@seliseblocks/client 0.1.0 → 0.1.2

package/AI_USAGE_GUIDE.md

@@ -1,149 +1,149 @@
-# AI Usage Guide
-
-Use this file only for `@seliseblocks/client` app-code work. For full method details, read the source docstrings.
-
-Source refs:
-
-- Client setup: `src/client.ts`
-- Auth: `src/auth/auth-client.ts`
-- IAM: `src/iam/iam-client.ts`
-- Data: `src/data/data-client.ts`
-- Localization: `src/localization/localization-client.ts`
-- HTTP/errors: `src/http/http-client.ts`, `src/http/errors.ts`
-
-## Non-Negotiable Rules
-
-- Configure `xBlocksKey`; SDK sends it as `x-blocks-key`.
-- Do not send `ProjectKey` or `projectKey`.
-- Do not add `/api` after `/v4`.
-- Valid route shapes: `/iam/v4/...`, `/data/v4/...`, `/localization/v4/...`.
-- SDK does not store tokens. App owns access token, refresh token, storage, and logout cleanup.
-- Frontend code must not contain client secrets.
-- Do not add impersonation, release deploy, schema/rules mutation, or localization authoring/admin APIs.
-
-## Create Client
-
-```ts
-import { createBlocksClient } from "@seliseblocks/client";
-
-export const blocks = createBlocksClient({
-  apiUrl: "https://api.seliseblocks.com",
-  xBlocksKey: env.BLOCKS_KEY,
-  accessToken: () => session.accessToken,
-  oidc: {
-    url: "https://iam.seliseblocks.com",
-    clientId: env.OIDC_CLIENT_ID,
-    redirectUri: env.OIDC_REDIRECT_URI ?? `${window.location.origin}/login/callback`
-  }
-});
-```
-
-Use `accessToken` only for the current token resolver. Do not add SDK token storage.
-Use a configured `redirectUri` when available; the current-origin `/login/callback` URL is only a browser fallback.
-
-## Auth Decision
-
-There are two auth flows.
-
-OIDC/hosted IAM flow:
-
-- Login: `blocks.auth.idp.initiate()`, `blocks.auth.idp.redirectToProvider()`, `blocks.auth.idp.callback(...)`
-- Refresh: `blocks.auth.oidc.refreshToken({ refreshToken })`
-- Refresh route: `POST /iam/v4/oidc/token`
-- Must send `client_id`; SDK uses `request.clientId` or configured `oidc.clientId`.
-- Do not manually build `oidc/authorize`.
-
-Embedded/app-owned flow:
-
-- Login: `blocks.auth.login(...)`
-- Social: `blocks.auth.socialInitiate(...)`, `blocks.auth.socialCallback(...)`
-- Refresh: `blocks.auth.refresh({ refreshToken })`
-- Routes: `/iam/v4/auth/login`, `/iam/v4/auth/social/*`, `/iam/v4/auth/refresh`
-
-Shared auth methods for both flows:
-
-- `userInfo()`
-- `switchOrganization(...)`
-- `logout(...)`, `logoutAll(...)`
-- `signup(...)`, `recover(...)`, `resetPassword(...)`
-- `changePassword(...)`
-- `activate(...)`, `resendActivation(...)`, `validateActivation(...)`
-- `identityProviders.*`, `config.*`, `userCodes.*`, `clientCredentials.*` when app has permission
-
-## Service Map
-
-IAM:
-
-- `blocks.iam.me()`
-- `blocks.iam.users.*`
-- `blocks.iam.roles.*`
-- `blocks.iam.permissions.*`
-- `blocks.iam.resources.*`
-- `blocks.iam.organizations.*`
-- `blocks.iam.signup.*`
-
-Data:
-
-- `blocks.data.schemas.*` for schema reads only
-- `blocks.data.validations.*` for validation reads
-- `blocks.data.collection("Name").list/get/create/update/delete`
-- `blocks.data.graphql(...)`
-- `blocks.data.files.*` for file/storage helpers
-- `blocks.data.dms.*` for DMS file/folder helpers
-- `blocks.data.utilities.*` for runtime utility helpers
-
-Localization:
-
-- `blocks.localization.languages()`
-- `blocks.localization.modules()`
-- `blocks.localization.languagesForCurrentTenant()`
-- `blocks.localization.modulesForCurrentTenant()`
-- `blocks.localization.translations(moduleName, language)`
-- `blocks.localization.load(language, modules)`
-- `blocks.localization.cloudTranslations(moduleName, language)`
-- `blocks.localization.loadCloud(language, modules)`
-- `blocks.localization.keysByNames(...)`
-- `blocks.localization.t(key, fallback, options)`
-
-HTTP fallback:
-
-- Use `blocks.http.request("/service/v4/...")` only when no typed method exists.
