thingsboard-cli 4.3.1.2__tar.gz

thingsboard_cli-4.3.1.2/.gitattributes

@@ -0,0 +1,5 @@
+# Preserve byte-for-byte fidelity of the vendored extension starter snapshot.
+# scripts/sync-extension-starter.sh produces a mirror of an upstream git
+# checkout; line-ending normalization would diverge it from upstream and
+# break Windows-only files like mvnw.cmd.
+extension-starter/** -text

thingsboard_cli-4.3.1.2/.github/workflows/ci.yml

@@ -0,0 +1,126 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --frozen
+      - run: uv run ruff check
+      - run: uv run ruff format --check
+      - name: Verify scaffold manifest hash is up to date
+        run: python scripts/update_scaffold_hash.py --check
+      - name: Verify resources manifest hash is up to date
+        run: python scripts/update_resources_manifest.py --check
+
+  type-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --frozen
+      - run: uv run mypy src/
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: uv sync --frozen
+      - run: uv run pytest --cov --ignore=tests/e2e
+
+  test-e2e:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --frozen
+      - run: uv run pytest tests/e2e -v --tb=short -m requires_tb
+        env:
+          TB_URL: ${{ secrets.TB_URL }}
+          TB_API_KEY: ${{ secrets.TB_API_KEY }}
+
+  extension-e2e-maven:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+      - name: Cache Maven repository (busts on starter snapshot change)
+        uses: actions/cache@v4
+        with:
+          path: ~/.m2/repository
+          key: maven-${{ runner.os }}-${{ hashFiles('extension-starter/**/pom.xml', 'src/thingsboard_cli/resources/maven_wrapper/.mvn/wrapper/maven-wrapper.properties') }}
+          restore-keys: maven-${{ runner.os }}-
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --frozen
+      - name: Run extension Maven E2E tests (plus pure-python)
+        shell: bash
+        run: uv run pytest tests/e2e/test_extension.py -v --tb=short -m "maven_e2e or not docker_e2e" 2>&1 | tee /tmp/extension-maven-e2e.log; exit ${PIPESTATUS[0]}
+      - name: Upload Maven E2E logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: extension-maven-e2e-logs
+          path: |
+            /tmp/extension-maven-e2e.log
+            /tmp/**/extension/extension/target/surefire-reports/
+          if-no-files-found: ignore
+
+  extension-e2e-docker:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: astral-sh/setup-uv@v6
+      - run: uv sync --frozen
+      - name: Cache Maven repository
+        uses: actions/cache@v4
+        with:
+          path: ~/.m2/repository
+          key: maven-${{ runner.os }}-${{ hashFiles('extension-starter/**/pom.xml', 'src/thingsboard_cli/resources/maven_wrapper/.mvn/wrapper/maven-wrapper.properties') }}
+          restore-keys: maven-${{ runner.os }}-
+      - name: Run extension Docker E2E tests
+        shell: bash
+        run: uv run pytest tests/e2e/test_extension.py -v --tb=short -m docker_e2e 2>&1 | tee /tmp/extension-docker-e2e.log; exit ${PIPESTATUS[0]}
+      - name: Capture docker compose logs on failure
+        if: failure()
+        shell: bash
+        run: |
+          find /tmp -maxdepth 4 -name "docker-compose.yml" -execdir docker compose logs --no-color \; > /tmp/docker-compose-logs.txt 2>&1 || true
+      - name: Upload Docker E2E logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: extension-docker-e2e-logs
+          path: |
+            /tmp/extension-docker-e2e.log
+            /tmp/docker-compose-logs.txt
+          if-no-files-found: ignore
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv build

thingsboard_cli-4.3.1.2/.gitignore

@@ -0,0 +1,16 @@
+.idea
+*.iml
+.planning
+docs/superpowers
+/.claude
+__pycache__/
+*.py[cod]
+*.egg-info/
+dist/
+build/
+.venv/
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.coverage
+htmlcov/

