@seliseblocks/cli-os 0.2.8 → 0.2.9

package/dist/index.js

@@ -485,697 +485,707 @@ function toCliError(error) {
     return { code: "command_failed", message };
 }
 function printHelp() {
-    console.log(`Blocks CLI
-
-Usage:
-  blocks <command> [options]
-
-  Namespaced commands use spaces, e.g. 'blocks data schema list'.
-  ':' also works if you prefer it: 'blocks data:schema:list'.
-
-Global options:
-  --version                 Print CLI version.
-  --json                    Print machine-readable JSON where supported.
-  --api-url <url>           Override Blocks API URL for this command.
-  --account <name>          Use a named account profile; default is implicit.
-  --project <tenantId>      Use a project tenant for project-scoped commands.
-  --dry-run                 Show planned mutation without calling the API.
-  --yes                     Skip mutation confirmation after explicit approval.
-
-Setup and health:
-  blocks init
-    Create local Blocks workspace files: blocks.json, data schema/rules folders,
-    and .env.example.
-
-  blocks doctor [--json]
-    Check local Node.js, OIDC config, token cache, selected project, and config
-    file locations. Does not mutate cloud resources.
-
-Auth:
-  blocks login
-    Device-code login. Prints a verification URL and user code, opens the
-    browser to the verification page when possible so you only need to click
-    approve, then polls until the device is authorized; stores account access
-    and refresh tokens and auto-refreshes later. If a project was previously
-    selected, re-impersonates it automatically; otherwise lists projects and
-    prompts you to run 'blocks use <tenantId>'.
-
-  blocks auth status [--json]
-    Show only whether account/project access and refresh tokens are missing,
-    valid, expired, or available. Does not print account config values.
-
-  blocks auth refresh [--project] [--json]
-    Force account token refresh, or project token refresh with --project.
-
-  blocks auth remove <account>
-    Clear cached tokens and stored local credentials for that account. The
-    packaged default OS account is restored from package defaults.
-
-  blocks logout
-    Revoke the current refresh token when possible and remove local session data.
-
-Projects:
-  blocks projects list [--json]
-    List accessible Blocks projects via /os/v4/Project/Gets. Uses the
-    impersonated project session when a project is selected, otherwise the
-    account token. Read-only.
-
-  blocks projects get [tenantId] [--deployment] [--json]
-    Read one project from Project/Gets. Uses selected project when tenantId is
-    omitted. Pass --deployment to also include the environment, tenantGroupId,
-    and linked repo assets (from Project/GetAsset) that 'release deploy' uses
-    to resolve its target. Read-only.
-
-  blocks use <project-tenant-id>
-    Save the selected project tenant globally and in blocks.json when present,
-    then immediately impersonate it. If a different project was selected,
-    stops that impersonation first to reclaim a fresh account refresh token
-    before starting the new one.
-
-  blocks deselect
-    Stop the active impersonation (restoring a fresh account refresh token),
-    then clear the selected project tenant (globally and in blocks.json) and
-    drop its cached impersonation token. Run 'blocks use <tenantId>' again to
-    reselect and re-impersonate.
-
-IAM:
-  blocks iam me [--json]
-    Read the current user from IAM (bootstrapping/CLI operator identity, not
-    a project resource). Uses the impersonated project session when a project
-    is selected, otherwise the account token -- the server always resolves
-    this to the root identity either way. Every other iam * command below is
-    project-scoped: it requires a selected project and calls IAM using an
-    impersonated project token only, never the account token.
-
-  Users (/iam/v4/iam/users*):
-    blocks iam users list [--page 1] [--page-size 20] [--email <e>] [--name <n>]
-                              [--organization-id <id>] [--sort-by <field>] [--sort-desc]
-                              [--filter '<json>'] [--json]
-      Query users. --filter merges a raw JSON filter object over the convenience flags.
-    blocks iam users get <id> [--organization-id <id>] [--json]
-    blocks iam users create --email <e>|--user-name <n> [--first-name] [--last-name]
-                                [--password] [--phone-number] [--organization-id]
-                                [--roles a,b] [--permissions a,b] [--body '<json>'|--file <path>]
-                                [--dry-run] [--yes] [--json]
-    blocks iam users update <id> [--first-name] [--last-name] [--phone-number]
-                                [--organization-id] [--roles a,b] [--permissions a,b]
-                                [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    blocks iam users activate <userId> [--reason <text>] [--dry-run] [--yes] [--json]
-    blocks iam users deactivate <userId> [--dry-run] [--yes] [--json]
-    blocks iam users access grant <userId> [--roles a,b] [--permissions a,b]
-                                [--organization-id] [--dry-run] [--yes] [--json]
-    blocks iam users access revoke <userId> [--organization-id] [--dry-run] [--yes] [--json]
-    blocks iam users exists <email> [--json]
-    blocks iam email available <email> [--json]
-
-  Roles (/iam/v4/iam/roles*):
-    blocks iam roles list [--page] [--page-size] [--search] [--slugs a,b]
-                              [--organization-id] [--filter '<json>'] [--json]
-    blocks iam roles get <id> [--json]
-    blocks iam roles create --name <n> [--slug] [--description] [--parent-role-slug]
-                              [--can-create-own] [--body '<json>'|--file <path>]
-                              [--dry-run] [--yes] [--json]
-    blocks iam roles update <itemId> [--name] [--description] [--parent-role-slug]
-                              [--propagate-to-other-org] [--can-create-own]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    blocks iam roles assign-permissions <slug> [--add-permissions a,b]
-                              [--remove-permissions a,b] [--organization-id]
-                              [--dry-run] [--yes] [--json]
-    blocks iam roles assignable [--json]
-
-  Permissions (/iam/v4/iam/permissions*):
-    blocks iam permissions list [--page] [--page-size] [--search] [--type <0-3>]
-                              [--severity <0-4>] [--resource-group] [--tags a,b]
-                              [--resources a,b] [--is-built-in] [--is-archived]
-                              [--roles a,b] [--organization-id] [--filter '<json>'] [--json]
-    blocks iam permissions get <id> [--json]
-    blocks iam permissions create --name <n> [--type] [--description] [--resource]
-                              [--resource-group] [--tags a,b] [--severity] [--is-built-in]
-                              [--dependent-permissions a,b] [--body '<json>'|--file <path>]
-                              [--dry-run] [--yes] [--json]
-    blocks iam permissions update <id> [same flags as create, plus --is-archived]
-                              [--dry-run] [--yes] [--json]
-    blocks iam permissions by-severity [--json]
-
-  Resources (/iam/v4/iam/resource*):
-    blocks iam resources groups [--json]
-    blocks iam resources features [--search <text>] [--is-built-in] [--json]
-
-  Organizations (/iam/v4/iam/organizations*):
-    blocks iam organizations list [--page] [--page-size] [--search] [--ids a,b]
-                              [--is-disabled] [--parent-organization-id] [--json]
-    blocks iam organizations get <id> [--json]
-    blocks iam organizations create --name <n> [--description] [--email] [--phone-number]
-                              [--website-url] [--default-roles a,b] [--default-permissions a,b]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    blocks iam organizations update <id> [--name] [--description] [--email]
-                              [--phone-number] [--website-url] [--industry] [--time-zone]
-                              [--currency] [--locale] [--is-enabled]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    blocks iam organizations my [--json]
-    blocks iam organizations config get [--json]
-    blocks iam organizations config save [--allow-org-creation-from-cloud]
-                              [--allow-org-creation-from-construct] [--allow-org-creation-from-signup]
-                              [--allow-org-creation-from-portal] [--multi-org-enabled]
-                              [--consent-for-multi-org-enable] [--body '<json>'|--file <path>]
-                              [--dry-run] [--yes] [--json]
-
-  Signup settings (/iam/v4/iam/signup-settings):
-    blocks iam signup-settings get [--json]
-    blocks iam signup-settings save [--email-password-signup] [--sso-signup]
-                              [--default-roles a,b] [--default-permissions a,b]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-
-MFA (/iam/v4/mfa*, project-scoped: requires a selected project, impersonated project token only):
-  blocks mfa config get [--json]
-    Read the tenant's MFA policy.
-  blocks mfa config save [--enable] [--require-for-all-users] [--allow-user-opt-out]
-                              [--allow-backup-codes] [--backup-codes-count <n>]
-                              [--user-mfa-type 0,1] [--required-roles a,b] [--exempt-roles a,b]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Save the tenant's MFA policy.
-  blocks mfa totp setup [--json]
-    Start TOTP enrollment for the impersonated user.
-  blocks mfa totp verify-setup <code> [--json]
-    Confirm TOTP enrollment.
-  blocks mfa totp enable --mfa-type <n> [--code <c>] [--dry-run] [--yes] [--json]
-    Composed enrollment: totp setup -> (scan the printed QR/secret, enter the code --
-    interactively prompted if --code is omitted) -> totp verify-setup -> method set
-    --mfa-type <n> -> backup-codes generate. One sitting, one confirmation.
-    --mfa-type is required and not defaulted: the numeric value meaning "TOTP" is
-    tenant-defined and undocumented here (same value plain mfa method set expects) --
-    look it up rather than guessing.
-  blocks mfa generate --mfa-type <n> [--send-phone-number-as-email-domain <domain>] [--json]
-    Send an OTP challenge; returns an mfaId to pass to resend/verify.
-  blocks mfa resend <mfaId> [--send-phone-number-as-email-domain <domain>] [--json]
-  blocks mfa verify <mfaId> <code> --auth-type <n> [--from-token-call] [--json]
-  blocks mfa method set --mfa-type <n> [--json]
-    Switch the impersonated user's active MFA method.
-  blocks mfa disable [--dry-run] [--yes] [--json]
-  blocks mfa backup-codes list [--json]
-  blocks mfa backup-codes generate [--dry-run] [--yes] [--json]
-  blocks mfa backup-codes use <userId> <code> [--json]
-
-Mail (/os/v4/Mail/* — project-scoped: requires a selected project, impersonated project token only):
-  blocks mail config list [--json]
-    List SMTP/inbound mail configurations for the selected project.
