@seliseblocks/cli-os 0.2.2 → 0.2.4

package/AI_USAGE_GUIDE.md

@@ -128,10 +128,10 @@ Then run with explicit flags so no prompt is reached:
 blocks new web <appName> --x-blocks-key <projectTenantId> --app-domain <appDomainOrUrl> --client-id <publicOidcClientId>
 ```
 
-`new web` also accepts `--blocks-api-url <url>` and `--oidc-url <url>`, same as `sdk client`
-below. When `--blocks-api-url` is omitted, the scaffold derives it from the app domain as
-`https://blocksapi.<registrable-domain>`; for example `https://dqrsf.slsblx.com` becomes
-`https://blocksapi.slsblx.com`. Pass `--blocks-api-url` only when targeting a non-default Blocks gateway. `--oidc-url` defaults to `https://iam.seliseblocks.com`.
+`new web` also accepts `--blocks-api-url <url>` and `--oidc-url <url>`, same as `sdk client`
+below. When `--blocks-api-url` is omitted, the scaffold derives it from the app domain as
+`https://blocksapi.<registrable-domain>`; for example `https://dqrsf.slsblx.com` becomes
+`https://blocksapi.slsblx.com`. Pass `--blocks-api-url` only when targeting a non-default Blocks gateway. `--oidc-url` defaults to `https://iam.seliseblocks.com`.
 
 Validate the scaffold:
 
@@ -160,10 +160,10 @@ The generated cert script uses the `selfsigned` Node dependency, so it works fro
 `sdk client` answers "I want to use the Blocks SDK - show me the client." It resolves this project's `@seliseblocks/client` config (same values `new web` scaffolds an app with) and prints a ready-to-paste `createBlocksClient(...)` snippet - **it never writes a file or mutates anything**. To scaffold a full app instead, use `new web` above.
 
 ```bash
-blocks sdk client --x-blocks-key <projectTenantId> --app-domain <appDomainOrUrl> --client-id <publicOidcClientId> --blocks-api-url https://api.seliseblocks.com
+blocks sdk client --x-blocks-key <projectTenantId> --app-domain <appDomainOrUrl> --client-id <publicOidcClientId> --blocks-api-url https://api.seliseblocks.com
 ```
 
-Unlike `new web`, `sdk client` keeps `--blocks-api-url` defaulted to `https://api.seliseblocks.com`; only pass it explicitly if your project uses a different gateway URL. Passing both `--app-domain` and `--client-id` skips the project lookup entirely, so it needs no CLI login at all - useful for a quick, non-interactive check. Omit either one and it resolves from the selected project instead (auto-picks when there's exactly one match, otherwise lists the options and asks you to pass the flag explicitly - it does not prompt or create anything, since this command is read-only). Use `--json` for the resolved values instead of the snippet.
+Unlike `new web`, `sdk client` keeps `--blocks-api-url` defaulted to `https://api.seliseblocks.com`; only pass it explicitly if your project uses a different gateway URL. Passing both `--app-domain` and `--client-id` skips the project lookup entirely, so it needs no CLI login at all - useful for a quick, non-interactive check. Omit either one and it resolves from the selected project instead (auto-picks when there's exactly one match, otherwise lists the options and asks you to pass the flag explicitly - it does not prompt or create anything, since this command is read-only). Use `--json` for the resolved values instead of the snippet.
 
 ## Skills
 
@@ -181,9 +181,9 @@ Every other command below is project-scoped: it requires a project already selec
 
 Command families (run `blocks --help` for the full flag reference on each):
 
-- `iam users *`, `iam email available` - list/get/create/update/activate/deactivate, access grant/revoke, existence and email-availability checks.
-- `iam roles *` - list/get/create/update, assign-permissions, assignable. `assign-permissions` accepts permission resource strings and resolves them to itemIds before sending IAM's id-based mutation.
-- `iam permissions *` - list/get/create/update, by-severity.
+- `iam users *`, `iam email available` - list/get/create/update/activate/deactivate, access grant/revoke, existence and email-availability checks.
+- `iam roles *` - list/get/create/update, assign-permissions, assignable. `assign-permissions` accepts permission resource strings and resolves them to itemIds before sending IAM's id-based mutation.
+- `iam permissions *` - list/get/create/update, by-severity.
 - `iam resources *` - resource groups and feature flags (read-only).
 - `iam organizations *` - list/get/create/update, `my`, and organization config get/save.
 - `iam signup-settings *` - get/save tenant signup policy.
@@ -280,13 +280,13 @@ It validates first and hard-fails with no API calls made if schemas or the rules
 - `data schema info list`/`save`/`update` + `data schema fields` - a two-step alternative to `schema push` (create/update schema metadata, then add/update field definitions separately). Prefer the file-oriented `schema push` workflow for normal authoring; use these only for a targeted metadata or field-only change without touching the local schema JSON.
 - `data rules policy get`/`delete` - read or delete one data-access policy without a full `rules pull`/edit/`rules deploy` round-trip.
 - `data validation list`/`get`/`by-schema`/`by-schema-field`/`save`/`delete` - field-level validation rules. No file-oriented workflow exists for these (no local JSON file to pull/push). `save` is an upsert (omit `--item-id` to create, pass it to update) and requires a `validations` array passed via `--body`/`--file` - there's no scalar flag for it, e.g. `--body '{"validations":[{"type":1,"value":"^[0-9]+$","isActive":true}]}'`.
-- `data files *` - DMS/storage: `get`/`get-many`/`info` (read), `presigned-upload-url` + `upload-to-url` (cloud storage, two calls) or `upload-to-local-storage` (one call, local storage), `update-additional-info`, `delete`, `dms-list`/`dms-upload` (folder browsing / registering an uploaded file into a folder), `create-folder`/`delete-folder`.
+- `data files *` - permission-aware storage object tree: upload/download, directory CRUD/move, cursor list/search, versions, copy/move/rename, trash/restore/purge, shared objects, and access policies/inheritance.
 
 Same rules as everywhere else: `--dry-run` before any mutating command, then `--yes` only after explicit approval.
 
 **`--file` means two different things depending on the command.** Everywhere else in this CLI (`--body '<json>'`/`--file <path.json>`), `--file` is a JSON payload file read by `jsonBodyFlag`. On the `data files *` upload commands (`upload-to-url`, `upload-to-local-storage`), `--file` is instead the local binary file to read and upload - there is no JSON payload involved. Don't conflate the two: passing a JSON path to `data files upload-to-local-storage --file` uploads the JSON text as the file's bytes, it does not set a request body.
 
-**Prefer the composed `data files upload` over the manual steps below.** It runs presign → PUT → dms-upload for you (or the one-call local-storage path with `--local-storage`), so the file is both stored and visible in DMS afterward - no copy-pasting `uploadUrl`/`fileId` between commands:
+**Prefer the composed `data files upload` over the manual steps below.** For cloud storage it creates the file/version metadata and PUTs the bytes; for local storage it performs one multipart call. Either path creates the visible object directly—there is no DMS registration step:
 
