@seliseblocks/cli-os 0.2.2 → 0.2.4

package/dist/commands/data/files/upload-to-local-storage.js

@@ -16,7 +16,7 @@ export async function dataFilesUploadToLocalStorage(argv) {
     const name = stringFlag(flags, "name") || basename(filePath);
     const additionalPropertiesRaw = stringFlag(flags, "additional-properties");
     if (booleanFlag(flags, "dry-run")) {
-        writeOutput({ dryRun: true, endpoint: "/data/v4/Files/UploadFileToLocalStorage", name, request: { file: filePath } }, flags);
+        writeOutput({ dryRun: true, endpoint: "/data/v4/files/upload-file-to-local-storage", name, request: { file: filePath } }, flags);
         return;
     }
     await confirmMutation(flags, `Upload '${filePath}' to local storage as '${name}'.`);
@@ -45,7 +45,7 @@ export async function dataFilesUploadToLocalStorage(argv) {
             form.set(`AdditionalProperties[${key}]`, value);
     }
     const projectKey = await selectedProject(flags);
-    const result = await blocksRequest("/data/v4/Files/UploadFileToLocalStorage", {
+    const result = await blocksRequest("/data/v4/files/upload-file-to-local-storage", {
         body: form,
         impersonatedProjectAuth: true,
         ...requestContext(flags),

package/dist/commands/data/files/upload.d.ts

@@ -1,7 +1,5 @@
 /**
- * Composed upload: give it a local file, it runs the right sequence of API calls itself --
- * presign + PUT + DMS-register for cloud storage (--local-storage for the single-call
- * local-storage path) -- instead of you chaining presigned-upload-url/upload-to-url/dms-upload
- * (or upload-to-local-storage) by hand.
+ * Composed upload: create the file/version metadata and PUT cloud bytes, or use the
+ * one-call local-storage path. The upload is immediately part of the object tree.
  */
 export declare function dataFilesUpload(argv: string[]): Promise<void>;