thingsboard_cli-4.3.1.2/CHANGELOG.md

@@ -0,0 +1,171 @@
+# Changelog
+
+All notable changes to ThingsBoard CLI are documented in this file.
+
+## [Unreleased] — Pre-v1 Release Audit Fixes
+
+This release closes all 71 findings from the Pre-v1 release audit
+(`docs/audit/2026-04-29-cli-release-audit.md`). The audit document has been
+annotated with a `Status:` line per finding pointing at the closing commit.
+
+### Security
+
+- **Redact sensitive values in `--debug` output.** A new redactor walks the
+  request/response payload printed by the debug logger and masks values for
+  keys matching a denylist (`password`, `accessToken`, `refreshToken`,
+  `apiKey`, `Authorization`, etc.). Pasting `--debug` output into a Slack
+  thread or bug report no longer leaks live credentials. (CC-01)
+- **Hide credential prompts.** The interactive `tb config` wizard's API-key
+  prompt now uses `hide_input=True`, matching the password prompt. (P0-08)
+- **Compact connectivity-error formatting.** Failed `tb config` connectivity
+  tests no longer dump the upstream HTML body or HTTP header dictionary.
+  Errors collapse to `HTTP <status> <reason>` for `ApiException`, or a
+  truncated `str(exc)` for everything else. (P0-15)
+
+### Correctness — broken commands now work
+
+- **`tb role list`, `tb entity-group list`, `tb telemetry get --limit`** were
+  broken with a Pydantic-strict `Input should be a valid string` error
+  because the SDK declares pagination params as `str` but the CLI passed
+  `int`. New `coerce_page_kwargs` helper introspects the SDK signature and
+  casts where needed. (P0-01, P0-02, P0-03)
+- **`tb telemetry keys`, `tb calculated-field save`, `tb alarm-rule save`**
+  failed because camelCase JSON dicts were passed straight into Pydantic
+  models that only declared a `serialization_alias`. New `dict_to_model`
+  helper routes save payloads through the SDK's `from_dict()` classmethod,
+  which translates camelCase→snake_case and dispatches discriminated
+  unions correctly. Also covers the `save-permission` and `share` payloads.
+  (P0-04, P0-06, P0-07, CC-06)
+- **`tb telemetry get -f json`** silently dropped the `ts` timestamp on every
+  datapoint. Output now preserves `{"ts": ..., "value": ...}` per key.
+  (P0-05)
+- **`tb push <unknown-solution>`** silently fell back to pushing root
+  entities. It now exits non-zero and lists available solutions. Same for
+  `tb validate`. (P0-09)
+- **`tb device list`** showed `Active: -` and a duplicated `Type`/`Profile`
+  column. The list now calls `get_all_device_infos` so `Active` populates,
+  and the `Type` column is removed (`device.type` IS the profile name in
+  TB 4.3+). (P0-10, P0-11)
+- **`tb device credentials`** showed `Credentials Value: -` for ACCESS_TOKEN
+  credentials. Output is now type-aware: tokens render under an `Access
+  Token:` label. (P0-13)
+- **`tb relation find-from`/`find-to`** had blank `To`/`To Type`/`To Name`
+  columns due to wrong accessors. Fixed to read `.var_from`, `.to`,
+  `.from_name`, `.to_name`. (P0-14)
+- **`tb asset list`/`get`** dropped the duplicated `Type` column. (P0-12)
+- **`tb alarm-rule list`/`get`** read `.entity_id.entity_type` instead of
+  the non-existent `.entity_type` field. (P1-06, P1-09)
+
+### New commands
+
+- **`tb alarm save | ack | clear | assign | unassign`** — full alarm
+  lifecycle. (P2-09)
+- **`tb attributes get | list | delete`** — read and remove attributes per
+  scope. (P1-10)
+- **`tb dashboard assign-customer | unassign-customer | add-to-group |
+  remove-from-group`** — wrap the entity-group membership API used by
+  TB 4.3+ for dashboard assignment. (P2-10)
+- **`tb rule-chain export <id> [--output PATH]`** — dump a rule chain plus
+  metadata as JSON. (P2-14)
+- **`tb solution list | delete`** — discover and remove solutions inside a
+  project. (P2-29)
+- **`tb telemetry delete <ENTITY_TYPE> <ENTITY_ID> --keys ...`** — delete
+  timeseries by key with optional time range. (P2-15)
+
+### UX & polish
+
+- **Standardize `--type` flag.** `--types` and `--type-list` now exist as
+  deprecated aliases on `tb alarm list` and `tb calculated-field list`;
+  using either prints a deprecation warning to stderr. (P1-12)
+- **Standardize `--format` flag.** `--format` is now a Choice over
+  `{table, json}` enforced by Typer; `--help` enumerates the values; invalid
+  values exit non-zero before the network. (CC-03, P2-27)
+- **Standardize `--sort-order` flag.** Now a Choice over `{ASC, DESC}`,
+  validated client-side. (CC-09)
+- **Friendlier validation errors for `--json`.** Invalid inline JSON shows