 ```bash
 blocks data files upload --file ./invoice.pdf --access-modifier Public --dry-run --json
@@ -297,7 +297,8 @@ blocks data files upload --file ./invoice.pdf --local-storage --yes --json   # l
 Manual cloud-storage upload, if you need the intermediate steps for some reason (two calls):
 
 ```bash
-blocks data files presigned-upload-url --name invoice.pdf --access-modifier Public --json
+blocks data files presigned-upload-url --name invoice.pdf --access-modifier Public --dry-run --json
+blocks data files presigned-upload-url --name invoice.pdf --access-modifier Public --yes --json
 # take the returned uploadUrl and fileId, then:
 blocks data files upload-to-url --url "<uploadUrl>" --file ./invoice.pdf --content-type application/pdf --dry-run --json
 blocks data files upload-to-url --url "<uploadUrl>" --file ./invoice.pdf --content-type application/pdf --yes --json
@@ -310,11 +311,15 @@ blocks data files upload-to-local-storage --file ./invoice.pdf --access-modifier
 blocks data files upload-to-local-storage --file ./invoice.pdf --access-modifier Public --yes --json
 ```
 
-Either manual upload path only stores the bytes - it does not make the file appear in a DMS folder. Register it afterward if the user needs that (the composed `data files upload` above already does this step for you):
+Browse the resulting object tree with cursor pagination. Deletion defaults to trash:
 
 ```bash
-blocks data files dms-upload --file-storage-id <fileId> --artifact-name invoice.pdf --dry-run --json
-blocks data files dms-upload --file-storage-id <fileId> --artifact-name invoice.pdf --yes --json
+blocks data files list --parent-id <directoryId> --limit 50 --json
+blocks data files search invoice --directory-id <directoryId> --json
+blocks data files delete <fileId> --dry-run --json
+blocks data files delete <fileId> --yes --json
+blocks data files trash --json
+blocks data files restore <fileId> --dry-run --json
 ```
 