-  blocks mail config get <name> [--json]
-  blocks mail config save [--configuration-id <id>] [--name <n>] [--host <h>] [--port <n>]
-                              [--enable-ssl] [--sender-name] [--sender-address] [--sender-username]
-                              [--account-password] [--inbound] [--provider <0|1>]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Upsert: omit --configuration-id to create; pass it to update.
-  blocks mail config delete <configurationId> [--dry-run] [--yes] [--json]
-  blocks mail config duplicate <configurationId> [--dry-run] [--yes] [--json]
-  blocks mail template list [--page-number] [--page-size] [--search] [--sort-by] [--sort-desc]
-                              [--configuration-id] [--language] [--json]
-  blocks mail template get <itemId> [--json]
-  blocks mail template save [--item-id <id>] [--configuration-id] [--name] [--language]
-                              [--subject] [--template-body] [--json-content] [--image-id]
-                              [--image-url] [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Upsert: omit --item-id to create; pass it to update.
-  blocks mail template delete <itemId> [--dry-run] [--yes] [--json]
-  blocks mail template clone <itemId> [--configuration-id] [--language] [--name] [--subject]
-                              [--dry-run] [--yes] [--json]
-  blocks mail mailbox list [--page-number] [--page-size] [--status] [--search]
-                              [--start-date] [--end-date] [--inbound] [--json]
-  blocks mail mailbox get <messageId> [--json]
-  blocks mail send [--to a,b] [--cc a,b] [--bcc a,b] [--reply-to a,b] [--purpose <p>]
-                              [--language <culture>] [--subject-data-context '<json>']
-                              [--body-data-context '<json>'] [--attachments '<json>']
-                              [--send-phone-number-as-email] [--project-key <key>]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Send an email through the tenant's default mail configuration
-    (/logic/v4/Mail/Send). --project-key defaults to the selected project.
-  blocks mail sendtoany [same flags as mail send, plus --is-test-mail]
-                              [--dry-run] [--yes] [--json]
-    Same as mail send but via /logic/v4/Mail/SendToAny, which lets the mail
-    provider route the send (e.g. mark it --is-test-mail).
-
-Notification (/os/v4/Notification/* — project-scoped: requires a selected project, impersonated project token only):
-  blocks notification list [--page] [--page-size] [--sort-by] [--sort-desc] [--filter] [--json]
-  blocks notification get <itemId> [--json]
-  blocks notification save [--name <n>] [--channel <0|1>] [--type <0-3>] [--enable-persistence]
-                              [--notify-method] [--update] [--body '<json>'|--file <path>]
-                              [--dry-run] [--yes] [--json]
-    Pass --update when saving over an existing notification configuration.
-  blocks notification delete <itemId> [--dry-run] [--yes] [--json]
-
-Notifier (/logic/v4/Notifier/* — real-time/offline notification sends and inbox reads;
-          project-scoped: requires a selected project, impersonated project token only.
-          Distinct from 'notification' above, which manages notification channel
-          configuration, not sending):
-  blocks notifier notify [--user-ids a,b] [--roles a,b] [--connection-id <id>]
-                              [--subscription-filters '<json>'] [--denormalized-payload <text>]
-                              [--save-denormalized-payload-as-object] [--response-key]
-                              [--response-value] [--content-available] [--configuration-name]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Push a notification to specific users/roles, or everyone matching a subscription
-    filter. Target with at least one of --user-ids/--roles/--subscription-filters.
-  blocks notifier list [--unread-only] [--page] [--page-size] [--sort-by] [--sort-desc]
-                              [--filter] [--json]
-    List the signed-in user's notifications (GetNotifications). Read-only.
-  blocks notifier unread [--user-id <id>] [--context <c>] [--action-name <a>] [--value <v>]
-                              [--order-by <1|2>] [--json]
-    Read unread notifications matching a subscription filter. Sent as query
-    parameters even though swagger documents this endpoint as GET with a JSON
-    body -- the Fetch spec forbids a body on GET. Read-only.
-  blocks notifier mark-read <id> [--dry-run] [--yes] [--json]
-  blocks notifier mark-all-read [--dry-run] [--yes] [--json]
-
-Secrets (/os/v4/Secrets/* — project-scoped: requires a selected project, impersonated project
-          token only; generic tenant secret storage, e.g. captcha provider config):
-  blocks secrets get <secretKey> [--page-number 0] [--page-size 10] [--json]
-  blocks secrets save --secret-key <key> [--item-id <id>] --key-value-pairs '<json>'
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Upsert: omit --item-id to create, pass it to update. --key-value-pairs is a flat
-    JSON object of provider-specific fields, e.g.
-    --key-value-pairs '{"isEnable":"true","provider":"recaptcha","captchaKey":"...","captchaSecret":"..."}'.
-
-Storage (/os/v4/Storage/* — project-scoped: requires a selected project, impersonated project token only):
-  blocks storage config list [--json]
-  blocks storage config get <name> [--json]
-  blocks storage config save [--item-id <id>] [--name <n>] [--strategy] [--connection-string]
-                              [--secret-key] [--access-key] [--region-endpoint] [--host] [--port]
-                              [--username] [--password] [--remote-base-path] [--update]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Upsert: omit --item-id to create; pass --update to update.
-  blocks storage config delete <name> [--dry-run] [--yes] [--json]
-
-Auth Admin (/iam/v4/auth/identity-providers*, /config, /client-credentials, /oidc-clients —
-            project-scoped: requires a selected project, impersonated project token only):
-  blocks auth idp list [--json]
-  blocks auth idp get <id> [--json]
-  blocks auth idp create --provider <p> --provider-type <t> --protocol <proto>
-                              --client-id <id> [--client-secret] [--display-name] [--issuer]
-                              [--scope] [--redirect-uris a,b] [--active]
-                              [--authorization-url] [--token-url] [--user-info-url]
-                              [--jwks-uri] [--well-known-url] [--response-type]
-                              [--grant-types a,b] [--require-pkce]
-                              [--token-endpoint-auth-method] [--initial-roles a,b]
-                              [--initial-permissions a,b] [--icon]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Apple-specific fields (teamId, keyId, privateKey, appleAudience) go in --body/--file
-    so no private key lands in shell history.
-    IAM's create endpoint stores issuer/jwksUri/wellKnownUrl but drops
-    authorizationUrl/tokenUrl/userInfoUrl -- set those with 'idp update' afterward.
-  blocks auth idp update <id> [same flags as create, all optional] [--dry-run] [--yes] [--json]
-    provider/providerType/protocol/clientId are immutable: omit them, or echo the
-    existing values exactly if you also pass --body/--file.
-    The only endpoint that persists authorizationUrl/tokenUrl/userInfoUrl -- create accepts
-    and drops them, and update never re-runs discovery, so values set here stick. Use it to
-    repair a provider whose authorizationUrl came back null: '/idp/initiate' builds its
-    redirect from that field, so hosted login goes nowhere without it. Read the endpoint
-    values from the tenant's discovery document rather than composing them by hand.
-  blocks auth idp delete <id> [--dry-run] [--yes] [--json]
-    Irreversible; also deletes the related OIDC client registration.
-  blocks auth idp status <id> --active|--active=false [--dry-run] [--yes] [--json]
-    Enable/disable a provider without deleting its configuration.
-  blocks auth config get [--json]
-  blocks auth config save [--refresh-token-minutes] [--absolute-refresh-token-minutes]
-                              [--access-token-minutes] [--remember-me-refresh-token-minutes]
-                              [--wrong-attempts-to-lock] [--account-lock-duration-minutes]
-                              [--oidc-enabled] [--logout-on-password-change]
-                              [--password-strength-regex] [--body '<json>'|--file <path>]
-                              [--dry-run] [--yes] [--json]
-  blocks auth client-credentials list [--json]
-    clientSecret is included in list responses; treat CLI output as sensitive.
-  blocks auth client-credentials save --name <n> [--item-id <id>] [--roles a,b]
-                              [--permissions a,b] [--access-token-valid-minutes] [--active]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Omit --item-id to create; pass it to update. The response's clientSecret is
-    shown once and is not retrievable again afterward.
-  blocks auth client-credentials delete <id> [--dry-run] [--yes] [--json]
-
-  blocks auth oidc-clients list [--json]
-    List registered OAuth 2.0 / OIDC client applications for the tenant. client_secret
-    is excluded from list/get responses.
-  blocks auth oidc-clients get <clientId> [--json]
-  blocks auth oidc-clients save [--item-id <id>] [--client-display-name] [--client-type]
-                              [--redirect-uris a,b] [--post-logout-redirect-uris a,b]
-                              [--scope] [--allowed-scopes a,b] [--allowed-response-types a,b]
-                              [--require-pkce] [--require-consent] [--require-mfa]
-                              [--allowed-mfa-methods 0,1] [--front-channel-logout-uri]
-                              [--back-channel-logout-uri] [--auto-redirect]
-                              [--external-discovery-endpoint] [--active] [--login-mode]
-                              [--client-logo-url] [--client-brand-color] [--use-tokens-cookie]
-                              [--register-as-identity-provider] [--device-flow-client]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    Upsert: omit --item-id to register a new client, pass it to update an existing one.
-    The response's client_secret is shown once and is not retrievable again afterward.
-    --client-type is not optional in practice: IAM derives tokenEndpointAuthMethod from it,
-    so omitting it stores a browser/SPA client as confidential ("client_secret_post") and
-    lets it request the client_credentials grant. Pass --client-type public for any
-    PKCE/browser client.
-    --register-as-identity-provider creates the linked identity provider in the same call.
-    Its authorize/token/userinfo/jwks/issuer values are filled from the discovery document
-    at --external-discovery-endpoint; with no discovery endpoint they are left null and the
-    provider's scope is replaced with "openid profile email". Verify with 'auth idp list'.
-  blocks auth oidc-clients delete <clientId> [--dry-run] [--yes] [--json]
-    Irreversible; revokes all tokens issued to the client.
