acumatica-cli 0.15.2__tar.gz → 0.15.4__tar.gz

{acumatica_cli-0.15.2 → acumatica_cli-0.15.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: acumatica-cli
-Version: 0.15.2
+Version: 0.15.4
 Summary: Acumatica ERP Config-as-Code: tenant provisioning, baseline config, and reference data
 Author: Konstantin Borovik
 Author-email: Konstantin Borovik <kb@lab5.ca>
@@ -39,7 +39,7 @@ uv tool install acumatica-cli
 
 acu config init --host erp.example.com my-erp
 cd my-erp                                # edit .env: set ACU_PASSWORD, ACU_TENANT
-                                         # keep ACU_API_VERSION in sync with target.yaml
+                                         # Default API pin = target.yaml default_api
                                          # start from a brand-new empty tenant
 
 acu config check                         # read-only preflight (incl. target.yaml)
@@ -49,18 +49,17 @@ acu --tenant DEV apply config/           # seed config/{bootstrap,baseline,setup
 acu --tenant DEV run scenario/           # once capital → buy → build → sell
 acu --tenant DEV diff config/            # prove zero drift (exit 2 on drift)
 acu --tenant DEV state                   # capture state/ trial-balance
-# warm: capital once-skips; Owner Capital stays 50000 (not 100000)
-acu --tenant DEV run scenario/
+acu --tenant DEV run scenario/           # replay transaction scenarios
 ```
 
 Bare `apply` / `diff` (no path args) also prefer `config/` when those trees exist.
 See [docs/demo-seed.md](docs/demo-seed.md) for the entity map, once-guard, and apply-order notes.
 
-**Hosted Acumatica (no SSH):** the tenant already exists; leave `ACU_SSH` blank.
+**Hosted Acumatica (no SSH):** the tenant already exists; set a blank `ACU_SSH=` in `.env` (scaffold omits the key — without it, acu defaults to `Administrator@<ACU_BASE_URL host>` for SSH boxes).
 
 ```sh
 acu config init --host customer.acumatica.com my-erp
-cd my-erp                                # edit .env: ACU_TENANT, ACU_PASSWORD; ACU_SSH=
+cd my-erp                                # edit .env: ACU_TENANT, ACU_PASSWORD; add ACU_SSH=
 acu config check                         # REST preflight; ssh probe is skipped
 acu --tenant DEV bootstrap               # publish AcuBootstrap via REST only
 acu --tenant DEV apply config/
@@ -126,7 +125,6 @@ There is no `--flavor`.
 Legacy data repos may still keep root `bootstrap/`…`master/`; bare `apply`/`diff` prefer `config/` when present and never merge both trees.
 
 Files in each directory apply alphabetically; the numbered prefixes (`10-`, `20-`, and so on) encode dependency order.
-The scaffolded `.gitignore` keeps `.env` out of git — store it encrypted (for example as `.env.gpg`) and decrypt once per clone.
 Commit `target.yaml` with the seeds so every clone knows the verified ERP line and Default API generation.
 
 Seed YAML is state: `apply` upserts it, `diff` proves it.
@@ -141,38 +139,19 @@ git diff config/                           # review extract delta before commit
 acu --tenant DEV apply config/             # replay extracted seed
 acu --tenant DEV diff config/              # expect exit 0
 ```
-
-**Migration (T115–T120 extract hard-cut):** extract no longer writes root `bootstrap/` / `baseline/` / `setup/` / `master/`.
-Paths are always `config/…`.
-There is no `--layout`.
-Move any root-layout extract output under `config/`, or re-extract into a modern data repo.
-Catalog rename: `extract_manifest.yaml` becomes `seed_catalog.yaml` (package data only; operators do not author it).
-
-Scenario YAML is different — it describes transactions that flow forward (not extractable seed).
-`acu run` executes each step in order (`put`, `action`, `wait`, `get`), captures server-assigned document numbers into `${var}` references for later steps, and checks `expect:` assertions as deltas against a pre-run snapshot, so additive scenarios re-run safely on a warm tenant.
-`once: true` scenarios declare a `present` inquire-absolute gate; when the probe already holds, the CLI prints `skip <path> (once: already present)` and runs neither steps nor expects (Owner Capital does not restack).
-
-`acu state` is the third observation path: it captures live derived state (balances) into `state/` for git review.
-It is not `extract` (config seed) and not `diff` (desired vs actual config).
-Packaged golden is trial-balance via contract `inquire:` (`EndingBalance` fixed-point); inventory-summary is not golden this pass. `gi:` stays optional when a GI is V12-verified and **Expose via OData** is on (`params` fail-closed vs `$metadata`).
-After a cold `acu run scenario/ && acu state`, warm `acu run scenario/10-seed-capital.yaml && acu state --assert-unchanged` is the once-class gate (full scenario re-run is additive and moves cash observations on the TB).
-
-**Migration (T112–T114 hard-cut):** CLI verb is `state` only (no `snapshot` alias).
-Bare defaults are `config/views/` (views) and `state/` (observations).
-Prior `config/snapshot/` and root `snapshot/` / `snapshots/` are not fallbacks — move views to `config/views/` or pass explicit path args.
-
 ### Seed `endpoint:` symbols
 
 Dual-served entities (on both Bootstrap and Default) need an explicit `endpoint:` line.
 
 | Value | Resolves to |
 | ----- | ----------- |
-| omitted | `Default/<ACU_API_VERSION>` for Default-only entities |
+| omitted | `Default/<api_version>` for Default-only entities |
 | `bootstrap` | active `Bootstrap/<ver>` from `bootstrap/project.xml` or the packaged contract |
-| `default` | `Default/<ACU_API_VERSION>` — tracks the operator API version |
-| `Bootstrap/1.0.0` or `Default/25.200.001` | literal pin (ignores `ACU_API_VERSION` for Default) |
+| `default` | `Default/<api_version>` — tracks the resolved API version |
+| `Bootstrap/1.0.0` or `Default/25.200.001` | literal pin (ignores the resolved Default version) |
 
-Prefer symbolic `default` over a pinned `Default/25.200.001` so the seed tree travels with the configured API generation.
+`api_version` resolves as `--api-version` flag, else `target.yaml` `default_api` when present, else code default `25.200.001` (never `ACU_API_VERSION` in `.env`).
+Prefer symbolic `default` over a pinned `Default/25.200.001` so the seed tree travels with the dataset pin.
 
 ## Installation
 
@@ -193,41 +172,45 @@ Verify with `acu --version`.
 
 ## Configuration
 
-Everything lives in one `.env` file: *where* to apply and *who* signs in.
-Three values are required; everything else has a code default matching a stock Acumatica install:
+Everything lives in one `.env` file: *where* to apply and *who* signs in
+(`ACU_*` vars only).
+The Default contract API pin is **not** in `.env` — it
+lives in committed `target.yaml` (`default_api`).
 
