cloudsmith-cli 1.27.0__tar.gz → 1.29.0__tar.gz

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.27.0
+Version: 1.29.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0
@@ -12,7 +12,6 @@ Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: System Administrators
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
@@ -20,23 +19,24 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Internet
 Classifier: Topic :: System :: Systems Administration
 Classifier: Topic :: Utilities
-Requires-Python: >=3.10.0
+Requires-Python: >=3.11.0
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: certifi>=2024.7.4
 Requires-Dist: click!=8.3.0,>=8.2
 Requires-Dist: click-configfile>=0.2.3
 Requires-Dist: click-didyoumean>=0.0.3
 Requires-Dist: click-spinner>=0.1.7
 Requires-Dist: json5>=0.9.0
-Requires-Dist: cloudsmith-api<3.0,>=2.0.31
+Requires-Dist: cloudsmith-api<3.0,>=2.0.38
 Requires-Dist: keyring>=25.4.1
 Requires-Dist: keyrings-alt>=5.0.2
 Requires-Dist: keyrings-cryptfile>=1.3.9
 Requires-Dist: cryptography>=50.0.0
-Requires-Dist: mcp==1.28.1
+Requires-Dist: mcp==2.3.0
 Requires-Dist: pydantic-settings>=2.14.2
 Requires-Dist: PyJWT[crypto]>=2.13.0
-Requires-Dist: python-toon==0.1.2
+Requires-Dist: python-toon==0.2.0
 Requires-Dist: requests>=2.18.4
 Requires-Dist: requests_toolbelt>=1.0.0
 Requires-Dist: rich>=13.0.0
@@ -46,8 +46,11 @@ Requires-Dist: urllib3>=2.5
 Requires-Dist: tomlkit>=0.15.0
 Provides-Extra: aws
 Requires-Dist: boto3[crt]>=1.26.0; extra == "aws"
+Provides-Extra: gcp
+Requires-Dist: google-auth>=2.40.0; extra == "gcp"
 Provides-Extra: all
 Requires-Dist: boto3[crt]>=1.26.0; extra == "all"
+Requires-Dist: google-auth>=2.40.0; extra == "all"
 Dynamic: license-file
 
 # Cloudsmith Command Line Interface (CLI)
@@ -231,6 +234,29 @@ pip install cloudsmith-cli[aws]
 
 This installs `boto3[crt]` for AWS credential chain support, STS token generation, and AWS SSO compatibility.
 
+#### GCP OIDC Support
+
+For Google Cloud environments (GCE, Cloud Run, GKE, Cloud Functions, App Engine, Cloud Build), install with the `gcp` extra to enable automatic credential discovery:
+
+```
+pip install cloudsmith-cli[gcp]
+```
+
+This installs `google-auth` for Application Default Credentials (ADC) resolution and OIDC ID token generation. It works with an attached Google Cloud service account, a service-account key supplied through `GOOGLE_APPLICATION_CREDENTIALS`, or service-account impersonation configured locally:
+
+```sh
+gcloud auth application-default login --impersonate-service-account=SERVICE_ACCOUNT_EMAIL
+cloudsmith whoami --workspace=YOUR_WORKSPACE --oidc-service-slug=YOUR_SERVICE --oidc-detector-order=gcp
+```
+
+Configure a Cloudsmith OIDC provider to trust `https://accounts.google.com`, the service account's numeric unique ID as the subject, and audience `cloudsmith` (override with `--oidc-audience` or `CLOUDSMITH_OIDC_AUDIENCE`). Local impersonation requires the Service Account Token Creator role on the target service account and the IAM Service Account Credentials API enabled.
+
+On workloads with a metadata identity endpoint, the CLI requests an ID token directly. If that endpoint returns HTTP 404 (as on some Cloud Build environments), it uses IAM `generateIdToken` for the same attached service account. This fallback requires the IAM Service Account Credentials API and `iam.serviceAccounts.getOpenIdToken` on that account; the Service Account OpenID Connect Identity Token Creator role grants this permission. Permission and transport failures are reported, not treated as a missing endpoint.
+
+A plain `gcloud auth application-default login` user session cannot mint an ID token for an arbitrary audience. To use it, set `--oidc-audience` to the session's OAuth client ID and configure Cloudsmith to trust that audience and user subject; otherwise use service-account impersonation. `gcloud auth login` alone does not configure ADC. Other ADC types, including direct external-account federation, are skipped rather than incorrectly treated as ID-token-capable credentials.
+
+See Google's [Authenticate with auth libraries](https://docs.cloud.google.com/iam/docs/authenticate-with-auth-libraries#authenticate-standard) guide for credential discovery.
+
 #### All Optional Features
 
