@seliseblocks/cli-os 0.1.2 → 0.1.4

package/dist/index.js

@@ -1,11 +1,7 @@
-import { authAdd } from "./commands/auth/add.js";
-import { authList } from "./commands/auth/list.js";
 import { authRefresh } from "./commands/auth/refresh.js";
-import { authRepair } from "./commands/auth/repair.js";
 import { authRemove } from "./commands/auth/remove.js";
-import { authShow } from "./commands/auth/show.js";
 import { authStatus } from "./commands/auth/status.js";
-import { authUse } from "./commands/auth/use.js";
+import { deselectProject } from "./commands/deselect.js";
 import { doctor } from "./commands/doctor.js";
 import { dataReload } from "./commands/data/reload.js";
 import { dataValidate } from "./commands/data/validate.js";
@@ -20,7 +16,6 @@ import { localizationPull } from "./commands/localization/pull.js";
 import { localizationPush } from "./commands/localization/push.js";
 import { localizationValidate } from "./commands/localization/validate.js";
 import { login } from "./commands/login.js";
-import { loginDevice } from "./commands/login-device.js";
 import { logout } from "./commands/logout.js";
 import { newWeb } from "./commands/new/web.js";
 import { createProject } from "./commands/projects/create.js";
@@ -40,18 +35,6 @@ try {
     else if (!command || command === "help" || command === "--help" || command === "-h") {
         printHelp();
     }
-    else if (command === "auth:add" || (command === "auth" && subcommand === "add")) {
-        await authAdd(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
-    else if (command === "auth:list" || (command === "auth" && subcommand === "list")) {
-        await authList(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
-    else if (command === "auth:use" || (command === "auth" && subcommand === "use")) {
-        await authUse(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
-    else if (command === "auth:show" || (command === "auth" && subcommand === "show")) {
-        await authShow(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
     else if (command === "auth:remove" || (command === "auth" && subcommand === "remove")) {
         await authRemove(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
     }
@@ -61,27 +44,18 @@ try {
     else if (command === "auth:refresh") {
         await authRefresh([subcommand, ...rest].filter(Boolean));
     }
-    else if (command === "auth:repair") {
-        await authRepair([subcommand, ...rest].filter(Boolean));
-    }
     else if (command === "auth" && subcommand === "status") {
         await authStatus(rest);
     }
     else if (command === "auth" && subcommand === "refresh") {
         await authRefresh(rest);
     }
-    else if (command === "auth" && subcommand === "repair") {
-        await authRepair(rest);
-    }
     else if (command === "doctor") {
         await doctor([subcommand, ...rest].filter(Boolean));
     }
     else if (command === "init") {
         await init();
     }
-    else if (command === "login:device") {
-        await loginDevice([subcommand, ...rest].filter(Boolean));
-    }
     else if (command === "login") {
         await login([subcommand, ...rest].filter(Boolean));
     }
@@ -106,6 +80,9 @@ try {
     else if (command === "use") {
         await useProject([subcommand, ...rest].filter(Boolean));
     }
+    else if (command === "deselect") {
+        await deselectProject([subcommand, ...rest].filter(Boolean));
+    }
     else if (command === "new" && subcommand === "web") {
         await newWeb(rest);
     }
@@ -181,7 +158,7 @@ function toCliError(error) {
         return { code: "not_logged_in", message, nextStep: "blocks-os login" };
     }
     if (message.includes("token expired") || message.includes("refresh token") || message.includes("cannot decrypt")) {
-        return { code: "auth_repair_required", message, nextStep: "blocks-os auth:repair --yes && blocks-os auth:add --client-id <id> --client-secret <secret> && blocks-os login" };
+        return { code: "auth_repair_required", message, nextStep: "blocks-os login" };
     }
     if (message.includes("No project selected")) {
         return { code: "project_not_selected", message, nextStep: "blocks-os use <tenantId>" };
@@ -216,41 +193,22 @@ Setup and health:
     file locations. Does not mutate cloud resources.
 