 ```sh
 ACU_BASE_URL=http://acu-dev1.vm.internal/AcumaticaERP  # required: REST root
 ACU_TENANT=LAB5                                        # sign-in name of the tenant API sessions use
-ACU_SSH=Administrator@acu-dev1.vm.internal             # optional: control-plane user@host (tenant CRUD)
-ACU_API_VERSION=25.200.001                             # Default contract version half only
+# ACU_SSH omitted → defaults to Administrator@acu-dev1.vm.internal
+# ACU_SSH=                                         # hosted opt-out (blank key)
 ACU_USER=admin                                         # optional, defaults to admin
 ACU_PASSWORD=...                                       # required for live commands
 ```
 
-`ACU_API_VERSION` is the version half only (`25.200.001`), never `Default/25.200.001`.
-A full path would nest as `/entity/Default/Default/...`.
+There is no `ACU_API_VERSION` env key (unknown `ACU_*` vars are ignored).
+Ad-hoc override: `acu --api-version 24.200.001 …` (version half only, never
+`Default/25.200.001` — a full path would nest as `/entity/Default/Default/...`).
 
-The committed `target.yaml` next to `.env` declares the verified matrix (what, not where):
+The committed `target.yaml` next to `.env` declares the verified matrix (what, not where) and is the **sole data-repo Default pin**:
 
 ```yaml
-erp: "26.101.0225"           # claimed product line/build (README-level detail)
-default_api: "25.200.001"    # must match ACU_API_VERSION
+erp: "26.101.0225"           # claimed product line/build
+default_api: "25.200.001"    # sources Instance.api_version when --api-version absent
 ```
 
-When `target.yaml` is present, `apply` / `diff` / `run` / `extract` / `schema` / `bootstrap` hard-fail if `default_api` does not match the configured API version.
-`acu config check` reports the same match as a probe line.
-Missing `target.yaml` only warns on check unless you pass `--strict`.
+When `target.yaml` is present, live commands resolve `api_version` from
+`default_api` (source-merge). `acu config check` reports
+`ok target (api_version from default_api=…; erp=… claimed)`.
+Missing `target.yaml` only warns on check unless you pass `--strict` (then
+the code default `25.200.001` is used).
 
 Worth knowing:
 
 - The file is found by walking up from the current directory, so any subdirectory of the data repo works.
 - Without a `.env`, global flags plus the process environment supply the full configuration.
-- `ACU_SSH` is optional.
-- Leave it blank on hosted instances; only `acu tenant` needs it.
-- Nothing is derived: split-horizon DNS, port forwards, and jump hosts are all handled by writing the address you actually want into the address keys.
-- `acu config show` prints the fully resolved configuration as a complete, valid `.env` — every knob visible, the password excluded.
-- When `target.yaml` is present, `config show` also comments `erp` / `default_api`.
+- When `ACU_SSH` is **absent**, acu defaults to `Administrator@` + the `ACU_BASE_URL` hostname.
+  A **present blank** `ACU_SSH=` is the hosted opt-out.
+  Only `acu tenant` requires a non-empty value post-default.
+- `acu config show` prints the resolved `.env` (password excluded; never `ACU_API_VERSION`) and comments `erp` / `default_api` plus the `api_version` source when `target.yaml` is present.
 - Redirect it to turn resolved state into a working config: `acu config show > .env`.
 
 Verify before touching anything live:
@@ -238,65 +221,6 @@ acu config check --strict  # missing target.yaml becomes fail
 acu apply --dry-run        # show what would be written, write nothing
 ```
 
-## Control and Data Planes
-
-`acu` talks to an instance over two independent channels:
-
-- **Control plane (SSH):** `acu tenant` runs `ac.exe -cm:CompanyConfig` and `sqlcmd` on the Windows guest — see [`docs/ac-exe.md`](docs/ac-exe.md).
-- **Data plane (REST):** `acu bootstrap`, `apply`, `diff`, `run`, `extract`, and `schema` use the contract-based API and CustomizationApi — see [`docs/rest-api.md`](docs/rest-api.md).
-
-If you never touch `acu tenant`, you never need SSH.
-On a hosted instance, publish AcuBootstrap with `acu bootstrap`, then seed with `apply`.
-`acu bootstrap --export PATH` writes the package zip for manual import on the Customization Projects screen (SM204505) when you cannot call the API.
-
-## SSH setup (control plane)
-
-`acu tenant` runs commands on the Windows guest through plain `ssh`.
-Two things about this setup are not obvious, and both are hard requirements.
-
-**1.
-The default SSH shell on the Windows guest must be PowerShell.**
-`acu` sends PowerShell syntax over the wire, and every one of those commands fails under `cmd.exe`, the Windows OpenSSH default.
-Switch it once, in an elevated PowerShell on the guest:
-
-```powershell
-New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell `
-  -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" `
-  -PropertyType String -Force
-```
-
-**2.
-Authentication must be key-based and non-interactive.**
-`acu` connects with `BatchMode=yes`, so it will never answer a password prompt.
-Because the default user is `Administrator` (an administrators-group member), Windows OpenSSH reads the key from the *machine-wide* file `C:\ProgramData\ssh\administrators_authorized_keys` — **not** from `~\.ssh\authorized_keys` like on Linux.
-On the guest:
-
-Install + start the server (once):
-
-```powershell
-Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
-Set-Service sshd -StartupType Automatic
-Start-Service sshd
-```
-
-Authorize your public key for administrators:
-
-```powershell
-Add-Content -Path C:\ProgramData\ssh\administrators_authorized_keys -Value "ssh-ed25519 AAAA... you@laptop"
-```
-
-The file must be readable by SYSTEM/Administrators only, or sshd ignores it:
-
-```powershell
-icacls C:\ProgramData\ssh\administrators_authorized_keys /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
-```
-
-Then verify from your workstation — this one test proves both requirements at once (key auth works, and the shell is PowerShell):
-
-```sh
-ssh -o BatchMode=yes Administrator@acu-dev1.vm.internal '$PSVersionTable.PSVersion'
-```
-
 ## Development
 
 Requires **GNU Make at least 3.82** — the Makefile uses `.ONESHELL`.
@@ -328,7 +252,7 @@ GitHub Actions re-runs the check on the tag, then publishes the GitHub release a
 
 `gmake e2e` runs the opt-in live tier against a real Acumatica instance (pytest marker `e2e`, deselected by the default suite).
 