-  blocks auth oidc-clients rotate-secret <clientId> [--dry-run] [--yes] [--json]
-    Generates a new client_secret, shown once; the old secret stops working immediately.
-
-Data:
-  blocks data validate [--json]
-    Validate local blocks/data/schemas/*.json and blocks/data/rules.json before
-    pushing. Local-only.
-
-  blocks data schema list [--json]
-    List project schemas via /data/v4/schemas using an impersonated project
-    token. Read-only.
-
-  blocks data schema pull [--json]
-    Download project schemas into blocks/data/schemas/*.json. Writes local files
-    only.
-
-  blocks data schema push [--dry-run] [--yes] [--json]
-    Create or update project schemas via /data/v4/schemas/define. Mutating;
-    uses POST for create and PUT for update.
-
-  blocks data rules pull [--json]
-    Download data-access policies into blocks/data/rules.json. Writes local
-    files only.
-
-  blocks data rules deploy [--dry-run] [--yes] [--json]
-    Apply schema security and data-access policies. Mutating; supports dry-run
-    and confirmation.
-
-  blocks data reload [--dry-run] [--yes] [--json]
-    Reload Data schema configuration so staged schema/rule changes become live.
-    Mutating; calls POST /data/v4/schema-configurations/reload.
-
-  blocks data sync [--dry-run] [--yes] [--json]
-    Composed flow: validate local schemas/rules, then data schema push ->
-    data rules deploy -> data reload, so pushed changes actually go live in one
-    step. Validation runs first and hard-fails before anything is sent if it
-    finds errors. Prints 3 separate step outputs (one per underlying command),
-    not one combined document. One confirmation covers the whole flow.
-
-  Data source configuration (/data/v4/configurations) - check this first; by default a
-  project's Data Gateway runs on Blocks-managed storage and data config get is all you need.
-  Only create/update a configuration if you're pointing the gateway at your own database.
-    blocks data config get [--json]
-    blocks data config create --connection-string <cs> [--database-name <name>]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    blocks data config update --item-id <id> [--connection-string] [--database-name]
-                              [--collection-name-editable] [--collection-name-pattern]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-
-  Raw Schema API (/data/v4/schemas* - beyond the file-oriented list/pull/push above):
-    blocks data schema get <id> [--json]
-    blocks data schema get-by-name <schemaName> [--json]
-      Full field-level detail by collection name (info-by-name).
-    blocks data schema aggregation [--keyword] [--schema-name] [--collection-name]
-                              [--schema-type <1|2>] [--page] [--page-size] [--sort-by]
-                              [--sort-desc] [--json]
-      Schemas plus an access-level summary (Public/User/Custom x Read/Write/Edit/Delete).
-    blocks data schema change-logs [--json]
-      Unadapted schema change logs; data reload clears these.
-    blocks data schema delete <id> [--dry-run] [--yes] [--json]
-      Irreversible.
-    blocks data schema info list [--json]
-      Entity-type schema collections with basic info.
-    blocks data schema info save --schema-name <n> [--collection-name] [--schema-type <1|2>]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-      Create schema metadata only (no fields yet) - pair with data schema fields.
-    blocks data schema info update --item-id <id> [--schema-name] [--collection-name]
-                              [--schema-type <1|2>] [--body '<json>'|--file <path>]
-                              [--dry-run] [--yes] [--json]
-    blocks data schema fields --schema-id <schemaDefinitionItemId> [--deletable-fields a,b]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-      Add/update field definitions; the 'fields' array (name/type/isArray/isPIIData/
-      isUniqueData/description) goes in --body/--file, e.g.
-      --body '{"fields":[{"name":"email","type":"string"}]}'.
-
-  Data-access policies, single-item ops (beyond the file-oriented rules pull/deploy above):
-    blocks data rules policy get <schemaName> [--json]
-    blocks data rules policy delete <itemId> [--dry-run] [--yes] [--json]
-
-  Data validation (/data/v4/data-validations* - field-level validation rules; no file-oriented
-                    workflow exists for this yet, use these directly):
-    blocks data validation list [--schema-id] [--field-name] [--keyword] [--page]
-                              [--page-size] [--sort-by] [--sort-desc] [--json]
-    blocks data validation get <validationId> [--json]
-    blocks data validation by-schema <schemaId> [--json]
-    blocks data validation by-schema-field <schemaId> <fieldName> [--json]
-    blocks data validation save --schema-id <id> --field-name <name> [--item-id]
-                              --body '<json>' (must include a "validations" array, e.g.
-                              '{"validations":[{"type":1,"value":"^[0-9]+$","isActive":true}]}')
-                              [--dry-run] [--yes] [--json]
-      Upsert: omit --item-id to create, pass it to update.
-    blocks data validation delete <validationId> [--dry-run] [--yes] [--json]
-
-  Storage object tree (files, directories, discovery, trash, versions, and access):
-    blocks data files get <fileId> [--version] [--configuration-name] [--json]
-    blocks data files get-many <fileId...>|--file-ids a,b [--configuration-name] [--json]
-    blocks data files info [--name] [--tenant-id] [--page] [--page-size] [--sort-by]
-                              [--sort-desc] [--json]
-    blocks data files upload --file <localPath> [--name] [--item-id] [--parent-id] [--tags]
-                              [--access-modifier Public|Private] [--content-type]
-                              [--configuration-name] [--module-name <1-11>] [--local-storage]
-                              [--dry-run] [--yes] [--json]
-      Cloud: create file/version metadata, then PUT bytes to the returned URL. Local:
-      one multipart request. The file appears in the object tree without registration.
-    blocks data files presigned-upload-url --name <fileName> [--item-id] [--parent-directory-id]
-                              [--access-modifier Public|Private] [--configuration-name]
-                              [--module-name <1-11>] [--meta-data] [--tags]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-      Mutating cloud step 1: creates metadata/version and returns uploadUrl/fileId.
-    blocks data files upload-to-url --url <presignedUrl> --file <localPath>
-                              --content-type <type> [--blob-type BlockBlob] [--no-blob-type-header]
-                              [--dry-run] [--yes] [--json]
-      Step 2. Provider-direct PUT - no Blocks auth headers by design.
-    blocks data files upload-to-local-storage --file <localPath> [--name] [--item-id]
-                              [--parent-directory-id] [--tags] [--access-modifier Public|Private]
-                              [--configuration-name] [--meta-data] [--additional-properties '<json>']
-                              [--dry-run] [--yes] [--json]
-      One-call alternative to the two commands above, for local-storage-backed projects.
-    blocks data files update-additional-info <itemId> --additional-properties '<json>'
-                              [--dry-run] [--yes] [--json]
-    blocks data files delete <fileId> [--configuration-name] [--event-queue-name]
-                              [--permanent]
-                              [--dry-run] [--yes] [--json]
-      Defaults to moving the file to trash; --permanent removes bytes and metadata.
-    blocks data files list [--parent-id] [--module-name <1-11>] [--type directory|file]
-                              [--search] [--cursor] [--limit 1-200] [--json]
-    blocks data files search <query> [--directory-id] [--type directory|file]
-                              [--cursor] [--limit 1-200] [--json]
-    blocks data files trash|shared [--type directory|file] [--cursor] [--limit] [--json]
-    blocks data files restore <resourceId> [--dry-run] [--yes] [--json]
-    blocks data files purge <resourceId> [--dry-run] [--yes] [--json]
-    blocks data files directory-create <name> [--parent-id] [--module-name]
-                              [--description] [--allowed-extensions pdf,docx]
-                              [--dry-run] [--yes] [--json]
-    blocks data files directory-get <directoryId> [--json]
-    blocks data files directory-update <directoryId> [--name] [--description]
-                              [--dry-run] [--yes] [--json]
-    blocks data files directory-delete <directoryId> [--permanent]
-                              [--dry-run] [--yes] [--json]
-    blocks data files directory-move <directoryId> [--target-directory-id]
-                              [--dry-run] [--yes] [--json]
-    blocks data files versions <fileId> [--cursor] [--limit 1-100] [--json]
-    blocks data files create-version <fileId> [--configuration-name]
-                              [--dry-run] [--yes] [--json]
-    blocks data files copy <fileId> --target-directory-id <id> [--copy-access-policies]
-                              [--dry-run] [--yes] [--json]
-    blocks data files move <fileId> --target-directory-id <id> [--dry-run] [--yes] [--json]
-    blocks data files rename <fileId> --name <name> [--dry-run] [--yes] [--json]
-    blocks data files access-list|access-resolve <resourceId> [--json]
-    blocks data files access-grant <resourceId> --resource-type Directory|File
-                              --principal-type User|Role|Everyone|Organization
-                              [--principal-id] --permission View|Download|Edit|Delete|Manage|Owner
-                              [--effect Allow|Deny] [--priority] [--expires-at]
-                              [--dry-run] [--yes] [--json]
-    blocks data files access-update <resourceId> --policy-id <id> <same policy flags>
-    blocks data files access-revoke <resourceId> --policy-id <id> [--dry-run] [--yes] [--json]
-    blocks data files inheritance <resourceId> --enabled=true|false [--dry-run] [--yes] [--json]
-    blocks data files share <resourceId> --resource-type <type> --principal-type <type>
-                              [--principal-id] --permission <permission> [--expires-at]
-                              [--dry-run] [--yes] [--json]
-
-Localization:
-  blocks localization validate --module <name> --language <culture> [--file <path>] [--json]
-    Validate a local i18n JSON dictionary. Supports nested JSON input and
-    validates the flattened key/value set locally.
-
-  blocks localization push --module <name> --language <culture> [--file <path>] [--route <route>] [--context <text>] [--dry-run] [--yes] [--json]
-    Create or update Localization keys from a local i18n JSON dictionary via
-    /localization/v4/Key/SaveKeys. Creates the module first when it is missing.
-
-  blocks localization pull --module <name> --language <culture> [--out <path>] [--json]
-    Download published cloud localization via
-    /localization/v4/Key/GetCloudUilmFile and write a local JSON dictionary.
