounts).length === 0) {
-        if (flags.json) {
-            writeOutput({ configured: false, message: "No OIDC accounts configured." }, flags);
-            return;
-        }
-        console.log("No OIDC accounts configured. Run 'blocks-os auth:add --client-id <id> --client-secret <secret>'.");
-        return;
-    }
-    const { name, profile } = getAccountProfile(config, accountOverride);
-    const clientSecret = await getClientSecret(name);
-    const secretInfo = await secretStoreInfo();
+    const accountOverride = stringFlag(flags, "account") || undefined;
+    const { name } = getAccountProfile(config, accountOverride);
     const accountToken = store.accounts[name]?.account;
     const projectToken = config.selectedProject?.tenantId
         ? store.accounts[name]?.projects?.[config.selectedProject.tenantId]
         : undefined;
     if (flags.json) {
         writeOutput({
-            configured: true,
-            activeAccount: config.activeAccount ?? null,
-            account: name,
-            apiUrl: profile.apiUrl,
-            clientId: profile.clientId,
-            clientSecret: clientSecret ? "configured" : "missing",
-            secretStorage: secretInfo,
-            tokenStorage: tokenInfo,
-            oidcUrl: profile.oidcUrl,
-            osUrl: profile.osUrl,
-            scope: profile.scope,
-            rootTenant: profile.rootTenantId ?? accountToken?.accountTenant ?? null,
-            accountAccessToken: accountToken?.accessToken ? tokenState(accountToken.expiresAt) : "missing",
-            accountRefreshToken: accountToken?.refreshToken ? "available" : "missing",
-            accountRefreshTokenExpiresAt: accountToken?.refreshTokenExpiresAt ?? null,
-            selectedProject: config.selectedProject?.tenantId ?? null,
-            projectAccessToken: projectToken?.accessToken ? tokenState(projectToken.expiresAt) : "not created",
-            projectRefreshToken: projectToken?.refreshToken ? "available" : "missing",
-            projectRefreshTokenExpiresAt: projectToken?.refreshTokenExpiresAt ?? null
+            accountAccessToken: tokenState(accountToken?.accessToken, accountToken?.expiresAt),
+            accountRefreshToken: tokenState(accountToken?.refreshToken, accountToken?.refreshTokenExpiresAt),
+            projectAccessToken: tokenState(projectToken?.accessToken, projectToken?.expiresAt),
+            projectRefreshToken: tokenState(projectToken?.refreshToken, projectToken?.refreshTokenExpiresAt)
         }, flags);
         return;
     }
-    console.log(`Active account: ${config.activeAccount ?? "missing"}`);
-    console.log(`Account: ${name}`);
-    console.log(`API URL: ${profile.apiUrl}`);
-    console.log(`OIDC URL: ${profile.oidcUrl}`);
-    console.log(`OS URL: ${profile.osUrl}`);
-    console.log(`OIDC client id: ${profile.clientId}`);
-    console.log(`OIDC client secret: ${clientSecret ? "configured" : "missing"}`);
-    console.log(`Secret storage: ${secretInfo.backend} (${secretInfo.detail})`);
-    console.log(`Token storage: ${tokenInfo.backend} (${tokenInfo.detail})`);
-    console.log(`Scope: ${profile.scope}`);
-    console.log(`Root tenant: ${profile.rootTenantId ?? accountToken?.accountTenant ?? "missing"}`);
-    console.log(`Account access token: ${accountToken?.accessToken ? tokenState(accountToken.expiresAt) : "missing"}`);
-    console.log(`Account refresh token: ${accountToken?.refreshToken ? "available" : "missing"}`);
-    console.log(`Account refresh token expires: ${accountToken?.refreshTokenExpiresAt ?? "unknown"}`);
-    console.log(`Selected project: ${config.selectedProject?.tenantId ?? "not selected"}`);
-    console.log(`Project access token: ${projectToken?.accessToken ? tokenState(projectToken.expiresAt) : "not created"}`);
-    console.log(`Project refresh token: ${projectToken?.refreshToken ? "available" : "missing"}`);
-    console.log(`Project refresh token expires: ${projectToken?.refreshTokenExpiresAt ?? "unknown"}`);
+    console.log(`Account access token: ${tokenState(accountToken?.accessToken, accountToken?.expiresAt)}`);
+    console.log(`Account refresh token: ${tokenState(accountToken?.refreshToken, accountToken?.refreshTokenExpiresAt)}`);
+    console.log(`Project access token: ${tokenState(projectToken?.accessToken, projectToken?.expiresAt)}`);
+    console.log(`Project refresh token: ${tokenState(projectToken?.refreshToken, projectToken?.refreshTokenExpiresAt)}`);
 }
-function tokenState(expiresAt) {
+function tokenState(token, expiresAt) {
+    if (!token)
+        return "missing";
     if (!expiresAt)
-        return "unknown expiry";
-    return `${isExpiring(expiresAt) ? "expired/expiring" : "fresh"} until ${expiresAt}`;
+        return "available";
+    return isExpiring(expiresAt) ? "expired" : "valid";
 }