-Configuration is one file: a decrypted `.env` at the repo root names the instance — `ACU_BASE_URL`, `ACU_SSH`, `ACU_TENANT`, `ACU_PASSWORD`.
+Configuration is one file: a decrypted `.env` at the repo root names the instance — `ACU_BASE_URL`, `ACU_TENANT`, `ACU_PASSWORD` (and optional `ACU_SSH`; omitted defaults to `Administrator@` + base-url host).
 `gmake e2e` refuses to start without it.
 
 The tier is self-contained.

{acumatica_cli-0.15.2 → acumatica_cli-0.15.4}/README.md

@@ -21,7 +21,7 @@ uv tool install acumatica-cli
 
 acu config init --host erp.example.com my-erp
 cd my-erp                                # edit .env: set ACU_PASSWORD, ACU_TENANT
-                                         # keep ACU_API_VERSION in sync with target.yaml
+                                         # Default API pin = target.yaml default_api
                                          # start from a brand-new empty tenant
 
 acu config check                         # read-only preflight (incl. target.yaml)
@@ -31,18 +31,17 @@ acu --tenant DEV apply config/           # seed config/{bootstrap,baseline,setup
 acu --tenant DEV run scenario/           # once capital → buy → build → sell
 acu --tenant DEV diff config/            # prove zero drift (exit 2 on drift)
 acu --tenant DEV state                   # capture state/ trial-balance
-# warm: capital once-skips; Owner Capital stays 50000 (not 100000)
-acu --tenant DEV run scenario/
+acu --tenant DEV run scenario/           # replay transaction scenarios
 ```
 
 Bare `apply` / `diff` (no path args) also prefer `config/` when those trees exist.
 See [docs/demo-seed.md](docs/demo-seed.md) for the entity map, once-guard, and apply-order notes.
 
-**Hosted Acumatica (no SSH):** the tenant already exists; leave `ACU_SSH` blank.
+**Hosted Acumatica (no SSH):** the tenant already exists; set a blank `ACU_SSH=` in `.env` (scaffold omits the key — without it, acu defaults to `Administrator@<ACU_BASE_URL host>` for SSH boxes).
 
 ```sh
 acu config init --host customer.acumatica.com my-erp
-cd my-erp                                # edit .env: ACU_TENANT, ACU_PASSWORD; ACU_SSH=
+cd my-erp                                # edit .env: ACU_TENANT, ACU_PASSWORD; add ACU_SSH=
 acu config check                         # REST preflight; ssh probe is skipped
 acu --tenant DEV bootstrap               # publish AcuBootstrap via REST only
 acu --tenant DEV apply config/
@@ -108,7 +107,6 @@ There is no `--flavor`.
 Legacy data repos may still keep root `bootstrap/`…`master/`; bare `apply`/`diff` prefer `config/` when present and never merge both trees.
 
 Files in each directory apply alphabetically; the numbered prefixes (`10-`, `20-`, and so on) encode dependency order.
-The scaffolded `.gitignore` keeps `.env` out of git — store it encrypted (for example as `.env.gpg`) and decrypt once per clone.
 Commit `target.yaml` with the seeds so every clone knows the verified ERP line and Default API generation.
 
 Seed YAML is state: `apply` upserts it, `diff` proves it.
@@ -123,38 +121,19 @@ git diff config/                           # review extract delta before commit
 acu --tenant DEV apply config/             # replay extracted seed
 acu --tenant DEV diff config/              # expect exit 0
 ```
-
-**Migration (T115–T120 extract hard-cut):** extract no longer writes root `bootstrap/` / `baseline/` / `setup/` / `master/`.
-Paths are always `config/…`.
-There is no `--layout`.
-Move any root-layout extract output under `config/`, or re-extract into a modern data repo.
-Catalog rename: `extract_manifest.yaml` becomes `seed_catalog.yaml` (package data only; operators do not author it).
-
-Scenario YAML is different — it describes transactions that flow forward (not extractable seed).
-`acu run` executes each step in order (`put`, `action`, `wait`, `get`), captures server-assigned document numbers into `${var}` references for later steps, and checks `expect:` assertions as deltas against a pre-run snapshot, so additive scenarios re-run safely on a warm tenant.
-`once: true` scenarios declare a `present` inquire-absolute gate; when the probe already holds, the CLI prints `skip <path> (once: already present)` and runs neither steps nor expects (Owner Capital does not restack).
-
-`acu state` is the third observation path: it captures live derived state (balances) into `state/` for git review.
-It is not `extract` (config seed) and not `diff` (desired vs actual config).
-Packaged golden is trial-balance via contract `inquire:` (`EndingBalance` fixed-point); inventory-summary is not golden this pass. `gi:` stays optional when a GI is V12-verified and **Expose via OData** is on (`params` fail-closed vs `$metadata`).
-After a cold `acu run scenario/ && acu state`, warm `acu run scenario/10-seed-capital.yaml && acu state --assert-unchanged` is the once-class gate (full scenario re-run is additive and moves cash observations on the TB).
-
-**Migration (T112–T114 hard-cut):** CLI verb is `state` only (no `snapshot` alias).
-Bare defaults are `config/views/` (views) and `state/` (observations).
-Prior `config/snapshot/` and root `snapshot/` / `snapshots/` are not fallbacks — move views to `config/views/` or pass explicit path args.
-
 ### Seed `endpoint:` symbols
 
 Dual-served entities (on both Bootstrap and Default) need an explicit `endpoint:` line.
 
 | Value | Resolves to |
 | ----- | ----------- |
-| omitted | `Default/<ACU_API_VERSION>` for Default-only entities |
+| omitted | `Default/<api_version>` for Default-only entities |
 | `bootstrap` | active `Bootstrap/<ver>` from `bootstrap/project.xml` or the packaged contract |
-| `default` | `Default/<ACU_API_VERSION>` — tracks the operator API version |
-| `Bootstrap/1.0.0` or `Default/25.200.001` | literal pin (ignores `ACU_API_VERSION` for Default) |
+| `default` | `Default/<api_version>` — tracks the resolved API version |
+| `Bootstrap/1.0.0` or `Default/25.200.001` | literal pin (ignores the resolved Default version) |
 
-Prefer symbolic `default` over a pinned `Default/25.200.001` so the seed tree travels with the configured API generation.
+`api_version` resolves as `--api-version` flag, else `target.yaml` `default_api` when present, else code default `25.200.001` (never `ACU_API_VERSION` in `.env`).
+Prefer symbolic `default` over a pinned `Default/25.200.001` so the seed tree travels with the dataset pin.
 
 ## Installation
 
@@ -175,41 +154,45 @@ Verify with `acu --version`.
 
 ## Configuration
 
-Everything lives in one `.env` file: *where* to apply and *who* signs in.
-Three values are required; everything else has a code default matching a stock Acumatica install:
+Everything lives in one `.env` file: *where* to apply and *who* signs in
+(`ACU_*` vars only).
+The Default contract API pin is **not** in `.env` — it
+lives in committed `target.yaml` (`default_api`).
 
