aac-cli 0.2.8__tar.gz → 0.2.9__tar.gz

{aac_cli-0.2.8/aac_cli.egg-info → aac_cli-0.2.9}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.2.8
+Version: 0.2.9
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
-Project-URL: Documentation, https://cascadeauth.github.io/aac-starter-guide/cli/
+Project-URL: Documentation, https://docs.cascadeauth.com/cli/
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -34,12 +34,13 @@ which tenant they belong to and what they were authorised to do. A
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
-New to AAC? [What AAC is for](https://cascadeauth.github.io/aac-starter-guide/#what-aac-is-for)
+New to AAC? [What AAC is for](https://docs.cascadeauth.com/overview/#what-aac-is-for)
 explains what delegated authority between agents buys you, and what it does not.
 
-The [CLI user guide and complete command reference](https://cascadeauth.github.io/aac-starter-guide/cli/)
+The [CLI user guide and complete command reference](https://docs.cascadeauth.com/cli/)
 cover developer and enterprise onboarding, everyday administration and recovery.
-Select documentation matching `aac --version`.
+These pages describe the latest supported release. Upgrade the CLI to use the
+documented commands, and check your installation with `aac --version`.
 
 The `aac` command is how a tenant's operator does everything that is not
 done by the sidecar itself: register the tenant, sign in, manage keys,
@@ -77,7 +78,7 @@ Python 3.11 to 3.14 is supported. Release checks test all four versions.
 ## Use `aeg` to view agent execution graphs
 
 Installing or upgrading `aac-cli` supplies both `aac` and `aeg`.
-Use the [AEG guide and command reference](https://cascadeauth.github.io/aac-starter-guide/aeg.html)
+Use the [AEG guide and command reference](https://docs.cascadeauth.com/aeg/)
 for listing local and central observations, rendering evidence, and selecting a profile.
 
 `aeg list --profile PROFILE --since 7d` discovers participant-visible central
@@ -111,7 +112,7 @@ Google developer sign-in. See “Setting up aac-cli on a new computer” below
 for the existing-tenant sign-in and material preparation steps.
 
 Setup uses the tenant's assigned trust domain and writes the files the
-trust-anchor publisher and Docker Compose need, as well as the sidecar
+trust anchor publisher and Docker Compose need, as well as the sidecar
 configuration. By default it generates development keys and certificates;
 the certificate choices below explain how to supply your own instead.
 
@@ -341,7 +342,7 @@ and destination maps allow at most 128 entries each.
 | `destinations.<name>.audience_pattern` | Required exact registered SPIFFE identity; no wildcard. | None |
 | `destinations.<name>.predicates`, `.valid_for` | Same value/duration contract as classes. | Empty predicates; duration required |
 | `destinations.<name>.timeout_ms` | Integer 1–2147483647 without A2A; 1–60000 for every destination when A2A is enabled, matching its generated deadline. | `10000` |
-| `a2a.public_base_url`, `a2a.local_handler_url` | Optional A2A block; both required if present. Public URL is HTTPS with no path except optional `/`; the HTTP(S) local handler path must be exactly `/a2a/v1`, with no escaped spelling. Neither URL permits query or fragment markers, even empty ones. Managed A2A state paths and a 60-second deadline are generated. No A2A self-route is added. | A2A disabled |
+| `a2a.public_base_url`, `a2a.local_handler_url` | Optional A2A block; both required if present. Public URL is HTTPS with no path except optional `/`; the HTTP(S) local handler path must be exactly `/a2a/v1`, with no escaped spelling. Neither URL permits query or fragment markers, even empty ones. Managed A2A state paths, a 60-second deadline and retry-state capacity are generated; the capacity holds the acknowledgement of the largest reply, which carries the peer's reply to your agent. No A2A self-route is added. | A2A disabled |
 
 URL hosts are ASCII DNS names or IP addresses; URL fields reject whitespace,
 backslashes, embedded credentials and fragments. Basic replay history
@@ -438,7 +439,7 @@ The laptop case. The CLI creates a certificate authority on this machine and sig
 
 **Renewal.** `aac agent renew --agent <name>` issues fresh certificates from the same CA.
 
-#### I bring my own CA
+#### I bring my own CA certificate
 
 Your own issuer has signed the agent's certificates, and your CA private key never reaches this machine. Certificate source alone does not qualify a production deployment.
 