-
-  Raw API (/localization/v4/* — project-scoped: requires a selected project, impersonated
-            project token only). These call the Localization service endpoints directly,
-            in addition to the file-oriented validate/push/pull commands above.
-
-    blocks localization assistant translation-suggestion --source-text <text>
-                              --destination-language <culture> [--current-language]
-                              [--element-type] [--element-application-context]
-                              [--element-detail-context] [--temperature] [--max-character-length]
-                              [--glossary-ids a,b] [--module-id] [--destination-language-code]
-                              [--body '<json>'|--file <path>] [--json]
-
-    blocks localization config get-webhook [--json]
-    blocks localization config save-webhook --url <url> --content-type <type>
-                              --secret <s> --header-key <k> [--item-id <id>] [--is-disabled]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-
-    blocks localization glossary save --name <n> [--item-id] [--language] [--type]
-                              [--context] [--additional-note] [--is-global] [--module-ids a,b]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    blocks localization glossary list [--search] [--page-number] [--page-size]
-                              [--is-global] [--module-id] [--json]
-    blocks localization glossary get <itemId> [--json]
-    blocks localization glossary suggested <itemId> [--max-results <n>] [--json]
-    blocks localization glossary delete <itemId> [--dry-run] [--yes] [--json]
-
-    blocks localization key save --key-name <n> --module-id <id> [--item-id] [--value]
-                              [--culture] [--routes a,b] [--glossary-ids a,b] [--context]
-                              [--is-new-key] [--is-partially-translated] [--should-publish]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    blocks localization key list [--key-search-text] [--search-key] [--module-ids a,b]
-                              [--page-number] [--page-size] [--sort-by] [--sort-desc]
-                              [--is-partially-translated] [--missing-languages a,b]
-                              [--create-date-start] [--create-date-end]
-                              [--last-update-date-start] [--last-update-date-end]
-                              [--glossary-id] [--body '<json>'|--file <path>] [--json]
-    blocks localization key get-by-names <keyName...>|--key-names a,b [--module-id] [--json]
-    blocks localization key get <itemId> [--json]
-    blocks localization key delete <itemId> [--dry-run] [--yes] [--json]
-    blocks localization key delete-keys <itemId...>|--item-ids a,b [--dry-run] [--yes] [--json]
-    blocks localization key get-timeline [--entity-id] [--user-id] [--page-number]
-                              [--page-size] [--sort-by] [--sort-desc] [--create-date-start]
-                              [--create-date-end] [--json]
-    blocks localization key get-localization-timeline [--user-id] [--log-from]
-                              [--log-from-values a,b] [--exclude-log-from-values a,b]
-                              [--page-number] [--page-size] [--sort-by] [--sort-desc]
-                              [--create-date-start] [--create-date-end] [--json]
-    blocks localization key get-timeline-by-operation-id <operationId> [--page-number]
-                              [--page-size] [--json]
-    blocks localization key get-uilm-file --module <name> --language <culture> [--json]
-    blocks localization key generate-uilm-file --module-id <id> [--guid]
-                              [--dry-run] [--yes] [--json]
-    blocks localization key translate-all --module-id <id> [--default-language]
-                              [--message-co-relation-id] [--dry-run] [--yes] [--json]
-    blocks localization key translate-key <keyId> --default-language <culture>
-                              [--message-co-relation-id] [--dry-run] [--yes] [--json]
-    blocks localization key translate-keys <keyId...>|--key-ids a,b --default-language <culture>
-                              [--message-co-relation-id] [--project-key]
-                              [--dry-run] [--yes] [--json]
-    blocks localization key translate-and-export --module-id <id> [--default-language]
-                              [--wait] [--poll-interval <seconds>] [--timeout <seconds>]
-                              [--guid] [--output-type <0-5>] [--app-ids a,b] [--languages a,b]
-                              [--reference-file-id] [--caller-tenant-id] [--start-date]
-                              [--end-date] [--dry-run] [--yes] [--json]
-      Composed flow: translate-all -> generate-uilm-file -> uilm-export. Without --wait,
-      fires all 3 back to back (same as running them by hand). With --wait, polls
-      GetTimelineByOperationId (using a generated messageCoRelationId) between translate
-      and generate, since translation runs async and there's no documented explicit
-      "done" field to check -- it stops once the timeline entry count settles across 2
-      polls, or times out with a clear next-step message. Prints one output block per
-      step, not a single combined document.
-    blocks localization key uilm-import <fileId> [--message-co-relation-id]
-                              [--dry-run] [--yes] [--json]
-    blocks localization key uilm-export [--output-type <0-5>] [--app-ids a,b] [--languages a,b]
-                              [--reference-file-id] [--caller-tenant-id] [--start-date]
-                              [--end-date] [--message-co-relation-id] [--dry-run] [--yes] [--json]
-    blocks localization key get-uilm-exported-files [--search] [--page-number] [--page-size]
-                              [--create-date-start] [--create-date-end] [--json]
-    blocks localization key get-language-file-generation-history [--page-number]
-                              [--page-size] [--json]
-    blocks localization key rollback <itemId> [--dry-run] [--yes] [--json]
-
-    blocks localization language save --language-name <n> --language-code <c> [--item-id]
-                              [--is-default] [--body '<json>'|--file <path>]
-                              [--dry-run] [--yes] [--json]
-    blocks localization language list [--json]
-    blocks localization language list-for-tenant [--json]
-    blocks localization language delete <languageName> [--dry-run] [--yes] [--json]
-    blocks localization language set-default <languageName> [--dry-run] [--yes] [--json]
-
-    blocks localization module save --module-name <n> [--item-id]
-                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
-    blocks localization module list [--json]
-    blocks localization module list-for-tenant [--json]
-    blocks localization module tag-glossary <moduleId> --glossary-ids a,b
-                              [--dry-run] [--yes] [--json]
-
-Release:
-  blocks release deploy [--domain <customDomain>] [--wait] [--poll-interval <seconds>]
-                    [--timeout <seconds>] [--dry-run] [--yes] [--json]
-    Deploy the selected project's environment. Resolves everything from state
-    you already have: the repo linked to this project (Project/GetAsset) and
-    that repo's connected branch (Build/repo-details) -- no --repo-id needed.
-    Aborts if the connected branch doesn't match this environment's name.
-    Pass --domain to also set the custom deployment domain before deploying.
-    Pass --wait to poll release status on the resulting build until it reaches
-    a terminal state (or --timeout elapses, default 900s) instead of returning
-    immediately with just a build id.
-    Mutating; no artifact upload is performed by this CLI.
-
-  blocks release status <buildId> [--json]
-    Read Release build status by build id using an impersonated project
-    token. Read-only.
-
-  blocks release builds list [repoId] [--repo-id <repoId>] [--json]
-    List Release build details for a repository using an impersonated project
-    token. When repoId is omitted, resolves it from the selected project's
-    linked repo assets (Project/GetAsset, account token) -- auto-picked if
-    there's exactly one, otherwise you're prompted to choose. Read-only.
-
-  blocks release builds get <buildId> [--json]
-    Alias for release status. Read-only.
-
-Scaffold:
-  blocks new web <name> [--app-domain <domain>] [--client-id <oidcClientId>]
-                    [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>]
-    Create a Vite React starter app that talks to Blocks exclusively through
-    @seliseblocks/client (a single createBlocksClient() instance) using the SDK
-    hosted IdP flow: blocksClient.auth.idp.redirectToProvider() on login click
-    and blocksClient.auth.idp.callback() on /login/callback. Includes route
-    guards, auto-refresh through auth.oidc.refreshToken(), live
-    auth/iam/data/localization SDK examples, environment config, and safe
-    .gitignore defaults.
-    Uses the selected project (see 'use') unless --x-blocks-key overrides it.
-    --app-domain and --client-id are resolved from the project when omitted:
-    if the project has one domain it's used automatically, otherwise you're
-    prompted to choose; the OIDC client is picked from a list of the
-    project's existing clients, or you can create a minimal one (display
-    name + redirect URI, active, registered as a Blocks OIDC identity
-    provider) on the spot, or skip and register one later from the portal or
-    'auth oidc-clients save'.
-    If --blocks-api-url is omitted, it is derived from the app domain:
-    https://blocksapi.<registrable-domain> (for example, app domain
-    https://dqrsf.slsblx.com uses https://blocksapi.slsblx.com). Pass a
-    different Data/IAM/Localization/OS gateway URL explicitly only if your
-    project uses a non-default one.
-    --oidc-url defaults to https://iam.seliseblocks.com.
-
-Skills:
-  blocks skill list [--json]
-    List bundled blocks-skills/*/SKILL.md agent context docs (name +
-    description). Local-only, no cloud calls.
-  blocks skill show <name> [--json]
-    Print one skill's full SKILL.md content.
-  blocks skill add <name> [--dir <path>]
-    Copy a bundled skill's SKILL.md into <path>/<name>/SKILL.md in the
-    current directory (default --dir is 'blocks-skills'), for use in a
-    project outside this monorepo. Overwrites silently, same as
-    'data schema pull'.
-
-SDK:
-  blocks sdk client [--app-domain <domain>] [--client-id <oidcClientId>]
-                    [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>] [--json]
-    Read-only: "I want to use the Blocks SDK -- show me the client." Resolves this
-    project's @seliseblocks/client config using the selected project unless
-    --x-blocks-key overrides it, and the project's registered domain/OIDC client
-    when --app-domain/--client-id are omitted. Its API URL defaults to
-    https://api.seliseblocks.com unless --blocks-api-url is passed.
-    Prints a ready-to-paste createBlocksClient(...) snippet.
-    Passing both --app-domain and --client-id skips the project lookup entirely
-    (no login required). Never writes a file; to scaffold a new app use 'new web'.
+    console.log(`Blocks CLI
+
+Usage:
+  blocks <command> [options]
+
+  Namespaced commands use spaces, e.g. 'blocks data schema list'.
+  ':' also works if you prefer it: 'blocks data:schema:list'.
+
+Global options:
+  --version                 Print CLI version.
+  --json                    Print machine-readable JSON where supported.
+  --api-url <url>           Override Blocks API URL for this command.