-- Use `blocks.http.external(url, ...)` only for external URLs such as pre-signed uploads.
-
-## Minimal Examples
-
-```ts
-const me = await blocks.iam.me();
-const schemas = await blocks.data.schemas.list({ pageNo: 1, pageSize: 20 });
-const rows = await blocks.data.collection("Students").list({ pageNo: 1, pageSize: 20 });
-await blocks.localization.load("en-US", ["common"]);
-const label = blocks.localization.t("save", "Save");
-```
-
-OIDC refresh with explicit client id:
-
-```ts
-await blocks.auth.oidc.refreshToken({
-  clientId: env.OIDC_CLIENT_ID,
-  refreshToken: session.refreshToken
-});
-```
-
-Embedded refresh:
-
-```ts
-await blocks.auth.refresh({
-  refreshToken: session.refreshToken
-});
-```
-
-## Check Before Finishing
-
-```bash
-npm test
-npm run lint
-npm pack --dry-run
-rg -n "v4[/\\]api|iam[/\\]v4[/\\]api|data[/\\]v4[/\\]api|localization[/\\]v4[/\\]api" src README.md AI_USAGE_GUIDE.md test
-```
-
-Only negative route-guard tests should match.
+# AI Usage Guide
+
+Use this file only for `@seliseblocks/client` app-code work. For full method details, read the source docstrings.
+
+Source refs:
+
+- Client setup: `src/client.ts`
+- Auth: `src/auth/auth-client.ts`
+- IAM: `src/iam/iam-client.ts`
+- Data: `src/data/data-client.ts`
+- Localization: `src/localization/localization-client.ts`
+- HTTP/errors: `src/http/http-client.ts`, `src/http/errors.ts`
+
+## Non-Negotiable Rules
+
+- Configure `xBlocksKey`; SDK sends it as `x-blocks-key`.
+- Do not send `ProjectKey` or `projectKey`.
+- Do not add `/api` after `/v4`.
+- Valid route shapes: `/iam/v4/...`, `/data/v4/...`, `/localization/v4/...`.
+- SDK does not store tokens. App owns access token, refresh token, storage, and logout cleanup.
+- Frontend code must not contain client secrets.
+- Do not add impersonation, release deploy, schema/rules mutation, or localization authoring/admin APIs.
+
+## Create Client
+
+```ts
+import { createBlocksClient } from "@seliseblocks/client";
+
+export const blocks = createBlocksClient({
+  apiUrl: "https://api.seliseblocks.com",
+  xBlocksKey: env.BLOCKS_KEY,
+  accessToken: () => session.accessToken,
+  oidc: {
+    url: "https://iam.seliseblocks.com",
+    clientId: env.OIDC_CLIENT_ID,
+    redirectUri: env.OIDC_REDIRECT_URI ?? `${window.location.origin}/login/callback`
+  }
+});
+```
+
+Use `accessToken` only for the current token resolver. Do not add SDK token storage.
+Use a configured `redirectUri` when available; the current-origin `/login/callback` URL is only a browser fallback.
+
+## Auth Decision
+
+There are two auth flows.