 Auth:
-  blocks-os auth:add [account] --client-id <id> --client-secret <secret>
-    Save OIDC client settings for the CLI. Defaults target production Blocks
-    URLs, root tenant, scope, and localhost callback. Secret is stored separately.
-
   blocks-os login
-    Browser Authorization Code + PKCE login. Opens IAM, captures the localhost
-    callback, stores account access and refresh tokens, and auto-refreshes later.
-
-  blocks-os login:device
-    Device-code login for terminals or agents where a browser callback is not
-    convenient. Uses the same saved account profile.
+    Device-code login. Prints a verification URL and user code, opens the
+    browser to the verification page when possible so you only need to click
+    approve, then polls until the device is authorized; stores account access
+    and refresh tokens and auto-refreshes later.
 
   blocks-os auth:status [--json]
-    Show configured account, token freshness, refresh-token availability, and
-    selected project without printing secrets.
+    Show only whether account/project access and refresh tokens are missing,
+    valid, expired, or available. Does not print account config values.
 
   blocks-os auth:refresh [--project] [--json]
     Force account token refresh, or project token refresh with --project.
 
-  blocks-os auth:repair [account] [--dry-run] [--yes] [--json]
-    Clear broken local secure-store auth state while keeping account profile
-    config. Use after OS credential migration, stale DPAPI, or corrupted tokens.
-
-  blocks-os auth:list [--json]
-    List saved account profiles without showing secrets.
-
-  blocks-os auth:show [account]
-    Print one account profile with secret redacted as configured/missing.
-
-  blocks-os auth:use <account>
-    Switch the active named account profile.
-
   blocks-os auth:remove <account>
-    Remove account config, cached tokens, and stored client secret for that
-    account.
+    Clear cached tokens and stored local credentials for that account. The
+    packaged default OS account is restored from package defaults.
 
   blocks-os logout
     Revoke the current refresh token when possible and remove local session data.
@@ -272,6 +230,12 @@ Projects:
     Save the selected project tenant globally and in blocks.json when present.
     Does not call cloud APIs.
 
+  blocks-os deselect
+    Clear the selected project tenant (globally and in blocks.json) and drop
+    its cached impersonation token. Use this to recover when an impersonated
+    project token has expired or failed, then run 'blocks-os use <tenantId>'
+    again to reselect and re-impersonate.
+
 IAM:
   blocks-os iam:me [--json]
     Read the current user from IAM using the account token. This is the only IAM
@@ -321,23 +285,31 @@ Localization:
 
 Release:
   blocks-os release:deploy --repo-id <repoId> [--dry-run] [--yes] [--json]
-    Trigger a manual Release build/deploy for a configured repository. Mutating;
-    no artifact upload is performed by this CLI.
+    Trigger a manual Release build/deploy for a configured repository using an
+    impersonated project token. Mutating; no artifact upload is performed by
+    this CLI.
 
   blocks-os release:status <buildId> [--json]
-    Read Release build status by build id. Read-only.
+    Read Release build status by build id using an impersonated project
+    token. Read-only.
 
   blocks-os release:builds:list --repo-id <repoId> [--json]
-    List Release build details for a repository. Read-only.
+    List Release build details for a repository using an impersonated project
+    token. Read-only.
 
   blocks-os release:builds:get <buildId> [--json]
     Alias for release:status. Read-only.
 
 Scaffold:
-  blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain> --blocks-api-url <url> [--client-id <oidcClientId>] [--oidc-url <url>]
+  blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain> [--client-id <oidcClientId>]
+                    [--blocks-api-url <url>] [--oidc-url <url>]
     Create a Vite React starter app with a real browser Authorization Code +
     PKCE login flow against Blocks IAM (login page, /login/callback handler,
     route guards), plus Data schema listing, Release build lookup, environment
     config, and safe .gitignore defaults.
+    --blocks-api-url defaults to the OS API (os.seliseblocks.com) if omitted -
+    pass the runtime Data/IAM/Localization gateway URL explicitly (typically
+    https://api.seliseblocks.com) for the scaffolded app to work at runtime.
+    --oidc-url defaults to https://iam.seliseblocks.com.
 `);
 }