 ```sh
 ACU_BASE_URL=http://acu-dev1.vm.internal/AcumaticaERP  # required: REST root
 ACU_TENANT=LAB5                                        # sign-in name of the tenant API sessions use
-ACU_SSH=Administrator@acu-dev1.vm.internal             # optional: control-plane user@host (tenant CRUD)
-ACU_API_VERSION=25.200.001                             # Default contract version half only
+# ACU_SSH omitted → defaults to Administrator@acu-dev1.vm.internal
+# ACU_SSH=                                         # hosted opt-out (blank key)
 ACU_USER=admin                                         # optional, defaults to admin
 ACU_PASSWORD=...                                       # required for live commands
 ```
 
-`ACU_API_VERSION` is the version half only (`25.200.001`), never `Default/25.200.001`.
-A full path would nest as `/entity/Default/Default/...`.
+There is no `ACU_API_VERSION` env key (unknown `ACU_*` vars are ignored).
+Ad-hoc override: `acu --api-version 24.200.001 …` (version half only, never
+`Default/25.200.001` — a full path would nest as `/entity/Default/Default/...`).
 
-The committed `target.yaml` next to `.env` declares the verified matrix (what, not where):
+The committed `target.yaml` next to `.env` declares the verified matrix (what, not where) and is the **sole data-repo Default pin**:
 
 ```yaml
-erp: "26.101.0225"           # claimed product line/build (README-level detail)
-default_api: "25.200.001"    # must match ACU_API_VERSION
+erp: "26.101.0225"           # claimed product line/build
+default_api: "25.200.001"    # sources Instance.api_version when --api-version absent
 ```
 
-When `target.yaml` is present, `apply` / `diff` / `run` / `extract` / `schema` / `bootstrap` hard-fail if `default_api` does not match the configured API version.
-`acu config check` reports the same match as a probe line.
-Missing `target.yaml` only warns on check unless you pass `--strict`.
+When `target.yaml` is present, live commands resolve `api_version` from
+`default_api` (source-merge). `acu config check` reports
+`ok target (api_version from default_api=…; erp=… claimed)`.
+Missing `target.yaml` only warns on check unless you pass `--strict` (then
+the code default `25.200.001` is used).
 
 Worth knowing:
 
 - The file is found by walking up from the current directory, so any subdirectory of the data repo works.
 - Without a `.env`, global flags plus the process environment supply the full configuration.
-- `ACU_SSH` is optional.
-- Leave it blank on hosted instances; only `acu tenant` needs it.
-- Nothing is derived: split-horizon DNS, port forwards, and jump hosts are all handled by writing the address you actually want into the address keys.
-- `acu config show` prints the fully resolved configuration as a complete, valid `.env` — every knob visible, the password excluded.
-- When `target.yaml` is present, `config show` also comments `erp` / `default_api`.
+- When `ACU_SSH` is **absent**, acu defaults to `Administrator@` + the `ACU_BASE_URL` hostname.
+  A **present blank** `ACU_SSH=` is the hosted opt-out.
+  Only `acu tenant` requires a non-empty value post-default.
+- `acu config show` prints the resolved `.env` (password excluded; never `ACU_API_VERSION`) and comments `erp` / `default_api` plus the `api_version` source when `target.yaml` is present.
 - Redirect it to turn resolved state into a working config: `acu config show > .env`.
 
 Verify before touching anything live:
@@ -220,65 +203,6 @@ acu config check --strict  # missing target.yaml becomes fail
 acu apply --dry-run        # show what would be written, write nothing
 ```
 
-## Control and Data Planes
-
-`acu` talks to an instance over two independent channels:
-
-- **Control plane (SSH):** `acu tenant` runs `ac.exe -cm:CompanyConfig` and `sqlcmd` on the Windows guest — see [`docs/ac-exe.md`](docs/ac-exe.md).
-- **Data plane (REST):** `acu bootstrap`, `apply`, `diff`, `run`, `extract`, and `schema` use the contract-based API and CustomizationApi — see [`docs/rest-api.md`](docs/rest-api.md).
-
-If you never touch `acu tenant`, you never need SSH.
-On a hosted instance, publish AcuBootstrap with `acu bootstrap`, then seed with `apply`.
-`acu bootstrap --export PATH` writes the package zip for manual import on the Customization Projects screen (SM204505) when you cannot call the API.
-
-## SSH setup (control plane)
-
-`acu tenant` runs commands on the Windows guest through plain `ssh`.
-Two things about this setup are not obvious, and both are hard requirements.
-
-**1.
-The default SSH shell on the Windows guest must be PowerShell.**
-`acu` sends PowerShell syntax over the wire, and every one of those commands fails under `cmd.exe`, the Windows OpenSSH default.
-Switch it once, in an elevated PowerShell on the guest:
-
-```powershell
-New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell `
-  -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" `
-  -PropertyType String -Force
-```
-
-**2.
-Authentication must be key-based and non-interactive.**
-`acu` connects with `BatchMode=yes`, so it will never answer a password prompt.
-Because the default user is `Administrator` (an administrators-group member), Windows OpenSSH reads the key from the *machine-wide* file `C:\ProgramData\ssh\administrators_authorized_keys` — **not** from `~\.ssh\authorized_keys` like on Linux.
-On the guest:
-
-Install + start the server (once):
-
-```powershell
-Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
-Set-Service sshd -StartupType Automatic
-Start-Service sshd
-```
-
-Authorize your public key for administrators:
-
-```powershell
-Add-Content -Path C:\ProgramData\ssh\administrators_authorized_keys -Value "ssh-ed25519 AAAA... you@laptop"
-```
-
-The file must be readable by SYSTEM/Administrators only, or sshd ignores it:
-
-```powershell
-icacls C:\ProgramData\ssh\administrators_authorized_keys /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
-```
-
-Then verify from your workstation — this one test proves both requirements at once (key auth works, and the shell is PowerShell):
-
-```sh
-ssh -o BatchMode=yes Administrator@acu-dev1.vm.internal '$PSVersionTable.PSVersion'
-```
-
 ## Development
 