 To install all optional dependencies:
@@ -239,7 +265,7 @@ To install all optional dependencies:
 pip install cloudsmith-cli[all]
 ```
 
-**Note:** If you don't install the AWS extra, the AWS OIDC detector will gracefully skip itself with no errors.
+**Note:** If you don't install the AWS or GCP extra, the corresponding OIDC detector will gracefully skip itself with no errors.
 
 #### Bitbucket Pipelines OIDC Support
 
@@ -260,6 +286,10 @@ See the [Bitbucket Pipelines OIDC documentation](https://support.atlassian.com/b
 
 In CircleCI, OIDC credential discovery works out of the box with no extra dependencies — the CLI reads the token from the `CIRCLE_OIDC_TOKEN_V2` (preferred) or `CIRCLE_OIDC_TOKEN` environment variable that CircleCI injects into every job. The Cloudsmith OIDC provider must expect the audience CircleCI mints, which is your CircleCI organization UUID. See the [Cloudsmith CircleCI integration guide](https://docs.cloudsmith.com/integrations/integrating-with-circleci).
 
+#### Buildkite OIDC Support
+
+In Buildkite, OIDC credential discovery works out of the box with no extra dependencies — the CLI requests a token for the current job through `buildkite-agent oidc request-token`. By default it requests the `cloudsmith` audience; use `--oidc-audience` or `CLOUDSMITH_OIDC_AUDIENCE` if your Cloudsmith OIDC provider expects a different audience. See the [Buildkite OIDC documentation](https://buildkite.com/docs/pipelines/security/oidc).
+
 #### Azure DevOps OIDC Support
 
 In Azure DevOps Pipelines, OIDC credential discovery works out of the box with no extra dependencies — the CLI fetches an OIDC token from the `SYSTEM_OIDCREQUESTURI` endpoint using the pipeline's `SYSTEM_ACCESSTOKEN`. Make sure `SYSTEM_ACCESSTOKEN` is mapped into the step's environment. The Cloudsmith OIDC provider must expect the audience `api://AzureADTokenExchange`, which Azure DevOps always mints (any requested audience is ignored). See the [Cloudsmith Azure DevOps integration guide](https://docs.cloudsmith.com/integrations/integrating-with-azure-devops).
@@ -294,7 +324,7 @@ By default the CLI tries each detector in a fixed priority order and uses the fi
 - **Disable a detector** — set `CLOUDSMITH_OIDC_<DETECTOR>_DISABLED=true` to skip it entirely. Only the literal value `true` (case-insensitive) disables; anything else leaves the detector enabled. For example, `CLOUDSMITH_OIDC_AWS_DISABLED=true` skips the AWS detector so an explicitly-set `CLOUDSMITH_OIDC_TOKEN` is picked up by the generic detector instead.
 - **Reorder evaluation** — use `--oidc-detector-order` (or the `CLOUDSMITH_OIDC_DETECTOR_ORDER` environment variable) with a comma-separated list of detector ids to control both which detectors are considered and the order they are tried in (first match wins). Ids not listed are skipped; unrecognised ids are ignored with a warning. For example, `--oidc-detector-order=generic,aws` tries the generic detector first and considers only those two.
 
-When both are set, the order list defines the candidate set and sequence, then the `*_DISABLED` flags are applied on top — so a disabled detector is always skipped even if it appears in the order list. Detector ids are: `aws`, `azure_devops`, `bitbucket`, `circleci`, `generic`, `github`, `gitlab`.
+When both are set, the order list defines the candidate set and sequence, then the `*_DISABLED` flags are applied on top — so a disabled detector is always skipped even if it appears in the order list. Detector ids are: `aws`, `azure_devops`, `bitbucket`, `buildkite`, `circleci`, `gcp`, `generic`, `github`, `gitlab`.
 
 Both controls can also be set in `config.ini`, under `[default]` or a profile section:
 

cloudsmith_cli-1.27.0/cloudsmith_cli.egg-info/PKG-INFO → cloudsmith_cli-1.29.0/README.md

@@ -1,55 +1,3 @@
-Metadata-Version: 2.4
-Name: cloudsmith-cli
-Version: 1.27.0
-Summary: Cloudsmith Command-Line Interface (CLI)
-Author-email: Cloudsmith Ltd <support@cloudsmith.io>
-License-Expression: Apache-2.0
-Project-URL: Homepage, https://github.com/cloudsmith-io/cloudsmith-cli
-Keywords: cloudsmith,cli,devops
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: Environment :: Console
-Classifier: Intended Audience :: Developers
-Classifier: Intended Audience :: System Administrators