package/dist/commands/doctor.js

@@ -5,7 +5,7 @@ import { parseFlags } from "../lib/args.js";
 import { writeOutput } from "../lib/output.js";
 import { isExpiring } from "../lib/token.js";
 import { readTokenStore, tokenPath, tokenStoreInfo } from "../lib/token-store.js";
-import { getClientSecret, secretPath, secretStoreInfo } from "../lib/secret-store.js";
+import { secretPath, secretStoreInfo } from "../lib/secret-store.js";
 export async function doctor(argv = []) {
     const { flags } = parseFlags(argv);
     const config = await readConfig();
@@ -17,8 +17,7 @@ export async function doctor(argv = []) {
         { label: "OIDC account configured", ok: Object.keys(config.accounts).length > 0, detail: config.activeAccount ?? "missing" }
     ];
     if (Object.keys(config.accounts).length > 0) {
-        const { name, profile } = getAccountProfile(config);
-        const clientSecret = await getClientSecret(name);
+        const { name } = getAccountProfile(config);
         const secretInfo = await secretStoreInfo();
         const accountToken = store.accounts[name]?.account;
         let sessionValid = false;
@@ -38,7 +37,7 @@ export async function doctor(argv = []) {
         const projectToken = config.selectedProject?.tenantId
             ? store.accounts[name]?.projects?.[config.selectedProject.tenantId]
             : undefined;
-        checks.push({ label: "API URL configured", ok: Boolean(profile.apiUrl), detail: profile.apiUrl }, { label: "OIDC URL configured", ok: Boolean(profile.oidcUrl), detail: profile.oidcUrl }, { label: "OS URL configured", ok: Boolean(profile.osUrl), detail: profile.osUrl }, { label: "OIDC client configured", ok: Boolean(profile.clientId), detail: profile.clientId }, { label: "OIDC client secret", ok: Boolean(clientSecret), detail: clientSecret ? "configured" : "missing" }, { label: "Secret storage backend", ok: true, detail: `${secretInfo.backend} (${secretInfo.detail})` }, { label: "Redirect URI configured", ok: Boolean(profile.redirectUri), detail: profile.redirectUri }, { label: "Account session", ok: sessionValid, detail: sessionDetail }, { label: "Account refresh token", ok: Boolean(refreshedAccountToken?.refreshToken), detail: refreshedAccountToken?.refreshToken ? "available" : "missing" }, { label: "Account access token cached", ok: Boolean(refreshedAccountToken?.accessToken && !isExpiring(refreshedAccountToken.expiresAt)), detail: refreshedAccountToken?.expiresAt ?? "missing" }, { label: "Project selected", ok: Boolean(config.selectedProject?.tenantId), detail: config.selectedProject?.tenantId ?? "missing" }, { label: "Project access token cached", ok: Boolean(!projectToken?.accessToken || !isExpiring(projectToken.expiresAt)), detail: projectToken?.expiresAt ?? "not created yet" });
+        checks.push({ label: "Credential storage backend", ok: true, detail: `${secretInfo.backend} (${secretInfo.detail})` }, { label: "Account session", ok: sessionValid, detail: sessionDetail }, { label: "Account refresh token", ok: Boolean(refreshedAccountToken?.refreshToken), detail: refreshedAccountToken?.refreshToken ? "available" : "missing" }, { label: "Account access token cached", ok: Boolean(refreshedAccountToken?.accessToken && !isExpiring(refreshedAccountToken.expiresAt)), detail: refreshedAccountToken?.expiresAt ?? "missing" }, { label: "Project selected", ok: Boolean(config.selectedProject?.tenantId), detail: config.selectedProject?.tenantId ?? "missing" }, { label: "Project access token cached", ok: Boolean(!projectToken?.accessToken || !isExpiring(projectToken.expiresAt)), detail: projectToken?.expiresAt ?? "not created yet" });
     }
     let configFile = "missing";
     try {

