aac-cli 0.2.10__tar.gz → 0.2.11__tar.gz

{aac_cli-0.2.10/aac_cli.egg-info → aac_cli-0.2.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.2.10
+Version: 0.2.11
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
@@ -46,8 +46,8 @@ The `aac` command is how a tenant's operator does everything that is not
 done by the sidecar itself: register the tenant, sign in, manage keys,
 workloads and domains, and prepare a runnable local workload. Everything
 works from a terminal or a script; there is no web console to click
-through. Output is JSON by default, and every command that reports a
-result also offers `--output table`.
+through. Output is JSON by default. Commands that support table output offer
+`--output table`; `aac sso describe` returns JSON only.
 
 Two kinds of tenant use the same tool:
 
@@ -857,8 +857,16 @@ aac sso logout --profile stage
 A developer tenant signs in with `--idp github` or `--idp google`; if you
 need another sign-in provider, contact support@cascadeauth.com. An
 enterprise tenant signs in through its Microsoft Entra ID connection, named
-by the connection's exact URL with `--idp-url`; when several connections
-are registered, the error message lists the exact commands to choose one.
+by the connection's exact URL with `--idp-url`. With neither flag, the
+tenant's own connections take precedence over the shared developer sign-ins;
+when several remain, a terminal shows a numbered list to choose from and then
+prints the flag that skips the prompt next time, while a script (no terminal)
+gets exit 3 and one copy-ready command per connection. The list marks which
+connection the cached session was last obtained through; it never shows
+which connections have members. A developer tenant admits only the provider
+and account it was registered with: when the AAC STS does not accept a shared
+sign-in, the CLI reminds you of that rule and lists any other shared sign-ins. GitHub connections accept the device flow
+only: `--flow pkce` with a GitHub connection stops locally with exit 3.
 
 Sessions last **4 hours by default**. Your administrator may configure a
 different lifetime for the deployment or connection. You can run
@@ -868,12 +876,20 @@ with the four-hour default, signing in at 09:00 gives an expiry of 13:00;
 signing in successfully again at 12:00 gives the new session an expiry of 16:00.
 Use `aac sso whoami --profile NAME --output table` to check the current
 expiration. If the session expires, sign in again; no refresh token is issued.
+A command that needs a session stops locally with exit 3 when none is cached,
+before anything is sent, and prints the `aac sso login` command for the same
+profile and endpoints; commands that also accept a bootstrap token name that
+alternative.
 
 Sign-in uses the device flow by default, so the browser can be on another
-machine and headless hosts work. Google connections use a loopback flow
-instead, because Google's device flow is scope-restricted; `--flow`
-overrides the choice. `whoami` and `logout` work offline and never contact
-AAC.
+machine and headless hosts work. On a terminal with a browser at hand
+(macOS, a desktop session, or `BROWSER` set), the device flow also offers to
+open the sign-in page for you: press Enter to open it in your browser, or copy
+the printed link and code into a browser yourself; `--no-browser` turns the
+offer off, and a script (no terminal) or a headless host never sees it. Google
+connections use a loopback flow instead, because Google's device flow is
+scope-restricted; `--flow` overrides the choice. `whoami` and `logout` work
+offline and never contact AAC.
 
 ## Output and exit codes
 
@@ -921,6 +937,17 @@ a callback gives up after 300 seconds with exit `3`. HTTP timeouts remain exit
 If AAC asks you to slow down, the command shows the interval to wait. The
 CLI never replays a change on its own; wait and rerun deliberately.
 
+The commands that can present a ceremony token (`aac tenant register`,
+`reissue-api-key`, `assign-hosted-domain`, `reactivate-hosted-domain`,
+`bind-trust-domain`, `list-trust-domains`, `revoke-trust-domain`,
+`rotate-admin-key`, `aac sso register-idp`, `enroll-idp-recovery-key` and
+`approve-idp-repair`) and `aac sso login` report a failure by HTTP status and
+AAC error code only, never the server's message or response body, because
+either can echo the credential the request carried; their transport failures
+show the error class and the operating system's reason, not the library's
+text. Other commands still print the server's message with the status and
+code.
+
 ## Enterprise tenants
 
 Enterprise tenants are registered through an onboarding ceremony: AAC

{aac_cli-0.2.10 → aac_cli-0.2.11}/README.md

@@ -19,8 +19,8 @@ The `aac` command is how a tenant's operator does everything that is not
 done by the sidecar itself: register the tenant, sign in, manage keys,
 workloads and domains, and prepare a runnable local workload. Everything
 works from a terminal or a script; there is no web console to click
-through. Output is JSON by default, and every command that reports a
-result also offers `--output table`.
+through. Output is JSON by default. Commands that support table output offer
+`--output table`; `aac sso describe` returns JSON only.
 