-Classifier: Operating System :: POSIX :: Linux
-Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Programming Language :: Python :: 3.14
-Classifier: Topic :: Internet
-Classifier: Topic :: System :: Systems Administration
-Classifier: Topic :: Utilities
-Requires-Python: >=3.10.0
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: click!=8.3.0,>=8.2
-Requires-Dist: click-configfile>=0.2.3
-Requires-Dist: click-didyoumean>=0.0.3
-Requires-Dist: click-spinner>=0.1.7
-Requires-Dist: json5>=0.9.0
-Requires-Dist: cloudsmith-api<3.0,>=2.0.31
-Requires-Dist: keyring>=25.4.1
-Requires-Dist: keyrings-alt>=5.0.2
-Requires-Dist: keyrings-cryptfile>=1.3.9
-Requires-Dist: cryptography>=50.0.0
-Requires-Dist: mcp==1.28.1
-Requires-Dist: pydantic-settings>=2.14.2
-Requires-Dist: PyJWT[crypto]>=2.13.0
-Requires-Dist: python-toon==0.1.2
-Requires-Dist: requests>=2.18.4
-Requires-Dist: requests_toolbelt>=1.0.0
-Requires-Dist: rich>=13.0.0
-Requires-Dist: semver>=2.7.9
-Requires-Dist: starlette>=1.3.1
-Requires-Dist: urllib3>=2.5
-Requires-Dist: tomlkit>=0.15.0
-Provides-Extra: aws
-Requires-Dist: boto3[crt]>=1.26.0; extra == "aws"
-Provides-Extra: all
-Requires-Dist: boto3[crt]>=1.26.0; extra == "all"
-Dynamic: license-file
-
 # Cloudsmith Command Line Interface (CLI)
 
 [![Latest Version @ Cloudsmith](https://api-prd.cloudsmith.io/badges/version/cloudsmith/cli/python/cloudsmith-cli/latest/xf=bdist_wheel;xn=cloudsmith-cli;xv=py2.py3/?render=true)](https://cloudsmith.io/~cloudsmith/repos/cli/packages/detail/python/cloudsmith-cli/latest/xf=bdist_wheel;xn=cloudsmith-cli;xv=py2.py3/)
@@ -231,6 +179,29 @@ pip install cloudsmith-cli[aws]
 
 This installs `boto3[crt]` for AWS credential chain support, STS token generation, and AWS SSO compatibility.
 
+#### GCP OIDC Support
+
+For Google Cloud environments (GCE, Cloud Run, GKE, Cloud Functions, App Engine, Cloud Build), install with the `gcp` extra to enable automatic credential discovery:
+
+```
+pip install cloudsmith-cli[gcp]
+```
+
+This installs `google-auth` for Application Default Credentials (ADC) resolution and OIDC ID token generation. It works with an attached Google Cloud service account, a service-account key supplied through `GOOGLE_APPLICATION_CREDENTIALS`, or service-account impersonation configured locally:
+
+```sh
+gcloud auth application-default login --impersonate-service-account=SERVICE_ACCOUNT_EMAIL
+cloudsmith whoami --workspace=YOUR_WORKSPACE --oidc-service-slug=YOUR_SERVICE --oidc-detector-order=gcp
+```
+
+Configure a Cloudsmith OIDC provider to trust `https://accounts.google.com`, the service account's numeric unique ID as the subject, and audience `cloudsmith` (override with `--oidc-audience` or `CLOUDSMITH_OIDC_AUDIENCE`). Local impersonation requires the Service Account Token Creator role on the target service account and the IAM Service Account Credentials API enabled.
+
+On workloads with a metadata identity endpoint, the CLI requests an ID token directly. If that endpoint returns HTTP 404 (as on some Cloud Build environments), it uses IAM `generateIdToken` for the same attached service account. This fallback requires the IAM Service Account Credentials API and `iam.serviceAccounts.getOpenIdToken` on that account; the Service Account OpenID Connect Identity Token Creator role grants this permission. Permission and transport failures are reported, not treated as a missing endpoint.
+
+A plain `gcloud auth application-default login` user session cannot mint an ID token for an arbitrary audience. To use it, set `--oidc-audience` to the session's OAuth client ID and configure Cloudsmith to trust that audience and user subject; otherwise use service-account impersonation. `gcloud auth login` alone does not configure ADC. Other ADC types, including direct external-account federation, are skipped rather than incorrectly treated as ID-token-capable credentials.
+
+See Google's [Authenticate with auth libraries](https://docs.cloud.google.com/iam/docs/authenticate-with-auth-libraries#authenticate-standard) guide for credential discovery.
+
 #### All Optional Features
 
 To install all optional dependencies:
@@ -239,7 +210,7 @@ To install all optional dependencies:
 pip install cloudsmith-cli[all]
 ```
 