 ## Localization

package/README.md

@@ -84,8 +84,8 @@ Global options available on every command:
 | `blocks data schema get/get-by-name/aggregation/change-logs/delete/fields/info *` | Raw `/data/v4/schemas*` API beyond the file-oriented `list/pull/push` above: single-schema/by-name lookups, access-level aggregation, unadapted change logs, delete, and a metadata-first (`info *`) plus field-only (`fields`) alternative to `push`. Run `blocks --help` for the full flag reference. |
 | `blocks data rules policy get/delete` | Single data-access policy read/delete via `/data/v4/data-access/policy/*`, alongside the bulk file-oriented `rules pull/deploy` above. |
 | `blocks data validation list/get/by-schema/by-schema-field/save/delete` | Field-level validation rules via `/data/v4/data-validations*`. No file-oriented workflow exists for this yet; `save` is an upsert (omit `--item-id` to create) and requires a `validations` array via `--body`/`--file`. |
-| `blocks data files upload --file <path> [--local-storage]` | Composed upload: presigned-upload-url → PUT the file → dms-upload, threading the returned `uploadUrl`/`fileId` automatically (content-type inferred from the file extension if omitted). Pass `--local-storage` for the one-call `upload-to-local-storage` path instead. Prefer this over the individual steps below. |
-| `blocks data files *` | Full DMS/storage surface via `/data/v4/Files/*`: `get`/`get-many`/`info` (read), `presigned-upload-url` + `upload-to-url` (cloud storage, two steps) or `upload-to-local-storage` (one step, local storage), `update-additional-info`, `delete`, `dms-list`/`dms-upload` (folder browsing/file registration), `create-folder`/`delete-folder`. Here `--file <path>` is the local binary to upload/read, not a JSON payload file - see [AI_USAGE_GUIDE.md](AI_USAGE_GUIDE.md) for the distinction. |
+| `blocks data files upload --file <path> [--local-storage]` | Composed upload: cloud storage creates the file/version record and PUTs the bytes; local storage uses one multipart request. The file is immediately part of the object tree—there is no DMS registration step. |
+| `blocks data files *` | Full storage object-tree surface: file get/upload/metadata/delete/version/copy/move/rename, directory CRUD/move, cursor-paginated list/search/shared/trash, restore/purge, and access policy/share/inheritance commands. Delete defaults to trash; pass `--permanent` explicitly to remove data. Run `blocks --help` for flags. |
 | `blocks localization validate --module <name> --language <culture> [--file <path>] [--json]` | Validate a local i18n JSON dictionary. Supports nested JSON input and checks the flattened key/value set locally. |
 | `blocks localization push --module <name> --language <culture> [--file <path>] [--route <route>] [--context <text>] [--dry-run] [--yes] [--json]` | Create or update Localization keys from local i18n JSON via `/localization/v4/Key/SaveKeys`. Creates the module first through `/localization/v4/Module/Save` when missing. |
 | `blocks localization pull --module <name> --language <culture> [--out <path>] [--json]` | Download published cloud localization via `/localization/v4/Key/GetCloudUilmFile` and write a local JSON dictionary. |
@@ -95,9 +95,9 @@ Global options available on every command:
 | `blocks release status <buildId> [--json]` | Read Release build status by build id. Read-only. |
 | `blocks release builds list [repoId] [--repo-id <repoId>] [--json]` | List Release build details for a repository. When `repoId` is omitted, resolves it from the selected project's linked repo assets - auto-picked if there's exactly one, otherwise you're prompted to choose. Read-only. |
 | `blocks release builds get <buildId> [--json]` | Alias for `release status`. Read-only. |
-| `blocks new web <name> [--app-domain <domain>] [--client-id <oidcClientId>] [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>]` | Create a Vite React starter app that talks to Blocks exclusively through `@seliseblocks/client` (a single `createBlocksClient()` instance) using the SDK hosted IdP flow: `blocksClient.auth.idp.redirectToProvider()` on login click and `blocksClient.auth.idp.callback()` on `/login/callback`. Includes route guards, auto-refresh through `auth.oidc.refreshToken()`, live `auth`/`iam`/`data`/`localization` SDK examples, environment config, and safe `.gitignore` defaults. Uses the selected project (see `use`) unless `--x-blocks-key` overrides it. `--app-domain` and `--client-id` are resolved from the project record when omitted: the domain auto-picks if the project has exactly one, otherwise you're prompted to choose; the OIDC client is picked from the project's existing clients, or you can create a minimal one (display name + redirect URI) on the spot, or skip and register one later from the portal or `auth oidc-clients save`. When `--blocks-api-url` is omitted, `new web` derives it from the app domain as `https://blocksapi.<registrable-domain>`; for example `https://dqrsf.slsblx.com` becomes `https://blocksapi.slsblx.com`. Pass a different Data/IAM/Localization/OS gateway URL explicitly only if your project uses a non-default one. `--oidc-url` defaults to `https://iam.seliseblocks.com`. |
+| `blocks new web <name> [--app-domain <domain>] [--client-id <oidcClientId>] [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>]` | Create a Vite React starter app that talks to Blocks exclusively through `@seliseblocks/client` (a single `createBlocksClient()` instance) using the SDK hosted IdP flow: `blocksClient.auth.idp.redirectToProvider()` on login click and `blocksClient.auth.idp.callback()` on `/login/callback`. Includes route guards, auto-refresh through `auth.oidc.refreshToken()`, live `auth`/`iam`/`data`/`localization` SDK examples, environment config, and safe `.gitignore` defaults. Uses the selected project (see `use`) unless `--x-blocks-key` overrides it. `--app-domain` and `--client-id` are resolved from the project record when omitted: the domain auto-picks if the project has exactly one, otherwise you're prompted to choose; the OIDC client is picked from the project's existing clients, or you can create a minimal one (display name + redirect URI) on the spot, or skip and register one later from the portal or `auth oidc-clients save`. When `--blocks-api-url` is omitted, `new web` derives it from the app domain as `https://blocksapi.<registrable-domain>`; for example `https://dqrsf.slsblx.com` becomes `https://blocksapi.slsblx.com`. Pass a different Data/IAM/Localization/OS gateway URL explicitly only if your project uses a non-default one. `--oidc-url` defaults to `https://iam.seliseblocks.com`. |
 | `blocks skill list [--json]` / `skill show <name> [--json]` / `skill add <name> [--dir <path>]` | Local-only, no cloud calls: list/print the bundled `blocks-skills/*/SKILL.md` agent context docs, or copy a skill's entire directory (`SKILL.md` plus any supporting files) into `<dir>/<name>/` (default `./blocks-skills`) for use in a project outside this monorepo. `list`'s output and `show`/`add`'s "unknown skill" error both point at the full public skill catalog in case the bundled set is out of date. |
-| `blocks sdk client [--app-domain <domain>] [--client-id <oidcClientId>] [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>] [--json]` | Read-only: resolves this project's `@seliseblocks/client` config and prints a ready-to-paste `createBlocksClient(...)` snippet. Unlike `new web`, the API URL defaults to `https://api.seliseblocks.com` unless `--blocks-api-url` is passed. Passing both `--app-domain` and `--client-id` skips the project lookup entirely (no login required). Writes nothing - use `new web` to scaffold a full app. |
+| `blocks sdk client [--app-domain <domain>] [--client-id <oidcClientId>] [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>] [--json]` | Read-only: resolves this project's `@seliseblocks/client` config and prints a ready-to-paste `createBlocksClient(...)` snippet. Unlike `new web`, the API URL defaults to `https://api.seliseblocks.com` unless `--blocks-api-url` is passed. Passing both `--app-domain` and `--client-id` skips the project lookup entirely (no login required). Writes nothing - use `new web` to scaffold a full app. |
 
 Use `--json` on commands when AI or automation needs machine-readable output. Use `--dry-run` before mutations and `--yes` only after approval.
 