@@ -507,7 +508,7 @@ name and `<tenant-id>` the tenant id AAC allocated.
 For what each of these proves, who else ever gets a copy, what never leaves you
 and how the pieces fit together — including when your own certificate authority
 signs instead of this tool — see
-[Keys and certificates](https://cascadeauth.github.io/aac-starter-guide/keys-and-certificates.html).
+[Keys and certificates](https://docs.cascadeauth.com/overview/keys-and-certificates/).
 
 <!-- inventory-table:start -->
 | No. | Material | Where | Used for | Lifetime | Back up? |
@@ -902,7 +903,7 @@ are described by their `--help`.
 ### Keys
 
 Replacing the tenant-admin key is immediate and forward-only: the previous
-key stops verifying at once and can never be reinstated. The trust-anchor
+key stops verifying at once and can never be reinstated. The trust anchor
 publisher signs its uploads with this key and loads it once, at start, so
 sequence the change: stop the publisher, register the new public half, put
 the new private key where the publisher's configuration points, start the

{aac_cli-0.2.8 → aac_cli-0.2.9}/README.md

@@ -7,12 +7,13 @@ which tenant they belong to and what they were authorised to do. A
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
-New to AAC? [What AAC is for](https://cascadeauth.github.io/aac-starter-guide/#what-aac-is-for)
+New to AAC? [What AAC is for](https://docs.cascadeauth.com/overview/#what-aac-is-for)
 explains what delegated authority between agents buys you, and what it does not.
 
-The [CLI user guide and complete command reference](https://cascadeauth.github.io/aac-starter-guide/cli/)
+The [CLI user guide and complete command reference](https://docs.cascadeauth.com/cli/)
 cover developer and enterprise onboarding, everyday administration and recovery.
-Select documentation matching `aac --version`.
+These pages describe the latest supported release. Upgrade the CLI to use the
+documented commands, and check your installation with `aac --version`.
 
 The `aac` command is how a tenant's operator does everything that is not
 done by the sidecar itself: register the tenant, sign in, manage keys,
@@ -50,7 +51,7 @@ Python 3.11 to 3.14 is supported. Release checks test all four versions.
 ## Use `aeg` to view agent execution graphs
 
 Installing or upgrading `aac-cli` supplies both `aac` and `aeg`.
-Use the [AEG guide and command reference](https://cascadeauth.github.io/aac-starter-guide/aeg.html)
+Use the [AEG guide and command reference](https://docs.cascadeauth.com/aeg/)
 for listing local and central observations, rendering evidence, and selecting a profile.
 
 `aeg list --profile PROFILE --since 7d` discovers participant-visible central
@@ -84,7 +85,7 @@ Google developer sign-in. See “Setting up aac-cli on a new computer” below
 for the existing-tenant sign-in and material preparation steps.
 
 Setup uses the tenant's assigned trust domain and writes the files the
-trust-anchor publisher and Docker Compose need, as well as the sidecar
+trust anchor publisher and Docker Compose need, as well as the sidecar
 configuration. By default it generates development keys and certificates;
 the certificate choices below explain how to supply your own instead.
 
@@ -314,7 +315,7 @@ and destination maps allow at most 128 entries each.
 | `destinations.<name>.audience_pattern` | Required exact registered SPIFFE identity; no wildcard. | None |
 | `destinations.<name>.predicates`, `.valid_for` | Same value/duration contract as classes. | Empty predicates; duration required |
 | `destinations.<name>.timeout_ms` | Integer 1–2147483647 without A2A; 1–60000 for every destination when A2A is enabled, matching its generated deadline. | `10000` |
-| `a2a.public_base_url`, `a2a.local_handler_url` | Optional A2A block; both required if present. Public URL is HTTPS with no path except optional `/`; the HTTP(S) local handler path must be exactly `/a2a/v1`, with no escaped spelling. Neither URL permits query or fragment markers, even empty ones. Managed A2A state paths and a 60-second deadline are generated. No A2A self-route is added. | A2A disabled |
+| `a2a.public_base_url`, `a2a.local_handler_url` | Optional A2A block; both required if present. Public URL is HTTPS with no path except optional `/`; the HTTP(S) local handler path must be exactly `/a2a/v1`, with no escaped spelling. Neither URL permits query or fragment markers, even empty ones. Managed A2A state paths, a 60-second deadline and retry-state capacity are generated; the capacity holds the acknowledgement of the largest reply, which carries the peer's reply to your agent. No A2A self-route is added. | A2A disabled |
 
 URL hosts are ASCII DNS names or IP addresses; URL fields reject whitespace,
 backslashes, embedded credentials and fragments. Basic replay history
@@ -411,7 +412,7 @@ The laptop case. The CLI creates a certificate authority on this machine and sig
 
 **Renewal.** `aac agent renew --agent <name>` issues fresh certificates from the same CA.
 
-#### I bring my own CA
+#### I bring my own CA certificate
 
 Your own issuer has signed the agent's certificates, and your CA private key never reaches this machine. Certificate source alone does not qualify a production deployment.
 