package/dist/commands/init.js

@@ -1,13 +1,15 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
+import { defaults } from "../lib/config.js";
 export async function init() {
+    const env = defaults();
     await mkdir(join(process.cwd(), "blocks", "data", "schemas"), { recursive: true });
     await mkdir(join(process.cwd(), "blocks", "localization"), { recursive: true });
     await mkdir(join(process.cwd(), "blocks", "release"), { recursive: true });
     await writeIfMissing("blocks.json", `${JSON.stringify({
         project: {
             tenantId: "",
-            apiUrl: "https://api.seliseblocks.com",
+            apiUrl: env.apiUrl,
             appDomain: ""
         },
         data: {
@@ -29,7 +31,7 @@ export async function init() {
         strategy: "configured-pipeline"
     }, null, 2)}\n`);
     await writeIfMissing(".env.example", [
-        "VITE_BLOCKS_API_URL=https://api.seliseblocks.com",
+        `VITE_BLOCKS_API_URL=${env.apiUrl}`,
         "VITE_BLOCKS_X_BLOCKS_KEY=",
         "VITE_BLOCKS_APP_DOMAIN=",
         ""

package/dist/commands/login.d.ts

@@ -1,2 +1 @@
 export declare function login(argv: string[]): Promise<void>;
-export declare function loginWithDeviceProfile(accountOverride?: string): Promise<void>;

package/dist/commands/login.js

@@ -1,75 +1,35 @@
-import { URLSearchParams } from "node:url";
 import { parseFlags, stringFlag } from "../lib/args.js";
-import { exchangeAuthorizationCode, pollDeviceToken, requestDeviceAuthorization } from "../lib/auth.js";
+import { pollDeviceToken, requestDeviceAuthorization } from "../lib/auth.js";
 import { getAccountProfile, readConfig, writeConfig } from "../lib/config.js";
-import { waitForAuthorizationCode } from "../lib/login-server.js";
 import { openBrowser } from "../lib/open-browser.js";
-import { createPkcePair } from "../lib/pkce.js";
-import { applyAccountToken, randomState } from "../lib/token.js";
+import { applyAccountToken } from "../lib/token.js";
 import { readTokenStore, writeTokenStore } from "../lib/token-store.js";
-import { getClientSecret } from "../lib/secret-store.js";
 export async function login(argv) {
     const { flags } = parseFlags(argv);
     const accountOverride = stringFlag(flags, "account");
-    const config = await readConfig();
-    const { name, profile } = getAccountProfile(config, accountOverride);
-    const redirectUri = profile.redirectUri;
-    if (!redirectUri) {
-        throw new Error("OIDC redirectUri is missing. Run 'blocks-os auth:add --client-id <id> --client-secret <secret>' to restore the default redirect URI.");
-    }
-    const url = new URL(redirectUri);
-    const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
-    const state = randomState();
-    const { challenge, verifier } = createPkcePair();
-    const authUrl = new URL("/api/oidc/authorize", profile.oidcUrl);
-    authUrl.search = new URLSearchParams({
-        client_id: profile.clientId,
-        code_challenge: challenge,
-        code_challenge_method: "S256",
-        redirect_uri: redirectUri,
-        response_type: "code",
-        scope: profile.scope,
-        state,
-        tenant_id: profile.rootTenantId ?? ""
-    }).toString();
-    const codePromise = waitForAuthorizationCode(port, state);
-    console.log("Open this URL to log in to Blocks OS:");
-    console.log(authUrl.toString());
-    const opened = await openBrowser(authUrl.toString());
-    if (!opened) {
-        console.log("Browser auto-open is unavailable on this machine. Open the URL manually.");
-    }
-    const code = await codePromise;
-    const token = await exchangeAuthorizationCode({
-        account: name,
-        clientId: profile.clientId,
-        clientSecret: await getClientSecret(name),
-        code,
-        codeVerifier: verifier,
-        oidcUrl: profile.oidcUrl,
-        redirectUri,
-        rootTenantId: profile.rootTenantId
-    });
-    const latest = await readConfig();
-    const latestStore = await readTokenStore();
-    const next = applyAccountToken(latest, latestStore, name, profile.clientId, token);
-    await writeConfig(next.config);
-    await writeTokenStore(next.store);
-    console.log(`Logged in to account '${name}' for tenant ${next.store.accounts[name].account.accountTenant}`);
-}
-export async function loginWithDeviceProfile(accountOverride) {
     const config = await readConfig();
     const { name, profile } = getAccountProfile(config, accountOverride);
     const device = await requestDeviceAuthorization(profile);
     console.log("Authorize this device:");
     console.log(`URL: ${device.verification_uri_complete ?? device.verification_uri}`);
     console.log(`Code: ${device.user_code}`);
+    if (device.verification_uri_complete) {
+        const opened = await openBrowser(device.verification_uri_complete);
+        console.log(opened
+            ? "Opened your browser to approve this device -- just confirm the code above."
+            : "Browser auto-open is unavailable on this machine. Open the URL above manually.");
+    }
+    else {
+        console.log("Open the URL above and enter the code to approve this device.");
+    }
     console.log("Waiting for approval...");
-    const token = await pollDeviceToken(profile, device);
+    const token = await pollDeviceToken(profile, device, {
+        onWait: (seconds) => console.log(`Checking for approval in ${seconds}s...`)
+    });
     const latest = await readConfig();
     const latestStore = await readTokenStore();
     const next = applyAccountToken(latest, latestStore, name, profile.clientId, token);
     await writeConfig(next.config);
     await writeTokenStore(next.store);
-    console.log(`Logged in to account '${name}' for tenant ${next.store.accounts[name].account.accountTenant}`);
+    console.log("Login done.");
 }

