aac-cli 0.1.2__tar.gz → 0.1.3__tar.gz

{aac_cli-0.1.2 → aac_cli-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.1.2
+Version: 0.1.3
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
@@ -99,14 +99,14 @@ aac sso login --profile dev            # thereafter: plain login
 # Tenant ids are the server-allocated canonical tnt-<uuid> form
 # (B154 PR 5) — captured at registration / shown by `aac profile show`.
 aac tenant list                                # which tenant ids exist (no 409 probe)
-aac tenant describe --tenant-id tnt-<uuid>     # workloads + key METADATA
+aac tenant describe --profile dev              # assigned domain, workloads + key METADATA
 aac tenant update --tenant-id tnt-<uuid> --display-name "ACME Manufacturing Inc"
 
 # B121/B228 — business-domain control proof and bounded claim lifecycle.
 # Registration can capture up to 16 pending rows with repeatable --tenant-domain.
 # The issue/verify/release/revoke commands
 # require the owning tenant's tenant-admin session and default --tenant-id from
-# the profile; the established tenant describe command keeps its explicit id.
+# the profile; tenant describe also uses the selected profile by default.
 aac tenant register --display-name "ACME" --contact ops@acme.example \
     --tenant-domain acme.example
 aac tenant issue-domain-challenge --domain acme.example
@@ -117,7 +117,7 @@ aac tenant verify-domain --domain acme.example
 # never performs an implicit binding write.
 aac tenant bind-trust-domain --trust-domain acme.example
 aac tenant list-trust-domains --output table
-aac tenant describe --tenant-id tnt-<uuid> --output table  # status + TXT
+aac tenant describe --profile dev --output table  # assigned binding status + TXT
 aac tenant release-domain --domain acme.example --reason "planned transfer"
 aac tenant revoke-domain --domain acme.example --reason "DNS control incident"
 
@@ -279,9 +279,9 @@ aac sso login --flow pkce --no-browser        # print the URL, don't launch
 # any admin verb tells you to re-run `aac sso login` — there is no
 # refresh token to steal, and no silent re-authentication.
 
