@seliseblocks/cli-os 0.1.4 → 0.1.5

package/README.md

@@ -1,9 +1,9 @@
-# Blocks OS CLI
+# Blocks CLI
 
 CLI for SELISE Blocks Cloud.
 
 - Package: `@seliseblocks/cli-os`
-- Binary: `blocks-os`
+- Binary: `blocks`
 
 ## Setup
 
@@ -11,7 +11,7 @@ Install the npm package where you want to operate the CLI:
 
 ```bash
 npm install -g @seliseblocks/cli-os
-blocks-os --version
+blocks --version
 ```
 
 Then log in (device-code flow - prints a verification URL and code, opens
@@ -19,7 +19,7 @@ your browser to the verification page when possible so you only need to
 click approve, then polls until approved):
 
 ```bash
-blocks-os login
+blocks login
 ```
 
 For source development in this repository:
@@ -32,35 +32,72 @@ node bin/run.js --version
 
 ## Commands
 
+Namespaced commands accept either spaces or colons, e.g. `blocks data schema list` and
+`blocks data:schema:list` are equivalent.
+
+Global options available on every command:
+
+| Option | Description |
+|---|---|
+| `--version` | Print CLI version. |
+| `--json` | Print machine-readable JSON where supported. |
+| `--api-url <url>` | Override the Blocks API URL for this command. |
+| `--account <name>` | Use a named account profile; default is implicit. |
+| `--project <tenantId>` | Use a project tenant for project-scoped commands. |
+| `--dry-run` | Show planned mutation without calling the API. |
+| `--yes` | Skip mutation confirmation after explicit approval. |
+
 | Command | Description |
 |---|---|
-| `blocks-os init` | Create local Blocks workspace files: `blocks.json`, data schema/rules folders, release deploy config, and `.env.example`. |
-| `blocks-os doctor [--json]` | Check Node.js, OIDC config, token cache, selected project, and config file locations. Does not mutate cloud resources. |
-| `blocks-os login` | Device-code login. Prints a verification URL and user code, opens the browser to the verification page when possible so you only need to click approve, then polls until the device is authorized; stores account tokens and auto-refreshes later. |
-| `blocks-os auth:status [--json]` | Show only whether account/project access and refresh tokens are missing, valid, expired, or available. Does not print account config values. |
-| `blocks-os auth:refresh [--project] [--json]` | Force account token refresh, or project token refresh with `--project`. |
-| `blocks-os auth:remove <account>` | Clear cached tokens and stored local credentials for that account. The packaged default OS account is restored from package defaults. |
-| `blocks-os logout` | Revoke the current refresh token when possible and remove local session data. |
-| `blocks-os projects:list [--json]` | List accessible Blocks projects via `/os/v4/Project/Gets` using the account token. Read-only. |
-| `blocks-os projects:get [tenantId] [--json]` | Read one project from `Project/Gets`. Uses selected project when `tenantId` is omitted. Read-only. |
-| `blocks-os projects:create <name> [--env dev] [--yes] [--dry-run] [--json]` | Create a Blocks project/environment via `/os/v4/Project/Create` using the account token. Mutating; supports dry-run and confirmation. |
-| `blocks-os use <tenantId>` | Save the selected project tenant globally and in `blocks.json` when present. Does not call cloud APIs. |
-| `blocks-os iam:me [--json]` | Read the current user from IAM using the account token. This is the only IAM admin surface exposed in the MVP. |
-| `blocks-os data:validate [--json]` | Validate local `blocks/data/schemas/*.json` and `blocks/data/rules.json` before pushing. Local-only. |
-| `blocks-os data:schema:list [--json]` | List project schemas via `/data/v4/schemas` using an impersonated project token. Read-only. |
-| `blocks-os data:schema:pull [--json]` | Download project schemas into `blocks/data/schemas/*.json`. Writes local files only. |
-| `blocks-os data:schema:push [--dry-run] [--yes] [--json]` | Create or update project schemas via `/data/v4/schemas/define`. Mutating; uses POST for create and PUT for update. |
-| `blocks-os data:rules:pull [--json]` | Download data-access policies into `blocks/data/rules.json`. Writes local files only. |
-| `blocks-os data:rules:deploy [--dry-run] [--yes] [--json]` | Apply schema security and data-access policies. Mutating; supports dry-run and confirmation. |
-| `blocks-os data:reload [--dry-run] [--yes] [--json]` | Reload Data schema configuration so staged schema/rule changes become live. Mutating; calls POST `/data/v4/schema-configurations/reload`. |
-| `blocks-os localization:validate --module <name> --language <culture> [--file <path>] [--json]` | Validate a local i18n JSON dictionary. Supports nested JSON input and checks the flattened key/value set locally. |
-| `blocks-os localization:push --module <name> --language <culture> [--file <path>] [--route <route>] [--context <text>] [--dry-run] [--yes] [--json]` | Create or update Localization keys from local i18n JSON via `/localization/v4/Key/SaveKeys`. Creates the module first through `/localization/v4/Module/Save` when missing. |
-| `blocks-os localization:pull --module <name> --language <culture> [--out <path>] [--json]` | Download published cloud localization via `/localization/v4/Key/GetCloudUilmFile` and write a local JSON dictionary. |