package/dist/commands/data/files/upload.js

@@ -3,7 +3,7 @@ import { basename, extname } from "node:path";
 import { booleanFlag, optionalIntegerFlag, stringFlag } from "../../../lib/args.js";
 import { blocksRequest } from "../../../lib/api.js";
 import { confirmMutation } from "../../../lib/confirm.js";
-import { compact, listFlag } from "../../../lib/json-flag.js";
+import { compact } from "../../../lib/json-flag.js";
 import { writeOutput } from "../../../lib/output.js";
 import { requestContext } from "../../../lib/request-context.js";
 import { parseCommand, selectedProject } from "../../../lib/workspace.js";
@@ -25,10 +25,8 @@ const CONTENT_TYPES = {
     ".zip": "application/zip"
 };
 /**
- * Composed upload: give it a local file, it runs the right sequence of API calls itself --
- * presign + PUT + DMS-register for cloud storage (--local-storage for the single-call
- * local-storage path) -- instead of you chaining presigned-upload-url/upload-to-url/dms-upload
- * (or upload-to-local-storage) by hand.
+ * Composed upload: create the file/version metadata and PUT cloud bytes, or use the
+ * one-call local-storage path. The upload is immediately part of the object tree.
  */
 export async function dataFilesUpload(argv) {
     const { flags } = parseCommand(argv);
@@ -43,7 +41,7 @@ export async function dataFilesUpload(argv) {
 async function uploadToLocalStorage(filePath, name, flags) {
     const parentDirectoryId = stringFlag(flags, "parent-id") || stringFlag(flags, "parent-directory-id");
     if (booleanFlag(flags, "dry-run")) {
-        writeOutput({ dryRun: true, endpoint: "/data/v4/Files/UploadFileToLocalStorage", file: filePath, name }, flags);
+        writeOutput({ dryRun: true, endpoint: "/data/v4/files/upload-file-to-local-storage", file: filePath, name }, flags);
         return;
     }
     await confirmMutation(flags, `Upload '${filePath}' to local storage as '${name}'.`);
@@ -52,6 +50,9 @@ async function uploadToLocalStorage(filePath, name, flags) {
     form.set("Name", name);
     if (parentDirectoryId)
         form.set("ParentDirectoryId", parentDirectoryId);
+    const itemId = stringFlag(flags, "item-id");
+    if (itemId)
+        form.set("ItemId", itemId);
     const tags = stringFlag(flags, "tags");
     if (tags)
         form.set("Tags", tags);
@@ -62,7 +63,7 @@ async function uploadToLocalStorage(filePath, name, flags) {
     if (configurationName)
         form.set("ConfigurationName", configurationName);
     const projectKey = await selectedProject(flags);
-    const result = await blocksRequest("/data/v4/Files/UploadFileToLocalStorage", {
+    const result = await blocksRequest("/data/v4/files/upload-file-to-local-storage", {
         body: form,
         impersonatedProjectAuth: true,
         ...requestContext(flags),
@@ -77,6 +78,7 @@ async function uploadViaPresignedUrl(filePath, name, flags) {
     const presignBody = compact({
         accessModifier: stringFlag(flags, "access-modifier") || undefined,
         configurationName: stringFlag(flags, "configuration-name") || undefined,
+        itemId: stringFlag(flags, "item-id") || undefined,
         metaData: stringFlag(flags, "meta-data") || undefined,
         moduleName: optionalIntegerFlag(flags, "module-name"),
         name,
@@ -87,16 +89,15 @@ async function uploadViaPresignedUrl(filePath, name, flags) {
         writeOutput({
             dryRun: true,
             steps: [
-                { body: presignBody, endpoint: "/data/v4/Files/GetPreSignedUrlForUpload" },
-                { contentType, endpoint: "PUT <uploadUrl>", file: filePath },
-                { endpoint: "/data/v4/Files/UploadFile" }
+                { body: presignBody, endpoint: "/data/v4/files/get-pre-signed-url-for-upload" },
+                { contentType, endpoint: "PUT <uploadUrl>", file: filePath }
             ]
         }, flags);
         return;
     }
-    await confirmMutation(flags, `Upload '${filePath}' as '${name}' (presign + PUT + DMS register).`);
+    await confirmMutation(flags, `Upload '${filePath}' as '${name}' (create metadata + PUT bytes).`);
     const projectKey = await selectedProject(flags);
-    const presigned = await blocksRequest("/data/v4/Files/GetPreSignedUrlForUpload", {
+    const presigned = await blocksRequest("/data/v4/files/get-pre-signed-url-for-upload", {
         body: presignBody,
         impersonatedProjectAuth: true,
         ...requestContext(flags),
@@ -118,22 +119,7 @@ async function uploadViaPresignedUrl(filePath, name, flags) {
     if (!putResponse.ok) {
         throw new Error(`Upload PUT ${putResponse.status} ${putResponse.statusText}: ${await putResponse.text().catch(() => "")}`);
     }
-    const registered = await blocksRequest("/data/v4/Files/UploadFile", {
-        body: {
-            upload: [
-                compact({
-                    artifactName: name,
-                    fileStorageId: fileId,
-                    parentId: parentDirectoryId || undefined,
-                    tags: listFlag(flags, "tags")
-                })
-            ]
-        },
-        impersonatedProjectAuth: true,
-        ...requestContext(flags),
-        projectTenantId: projectKey
-    });
-    writeOutput({ fileId, registered, uploadUrl }, flags);
+    writeOutput({ fileId, uploadUrl, uploaded: true }, flags);
 }
 function firstString(record, keys) {
     for (const key of keys) {