+  `Invalid JSON in --json: <msg> (line N, column N)` without the bare
+  `JSONDecodeError:` prefix. Path-like inputs that don't exist show
+  `JSON file '<path>' not found`. (P2-02, P2-05, P2-18)
+- **Tighter delete UX.** `tb <entity> delete <not-a-uuid>` now exits non-zero
+  with a hint pointing at `tb <entity> get '<value>' -f json | jq -r '.id.id'`
+  before any confirmation prompt. Applied to `device`, `asset`, `customer`.
+  (P1-02)
+- **`--name-conflict-policy` validation.** Invalid values are rejected with
+  the allowed list before the SDK is called. (P1-01)
+- **`-H` falls back to `--help` for non-API commands.** `tb config show -H`,
+  `tb init -H`, `tb push -H` now print the regular `--help` instead of
+  exiting silently. (P2-19)
+- **Empty results render as "No results found"** instead of a blank table
+  with `Page 1 of 0`. (CC-04)
+- **Past-last-page warning.** Requesting a page beyond the last now prints
+  a yellow warning above the footer. (P2-01)
+- **ISO-8601 timestamps with epoch.** `Created` rows show
+  `2026-04-29T14:30:45.123Z (1714403445123)` — human-readable plus
+  grep-able. Applied across device/asset/customer/user/profile detail
+  views. (P1-03)
+- **Bare enum rendering.** SDK enum values render as `ACCESS_TOKEN`, not
+  `DeviceCredentialsType.ACCESS_TOKEN`. (CC-02)
+- **Conditional "entity files" hint.** Pydantic ValidationError no longer
+  appends a misleading "Check that entity files have required fields" hint
+  to errors that came from CLI args, only file-loaded entities. (CC-05)
+- **`tb config show` Mode row.** When run inside a project, `tb config show`
+  appends `Mode: local|remote`. (P2-21)
+- **`tb config remove` cleanup.** Removing the current default profile
+  clears or auto-picks `default_profile`; removing a nonexistent profile
+  lists available profiles. (P1-14, P2-20)
+- **Better default `.gitignore`.** `tb init` writes a richer default
+  including `__pycache__/`, `*.pyc`, `.venv/`, `.DS_Store`, `solution.json`,
+  `*.local.*`. (P2-22)
+- **`init` success polish.** Path uses `Path.relative_to`; output lists
+  `tasks/` and the gitignore status. (P2-16, P2-23)
+- **`push` always emits per-entity-type counts.** `created`/`updated`/
+  `unchanged` lines on idempotent re-pushes, on `--all`, and with
+  `--skip-validate`. (P2-24, P2-25, P2-26)
+- **`tb user save` UX.** `--authority` Choice flag (default `TENANT_ADMIN`),
+  email shown in the success line, and the
+  `--send-activation-mail/--no-send-activation-mail` flag was renamed to
+  `--activation-mail/--no-activation-mail` to fit the help table.
+  (P1-04, P1-05, P2-03)
+- **`tb dashboard list` Customers column.** Renamed from `Assigned`,
+  populated with assigned customer titles when present. (P2-07)
+- **`tb dashboard get` description fixed.** `-H` no longer claims it
+  excludes configuration JSON. (P2-06)
+- **`tb device-profile list` / `tb asset-profile list` column parity.**
+  Aligned to `ID | Name | Type | Default`. (P2-04)
+- **`tb entity-group list` zero-args usability.** `OWNER_TYPE` defaults
+  to `TENANT`, `OWNER_ID` defaults to the current tenant via
+  `client.get_user()`, `GROUP_TYPE` becomes a `--type` flag. (P1-13)
+- **`tb entity-group save` --type pre-validation.** Missing `--type` is
+  rejected client-side before tb-pe-client validation. (P2-13)
+- **`tb customer get <title>` resolution by title.** Added title-based
+  lookup alongside UUID. (CC-07)
+- **`tb alarm-rule debug` empty response.** Now prints "No debug events
+  available" instead of an empty string. (P1-07)
+- **Help generator `r"""` docstrings.** Generated SDK model docstrings
+  with backslash sequences (`List\<String\>`) no longer trigger
+  `SyntaxWarning` on import. (CC-08)
+
+### Internals
+
+- **`TB_CONFIG_HOME` env var override.** `ConfigManager` honors
+  `TB_CONFIG_HOME` to redirect the config root, unblocking isolated E2E
+  config tests. (P1-17)
+- **Consolidated `_get_client(ctx)`.** Moved 16 duplicate function bodies
+  into a single `core.client.get_client_from_ctx`. (P1-18)
+- **Cleaned up `hasattr` patterns** across every per-group list/detail
+  render. (P2-28)
+
+### Test coverage
+
+- 732 unit tests pass (up from a pre-audit baseline) with 87% code
+  coverage on changed paths.
+- Every modified command ships with new or extended unit tests AND E2E
+  tests in the same commit. E2E tests skip cleanly without
+  `TB_URL`/`TB_API_KEY`.
+
+---
+
+## Earlier releases
+
+See git history for releases prior to this audit-fix cycle (4.3.1.2 and
+earlier).