@@ -166,7 +166,7 @@ Localization dictionaries are not created by `init` - the default path is `block
 ## Boundaries
 
 - `iam me` reads the CLI operator's own account identity; every other `iam *`, `mfa *`, `auth idp *`/`auth config *`/`auth client-credentials *`/`auth oidc-clients *`, `mail *`, `notification *`, `notifier *`, `secrets *`, and `storage config *` command is project-scoped and requires a selected project (`blocks use <tenantId>`) plus an impersonated project token - none of them ever run against the account token.
-- Data covers the tenant data-source configuration, schema/rules/reload/validate, field-level validation rules, and the DMS/storage (`data files *`) surface. Prefer the composed `data sync` and `data files upload` over their individual steps.
+- Data covers tenant data-source configuration, schema/rules/reload/validate, field-level validation rules, and the storage object tree (`data files *`). Prefer the composed `data sync` and `data files upload` workflows.
 - Localization covers dictionary validate/pull/push plus the full raw `/localization/v4/*` API surface (assistant, config, glossary, key, language, module). Prefer `localization key translate-and-export` over running translate/generate/export by hand.
 - Release covers deploy trigger and build status/read commands only.
 - No direct artifact upload unless Blocks Release adds a confirmed artifact upload API.

package/dist/commands/auth/idp/create.d.ts

@@ -1 +1,8 @@
+/**
+ * The endpoint URLs are not decoration: `GET /iam/v4/idp/initiate` builds the
+ * provider authorize URL from the stored `authorizationUrl` and falls back to an
+ * empty base when it is missing, so a provider saved without it hands the browser
+ * a bare query string. Apple-only fields (teamId/keyId/privateKey/appleAudience)
+ * stay in --body/--file so no private key lands in shell history.
+ */
 export declare function authIdpCreate(argv: string[]): Promise<void>;

package/dist/commands/auth/idp/create.js

@@ -1,25 +1,44 @@
-import { booleanFlag, stringFlag } from "../../../lib/args.js";
+import { booleanFlag, optionalBooleanFlag, stringFlag } from "../../../lib/args.js";
 import { blocksRequest } from "../../../lib/api.js";
 import { confirmMutation } from "../../../lib/confirm.js";
 import { compact, jsonBodyFlag, listFlag } from "../../../lib/json-flag.js";
 import { writeOutput } from "../../../lib/output.js";
 import { requestContext } from "../../../lib/request-context.js";
 import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+/**
+ * The endpoint URLs are not decoration: `GET /iam/v4/idp/initiate` builds the
+ * provider authorize URL from the stored `authorizationUrl` and falls back to an
+ * empty base when it is missing, so a provider saved without it hands the browser
+ * a bare query string. Apple-only fields (teamId/keyId/privateKey/appleAudience)
+ * stay in --body/--file so no private key lands in shell history.
+ */
 export async function authIdpCreate(argv) {
     const { flags } = parseCommand(argv);
     const body = {
         ...(await jsonBodyFlag(flags)),
         ...compact({
+            authorizationUrl: stringFlag(flags, "authorization-url") || undefined,
             clientId: stringFlag(flags, "client-id") || undefined,
             clientSecret: stringFlag(flags, "client-secret") || undefined,
             displayName: stringFlag(flags, "display-name") || undefined,
-            isActive: booleanFlag(flags, "active") || undefined,
+            grantTypes: listFlag(flags, "grant-types"),
+            icon: stringFlag(flags, "icon") || undefined,
+            initialPermissions: listFlag(flags, "initial-permissions"),
+            initialRoles: listFlag(flags, "initial-roles"),
+            isActive: optionalBooleanFlag(flags, "active"),
             issuer: stringFlag(flags, "issuer") || undefined,
+            jwksUri: stringFlag(flags, "jwks-uri") || undefined,
             protocol: stringFlag(flags, "protocol") || undefined,
             provider: stringFlag(flags, "provider") || undefined,
             providerType: stringFlag(flags, "provider-type") || undefined,
             redirectUris: listFlag(flags, "redirect-uris"),
-            scope: stringFlag(flags, "scope") || undefined
+            requirePkce: optionalBooleanFlag(flags, "require-pkce"),
+            responseType: stringFlag(flags, "response-type") || undefined,
+            scope: stringFlag(flags, "scope") || undefined,
+            tokenEndpointAuthMethod: stringFlag(flags, "token-endpoint-auth-method") || undefined,
+            tokenUrl: stringFlag(flags, "token-url") || undefined,
+            userInfoUrl: stringFlag(flags, "user-info-url") || undefined,
+            wellKnownUrl: stringFlag(flags, "well-known-url") || undefined
         })
     };
     if (!body.provider || !body.providerType || !body.protocol || !body.clientId) {

package/dist/commands/auth/idp/update.d.ts

@@ -3,5 +3,12 @@
  * IAM requires them to echo the existing value when supplied, so only pass them
  * via --provider/--provider-type/--protocol/--client-id if you're re-sending the
  * current configuration alongside other field changes.
+ *
+ * This is also the only endpoint that can set the OIDC endpoint URLs: the create
+ * endpoint silently drops authorizationUrl/tokenUrl/userInfoUrl, and a provider
+ * auto-registered from an OIDC client (--register-as-identity-provider) never has
+ * them. `GET /iam/v4/idp/initiate` needs authorizationUrl, so a freshly created
+ * provider has to be patched here before hosted login works. Apple-only fields
+ * stay in --body/--file so no private key lands in shell history.
  */
 export declare function authIdpUpdate(argv: string[]): Promise<void>;