-| `blocks-os release:deploy --repo-id <repoId> [--dry-run] [--yes] [--json]` | Trigger a manual Release build/deploy for a configured repository. Mutating; no artifact upload is performed by this CLI. |
-| `blocks-os release:status <buildId> [--json]` | Read Release build status by build id. Read-only. |
-| `blocks-os release:builds:list --repo-id <repoId> [--json]` | List Release build details for a repository. Read-only. |
-| `blocks-os release:builds:get <buildId> [--json]` | Alias for `release:status`. Read-only. |
-| `blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain-or-url> [--client-id <oidcClientId>]` | Create a Vite React starter app that talks to Blocks exclusively through `@seliseblocks/client` (a single `createBlocksClient()` instance) using the SDK hosted IdP flow: `blocksClient.auth.idp.redirectToProvider()` on login click and `blocksClient.auth.idp.callback()` on `/login/callback`. Includes route guards, auto-refresh through `auth.oidc.refreshToken()`, live `auth`/`iam`/`data`/`localization` SDK examples, environment config, and safe `.gitignore` defaults. Register a **public** OIDC client with redirect URIs for both your local HTTPS dev origin and `--app-domain`, then pass its id as `--client-id` (or set `VITE_BLOCKS_OIDC_CLIENT_ID` in `.env` afterwards). |
+| `blocks init` | Create local Blocks workspace files: `blocks.json`, data schema/rules folders, and `.env.example`. |
+| `blocks doctor [--json]` | Check Node.js, OIDC config, token cache, selected project, and config file locations. Does not mutate cloud resources. |
+| `blocks login` | Device-code login. Prints a verification URL and user code, opens the browser to the verification page when possible so you only need to click approve, then polls until the device is authorized; stores account tokens and auto-refreshes later. |
+| `blocks auth status [--json]` | Show only whether account/project access and refresh tokens are missing, valid, expired, or available. Does not print account config values. |
+| `blocks auth refresh [--project] [--json]` | Force account token refresh, or project token refresh with `--project`. |
+| `blocks auth remove <account>` | Clear cached tokens and stored local credentials for that account. The packaged default OS account is restored from package defaults. |
+| `blocks logout` | Revoke the current refresh token when possible and remove local session data. |
+| `blocks projects list [--json]` | List accessible Blocks projects via `/os/v4/Project/Gets` using the account token. Read-only. |
+| `blocks projects get [tenantId] [--deployment] [--json]` | Read one project from `Project/Gets`. Uses selected project when `tenantId` is omitted. Pass `--deployment` to also include the environment, tenantGroupId, and linked repo assets that `release deploy` resolves internally. Read-only. |
+| `blocks projects create` | **Currently disabled** (commented out, not deleted) - the dispatch entry, import, and help text were removed pending a product decision. Do not tell users this command is available. |
+| `blocks use <tenantId>` | Save the selected project tenant globally and in `blocks.json` when present. Does not call cloud APIs. |
+| `blocks deselect` | Clear the selected project tenant (globally and in `blocks.json`) and drop its cached impersonation token. Use this to recover when an impersonated project token has expired or failed, then run `blocks use <tenantId>` again to reselect and re-impersonate. |
+| `blocks iam me [--json]` | Read the current user from IAM using the account token (CLI operator identity, not a project resource). |
+| `blocks iam users *`, `iam email available`, `iam roles *`, `iam permissions *`, `iam resources *`, `iam organizations *`, `iam signup-settings *` | Full IAM admin surface for the selected project (users, roles, permissions, resource metadata, organizations and their config, signup settings). Project-scoped: requires a selected project and always uses an impersonated project token, never the account token. Mutating commands support `--dry-run`/`--yes`; rich payloads accept `--body '<json>'`/`--file <path>` on top of common convenience flags. Run `blocks --help` for the full command/flag list. |
+| `blocks mfa config *`, `mfa totp *`, `mfa generate`, `mfa resend`, `mfa verify`, `mfa method set`, `mfa disable`, `mfa backup-codes *` | Project-scoped MFA admin and self-service surface (tenant MFA policy, TOTP enrollment, OTP challenge/verify, method switch, backup codes). Same project-selection and impersonation-only rules as IAM above. |
+| `blocks mfa totp enable --mfa-type <n> [--code <c>]` | Composed TOTP enrollment: `totp setup` → prints the QR/secret → prompts for the code (or `--code` to skip the prompt) → `totp verify-setup` → `method set` → `backup-codes generate`, one confirmation. `--mfa-type` is required and not defaulted - the tenant-specific integer meaning "TOTP" isn't documented anywhere in this CLI. Deliberately excludes `mfa config save` (a separate, tenant-wide admin policy, not part of one user's enrollment). |
+| `blocks auth idp *`, `auth config *`, `auth client-credentials *`, `auth oidc-clients *` | Auth admin surface: identity providers, AuthController tenant config, machine-to-machine client credentials, and OIDC client app registrations. Project-scoped, impersonated project token only. `idp delete`, `client-credentials save`/`delete`, and `oidc-clients save`/`delete`/`rotate-secret` return or handle secrets shown only once - treat CLI output as sensitive and never log it. |