package/dist/commands/new/web.js

@@ -8,7 +8,7 @@ export async function newWeb(argv) {
     if (!name)
         throw new Error("Missing web app name.");
     const appDomain = stringFlag(parsed.flags, "app-domain", { required: true });
-    const apiUrl = stringFlag(parsed.flags, "blocks-api-url", { defaultValue: "https://api.seliseblocks.com" });
+    const apiUrl = stringFlag(parsed.flags, "blocks-api-url", { defaultValue: defaults().apiUrl });
     const oidcUrl = stringFlag(parsed.flags, "oidc-url", { defaultValue: defaults().oidcUrl });
     const xBlocksKey = stringFlag(parsed.flags, "x-blocks-key", { required: true });
     const oidcClientId = stringFlag(parsed.flags, "client-id");

package/dist/index.js

@@ -1,11 +1,6 @@
-import { authAdd } from "./commands/auth/add.js";
-import { authList } from "./commands/auth/list.js";
 import { authRefresh } from "./commands/auth/refresh.js";
-import { authRepair } from "./commands/auth/repair.js";
 import { authRemove } from "./commands/auth/remove.js";
-import { authShow } from "./commands/auth/show.js";
 import { authStatus } from "./commands/auth/status.js";
-import { authUse } from "./commands/auth/use.js";
 import { doctor } from "./commands/doctor.js";
 import { dataReload } from "./commands/data/reload.js";
 import { dataValidate } from "./commands/data/validate.js";
@@ -20,7 +15,6 @@ import { localizationPull } from "./commands/localization/pull.js";
 import { localizationPush } from "./commands/localization/push.js";
 import { localizationValidate } from "./commands/localization/validate.js";
 import { login } from "./commands/login.js";
-import { loginDevice } from "./commands/login-device.js";
 import { logout } from "./commands/logout.js";
 import { newWeb } from "./commands/new/web.js";
 import { createProject } from "./commands/projects/create.js";
@@ -40,18 +34,6 @@ try {
     else if (!command || command === "help" || command === "--help" || command === "-h") {
         printHelp();
     }
-    else if (command === "auth:add" || (command === "auth" && subcommand === "add")) {
-        await authAdd(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
-    else if (command === "auth:list" || (command === "auth" && subcommand === "list")) {
-        await authList(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
-    else if (command === "auth:use" || (command === "auth" && subcommand === "use")) {
-        await authUse(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
-    else if (command === "auth:show" || (command === "auth" && subcommand === "show")) {
-        await authShow(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
     else if (command === "auth:remove" || (command === "auth" && subcommand === "remove")) {
         await authRemove(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
     }
@@ -61,27 +43,18 @@ try {
     else if (command === "auth:refresh") {
         await authRefresh([subcommand, ...rest].filter(Boolean));
     }
-    else if (command === "auth:repair") {
-        await authRepair([subcommand, ...rest].filter(Boolean));
-    }
     else if (command === "auth" && subcommand === "status") {
         await authStatus(rest);
     }
     else if (command === "auth" && subcommand === "refresh") {
         await authRefresh(rest);
     }
-    else if (command === "auth" && subcommand === "repair") {
-        await authRepair(rest);
-    }
     else if (command === "doctor") {
         await doctor([subcommand, ...rest].filter(Boolean));
     }
     else if (command === "init") {
         await init();
     }
-    else if (command === "login:device") {
-        await loginDevice([subcommand, ...rest].filter(Boolean));
-    }
     else if (command === "login") {
         await login([subcommand, ...rest].filter(Boolean));
     }
@@ -181,7 +154,7 @@ function toCliError(error) {
         return { code: "not_logged_in", message, nextStep: "blocks-os login" };
     }
     if (message.includes("token expired") || message.includes("refresh token") || message.includes("cannot decrypt")) {
-        return { code: "auth_repair_required", message, nextStep: "blocks-os auth:repair --yes && blocks-os auth:add --client-id <id> --client-secret <secret> && blocks-os login" };
+        return { code: "auth_repair_required", message, nextStep: "blocks-os login" };
     }
     if (message.includes("No project selected")) {
         return { code: "project_not_selected", message, nextStep: "blocks-os use <tenantId>" };
@@ -216,41 +189,22 @@ Setup and health:
     file locations. Does not mutate cloud resources.
 