package/dist/commands/auth/idp/update.js

@@ -1,4 +1,4 @@
-import { booleanFlag, stringFlag } from "../../../lib/args.js";
+import { booleanFlag, optionalBooleanFlag, stringFlag } from "../../../lib/args.js";
 import { blocksRequest } from "../../../lib/api.js";
 import { confirmMutation } from "../../../lib/confirm.js";
 import { compact, jsonBodyFlag, listFlag } from "../../../lib/json-flag.js";
@@ -10,6 +10,13 @@ import { parseCommand, selectedProject } from "../../../lib/workspace.js";
  * IAM requires them to echo the existing value when supplied, so only pass them
  * via --provider/--provider-type/--protocol/--client-id if you're re-sending the
  * current configuration alongside other field changes.
+ *
+ * This is also the only endpoint that can set the OIDC endpoint URLs: the create
+ * endpoint silently drops authorizationUrl/tokenUrl/userInfoUrl, and a provider
+ * auto-registered from an OIDC client (--register-as-identity-provider) never has
+ * them. `GET /iam/v4/idp/initiate` needs authorizationUrl, so a freshly created
+ * provider has to be patched here before hosted login works. Apple-only fields
+ * stay in --body/--file so no private key lands in shell history.
  */
 export async function authIdpUpdate(argv) {
     const { args, flags } = parseCommand(argv);
@@ -17,15 +24,27 @@ export async function authIdpUpdate(argv) {
     const body = {
         ...(await jsonBodyFlag(flags)),
         ...compact({
+            authorizationUrl: stringFlag(flags, "authorization-url") || undefined,
             clientId: stringFlag(flags, "client-id") || undefined,
             displayName: stringFlag(flags, "display-name") || undefined,
-            isActive: booleanFlag(flags, "active") || undefined,
+            grantTypes: listFlag(flags, "grant-types"),
+            icon: stringFlag(flags, "icon") || undefined,
+            initialPermissions: listFlag(flags, "initial-permissions"),
+            initialRoles: listFlag(flags, "initial-roles"),
+            isActive: optionalBooleanFlag(flags, "active"),
             issuer: stringFlag(flags, "issuer") || undefined,
+            jwksUri: stringFlag(flags, "jwks-uri") || undefined,
             protocol: stringFlag(flags, "protocol") || undefined,
             provider: stringFlag(flags, "provider") || undefined,
             providerType: stringFlag(flags, "provider-type") || undefined,
             redirectUris: listFlag(flags, "redirect-uris"),
-            scope: stringFlag(flags, "scope") || undefined
+            requirePkce: optionalBooleanFlag(flags, "require-pkce"),
+            responseType: stringFlag(flags, "response-type") || undefined,
+            scope: stringFlag(flags, "scope") || undefined,
+            tokenEndpointAuthMethod: stringFlag(flags, "token-endpoint-auth-method") || undefined,
+            tokenUrl: stringFlag(flags, "token-url") || undefined,
+            userInfoUrl: stringFlag(flags, "user-info-url") || undefined,
+            wellKnownUrl: stringFlag(flags, "well-known-url") || undefined
         })
     };
     if (booleanFlag(flags, "dry-run")) {

package/dist/commands/data/files/delete.js

@@ -8,17 +8,18 @@ import { parseCommand, selectedProject } from "../../../lib/workspace.js";
 export async function dataFilesDelete(argv) {
     const { args, flags } = parseCommand(argv);
     const fileId = args[0] || stringFlag(flags, "file-id", { required: true });
-    const body = { fileId, ...compact({
+    const permanent = booleanFlag(flags, "permanent");
+    const body = { fileId, permanent, ...compact({
             configurationName: stringFlag(flags, "configuration-name") || undefined,
             eventQueueName: stringFlag(flags, "event-queue-name") || undefined
         }) };
     if (booleanFlag(flags, "dry-run")) {
-        writeOutput({ dryRun: true, endpoint: "/data/v4/Files/DeleteFile", request: body }, flags);
+        writeOutput({ dryRun: true, endpoint: "/data/v4/files/delete-file", request: body }, flags);
         return;
     }
-    await confirmMutation(flags, `Delete file '${fileId}'.`);
+    await confirmMutation(flags, `${permanent ? "Permanently delete" : "Move"} file '${fileId}'${permanent ? "" : " to trash"}.`);
     const projectKey = await selectedProject(flags);
-    const result = await blocksRequest("/data/v4/Files/DeleteFile", {
+    const result = await blocksRequest("/data/v4/files/delete-file", {
         body,
         impersonatedProjectAuth: true,
         ...requestContext(flags),

package/dist/commands/data/files/get-many.js

@@ -14,7 +14,7 @@ export async function dataFilesGetMany(argv) {
         fileIds
     });
     const projectKey = await selectedProject(flags);
-    const result = await blocksRequest("/data/v4/Files/GetFiles", {
+    const result = await blocksRequest("/data/v4/files/get-files", {
         body,
         impersonatedProjectAuth: true,
         ...requestContext(flags),

package/dist/commands/data/files/get.js

@@ -7,7 +7,7 @@ export async function dataFilesGet(argv) {
     const { args, flags } = parseCommand(argv);
     const fileId = args[0] || stringFlag(flags, "file-id", { required: true });
     const projectKey = await selectedProject(flags);
-    const result = await blocksRequest("/data/v4/Files/GetFile", {
+    const result = await blocksRequest("/data/v4/files/get-file", {
         impersonatedProjectAuth: true,
         ...requestContext(flags),
         projectTenantId: projectKey,

package/dist/commands/data/files/info.js

@@ -20,7 +20,7 @@ export async function dataFilesInfo(argv) {
         }
     };
     const projectKey = await selectedProject(flags);
-    const result = await blocksRequest("/data/v4/Files/GetFilesInfo", {
+    const result = await blocksRequest("/data/v4/files/get-files-info", {
         body,
         impersonatedProjectAuth: true,
         ...requestContext(flags),