 Requires **GNU Make at least 3.82** — the Makefile uses `.ONESHELL`.
@@ -310,7 +234,7 @@ GitHub Actions re-runs the check on the tag, then publishes the GitHub release a
 
 `gmake e2e` runs the opt-in live tier against a real Acumatica instance (pytest marker `e2e`, deselected by the default suite).
 
-Configuration is one file: a decrypted `.env` at the repo root names the instance — `ACU_BASE_URL`, `ACU_SSH`, `ACU_TENANT`, `ACU_PASSWORD`.
+Configuration is one file: a decrypted `.env` at the repo root names the instance — `ACU_BASE_URL`, `ACU_TENANT`, `ACU_PASSWORD` (and optional `ACU_SSH`; omitted defaults to `Administrator@` + base-url host).
 `gmake e2e` refuses to start without it.
 
 The tier is self-contained.

{acumatica_cli-0.15.2 → acumatica_cli-0.15.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "acumatica-cli"
-version = "0.15.2"
+version = "0.15.4"
 description = "Acumatica ERP Config-as-Code: tenant provisioning, baseline config, and reference data"
 authors = [{ name = "Konstantin Borovik", email = "kb@lab5.ca" }]
 license = "PolyForm-Noncommercial-1.0.0"

{acumatica_cli-0.15.2 → acumatica_cli-0.15.4}/src/acumatica_cli/cli.py

@@ -155,18 +155,67 @@ def pass_instance[**P, R](f: Callable[Concatenate[Instance, P], R]) -> Callable[
     return new_func
 
 
+def _transport_target(
+    exc: httpx.TransportError, *, target: str | None = None
+) -> str | None:
+    """Prefer explicit target (e.g. Instance.base_url); else request URL."""
+    if target:
+        return target
+    request = getattr(exc, "request", None)
+    if request is not None:
+        return str(request.url)
+    return None
+
+
+def _format_transport_error(
+    exc: httpx.TransportError, *, target: str | None = None
+) -> str:
+    """Friendly one-line body for connect/timeout/TLS (V9 / T123).
+
+    Never surface raw httpx/OS dumps (e.g. ``[Errno 61] Connection refused``).
+    """
+    raw = str(exc).lower()
+    if "ssl" in raw or "certificate" in raw or "tls" in raw:
+        kind = "TLS error"
+    elif isinstance(exc, httpx.TimeoutException):
+        kind = "request timed out"
+    elif isinstance(exc, httpx.ConnectError):
+        kind = "cannot connect"
+    elif isinstance(exc, httpx.NetworkError):
+        kind = "network error"
+    else:
+        kind = "transport error"
+    where = _transport_target(exc, target=target)
+    hint = "check ACU_BASE_URL / network / instance up"
+    if where:
+        return f"{kind} to {where} ({hint})"
+    return f"{kind} ({hint})"
+
+
+def _format_failure(exc: BaseException, *, target: str | None = None) -> str:
+    """Map expected failures to one greppable error line body (V9).
+
+    Transport/network class → friendly rewrite; other RuntimeError / HTTPError
+    keep ``str(exc)`` (server ``exceptionMessage`` path unchanged).
+    """
+    if isinstance(exc, httpx.TransportError):
+        return _format_transport_error(exc, target=target)
+    return str(exc)
+
+
 def main() -> None:
     """Entry point: run the CLI, mapping expected failures to one-line errors.
 
     RuntimeError (SSH/ac.exe, REST, first-login) and httpx transport errors
     print `x message` and exit 1; ACU_DEBUG=1 re-raises for the traceback.
+    Transport/network failures use a friendly rewrite (V9), not raw dumps.
     """
     try:
         cli()
     except (RuntimeError, httpx.HTTPError) as exc:
         if os.environ.get("ACU_DEBUG"):
             raise
-        output.error(str(exc))
+        output.error(_format_failure(exc))
         raise SystemExit(1) from exc
 
 
@@ -407,8 +456,8 @@ def config_group() -> None:
 @click.option(
     "--host",
     default=None,
-    help="Hostname substituted into the scaffolded .env ACU_BASE_URL/ACU_SSH "
-    "values (default: a placeholder)",
+    help="Hostname substituted into the scaffolded .env ACU_BASE_URL "
+    "(default: a placeholder); ACU_SSH is omitted and defaults from that host",
 )
 @click.argument(
     "directory", required=False, type=click.Path(file_okay=False, path_type=Path)
@@ -431,7 +480,7 @@ def config_init(host: str | None, directory: Path | None) -> None:
     # next-step cmds: operator rebuild order after scaffold (V28)
     output.data("")
     output.data("next:")
-    output.data("  1. edit .env (set ACU_PASSWORD, ACU_TENANT; keep ACU_API_VERSION)")
+    output.data("  1. edit .env (set ACU_PASSWORD, ACU_TENANT)")
     output.data("  2. acu config check")
     output.data("  3. acu bootstrap          # or: acu tenant create ... (SSH)")
     output.data("  4. acu apply config/")
@@ -449,23 +498,35 @@ def config_show(inst: Instance) -> None:
     so the printed values are exactly what a live command would trust -
     global flag overrides (--url, --ssh, ...) included. The password is
     never emitted in any form (V2): no ACU_PASSWORD key, no value.
-    When target.yaml is present, surfaces erp/default_api as comments
-    (mismatch noted, still exit 0 — no hard gate). Redirect to a file and
-    edit: the output loads back through load_instance unchanged, the
-    password supplied out of band.
+    ``ACU_API_VERSION`` is never emitted (V27/T125 — api pin is not env;
+    source is target.yaml ``default_api`` or ``--api-version``). When
+    target.yaml is present, surfaces erp/default_api as comments and notes
+    the api_version source (still exit 0 — no hard gate). Redirect to a
+    file and edit: the output loads back through load_instance unchanged,
+    the password supplied out of band.
     """
     output.data("# resolved by `acu config show` - a complete .env")
     output.data("# ACU_PASSWORD comes from .env or the environment, never from here")
-    for field, value in inst.model_dump(exclude={"password"}).items():
+    # V27: api pin is not an env key — never emit ACU_API_VERSION
+    for field, value in inst.model_dump(exclude={"password", "api_version"}).items():
         output.data(f"ACU_{field.upper()}={value}")
     target = load_target()
     if target is not None:
         output.data(f"# target.yaml: erp={target.erp} default_api={target.default_api}")
-        if target.default_api != inst.api_version:
+        if inst.api_version == target.default_api:
             output.data(
-                f"# warn: default_api={target.default_api} != "
-                f"ACU_API_VERSION={inst.api_version}"
+                f"# api_version={inst.api_version} (from target.yaml default_api)"
             )
+        else:
+            output.data(
+                f"# api_version={inst.api_version} (from --api-version; "
+                f"target default_api={target.default_api})"
+            )
+    else:
+        output.data(
+            f"# api_version={inst.api_version} "
+            f"(code default or --api-version; no target.yaml)"
+        )
 