-**Note:** If you don't install the AWS extra, the AWS OIDC detector will gracefully skip itself with no errors.
+**Note:** If you don't install the AWS or GCP extra, the corresponding OIDC detector will gracefully skip itself with no errors.
 
 #### Bitbucket Pipelines OIDC Support
 
@@ -260,6 +231,10 @@ See the [Bitbucket Pipelines OIDC documentation](https://support.atlassian.com/b
 
 In CircleCI, OIDC credential discovery works out of the box with no extra dependencies — the CLI reads the token from the `CIRCLE_OIDC_TOKEN_V2` (preferred) or `CIRCLE_OIDC_TOKEN` environment variable that CircleCI injects into every job. The Cloudsmith OIDC provider must expect the audience CircleCI mints, which is your CircleCI organization UUID. See the [Cloudsmith CircleCI integration guide](https://docs.cloudsmith.com/integrations/integrating-with-circleci).
 
+#### Buildkite OIDC Support
+
+In Buildkite, OIDC credential discovery works out of the box with no extra dependencies — the CLI requests a token for the current job through `buildkite-agent oidc request-token`. By default it requests the `cloudsmith` audience; use `--oidc-audience` or `CLOUDSMITH_OIDC_AUDIENCE` if your Cloudsmith OIDC provider expects a different audience. See the [Buildkite OIDC documentation](https://buildkite.com/docs/pipelines/security/oidc).
+
 #### Azure DevOps OIDC Support
 