package/dist/commands/data/files/object-tree.d.ts

@@ -0,0 +1,23 @@
+export declare function dataFilesList(argv: string[]): Promise<void>;
+export declare function dataFilesSearch(argv: string[]): Promise<void>;
+export declare function dataFilesTrash(argv: string[]): Promise<void>;
+export declare function dataFilesShared(argv: string[]): Promise<void>;
+export declare function dataFilesRestore(argv: string[]): Promise<void>;
+export declare function dataFilesPurge(argv: string[]): Promise<void>;
+export declare function dataFilesDirectoryCreate(argv: string[]): Promise<void>;
+export declare function dataFilesDirectoryGet(argv: string[]): Promise<void>;
+export declare function dataFilesDirectoryUpdate(argv: string[]): Promise<void>;
+export declare function dataFilesDirectoryDelete(argv: string[]): Promise<void>;
+export declare function dataFilesDirectoryMove(argv: string[]): Promise<void>;
+export declare function dataFilesVersions(argv: string[]): Promise<void>;
+export declare function dataFilesCreateVersion(argv: string[]): Promise<void>;
+export declare function dataFilesCopy(argv: string[]): Promise<void>;
+export declare function dataFilesMove(argv: string[]): Promise<void>;
+export declare function dataFilesRename(argv: string[]): Promise<void>;
+export declare function dataFilesAccessList(argv: string[]): Promise<void>;
+export declare function dataFilesAccessGrant(argv: string[]): Promise<void>;
+export declare function dataFilesAccessUpdate(argv: string[]): Promise<void>;
+export declare function dataFilesAccessRevoke(argv: string[]): Promise<void>;
+export declare function dataFilesAccessResolve(argv: string[]): Promise<void>;
+export declare function dataFilesInheritance(argv: string[]): Promise<void>;
+export declare function dataFilesShare(argv: string[]): Promise<void>;