package/dist/lib/auth.d.ts

@@ -20,18 +20,11 @@ export type DeviceAuthorizationResponse = {
     verification_uri: string;
     verification_uri_complete?: string;
 };
-export declare function exchangeAuthorizationCode(args: {
-    account: string;
-    clientId: string;
-    clientSecret?: string;
-    code: string;
-    codeVerifier?: string;
-    oidcUrl: string;
-    redirectUri: string;
-    rootTenantId?: string;
-}): Promise<TokenResponse>;
+export type DevicePollingOptions = {
+    onWait?: (seconds: number) => void;
+};
 export declare function requestDeviceAuthorization(profile: AccountProfile): Promise<DeviceAuthorizationResponse>;
-export declare function pollDeviceToken(profile: AccountProfile, device: DeviceAuthorizationResponse): Promise<TokenResponse>;
+export declare function pollDeviceToken(profile: AccountProfile, device: DeviceAuthorizationResponse, options?: DevicePollingOptions): Promise<TokenResponse>;
 export declare function getAccountSession(accountOverride?: string): Promise<AccountSession>;
 export declare function selectProject(tenantId: string): Promise<void>;
 export declare function getImpersonatedProjectSession(accountOverride?: string, tenantOverride?: string): Promise<ProjectSession>;

package/dist/lib/auth.js

@@ -5,18 +5,7 @@ import { getClientSecret } from "./secret-store.js";
 import { CliActionableError } from "./errors.js";
 const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 const FALLBACK_IMPERSONATION_CLIENT_ID = "57214b67-aa9c-4307-92ab-a25e35180fac";
-export async function exchangeAuthorizationCode(args) {
-    const body = new URLSearchParams({
-        client_id: args.clientId,
-        code: args.code,
-        grant_type: "authorization_code",
-        redirect_uri: args.redirectUri
-    });
-    if (args.codeVerifier)
-        body.set("code_verifier", args.codeVerifier);
-    applyClientSecret(body, args.clientSecret);
-    return postFormToken(args.oidcUrl, body, args.rootTenantId);
-}
+const MAX_CONSECUTIVE_TRANSIENT_ERRORS = 3;
 export async function requestDeviceAuthorization(profile) {
     const rootTenantId = await resolveRootTenantForDevice(profile);
     if (!rootTenantId) {
@@ -45,34 +34,70 @@ export async function requestDeviceAuthorization(profile) {
     }
     return data;
 }
-export async function pollDeviceToken(profile, device) {
+export async function pollDeviceToken(profile, device, options = {}) {
     const rootTenantId = await resolveRootTenantForDevice(profile);
     if (!rootTenantId) {
         throw new Error("Device token polling requires rootTenantId in the account profile.");
     }
     let intervalSeconds = Math.max(device.interval ?? 5, 1);
     const deadline = Date.now() + device.expires_in * 1000;
+    let consecutiveTransientErrors = 0;
     while (Date.now() < deadline) {
-        await delay(intervalSeconds * 1000);
+        options.onWait?.(intervalSeconds);
+        await delay(Math.min(intervalSeconds * 1000, Math.max(deadline - Date.now(), 0)));
         const body = new URLSearchParams({
             client_id: profile.clientId,
             device_code: device.device_code,
             grant_type: DEVICE_GRANT
         });
         applyClientSecret(body, await getSecretForProfile(profile));
-        const response = await postFormToken(profile.oidcUrl, body, rootTenantId, false);
-        if (response.error === "authorization_pending")
+        let response;
+        try {
+            response = await postFormToken(profile.oidcUrl, body, rootTenantId, false);
+        }
+        catch (error) {
+            // The token endpoint itself never throws (postFormToken with
+            // throwOnOAuthError=false only returns error payloads) -- a thrown
+            // error here means fetch() failed before any response came back
+            // (DNS, connection reset, etc.). Treat it as transient and keep
+            // polling rather than aborting a multi-minute wait on one blip.
+            throwIfTooManyTransientErrors(++consecutiveTransientErrors, error);
             continue;
+        }
+        if (response.error === "authorization_pending") {
+            consecutiveTransientErrors = 0;
+            continue;
+        }
         if (response.error === "slow_down") {
+            consecutiveTransientErrors = 0;
             intervalSeconds += 5;
             continue;
         }
+        if (response.error === "token_request_failed") {
+            // Synthetic error from postFormToken for a non-JSON HTTP failure
+            // (e.g. a 502 from an upstream proxy) -- not a real OAuth rejection,
+            // so treat it the same as a network blip.
+            throwIfTooManyTransientErrors(++consecutiveTransientErrors, response.error_description ?? response.error);
+            continue;
+        }
+        if (response.error === "access_denied") {
+            throw new CliActionableError("Device authorization was denied.", "device_login_denied", "blocks-os login");
+        }
+        if (response.error === "expired_token") {
+            throw new CliActionableError("Device login expired before approval.", "device_login_expired", "blocks-os login");
+        }
         if (response.error) {
-            throw new Error(response.error_description ?? response.error);
+            throw new CliActionableError(response.error_description ?? response.error, "device_login_failed", "blocks-os login");
         }
         return response;
     }
-    throw new Error("Device login expired before approval.");
+    throw new CliActionableError("Device login expired before approval.", "device_login_expired", "blocks-os login");
+}
+function throwIfTooManyTransientErrors(count, cause) {
+    if (count <= MAX_CONSECUTIVE_TRANSIENT_ERRORS)
+        return;
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    throw new CliActionableError(`Could not reach the identity provider while waiting for device approval (${detail}).`, "device_login_network_error", "Check your network connection and run 'blocks-os login' again.");
 }
 export async function getAccountSession(accountOverride) {
     let config = await readConfig();