 
 @config_group.command("check")
@@ -546,7 +607,7 @@ def _probe_rest(inst: Instance, claimed_erp: str | None) -> bool:
             output.data(f"ok rest ({inst.base_url}, tenant {inst.tenant})")
             return _probe_entity_root(client, inst, claimed_erp)
     except (RuntimeError, httpx.HTTPError) as exc:
-        output.data(f"fail rest: {exc}")
+        output.data(f"fail rest: {_format_failure(exc, target=inst.base_url)}")
         return False
 
 
@@ -558,7 +619,7 @@ def _probe_entity_root(
     try:
         endpoints, live_build = client.entity_root()
     except (RuntimeError, httpx.HTTPError) as exc:
-        output.data(f"fail endpoints: {exc}")
+        output.data(f"fail endpoints: {_format_failure(exc, target=inst.base_url)}")
         endpoints, live_build = [], None
         ok = False
     else:
@@ -609,16 +670,18 @@ def _probe_target(
         )
         output.data(f"{'fail' if strict else 'warn'} {msg}")
         return strict, None
-    if target.default_api != inst.api_version:
+    # V27/T125: source-merge — api_version already from default_api unless
+    # --api-version; surface source, never dual-source mismatch fail
+    if inst.api_version == target.default_api:
         output.data(
-            f"fail target: dataset default_api={target.default_api} vs "
-            f"configured {inst.api_version}"
+            f"ok target (api_version from default_api={target.default_api}; "
+            f"erp={target.erp} claimed)"
+        )
+    else:
+        output.data(
+            f"ok target (api_version={inst.api_version} from --api-version; "
+            f"default_api={target.default_api}; erp={target.erp} claimed)"
         )
-        return True, None
-    output.data(
-        f"ok target (default_api={target.default_api} matches configured; "
-        f"erp={target.erp} claimed)"
-    )
     return False, target.erp
 
 

{acumatica_cli-0.15.2 → acumatica_cli-0.15.4}/src/acumatica_cli/config.py

@@ -5,16 +5,22 @@ env prefix ``ACU_``, and the sole config file is ``.env`` (found by walking
 up from cwd) carrying where + secrets as ``ACU_*`` vars. The file is
 optional - flags plus the process environment can supply the full config.
 Per key the first set value wins: flag, ``ACU_*`` var (process environment
-over a found ``.env``), code default. ``base_url`` is the only required
-address (REST data plane); ``ssh`` is optional control-plane address
-(empty = data-plane only; tenant cmds hard-error when unresolved — V1/V3).
-The password must resolve via ``--password`` or ``ACU_PASSWORD``.
+over a found ``.env``), code default — exclusion ``api_version`` (V27/T125):
+``--api-version`` flag ? → else data-repo ``target.yaml`` ``default_api``
+when present → else code default ``25.200.001``; never ``ACU_API_VERSION``
+(unknown ``ACU_*`` ignored). ``base_url`` is the only required address
+(REST data plane). ``ssh`` defaults to ``Administrator@`` + the
+``base_url`` hostname when the key is absent (V3/T124); a present blank
+key is the hosted opt-out (empty = data-plane only; tenant cmds hard-error
+when empty post-default — V1/V3). The password must resolve via
+``--password`` or ``ACU_PASSWORD``.
 """
 
 from collections.abc import Iterator, Mapping
 from importlib import resources
 from pathlib import Path
 from typing import Any
+from urllib.parse import urlparse
 
 from pydantic import ValidationError, field_validator, model_validator
 from pydantic_settings import BaseSettings, DotEnvSettingsSource, SettingsConfigDict
@@ -22,6 +28,8 @@ from pydantic_settings import BaseSettings, DotEnvSettingsSource, SettingsConfig
 from .models import validation_summary
 
 PLACEHOLDER_HOST = "erp.example.com"
+DEFAULT_SSH_USER = "Administrator"
+DEFAULT_API_VERSION = "25.200.001"
 
 ACU_INSTANCE_NAME = "AcumaticaERP"  # ac.exe -iname; IIS app-pool name
 ACU_INSTANCE_PATH = "C:\\Acumatica\\AcumaticaERP"  # ac.exe -h
@@ -124,13 +132,26 @@ INIT_TEMPLATES = (
 )
 
 
+def default_ssh_for_base_url(base_url: str | None) -> str:
+    """``Administrator@<hostname>`` from a REST root, or empty when unparseable.
+
+    T124/V3 code default when ``ACU_SSH`` is absent. Blank key stays empty
+    (hosted opt-out) and never calls this.
+    """
+    if not base_url:
+        return ""
+    host = urlparse(base_url).hostname
+    return f"{DEFAULT_SSH_USER}@{host}" if host else ""
+
+
 class Instance(BaseSettings):
     """The resolved target: flags over ACU_* vars (.env or process) over defaults.
 