package/dist/commands/data/files/object-tree.js

@@ -0,0 +1,238 @@
+import { booleanFlag, optionalBooleanFlag, optionalIntegerFlag, stringFlag } from "../../../lib/args.js";
+import { blocksRequest } from "../../../lib/api.js";
+import { confirmMutation } from "../../../lib/confirm.js";
+import { compact, jsonBodyFlag, listFlag } from "../../../lib/json-flag.js";
+import { writeOutput } from "../../../lib/output.js";
+import { requestContext } from "../../../lib/request-context.js";
+import { parseCommand, selectedProject } from "../../../lib/workspace.js";
+export async function dataFilesList(argv) {
+    const { flags } = parseCommand(argv);
+    await read("/data/v4/objects/get-objects", flags, compact({
+        cursor: stringFlag(flags, "cursor") || undefined,
+        limit: optionalIntegerFlag(flags, "limit"),
+        moduleName: optionalIntegerFlag(flags, "module-name"),
+        parentDirectoryId: parentId(flags) || undefined,
+        search: stringFlag(flags, "search") || undefined,
+        type: stringFlag(flags, "type") || undefined
+    }));
+}
+export async function dataFilesSearch(argv) {
+    const { args, flags } = parseCommand(argv);
+    await read("/data/v4/objects/search-objects", flags, compact({
+        cursor: stringFlag(flags, "cursor") || undefined,
+        directoryId: stringFlag(flags, "directory-id") || undefined,
+        limit: optionalIntegerFlag(flags, "limit"),
+        query: args[0] || stringFlag(flags, "query", { required: true }),
+        type: stringFlag(flags, "type") || undefined
+    }));
+}
+export async function dataFilesTrash(argv) {
+    const { flags } = parseCommand(argv);
+    await read("/data/v4/objects/get-trash", flags, pageQuery(flags));
+}
+export async function dataFilesShared(argv) {
+    const { flags } = parseCommand(argv);
+    await read("/data/v4/objects/get-shared-objects", flags, pageQuery(flags));
+}
+export async function dataFilesRestore(argv) {
+    const { args, flags } = parseCommand(argv);
+    const resourceId = resourceArg(args, flags);
+    await mutate("/data/v4/objects/restore-from-trash", flags, { resourceId }, `Restore storage object '${resourceId}' from trash.`);
+}
+export async function dataFilesPurge(argv) {
+    const { args, flags } = parseCommand(argv);
+    const resourceId = resourceArg(args, flags);
+    await mutate("/data/v4/objects/delete-from-trash", flags, { resourceId }, `Permanently delete storage object '${resourceId}' from trash.`);
+}
+export async function dataFilesDirectoryCreate(argv) {
+    const { args, flags } = parseCommand(argv);
+    const base = await jsonBodyFlag(flags);
+    const name = args[0] || stringFlag(flags, "name") || String(base.name ?? "");
+    if (!name)
+        throw new Error("Provide a directory name as the first argument or --name.");
+    const body = { ...base, ...compact({
+            allowedFileExtensions: listFlag(flags, "allowed-extensions"),
+            configurationName: stringFlag(flags, "configuration-name") || undefined,
+            description: stringFlag(flags, "description") || undefined,
+            moduleName: optionalIntegerFlag(flags, "module-name"),
+            name,
+            parentDirectoryId: parentId(flags) || undefined
+        }) };
+    await mutate("/data/v4/directory/create-directory", flags, body, `Create storage directory '${name}'.`);
+}
+export async function dataFilesDirectoryGet(argv) {
+    const { args, flags } = parseCommand(argv);
+    const directoryId = directoryArg(args, flags);
+    await read("/data/v4/directory/get-directory", flags, { directoryId });
+}
+export async function dataFilesDirectoryUpdate(argv) {
+    const { args, flags } = parseCommand(argv);
+    const directoryId = directoryArg(args, flags);
+    const body = { ...(await jsonBodyFlag(flags)), ...compact({
+            description: stringFlag(flags, "description") || undefined,
+            directoryId,
+            name: stringFlag(flags, "name") || undefined
+        }) };
+    await mutate("/data/v4/directory/update-directory", flags, body, `Update storage directory '${directoryId}'.`);
+}
+export async function dataFilesDirectoryDelete(argv) {
+    const { args, flags } = parseCommand(argv);
+    const directoryId = directoryArg(args, flags);
+    const permanent = booleanFlag(flags, "permanent");
+    await mutate("/data/v4/directory/delete-directory", flags, { directoryId, permanent }, `${permanent ? "Permanently delete" : "Move"} storage directory '${directoryId}'${permanent ? "" : " to trash"}.`);
+}
+export async function dataFilesDirectoryMove(argv) {
+    const { args, flags } = parseCommand(argv);
+    const directoryId = directoryArg(args, flags);
+    const targetDirectoryId = stringFlag(flags, "target-directory-id") || stringFlag(flags, "target-id");
+    await mutate("/data/v4/directory/move-directory", flags, { directoryId, targetDirectoryId }, `Move storage directory '${directoryId}'.`);
+}
+export async function dataFilesVersions(argv) {
+    const { args, flags } = parseCommand(argv);
+    await read("/data/v4/files/get-file-versions", flags, compact({
+        cursor: stringFlag(flags, "cursor") || undefined,
+        fileId: fileArg(args, flags),
+        limit: optionalIntegerFlag(flags, "limit")
+    }));
+}
+export async function dataFilesCreateVersion(argv) {
+    const { args, flags } = parseCommand(argv);
+    const fileId = fileArg(args, flags);
+    await mutate("/data/v4/files/create-file-version", flags, compact({
+        configurationName: stringFlag(flags, "configuration-name") || undefined,
+        fileId
+    }), `Create a new upload version for file '${fileId}'.`);
+}
+export async function dataFilesCopy(argv) {
+    const { args, flags } = parseCommand(argv);
+    const fileId = fileArg(args, flags);
+    const targetDirectoryId = stringFlag(flags, "target-directory-id", { required: true });
+    await mutate("/data/v4/files/copy-file", flags, {
+        copyAccessPolicies: booleanFlag(flags, "copy-access-policies"), fileId, targetDirectoryId
+    }, `Copy file '${fileId}' to directory '${targetDirectoryId}'.`);
+}
+export async function dataFilesMove(argv) {
+    const { args, flags } = parseCommand(argv);
+    const fileId = fileArg(args, flags);
+    const targetDirectoryId = stringFlag(flags, "target-directory-id", { required: true });
+    await mutate("/data/v4/files/move-file", flags, { fileId, targetDirectoryId }, `Move file '${fileId}' to directory '${targetDirectoryId}'.`);
+}
+export async function dataFilesRename(argv) {
+    const { args, flags } = parseCommand(argv);
+    const fileId = fileArg(args, flags);
+    const name = stringFlag(flags, "name", { required: true });
+    await mutate("/data/v4/files/rename-file", flags, { fileId, name }, `Rename file '${fileId}' to '${name}'.`);
+}
+export async function dataFilesAccessList(argv) {
+    const { args, flags } = parseCommand(argv);
+    await read("/data/v4/objects/get-access-policies", flags, { resourceId: resourceArg(args, flags) });
+}
+export async function dataFilesAccessGrant(argv) {
+    await accessMutation(argv, "/data/v4/objects/grant-access", "Grant access to");
+}
+export async function dataFilesAccessUpdate(argv) {
+    await accessMutation(argv, "/data/v4/objects/update-access-policy", "Update access on", true);
+}
+export async function dataFilesAccessRevoke(argv) {
+    const { args, flags } = parseCommand(argv);
+    const resourceId = resourceArg(args, flags);
+    const policyItemId = stringFlag(flags, "policy-id", { required: true });
+    await mutate("/data/v4/objects/revoke-access-policy", flags, { policyItemId, resourceId }, `Revoke access policy '${policyItemId}' from '${resourceId}'.`);
+}
+export async function dataFilesAccessResolve(argv) {
+    const { args, flags } = parseCommand(argv);
+    await read("/data/v4/objects/resolve-access", flags, { resourceId: resourceArg(args, flags) });
+}
+export async function dataFilesInheritance(argv) {
+    const { args, flags } = parseCommand(argv);
+    const base = await jsonBodyFlag(flags);
+    const value = optionalBooleanFlag(flags, "enabled");
+    const inheritsParentAccess = value ?? base.inheritsParentAccess;
+    if (typeof inheritsParentAccess !== "boolean")
+        throw new Error("Provide --enabled=true|false.");
+    const resourceId = resourceArg(args, flags, base);
+    await mutate("/data/v4/objects/toggle-inheritance", flags, { ...base, inheritsParentAccess, resourceId }, `Set inheritance on '${resourceId}' to ${inheritsParentAccess}.`);
+}
+export async function dataFilesShare(argv) {
+    const { args, flags } = parseCommand(argv);
+    const base = await jsonBodyFlag(flags);
+    const resourceId = resourceArg(args, flags, base);
+    const body = accessBody(base, flags, resourceId);
+    delete body.effect;
+    delete body.policyItemId;
+    await mutate("/data/v4/objects/share-object", flags, body, `Share storage object '${resourceId}'.`);
+}
+async function accessMutation(argv, endpoint, action, update = false) {
+    const { args, flags } = parseCommand(argv);
+    const base = await jsonBodyFlag(flags);
+    const resourceId = resourceArg(args, flags, base);
+    const body = accessBody(base, flags, resourceId);
+    if (update && !body.policyItemId)
+        throw new Error("Provide --policy-id when updating an access policy.");
+    await mutate(endpoint, flags, body, `${action} storage object '${resourceId}'.`);
+}
+function accessBody(base, flags, resourceId) {
+    const body = { ...base, ...compact({
+            effect: stringFlag(flags, "effect") || undefined,
+            expiresAt: stringFlag(flags, "expires-at") || undefined,
+            permission: stringFlag(flags, "permission") || undefined,
+            policyItemId: stringFlag(flags, "policy-id") || undefined,
+            principalId: stringFlag(flags, "principal-id") || undefined,
+            principalType: stringFlag(flags, "principal-type") || undefined,
+            priority: optionalIntegerFlag(flags, "priority"),
+            resourceId,
+            resourceType: stringFlag(flags, "resource-type") || undefined
+        }) };
+    for (const field of ["permission", "principalType", "resourceType"]) {
+        if (!body[field])
+            throw new Error(`Provide --${field.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`)}.`);
+    }
+    return body;
+}
+async function read(endpoint, flags, query) {
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest(endpoint, {
+        impersonatedProjectAuth: true,
+        ...requestContext(flags),
+        projectTenantId: projectKey,
+        query
+    });
+    writeOutput(result, flags);
+}
+async function mutate(endpoint, flags, body, prompt) {
+    if (booleanFlag(flags, "dry-run")) {
+        writeOutput({ dryRun: true, endpoint, request: body }, flags);
+        return;
+    }
+    await confirmMutation(flags, prompt);
+    const projectKey = await selectedProject(flags);
+    const result = await blocksRequest(endpoint, {
+        body,
+        impersonatedProjectAuth: true,
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    writeOutput(result, flags);
+}
+function pageQuery(flags) {
+    return compact({
+        cursor: stringFlag(flags, "cursor") || undefined,
+        limit: optionalIntegerFlag(flags, "limit"),
+        type: stringFlag(flags, "type") || undefined
+    });
+}
+function parentId(flags) {
+    return stringFlag(flags, "parent-directory-id") || stringFlag(flags, "parent-id");
+}
+function resourceArg(args, flags, base = {}) {
+    const value = args[0] || stringFlag(flags, "resource-id") || String(base.resourceId ?? "");
+    if (!value)
+        throw new Error("Provide a resource id as the first argument or --resource-id.");
+    return value;
+}
+function directoryArg(args, flags) {
+    return args[0] || stringFlag(flags, "directory-id", { required: true });
+}
+function fileArg(args, flags) {
+    return args[0] || stringFlag(flags, "file-id", { required: true });
+}