+| `blocks mail config *`, `mail template *`, `mail mailbox *` | Project-scoped mail admin surface via `/os/v4/Mail/*`: SMTP/inbound configuration upsert/delete/duplicate, mail template CRUD/clone, and mailbox message reads. Impersonated project token only. `mail config save`'s `--account-password` is redacted in `--dry-run` output only. |
+| `blocks mail send [--to a,b] [--purpose <p>] [--language <c>] ...` / `mail sendtoany [same, plus --is-test-mail]` | Send an email via `/logic/v4/Mail/Send` / `/logic/v4/Mail/SendToAny`. Impersonated project token only; `--project-key` defaults to the selected project. |
+| `blocks notification *` | Project-scoped notification channel configuration via `/os/v4/Notification/*` (list/get/save/delete). Impersonated project token only. `--channel`/`--type` are raw numeric enum values from the API. |
+| `blocks notifier notify`, `notifier list`, `notifier unread`, `notifier mark-read`, `notifier mark-all-read` | Real-time/offline notification sends and inbox reads via `/logic/v4/Notifier/*` - distinct from `notification` above, which manages channel configuration, not sending. Impersonated project token only. `notify` targets `--user-ids`/`--roles`/`--subscription-filters`; `unread` sends its filter as query parameters even though swagger documents that endpoint as GET with a JSON body, which the Fetch spec forbids. |
+| `blocks secrets get <secretKey>` / `secrets save --secret-key <key> --key-value-pairs '<json>'` | Generic tenant secret storage via `/os/v4/Secrets/*` (e.g. captcha provider config). Impersonated project token only. `save` is an upsert - omit `--item-id` to create, pass it to update. |
+| `blocks storage config *` | Project-scoped storage backend configuration via `/os/v4/Storage/*` (list/get/save/delete). Impersonated project token only. `--secret-key`/`--access-key`/`--password`/`--connection-string` are redacted in `--dry-run` output only. |
+| `blocks data validate [--json]` | Validate local `blocks/data/schemas/*.json` and `blocks/data/rules.json` before pushing. Local-only. |
+| `blocks data schema list [--json]` | List project schemas via `/data/v4/schemas` using an impersonated project token. Read-only. |
+| `blocks data schema pull [--json]` | Download project schemas into `blocks/data/schemas/*.json`. Writes local files only. |
+| `blocks data schema push [--dry-run] [--yes] [--json]` | Create or update project schemas via `/data/v4/schemas/define`. Mutating; uses POST for create and PUT for update. |
+| `blocks data rules pull [--json]` | Download data-access policies into `blocks/data/rules.json`. Writes local files only. |
+| `blocks data rules deploy [--dry-run] [--yes] [--json]` | Apply schema security and data-access policies. Mutating; supports dry-run and confirmation. |
+| `blocks data reload [--dry-run] [--yes] [--json]` | Reload Data schema configuration so staged schema/rule changes become live. Mutating; calls POST `/data/v4/schema-configurations/reload`. |
+| `blocks data sync [--dry-run] [--yes] [--json]` | Composed flow: validate local schemas/rules → `data schema push` → `data rules deploy` → `data reload`, one confirmation. Use this instead of running the three separately - nothing else calls `data reload` automatically, so pushed changes can otherwise sit staged without going live. Prints 3 separate step outputs, not one combined document. |
+| `blocks data config get/create/update` | Tenant data-source configuration via `/data/v4/configurations` - check `get` first, it defaults to Blocks-managed storage; `create`/`update` point the gateway at an external database. Impersonated project token only. |
+| `blocks data schema get/get-by-name/aggregation/change-logs/delete/fields/info *` | Raw `/data/v4/schemas*` API beyond the file-oriented `list/pull/push` above: single-schema/by-name lookups, access-level aggregation, unadapted change logs, delete, and a metadata-first (`info *`) plus field-only (`fields`) alternative to `push`. Run `blocks --help` for the full flag reference. |
+| `blocks data rules policy get/delete` | Single data-access policy read/delete via `/data/v4/data-access/policy/*`, alongside the bulk file-oriented `rules pull/deploy` above. |
+| `blocks data validation list/get/by-schema/by-schema-field/save/delete` | Field-level validation rules via `/data/v4/data-validations*`. No file-oriented workflow exists for this yet; `save` is an upsert (omit `--item-id` to create) and requires a `validations` array via `--body`/`--file`. |
+| `blocks data files upload --file <path> [--local-storage]` | Composed upload: presigned-upload-url → PUT the file → dms-upload, threading the returned `uploadUrl`/`fileId` automatically (content-type inferred from the file extension if omitted). Pass `--local-storage` for the one-call `upload-to-local-storage` path instead. Prefer this over the individual steps below. |
+| `blocks data files *` | Full DMS/storage surface via `/data/v4/Files/*`: `get`/`get-many`/`info` (read), `presigned-upload-url` + `upload-to-url` (cloud storage, two steps) or `upload-to-local-storage` (one step, local storage), `update-additional-info`, `delete`, `dms-list`/`dms-upload` (folder browsing/file registration), `create-folder`/`delete-folder`. Here `--file <path>` is the local binary to upload/read, not a JSON payload file - see [AI_USAGE_GUIDE.md](AI_USAGE_GUIDE.md) for the distinction. |