package/dist/commands/new/web.js

@@ -132,8 +132,12 @@ async function createOidcClientInteractively(tenantId, appDomain, appName, flags
     const defaultRedirect = `https://${appDomain}/login/callback`;
     const displayName = (await promptText(`OIDC client display name [${appName}]: `)) || appName;
     const redirectUri = (await promptText(`Redirect URI [${defaultRedirect}]: `)) || defaultRedirect;
+    // clientType drives IAM's tokenEndpointAuthMethod: omitting it stores this browser
+    // app as confidential ("client_secret_post") and lets it request client_credentials.
+    // The scaffold only ever produces a PKCE SPA, so it is always "public".
     const body = {
         clientDisplayName: displayName,
+        clientType: "public",
         isActive: true,
         redirectUris: [redirectUri],
         registerAsIdentityProvider: true,

package/dist/index.js

@@ -31,11 +31,7 @@ import { dataValidationDelete } from "./commands/data/validation/delete.js";
 import { dataValidationGet } from "./commands/data/validation/get.js";
 import { dataValidationList } from "./commands/data/validation/list.js";
 import { dataValidationSave } from "./commands/data/validation/save.js";
-import { dataFilesCreateFolder } from "./commands/data/files/create-folder.js";
 import { dataFilesDelete } from "./commands/data/files/delete.js";
-import { dataFilesDeleteFolder } from "./commands/data/files/delete-folder.js";
-import { dataFilesDmsList } from "./commands/data/files/dms-list.js";
-import { dataFilesDmsUpload } from "./commands/data/files/dms-upload.js";
 import { dataFilesGet } from "./commands/data/files/get.js";
 import { dataFilesGetMany } from "./commands/data/files/get-many.js";
 import { dataFilesInfo } from "./commands/data/files/info.js";
@@ -44,6 +40,7 @@ import { dataFilesUpdateAdditionalInfo } from "./commands/data/files/update-addi
 import { dataFilesUpload } from "./commands/data/files/upload.js";
 import { dataFilesUploadToLocalStorage } from "./commands/data/files/upload-to-local-storage.js";
 import { dataFilesUploadToUrl } from "./commands/data/files/upload-to-url.js";
+import { dataFilesAccessGrant, dataFilesAccessList, dataFilesAccessResolve, dataFilesAccessRevoke, dataFilesAccessUpdate, dataFilesCopy, dataFilesCreateVersion, dataFilesDirectoryCreate, dataFilesDirectoryDelete, dataFilesDirectoryGet, dataFilesDirectoryMove, dataFilesDirectoryUpdate, dataFilesInheritance, dataFilesList, dataFilesMove, dataFilesPurge, dataFilesRename, dataFilesRestore, dataFilesSearch, dataFilesShare, dataFilesShared, dataFilesTrash, dataFilesVersions } from "./commands/data/files/object-tree.js";
 import { iamMe } from "./commands/iam/me.js";
 import { init } from "./commands/init.js";
 import { localizationAssistantTranslationSuggestion } from "./commands/localization/assistant/translation-suggestion.js";
@@ -243,10 +240,29 @@ const commands = {
     "data:files:upload-to-local-storage": dataFilesUploadToLocalStorage,
     "data:files:update-additional-info": dataFilesUpdateAdditionalInfo,
     "data:files:delete": dataFilesDelete,
-    "data:files:dms-list": dataFilesDmsList,
-    "data:files:dms-upload": dataFilesDmsUpload,
-    "data:files:create-folder": dataFilesCreateFolder,
-    "data:files:delete-folder": dataFilesDeleteFolder,
+    "data:files:list": dataFilesList,
+    "data:files:search": dataFilesSearch,
+    "data:files:trash": dataFilesTrash,
+    "data:files:shared": dataFilesShared,
+    "data:files:restore": dataFilesRestore,
+    "data:files:purge": dataFilesPurge,
+    "data:files:directory-create": dataFilesDirectoryCreate,
+    "data:files:directory-get": dataFilesDirectoryGet,
+    "data:files:directory-update": dataFilesDirectoryUpdate,
+    "data:files:directory-delete": dataFilesDirectoryDelete,
+    "data:files:directory-move": dataFilesDirectoryMove,
+    "data:files:versions": dataFilesVersions,
+    "data:files:create-version": dataFilesCreateVersion,
+    "data:files:copy": dataFilesCopy,
+    "data:files:move": dataFilesMove,
+    "data:files:rename": dataFilesRename,