 In Azure DevOps Pipelines, OIDC credential discovery works out of the box with no extra dependencies — the CLI fetches an OIDC token from the `SYSTEM_OIDCREQUESTURI` endpoint using the pipeline's `SYSTEM_ACCESSTOKEN`. Make sure `SYSTEM_ACCESSTOKEN` is mapped into the step's environment. The Cloudsmith OIDC provider must expect the audience `api://AzureADTokenExchange`, which Azure DevOps always mints (any requested audience is ignored). See the [Cloudsmith Azure DevOps integration guide](https://docs.cloudsmith.com/integrations/integrating-with-azure-devops).
@@ -294,7 +269,7 @@ By default the CLI tries each detector in a fixed priority order and uses the fi
 - **Disable a detector** — set `CLOUDSMITH_OIDC_<DETECTOR>_DISABLED=true` to skip it entirely. Only the literal value `true` (case-insensitive) disables; anything else leaves the detector enabled. For example, `CLOUDSMITH_OIDC_AWS_DISABLED=true` skips the AWS detector so an explicitly-set `CLOUDSMITH_OIDC_TOKEN` is picked up by the generic detector instead.
 - **Reorder evaluation** — use `--oidc-detector-order` (or the `CLOUDSMITH_OIDC_DETECTOR_ORDER` environment variable) with a comma-separated list of detector ids to control both which detectors are considered and the order they are tried in (first match wins). Ids not listed are skipped; unrecognised ids are ignored with a warning. For example, `--oidc-detector-order=generic,aws` tries the generic detector first and considers only those two.
 
-When both are set, the order list defines the candidate set and sequence, then the `*_DISABLED` flags are applied on top — so a disabled detector is always skipped even if it appears in the order list. Detector ids are: `aws`, `azure_devops`, `bitbucket`, `circleci`, `generic`, `github`, `gitlab`.
+When both are set, the order list defines the candidate set and sequence, then the `*_DISABLED` flags are applied on top — so a disabled detector is always skipped even if it appears in the order list. Detector ids are: `aws`, `azure_devops`, `bitbucket`, `buildkite`, `circleci`, `gcp`, `generic`, `github`, `gitlab`.
 
 Both controls can also be set in `config.ini`, under `[default]` or a profile section:
 

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/check.py

@@ -127,6 +127,4 @@ def service(ctx, opts):
         click.secho("(up-to-date)", fg="green")
 
         click.echo()
-        click.secho(
-            "The API library used by this CLI tool seems to be up-to-date.", fg="green"
-        )
+        click.secho("The API library used by this CLI tool is up-to-date.", fg="green")

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/credential_helper/__init__.py

@@ -27,18 +27,20 @@ def credential_helper():
     manager automatically, or run the runtime command directly for debugging.
 
     Examples:
+
+    \b
         # Install Docker credential helper
         $ cloudsmith credential-helper install docker
-
+    \b
         # Install pnpm credential helper
         $ cloudsmith credential-helper install pnpm
-
+    \b
         # Install cargo credential helper
         $ cloudsmith credential-helper install cargo
-
+    \b
         # Test Docker credential helper directly
         $ echo "docker.cloudsmith.io" | cloudsmith credential-helper docker
-
+    \b
         # Test pnpm credential helper directly
         $ cloudsmith credential-helper pnpm npm.cloudsmith.io
     """

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/credential_helper/docker.py

@@ -33,23 +33,30 @@ def docker(opts, operation):
     ``workspace`` in ``config.ini``; legacy aliases are also accepted - and a
     valid API key/token).
 
+    \b
     Input (stdin):
         Server URL as plain text (e.g. "docker.cloudsmith.io")
 
+    \b
     Output (stdout):
         JSON: {"Username": "token", "Secret": "<cloudsmith-token>"}
 
+    \b
     Exit codes:
         0: Success
         1: Error (no credentials available, not a Cloudsmith registry, etc.)
 