 Two kinds of tenant use the same tool:
 
@@ -830,8 +830,16 @@ aac sso logout --profile stage
 A developer tenant signs in with `--idp github` or `--idp google`; if you
 need another sign-in provider, contact support@cascadeauth.com. An
 enterprise tenant signs in through its Microsoft Entra ID connection, named
-by the connection's exact URL with `--idp-url`; when several connections
-are registered, the error message lists the exact commands to choose one.
+by the connection's exact URL with `--idp-url`. With neither flag, the
+tenant's own connections take precedence over the shared developer sign-ins;
+when several remain, a terminal shows a numbered list to choose from and then
+prints the flag that skips the prompt next time, while a script (no terminal)
+gets exit 3 and one copy-ready command per connection. The list marks which
+connection the cached session was last obtained through; it never shows
+which connections have members. A developer tenant admits only the provider
+and account it was registered with: when the AAC STS does not accept a shared
+sign-in, the CLI reminds you of that rule and lists any other shared sign-ins. GitHub connections accept the device flow
+only: `--flow pkce` with a GitHub connection stops locally with exit 3.
 
 Sessions last **4 hours by default**. Your administrator may configure a
 different lifetime for the deployment or connection. You can run
@@ -841,12 +849,20 @@ with the four-hour default, signing in at 09:00 gives an expiry of 13:00;
 signing in successfully again at 12:00 gives the new session an expiry of 16:00.
 Use `aac sso whoami --profile NAME --output table` to check the current
 expiration. If the session expires, sign in again; no refresh token is issued.
+A command that needs a session stops locally with exit 3 when none is cached,
+before anything is sent, and prints the `aac sso login` command for the same
+profile and endpoints; commands that also accept a bootstrap token name that
+alternative.
 
 Sign-in uses the device flow by default, so the browser can be on another
-machine and headless hosts work. Google connections use a loopback flow
-instead, because Google's device flow is scope-restricted; `--flow`
-overrides the choice. `whoami` and `logout` work offline and never contact
-AAC.
+machine and headless hosts work. On a terminal with a browser at hand
+(macOS, a desktop session, or `BROWSER` set), the device flow also offers to
+open the sign-in page for you: press Enter to open it in your browser, or copy
+the printed link and code into a browser yourself; `--no-browser` turns the
+offer off, and a script (no terminal) or a headless host never sees it. Google
+connections use a loopback flow instead, because Google's device flow is
+scope-restricted; `--flow` overrides the choice. `whoami` and `logout` work
+offline and never contact AAC.
 
 ## Output and exit codes
 
@@ -894,6 +910,17 @@ a callback gives up after 300 seconds with exit `3`. HTTP timeouts remain exit
 If AAC asks you to slow down, the command shows the interval to wait. The
 CLI never replays a change on its own; wait and rerun deliberately.
 
+The commands that can present a ceremony token (`aac tenant register`,
+`reissue-api-key`, `assign-hosted-domain`, `reactivate-hosted-domain`,
+`bind-trust-domain`, `list-trust-domains`, `revoke-trust-domain`,
+`rotate-admin-key`, `aac sso register-idp`, `enroll-idp-recovery-key` and
+`approve-idp-repair`) and `aac sso login` report a failure by HTTP status and
+AAC error code only, never the server's message or response body, because
+either can echo the credential the request carried; their transport failures
+show the error class and the operating system's reason, not the library's
+text. Other commands still print the server's message with the status and
+code.
+
 ## Enterprise tenants
 
 Enterprise tenants are registered through an onboarding ceremony: AAC

{aac_cli-0.2.10 → aac_cli-0.2.11}/aac_cli/__init__.py

@@ -10,4 +10,4 @@ entrypoint (`aac_cli.cli:entrypoint`).
 # test in bin/tests/test_cli_version_parity.py. A literal keeps the
 # shipped code free of import-time metadata lookups (and their
 # not-installed failure mode).
-__version__ = "0.2.10"
+__version__ = "0.2.11"

{aac_cli-0.2.10 → aac_cli-0.2.11}/aac_cli/admin_key_pem.py

@@ -223,6 +223,9 @@ def require_ed25519_public_key_pem(text: str) -> str:
     try:
         der = base64.b64decode(encoded, validate=True)
     except (binascii.Error, ValueError) as exc:
+        # The decoder's text names the fault ("Incorrect padding", a bad
+        # character's position) and never quotes the data, which is what keeps
+        # AdminKeyPemError on the CLI-composed list of the diagnostic contract.
         raise AdminKeyPemError(f"PEM body is not valid base64: {exc}") from exc
 
     if len(der) != _ED25519_SPKI_LENGTH or not der.startswith(_ED25519_SPKI_PREFIX):

{aac_cli-0.2.10 → aac_cli-0.2.11}/aac_cli/api_key_rotation_state.py

@@ -16,6 +16,7 @@ from aac_cli.config import (
     cli_home,
     credentials_path,
 )
+from aac_cli.safe_output import failure_class
 
 __all__ = [
     "ROTATION_STATE_WARNING",
@@ -97,7 +98,9 @@ def read_rotation_state(profile: str) -> RotationIssueState | None:
     except FileNotFoundError:
         return None
     except OSError as exc:
-        raise CliConfigError(f"cannot read API-key rotation state {path}: {exc}") from exc
+        raise CliConfigError(
+            f"cannot read API-key rotation state {path}: {failure_class(exc)}"
+        ) from exc
     if len(raw) > _MAX_STATE_BYTES:
         raise CliConfigError(f"API-key rotation state {path} exceeds {_MAX_STATE_BYTES} bytes")
     try: