What's new in Blocks

Release Notes

Identity gains signup links: invite someone with a link that already carries their roles, and they join in one click, through Blocks OIDC or from inside your own app. Custom domains now come with a guided setup that shows each step as it runs. Data Gateway adds an Enum field type. Subscriptions can be sold per person, with each person getting their own allowance. The CLI now covers proxies, schedules, custom domains, and GitHub connection.

Identity

• Signup links — Under Identity & Access → One-Click Signup, you create a configuration that holds the defaults for one kind of invitation: roles, permissions, how long a link lasts, where the person lands afterwards, and whether they set a password (PasswordRequired) or join without one (Passwordless). Each link you then generate is tied to one email address, and its grant is fixed when it's made. A link is stored only as a hash and can be revoked one at a time or for a whole configuration. Generating a link checks that you're allowed to assign the roles it grants, so a link can't hand out more access than you have.

• Two modes — Blocks OIDC mode sends the person through your registered OIDC client and back to its registered redirect URI. IAM checks that redirect when the link is generated and again when it's used. Embedded mode is for apps that run with OIDC off. Your app shows its own join screen, calls signup-links/context and signup-links/redeem, and gets the tokens back directly. IAM never redirects in this mode, because there's no registered client to check a redirect against. The configuration form shows only the fields that apply to the mode you choose, and the client is picked from a list instead of typed in.

• Signed in on arrival — Previously, someone who accepted a PasswordRequired invitation set a password and was then asked to type it again on the sign-in page. Turn on Sign in after activation and they arrive already signed in. This works in both modes. The setting is on by default for new PasswordRequired configurations. Existing configurations are unchanged.

• Multi-use links — A link can now be used more than once. Set maxRedemptions to a number, or to 0 for unlimited uses until the link expires. Leave it out and the link stays single-use, as before.

• Link activity — POST iam/signup-links/summary returns, for each configuration, how many links were generated, used, never used, and rejected. It returns counts only, no link ids or email addresses.

• Account state on the users list — Previously an invited, deactivated, or suspended user all showed as "Inactive". Each user now has one accountState (Active, PendingVerification, Suspended, or Deactivated), and the portal's users list has a Status column and filter. In the API, the accountStates filter also accepts LockedOut. Bulk role changes use the same filter. The existing active and status fields are unchanged.

• Rotate client secrets — POST client-credentials/{id}/rotate-secret issues a new secret for a client credential and returns it once. Saving a client credential returns the secret only when the credential is first created. An update keeps the existing secret.

• Client status in the list — The OIDC client list now shows an Active/Inactive badge and lets you enable or disable a client from the row, as the client credentials list already does.

• Revoke default-organization access — In multi-organization tenants, you can now remove a user's access to the default organization from their Access tab. You still can't remove your own access.

• Delegated access for services — A delegated-access grant can now name an OAuth client instead of a user. When it's redeemed, IAM issues a client_credentials token (with no refresh token) and checks that the client is still active. This is the server side of the Genesis (.NET) v4.2.3 change in the September 27 notes.

• No more repeat activation emails — Revoking access, reinstating a user, or activating a social-login account used to send the user a new activation email, which looked like being invited again. Activation emails now go out only when a user is created.

• Security fixes — If an OIDC redirect_uri doesn't match a registered client, IAM now shows its own login error page instead of redirecting to the supplied URL. The user-exists check (users/exists) now takes the email in a POST body instead of the query string. A GET on email/available returns 405. This keeps email addresses out of URLs and logs. If you call users/exists directly, switch to POST.

OS

• Guided custom domains — Previously, adding a custom domain didn't tell you which DNS records to create or which API address to use afterwards. Setup now lists the exact records: a CNAME for a subdomain, or an A record with the target's IP for a root domain. It then shows verification, server configuration, and certificate issuance as they happen. Setup keeps running if you close the tab, and only one setup can run per domain at a time. The domains table shows each domain's API base URL. The connect step's Test now link opens your domain's IAM Swagger page, which loads only when the domain, its certificate, and the gateway route all work.

• Archived and purged secrets — Secrets now have an Archived view with its own count. An archived secret stops working until you Restore it, or you can Purge it to delete it permanently, including from Azure Key Vault.

• Connect with Blocks OS — An external site, such as a CMS, can send you to Blocks OS to connect it to a project. You sign in and pick a project and environment, or create a project on the spot, then approve the connection. The page waits until the environment is ready. If you have to sign in partway through, the request picks up where it left off. Connections are managed under Integrations (previously Connect).

• Links survive sign-in — If you open a portal link while signed out, you're taken back to that page after signing in.

• Project limit — You can own up to 10 projects. The server now enforces this limit, not only the console. A project's environments (dev, stg, prod) count once, and projects shared with you don't count. Adding an environment to an existing project is never blocked.

Data

• Enum fields — Schemas get an Enum property type. You list the allowed values in the schema editor: up to 100, each 1–100 characters of letters, numbers, and underscores, not starting with a number, and no duplicates. Each Enum field becomes its own GraphQL enum type, so a value outside the list is rejected and clients can discover the allowed values from the schema. Enum fields can be filtered with eq, neq, in, and nin.

• No more blank Data Gateway screen — Data Gateway could open to an empty main area when the project configuration loaded before the session. It now waits and shows a loading or error state instead.

Workflow

• Reliable branching — When an If node splits items, only the branches that actually received items continue. A node that joins several branches now waits until every parent has either finished or can no longer run, so it runs once with all its inputs instead of early or twice.

• Correct webhook responses — A webhook-triggered workflow now responds with the result of the last node that actually ran, following only the branches that received items. Previously it could pick a node on a branch that never ran.

• Steadier parallel runs — When parallel nodes finish, each completion and the nodes it starts are recorded as one step, so a run can't skip a node or run one twice.

• Execution history — The executions list and execution view were reworked, and the Transform Code node guide now has sections and worked examples.

Utilities

• Per-person plans — A plan can now be sold to each person in an organization, not only to the organization as a whole. The organization buys places, and an administrator assigns each place to one person. Each place has its own allowance (for example, 100,000 AI tokens per month), and only the person holding it can use it. Overage is calculated place by place. When a person uses something, their place pays first, and anything it doesn't cover falls back to the organization's plan, so an organization can have both kinds of plan at once. A place keeps its usage when it's reassigned. People can see their own subscription with GET /subscriptions/mine. A service calling with client credentials can name the user whose place should be charged. See the per-person plans guide in the Subscription API documentation.

• Flexible rate limits — A rate limit on a meter (for example, "at most 1,000 an hour") can now span several windows and be measured as a rolling window, and one meter can have several limits at once. The plan builder names the window each limit applies to, and warns you when a limit can never be reached because the plan's included amount is lower.

• Better invoices — Invoices list discounts as their own lines, show a customer number and the masked card, and follow the standard financial-document layout. Financial-document PDFs are stored with organization-level access. Adyen subscription checkout now always saves the card.

• PDF signature validation — A new asynchronous API checks the digital signatures of PDFs already in Blocks storage using the European Commission's DSS library. Send file ids to POST /pdf-signature-validations (202 Accepted), then read results with POST /pdf-signature-validations/status. You get a verdict per file and per signature, including the PAdES level reached. Trust comes from the EU List of Trusted Lists plus any extra trust anchors you configure. Only the revocation data embedded in the document is used. Files are never modified. A completion notification can be sent for each file.

• Templates with nested data — The template engine now renders nested JSON objects and lists in template data.

Studio

• A better model picker — The chat model picker is a fixed-height popover with Blocks provided and Your models tabs, search by model or provider, and grouping by provider. It now lists every chat model in the catalogue. Embedding models are left out because they can't chat.

• Requests go to the right place — Studio now decides by what you mean, not by keywords, whether a message describes a new requirement (which becomes a feature) or asks for a build.

• Fixes — Features can be edited again. Telegram file paths resolve correctly. The PRD document structure has been reworked.

Extension

The UILM Assistant browser extension (v1.2.0) can now create keys and publish from the side panel:

• Add new keys — Create a localization key and its translations directly from the page you're working on.

• Publish changes — Publish your localization changes from the side panel instead of switching to the portal.

• Smoother sign-in — Fixed tokens expiring too early and the screen flickering during the Blocks sign-in flow, plus smaller UI fixes.