-    Explicit addresses, no derivation (V1): ``base_url`` is the REST root
-    (scheme + host + site path); ``ssh`` is the optional control-plane
-    ``user@host`` (empty = data-plane only). Install-layout values are
-    module constants, not fields. Unknown ``ACU_*`` vars are ignored,
+    ``base_url`` is the REST root (scheme + host + site path). ``ssh`` is the
+    control-plane ``user@host``: flag/env when the key is present win
+    (including blank = hosted/data-plane only); key absent → code default
+    ``Administrator@`` + base_url hostname (V3/T124). Install-layout values
+    are module constants, not fields. Unknown ``ACU_*`` vars are ignored,
     never errors - the environment and ``.env`` legitimately carry
     non-config vars (``ACU_DEBUG``).
     """
@@ -142,9 +163,12 @@ class Instance(BaseSettings):
     )
 
     base_url: str  # REST root: scheme + host + site path
-    ssh: str = ""  # control plane: full user@host; empty = data-plane only
+    ssh: str = ""  # control plane: full user@host; empty post-default = data-plane only
     tenant: str = ""
-    api_version: str = "25.200.001"  # V11: /entity/Default/<api_version>/
+    # V11/V27: version half only; resolved in load_instance (flag → target →
+    # code default), never ACU_API_VERSION env. Default here is the code pin
+    # only; env values for this field are discarded post-build (T125).
+    api_version: str = DEFAULT_API_VERSION  # V11: /entity/Default/<api_version>/
     user: str = "admin"  # ACU_USER; the --username flag maps here
     # required, but enforced in load_instance so a blank scaffolded
     # ACU_PASSWORD= placeholder and a missing var raise the same named error
@@ -152,13 +176,15 @@ class Instance(BaseSettings):
 
     @model_validator(mode="before")
     @classmethod
-    def _blank_required_is_unset(cls, data: Any) -> Any:
-        # blank ACU_BASE_URL= / ACU_SSH= reads as unset (V3): base_url then
-        # fails required; ssh falls through to the empty default (optional)
+    def _blank_required_and_ssh_default(cls, data: Any) -> Any:
+        # blank ACU_BASE_URL= reads as unset (V3): base_url then fails required.
+        # ACU_SSH: key absent → Administrator@<base_url host>; key present blank
+        # stays empty (hosted opt-out) — do not strip blank ssh (T124).
         if isinstance(data, dict):
-            for key in ("base_url", "ssh"):
-                if data.get(key) == "":
-                    del data[key]
+            if data.get("base_url") == "":
+                del data["base_url"]
+            if "ssh" not in data:
+                data["ssh"] = default_ssh_for_base_url(data.get("base_url"))
         return data
 
     @field_validator("base_url")
@@ -188,11 +214,12 @@ def scaffold(directory: Path, host: str | None = None) -> Iterator[tuple[str, Pa
     """Write the data-repo template set into ``directory``, never overwriting.
 
     Yields ("write" | "skip", path) per template file. ``host`` replaces the
-    placeholder host inside the scaffolded .env ``ACU_BASE_URL``/``ACU_SSH``
-    values; secrets stay placeholders (V2). Single full seed under
-    ``config/`` + lifecycle ``scenario/`` (V28/T108; no flavor). The
-    directory is created if absent. No git init, no gpg - version control
-    and secret encryption stay the operator's call.
+    placeholder host inside the scaffolded .env ``ACU_BASE_URL`` only
+    (``ACU_SSH`` is omitted — defaults from the base_url host at resolve;
+    hosted opt-out = present blank ``ACU_SSH=``). Secrets stay placeholders
+    (V2). Single full seed under ``config/`` + lifecycle ``scenario/``
+    (V28/T108; no flavor). The directory is created if absent. No git init,
+    no gpg - version control and secret encryption stay the operator's call.
     """
     pkg = resources.files("acumatica_cli") / "templates"
     directory.mkdir(parents=True, exist_ok=True)
@@ -257,13 +284,27 @@ def load_instance(overrides: Mapping[str, str | None] | None = None) -> Instance
 
     ``overrides`` carries the global flags keyed by Instance field name;
     per key the first set value wins (flag, ACU_* var - process environment
-    over a found .env - code default). No .env is fine (V3): the hard error
-    comes only when a required value (base_url, password) is still
-    unresolved after the merge, naming the missing key. ``ssh`` is optional
-    (hosted / data-plane-only path); tenant cmds hard-error when it is empty.
+    over a found .env - code default). Exclusion ``api_version`` (V27/T125):
+    ``--api-version`` flag ? → else ``target.yaml`` ``default_api`` when
+    present → else ``DEFAULT_API_VERSION``; ``ACU_API_VERSION`` is ignored.
+    No .env is fine (V3): the hard error comes only when a required value
+    (base_url, password) is still unresolved after the merge, naming the
+    missing key. ``ssh`` defaults from the base_url host when the key is
+    absent; blank key = hosted path; tenant cmds hard-error when empty
+    post-default.
     """
     flags = {k: v for k, v in dict(overrides or {}).items() if v is not None}
     root = find_data_root()
+    # V27/T125: resolve api_version outside env. Init kwargs beat dotenv/env,
+    # so always inject — ACU_API_VERSION (valid or invalid) is ignored.
+    if "api_version" not in flags:
+        # Local import avoids config↔target cycle (target imports Instance).
+        from .target import load_target
+
+        target = load_target(root)
+        flags["api_version"] = (
+            target.default_api if target is not None else DEFAULT_API_VERSION
+        )
     env_file = root / ".env" if root is not None else None
     try:
         # _env_file is a real BaseSettings init override; the synthesized

{acumatica_cli-0.15.2 → acumatica_cli-0.15.4}/src/acumatica_cli/seed.py

@@ -70,7 +70,7 @@ BOOTSTRAP_ENDPOINT, BOOTSTRAP_ENTITIES = bootstrap.parse_endpoint(
     bootstrap.packaged_contract_xml()
 )
 # Dual-serve error text prefers the symbolic Default form (V20) so operators
-# do not read the code-default version as their configured ACU_API_VERSION.
+# do not read the code-default version as their configured api_version.
 _DEFAULT_ENDPOINT_NAME = "Default"
 _SYMBOLIC_BOOTSTRAP = "bootstrap"
 _SYMBOLIC_DEFAULT = "default"
@@ -113,7 +113,7 @@ def resolve_endpoint(
         if not api_version:
             raise SystemExit(
                 "endpoint: default requires a configured api_version "
-                "(ACU_API_VERSION or --api-version)"
+                "(target.yaml default_api or --api-version)"
             )
         return f"{_DEFAULT_ENDPOINT_NAME}/{api_version}"
     return endpoint
@@ -233,7 +233,7 @@ def load_baseline(path: Path) -> BaselineFile | ActionFile:
     elif parsed.endpoint is None and parsed.entity in entities:
         raise SystemExit(
             f"{path}: entity '{parsed.entity}' is served by both "
-            f"Default (use endpoint: default -> Default/<ACU_API_VERSION>) "
+            f"Default (use endpoint: default -> Default/<api_version>) "
             f"and the active {name} - add an explicit 'endpoint:' line to "
             f"pick one (literal or symbolic 'bootstrap' | 'default')"
         )

{acumatica_cli-0.15.2 → acumatica_cli-0.15.4}/src/acumatica_cli/target.py

@@ -1,9 +1,10 @@
 """Dataset target matrix: committed verified ERP + Default API versions (V27).
 