+  --account <name>          Use a named account profile; default is implicit.
+  --project <tenantId>      Use a project tenant for project-scoped commands.
+  --dry-run                 Show planned mutation without calling the API.
+  --yes                     Skip mutation confirmation after explicit approval.
+
+Setup and health:
+  blocks init
+    Create local Blocks workspace files: blocks.json, data schema/rules folders,
+    and .env.example.
+
+  blocks doctor [--json]
+    Check local Node.js, OIDC config, token cache, selected project, and config
+    file locations. Does not mutate cloud resources.
+
+Auth:
+  blocks login
+    Device-code login. Prints a verification URL and user code, opens the
+    browser to the verification page when possible so you only need to click
+    approve, then polls until the device is authorized; stores account access
+    and refresh tokens and auto-refreshes later. If a project was previously
+    selected, re-impersonates it automatically; otherwise lists projects and
+    prompts you to run 'blocks use <tenantId>'.
+
+  blocks auth status [--json]
+    Show only whether account/project access and refresh tokens are missing,
+    valid, expired, or available. Does not print account config values.
+
+  blocks auth refresh [--project] [--json]
+    Force account token refresh, or project token refresh with --project.
+
+  blocks auth remove <account>
+    Clear cached tokens and stored local credentials for that account. The
+    packaged default OS account is restored from package defaults.
+
+  blocks logout
+    Revoke the current refresh token when possible and remove local session data.
+
+Projects:
+  blocks projects list [--json]
+    List accessible Blocks projects via /os/v4/Project/Gets. Uses the
+    impersonated project session when a project is selected, otherwise the
+    account token. Read-only.
+
+  blocks projects get [tenantId] [--deployment] [--json]
+    Read one project from Project/Gets. Uses selected project when tenantId is
+    omitted. Pass --deployment to also include the environment, tenantGroupId,
+    and linked repo assets (from Project/GetAsset) that 'release deploy' uses
+    to resolve its target. Read-only.
+
+  blocks use <project-tenant-id>
+    Save the selected project tenant globally and in blocks.json when present,
+    then immediately impersonate it. If a different project was selected,
+    stops that impersonation first to reclaim a fresh account refresh token
+    before starting the new one.
+
+  blocks deselect
+    Stop the active impersonation (restoring a fresh account refresh token),
+    then clear the selected project tenant (globally and in blocks.json) and
+    drop its cached impersonation token. Run 'blocks use <tenantId>' again to
+    reselect and re-impersonate.
+
+IAM:
+  blocks iam me [--json]
+    Read the current user from IAM (bootstrapping/CLI operator identity, not
+    a project resource). Uses the impersonated project session when a project
+    is selected, otherwise the account token -- the server always resolves
+    this to the root identity either way. Every other iam * command below is
+    project-scoped: it requires a selected project and calls IAM using an
+    impersonated project token only, never the account token.
+
+  Users (/iam/v4/iam/users*):
+    blocks iam users list [--page 1] [--page-size 20] [--email <e>] [--name <n>]
+                              [--organization-id <id>] [--sort-by <field>] [--sort-desc]
+                              [--filter '<json>'] [--json]
+      Query users. --filter merges a raw JSON filter object over the convenience flags.
+    blocks iam users get <id> [--organization-id <id>] [--json]
+    blocks iam users create --email <e>|--user-name <n> [--first-name] [--last-name]
+                                [--password] [--phone-number] [--organization-id]
+                                [--roles a,b] [--permissions a,b] [--body '<json>'|--file <path>]
+                                [--dry-run] [--yes] [--json]
+    blocks iam users update <id> [--first-name] [--last-name] [--phone-number]
+                                [--organization-id] [--roles a,b] [--permissions a,b]
+                                [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    blocks iam users activate <userId> [--reason <text>] [--dry-run] [--yes] [--json]
+    blocks iam users deactivate <userId> [--dry-run] [--yes] [--json]
+    blocks iam users access grant <userId> [--roles a,b] [--permissions a,b]
+                                [--organization-id] [--dry-run] [--yes] [--json]
+    blocks iam users access revoke <userId> [--organization-id] [--dry-run] [--yes] [--json]
+    blocks iam users exists <email> [--json]
+    blocks iam email available <email> [--json]
+
+  Roles (/iam/v4/iam/roles*):
+    blocks iam roles list [--page] [--page-size] [--search] [--slugs a,b]
+                              [--organization-id] [--filter '<json>'] [--json]
+    blocks iam roles get <id> [--json]
+    blocks iam roles create --name <n> [--slug] [--description] [--parent-role-slug]
+                              [--can-create-own] [--body '<json>'|--file <path>]
+                              [--dry-run] [--yes] [--json]
+    blocks iam roles update <itemId> [--name] [--description] [--parent-role-slug]
+                              [--propagate-to-other-org] [--can-create-own]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    blocks iam roles assign-permissions <slug> [--add-permissions a,b]
+                              [--remove-permissions a,b] [--organization-id]
+                              [--dry-run] [--yes] [--json]
+    blocks iam roles assignable [--json]
+
+  Permissions (/iam/v4/iam/permissions*):
+    blocks iam permissions list [--page] [--page-size] [--search] [--type <0-3>]
+                              [--severity <0-4>] [--resource-group] [--tags a,b]
+                              [--resources a,b] [--is-built-in] [--is-archived]
+                              [--roles a,b] [--organization-id] [--filter '<json>'] [--json]
+    blocks iam permissions get <id> [--json]
+    blocks iam permissions create --name <n> [--type] [--description] [--resource]
+                              [--resource-group] [--tags a,b] [--severity] [--is-built-in]
+                              [--dependent-permissions a,b] [--body '<json>'|--file <path>]
+                              [--dry-run] [--yes] [--json]
+    blocks iam permissions update <id> [same flags as create, plus --is-archived]
+                              [--dry-run] [--yes] [--json]
+    blocks iam permissions by-severity [--json]
+
+  Resources (/iam/v4/iam/resource*):
+    blocks iam resources groups [--json]
+    blocks iam resources features [--search <text>] [--is-built-in] [--json]
+
+  Organizations (/iam/v4/iam/organizations*):
+    blocks iam organizations list [--page] [--page-size] [--search] [--ids a,b]
+                              [--is-disabled] [--parent-organization-id] [--json]
+    blocks iam organizations get <id> [--json]
+    blocks iam organizations create --name <n> [--description] [--email] [--phone-number]
+                              [--website-url] [--default-roles a,b] [--default-permissions a,b]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    blocks iam organizations update <id> [--name] [--description] [--email]
+                              [--phone-number] [--website-url] [--industry] [--time-zone]
+                              [--currency] [--locale] [--is-enabled]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    blocks iam organizations my [--json]
+    blocks iam organizations config get [--json]
+    blocks iam organizations config save [--allow-org-creation-from-cloud]
+                              [--allow-org-creation-from-construct] [--allow-org-creation-from-signup]
+                              [--allow-org-creation-from-portal] [--multi-org-enabled]
+                              [--consent-for-multi-org-enable] [--body '<json>'|--file <path>]
+                              [--dry-run] [--yes] [--json]
+
+  Signup settings (/iam/v4/iam/signup-settings):
+    blocks iam signup-settings get [--json]
+    blocks iam signup-settings save [--email-password-signup] [--sso-signup]
+                              [--default-roles a,b] [--default-permissions a,b]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+
+MFA (/iam/v4/mfa*, project-scoped: requires a selected project, impersonated project token only):
+  blocks mfa config get [--json]
+    Read the tenant's MFA policy.
+  blocks mfa config save [--enable] [--require-for-all-users] [--allow-user-opt-out]
+                              [--allow-backup-codes] [--backup-codes-count <n>]
+                              [--user-mfa-type 0,1] [--required-roles a,b] [--exempt-roles a,b]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    Save the tenant's MFA policy.
+  blocks mfa totp setup [--json]
+    Start TOTP enrollment for the impersonated user.
+  blocks mfa totp verify-setup <code> [--json]
+    Confirm TOTP enrollment.
+  blocks mfa totp enable --mfa-type <n> [--code <c>] [--dry-run] [--yes] [--json]
+    Composed enrollment: totp setup -> (scan the printed QR/secret, enter the code --
+    interactively prompted if --code is omitted) -> totp verify-setup -> method set
+    --mfa-type <n> -> backup-codes generate. One sitting, one confirmation.
+    --mfa-type is required and not defaulted: the numeric value meaning "TOTP" is
+    tenant-defined and undocumented here (same value plain mfa method set expects) --
+    look it up rather than guessing.
+  blocks mfa generate --mfa-type <n> [--send-phone-number-as-email-domain <domain>] [--json]
+    Send an OTP challenge; returns an mfaId to pass to resend/verify.
+  blocks mfa resend <mfaId> [--send-phone-number-as-email-domain <domain>] [--json]
+  blocks mfa verify <mfaId> <code> --auth-type <n> [--from-token-call] [--json]
+  blocks mfa method set --mfa-type <n> [--json]
+    Switch the impersonated user's active MFA method.
+  blocks mfa disable [--dry-run] [--yes] [--json]
+  blocks mfa backup-codes list [--json]
+  blocks mfa backup-codes generate [--dry-run] [--yes] [--json]
+  blocks mfa backup-codes use <userId> <code> [--json]
+
+Mail (/os/v4/Mail/* — project-scoped: requires a selected project, impersonated project token only):
+  blocks mail config list [--json]
+    List SMTP/inbound mail configurations for the selected project.
+  blocks mail config get <name> [--json]
+  blocks mail config save [--configuration-id <id>] [--name <n>] [--host <h>] [--port <n>]
+                              [--enable-ssl] [--sender-name] [--sender-address] [--sender-username]
+                              [--account-password] [--inbound] [--provider <0|1>]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    Upsert: omit --configuration-id to create; pass it to update.