package/dist/lib/config.d.ts

@@ -4,7 +4,6 @@ export type AccountProfile = {
     createdAt: string;
     oidcUrl: string;
     osUrl: string;
-    redirectUri: string;
     rootTenantId?: string;
     scope: string;
     updatedAt: string;
@@ -31,9 +30,9 @@ export type BlocksCliConfig = {
 };
 export declare function defaults(): {
     apiUrl: string;
+    osClientId: string;
     oidcUrl: string;
     osUrl: string;
-    redirectUri: string;
     rootTenantId: string;
     scope: string;
 };

package/dist/lib/config.js

@@ -1,19 +1,20 @@
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
-const DEFAULT_API_URL = "https://api.seliseblocks.com";
+const BAD_GATEWAY_OS_URL = "https://api.seliseblocks.com/os/v4";
+const DEFAULT_API_URL = "https://os.seliseblocks.com";
+const DEFAULT_OS_CLIENT_ID = "4a633b13-1108-4fbf-84fd-b196c9dcdee2";
 const DEFAULT_OIDC_URL = "https://iam.seliseblocks.com";
 const DEFAULT_OS_URL = "https://os.seliseblocks.com";
-const BAD_GATEWAY_OS_URL = "https://api.seliseblocks.com/os/v4";
+const DEFAULT_PROFILE_TIMESTAMP = "2026-01-01T00:00:00.000Z";
 const DEFAULT_ROOT_TENANT_ID = "d7e5554c758541db8a18694b64ef423d";
 const DEFAULT_SCOPE = "openid profile offline_access";
-const DEFAULT_REDIRECT_URI = "http://127.0.0.1:8976/callback";
 export function defaults() {
     return {
         apiUrl: DEFAULT_API_URL,
+        osClientId: DEFAULT_OS_CLIENT_ID,
         oidcUrl: DEFAULT_OIDC_URL,
         osUrl: DEFAULT_OS_URL,
-        redirectUri: DEFAULT_REDIRECT_URI,
         rootTenantId: DEFAULT_ROOT_TENANT_ID,
         scope: DEFAULT_SCOPE
     };
@@ -40,9 +41,7 @@ export async function readConfig() {
     }
     catch (error) {
         if (error.code === "ENOENT") {
-            return {
-                accounts: {}
-            };
+            return defaultConfig();
         }
         throw error;
     }
@@ -61,7 +60,7 @@ export function normalizeAccountName(account) {
 export function getActiveAccountName(config, override) {
     const account = normalizeAccountName(override ?? config.activeAccount);
     if (!config.accounts[account]) {
-        throw new Error("OIDC account is not configured. Run 'blocks-os auth:add --client-id <id> --client-secret <secret>' first.");
+        throw new Error("OIDC account is not configured.");
     }
     return account;
 }
@@ -73,21 +72,54 @@ export function getAccountProfile(config, account) {
     };
 }
 function normalizeConfig(config) {
+    const env = defaults();
     const accounts = {};
     for (const [name, profile] of Object.entries(config.accounts ?? {})) {
-        accounts[name] = {
+        accounts[name] = name === "default" ? defaultProfile(profile) : {
             ...profile,
-            oidcUrl: profile.oidcUrl ?? DEFAULT_OIDC_URL,
-            osUrl: !profile.osUrl || profile.osUrl === BAD_GATEWAY_OS_URL ? DEFAULT_OS_URL : profile.osUrl,
-            rootTenantId: profile.rootTenantId ?? DEFAULT_ROOT_TENANT_ID
+            apiUrl: profile.apiUrl ?? env.apiUrl,