package/dist/commands/data/files/presigned-upload-url.js

@@ -1,5 +1,6 @@
-import { optionalIntegerFlag, stringFlag } from "../../../lib/args.js";
+import { booleanFlag, optionalIntegerFlag, stringFlag } from "../../../lib/args.js";
 import { blocksRequest } from "../../../lib/api.js";
+import { confirmMutation } from "../../../lib/confirm.js";
 import { compact, jsonBodyFlag } from "../../../lib/json-flag.js";
 import { writeOutput } from "../../../lib/output.js";
 import { requestContext } from "../../../lib/request-context.js";
@@ -16,6 +17,7 @@ export async function dataFilesPresignedUploadUrl(argv) {
         ...compact({
             accessModifier: stringFlag(flags, "access-modifier") || undefined,
             configurationName: stringFlag(flags, "configuration-name") || undefined,
+            itemId: stringFlag(flags, "item-id") || undefined,
             metaData: stringFlag(flags, "meta-data") || undefined,
             moduleName: optionalIntegerFlag(flags, "module-name"),
             name: stringFlag(flags, "name", { required: true }),
@@ -23,8 +25,13 @@ export async function dataFilesPresignedUploadUrl(argv) {
             tags: stringFlag(flags, "tags") || undefined
         })
     };
+    if (booleanFlag(flags, "dry-run")) {
+        writeOutput({ dryRun: true, endpoint: "/data/v4/files/get-pre-signed-url-for-upload", request: body }, flags);
+        return;
+    }
+    await confirmMutation(flags, `Create file metadata and an upload URL for '${body.name}'.`);
     const projectKey = await selectedProject(flags);
-    const result = await blocksRequest("/data/v4/Files/GetPreSignedUrlForUpload", {
+    const result = await blocksRequest("/data/v4/files/get-pre-signed-url-for-upload", {
         body,
         impersonatedProjectAuth: true,
         ...requestContext(flags),

package/dist/commands/data/files/update-additional-info.js

@@ -11,12 +11,12 @@ export async function dataFilesUpdateAdditionalInfo(argv) {
     const additionalProperties = JSON.parse(additionalPropertiesRaw);
     const body = { additionalProperties, itemId };
     if (booleanFlag(flags, "dry-run")) {
-        writeOutput({ dryRun: true, endpoint: "/data/v4/Files/UpdateFileAdditionalInfo", request: body }, flags);
+        writeOutput({ dryRun: true, endpoint: "/data/v4/files/update-file-additional-info", request: body }, flags);
         return;
     }
     await confirmMutation(flags, `Update additional info for file '${itemId}'.`);
     const projectKey = await selectedProject(flags);
-    const result = await blocksRequest("/data/v4/Files/UpdateFileAdditionalInfo", {
+    const result = await blocksRequest("/data/v4/files/update-file-additional-info", {
         body,
         impersonatedProjectAuth: true,
         ...requestContext(flags),