-# B155 — session niceties (cache-file operations; the CLI never
-# parses the token itself). whoami exits 0 = live, 3 = expired/none (§14).
-aac sso whoami --tenant-id tnt-550e8400-e29b-41d4-a716-446655440000
+# B155/B239 — local session/profile inspection; no server call or JWT parsing.
+# whoami exits 0 = unexpired cache, 3 = expired/none (§14).
+aac sso whoami --profile dev --output table   # cached session + saved assigned domain
 aac sso logout --tenant-id tnt-550e8400-e29b-41d4-a716-446655440000
 ```
 
@@ -495,8 +495,9 @@ coexistence, Eng Spec §XVII.9):
   expiry fails fast locally with the re-login message instead of
   dialing out; the server's own session 401s carry the same
   remediation (the server stays authoritative). `aac sso logout`
-  removes the file; `aac sso whoami` reports its tenant + expiry
-  (B155 — both operate on the cache file only).
+  removes the file; `aac sso whoami` reports its tenant + expiry and, when
+  available, the matching profile's saved AAC-assigned domain. Both commands
+  operate locally; `whoami` does not verify current server-side binding status.
 
 ## Your tenant_id
 
@@ -547,3 +548,39 @@ ceremony-only, and existing binding history remains B181.
 needed. Against a live stack: bring up the joined topology
 (`./bin/run-wedge-a-control-plane-compose.sh --keep-up`) and point the
 flags at localhost.
+
+## Assigned tenant domains (B239)
+
+Registration automatically saves the server-assigned `hosted_trust_domain` in
+the selected profile. The CLI displays the full name, explains its purpose in
+SPIFFE identities/certificates/trust configuration, and prints the command for
+finding it again. No manual copy is required. With JSON output, this guidance
+goes to stderr and stdout remains one JSON document; table output includes it
+inline. Completed-registration recovery provides the same saved-name guidance
+without changing credential-reissue requirements.
+
+```sh
+aac profile show dev --output table                         # saved locally, offline
+aac tenant describe --profile dev --output table            # assigned name + current binding status
+aac tenant list-trust-domains --profile dev --output table   # current ACTIVE bindings
+aac tenant list-trust-domains --profile dev --all --output table  # includes revoked history
+aac sso whoami --profile dev --output table                  # cached session + matching saved name
+```
+
+`tenant describe` accepts an optional `--tenant-id`; the usual flag → environment
+→ selected profile precedence applies. Its response comes from AAC. Binding
+table output labels AAC-assigned/custom origin, ACTIVE/REVOKED status and
+inherited scope. Registration, describe, profile show and binding-list JSON
+fields retain their existing shapes. `whoami` adds optional
+`hosted_trust_domain` and `hosted_trust_domain_source: "profile:<name>"` fields
+when that profile's saved tenant matches the inspected session. These fields
+describe locally saved metadata, not current binding eligibility. Tenant
+overrides never display another tenant's saved domain; session exit codes and
+offline operation are unchanged. Profile show says "not saved in this profile"
+when metadata is absent, without asserting that AAC has no allocation.
+
+Existing tenant admins use `aac tenant assign-hosted-domain --profile dev`;
+explicit eligible restoration uses `aac tenant reactivate-hosted-domain --profile dev`.
+Neither command registers another tenant or asks for a DNS name.
+See [the hosted-domain guide](../../docs/b239-hosted-trust-domains.md) for
+custom-domain progression, recovery compatibility and lifecycle limits.

{aac_cli-0.1.2 → aac_cli-0.1.3}/README.md

@@ -83,14 +83,14 @@ aac sso login --profile dev            # thereafter: plain login
 # Tenant ids are the server-allocated canonical tnt-<uuid> form
 # (B154 PR 5) — captured at registration / shown by `aac profile show`.
 aac tenant list                                # which tenant ids exist (no 409 probe)
-aac tenant describe --tenant-id tnt-<uuid>     # workloads + key METADATA
+aac tenant describe --profile dev              # assigned domain, workloads + key METADATA
 aac tenant update --tenant-id tnt-<uuid> --display-name "ACME Manufacturing Inc"
 
 # B121/B228 — business-domain control proof and bounded claim lifecycle.
 # Registration can capture up to 16 pending rows with repeatable --tenant-domain.
 # The issue/verify/release/revoke commands
 # require the owning tenant's tenant-admin session and default --tenant-id from
-# the profile; the established tenant describe command keeps its explicit id.
+# the profile; tenant describe also uses the selected profile by default.
 aac tenant register --display-name "ACME" --contact ops@acme.example \
     --tenant-domain acme.example
 aac tenant issue-domain-challenge --domain acme.example
@@ -101,7 +101,7 @@ aac tenant verify-domain --domain acme.example
 # never performs an implicit binding write.
 aac tenant bind-trust-domain --trust-domain acme.example
 aac tenant list-trust-domains --output table
-aac tenant describe --tenant-id tnt-<uuid> --output table  # status + TXT
+aac tenant describe --profile dev --output table  # assigned binding status + TXT
 aac tenant release-domain --domain acme.example --reason "planned transfer"
 aac tenant revoke-domain --domain acme.example --reason "DNS control incident"
 
@@ -263,9 +263,9 @@ aac sso login --flow pkce --no-browser        # print the URL, don't launch
 # any admin verb tells you to re-run `aac sso login` — there is no
 # refresh token to steal, and no silent re-authentication.
 
-# B155 — session niceties (cache-file operations; the CLI never
-# parses the token itself). whoami exits 0 = live, 3 = expired/none (§14).
-aac sso whoami --tenant-id tnt-550e8400-e29b-41d4-a716-446655440000
+# B155/B239 — local session/profile inspection; no server call or JWT parsing.
+# whoami exits 0 = unexpired cache, 3 = expired/none (§14).
+aac sso whoami --profile dev --output table   # cached session + saved assigned domain
 aac sso logout --tenant-id tnt-550e8400-e29b-41d4-a716-446655440000
 ```
 