@@ -480,7 +481,7 @@ name and `<tenant-id>` the tenant id AAC allocated.
 For what each of these proves, who else ever gets a copy, what never leaves you
 and how the pieces fit together — including when your own certificate authority
 signs instead of this tool — see
-[Keys and certificates](https://cascadeauth.github.io/aac-starter-guide/keys-and-certificates.html).
+[Keys and certificates](https://docs.cascadeauth.com/overview/keys-and-certificates/).
 
 <!-- inventory-table:start -->
 | No. | Material | Where | Used for | Lifetime | Back up? |
@@ -875,7 +876,7 @@ are described by their `--help`.
 ### Keys
 
 Replacing the tenant-admin key is immediate and forward-only: the previous
-key stops verifying at once and can never be reinstated. The trust-anchor
+key stops verifying at once and can never be reinstated. The trust anchor
 publisher signs its uploads with this key and loads it once, at start, so
 sequence the change: stop the publisher, register the new public half, put
 the new private key where the publisher's configuration points, start the

{aac_cli-0.2.8 → aac_cli-0.2.9}/aac_cli/__init__.py

@@ -10,4 +10,4 @@ entrypoint (`aac_cli.cli:entrypoint`).
 # test in bin/tests/test_cli_version_parity.py. A literal keeps the
 # shipped code free of import-time metadata lookups (and their
 # not-installed failure mode).
-__version__ = "0.2.8"
+__version__ = "0.2.9"

{aac_cli-0.2.8 → aac_cli-0.2.9}/aac_cli/agent_cli.py

@@ -10,7 +10,7 @@ tenants:
   public trust endpoints.
 * ``renew`` — in "The CLI creates a development CA" mode, reissues the one-day
   workload, receipt and HTTPS certificates with fresh keys, and the CA only
-  when it is expired or inside its renewal window. In "I bring my own CA" mode
+  when it is expired or inside its renewal window. With supplied certificates
   it cannot reissue what it did not sign: it takes replacements from your
   issuer through the same flags `aac init` accepts. Retired material is
   archived, never deleted.
@@ -64,7 +64,7 @@ from aac_cli.init_cli import (
     check_settings_can_be_written,
     write_settings_files,
 )
-from aac_cli.material_cases import MATERIAL_SUPPLIED, case_for
+from aac_cli.material_cases import MATERIAL_ISSUED_HERE, MATERIAL_SUPPLIED, case_for
 from aac_cli.secure_files import ensure_managed_directory, managed_path_problem, write_private_file
 from aac_cli.supplied_material import resolve_supplied_replacement
 
@@ -692,10 +692,10 @@ def add_agent_parser(nouns: argparse._SubParsersAction) -> None:
         "renew",
         help="Replace the short-lived certificates; archive the old material.",
         description=(
-            'In "The CLI creates a development CA" mode, reissues the workload, receipt and '
+            f'In "{case_for(MATERIAL_ISSUED_HERE).name}" mode, reissues the workload, receipt and '
             "HTTPS certificates with new keys; the development CA is reissued only when "
             "expired or within one day of expiry, or with --ca, and a new CA needs the "
-            'publisher to publish the new anchor. In "I bring my own CA" mode nothing is '
+            f'publisher to publish the new anchor. In "{case_for(MATERIAL_SUPPLIED).name}" mode nothing is '
             "reissued: pass the replacement certificates your issuer produced, each with its "
             "key file, and --ca-cert-file if your CA certificate changed too."
         ),

{aac_cli-0.2.8 → aac_cli-0.2.9}/aac_cli/config_render.py

@@ -32,6 +32,22 @@ from aac_cli.material_cases import MATERIAL_ISSUED_HERE, MATERIAL_SUPPLIED
 LAYOUTS = ("host", "container")
 PUBLISHER_POLL_INTERVAL_SECONDS = 60
 