+
+OIDC/hosted IAM flow:
+
+- Login: `blocks.auth.idp.initiate()`, `blocks.auth.idp.redirectToProvider()`, `blocks.auth.idp.callback(...)`
+- Refresh: `blocks.auth.oidc.refreshToken({ refreshToken })`
+- Refresh route: `POST /iam/v4/oidc/token`
+- Must send `client_id`; SDK uses `request.clientId` or configured `oidc.clientId`.
+- Do not manually build `oidc/authorize`.
+
+Embedded/app-owned flow:
+
+- Login: `blocks.auth.login(...)`
+- Social: `blocks.auth.socialInitiate(...)`, `blocks.auth.socialCallback(...)`
+- Refresh: `blocks.auth.refresh({ refreshToken })`
+- Routes: `/iam/v4/auth/login`, `/iam/v4/auth/social/*`, `/iam/v4/auth/refresh`
+
+Shared auth methods for both flows:
+
+- `userInfo()`
+- `switchOrganization(...)`
+- `logout(...)`, `logoutAll(...)`
+- `signup(...)`, `recover(...)`, `resetPassword(...)`
+- `changePassword(...)`
+- `activate(...)`, `resendActivation(...)`, `validateActivation(...)`
+- `identityProviders.*`, `config.*`, `userCodes.*`, `clientCredentials.*` when app has permission
+
+## Service Map
+
+IAM:
+
+- `blocks.iam.me()`
+- `blocks.iam.users.*`
+- `blocks.iam.roles.*`
+- `blocks.iam.permissions.*`
+- `blocks.iam.resources.*`
+- `blocks.iam.organizations.*`
+- `blocks.iam.signup.*`
+
+Data:
+
+- `blocks.data.schemas.*` for schema reads only
+- `blocks.data.validations.*` for validation reads
+- `blocks.data.collection("Name").list/get/create/update/delete`
+- `blocks.data.graphql(...)`
+- `blocks.data.files.*` for file/storage helpers
+- `blocks.data.dms.*` for DMS file/folder helpers
+- `blocks.data.utilities.*` for runtime utility helpers
+
+Localization:
+
+- `blocks.localization.languages()`
+- `blocks.localization.modules()`
+- `blocks.localization.languagesForCurrentTenant()`
+- `blocks.localization.modulesForCurrentTenant()`
+- `blocks.localization.translations(moduleName, language)`
+- `blocks.localization.load(language, modules)`
+- `blocks.localization.cloudTranslations(moduleName, language)`
+- `blocks.localization.loadCloud(language, modules)`
+- `blocks.localization.keysByNames(...)`
+- `blocks.localization.t(key, fallback, options)`
+
+HTTP fallback:
+
+- Use `blocks.http.request("/service/v4/...")` only when no typed method exists.
+- Use `blocks.http.external(url, ...)` only for external URLs such as pre-signed uploads.
+
+## Minimal Examples
+
+```ts
+const me = await blocks.iam.me();
+const schemas = await blocks.data.schemas.list({ pageNo: 1, pageSize: 20 });
+const rows = await blocks.data.collection("Students").list({ pageNo: 1, pageSize: 20 });
+await blocks.localization.load("en-US", ["common"]);
+const label = blocks.localization.t("save", "Save");
+```
+
+OIDC refresh with explicit client id:
+
+```ts
+await blocks.auth.oidc.refreshToken({
+  clientId: env.OIDC_CLIENT_ID,
+  refreshToken: session.refreshToken
+});
+```
+
+Embedded refresh:
+
+```ts
+await blocks.auth.refresh({
+  refreshToken: session.refreshToken
+});
+```
+
+## Check Before Finishing
+
+```bash
+npm test
+npm run lint
+npm pack --dry-run
+rg -n "v4[/\\]api|iam[/\\]v4[/\\]api|data[/\\]v4[/\\]api|localization[/\\]v4[/\\]api" src README.md AI_USAGE_GUIDE.md test
+```
+
+Only negative route-guard tests should match.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) SELISE Blocks
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) SELISE Blocks
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,161 +1,161 @@
-# Blocks Client
-
-Framework-neutral TypeScript SDK for SELISE Blocks frontend and app-runtime code.