@@ -479,8 +479,9 @@ coexistence, Eng Spec §XVII.9):
   expiry fails fast locally with the re-login message instead of
   dialing out; the server's own session 401s carry the same
   remediation (the server stays authoritative). `aac sso logout`
-  removes the file; `aac sso whoami` reports its tenant + expiry
-  (B155 — both operate on the cache file only).
+  removes the file; `aac sso whoami` reports its tenant + expiry and, when
+  available, the matching profile's saved AAC-assigned domain. Both commands
+  operate locally; `whoami` does not verify current server-side binding status.
 
 ## Your tenant_id
 
@@ -531,3 +532,39 @@ ceremony-only, and existing binding history remains B181.
 needed. Against a live stack: bring up the joined topology
 (`./bin/run-wedge-a-control-plane-compose.sh --keep-up`) and point the
 flags at localhost.
+
+## Assigned tenant domains (B239)
+
+Registration automatically saves the server-assigned `hosted_trust_domain` in
+the selected profile. The CLI displays the full name, explains its purpose in
+SPIFFE identities/certificates/trust configuration, and prints the command for
+finding it again. No manual copy is required. With JSON output, this guidance
+goes to stderr and stdout remains one JSON document; table output includes it
+inline. Completed-registration recovery provides the same saved-name guidance
+without changing credential-reissue requirements.
+
+```sh
+aac profile show dev --output table                         # saved locally, offline
+aac tenant describe --profile dev --output table            # assigned name + current binding status
+aac tenant list-trust-domains --profile dev --output table   # current ACTIVE bindings
+aac tenant list-trust-domains --profile dev --all --output table  # includes revoked history
+aac sso whoami --profile dev --output table                  # cached session + matching saved name
+```
+
+`tenant describe` accepts an optional `--tenant-id`; the usual flag → environment
+→ selected profile precedence applies. Its response comes from AAC. Binding
+table output labels AAC-assigned/custom origin, ACTIVE/REVOKED status and
+inherited scope. Registration, describe, profile show and binding-list JSON
+fields retain their existing shapes. `whoami` adds optional
+`hosted_trust_domain` and `hosted_trust_domain_source: "profile:<name>"` fields
+when that profile's saved tenant matches the inspected session. These fields
+describe locally saved metadata, not current binding eligibility. Tenant
+overrides never display another tenant's saved domain; session exit codes and
+offline operation are unchanged. Profile show says "not saved in this profile"
+when metadata is absent, without asserting that AAC has no allocation.
+
+Existing tenant admins use `aac tenant assign-hosted-domain --profile dev`;
+explicit eligible restoration uses `aac tenant reactivate-hosted-domain --profile dev`.
+Neither command registers another tenant or asks for a DNS name.
+See [the hosted-domain guide](../../docs/b239-hosted-trust-domains.md) for
+custom-domain progression, recovery compatibility and lifecycle limits.

{aac_cli-0.1.2 → aac_cli-0.1.3}/aac_cli/__init__.py

@@ -10,4 +10,4 @@ entrypoint (`aac_cli.cli:entrypoint`).
 # test in bin/tests/test_cli_version_parity.py. A literal keeps the
 # shipped code free of import-time metadata lookups (and their
 # not-installed failure mode).
-__version__ = "0.1.2"
+__version__ = "0.1.3"

{aac_cli-0.1.2 → aac_cli-0.1.3}/aac_cli/cli.py

@@ -107,6 +107,7 @@ from aac_cli.config import (
     resolve_config,
     select_profile,
     session_credentials_path,
+    validate_hosted_trust_domain,
     write_api_key,
     write_profile,
     write_session_credential,
@@ -619,6 +620,45 @@ def _cmd_tenant_register(args: argparse.Namespace) -> int:
         return _cmd_tenant_register_locked(args, selection.name)
 