+# The sidecar bounds a peer's A2A reply by a2a.max_request_body_bytes and
+# retains the whole dispatch acknowledgement, which embeds that reply inside
+# 92 bytes of framing. It refuses to start unless every retained
+# acknowledgement fits, so the three capacity values move together: the
+# per-outcome maximum is the largest reply plus the framing, and the
+# reservation is that maximum for every retained dispatch. The reservation is
+# an accounting bound, not allocated storage; the database holds only the
+# replies actually retained.
+A2A_MAX_REQUEST_BODY_BYTES = 262144
+A2A_ACKNOWLEDGEMENT_FRAMING_BYTES = 92
+A2A_RETAINED_DISPATCHES_PER_PAIR = 4096
+A2A_MAX_CACHED_RESPONSE_BODY_BYTES = A2A_MAX_REQUEST_BODY_BYTES + A2A_ACKNOWLEDGEMENT_FRAMING_BYTES
+A2A_MAX_RESERVED_CACHED_BYTES_PER_PAIR = (
+    A2A_RETAINED_DISPATCHES_PER_PAIR * A2A_MAX_CACHED_RESPONSE_BODY_BYTES
+)
+
 
 def generated_header(
     agent_name: str, material_source: str = MATERIAL_ISSUED_HERE, profile: str = "main"
@@ -189,7 +205,7 @@ def render_sidecar_config(
     if "a2a" in accepted:
         result["a2a"] = {
             **accepted["a2a"],
-            "max_request_body_bytes": 262144,
+            "max_request_body_bytes": A2A_MAX_REQUEST_BODY_BYTES,
             "deadline_seconds": A2A_DEADLINE_SECONDS,
             "max_concurrent_requests": 20,
             "max_json_nesting_depth": 32,
@@ -198,9 +214,9 @@ def render_sidecar_config(
             "egress_idempotency": {
                 "state_file": paths.state(agent.a2a_egress_state),
                 "retention_seconds": 86400,
-                "max_entries_per_pair": 4096,
-                "max_cached_response_body_bytes": 4096,
-                "max_reserved_cached_bytes_per_pair": 16777216,
+                "max_entries_per_pair": A2A_RETAINED_DISPATCHES_PER_PAIR,
+                "max_cached_response_body_bytes": A2A_MAX_CACHED_RESPONSE_BODY_BYTES,
+                "max_reserved_cached_bytes_per_pair": A2A_MAX_RESERVED_CACHED_BYTES_PER_PAIR,
             },
         }
     return result

{aac_cli-0.2.8 → aac_cli-0.2.9}/aac_cli/material_cases.py

@@ -70,7 +70,7 @@ ISSUED_HERE = MaterialCase(
 
 SUPPLIED = MaterialCase(
     source=MATERIAL_SUPPLIED,
-    name="I bring my own CA",
+    name="I bring my own CA certificate",
     summary=(
         "Your own issuer has signed the agent's certificates, and your CA private key never "
         "reaches this machine. Certificate source alone does not qualify a production deployment."

{aac_cli-0.2.8 → aac_cli-0.2.9/aac_cli.egg-info}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.2.8
+Version: 0.2.9
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
-Project-URL: Documentation, https://cascadeauth.github.io/aac-starter-guide/cli/
+Project-URL: Documentation, https://docs.cascadeauth.com/cli/
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -34,12 +34,13 @@ which tenant they belong to and what they were authorised to do. A
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
-New to AAC? [What AAC is for](https://cascadeauth.github.io/aac-starter-guide/#what-aac-is-for)
+New to AAC? [What AAC is for](https://docs.cascadeauth.com/overview/#what-aac-is-for)
 explains what delegated authority between agents buys you, and what it does not.
 
-The [CLI user guide and complete command reference](https://cascadeauth.github.io/aac-starter-guide/cli/)
+The [CLI user guide and complete command reference](https://docs.cascadeauth.com/cli/)
 cover developer and enterprise onboarding, everyday administration and recovery.
-Select documentation matching `aac --version`.
+These pages describe the latest supported release. Upgrade the CLI to use the
+documented commands, and check your installation with `aac --version`.
 