 Auth:
-  blocks-os auth:add [account] --client-id <id> --client-secret <secret>
-    Save OIDC client settings for the CLI. Defaults target production Blocks
-    URLs, root tenant, scope, and localhost callback. Secret is stored separately.
-
   blocks-os login
-    Browser Authorization Code + PKCE login. Opens IAM, captures the localhost
-    callback, stores account access and refresh tokens, and auto-refreshes later.
-
-  blocks-os login:device
-    Device-code login for terminals or agents where a browser callback is not
-    convenient. Uses the same saved account profile.
+    Device-code login. Prints a verification URL and user code, opens the
+    browser to the verification page when possible so you only need to click
+    approve, then polls until the device is authorized; stores account access
+    and refresh tokens and auto-refreshes later.
 
   blocks-os auth:status [--json]
-    Show configured account, token freshness, refresh-token availability, and
-    selected project without printing secrets.
+    Show only whether account/project access and refresh tokens are missing,
+    valid, expired, or available. Does not print account config values.
 
   blocks-os auth:refresh [--project] [--json]
     Force account token refresh, or project token refresh with --project.
 
-  blocks-os auth:repair [account] [--dry-run] [--yes] [--json]
-    Clear broken local secure-store auth state while keeping account profile
-    config. Use after OS credential migration, stale DPAPI, or corrupted tokens.
-
-  blocks-os auth:list [--json]
-    List saved account profiles without showing secrets.
-
-  blocks-os auth:show [account]
-    Print one account profile with secret redacted as configured/missing.
-
-  blocks-os auth:use <account>
-    Switch the active named account profile.
-
   blocks-os auth:remove <account>
-    Remove account config, cached tokens, and stored client secret for that
-    account.
+    Clear cached tokens and stored local credentials for that account. The
+    packaged default OS account is restored from package defaults.
 
   blocks-os logout
     Revoke the current refresh token when possible and remove local session data.
@@ -334,7 +288,7 @@ Release:
     Alias for release:status. Read-only.
 
 Scaffold:
-  blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain> --blocks-api-url <url> [--client-id <oidcClientId>] [--oidc-url <url>]
+  blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain> [--client-id <oidcClientId>]
     Create a Vite React starter app with a real browser Authorization Code +
     PKCE login flow against Blocks IAM (login page, /login/callback handler,
     route guards), plus Data schema listing, Release build lookup, environment

package/dist/lib/auth.d.ts

@@ -20,18 +20,11 @@ export type DeviceAuthorizationResponse = {
     verification_uri: string;
     verification_uri_complete?: string;
 };
-export declare function exchangeAuthorizationCode(args: {
-    account: string;
-    clientId: string;
-    clientSecret?: string;
-    code: string;
-    codeVerifier?: string;
-    oidcUrl: string;
-    redirectUri: string;
-    rootTenantId?: string;
-}): Promise<TokenResponse>;
+export type DevicePollingOptions = {
+    onWait?: (seconds: number) => void;
+};
 export declare function requestDeviceAuthorization(profile: AccountProfile): Promise<DeviceAuthorizationResponse>;
-export declare function pollDeviceToken(profile: AccountProfile, device: DeviceAuthorizationResponse): Promise<TokenResponse>;
+export declare function pollDeviceToken(profile: AccountProfile, device: DeviceAuthorizationResponse, options?: DevicePollingOptions): Promise<TokenResponse>;
 export declare function getAccountSession(accountOverride?: string): Promise<AccountSession>;
 export declare function selectProject(tenantId: string): Promise<void>;
 export declare function getImpersonatedProjectSession(accountOverride?: string, tenantOverride?: string): Promise<ProjectSession>;