 
+def _print_hosted_domain_guidance(domain: str, profile: str, *, output: str) -> None:
+    """Keep registration JSON on stdout; explain the saved name to humans."""
+    stream = sys.stdout if output == "table" else sys.stderr
+    print(
+        f"\nAAC-assigned trust domain:\n{domain}\n\n"
+        f"Saved automatically in profile [{profile}].\n"
+        "Use this domain in your agents' SPIFFE workload identities,\n"
+        "certificates, and trust configuration. No tenant DNS setup is required.\n"
+        "You can continue using it when you add a custom domain later.\n\n"
+        "View your saved domain:\n"
+        f"  aac profile show {shlex.quote(profile)} --output table",
+        file=stream,
+    )
+
+
+def _hosted_domain_from_payload(payload: object, tenant_id: str) -> str | None:
+    if payload is None:
+        return None
+    if not isinstance(payload, dict) or not isinstance(payload.get("trust_domain"), str):
+        raise CliConfigError("server returned invalid hosted-domain metadata")
+    binding = payload.get("binding")
+    if (
+        not isinstance(binding, dict)
+        or binding.get("scope_tenant_id") != tenant_id
+        or binding.get("trust_domain") != payload["trust_domain"]
+        or binding.get("status") not in ("ACTIVE", "REVOKED")
+        or type(binding.get("binding_version")) is not int
+        or binding["binding_version"] < 1
+        or not isinstance(binding.get("binding_id"), str)
+    ):
+        raise CliConfigError("server returned a hosted binding for a different tenant")
+    try:
+        if str(uuid.UUID(binding["binding_id"])) != binding["binding_id"]:
+            raise ValueError("noncanonical binding id")
+    except ValueError as exc:
+        raise CliConfigError("server returned invalid hosted binding metadata") from exc
+    return validate_hosted_trust_domain(tenant_id, payload["trust_domain"])
+
+
 def _cmd_tenant_register_locked(args: argparse.Namespace, profile: str) -> int:
     config = _resolve(args)
     normalized_admin_url = normalize_admin_url(config.admin_url)
@@ -887,7 +927,10 @@ def _cmd_tenant_register_locked(args: argparse.Namespace, profile: str) -> int:
             )
             return 3
         try:
-            profile_path = bind_profile_for_registration(profile, returned_tenant_id)
+            recovered_domain = response.headers.get("X-AAC-Hosted-Trust-Domain")
+            profile_path = bind_profile_for_registration(
+                profile, returned_tenant_id, hosted_trust_domain=recovered_domain
+            )
         except (CliConfigError, OSError) as exc:
             state = _mark_registration_unknown(state)
             print(
@@ -896,6 +939,9 @@ def _cmd_tenant_register_locked(args: argparse.Namespace, profile: str) -> int:
                 file=sys.stderr,
             )
             return 3
+        if recovered_domain is not None:
+            payload["hosted_trust_domain"] = recovered_domain
+            _print_hosted_domain_guidance(recovered_domain, profile, output=args.output)
         try:
             read_api_key(returned_tenant_id)
         except CliConfigError:
@@ -968,7 +1014,13 @@ def _cmd_tenant_register_locked(args: argparse.Namespace, profile: str) -> int:
             file=sys.stderr,
         )
     try:
-        profile_path = bind_profile_for_registration(profile, returned_tenant_id)
+        profile_path = bind_profile_for_registration(
+            profile,
+            returned_tenant_id,
+            hosted_trust_domain=_hosted_domain_from_payload(
+                payload.get("hosted_trust_domain"), returned_tenant_id
+            ),
+        )
     except (CliConfigError, OSError) as exc:
         state = _mark_registration_unknown(state)
         print(
@@ -1002,6 +1054,8 @@ def _cmd_tenant_register_locked(args: argparse.Namespace, profile: str) -> int:
     }
     if stored_at is None:
         result["api_key"] = api_key
+    if payload.get("hosted_trust_domain") is not None:
+        result["hosted_trust_domain"] = payload["hosted_trust_domain"]["trust_domain"]
     if args.output == "table":
         print(f"tenant_id : {returned_tenant_id}")
         print(f"key_id    : {key_id}")
@@ -1030,6 +1084,10 @@ def _cmd_tenant_register_locked(args: argparse.Namespace, profile: str) -> int:
             )
     else:
         print(json.dumps(result, indent=2))
+    if payload.get("hosted_trust_domain") is not None:
+        _print_hosted_domain_guidance(
+            payload["hosted_trust_domain"]["trust_domain"], profile, output=args.output
+        )
     if stored_at is not None:
         _print_api_key_verification_guidance(
             tenant_id=returned_tenant_id,
@@ -1050,6 +1108,16 @@ def _render_tenant_status_table(body: dict) -> None:
         value = body.get(field)
         print(f"{field:<18}: {value if value is not None else '-'}")
     api_key = body.get("api_key") or {}
+    hosted = body.get("hosted_trust_domain")
+    if isinstance(hosted, dict):
+        print(f"AAC-assigned trust domain: {hosted.get('trust_domain', '-')}")
+        binding = hosted.get("binding") or {}
+        print(f"hosted binding status   : {binding.get('status', '-')}")
+        print(f"hosted binding version  : {binding.get('binding_version', '-')}")
+        if hosted.get("platform_hold"):
+            print("hosted platform hold    : yes")
+    elif "hosted_trust_domain" in body:
+        print("AAC-assigned trust domain: not assigned")
     print(f"{'api_key.key_id':<18}: {api_key.get('key_id', '-')} (metadata only)")
     workloads = body.get("workloads") or []
     print(f"{'workloads':<18}: {len(workloads)}")
@@ -1230,10 +1298,17 @@ def _cmd_tenant_revoke_domain(args: argparse.Namespace) -> int:
 