+            clientId: profile.clientId ?? env.osClientId,
+            createdAt: profile.createdAt ?? DEFAULT_PROFILE_TIMESTAMP,
+            oidcUrl: profile.oidcUrl ?? env.oidcUrl,
+            osUrl: !profile.osUrl || profile.osUrl === BAD_GATEWAY_OS_URL ? env.osUrl : profile.osUrl,
+            rootTenantId: profile.rootTenantId ?? env.rootTenantId,
+            scope: profile.scope ?? env.scope,
+            updatedAt: profile.updatedAt ?? DEFAULT_PROFILE_TIMESTAMP
+        };
+    }
+    if (Object.keys(accounts).length === 0) {
+        return {
+            ...defaultConfig(),
+            selectedProject: config.selectedProject
         };
     }
     return {
-        activeAccount: config.activeAccount,
+        activeAccount: config.activeAccount ?? "default",
         accounts,
         selectedProject: config.selectedProject
     };
 }
+function defaultConfig() {
+    return {
+        activeAccount: "default",
+        accounts: {
+            default: defaultProfile()
+        }
+    };
+}
+function defaultProfile(existing) {
+    const env = defaults();
+    return {
+        apiUrl: env.apiUrl,
+        clientId: env.osClientId,
+        createdAt: existing?.createdAt ?? DEFAULT_PROFILE_TIMESTAMP,
+        oidcUrl: env.oidcUrl,
+        osUrl: env.osUrl,
+        rootTenantId: env.rootTenantId,
+        scope: env.scope,
+        updatedAt: DEFAULT_PROFILE_TIMESTAMP
+    };
+}
 function nonEmptyEnv(name) {
     const value = process.env[name]?.trim();
     return value || undefined;

package/dist/lib/open-browser.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { platform } from "node:os";
+const LAUNCH_GRACE_PERIOD_MS = 500;
 export async function openBrowser(url) {
     const os = platform();
     const command = os === "win32" ? "rundll32" : os === "darwin" ? "open" : "xdg-open";
@@ -10,10 +11,32 @@ export async function openBrowser(url) {
             stdio: "ignore",
             windowsHide: true
         });
-        child.once("error", () => resolve(false));
-        child.once("spawn", () => {
+        let settled = false;
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(result);
+        };
+        child.once("error", () => settle(false));
+        // A launcher like xdg-open can spawn successfully and still exit
+        // non-zero almost immediately when no browser/display session is
+        // available (headless SSH, missing DISPLAY, etc.). Give it a short
+        // grace period to fail fast before treating the launch as a success
+        // and detaching the process.
+        const grace = setTimeout(() => {
             child.unref();
-            resolve(true);
+            settle(true);
+        }, LAUNCH_GRACE_PERIOD_MS);
+        child.once("exit", (code) => {
+            clearTimeout(grace);
+            if (code === 0 || code === null) {
+                child.unref();
+                settle(true);
+            }
+            else {
+                settle(false);
+            }
         });
     });
 }