+  blocks mail config delete <configurationId> [--dry-run] [--yes] [--json]
+  blocks mail config duplicate <configurationId> [--dry-run] [--yes] [--json]
+  blocks mail template list [--page-number] [--page-size] [--search] [--sort-by] [--sort-desc]
+                              [--configuration-id] [--language] [--json]
+  blocks mail template get <itemId> [--json]
+  blocks mail template save [--item-id <id>] [--configuration-id] [--name] [--language]
+                              [--subject] [--template-body] [--json-content] [--image-id]
+                              [--image-url] [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    Upsert: omit --item-id to create; pass it to update.
+  blocks mail template delete <itemId> [--dry-run] [--yes] [--json]
+  blocks mail template clone <itemId> [--configuration-id] [--language] [--name] [--subject]
+                              [--dry-run] [--yes] [--json]
+  blocks mail mailbox list [--page-number] [--page-size] [--status] [--search]
+                              [--start-date] [--end-date] [--inbound] [--json]
+  blocks mail mailbox get <messageId> [--json]
+  blocks mail send [--to a,b] [--cc a,b] [--bcc a,b] [--reply-to a,b] [--purpose <p>]
+                              [--language <culture>] [--subject-data-context '<json>']
+                              [--body-data-context '<json>'] [--attachments '<json>']
+                              [--send-phone-number-as-email] [--project-key <key>]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    Send an email through the tenant's default mail configuration
+    (/logic/v4/Mail/Send). --project-key defaults to the selected project.
+  blocks mail sendtoany [same flags as mail send, plus --is-test-mail]
+                              [--dry-run] [--yes] [--json]
+    Same as mail send but via /logic/v4/Mail/SendToAny, which lets the mail
+    provider route the send (e.g. mark it --is-test-mail).
+
+Notification (/os/v4/Notification/* — project-scoped: requires a selected project, impersonated project token only):
+  blocks notification list [--page] [--page-size] [--sort-by] [--sort-desc] [--filter] [--json]
+  blocks notification get <itemId> [--json]
+  blocks notification save [--name <n>] [--channel <0|1>] [--type <0-3>] [--enable-persistence]
+                              [--notify-method] [--update] [--body '<json>'|--file <path>]
+                              [--dry-run] [--yes] [--json]
+    Pass --update when saving over an existing notification configuration.
+  blocks notification delete <itemId> [--dry-run] [--yes] [--json]
+
+Notifier (/logic/v4/Notifier/* — real-time/offline notification sends and inbox reads;
+          project-scoped: requires a selected project, impersonated project token only.
+          Distinct from 'notification' above, which manages notification channel
+          configuration, not sending):
+  blocks notifier notify [--user-ids a,b] [--roles a,b] [--connection-id <id>]
+                              [--subscription-filters '<json>'] [--denormalized-payload <text>]
+                              [--save-denormalized-payload-as-object] [--response-key]
+                              [--response-value] [--content-available] [--configuration-name]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    Push a notification to specific users/roles, or everyone matching a subscription
+    filter. Target with at least one of --user-ids/--roles/--subscription-filters.
+  blocks notifier list [--unread-only] [--page] [--page-size] [--sort-by] [--sort-desc]
+                              [--filter] [--json]
+    List the signed-in user's notifications (GetNotifications). Read-only.
+  blocks notifier unread [--user-id <id>] [--context <c>] [--action-name <a>] [--value <v>]
+                              [--order-by <1|2>] [--json]
+    Read unread notifications matching a subscription filter. Sent as query
+    parameters even though swagger documents this endpoint as GET with a JSON
+    body -- the Fetch spec forbids a body on GET. Read-only.
+  blocks notifier mark-read <id> [--dry-run] [--yes] [--json]
+  blocks notifier mark-all-read [--dry-run] [--yes] [--json]
+
+Secrets (/os/v4/Secrets/* — project-scoped: requires a selected project, impersonated project
+          token only; generic tenant secret storage, e.g. captcha provider config):
+  blocks secrets get <secretKey> [--page-number 0] [--page-size 10] [--json]
+  blocks secrets save --secret-key <key> [--item-id <id>] --key-value-pairs '<json>'
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    Upsert: omit --item-id to create, pass it to update. --key-value-pairs is a flat
+    JSON object of provider-specific fields, e.g.
+    --key-value-pairs '{"isEnable":"true","provider":"recaptcha","captchaKey":"...","captchaSecret":"..."}'.
+
+Storage (/os/v4/Storage/* — project-scoped: requires a selected project, impersonated project token only):
+  blocks storage config list [--json]
+  blocks storage config get <name> [--json]
+  blocks storage config save [--item-id <id>] [--name <n>] [--strategy] [--connection-string]
+                              [--secret-key] [--access-key] [--region-endpoint] [--host] [--port]
+                              [--username] [--password] [--remote-base-path] [--update]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    Upsert: omit --item-id to create; pass --update to update.
+  blocks storage config delete <name> [--dry-run] [--yes] [--json]
+
+Auth Admin (/iam/v4/auth/identity-providers*, /config, /client-credentials, /oidc-clients —
+            project-scoped: requires a selected project, impersonated project token only):
+  blocks auth idp list [--json]
+  blocks auth idp get <id> [--json]
+  blocks auth idp create --provider <p> --provider-type <t> --protocol <proto>
+                              --client-id <id> [--client-secret] [--display-name] [--issuer]
+                              [--scope] [--redirect-uris a,b] [--active]
+                              [--authorization-url] [--token-url] [--user-info-url]
+                              [--jwks-uri] [--well-known-url] [--response-type]
+                              [--grant-types a,b] [--require-pkce]
+                              [--token-endpoint-auth-method] [--initial-roles a,b]
+                              [--initial-permissions a,b] [--icon]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    Apple-specific fields (teamId, keyId, privateKey, appleAudience) go in --body/--file
+    so no private key lands in shell history.
+    IAM's create endpoint stores issuer/jwksUri/wellKnownUrl but drops
+    authorizationUrl/tokenUrl/userInfoUrl -- set those with 'idp update' afterward.
+  blocks auth idp update <id> [same flags as create, all optional] [--dry-run] [--yes] [--json]
+    provider/providerType/protocol/clientId are immutable: omit them, or echo the
+    existing values exactly if you also pass --body/--file.
+    The only endpoint that persists authorizationUrl/tokenUrl/userInfoUrl -- create accepts
+    and drops them, and update never re-runs discovery, so values set here stick. Use it to
+    repair a provider whose authorizationUrl came back null: '/idp/initiate' builds its
+    redirect from that field, so hosted login goes nowhere without it. Read the endpoint
+    values from the tenant's discovery document rather than composing them by hand.
+  blocks auth idp delete <id> [--dry-run] [--yes] [--json]
+    Irreversible; also deletes the related OIDC client registration.
+  blocks auth idp status <id> --active|--active=false [--dry-run] [--yes] [--json]
+    Enable/disable a provider without deleting its configuration.
+  blocks auth config get [--json]
+  blocks auth config save [--refresh-token-minutes] [--absolute-refresh-token-minutes]
+                              [--access-token-minutes] [--remember-me-refresh-token-minutes]
+                              [--wrong-attempts-to-lock] [--account-lock-duration-minutes]
+                              [--oidc-enabled] [--logout-on-password-change]
+                              [--password-strength-regex] [--body '<json>'|--file <path>]
+                              [--dry-run] [--yes] [--json]
+  blocks auth client-credentials list [--json]
+    clientSecret is included in list responses; treat CLI output as sensitive.
+  blocks auth client-credentials save --name <n> [--item-id <id>] [--roles a,b]
+                              [--permissions a,b] [--access-token-valid-minutes] [--active]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    Omit --item-id to create; pass it to update. The response's clientSecret is
+    shown once and is not retrievable again afterward.
+  blocks auth client-credentials delete <id> [--dry-run] [--yes] [--json]
+
+  blocks auth oidc-clients list [--json]
+    List registered OAuth 2.0 / OIDC client applications for the tenant. client_secret
+    is excluded from list/get responses.
+  blocks auth oidc-clients get <clientId> [--json]
+  blocks auth oidc-clients save [--item-id <id>] [--client-display-name] [--client-type]
+                              [--redirect-uris a,b] [--post-logout-redirect-uris a,b]
+                              [--scope] [--allowed-scopes a,b] [--allowed-response-types a,b]
+                              [--require-pkce] [--require-consent] [--require-mfa]
+                              [--allowed-mfa-methods 0,1] [--front-channel-logout-uri]
+                              [--back-channel-logout-uri] [--auto-redirect]
+                              [--external-discovery-endpoint] [--active] [--login-mode]
+                              [--client-logo-url] [--client-brand-color] [--use-tokens-cookie]
+                              [--register-as-identity-provider] [--device-flow-client]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    Upsert: omit --item-id to register a new client, pass it to update an existing one.
+    The response's client_secret is shown once and is not retrievable again afterward.
+    --client-type is not optional in practice: IAM derives tokenEndpointAuthMethod from it,
+    so omitting it stores a browser/SPA client as confidential ("client_secret_post") and
+    lets it request the client_credentials grant. Pass --client-type public for any
+    PKCE/browser client.
+    --register-as-identity-provider creates the linked identity provider in the same call.
+    Its authorize/token/userinfo/jwks/issuer values are filled from the discovery document
+    at --external-discovery-endpoint; with no discovery endpoint they are left null and the
+    provider's scope is replaced with "openid profile email". Verify with 'auth idp list'.
+  blocks auth oidc-clients delete <clientId> [--dry-run] [--yes] [--json]
+    Irreversible; revokes all tokens issued to the client.
+  blocks auth oidc-clients rotate-secret <clientId> [--dry-run] [--yes] [--json]
+    Generates a new client_secret, shown once; the old secret stops working immediately.
+
+Data:
+  blocks data validate [--json]
+    Validate local blocks/data/schemas/*.json and blocks/data/rules.json before
+    pushing. Local-only.
+
+  blocks data schema list [--page <n>] [--page-size <n>] [--json]
+    List project schemas via /data/v4/schemas using an impersonated project
+    token. Read-only. Page defaults are 1/100; fails clearly on an unexpected
+    response shape instead of treating it as an empty list.