 
 def _cmd_tenant_describe(args: argparse.Namespace) -> int:
-    _require_canonical_tenant_id_arg(args.tenant_id)
+    tenant_id = _resolve(args).tenant_id
+    if tenant_id is None:
+        print(
+            "select a profile bound to the tenant, or provide --tenant-id",
+            file=sys.stderr,
+        )
+        return 3
+    _require_canonical_tenant_id_arg(tenant_id)
     # URL-encode the path segment (B130 review M1 lesson): a stray
     # '#'/'?' must not truncate the path or inject a query.
-    code, body = _admin_json(args, "GET", f"/v1/tenants/{quote(args.tenant_id, safe='')}")
+    code, body = _admin_json(args, "GET", f"/v1/tenants/{quote(tenant_id, safe='')}")
     if body is None:
         return code
     if args.output == "table":
@@ -2217,11 +2292,72 @@ def _print_binding_row(payload: dict) -> None:
     print(f"scope_tenant_id : {payload['scope_tenant_id']}")
     admission = payload.get("admission")
     if isinstance(admission, dict):
+        method = admission.get("admission_method")
+        if method == "aac_assigned":
+            print("domain origin   : AAC-assigned")
+        elif method in ("pre_b182", "operator_ceremony", "dns_txt_exact", "auth_unconfigured"):
+            print("domain origin   : Custom")
+        else:
+            print("domain origin   : not reported")
         print(f"admission       : {admission.get('admission_method', '-')}")
         if admission.get("evidence_domain"):
             print(f"evidence_domain : {admission['evidence_domain']}")
 