-
-`@seliseblocks/client` gives consumer apps a small, typed wrapper around the Blocks APIs they normally call at runtime: Auth/IAM, Data, Localization, and shared HTTP configuration. Detailed `what / why / how` descriptions are kept on the SDK functions themselves so editors and generated typings show the guidance where developers use the API.
-
-Admin/control-plane work belongs in `@seliseblocks/cli-os`: project setup, schema/rules deploy, release deploy, and AI/admin terminal workflows.
-
-For AI agents and automation, see [AI_USAGE_GUIDE.md](AI_USAGE_GUIDE.md).
-
-## Install
-
-```bash
-npm install @seliseblocks/client
-```
-
-Requires Node.js 20+ or a browser/runtime with `fetch`.
-
-## Create A Client
-
-```ts
-import { createBlocksClient } from "@seliseblocks/client";
-
-const blocks = createBlocksClient({
-  apiUrl: "https://api.seliseblocks.com",
-  xBlocksKey: "<blocks-key>",
-  accessToken: () => currentUserSession?.accessToken,
-  oidc: {
-    url: "https://iam.seliseblocks.com",
-    clientId: "<public-browser-client-id>",
-    redirectUri: configuredRedirectUri ?? `${window.location.origin}/login/callback`
-  }
-});
-```
-
-`xBlocksKey` is always sent as the `x-blocks-key` header. Do not send `ProjectKey` or `projectKey` in request query/body payloads.
-
-The SDK does not store tokens. Your app owns login state, refresh scheduling, storage, and logout cleanup.
-
-Use a configured OIDC redirect URI when your app has one. The current-origin `/login/callback` URL is only a browser fallback.
-
-## Auth
-
-Auth has two login flows.
-
-OIDC/hosted IAM login uses `auth.idp`. The SDK relies on Blocks IAM `IdpController`, sends the configured public `clientId`, and does not manually build `oidc/authorize` URLs. Refresh OIDC sessions with `auth.oidc.refreshToken()`, which calls `/iam/v4/oidc/token` and sends `client_id`.
-
-```ts
-await blocks.auth.idp.redirectToProvider();
-
-const result = await blocks.auth.idp.callback(window.location.href);
-
-const refreshed = await blocks.auth.oidc.refreshToken({
-  refreshToken: result.refresh_token,
-  clientId: "<public-browser-client-id>"
-});
-```
-
-Embedded/app-owned login UI uses AuthController methods directly on `auth`: `auth.login()`, `auth.socialInitiate()`, `auth.socialCallback()`, and `auth.refresh()`.
-
-```ts
-const login = await blocks.auth.login({
-  username: "user@example.com",
-  password: "password"
-});
-
-const refreshed = await blocks.auth.refresh({
-  refreshToken: login.refresh_token
-});
-```
-
-Other auth APIs, such as user info, organization switch, logout, signup, recovery, activation, auth config, user codes, client credentials, and identity providers, can be used by either flow when the app has the required token/permission.
-
-`auth.oidc.clientCredentials()` is for trusted non-browser runtimes only because it requires a client secret.
-
-## Common Runtime Calls
-
-```ts
-const me = await blocks.iam.me();
-const orgs = await blocks.iam.organizations.my();
-const features = await blocks.iam.resources.features();
-```
-
-```ts
-const schemas = await blocks.data.schemas.list();
-const schemaInfo = await blocks.data.schemas.infoByName("Student");
-const schemaRules = await blocks.data.validations.bySchemaId("schema-id");
-
-const students = blocks.data.collection("Students");
-const rows = await students.list({ pageNo: 1, pageSize: 20 });
-await students.create({ firstName: "Test" });
-
-const graph = await blocks.data.graphql({
-  query: "{ students { items { itemId firstName } } }"
-});
-```
-
-```ts
-const upload = await blocks.data.files.presignedUploadUrl({
-  name: "avatar.png",
-  configurationName: "default",
-  parentDirectoryId: "root",
-  accessModifier: "Private"
-});
-
-await blocks.data.files.uploadToUrl({
-  url: upload.uploadUrl,
-  body: file,
-  contentType: file.type
-});
-
-const items = await blocks.data.dms.list({
-  configurationName: "default",
-  parentId: "root",
-  skip: 0,
-  take: 20
-});
-```
-
-```ts
-await blocks.localization.load("en-US", ["common", "dashboard"]);
-const label = blocks.localization.t("dashboard.title", "Dashboard");
-
-const tenantLanguages = await blocks.localization.languagesForCurrentTenant();
-const selectedKeys = await blocks.localization.keysByNames({
-  keyNames: ["dashboard.title"]
-});
-```
-
-## API Surface
-
-- `blocks.auth`: AuthController login, social login, refresh, org switch, logout, signup, recovery, activation, auth config, user codes, client credentials, identity providers.
