@fugood/bricks-cli 2.26.0-beta.2 → 2.26.0-beta.20

package/README.md

@@ -217,14 +217,21 @@ bricks app bind <app-id> [-b device-ids] [-u device-ids]
 bricks app bind <app-id> [-b device-ids] [-u device-ids] [--dry-run] [-j|--json]
 
 # Trigger automation
-bricks app trigger <app-id> <test-id> [--play|--stop] [--setup-at-launch]
+bricks app trigger <app-id> <test-id> [--play|--stop] [--setup-at-launch] [-g match-group]
+
+# Application Control pages (Runtime Editor, Canvas Control, Device Control):
+# issue a page token and print the URL of each page (needs an OAuth login: `bricks auth login`);
+# --no-token prints the sign-in URLs only and works with any login
+bricks app control-page <app-id> -t <short-edit,canvas-control,device-control,device-control-create-only> [--token-name name] [--expires-in days] [-e KEY=VALUE] [--no-token] [--dry-run] [-j|--json]
+# The printed URL is <controller>/<page>.html?workspace_secret=…&application_id=…; set BRICKS_CONTROLLER_URL to override the controller origin.
 
 # Preview a release without publishing
 bricks app release <app-id> -c <config-path-or-json> [-n name] [--version version] [--changelogs text] [--dry-run] [-j|--json]
 
 # Diagnose a config: schema validation + semantic lint rules
 # (data-update-race, redundant-rect-overlay, off-grid-frame, out-of-bounds-frame,
-#  wait-async-no-op, missing-result-param, unused-data-node, z-order-cover)
+#  wait-async-no-op, missing-result-param, unused-data-node, z-order-cover,
+#  expression-global-variable, mapping-outside-items)
 # Accepts a local file path or a remote application id.
 bricks app doctor <app-id-or-path> [-c|--composed] [--strict] [--only codes] [--ignore codes] [-j|--json]
 ```
@@ -278,6 +285,32 @@ bricks group refresh <group-id> [--dry-run] [-j|--json]
 bricks group monitor <group-id> [-i interval-seconds]
 ```
 
+### Blueprints
+
+A Blueprint is a workspace-level map of a site: its applications, modules, devices, Data Bank
+properties and Media Flow boxes as nodes, with role cards and the edges between them. The CLI
+reads Blueprints; edit them in CTOR. These commands need the `query_blueprint` token permission.
+
+```bash
+# List blueprints (name, node count, revision, Orchestrator run state)
+bricks blueprint list [-k keyword] [-j|--json]
+
+# Resolve a blueprint name or ID
+bricks blueprint resolve <query> [-l limit] [-j|--json]
+
+# Get blueprint details (overview, counts, run state, referenced entities with no node)
+bricks blueprint get <blueprint-id> [-j|--json]
+
+# Nodes with authored edges and edges derived from the workspace (bindings, used modules, ...)
+bricks blueprint graph <blueprint-id> [-j|--json]
+
+# Nodes grouped by kind; removed or moved entities are flagged as missing
+bricks blueprint members <blueprint-id> [-j|--json]
+
+# Print the projection text that the Blueprint Orchestrator gets as its context
+bricks blueprint projection <blueprint-id>
+```
+
 ### Media Flow
 
 Media Flow commands require:
@@ -345,6 +378,9 @@ Notes:
 - When no `-v/--value-file` is given, `set` keeps the current value (useful to change only tags or the definition).
 - `-v` parses the input as JSON and falls back to a plain string (`-v '{"a":1}'` → object, `-v hello` → string).
 - Revoking the auto-provisioned `manager` / `used-by-device` keys rotates them instead of deleting them.
+- Space key values come back masked (last 4 characters) unless the login may read them: the
+  workspace owner, a role with `update-workspace`, or a token with the `manage_devtools` scope.
+  A key the login creates is always returned in full, and a masked key revokes by its full value.
 - The Data Bank endpoint is derived from the configured BRICKS endpoint
   (prod → `bank.bricks.tools`, beta → `bank-beta.bricks.tools`, dev → `localhost:8080`).
 - Environment overrides for CI / custom setups: `BRICKS_BANK_SPACENAME` + `BRICKS_BANK_SPACEKEY`
@@ -353,6 +389,16 @@ Notes:
   it in the buttress `state.json`, so that server's local functions can use `context.bank`
   (`--revoke` removes it; re-running rotates the key).
 
+### Buttress binding and device authentication
+
+`bricks buttress bind` pairs the server with the current workspace **and automatically
+provisions a workspace-scoped DevTools token** in its permission-restricted `state.json`.
+After restarting Buttress, agents with `local_devices = true` use it for matching-workspace
+devices without passing credentials through model arguments. Normal bind/status output
+hides the token; `--print` emits the complete secret state for remote provisioning.
+Rebind and restart to renew an expired token (default lifetime: 30 days). Rebinding does
+not revoke older tokens. Automatic device authentication assumes a trusted LAN.
+
 ### Interactive Mode
 
 ```bash