 
+def _cmd_tenant_hosted_domain(args: argparse.Namespace) -> int:
+    profile = select_profile(args.profile).name
+    with profile_registration_lock(profile):
+        config = _resolve(args)
+        tenant_id = config.tenant_id
+        if tenant_id is None:
+            print(
+                "select a profile bound to the existing tenant, or provide --tenant-id",
+                file=sys.stderr,
+            )
+            return 3
+        headers = _binding_headers(args, config)
+        if isinstance(headers, int):
+            return headers
+        suffix = "/reactivation" if args.hosted_reactivate else ""
+        try:
+            response = httpx.post(
+                f"{config.admin_url}/v1/tenants/{tenant_id}/hosted-trust-domain{suffix}",
+                json={},
+                headers=headers,
+                timeout=_REQUEST_TIMEOUT_SECONDS,
+            )
+        except httpx.HTTPError as exc:
+            print(f"hosted-domain request failed: {type(exc).__name__}", file=sys.stderr)
+            return 4
+        if response.status_code not in (200, 201):
+            _print_envelope_with_login_remediation(response, tenant_id)
+            return 1
+        try:
+            payload = response.json()
+            domain = _hosted_domain_from_payload(payload, tenant_id)
+            if domain is None:
+                raise CliConfigError("server returned no hosted domain")
+            if read_profile_section(profile).get("tenant_id") == tenant_id:
+                bind_profile_for_registration(profile, tenant_id, hosted_trust_domain=domain)
+            else:
+                print(
+                    "hosted domain returned; selected profile is not bound to this tenant, so its binding was preserved",
+                    file=sys.stderr,
+                )
+        except (ValueError, CliConfigError, OSError):
+            print(
+                "the operation returned success but its metadata could not be saved; inspect the selected profile and safely retry the same command",
+                file=sys.stderr,
+            )
+            return 3
+        if args.output == "table":
+            print(f"hosted_domain   : {domain}")
+            _print_binding_row(payload["binding"])
+        else:
+            print(json.dumps(payload, indent=2))
+        return 0
+
+
 def _cmd_tenant_bind_trust_domain(args: argparse.Namespace) -> int:
     """Create (or idempotently re-affirm) a trust-domain binding
     anchored at this tenant. A session caller needs current exact-name
@@ -2338,7 +2474,10 @@ def _cmd_tenant_list_trust_domains(args: argparse.Namespace) -> int:
     for item in bindings:
         _print_binding_row(item)
         if item.get("inherited"):
+            print("scope           : inherited from ancestor tenant")
             print("inherited       : true")
+        else:
+            print("scope           : anchored at this tenant")
         if item.get("revoked_at"):
             print(f"revoked_at      : {item['revoked_at']}")
             print(f"reason          : {item.get('revocation_reason') or ''}")
@@ -3847,9 +3986,11 @@ def _cmd_sso_replace_idp(args: argparse.Namespace) -> int:
 
 
 def _cmd_sso_whoami(args: argparse.Namespace) -> int:
-    """B155 (B142 rider): print the cached session's identity facts —
-    FROM THE CACHE FILE ONLY (B141 Decision 2: the CLI never parses the
-    JWT; the guard stays authoritative when clocks disagree)."""
+    """B155 session facts plus optional B239 domain context, all local.
+
+    The CLI reads the session cache and matching profile, never the JWT or
+    a server. The server stays authoritative for session and binding status.
+    """
     config = _resolve(args)
     tenant_id = config.tenant_id
     if not tenant_id:
@@ -3880,26 +4021,40 @@ def _cmd_sso_whoami(args: argparse.Namespace) -> int:
     expires_at_display = time.strftime(
         "%Y-%m-%d %H:%M:%S %Z", time.localtime(credential.expires_at_unix_seconds)
     )
+    profile = select_profile(args.profile).name
+    stored = read_profile_section(profile)
+    # Flags/environment may select a different tenant from the saved profile.
+    # Cached domain context must belong to the inspected session's tenant.
+    hosted_domain = (
+        stored.get("hosted_trust_domain")
+        if stored.get("tenant_id") == credential.tenant_id == tenant_id
+        else None
+    )
+    payload = {
+        "tenant_id": credential.tenant_id,
+        "audience": credential.audience,
+        "expires_at_unix_seconds": credential.expires_at_unix_seconds,
+        "expired": expired,
+        "path": str(session_credentials_path(tenant_id)),
+    }
+    if hosted_domain is not None:
+        payload["hosted_trust_domain"] = hosted_domain
+        payload["hosted_trust_domain_source"] = f"profile:{profile}"
     if args.output == "table":
         print(f"tenant_id  : {credential.tenant_id}")
         print(f"audience   : {credential.audience}")
         print(f"expires_at : {expires_at_display}{' (EXPIRED)' if expired else ''}")
         print(f"session    : {session_credentials_path(tenant_id)}")
+        if hosted_domain is not None:
+            print(f"AAC-assigned trust domain (saved in profile [{profile}]):\n{hosted_domain}")
+            print(
+                "Use `aac tenant list-trust-domains` with the same profile and endpoint "
+                "for current server-side bindings and status."
+            )
         if expired:
             print("\nSession expired — run `aac sso login` again.")
     else:
-        print(
-            json.dumps(
-                {
-                    "tenant_id": credential.tenant_id,
-                    "audience": credential.audience,
-                    "expires_at_unix_seconds": credential.expires_at_unix_seconds,
-                    "expired": expired,
-                    "path": str(session_credentials_path(tenant_id)),
-                },
-                indent=2,
-            )
-        )
+        print(json.dumps(payload, indent=2))
     return 3 if expired else 0  # review M5: local state → 3, not 1 (§14)
 