 ``target.yaml`` is *what* (V2) — co-located with the data-repo root found by
-``.env`` discovery. Never secrets. Present → hard-match ``default_api`` to
-``Instance.api_version`` on allowlisted data-plane cmds and ``config check``;
-missing → warn on check unless ``--strict``; invalid → hard-fail any loader.
+``.env`` discovery. Never secrets. Present → ``load_instance`` sources
+``Instance.api_version`` from ``default_api`` when ``--api-version`` is
+absent (source-merge; dual-source match gate retired — T125); missing →
+warn on check unless ``--strict``; invalid → hard-fail any loader.
 """
 
 from pathlib import Path
@@ -81,20 +82,13 @@ def load_target(root: Path | None = None) -> DatasetTarget | None:
 
 
 def assert_target_compatible(inst: Instance, root: Path | None = None) -> None:
-    """Hard-fail when target.yaml present and default_api mismatches api_version.
+    """Load target when present; invalid → hard-fail (V27).
 
-    Missing target is not an error here (config check --strict owns that).
-    Invalid target always SystemExit. Call only from the allowlisted
-    data-plane commands (V27) — never from bare pass_instance.
+    Version mismatch gate retired (T125): ``load_instance`` source-merges
+    ``default_api`` into ``api_version`` when the flag is absent; flag
+    override is intentional for ad-hoc probes. Missing target is not an
+    error here (config check --strict owns that). Call only from the
+    allowlisted data-plane commands — never from bare pass_instance.
     """
-    target = load_target(root)
-    if target is None:
-        return
-    if target.default_api != inst.api_version:
-        raise SystemExit(
-            "Default API version mismatch:\n"
-            f"  dataset target (target.yaml): default_api={target.default_api}\n"
-            f"  configured (ACU_API_VERSION/--api-version): {inst.api_version}\n"
-            f"Fix: set ACU_API_VERSION={target.default_api} to match this "
-            f"dataset, or use a dataset verified for {inst.api_version}."
-        )
+    del inst  # kept for call-site stability; version match no longer used
+    load_target(root)

{acumatica_cli-0.15.2 → acumatica_cli-0.15.4}/src/acumatica_cli/templates/README.md

@@ -8,7 +8,8 @@ Tenant Factory class). Single full seed — no `--flavor`.
 ## Rebuild order
 
 ```sh
-# 1. Credentials in .env (ACU_PASSWORD, ACU_TENANT, …); keep ACU_API_VERSION in sync with target.yaml
+# 1. Credentials in .env (ACU_PASSWORD, ACU_TENANT, …)
+#    Default API pin = committed target.yaml default_api (not .env)
 acu config check
 
 # 2. Publish Bootstrap (features + contract from config/bootstrap/)

acumatica_cli-0.15.4/src/acumatica_cli/templates/env

@@ -0,0 +1,16 @@
+# scaffolded by `acu config init` - the sole config file: where + secrets,
+# every key an ACU_* var; print the fully resolved document with:
+#   acu config show
+# ACU_BASE_URL (REST root) is required. Control-plane SSH is omitted on
+# purpose: when the key is absent, acu defaults to Administrator@ plus the
+# ACU_BASE_URL hostname (SSH boxes). Hosted / data-plane-only opt-out: add
+# the SSH key with an empty value. Tenant CRUD still needs a non-empty
+# value post-default.
+# Default contract API pin lives in committed target.yaml (default_api),
+# not here — never ACU_API_VERSION (see acu config check / --api-version).
+# Keep this file out of git (the scaffolded .gitignore already lists it;
+# encrypt at rest, e.g. .env.gpg).
+ACU_BASE_URL=http://erp.example.com/AcumaticaERP
+ACU_TENANT=
+ACU_USER=admin
+ACU_PASSWORD=

acumatica_cli-0.15.4/src/acumatica_cli/templates/target

@@ -0,0 +1,7 @@
+# scaffolded by `acu config init` — verified target matrix for this dataset.
+# Edit when you re-verify against a new ERP build or Default API generation.
+# default_api is the sole data-repo Default contract pin (version half only,
+# never Default/<ver>). It sources Instance.api_version when --api-version is
+# absent. There is no ACU_API_VERSION env pin.
+erp: "26.101.0225"
+default_api: "25.200.001"

acumatica_cli-0.15.2/src/acumatica_cli/templates/env

@@ -1,17 +0,0 @@
-# scaffolded by `acu config init` - the sole config file: where + secrets,
-# every key an ACU_* var; print the fully resolved document with:
-#   acu config show
-# ACU_BASE_URL (REST root) is required; ACU_SSH (control-plane user@host)
-# is optional - leave blank for hosted / data-plane-only (tenant CRUD still
-# needs it). The rest are code defaults you can override here.
-# ACU_API_VERSION is the Default contract version half only (e.g. 25.200.001),
-# never "Default/25.200.001". Must match target.yaml default_api when that
-# file exists (see acu config check).
-# Keep this file out of git (the scaffolded .gitignore already lists it;
-# encrypt at rest, e.g. .env.gpg).
-ACU_BASE_URL=http://erp.example.com/AcumaticaERP
-ACU_SSH=Administrator@erp.example.com
-ACU_TENANT=
-ACU_API_VERSION=25.200.001
-ACU_USER=admin
-ACU_PASSWORD=

acumatica_cli-0.15.2/src/acumatica_cli/templates/target

@@ -1,6 +0,0 @@
-# scaffolded by `acu config init` — verified target matrix for this dataset.
-# Edit when you re-verify against a new ERP build or Default API generation.
-# default_api is the version half only (ACU_API_VERSION spelling), not Default/<ver>.
-# Must match ACU_API_VERSION / --api-version (default 25.200.001) or live cmds fail.
-erp: "26.101.0225"
-default_api: "25.200.001"