+| `blocks localization validate --module <name> --language <culture> [--file <path>] [--json]` | Validate a local i18n JSON dictionary. Supports nested JSON input and checks the flattened key/value set locally. |
+| `blocks localization push --module <name> --language <culture> [--file <path>] [--route <route>] [--context <text>] [--dry-run] [--yes] [--json]` | Create or update Localization keys from local i18n JSON via `/localization/v4/Key/SaveKeys`. Creates the module first through `/localization/v4/Module/Save` when missing. |
+| `blocks localization pull --module <name> --language <culture> [--out <path>] [--json]` | Download published cloud localization via `/localization/v4/Key/GetCloudUilmFile` and write a local JSON dictionary. |
+| `blocks localization key translate-and-export --module-id <id> [--wait]` | Composed flow: `translate-all` → `generate-uilm-file` → `uilm-export`. With `--wait`, polls translation progress (via a self-generated correlation id) before generating/exporting, since translation runs asynchronously; without it, fires all 3 back to back. Prints one output block per step. |
+| `blocks localization assistant translation-suggestion`, `localization config *`, `localization glossary *`, `localization key *`, `localization language *`, `localization module *` | Full raw `/localization/v4/*` API surface (AI translation suggestions, tenant webhook config, glossary CRUD, key CRUD/search/timeline/translate/UILM import-export/rollback, language CRUD, module CRUD/glossary tagging) alongside the file-oriented validate/push/pull commands above. Project-scoped, impersonated project token only. Run `blocks --help` for the full command/flag list. |
+| `blocks release deploy [--domain <customDomain>] [--wait] [--poll-interval <s>] [--timeout <s>] [--dry-run] [--yes] [--json]` | Deploy the selected project's environment. No `--repo-id` needed - resolves the linked repo via `Project/GetAsset` and its connected branch via `Build/repo-details`, and aborts if that branch doesn't match the environment name. Pass `--domain` to also set the custom deployment domain first. Pass `--wait` to poll `release status` on the resulting build until it reaches a terminal state instead of returning immediately with just a build id. Mutating; no artifact upload is performed by this CLI. |
+| `blocks release status <buildId> [--json]` | Read Release build status by build id. Read-only. |
+| `blocks release builds list [repoId] [--repo-id <repoId>] [--json]` | List Release build details for a repository. When `repoId` is omitted, resolves it from the selected project's linked repo assets - auto-picked if there's exactly one, otherwise you're prompted to choose. Read-only. |
+| `blocks release builds get <buildId> [--json]` | Alias for `release status`. Read-only. |
+| `blocks new web <name> [--app-domain <domain>] [--client-id <oidcClientId>] [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>]` | Create a Vite React starter app that talks to Blocks exclusively through `@seliseblocks/client` (a single `createBlocksClient()` instance) using the SDK hosted IdP flow: `blocksClient.auth.idp.redirectToProvider()` on login click and `blocksClient.auth.idp.callback()` on `/login/callback`. Includes route guards, auto-refresh through `auth.oidc.refreshToken()`, live `auth`/`iam`/`data`/`localization` SDK examples, environment config, and safe `.gitignore` defaults. Uses the selected project (see `use`) unless `--x-blocks-key` overrides it. `--app-domain` and `--client-id` are resolved from the project record when omitted: the domain auto-picks if the project has exactly one, otherwise you're prompted to choose; the OIDC client is picked from the project's existing clients, or you can create a minimal one (display name + redirect URI) on the spot, or skip and register one later from the portal or `auth oidc-clients save`. `--blocks-api-url` defaults to `https://api.seliseblocks.com` if omitted - pass a different Data/IAM/Localization/OS gateway URL explicitly only if your project uses a non-default one. `--oidc-url` defaults to `https://iam.seliseblocks.com`. |
+| `blocks skill list [--json]` / `skill show <name> [--json]` / `skill add <name> [--dir <path>]` | Local-only, no cloud calls: list/print the bundled `blocks-skills/*/SKILL.md` agent context docs, or copy a skill's entire directory (`SKILL.md` plus any supporting files) into `<dir>/<name>/` (default `./blocks-skills`) for use in a project outside this monorepo. `list`'s output and `show`/`add`'s "unknown skill" error both point at the full public skill catalog in case the bundled set is out of date. |
+| `blocks sdk client [--app-domain <domain>] [--client-id <oidcClientId>] [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>] [--json]` | Read-only: resolves this project's `@seliseblocks/client` config (same values `new web` scaffolds with) and prints a ready-to-paste `createBlocksClient(...)` snippet. Passing both `--app-domain` and `--client-id` skips the project lookup entirely (no login required). Writes nothing - use `new web` to scaffold a full app. |
 