 
@@ -4378,10 +4533,10 @@ def build_parser() -> argparse.ArgumentParser:
     _add_common_flags(tenant_describe)
     tenant_describe.add_argument(
         "--tenant-id",
-        required=True,
+        default=None,
         help=(
-            "The tenant to describe (canonical federation identifier, "
-            "e.g. tnt-550e8400-e29b-41d4-a716-446655440000)."
+            "The tenant to describe (defaults to the selected profile/environment identity; "
+            "an explicit canonical tenant ID overrides it)."
         ),
     )
     tenant_describe.set_defaults(handler=_cmd_tenant_describe)
@@ -4765,6 +4920,26 @@ def build_parser() -> argparse.ArgumentParser:
     )
     deactivate_workload.set_defaults(handler=_cmd_tenant_deactivate_workload)
 
+    for verb, reactivation in (("assign-hosted-domain", False), ("reactivate-hosted-domain", True)):
+        hosted = tenant_verbs.add_parser(
+            verb,
+            help=(
+                "Reactivate the existing assigned binding without changing tenant identity."
+                if reactivation
+                else "Assign a hosted domain to an existing tenant; repeated calls reuse it."
+            ),
+        )
+        _add_common_flags(hosted)
+        hosted.add_argument(
+            "--tenant-id", default=None, help="Tenant (defaults to the selected profile)."
+        )
+        hosted.add_argument(
+            "--bootstrap-token",
+            default=None,
+            help="Explicit platform ceremony; otherwise use the tenant-admin session.",
+        )
+        hosted.set_defaults(handler=_cmd_tenant_hosted_domain, hosted_reactivate=reactivation)
+
     bind_domain = tenant_verbs.add_parser(
         "bind-trust-domain",
         help="Bind a SPIFFE trust domain using current exact-name evidence or ceremony.",
@@ -5306,12 +5481,13 @@ def build_parser() -> argparse.ArgumentParser:
 
     whoami = sso_verbs.add_parser(
         "whoami",
-        help="Show the cached AAC session's tenant + expiry (B155).",
+        help="Show cached session identity/expiry and the profile's saved AAC-assigned domain.",
         description=(
-            "Reads the session CACHE FILE only — the CLI never parses "
+            "Reads local session/profile files only — the CLI never parses "
             "the token itself (the server stays authoritative). Exit 0 "
-            "= a live session; exit 3 = expired or none (local cache "
-            "state, Spec §14)."
+            "= an unexpired cached session; exit 3 = expired or none (local cache "
+            "state, Spec §14). The assigned domain, when present, comes from the matching "
+            "local profile; use tenant list-trust-domains for current server-side bindings."
         ),
     )
     _add_common_flags(whoami)

{aac_cli-0.1.2 → aac_cli-0.1.3}/aac_cli/config.py

@@ -100,6 +100,7 @@ __all__ = [
     "write_api_key",
     "write_profile",
     "write_session_credential",
+    "validate_hosted_trust_domain",
 ]
 