+    "data:files:access-list": dataFilesAccessList,
+    "data:files:access-grant": dataFilesAccessGrant,
+    "data:files:access-update": dataFilesAccessUpdate,
+    "data:files:access-revoke": dataFilesAccessRevoke,
+    "data:files:access-resolve": dataFilesAccessResolve,
+    "data:files:inheritance": dataFilesInheritance,
+    "data:files:share": dataFilesShare,
     "localization:validate": localizationValidate,
     "localization:push": localizationPush,
     "localization:pull": localizationPull,
@@ -753,12 +769,24 @@ Auth Admin (/iam/v4/auth/identity-providers*, /config, /client-credentials, /oid
   blocks auth idp create --provider <p> --provider-type <t> --protocol <proto>
                               --client-id <id> [--client-secret] [--display-name] [--issuer]
                               [--scope] [--redirect-uris a,b] [--active]
+                              [--authorization-url] [--token-url] [--user-info-url]
+                              [--jwks-uri] [--well-known-url] [--response-type]
+                              [--grant-types a,b] [--require-pkce]
+                              [--token-endpoint-auth-method] [--initial-roles a,b]
+                              [--initial-permissions a,b] [--icon]
                               [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Rich provider configs (JWKS, private keys, initial roles, etc.) go in --body/--file;
-    the flags above cover the common OAuth/OIDC fields.
+    Apple-specific fields (teamId, keyId, privateKey, appleAudience) go in --body/--file
+    so no private key lands in shell history.
+    IAM's create endpoint stores issuer/jwksUri/wellKnownUrl but drops
+    authorizationUrl/tokenUrl/userInfoUrl -- set those with 'idp update' afterward.
   blocks auth idp update <id> [same flags as create, all optional] [--dry-run] [--yes] [--json]
     provider/providerType/protocol/clientId are immutable: omit them, or echo the
     existing values exactly if you also pass --body/--file.
+    The only endpoint that persists authorizationUrl/tokenUrl/userInfoUrl -- create accepts
+    and drops them, and update never re-runs discovery, so values set here stick. Use it to
+    repair a provider whose authorizationUrl came back null: '/idp/initiate' builds its
+    redirect from that field, so hosted login goes nowhere without it. Read the endpoint
+    values from the tenant's discovery document rather than composing them by hand.
   blocks auth idp delete <id> [--dry-run] [--yes] [--json]
     Irreversible; also deletes the related OIDC client registration.
   blocks auth idp status <id> --active|--active=false [--dry-run] [--yes] [--json]
@@ -795,6 +823,14 @@ Auth Admin (/iam/v4/auth/identity-providers*, /config, /client-credentials, /oid
                               [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
     Upsert: omit --item-id to register a new client, pass it to update an existing one.
     The response's client_secret is shown once and is not retrievable again afterward.
+    --client-type is not optional in practice: IAM derives tokenEndpointAuthMethod from it,
+    so omitting it stores a browser/SPA client as confidential ("client_secret_post") and
+    lets it request the client_credentials grant. Pass --client-type public for any
+    PKCE/browser client.
+    --register-as-identity-provider creates the linked identity provider in the same call.
+    Its authorize/token/userinfo/jwks/issuer values are filled from the discovery document
+    at --external-discovery-endpoint; with no discovery endpoint they are left null and the
+    provider's scope is replaced with "openid profile email". Verify with 'auth idp list'.
   blocks auth oidc-clients delete <clientId> [--dry-run] [--yes] [--json]
     Irreversible; revokes all tokens issued to the client.
   blocks auth oidc-clients rotate-secret <clientId> [--dry-run] [--yes] [--json]
@@ -890,26 +926,22 @@ Data:
       Upsert: omit --item-id to create, pass it to update.
     blocks data validation delete <validationId> [--dry-run] [--yes] [--json]
 