 Use `--json` on commands when AI or automation needs machine-readable output. Use `--dry-run` before mutations and `--yes` only after approval.
 
@@ -68,7 +105,7 @@ For agent-specific operating rules and command sequences, see [AI_USAGE_GUIDE.md
 
 ### Scaffolded Web App Local HTTPS
 
-For `blocks-os new web`, `--app-domain` should be the app's real Blocks domain/origin, for example `https://dbpdba.seliseblocks.com`. The generated app keeps that full value as `VITE_BLOCKS_APP_DOMAIN` and derives the local dev host without a scheme as `VITE_BLOCKS_DEV_HOST=dbpdba.seliseblocks.com`.
+For `blocks new web`, `--app-domain` should be the app's real Blocks domain/origin, for example `https://dbpdba.seliseblocks.com`. The generated app keeps that full value as `VITE_BLOCKS_APP_DOMAIN` and derives the local dev host without a scheme as `VITE_BLOCKS_DEV_HOST=dbpdba.seliseblocks.com`.
 
 Browser login uses the hosted Blocks IAM IdP flow and secure cookies, so local testing on the project domain must run over HTTPS:
 
@@ -94,22 +131,22 @@ OAuth tokens use an OS-aware credential backend:
 | OS | Credential backend |
 |---|---|
 | Windows | DPAPI-encrypted value in the CLI secret metadata file, scoped to the current Windows user. |
-| macOS | Keychain generic password for the `seliseblocks-cli-os` service. |
+| macOS | Keychain generic password for the `seliseblocks-cli` service. |
 | Linux | Secret Service through `secret-tool` when available. |
-| Fallback | `0600` file storage in the CLI config directory. Set `BLOCKS_OS_SECRET_STORE=file` to force this mode for CI or minimal containers. |
+| Fallback | `0600` file storage in the CLI config directory. Set `BLOCKS_SECRET_STORE=file` to force this mode for CI or minimal containers. |
 
-Use `blocks-os doctor` or `blocks-os auth:status` to see which backend is active. Tokens are never printed by CLI status commands.
+Use `blocks doctor` or `blocks auth status` to see which backend is active. Tokens are never printed by CLI status commands.
 
 If the active OS credential backend cannot decrypt old local auth state after a Windows profile change, machine migration, Keychain reset, or corrupted token cache, clear local auth state and log in again:
 
 ```bash
-blocks-os auth:remove <account>
-blocks-os login
+blocks auth remove <account>
+blocks login
 ```
 
 ## Workspace
 
-`blocks-os init` creates:
+`blocks init` creates:
 
 ```text
 blocks.json
@@ -117,20 +154,20 @@ blocks/
   data/
     schemas/
     rules.json
-  localization/
-  release/
-    deploy.json
 .env.example
 ```
 
-Localization dictionaries default to `blocks/localization/<module>.<language>.json`, for example `blocks/localization/common.en.json`. AI agents can generate or update that file, run `blocks-os localization:validate`, then push it to the Localization service with `blocks-os localization:push --dry-run` followed by `--yes` after approval. Gateway v4 routes do not include an `/api` segment.
+Localization dictionaries are not created by `init` - the default path is `blocks/localization/<module>.<language>.json`, for example `blocks/localization/common.en.json`, and the `blocks/localization/` folder is created lazily the first time `blocks localization pull` writes to it. AI agents can create or update that file directly (before `push`, which only reads it), run `blocks localization validate`, then push it to the Localization service with `blocks localization push --dry-run` followed by `--yes` after approval. Gateway v4 routes do not include an `/api` segment.
+
+`blocks use <tenantId>` updates the selected project in global CLI state and `blocks.json` when present.
 
-`blocks-os use <tenantId>` updates the selected project in global CLI state and `blocks.json` when present.
+`blocks release deploy` has no local config file - it needs a repo already linked to the project. Linking a repo requires GitHub OAuth, which only the Blocks portal can do; if none is linked, the command tells you so and stops.
 