package/dist/lib/secret-store.d.ts

@@ -17,7 +17,6 @@ export declare function writeSecretStore(store: BlocksSecretStore): Promise<void
 export declare function setClientSecret(account: string, clientSecret: string): Promise<void>;
 export declare function getClientSecret(account: string): Promise<string | undefined>;
 export declare function removeAccountSecrets(account: string): Promise<void>;
-export declare function clearSecretStore(): Promise<void>;
 export declare function setSecretValue(key: string, value: string): Promise<void>;
 export declare function getSecretValue(key: string): Promise<string | undefined>;
 export declare function removeSecretValue(key: string): Promise<void>;

package/dist/lib/secret-store.js

@@ -1,5 +1,5 @@
 import { execFile, spawn } from "node:child_process";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { platform } from "node:os";
 import { dirname, join } from "node:path";
 import { promisify } from "node:util";
@@ -57,9 +57,6 @@ export async function removeAccountSecrets(account) {
     await removeSecretValue(`client-secret:${account}`);
     await removeFallbackSecret(account);
 }
-export async function clearSecretStore() {
-    await rm(secretPath(), { force: true });
-}
 export async function setSecretValue(key, value) {
     const backend = await resolveBackend();
     if (backend === "macos-keychain") {

package/dist/lib/token-store.d.ts

@@ -15,4 +15,3 @@ export declare function tokenStoreInfo(): Promise<{
 export declare function readTokenStore(): Promise<BlocksTokenStore>;
 export declare function writeTokenStore(store: BlocksTokenStore): Promise<void>;
 export declare function removeAccountTokens(account: string): Promise<void>;
-export declare function clearTokenStore(): Promise<void>;

package/dist/lib/token-store.js

@@ -1,7 +1,7 @@
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { configDir, configPath } from "./config.js";
-import { getSecretValue, removeSecretValue, secretStoreInfo, setSecretValue } from "./secret-store.js";
+import { getSecretValue, secretStoreInfo, setSecretValue } from "./secret-store.js";
 const TOKEN_SECRET_KEY = "oauth-token-store";
 export function tokenPath() {
     return join(configDir(), "tokens.json");
@@ -56,10 +56,6 @@ export async function removeAccountTokens(account) {
     const { [account]: _, ...accounts } = store.accounts;
     await writeTokenStore({ accounts });
 }
-export async function clearTokenStore() {
-    await removeSecretValue(TOKEN_SECRET_KEY);
-    await rm(tokenPath(), { force: true });
-}
 function normalizeTokenStore(store) {
     return {
         accounts: store?.accounts ?? {}

package/dist/lib/token.d.ts

@@ -13,7 +13,6 @@ export type TokenResponse = {
     scope?: string;
     token_type?: string;
 };
-export declare function randomState(): string;
 export declare function expiresAtFromToken(response: TokenResponse, accessToken: string): string | undefined;
 export declare function expiresAtFromJwtFirst(response: TokenResponse, accessToken: string): string | undefined;
 export declare function refreshExpiresAtFromToken(response: TokenResponse, refreshToken?: string): string | undefined;

package/dist/lib/token.js

@@ -1,10 +1,6 @@
-import { randomBytes } from "node:crypto";
 import { decodeJwtPayload, tenantFromToken } from "./jwt.js";
 const EXPIRY_SKEW_MS = 60_000;
 const DEFAULT_REFRESH_TOKEN_LIFETIME_SECONDS = 30 * 60;
-export function randomState() {
-    return randomBytes(24).toString("base64url");
-}
 export function expiresAtFromToken(response, accessToken) {
     if (typeof response.expires_in === "number" && response.expires_in > 0) {
         return new Date(Date.now() + response.expires_in * 1000).toISOString();

package/dist/lib/workspace.d.ts

@@ -20,6 +20,7 @@ export declare function readWorkspaceConfig(): Promise<BlocksWorkspaceConfig>;
 export declare function writeWorkspaceConfig(config: BlocksWorkspaceConfig): Promise<void>;
 export declare function selectedProject(flags: Record<string, string | boolean>): Promise<string>;
 export declare function saveSelectedProject(tenantId: string): Promise<void>;
+export declare function clearSelectedProject(): Promise<string | undefined>;
 export declare function pathsFromWorkspace(config: BlocksWorkspaceConfig): {
     dictionaries: string;
     releaseConfig: string;