thingsboard_cli-4.3.1.2/CLAUDE.md

@@ -0,0 +1,118 @@
+## Project
+
+**ThingsBoard CLI**
+
+A Python CLI for managing ThingsBoard Professional Edition resources (devices, dashboards, widgets, integrations, …) from the terminal. Works against any ThingsBoard instance — self-hosted or ThingsBoard Cloud. The primary command is `thingsboard` with a `tb` shortcut alias.
+
+### Constraints
+
+- **Tech stack**: Python 3.11+, uv, Typer, tb-pe-client, Rich
+- **Auth**: handled by tb-pe-client (JWT login + refresh, API key, rate-limit retry)
+- **API target**: ThingsBoard PE REST API
+- **Compatibility**: macOS, Linux (Windows nice-to-have)
+
+## Repo Layout
+
+```
+src/thingsboard_cli/
+  main.py            # Typer app entrypoint (thingsboard, tb)
+  commands/          # one module per resource (device, dashboard, asset, …)
+  core/              # client wiring, output helpers, local-mode utilities
+  config/            # profile/config loading (YAML)
+  common/            # shared option types, formatters, validators
+  help/              # @api_docs decorator + generated help text
+  resources/         # static assets bundled with the package
+tests/               # unit tests (Typer CliRunner)
+tests/e2e/           # end-to-end against a real or mocked TB
+scripts/             # build/help-generation helpers
+```
+
+## Local mode & solutions
+
+The CLI has a "local mode" for IaC-style project management. A directory becomes a project when it contains `thingsboard.json`. `find_project_root()` walks up from cwd to locate it.
+
+A **solution** is a self-contained slice of entities living at `<project>/solutions/<name>/`. The same solution can be pushed to multiple targets (e.g. dev → test → prod); idempotency state lives on the server, never in committed task files.
+
+- `resolve_solution_dir(project_root, solution_name=None)` returns the right directory. With `solution_name=None`, it auto-detects from cwd; pass `--solution <name>` to target one explicitly.
+- **Don't `cd` into solution directories** — always use `--solution <name>`.
+
+## Technology Stack
+
+Versions live in `pyproject.toml` / `uv.lock` — this list is for orientation.
+
+### Runtime & tooling
+- **Python** (3.11+) — modern typing, `tomllib`, `ExceptionGroup`
+- **uv** — package manager, virtualenvs, Python version management
+- **ruff** — lint + format (rules: E, F, W, UP, B, SIM, RUF, I; line length 120)
+- **mypy** — strict type checking
+- **pytest** + **pytest-cov** + **pytest-mock** + **respx** — tests and HTTP mocking
+
+### CLI & output
+- **Typer** (on **Click**) — command routing, argument parsing
+- **Rich** — tables, panels, progress bars, syntax highlighting
+
+### Data & config
+- **Pydantic** — request/response models, validation
+- **pydantic-settings** — layered settings (defaults, env vars, files)
+- **PyYAML** — profile/config files
+
+### HTTP & API
+- **httpx** — HTTP client for ThingsBoard REST API
+- **tb-pe-client** — wraps httpx with auth, retries, token refresh
+
+## Conventions
+
+### `@api_docs` decorator
+
+Every CLI command function that maps to a tb-pe-client API method must have an `@api_docs()` decorator. This powers the `-H` verbose help flag.
+
+```python
+@device_app.command()
+@api_docs(method="save_device", model="Device")
+def create(...):
+    """Create a new device."""
+    handle_verbose_help(create, "device", verbose_help)
+    ...
+```
+
+Parameters:
+- `method` (str | list[str]): tb-pe-client API method name(s)
+- `model` (str, optional): primary model name for JSON schema display
+- `controller` (str, optional): controller name override (defaults to Typer group name)
+
+After adding new commands, regenerate help: `./scripts/generate-help.sh`
+
+Commands that don't map to API methods (config, init, push) don't need the decorator.
+
+### Testing — perfect coverage is mandatory
+
+Every code change MUST ship with thorough test coverage. This is non-negotiable.
+
+- **Both layers required**:
+  - **Unit tests** in `tests/` — cover every branch of helpers, command flags, error paths, edge cases. Use Typer's `CliRunner` for command tests and direct calls for helpers.
+  - **E2E tests** in `tests/e2e/` — cover the user-facing flow end to end against a real (or realistically mocked) ThingsBoard. Bug fixes also need an E2E case that would have caught the bug.
+- **Add before claiming done.** Run `uv run pytest --cov` and confirm new code is exercised before reporting completion.
+- **No coverage holes for new code.** If a branch is hard to test, redesign it — don't skip the test.
+
+### Code quality (CI enforced)
+
+GitHub Actions CI runs on every push to `master` and on PRs. All checks must pass:
+
+- **`uv run ruff check`** — lint
+- **`uv run ruff format --check`** — formatting (line length 120)
+- **`uv run mypy src/`** — strict type checking (excludes `help/_generated/`)
+- **`uv run pytest --cov`** — tests across Python 3.11, 3.12, 3.13
+
+Before committing, run `uv run ruff check --fix && uv run ruff format` to auto-fix lint and formatting.
+
+### Type annotations
+
+- `_get_client()` helper in command files returns `Any` (not `object`) — `tb_pe_client` is untyped
+- `error()` in `core/output.py` is typed `NoReturn` — mypy knows code after it is unreachable
+- `resolve_solution_dir()` accepts `Path | None` and exits if None
+- Bare `dict` and `list` without type params are allowed (mypy `disallow_any_generics = false`)
+- `tb_pe_client.*` is excluded from mypy import checks (`ignore_missing_imports = true`)
+
+### Versioning
+
+CLI version mirrors tb-pe-client and matches the ThingsBoard version exactly. CLI-only patches use PEP 440 `.postN`. LTS lines live on `release/X.Y` branches.