-- `blocks.auth.idp`: hosted IdP initiate, browser redirect, callback, UI config.
-- `blocks.auth.oidc`: refresh-token and client-credentials token endpoint helpers.
-- `blocks.iam`: current user, users, roles, permissions, resources, organizations, signup settings.
-- `blocks.data`: schema reads, validation reads, GraphQL gateway execution, file/storage helpers, DMS file/folder helpers, runtime collection CRUD.
-- `blocks.localization`: tenant language/module discovery, UILM dictionary loading, selected key lookup, simple `t()` lookup.
-
-Professional class names are exported for advanced typing and adapters: `BlocksAuthenticationClient`, `BlocksIAMClient`, `BlocksDataClient`, and `BlocksLocalizationClient`.
-
-## Boundaries
-
-This package must not contain:
-
-- CLI client secrets
-- impersonation APIs
-- project create/list/use
-- schema/rules deploy
-- release deploy
-- token/session/PKCE storage
-- Node filesystem or OS credential storage
-- framework UI components
-- Localization authoring/admin endpoints
-- Data schema/rules mutation endpoints
-
-## Package Checks
-
-```bash
-npm test
-npm pack --dry-run
-```
+# Blocks Client
+
+Framework-neutral TypeScript SDK for SELISE Blocks frontend and app-runtime code.
+
+`@seliseblocks/client` gives consumer apps a small, typed wrapper around the Blocks APIs they normally call at runtime: Auth/IAM, Data, Localization, and shared HTTP configuration. Detailed `what / why / how` descriptions are kept on the SDK functions themselves so editors and generated typings show the guidance where developers use the API.
+
+Admin/control-plane work belongs in `@seliseblocks/cli-os`: project setup, schema/rules deploy, release deploy, and AI/admin terminal workflows.
+
+For AI agents and automation, see [AI_USAGE_GUIDE.md](AI_USAGE_GUIDE.md).
+
+## Install
+
+```bash
+npm install @seliseblocks/client
+```
+
+Requires Node.js 20+ or a browser/runtime with `fetch`.
+
+## Create A Client
+
+```ts
+import { createBlocksClient } from "@seliseblocks/client";
+
+const blocks = createBlocksClient({
+  apiUrl: "https://api.seliseblocks.com",
+  xBlocksKey: "<blocks-key>",
+  accessToken: () => currentUserSession?.accessToken,
+  oidc: {
+    url: "https://iam.seliseblocks.com",
+    clientId: "<public-browser-client-id>",
+    redirectUri: configuredRedirectUri ?? `${window.location.origin}/login/callback`
+  }
+});
+```
+
+`xBlocksKey` is always sent as the `x-blocks-key` header. Do not send `ProjectKey` or `projectKey` in request query/body payloads.
+
+The SDK does not store tokens. Your app owns login state, refresh scheduling, storage, and logout cleanup.
+
+Use a configured OIDC redirect URI when your app has one. The current-origin `/login/callback` URL is only a browser fallback.
+
+## Auth
+
+Auth has two login flows.
+
+OIDC/hosted IAM login uses `auth.idp`. The SDK relies on Blocks IAM `IdpController`, sends the configured public `clientId`, and does not manually build `oidc/authorize` URLs. Refresh OIDC sessions with `auth.oidc.refreshToken()`, which calls `/iam/v4/oidc/token` and sends `client_id`.