 ## Boundaries
 
-- IAM is limited to `iam:me` for now.
-- Data covers schema/rules/reload/validate only.
-- Localization covers dictionary validate/pull/push through the Localization service.
+- `iam me` reads the CLI operator's own account identity; every other `iam *`, `mfa *`, `auth idp *`/`auth config *`/`auth client-credentials *`/`auth oidc-clients *`, `mail *`, `notification *`, `notifier *`, `secrets *`, and `storage config *` command is project-scoped and requires a selected project (`blocks use <tenantId>`) plus an impersonated project token - none of them ever run against the account token.
+- Data covers the tenant data-source configuration, schema/rules/reload/validate, field-level validation rules, and the DMS/storage (`data files *`) surface. Prefer the composed `data sync` and `data files upload` over their individual steps.
+- Localization covers dictionary validate/pull/push plus the full raw `/localization/v4/*` API surface (assistant, config, glossary, key, language, module). Prefer `localization key translate-and-export` over running translate/generate/export by hand.
 - Release covers deploy trigger and build status/read commands only.
 - No direct artifact upload unless Blocks Release adds a confirmed artifact upload API.
+- `projects create` is currently disabled in this build (commented out pending a product decision) - don't reference it as available.

package/dist/commands/auth/client-credentials/delete.d.ts

@@ -0,0 +1 @@
+export declare function authClientCredentialsDelete(argv: string[]): Promise<void>;

package/dist/commands/auth/client-credentials/delete.js

@@ -0,0 +1,23 @@
+import { booleanFlag, stringFlag } from "../../../lib/args.js";
+import { blocksRequest } from "../../../lib/api.js";
+import { confirmMutation } from "../../../lib/confirm.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function authClientCredentialsDelete(argv) {
+    const { args, flags } = parseCommand(argv);
+    const id = args[0] || stringFlag(flags, "id", { required: true });
+    if (booleanFlag(flags, "dry-run")) {
+        writeOutput({ dryRun: true, endpoint: `/iam/v4/auth/client-credentials/${id}` }, flags);
+        return;
+    }
+    await confirmMutation(flags, `Delete client credential '${id}'.`);
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest(`/iam/v4/auth/client-credentials/${encodeURIComponent(id)}`, {
+        impersonatedProjectAuth: true,
+        method: "DELETE",
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}

package/dist/commands/auth/client-credentials/list.d.ts

@@ -0,0 +1 @@
+export declare function authClientCredentialsList(argv: string[]): Promise<void>;

package/dist/commands/auth/client-credentials/list.js

@@ -0,0 +1,14 @@
+import { blocksRequest } from "../../../lib/api.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function authClientCredentialsList(argv) {
+    const { flags } = parseCommand(argv);
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest("/iam/v4/auth/client-credentials", {
+        impersonatedProjectAuth: true,
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}

package/dist/commands/auth/client-credentials/save.d.ts

@@ -0,0 +1 @@
+export declare function authClientCredentialsSave(argv: string[]): Promise<void>;

package/dist/commands/auth/client-credentials/save.js

@@ -0,0 +1,41 @@
+import { booleanFlag, optionalBooleanFlag, optionalIntegerFlag, stringFlag } from "../../../lib/args.js";
+import { blocksRequest } from "../../../lib/api.js";
+import { confirmMutation } from "../../../lib/confirm.js";
+import { compact, jsonBodyFlag, listFlag } from "../../../lib/json-flag.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function authClientCredentialsSave(argv) {
+    const { flags } = parseCommand(argv);
+    const body = {
+        ...(await jsonBodyFlag(flags)),
+        ...compact({
+            accessTokenValidForNumberMinutes: optionalIntegerFlag(flags, "access-token-valid-minutes"),
+            isActive: optionalBooleanFlag(flags, "active"),
+            itemId: stringFlag(flags, "item-id") || undefined,
+            name: stringFlag(flags, "name") || undefined,
+            permissions: listFlag(flags, "permissions"),
+            roles: listFlag(flags, "roles")
+        })
+    };
+    if (!body.name && !body.itemId)
+        throw new Error("Provide --name (create) or --item-id (update), or set them in --body/--file.");
+    if (booleanFlag(flags, "dry-run")) {
+        writeOutput({ dryRun: true, endpoint: "/iam/v4/auth/client-credentials", request: redactSecret(body) }, flags);
+        return;
+    }
+    await confirmMutation(flags, `Save client credential '${body.name ?? body.itemId}'. The response's clientSecret is shown once.`);
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest("/iam/v4/auth/client-credentials", {
+        body,
+        impersonatedProjectAuth: true,
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}
+function redactSecret(body) {
+    if (!body.clientSecret)
+        return body;
+    return { ...body, clientSecret: "***" };
+}

package/dist/commands/auth/config/get.d.ts

@@ -0,0 +1 @@
+export declare function authConfigGet(argv: string[]): Promise<void>;

package/dist/commands/auth/config/get.js

@@ -0,0 +1,14 @@
+import { blocksRequest } from "../../../lib/api.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function authConfigGet(argv) {
+    const { flags } = parseCommand(argv);
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest("/iam/v4/auth/config", {
+        impersonatedProjectAuth: true,
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}

package/dist/commands/auth/config/save.d.ts

@@ -0,0 +1 @@
+export declare function authConfigSave(argv: string[]): Promise<void>;