package/dist/lib/workspace.js

@@ -47,6 +47,23 @@ export async function saveSelectedProject(tenantId) {
         });
     }
 }
+export async function clearSelectedProject() {
+    const global = await readConfig();
+    const tenantId = global.selectedProject?.tenantId;
+    if (!tenantId)
+        return undefined;
+    const { selectedProject: _dropped, ...rest } = global;
+    await writeConfig(rest);
+    const local = await readWorkspaceConfig();
+    if (local.project?.tenantId) {
+        const { tenantId: _localTenantId, ...restProject } = local.project;
+        await writeWorkspaceConfig({
+            ...local,
+            project: Object.keys(restProject).length > 0 ? restProject : undefined
+        });
+    }
+    return tenantId;
+}
 export function pathsFromWorkspace(config) {
     return {
         dictionaries: config.localization?.dictionaries ?? "blocks/localization",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seliseblocks/cli-os",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "CLI for SELISE Blocks OS project setup and configuration.",
   "license": "MIT",
   "type": "module",

package/dist/commands/auth/add.d.ts

@@ -1 +0,0 @@
-export declare function authAdd(argv: string[]): Promise<void>;

package/dist/commands/auth/add.js

@@ -1,51 +0,0 @@
-import { parseFlags, stringFlag } from "../../lib/args.js";
-import { defaults, normalizeAccountName, readConfig, writeConfig } from "../../lib/config.js";
-import { promptSecret, promptValue } from "../../lib/prompt.js";
-import { getClientSecret, setClientSecret } from "../../lib/secret-store.js";
-export async function authAdd(argv) {
-    const { args, flags } = parseFlags(argv);
-    const account = normalizeAccountName(args[0]);
-    const current = await readConfig();
-    const previous = current.accounts[account];
-    const now = new Date().toISOString();
-    const apiUrl = stringFlag(flags, "api-url") || previous?.apiUrl || defaults().apiUrl;
-    const oidcUrl = stringFlag(flags, "oidc-url") || previous?.oidcUrl || defaults().oidcUrl;
-    const osUrl = stringFlag(flags, "os-url") || defaults().osUrl;
-    const clientId = await value(flags, "client-id", "OIDC client id", previous?.clientId);
-    const existingSecret = await getClientSecret(account);
-    const clientSecret = await value(flags, "client-secret", "OIDC client secret", existingSecret, true);
-    const scope = stringFlag(flags, "scope") || previous?.scope || defaults().scope;
-    const redirectUri = stringFlag(flags, "redirect-uri") || previous?.redirectUri || defaults().redirectUri;
-    const rootTenantId = optionalStringFlag(flags, "root-tenant") ?? previous?.rootTenantId ?? defaults().rootTenantId;
-    await writeConfig({
-        ...current,
-        activeAccount: current.activeAccount ?? account,
-        accounts: {
-            ...current.accounts,
-            [account]: {
-                apiUrl,
-                clientId,
-                createdAt: previous?.createdAt ?? now,
-                oidcUrl,
-                osUrl,
-                redirectUri,
-                rootTenantId,
-                scope,
-                updatedAt: now
-            }
-        }
-    });
-    await setClientSecret(account, clientSecret);
-    console.log(`Saved OIDC account '${account}'.`);
-}
-async function value(flags, name, label, defaultValue, secret = false) {
-    const flag = stringFlag(flags, name);
-    const resolved = flag || await (secret ? promptSecret(label, defaultValue) : promptValue(label, defaultValue));
-    if (!resolved)
-        throw new Error(`Missing --${name}`);
-    return resolved;
-}
-function optionalStringFlag(flags, name) {
-    const value = flags[name];
-    return typeof value === "string" && value ? value : undefined;
-}

package/dist/commands/auth/list.d.ts

@@ -1 +0,0 @@
-export declare function authList(argv?: string[]): Promise<void>;