+
+```ts
+await blocks.auth.idp.redirectToProvider();
+
+const result = await blocks.auth.idp.callback(window.location.href);
+
+const refreshed = await blocks.auth.oidc.refreshToken({
+  refreshToken: result.refresh_token,
+  clientId: "<public-browser-client-id>"
+});
+```
+
+Embedded/app-owned login UI uses AuthController methods directly on `auth`: `auth.login()`, `auth.socialInitiate()`, `auth.socialCallback()`, and `auth.refresh()`.
+
+```ts
+const login = await blocks.auth.login({
+  username: "user@example.com",
+  password: "password"
+});
+
+const refreshed = await blocks.auth.refresh({
+  refreshToken: login.refresh_token
+});
+```
+
+Other auth APIs, such as user info, organization switch, logout, signup, recovery, activation, auth config, user codes, client credentials, and identity providers, can be used by either flow when the app has the required token/permission.
+
+`auth.oidc.clientCredentials()` is for trusted non-browser runtimes only because it requires a client secret.
+
+## Common Runtime Calls
+
+```ts
+const me = await blocks.iam.me();
+const orgs = await blocks.iam.organizations.my();
+const features = await blocks.iam.resources.features();
+```
+
+```ts
+const schemas = await blocks.data.schemas.list();
+const schemaInfo = await blocks.data.schemas.infoByName("Student");
+const schemaRules = await blocks.data.validations.bySchemaId("schema-id");
+
+const students = blocks.data.collection("Students");
+const rows = await students.list({ pageNo: 1, pageSize: 20 });
+await students.create({ firstName: "Test" });
+
+const graph = await blocks.data.graphql({
+  query: "{ students { items { itemId firstName } } }"
+});
+```
+
+```ts
+const upload = await blocks.data.files.presignedUploadUrl({
+  name: "avatar.png",
+  configurationName: "default",
+  parentDirectoryId: "root",
+  accessModifier: "Private"
+});
+
+await blocks.data.files.uploadToUrl({
+  url: upload.uploadUrl,
+  body: file,
+  contentType: file.type
+});
+
+const items = await blocks.data.dms.list({
+  configurationName: "default",
+  parentId: "root",
+  skip: 0,
+  take: 20
+});
+```
+
+```ts
+await blocks.localization.load("en-US", ["common", "dashboard"]);
+const label = blocks.localization.t("dashboard.title", "Dashboard");
+
+const tenantLanguages = await blocks.localization.languagesForCurrentTenant();
+const selectedKeys = await blocks.localization.keysByNames({
+  keyNames: ["dashboard.title"]
+});
+```
+
+## API Surface
+
+- `blocks.auth`: AuthController login, social login, refresh, org switch, logout, signup, recovery, activation, auth config, user codes, client credentials, identity providers.
+- `blocks.auth.idp`: hosted IdP initiate, browser redirect, callback, UI config.
+- `blocks.auth.oidc`: refresh-token and client-credentials token endpoint helpers.
+- `blocks.iam`: current user, users, roles, permissions, resources, organizations, signup settings.
+- `blocks.data`: schema reads, validation reads, GraphQL gateway execution, file/storage helpers, DMS file/folder helpers, runtime collection CRUD.
+- `blocks.localization`: tenant language/module discovery, UILM dictionary loading, selected key lookup, simple `t()` lookup.
+
+Professional class names are exported for advanced typing and adapters: `BlocksAuthenticationClient`, `BlocksIAMClient`, `BlocksDataClient`, and `BlocksLocalizationClient`.
+
+## Boundaries
+
+This package must not contain:
+
+- CLI client secrets
+- impersonation APIs
+- project create/list/use
+- schema/rules deploy
+- release deploy
+- token/session/PKCE storage
+- Node filesystem or OS credential storage
+- framework UI components
+- Localization authoring/admin endpoints
+- Data schema/rules mutation endpoints
+
+## Package Checks
+
+```bash
+npm test
+npm pack --dry-run
+```