 _DEFAULT_ADMIN_URL = "http://127.0.0.1:8000"
@@ -449,6 +450,28 @@ def _enforce_guardrails(parser: configparser.ConfigParser, config_path: Path) ->
                     f"`aac tenant register` or `aac sso login` "
                     f"(Spec §5.4, §8.6)"
                 )
+            if key == "hosted_trust_domain":
+                validate_hosted_trust_domain(parser[section].get("tenant_id"), value)
+
+
+def validate_hosted_trust_domain(tenant_id: str | None, value: str) -> str:
+    """Validate system-managed metadata without importing the control plane."""
+    if (
+        tenant_id is None
+        or CANONICAL_TENANT_ID_PATTERN.fullmatch(tenant_id) is None
+        or not isinstance(value, str)
+        or len(value) > 255
+        or not value.startswith(tenant_id + ".tenants.")
+        or any(
+            re.fullmatch(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?", label) is None
+            for label in value.split(".")
+        )
+    ):
+        raise CliConfigError(
+            "hosted_trust_domain must be canonical metadata for the bound tenant; "
+            "remove an invalid local value and retrieve the allocation through the authenticated tenant commands"
+        )
+    return value
 
 
 def _load_validated_config_unlocked() -> configparser.ConfigParser:
@@ -634,7 +657,9 @@ def write_profile(profile: str, settings: dict[str, str]) -> Path:
         return _write_profile_locked(profile, settings)
 
 
-def bind_profile_for_registration(profile: str, tenant_id: str) -> Path:
+def bind_profile_for_registration(
+    profile: str, tenant_id: str, *, hosted_trust_domain: str | None = None
+) -> Path:
     """Bind a registration result without overwriting a concurrent binding.
 
     Registration is fail-closed while verified login is last-wins. The selected
@@ -650,7 +675,18 @@ def bind_profile_for_registration(profile: str, tenant_id: str) -> Path:
                 f"profile [{profile}] became bound to another tenant while "
                 "registration was in progress; refusing to replace that binding"
             )
-        return _write_profile_locked(profile, {"tenant_id": tenant_id})
+        settings = {"tenant_id": tenant_id}
+        if hosted_trust_domain is not None:
+            validate_hosted_trust_domain(tenant_id, hosted_trust_domain)
+            existing_domain = (
+                parser[profile].get("hosted_trust_domain") if parser.has_section(profile) else None
+            )
+            if existing_domain is not None and existing_domain != hosted_trust_domain:
+                raise CliConfigError(
+                    "the returned hosted domain differs from the stored permanent allocation; refusing to overwrite it"
+                )
+            settings["hosted_trust_domain"] = hosted_trust_domain
+        return _write_profile_locked(profile, settings)
 
 
 def _write_profile_locked(profile: str, settings: dict[str, str]) -> Path:
@@ -675,6 +711,11 @@ def _write_profile_locked(profile: str, settings: dict[str, str]) -> Path:
                 f"profiles besides the reserved [main]) (Spec §5.2)"
             )
         parser.add_section(profile)
+    prior_tenant_id = parser[profile].get("tenant_id")
+    if "tenant_id" in settings and settings["tenant_id"] != prior_tenant_id:
+        # Verified login may intentionally rebind a profile; metadata of the
+        # previous tenant must not follow that new association.
+        parser[profile].pop("hosted_trust_domain", None)
     for key, value in settings.items():
         if len(key) > MAX_KEY_CHARS:
             raise CliConfigError(
@@ -706,6 +747,8 @@ def _write_profile_locked(profile: str, settings: dict[str, str]) -> Path:
             f"canonical tnt-<lowercase UUIDv4> form (value not shown) — "
             f"tenant ids are server-allocated since B154 PR 5 (Spec §5.4)"
         )
+    if "hosted_trust_domain" in parser[profile]:
+        validate_hosted_trust_domain(result_tenant_id, parser[profile]["hosted_trust_domain"])
     _write_parser_atomically(parser, config_path)
     return config_path