thingsboard_cli-4.3.1.2/PKG-INFO

@@ -0,0 +1,129 @@
+Metadata-Version: 2.4
+Name: thingsboard-cli
+Version: 4.3.1.2
+Summary: CLI tool for managing ThingsBoard resources
+Requires-Python: <3.15,>=3.11
+Requires-Dist: click<9.0,>=8.1
+Requires-Dist: filelock<4.0,>=3.13
+Requires-Dist: httpx<1.0,>=0.28
+Requires-Dist: packaging>=24.0
+Requires-Dist: pydantic-settings<3.0,>=2.13
+Requires-Dist: pydantic<3.0,>=2.12
+Requires-Dist: rich<15.0,>=14.0
+Requires-Dist: tb-pe-client==4.3.1.2
+Requires-Dist: textual<2.0,>=0.83
+Requires-Dist: typer<1.0,>=0.24.1
+Description-Content-Type: text/markdown
+
+# ThingsBoard CLI
+
+CLI tool for managing ThingsBoard resources from the terminal.
+
+## Installation
+
+Install [uv](https://docs.astral.sh/uv/) if you don't have it:
+
+```bash
+curl -LsSf https://astral.sh/uv/install.sh | sh
+```
+
+Then install the CLI:
+
+```bash
+uv tool install thingsboard-cli
+```
+
+### Upgrading
+
+The CLI checks for updates automatically on launch and prompts to upgrade. You can also upgrade manually:
+
+```bash
+tb update
+```
+
+### Local development
+
+Editable install — changes take effect immediately:
+
+```bash
+uv tool install -e .
+```
+
+> **Note:** `uv tool install` overwrites any previous installation. When switching between editable and published installs, uninstall first to avoid stale cache issues:
+> ```bash
+> uv tool uninstall thingsboard-cli
+> ```
+
+### Updating tb-pe-client
+
+The `tb-pe-client` dependency is pulled from PyPI and updated frequently. To pick up a new version:
+
+```bash
+uv lock --refresh-package tb-pe-client && uv sync
+```
+
+### Shell Completion
+
+```bash
+# Bash
+tb --install-completion bash
+
+# Zsh
+tb --install-completion zsh
+
+# Fish
+tb --install-completion fish
+```
+
+Restart your terminal after installing completion.
+
+## Usage
+
+```bash
+tb --help
+tb config set --url https://thingsboard.cloud --api-key YOUR_KEY
+tb device list
+```
+
+## Verbose Help
+
+Use `-H` or `--help-verbose` on any command to see detailed API documentation, JSON schemas, and field descriptions:
+
+```bash
+tb device create -H
+tb dashboard save -H
+```
+
+### Regenerating Help Text
+
+After updating `tb-pe-client`, regenerate the help text from the API docs:
+
+```bash
+./scripts/generate-help.sh
+```
+
+This reads the markdown docs from `../thingsboard-java-client/pe/docs/` and generates Python modules in `src/thingsboard_cli/help/_generated/`.
+
+## Publishing
+
+Requires [twine](https://twine.readthedocs.io/) for uploading and credentials configured in `~/.pypirc`:
+
+```bash
+uv tool install twine
+```
+
+```bash
+./scripts/release.sh --version 4.3.1.2.post1         # TestPyPI (default, staging)
+./scripts/release.sh --version 4.3.1.2 --prod        # PyPI (production)
+./scripts/release.sh --version 4.3.1.2 --dry-run     # Build only, no upload
+```
+
+> TestPyPI is the default on purpose — a misfire goes to staging, not to the real index. Add `--prod` only when you intend to publish a production release.
+
+The publish script automatically updates the scaffold content hash in `scaffold/manifest.json` before building. If you change scaffold files without publishing, update the hash manually:
+
+```bash
+uv run python scripts/update_scaffold_hash.py
+```
+
+CI enforces that the hash matches — if scaffold files change but `manifest.json` isn't updated, `test_scaffold_hash_matches_manifest` will fail.