+
+  blocks data schema pull [--json]
+    Download every project schema (paging through all of them) into
+    blocks/data/schemas/*.json. Strips the API id, project identifiers, and
+    platform-managed fields so the file is portable and re-pushable as-is.
+    Writes local files only.
+
+  blocks data schema push [--dry-run] [--yes] [--json]
+    Create or update project schemas via /data/v4/schemas/define. Mutating.
+    Looks up the destination project's schema by name -- never trusts a local
+    id/itemId, which may belong to another project -- and uses PUT with the
+    destination id when found, POST otherwise. Warns when a local id is
+    ignored; fails clearly instead of treating an empty response as success.
+
+  blocks data rules pull [--json]
+    Download data-access policies into blocks/data/rules.json in the CLI's
+    portable format (schemaName, no itemId/schemaId). Writes local files only.
+
+  blocks data rules deploy [--dry-run] [--yes] [--json]
+    Apply schema security and data-access policies. Mutating; supports dry-run
+    and confirmation. Resolves each policy's destination schema id and any
+    existing policy id by name -- never reuses a source-project id.
+
+  blocks data reload [--dry-run] [--yes] [--json]
+    Reload Data schema configuration so staged schema/rule changes become live.
+    Mutating; calls POST /data/v4/schema-configurations/reload.
+
+  blocks data sync [--dry-run] [--yes] [--json]
+    Composed flow: validate local schemas/rules, then data schema push ->
+    data rules deploy -> data reload, so pushed changes actually go live in one
+    step. Validation runs first and hard-fails before anything is sent if it
+    finds errors. Prints 3 separate step outputs (one per underlying command),
+    not one combined document. One confirmation covers the whole flow.
+
+  Data source configuration (/data/v4/configurations) - check this first; by default a
+  project's Data Gateway runs on Blocks-managed storage and data config get is all you need.
+  Only create/update a configuration if you're pointing the gateway at your own database.
+    blocks data config get [--json]
+    blocks data config create --connection-string <cs> [--database-name <name>]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    blocks data config update --item-id <id> [--connection-string] [--database-name]
+                              [--collection-name-editable] [--collection-name-pattern]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+
+  Raw Schema API (/data/v4/schemas* - beyond the file-oriented list/pull/push above):
+    blocks data schema get <id> [--json]
+      Non-JSON output also prints the schema's exact GraphQL operation names --
+      generated names are naive string concatenation, not English
+      pluralization (e.g. Company -> getCompanys/Companys, not Companies).
+    blocks data schema get-by-name <schemaName> [--json]
+      Full field-level detail by collection name (info-by-name).
+    blocks data schema aggregation [--keyword] [--schema-name] [--collection-name]
+                              [--schema-type <1|2>] [--page] [--page-size] [--sort-by]
+                              [--sort-desc] [--json]
+      Schemas plus an access-level summary (Public/User/Custom x Read/Write/Edit/Delete).
+    blocks data schema change-logs [--json]
+      Unadapted schema change logs; data reload clears these.
+    blocks data schema delete <id> [--dry-run] [--yes] [--json]
+      Irreversible.
+    blocks data schema info list [--json]
+      Entity-type schema collections with basic info.
+    blocks data schema info save --schema-name <n> [--collection-name] [--schema-type <1|2>]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+      Create schema metadata only (no fields yet) - pair with data schema fields.
+    blocks data schema info update --item-id <id> [--schema-name] [--collection-name]
+                              [--schema-type <1|2>] [--body '<json>'|--file <path>]
+                              [--dry-run] [--yes] [--json]
+    blocks data schema fields --schema-id <schemaDefinitionItemId> [--deletable-fields a,b]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+      Add/update field definitions; the 'fields' array (name/type/isArray/isPIIData/
+      isUniqueData/description) goes in --body/--file, e.g.
+      --body '{"fields":[{"name":"email","type":"string"}]}'.
+
+  Data-access policies, single-item ops (beyond the file-oriented rules pull/deploy above):
+    blocks data rules policy get <schemaName> [--json]
+    blocks data rules policy delete <itemId> [--dry-run] [--yes] [--json]
+
+  Data validation (/data/v4/data-validations* - field-level validation rules; no file-oriented
+                    workflow exists for this yet, use these directly):
+    blocks data validation list [--schema-id] [--field-name] [--keyword] [--page]
+                              [--page-size] [--sort-by] [--sort-desc] [--json]
+    blocks data validation get <validationId> [--json]
+    blocks data validation by-schema <schemaId> [--json]
+    blocks data validation by-schema-field <schemaId> <fieldName> [--json]
+    blocks data validation save --schema-id <id> --field-name <name> [--item-id]
+                              --body '<json>' (must include a "validations" array, e.g.
+                              '{"validations":[{"type":1,"value":"^[0-9]+$","isActive":true}]}')
+                              [--dry-run] [--yes] [--json]
+      Upsert: omit --item-id to create, pass it to update.
+    blocks data validation delete <validationId> [--dry-run] [--yes] [--json]
+
+  Storage object tree (files, directories, discovery, trash, versions, and access):
+    blocks data files get <fileId> [--version] [--configuration-name] [--json]
+    blocks data files get-many <fileId...>|--file-ids a,b [--configuration-name] [--json]
+    blocks data files info [--name] [--tenant-id] [--page] [--page-size] [--sort-by]
+                              [--sort-desc] [--json]
+    blocks data files upload --file <localPath> [--name] [--item-id] [--parent-id] [--tags]
+                              [--access-modifier Public|Private] [--content-type]
+                              [--configuration-name] [--module-name <1-11>] [--local-storage]
+                              [--dry-run] [--yes] [--json]
+      Cloud: create file/version metadata, then PUT bytes to the returned URL. Local:
+      one multipart request. The file appears in the object tree without registration.
+    blocks data files presigned-upload-url --name <fileName> [--item-id] [--parent-directory-id]
+                              [--access-modifier Public|Private] [--configuration-name]
+                              [--module-name <1-11>] [--meta-data] [--tags]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+      Mutating cloud step 1: creates metadata/version and returns uploadUrl/fileId.
+    blocks data files upload-to-url --url <presignedUrl> --file <localPath>
+                              --content-type <type> [--blob-type BlockBlob] [--no-blob-type-header]
+                              [--dry-run] [--yes] [--json]
+      Step 2. Provider-direct PUT - no Blocks auth headers by design.
+    blocks data files upload-to-local-storage --file <localPath> [--name] [--item-id]
+                              [--parent-directory-id] [--tags] [--access-modifier Public|Private]
+                              [--configuration-name] [--meta-data] [--additional-properties '<json>']
+                              [--dry-run] [--yes] [--json]
+      One-call alternative to the two commands above, for local-storage-backed projects.
+    blocks data files update-additional-info <itemId> --additional-properties '<json>'
+                              [--dry-run] [--yes] [--json]
+    blocks data files delete <fileId> [--configuration-name] [--event-queue-name]
+                              [--permanent]
+                              [--dry-run] [--yes] [--json]
+      Defaults to moving the file to trash; --permanent removes bytes and metadata.
+    blocks data files list [--parent-id] [--module-name <1-11>] [--type directory|file]
+                              [--search] [--cursor] [--limit 1-200] [--json]
+    blocks data files search <query> [--directory-id] [--type directory|file]
+                              [--cursor] [--limit 1-200] [--json]
+    blocks data files trash|shared [--type directory|file] [--cursor] [--limit] [--json]
+    blocks data files restore <resourceId> [--dry-run] [--yes] [--json]
+    blocks data files purge <resourceId> [--dry-run] [--yes] [--json]
+    blocks data files directory-create <name> [--parent-id] [--module-name]
+                              [--description] [--allowed-extensions pdf,docx]
+                              [--dry-run] [--yes] [--json]
+    blocks data files directory-get <directoryId> [--json]
+    blocks data files directory-update <directoryId> [--name] [--description]
+                              [--dry-run] [--yes] [--json]
+    blocks data files directory-delete <directoryId> [--permanent]
+                              [--dry-run] [--yes] [--json]
+    blocks data files directory-move <directoryId> [--target-directory-id]
+                              [--dry-run] [--yes] [--json]
+    blocks data files versions <fileId> [--cursor] [--limit 1-100] [--json]
+    blocks data files create-version <fileId> [--configuration-name]
+                              [--dry-run] [--yes] [--json]
+    blocks data files copy <fileId> --target-directory-id <id> [--copy-access-policies]
+                              [--dry-run] [--yes] [--json]
+    blocks data files move <fileId> --target-directory-id <id> [--dry-run] [--yes] [--json]
+    blocks data files rename <fileId> --name <name> [--dry-run] [--yes] [--json]
+    blocks data files access-list|access-resolve <resourceId> [--json]
+    blocks data files access-grant <resourceId> --resource-type Directory|File
+                              --principal-type User|Role|Everyone|Organization
+                              [--principal-id] --permission View|Download|Edit|Delete|Manage|Owner
+                              [--effect Allow|Deny] [--priority] [--expires-at]
+                              [--dry-run] [--yes] [--json]
+    blocks data files access-update <resourceId> --policy-id <id> <same policy flags>
+    blocks data files access-revoke <resourceId> --policy-id <id> [--dry-run] [--yes] [--json]
+    blocks data files inheritance <resourceId> --enabled=true|false [--dry-run] [--yes] [--json]
+    blocks data files share <resourceId> --resource-type <type> --principal-type <type>
+                              [--principal-id] --permission <permission> [--expires-at]
+                              [--dry-run] [--yes] [--json]
+
+Localization:
+  blocks localization validate --module <name> --language <culture> [--file <path>] [--json]
+    Validate a local i18n JSON dictionary. Supports nested JSON input and
+    validates the flattened key/value set locally.
+
+  blocks localization push --module <name> --language <culture> [--file <path>] [--route <route>] [--context <text>] [--dry-run] [--yes] [--json]
+    Create or update Localization keys from a local i18n JSON dictionary via
+    /localization/v4/Key/SaveKeys. Creates the module first when it is missing.