 The `aac` command is how a tenant's operator does everything that is not
 done by the sidecar itself: register the tenant, sign in, manage keys,
@@ -77,7 +78,7 @@ Python 3.11 to 3.14 is supported. Release checks test all four versions.
 ## Use `aeg` to view agent execution graphs
 
 Installing or upgrading `aac-cli` supplies both `aac` and `aeg`.
-Use the [AEG guide and command reference](https://cascadeauth.github.io/aac-starter-guide/aeg.html)
+Use the [AEG guide and command reference](https://docs.cascadeauth.com/aeg/)
 for listing local and central observations, rendering evidence, and selecting a profile.
 
 `aeg list --profile PROFILE --since 7d` discovers participant-visible central
@@ -111,7 +112,7 @@ Google developer sign-in. See “Setting up aac-cli on a new computer” below
 for the existing-tenant sign-in and material preparation steps.
 
 Setup uses the tenant's assigned trust domain and writes the files the
-trust-anchor publisher and Docker Compose need, as well as the sidecar
+trust anchor publisher and Docker Compose need, as well as the sidecar
 configuration. By default it generates development keys and certificates;
 the certificate choices below explain how to supply your own instead.
 
@@ -341,7 +342,7 @@ and destination maps allow at most 128 entries each.
 | `destinations.<name>.audience_pattern` | Required exact registered SPIFFE identity; no wildcard. | None |
 | `destinations.<name>.predicates`, `.valid_for` | Same value/duration contract as classes. | Empty predicates; duration required |
 | `destinations.<name>.timeout_ms` | Integer 1–2147483647 without A2A; 1–60000 for every destination when A2A is enabled, matching its generated deadline. | `10000` |
-| `a2a.public_base_url`, `a2a.local_handler_url` | Optional A2A block; both required if present. Public URL is HTTPS with no path except optional `/`; the HTTP(S) local handler path must be exactly `/a2a/v1`, with no escaped spelling. Neither URL permits query or fragment markers, even empty ones. Managed A2A state paths and a 60-second deadline are generated. No A2A self-route is added. | A2A disabled |
+| `a2a.public_base_url`, `a2a.local_handler_url` | Optional A2A block; both required if present. Public URL is HTTPS with no path except optional `/`; the HTTP(S) local handler path must be exactly `/a2a/v1`, with no escaped spelling. Neither URL permits query or fragment markers, even empty ones. Managed A2A state paths, a 60-second deadline and retry-state capacity are generated; the capacity holds the acknowledgement of the largest reply, which carries the peer's reply to your agent. No A2A self-route is added. | A2A disabled |
 
 URL hosts are ASCII DNS names or IP addresses; URL fields reject whitespace,
 backslashes, embedded credentials and fragments. Basic replay history
@@ -438,7 +439,7 @@ The laptop case. The CLI creates a certificate authority on this machine and sig
 
 **Renewal.** `aac agent renew --agent <name>` issues fresh certificates from the same CA.
 
-#### I bring my own CA
+#### I bring my own CA certificate
 
 Your own issuer has signed the agent's certificates, and your CA private key never reaches this machine. Certificate source alone does not qualify a production deployment.
 
@@ -507,7 +508,7 @@ name and `<tenant-id>` the tenant id AAC allocated.
 For what each of these proves, who else ever gets a copy, what never leaves you
 and how the pieces fit together — including when your own certificate authority
 signs instead of this tool — see
-[Keys and certificates](https://cascadeauth.github.io/aac-starter-guide/keys-and-certificates.html).
+[Keys and certificates](https://docs.cascadeauth.com/overview/keys-and-certificates/).
 
 <!-- inventory-table:start -->
 | No. | Material | Where | Used for | Lifetime | Back up? |
@@ -902,7 +903,7 @@ are described by their `--help`.
 ### Keys
 
 Replacing the tenant-admin key is immediate and forward-only: the previous
-key stops verifying at once and can never be reinstated. The trust-anchor
+key stops verifying at once and can never be reinstated. The trust anchor
 publisher signs its uploads with this key and loads it once, at start, so
 sequence the change: stop the publisher, register the new public half, put
 the new private key where the publisher's configuration points, start the

{aac_cli-0.2.8 → aac_cli-0.2.9}/pyproject.toml

@@ -32,7 +32,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aac-cli"
-version = "0.2.8"
+version = "0.2.9"
 description = "The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit)."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -71,7 +71,7 @@ dependencies = [
 ]
 
 [project.urls]
-Documentation = "https://cascadeauth.github.io/aac-starter-guide/cli/"
+Documentation = "https://docs.cascadeauth.com/cli/"
 
 [project.optional-dependencies]
 test = [