package/dist/commands/auth/config/save.js

@@ -0,0 +1,37 @@
+import { booleanFlag, optionalIntegerFlag, stringFlag } from "../../../lib/args.js";
+import { blocksRequest } from "../../../lib/api.js";
+import { confirmMutation } from "../../../lib/confirm.js";
+import { compact, jsonBodyFlag } from "../../../lib/json-flag.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function authConfigSave(argv) {
+    const { flags } = parseCommand(argv);
+    const body = {
+        ...(await jsonBodyFlag(flags)),
+        ...compact({
+            absoluteRefreshTokenValidForNumberMinutes: optionalIntegerFlag(flags, "absolute-refresh-token-minutes"),
+            accessTokenValidForNumberMinutes: optionalIntegerFlag(flags, "access-token-minutes"),
+            accountLockDurationInMinutes: optionalIntegerFlag(flags, "account-lock-duration-minutes"),
+            getNumberOfWrongAttemptsToLockTheAccount: optionalIntegerFlag(flags, "wrong-attempts-to-lock"),
+            isOidcEnabled: booleanFlag(flags, "oidc-enabled") || undefined,
+            logoutOnPasswordChange: booleanFlag(flags, "logout-on-password-change") || undefined,
+            passwordStrengthCheckerRegex: stringFlag(flags, "password-strength-regex") || undefined,
+            refreshTokenValidForNumberMinutes: optionalIntegerFlag(flags, "refresh-token-minutes"),
+            rememberMeRefreshTokenValidForNumberMinutes: optionalIntegerFlag(flags, "remember-me-refresh-token-minutes")
+        })
+    };
+    if (booleanFlag(flags, "dry-run")) {
+        writeOutput({ dryRun: true, endpoint: "/iam/v4/auth/config", request: body }, flags);
+        return;
+    }
+    await confirmMutation(flags, "Save AuthController configuration for the selected project.");
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest("/iam/v4/auth/config", {
+        body,
+        impersonatedProjectAuth: true,
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}

package/dist/commands/auth/idp/create.d.ts

@@ -0,0 +1 @@
+export declare function authIdpCreate(argv: string[]): Promise<void>;

package/dist/commands/auth/idp/create.js

@@ -0,0 +1,46 @@
+import { booleanFlag, stringFlag } from "../../../lib/args.js";
+import { blocksRequest } from "../../../lib/api.js";
+import { confirmMutation } from "../../../lib/confirm.js";
+import { compact, jsonBodyFlag, listFlag } from "../../../lib/json-flag.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function authIdpCreate(argv) {
+    const { flags } = parseCommand(argv);
+    const body = {
+        ...(await jsonBodyFlag(flags)),
+        ...compact({
+            clientId: stringFlag(flags, "client-id") || undefined,
+            clientSecret: stringFlag(flags, "client-secret") || undefined,
+            displayName: stringFlag(flags, "display-name") || undefined,
+            isActive: booleanFlag(flags, "active") || undefined,
+            issuer: stringFlag(flags, "issuer") || undefined,
+            protocol: stringFlag(flags, "protocol") || undefined,
+            provider: stringFlag(flags, "provider") || undefined,
+            providerType: stringFlag(flags, "provider-type") || undefined,
+            redirectUris: listFlag(flags, "redirect-uris"),
+            scope: stringFlag(flags, "scope") || undefined
+        })
+    };
+    if (!body.provider || !body.providerType || !body.protocol || !body.clientId) {
+        throw new Error("Provide --provider, --provider-type, --protocol and --client-id (or set them in --body/--file).");
+    }
+    if (booleanFlag(flags, "dry-run")) {
+        writeOutput({ dryRun: true, endpoint: "/iam/v4/auth/identity-providers", request: redactSecret(body) }, flags);
+        return;
+    }
+    await confirmMutation(flags, `Create identity provider '${body.provider}' (${body.providerType}).`);
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest("/iam/v4/auth/identity-providers", {
+        body,
+        impersonatedProjectAuth: true,
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}
+function redactSecret(body) {
+    if (!body.clientSecret)
+        return body;
+    return { ...body, clientSecret: "***" };
+}

package/dist/commands/auth/idp/delete.d.ts

@@ -0,0 +1 @@
+export declare function authIdpDelete(argv: string[]): Promise<void>;

package/dist/commands/auth/idp/delete.js

@@ -0,0 +1,23 @@
+import { booleanFlag, stringFlag } from "../../../lib/args.js";
+import { blocksRequest } from "../../../lib/api.js";
+import { confirmMutation } from "../../../lib/confirm.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function authIdpDelete(argv) {
+    const { args, flags } = parseCommand(argv);
+    const id = args[0] || stringFlag(flags, "id", { required: true });
+    if (booleanFlag(flags, "dry-run")) {
+        writeOutput({ dryRun: true, endpoint: `/iam/v4/auth/identity-providers/${id}` }, flags);
+        return;
+    }
+    await confirmMutation(flags, `Delete identity provider '${id}'. This also removes its OIDC client and is irreversible.`);
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest(`/iam/v4/auth/identity-providers/${encodeURIComponent(id)}`, {
+        impersonatedProjectAuth: true,
+        method: "DELETE",
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}