+
+  blocks localization pull --module <name> --language <culture> [--out <path>] [--json]
+    Download published cloud localization via
+    /localization/v4/Key/GetCloudUilmFile and write a local JSON dictionary.
+
+  Raw API (/localization/v4/* — project-scoped: requires a selected project, impersonated
+            project token only). These call the Localization service endpoints directly,
+            in addition to the file-oriented validate/push/pull commands above.
+
+    blocks localization assistant translation-suggestion --source-text <text>
+                              --destination-language <culture> [--current-language]
+                              [--element-type] [--element-application-context]
+                              [--element-detail-context] [--temperature] [--max-character-length]
+                              [--glossary-ids a,b] [--module-id] [--destination-language-code]
+                              [--body '<json>'|--file <path>] [--json]
+
+    blocks localization config get-webhook [--json]
+    blocks localization config save-webhook --url <url> --content-type <type>
+                              --secret <s> --header-key <k> [--item-id <id>] [--is-disabled]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+
+    blocks localization glossary save --name <n> [--item-id] [--language] [--type]
+                              [--context] [--additional-note] [--is-global] [--module-ids a,b]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    blocks localization glossary list [--search] [--page-number] [--page-size]
+                              [--is-global] [--module-id] [--json]
+    blocks localization glossary get <itemId> [--json]
+    blocks localization glossary suggested <itemId> [--max-results <n>] [--json]
+    blocks localization glossary delete <itemId> [--dry-run] [--yes] [--json]
+
+    blocks localization key save --key-name <n> --module-id <id> [--item-id] [--value]
+                              [--culture] [--routes a,b] [--glossary-ids a,b] [--context]
+                              [--is-new-key] [--is-partially-translated] [--should-publish]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    blocks localization key list [--key-search-text] [--search-key] [--module-ids a,b]
+                              [--page-number] [--page-size] [--sort-by] [--sort-desc]
+                              [--is-partially-translated] [--missing-languages a,b]
+                              [--create-date-start] [--create-date-end]
+                              [--last-update-date-start] [--last-update-date-end]
+                              [--glossary-id] [--body '<json>'|--file <path>] [--json]
+    blocks localization key get-by-names <keyName...>|--key-names a,b [--module-id] [--json]
+    blocks localization key get <itemId> [--json]
+    blocks localization key delete <itemId> [--dry-run] [--yes] [--json]
+    blocks localization key delete-keys <itemId...>|--item-ids a,b [--dry-run] [--yes] [--json]
+    blocks localization key get-timeline [--entity-id] [--user-id] [--page-number]
+                              [--page-size] [--sort-by] [--sort-desc] [--create-date-start]
+                              [--create-date-end] [--json]
+    blocks localization key get-localization-timeline [--user-id] [--log-from]
+                              [--log-from-values a,b] [--exclude-log-from-values a,b]
+                              [--page-number] [--page-size] [--sort-by] [--sort-desc]
+                              [--create-date-start] [--create-date-end] [--json]
+    blocks localization key get-timeline-by-operation-id <operationId> [--page-number]
+                              [--page-size] [--json]
+    blocks localization key get-uilm-file --module <name> --language <culture> [--json]
+    blocks localization key generate-uilm-file --module-id <id> [--guid]
+                              [--dry-run] [--yes] [--json]
+    blocks localization key translate-all --module-id <id> [--default-language]
+                              [--message-co-relation-id] [--dry-run] [--yes] [--json]
+    blocks localization key translate-key <keyId> --default-language <culture>
+                              [--message-co-relation-id] [--dry-run] [--yes] [--json]
+    blocks localization key translate-keys <keyId...>|--key-ids a,b --default-language <culture>
+                              [--message-co-relation-id] [--project-key]
+                              [--dry-run] [--yes] [--json]
+    blocks localization key translate-and-export --module-id <id> [--default-language]
+                              [--wait] [--poll-interval <seconds>] [--timeout <seconds>]
+                              [--guid] [--output-type <0-5>] [--app-ids a,b] [--languages a,b]
+                              [--reference-file-id] [--caller-tenant-id] [--start-date]
+                              [--end-date] [--dry-run] [--yes] [--json]
+      Composed flow: translate-all -> generate-uilm-file -> uilm-export. Without --wait,
+      fires all 3 back to back (same as running them by hand). With --wait, polls
+      GetTimelineByOperationId (using a generated messageCoRelationId) between translate
+      and generate, since translation runs async and there's no documented explicit
+      "done" field to check -- it stops once the timeline entry count settles across 2
+      polls, or times out with a clear next-step message. Prints one output block per
+      step, not a single combined document.
+    blocks localization key uilm-import <fileId> [--message-co-relation-id]
+                              [--dry-run] [--yes] [--json]
+    blocks localization key uilm-export [--output-type <0-5>] [--app-ids a,b] [--languages a,b]
+                              [--reference-file-id] [--caller-tenant-id] [--start-date]
+                              [--end-date] [--message-co-relation-id] [--dry-run] [--yes] [--json]
+    blocks localization key get-uilm-exported-files [--search] [--page-number] [--page-size]
+                              [--create-date-start] [--create-date-end] [--json]
+    blocks localization key get-language-file-generation-history [--page-number]
+                              [--page-size] [--json]
+    blocks localization key rollback <itemId> [--dry-run] [--yes] [--json]
+
+    blocks localization language save --language-name <n> --language-code <c> [--item-id]
+                              [--is-default] [--body '<json>'|--file <path>]
+                              [--dry-run] [--yes] [--json]
+    blocks localization language list [--json]
+    blocks localization language list-for-tenant [--json]
+    blocks localization language delete <languageName> [--dry-run] [--yes] [--json]
+    blocks localization language set-default <languageName> [--dry-run] [--yes] [--json]
+
+    blocks localization module save --module-name <n> [--item-id]
+                              [--body '<json>'|--file <path>] [--dry-run] [--yes] [--json]
+    blocks localization module list [--json]
+    blocks localization module list-for-tenant [--json]
+    blocks localization module tag-glossary <moduleId> --glossary-ids a,b
+                              [--dry-run] [--yes] [--json]
+
+Release:
+  blocks release deploy [--domain <customDomain>] [--wait] [--poll-interval <seconds>]
+                    [--timeout <seconds>] [--dry-run] [--yes] [--json]
+    Deploy the selected project's environment. Resolves everything from state
+    you already have: the repo linked to this project (Project/GetAsset) and
+    that repo's connected branch (Build/repo-details) -- no --repo-id needed.
+    Aborts if the connected branch doesn't match this environment's name.
+    Pass --domain to also set the custom deployment domain before deploying.
+    Pass --wait to poll release status on the resulting build until it reaches
+    a terminal state (or --timeout elapses, default 900s) instead of returning
+    immediately with just a build id.
+    Mutating; no artifact upload is performed by this CLI.
+
+  blocks release status <buildId> [--json]
+    Read Release build status by build id using an impersonated project
+    token. Read-only.
+
+  blocks release builds list [repoId] [--repo-id <repoId>] [--json]
+    List Release build details for a repository using an impersonated project
+    token. When repoId is omitted, resolves it from the selected project's
+    linked repo assets (Project/GetAsset, account token) -- auto-picked if
+    there's exactly one, otherwise you're prompted to choose. Read-only.
+
+  blocks release builds get <buildId> [--json]
+    Alias for release status. Read-only.
+
+Scaffold:
+  blocks new web <name> [--app-domain <domain>] [--client-id <oidcClientId>]
+                    [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>]
+    Create a Vite React starter app that talks to Blocks exclusively through
+    @seliseblocks/client (a single createBlocksClient() instance) using the SDK
+    hosted IdP flow: blocksClient.auth.idp.redirectToProvider() on login click
+    and blocksClient.auth.idp.callback() on /login/callback. Includes route
+    guards, auto-refresh through auth.oidc.refreshToken(), live
+    auth/iam/data/localization SDK examples, environment config, and safe
+    .gitignore defaults.
+    Uses the selected project (see 'use') unless --x-blocks-key overrides it.
+    --app-domain and --client-id are resolved from the project when omitted:
+    if the project has one domain it's used automatically, otherwise you're
+    prompted to choose; the OIDC client is picked from a list of the
+    project's existing clients, or you can create a minimal one (display
+    name + redirect URI, active, registered as a Blocks OIDC identity
+    provider) on the spot, or skip and register one later from the portal or
+    'auth oidc-clients save'.
+    If --blocks-api-url is omitted, it is derived from the app domain:
+    https://blocksapi.<registrable-domain> (for example, app domain
+    https://dqrsf.slsblx.com uses https://blocksapi.slsblx.com). Pass a
+    different Data/IAM/Localization/OS gateway URL explicitly only if your
+    project uses a non-default one.
+    --oidc-url defaults to https://iam.seliseblocks.com.
+
+Skills:
+  blocks skill list [--json]
+    List bundled blocks-skills/*/SKILL.md agent context docs (name +
+    description). Local-only, no cloud calls.
+  blocks skill show <name> [--json]
+    Print one skill's full SKILL.md content.
+  blocks skill add <name> [--dir <path>]
+    Copy a bundled skill's SKILL.md into <path>/<name>/SKILL.md in the
+    current directory (default --dir is 'blocks-skills'), for use in a
+    project outside this monorepo. Overwrites silently, same as
+    'data schema pull'.
+
+SDK:
+  blocks sdk client [--app-domain <domain>] [--client-id <oidcClientId>]
+                    [--x-blocks-key <tenantId>] [--blocks-api-url <url>] [--oidc-url <url>] [--json]
+    Read-only: "I want to use the Blocks SDK -- show me the client." Resolves this
+    project's @seliseblocks/client config using the selected project unless
+    --x-blocks-key overrides it, and the project's registered domain/OIDC client
+    when --app-domain/--client-id are omitted. Its API URL defaults to
+    https://api.seliseblocks.com unless --blocks-api-url is passed.
+    Prints a ready-to-paste createBlocksClient(...) snippet.
+    Passing both --app-domain and --client-id skips the project lookup entirely
+    (no login required). Never writes a file; to scaffold a new app use 'new web'.
 `);
 }