Blocks Cloud is now Blocks OS. This release re-architects the platform around a unified operating console where every service runs on its own dedicated domain, migrates all applications to the new genesis-os frontend foundation on React 19, and ships a wave of new capabilities across Identity, Storage, Payments, and Workflow. It is the largest platform update since the 3.x line and the starting point for everything that follows.

Blocks OS Platform

The platform rename is more than branding — it reflects a re-architecture into independent, individually addressable services behind one console.

• A unified OS console — All services are now reached through a single shell at os.seliseblocks.com, with consolidated sidebar navigation and a service switcher that filters available applications by environment.

• A domain per service — Each capability now has its own dedicated subdomain instead of sharing one Cloud origin. Identity, Data, Workflow, Deployment, Observability, Localization, Utilities, Studio, and AI each run and scale on their own host.

• Identity & Access, in the console — User and Organization management has moved out of the standalone IAM frontend and now lives natively inside the OS console under Identity & Access, unifying administration with the rest of the platform.

• Environment data migration — A new migration engine moves each project's data into the per-environment architecture. Migrations are authorized, OTP-verified, and emit completion events so dependent services can react when a project finishes moving.

Identity

Identity gains a major set of authentication and access-management capabilities alongside the console move.

• Device Authorization flow (OAuth 2.0 / RFC 8628) — Blocks OS now supports the OAuth 2.0 Device Authorization Grant, enabling sign-in on input-constrained and headless clients (CLIs, terminals, TV apps) using a short user code.

• Social identity linking at signup — Users can link a social identity provider to their account during signup, streamlining onboarding across providers.

• User activation flow — A dedicated activation experience captures first and last name on the activation form, and administrators can resend activation to users who remain inactive.

• OIDC client management — Client secrets can now be rotated for OIDC clients, identity providers can be deleted, and credential saving supports an external discovery endpoint.

• Permission management overhaul — Dependent-permission selection is clearer and easier to reason about, built-in permissions are surfaced as read-only, permissions carry a severity, and permission groups can be created directly from the UI.

• Stronger session control — Logging out can now revoke multiple active sessions at once.

Storage & Data

Storage is now a full document management system, and the data layer gains query and metadata improvements.

• Document Management System (DMS) — A new content platform with fine-grained access control: content-access administration backed by an audit trail, file version history, move and zero-copy copy, cached folder ancestry with a cycle-guarded rebuild, and access-resolved children listing with cursor pagination. An effective-policy resolver evaluates access-control entries per request.

• Richer GraphQL queries — Queries now support logical AND / OR operators for more expressive filtering.

• Better resource metadata & docs — Permissions and resources carry names and descriptions, and the Data service ships published API documentation.

Workflow

• Rename workflows — Workflows can be renamed in place, and the workflow editor gains improved state management and input-panel handling.

Payments

Utilities introduces a complete Stripe-based payments experience.

• Stripe payments — Hosted checkout, saved cards (save and remove), and refunds are now supported end to end. Payments record the authenticated user, and the platform reuses a shopper's existing Stripe customer at checkout.

• Multiple providers — Payment providers can be registered and configured through the API and administered from dedicated provider pages, with provider credentials stored encrypted on the provider document and incoming events verified through Stripe webhook validation.

Localization

• genesis-os client — The Localization application has migrated to React 19 on the genesis-os foundation, and a new extension guide page documents the localization extension workflow.

Observability

• Driver updates & API exploration — The observability driver was updated across services, and Swagger is enabled for exploring the monitoring API.

Developer SDKs

The SDK line moved to v4.0 in lockstep with the platform, unified under the genesis-os name.

• genesis-os (React) v4.0 — @seliseblocks/blocks-kit is renamed to @seliseblocks/genesis-os@4.0.0 and now requires React 19.2.8 and react-router 8. It is the shared app-shell and component foundation consumed by every service application (IAM, OS, Data, Logic, Monitor, Release, Studio, Utilities, Localization), with an environment-aware app switcher. A React 19 / react-router 8 migration guide is published. (Breaking change.)

• Blocks Genesis (.NET) v4.0 — The .NET bootstrap SDK bumped to v4.0 alongside, adding formal versioning and analysis rulesets and picking up security updates.