thingsboard_cli-4.3.1.2/README.md

@@ -0,0 +1,112 @@
+# ThingsBoard CLI
+
+CLI tool for managing ThingsBoard resources from the terminal.
+
+## Installation
+
+Install [uv](https://docs.astral.sh/uv/) if you don't have it:
+
+```bash
+curl -LsSf https://astral.sh/uv/install.sh | sh
+```
+
+Then install the CLI:
+
+```bash
+uv tool install thingsboard-cli
+```
+
+### Upgrading
+
+The CLI checks for updates automatically on launch and prompts to upgrade. You can also upgrade manually:
+
+```bash
+tb update
+```
+
+### Local development
+
+Editable install — changes take effect immediately:
+
+```bash
+uv tool install -e .
+```
+
+> **Note:** `uv tool install` overwrites any previous installation. When switching between editable and published installs, uninstall first to avoid stale cache issues:
+> ```bash
+> uv tool uninstall thingsboard-cli
+> ```
+
+### Updating tb-pe-client
+
+The `tb-pe-client` dependency is pulled from PyPI and updated frequently. To pick up a new version:
+
+```bash
+uv lock --refresh-package tb-pe-client && uv sync
+```
+
+### Shell Completion
+
+```bash
+# Bash
+tb --install-completion bash
+
+# Zsh
+tb --install-completion zsh
+
+# Fish
+tb --install-completion fish
+```
+
+Restart your terminal after installing completion.
+
+## Usage
+
+```bash
+tb --help
+tb config set --url https://thingsboard.cloud --api-key YOUR_KEY
+tb device list
+```
+
+## Verbose Help
+
+Use `-H` or `--help-verbose` on any command to see detailed API documentation, JSON schemas, and field descriptions:
+
+```bash
+tb device create -H
+tb dashboard save -H
+```
+
+### Regenerating Help Text
+
+After updating `tb-pe-client`, regenerate the help text from the API docs:
+
+```bash
+./scripts/generate-help.sh
+```
+
+This reads the markdown docs from `../thingsboard-java-client/pe/docs/` and generates Python modules in `src/thingsboard_cli/help/_generated/`.
+
+## Publishing
+
+Requires [twine](https://twine.readthedocs.io/) for uploading and credentials configured in `~/.pypirc`:
+
+```bash
+uv tool install twine
+```
+
+```bash
+./scripts/release.sh --version 4.3.1.2.post1         # TestPyPI (default, staging)
+./scripts/release.sh --version 4.3.1.2 --prod        # PyPI (production)
+./scripts/release.sh --version 4.3.1.2 --dry-run     # Build only, no upload
+```
+
+> TestPyPI is the default on purpose — a misfire goes to staging, not to the real index. Add `--prod` only when you intend to publish a production release.
+
+The publish script automatically updates the scaffold content hash in `scaffold/manifest.json` before building. If you change scaffold files without publishing, update the hash manually:
+
+```bash
+uv run python scripts/update_scaffold_hash.py
+```
+
+CI enforces that the hash matches — if scaffold files change but `manifest.json` isn't updated, `test_scaffold_hash_matches_manifest` will fail.