-  Files / DMS (/data/v4/Files/* - storage and document management; no SDK required, but see
-                the blocks-data-storage skill if writing this into app code instead of scripting it):
+  Storage object tree (files, directories, discovery, trash, versions, and access):
     blocks data files get <fileId> [--version] [--configuration-name] [--json]
     blocks data files get-many <fileId...>|--file-ids a,b [--configuration-name] [--json]
     blocks data files info [--name] [--tenant-id] [--page] [--page-size] [--sort-by]
                               [--sort-desc] [--json]
-    blocks data files upload --file <localPath> [--name] [--parent-id] [--tags]
+    blocks data files upload --file <localPath> [--name] [--item-id] [--parent-id] [--tags]
                               [--access-modifier Public|Private] [--content-type]
                               [--configuration-name] [--module-name <1-11>] [--local-storage]
                               [--dry-run] [--yes] [--json]
-      Composed flow: presigned-upload-url -> PUT the file -> dms-upload, threading the
-      returned uploadUrl/fileId automatically (content-type is inferred from the file
-      extension if omitted). Pass --local-storage to use the one-call
-      upload-to-local-storage path instead, for local-storage-backed projects.
-    blocks data files presigned-upload-url --name <fileName> [--parent-directory-id]
+      Cloud: create file/version metadata, then PUT bytes to the returned URL. Local:
+      one multipart request. The file appears in the object tree without registration.
+    blocks data files presigned-upload-url --name <fileName> [--item-id] [--parent-directory-id]
                               [--access-modifier Public|Private] [--configuration-name]
                               [--module-name <1-11>] [--meta-data] [--tags]
-                              [--body '<json>'|--file <path>] [--json]
-      Cloud-storage upload, step 1 of 2. Returns an uploadUrl and fileId; PUT the bytes next
-      with data files upload-to-url.
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+      Mutating cloud step 1: creates metadata/version and returns uploadUrl/fileId.
     blocks data files upload-to-url --url <presignedUrl> --file <localPath>
                               --content-type <type> [--blob-type BlockBlob] [--no-blob-type-header]
                               [--dry-run] [--yes] [--json]
@@ -922,18 +954,44 @@ Data:
     blocks data files update-additional-info <itemId> --additional-properties '<json>'
                               [--dry-run] [--yes] [--json]
     blocks data files delete <fileId> [--configuration-name] [--event-queue-name]
+                              [--permanent]
+                              [--dry-run] [--yes] [--json]
+      Defaults to moving the file to trash; --permanent removes bytes and metadata.
+    blocks data files list [--parent-id] [--module-name <1-11>] [--type directory|file]
+                              [--search] [--cursor] [--limit 1-200] [--json]
+    blocks data files search <query> [--directory-id] [--type directory|file]
+                              [--cursor] [--limit 1-200] [--json]
+    blocks data files trash|shared [--type directory|file] [--cursor] [--limit] [--json]
+    blocks data files restore <resourceId> [--dry-run] [--yes] [--json]
+    blocks data files purge <resourceId> [--dry-run] [--yes] [--json]
+    blocks data files directory-create <name> [--parent-id] [--module-name]
+                              [--description] [--allowed-extensions pdf,docx]
+                              [--dry-run] [--yes] [--json]
+    blocks data files directory-get <directoryId> [--json]
+    blocks data files directory-update <directoryId> [--name] [--description]
+                              [--dry-run] [--yes] [--json]
+    blocks data files directory-delete <directoryId> [--permanent]
+                              [--dry-run] [--yes] [--json]
+    blocks data files directory-move <directoryId> [--target-directory-id]
+                              [--dry-run] [--yes] [--json]
+    blocks data files versions <fileId> [--cursor] [--limit 1-100] [--json]
+    blocks data files create-version <fileId> [--configuration-name]
+                              [--dry-run] [--yes] [--json]
+    blocks data files copy <fileId> --target-directory-id <id> [--copy-access-policies]
                               [--dry-run] [--yes] [--json]
-    blocks data files dms-list [--parent-id] [--search] [--configuration-name] [--take]
-                              [--skip] [--json]
-      Combined folder+file listing for a DMS parent ("" = root).
-    blocks data files dms-upload --file-storage-id <id> --artifact-name <name>
-                              [--parent-id] [--tags a,b] [--body '<json>'|--file <path>]
+    blocks data files move <fileId> --target-directory-id <id> [--dry-run] [--yes] [--json]
+    blocks data files rename <fileId> --name <name> [--dry-run] [--yes] [--json]
+    blocks data files access-list|access-resolve <resourceId> [--json]
+    blocks data files access-grant <resourceId> --resource-type Directory|File
+                              --principal-type User|Role|Everyone|Organization
+                              [--principal-id] --permission View|Download|Edit|Delete|Manage|Owner
+                              [--effect Allow|Deny] [--priority] [--expires-at]
                               [--dry-run] [--yes] [--json]
-      Registers an uploaded file (fileId from presigned-upload-url/upload-to-local-storage)
-      so it appears in a DMS folder. Upload alone does not make a file visible in a folder.
-    blocks data files create-folder <name> [--parent-id] [--description] [--tags a,b]
-                              [--configuration-name] [--dry-run] [--yes] [--json]
-    blocks data files delete-folder <folderId> [--configuration-name]
+    blocks data files access-update <resourceId> --policy-id <id> <same policy flags>
+    blocks data files access-revoke <resourceId> --policy-id <id> [--dry-run] [--yes] [--json]
+    blocks data files inheritance <resourceId> --enabled=true|false [--dry-run] [--yes] [--json]
+    blocks data files share <resourceId> --resource-type <type> --principal-type <type>
+                              [--principal-id] --permission <permission> [--expires-at]
                               [--dry-run] [--yes] [--json]
 