• genesis-py v0.3.1 — The Python Genesis SDK received a maintenance update.

warning Legacy CLI notice The @seliseblocks/cli package referenced below in Construct Cli has been retired and removed from npm. Use @seliseblocks/cli-os instead — see the bootstrap guide to get started. This page is kept as-is for historical reference.

Release notes

This release enhances Blocks Cloud with improvements across AI, Selise AI, Data Gateway, and project management. Key highlights include a more flexible knowledge base structure, the introduction of reasoning agents, richer note-taking and file interaction capabilities in Selise AI, and improved ownership controls at the project level. Together, these updates improve usability, flexibility, and control across the platform.

AI

Knowledge Base Folders

The Knowledge Base is now available as a dedicated section within the AI module, at the same level as Agents. Previously, knowledge bases were tightly coupled with individual agents and had to be configured within the agent setup.

With this update:

• Knowledge bases can now be organized into folders

• Each folder can be assigned to one or multiple agents

• Agents can consume multiple knowledge base folders simultaneously

• Each folder supports its own:

  • Embedding model

  • Chunking strategy

This separation improves reusability, modularity, and management of knowledge resources across different agents and use cases.

Reasoning Agents

A new Reasoning Agent mode has been introduced for handling complex, multi-step tasks.

Reasoning agents:

• Break down user queries into multiple steps

• Evaluate the output of each step before proceeding

• Iteratively refine responses until a final result is achieved

This mode is ideal for complex workflows, decision-making tasks, and multi-step problem solving, though it may consume more AI credits due to its iterative nature.

Selise AI

Notes

Selise AI now includes a Notes feature within its GPT-style interface, enabling users to create, manage, and interact with structured content directly inside the platform.

Key capabilities include:

• Create and manage notes with Markdown support

• Switch between edit and read modes

• Search across existing notes

• Use undo/redo for editing

• Enhance content using AI-assisted improvements

• Interact with an agent to discuss or refine notes

• Export notes in multiple formats:

  • .txt

  • .md

  • .pdf

This feature transforms Selise AI into a powerful workspace for both content creation and AI-assisted knowledge management.

File Upload

Selise AI now supports file uploads, enabling users to interact with documents directly within the chat interface.

Users can:

• Upload files and reference them in conversations

• Ask questions based on file content

• Use AI to analyze, summarize, or extract information

This brings Selise AI closer to a full-featured, ChatGPT-like experience with enhanced context handling.

Data Gateway

Data Visualization

Data Gateway now provides enhanced data visualization capabilities, allowing users to easily view, filter, and interact with schema data directly within the platform.

Viewing Data

Users can visualize data by navigating to a schema and switching to the Data tab. Data can be viewed in multiple formats:

• Table View — Structured tabular format with per-cell copy support

• JSON View — Raw JSON representation of the data

• Data Details View — Expanded view showing complete record-level information

Each data entry includes quick copy options for improved usability.

Filtering & Sorting

The data view supports flexible filtering and sorting options:

• Filter by Condition

  • Apply one or more conditions

  • Combine conditions using AND / OR logic

• Filter by Column

  • Select specific columns to display

• Sorting

  • Sort data by any field in ascending or descending order

These capabilities allow users to efficiently explore and analyze data without leaving the platform.

Project Settings

Ownership Transfer

Blocks Cloud now supports project ownership transfer, allowing the current owner to assign ownership to another user.

Once ownership is transferred, the new owner gains full administrative control, including the ability to:

• Add or remove users from the project

• Manage user access across environments

• Create and manage environments

• Update the project name

This feature ensures continuity, simplifies team transitions, and improves project governance.

Construct Cli

The Construct CLI has been updated with the following improvements:

• Added environment-based prefixes to VITE_X_BLOCKS_KEY and VITE_PROJECT_SLUG for better configuration management

• Refactored CLI setup instructions for improved clarity

• Removed unnecessary .github folder from generated projects

• Updated the Construct repository reference

To use the latest version:

npm install -g @seliseblocks/cli-os@latest

See the bootstrap guide for full setup instructions. The legacy @seliseblocks/cli package is retired and no longer published.

Bug Fixes

• Fixed issue where creating roles returned a 403 error for non-project owners

• Resolved issues with Gemini and Sonnet models in Selise AI chat

• Fixed Data Gateway pod reload issues