package/dist/commands/auth/idp/get.d.ts

@@ -0,0 +1 @@
+export declare function authIdpGet(argv: string[]): Promise<void>;

package/dist/commands/auth/idp/get.js

@@ -0,0 +1,16 @@
+import { stringFlag } from "../../../lib/args.js";
+import { blocksRequest } from "../../../lib/api.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function authIdpGet(argv) {
+    const { args, flags } = parseCommand(argv);
+    const id = args[0] || stringFlag(flags, "id", { required: true });
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest(`/iam/v4/auth/identity-providers/${encodeURIComponent(id)}`, {
+        impersonatedProjectAuth: true,
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}

package/dist/commands/auth/idp/list.d.ts

@@ -0,0 +1 @@
+export declare function authIdpList(argv: string[]): Promise<void>;

package/dist/commands/auth/idp/list.js

@@ -0,0 +1,14 @@
+import { blocksRequest } from "../../../lib/api.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function authIdpList(argv) {
+    const { flags } = parseCommand(argv);
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest("/iam/v4/auth/identity-providers", {
+        impersonatedProjectAuth: true,
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}

package/dist/commands/auth/idp/status.d.ts

@@ -0,0 +1 @@
+export declare function authIdpStatus(argv: string[]): Promise<void>;

package/dist/commands/auth/idp/status.js

@@ -0,0 +1,27 @@
+import { booleanFlag, stringFlag } from "../../../lib/args.js";
+import { blocksRequest } from "../../../lib/api.js";
+import { confirmMutation } from "../../../lib/confirm.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function authIdpStatus(argv) {
+    const { args, flags } = parseCommand(argv);
+    const id = args[0] || stringFlag(flags, "id", { required: true });
+    if (!("active" in flags))
+        throw new Error("Provide --active or --active=false.");
+    const isActive = booleanFlag(flags, "active");
+    if (booleanFlag(flags, "dry-run")) {
+        writeOutput({ dryRun: true, endpoint: `/iam/v4/auth/identity-providers/${id}/status`, request: { isActive } }, flags);
+        return;
+    }
+    await confirmMutation(flags, `${isActive ? "Enable" : "Disable"} identity provider '${id}'.`);
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest(`/iam/v4/auth/identity-providers/${encodeURIComponent(id)}/status`, {
+        body: { isActive },
+        impersonatedProjectAuth: true,
+        method: "PATCH",
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}

package/dist/commands/auth/idp/update.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Provider, providerType, protocol and clientId are immutable on this endpoint --
+ * IAM requires them to echo the existing value when supplied, so only pass them
+ * via --provider/--provider-type/--protocol/--client-id if you're re-sending the
+ * current configuration alongside other field changes.
+ */
+export declare function authIdpUpdate(argv: string[]): Promise<void>;

package/dist/commands/auth/idp/update.js

@@ -0,0 +1,45 @@
+import { booleanFlag, stringFlag } from "../../../lib/args.js";
+import { blocksRequest } from "../../../lib/api.js";
+import { confirmMutation } from "../../../lib/confirm.js";
+import { compact, jsonBodyFlag, listFlag } from "../../../lib/json-flag.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+/**
+ * Provider, providerType, protocol and clientId are immutable on this endpoint --
+ * IAM requires them to echo the existing value when supplied, so only pass them
+ * via --provider/--provider-type/--protocol/--client-id if you're re-sending the
+ * current configuration alongside other field changes.
+ */
+export async function authIdpUpdate(argv) {
+    const { args, flags } = parseCommand(argv);
+    const id = args[0] || stringFlag(flags, "id", { required: true });
+    const body = {
+        ...(await jsonBodyFlag(flags)),
+        ...compact({
+            clientId: stringFlag(flags, "client-id") || undefined,
+            displayName: stringFlag(flags, "display-name") || undefined,
+            isActive: booleanFlag(flags, "active") || undefined,
+            issuer: stringFlag(flags, "issuer") || undefined,
+            protocol: stringFlag(flags, "protocol") || undefined,
+            provider: stringFlag(flags, "provider") || undefined,
+            providerType: stringFlag(flags, "provider-type") || undefined,
+            redirectUris: listFlag(flags, "redirect-uris"),
+            scope: stringFlag(flags, "scope") || undefined
+        })
+    };
+    if (booleanFlag(flags, "dry-run")) {
+        writeOutput({ dryRun: true, endpoint: `/iam/v4/auth/identity-providers/${id}`, request: body }, flags);
+        return;
+    }
+    await confirmMutation(flags, `Update identity provider '${id}'.`);
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest(`/iam/v4/auth/identity-providers/${encodeURIComponent(id)}`, {
+        body,
+        impersonatedProjectAuth: true,
+        method: "PUT",
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}

package/dist/commands/auth/oidc-clients/delete.d.ts

@@ -0,0 +1 @@
+export declare function authOidcClientsDelete(argv: string[]): Promise<void>;