 Localization:
@@ -1089,11 +1147,11 @@ Scaffold:
     name + redirect URI, active, registered as a Blocks OIDC identity
     provider) on the spot, or skip and register one later from the portal or
     'auth oidc-clients save'.
-    If --blocks-api-url is omitted, it is derived from the app domain:
-    https://blocksapi.<registrable-domain> (for example, app domain
-    https://dqrsf.slsblx.com uses https://blocksapi.slsblx.com). Pass a
-    different Data/IAM/Localization/OS gateway URL explicitly only if your
-    project uses a non-default one.
+    If --blocks-api-url is omitted, it is derived from the app domain:
+    https://blocksapi.<registrable-domain> (for example, app domain
+    https://dqrsf.slsblx.com uses https://blocksapi.slsblx.com). Pass a
+    different Data/IAM/Localization/OS gateway URL explicitly only if your
+    project uses a non-default one.
     --oidc-url defaults to https://iam.seliseblocks.com.
 
 Skills:
@@ -1111,12 +1169,12 @@ Skills:
 SDK:
   blocks sdk client [--app-domain <domain>] [--client-id <oidcClientId>]
                     [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>] [--json]
-    Read-only: "I want to use the Blocks SDK -- show me the client." Resolves this
-    project's @seliseblocks/client config using the selected project unless
-    --x-blocks-key overrides it, and the project's registered domain/OIDC client
-    when --app-domain/--client-id are omitted. Its API URL defaults to
-    https://api.seliseblocks.com unless --blocks-api-url is passed.
-    Prints a ready-to-paste createBlocksClient(...) snippet.
+    Read-only: "I want to use the Blocks SDK -- show me the client." Resolves this
+    project's @seliseblocks/client config using the selected project unless
+    --x-blocks-key overrides it, and the project's registered domain/OIDC client
+    when --app-domain/--client-id are omitted. Its API URL defaults to
+    https://api.seliseblocks.com unless --blocks-api-url is passed.
+    Prints a ready-to-paste createBlocksClient(...) snippet.
     Passing both --app-domain and --client-id skips the project lookup entirely
     (no login required). Never writes a file; to scaffold a new app use 'new web'.
 `);