+    \b
     Examples:
+
+    \b
         # Manual testing
         $ echo "docker.cloudsmith.io" | cloudsmith credential-helper docker
-
+    \b
         # Called by Docker via launcher
         $ echo "docker.cloudsmith.io" | docker-credential-cloudsmith get
 
+    \b
     Environment variables:
         CLOUDSMITH_API_KEY: API key for authentication (optional)
         CLOUDSMITH_WORKSPACE: Workspace slug (CLOUDSMITH_ORG is also accepted)

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/credential_helper/terraform.py

@@ -92,13 +92,15 @@ def terraform(opts, repo, params):
 
     \b
     Examples:
+
+    \b
         # Direct usage
         $ cloudsmith credential-helper terraform --repo my-repo terraform.cloudsmith.io
         {"token": "..."}
-
+    \b
         # Terraform's calling convention (verb + hostname)
         $ cloudsmith credential-helper terraform --repo my-repo get terraform.cloudsmith.io
-
+    \b
         # Select an org and profile explicitly (no env vars needed)
         $ cloudsmith credential-helper terraform --org=acme -P ci get terraform.cloudsmith.io
 

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/domains.py

@@ -162,6 +162,7 @@ def list_domains(  # pylint: disable=too-many-arguments
     paginated endpoint, so there is no benefit to hiding entries by default.
     Passing --page or --page-size switches to paged output.
 
+    \b
     Output (stdout):
         JSON: {"version": 1, "domains": [{"host": ..., "format": ...,
         "type": ..., "domain_type": ..., "workspace": ..., "repository": ...,

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/entitlements.py

@@ -775,14 +775,15 @@ def restrict(
 
     Full CLI example:
 
-      $ cloudsmith entitlements restrict cloudsmith/testing-private/9xGSdAxlIqIV \
-        --limit-bandwidth=1 \
-        --limit-bandwidth-unit=gigabyte \
-        --limit-num-clients=10 \
-        --limit-num-downloads=1000 \
-        --limit-package-query="package-darwin-amd64 OR package-windows-amd64 OR package-linux-amd64" \
-        --limit-path-query=tag:latest \
-        --limit-date-range-from=2020-01-01T00:00:00Z \
+    \b
+      $ cloudsmith entitlements restrict cloudsmith/testing-private/9xGSdAxlIqIV \\
+        --limit-bandwidth=1 \\
+        --limit-bandwidth-unit=gigabyte \\
+        --limit-num-clients=10 \\
+        --limit-num-downloads=1000 \\
+        --limit-package-query="package-darwin-amd64 OR package-windows-amd64 OR package-linux-amd64" \\
+        --limit-path-query=tag:latest \\
+        --limit-date-range-from=2020-01-01T00:00:00Z \\
         --limit-date-range-to=2077-01-01T00:00:00Z
     """
     owner, repo, identifier = owner_repo_identifier

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/list_.py

@@ -157,8 +157,20 @@ def entitlements_(*args, **kwargs):  # pylint: disable=missing-docstring
     ),
     help=("Sort packages by field. Prefix with '-' for descending order."),
 )
+@click.option(
+    "--include-connected",
+    is_flag=True,
+    default=False,
+    help=(
+        "Include packages from active connected repositories and show the "
+        "origin repository of each package. Download URLs (e.g. cdn_url, "
+        "signature_url) point at the requesting repository, not the origin."
+    ),
+)
 @click.pass_context
-def packages(ctx, opts, owner_repo, page, page_size, query, sort, page_all):
+def packages(
+    ctx, opts, owner_repo, page, page_size, query, sort, include_connected, page_all
+):
     """
     List packages for a repository.
 
@@ -195,6 +207,7 @@ def packages(ctx, opts, owner_repo, page, page_size, query, sort, page_all):
 
     --query 'name:^foo$ filename:.zip$ architecture:~x86'
 
+    \b
     You can sort the results using --sort with these fields:
       - date/-date: Sort by creation date
       - downloads/-downloads: Sort by download count
@@ -230,6 +243,7 @@ def packages(ctx, opts, owner_repo, page, page_size, query, sort, page_all):
             repo=repo,
             query=query,
             sort=sort,
+            include_connected=include_connected,
         )
 
     if not use_stderr:
@@ -239,6 +253,7 @@ def packages(ctx, opts, owner_repo, page, page_size, query, sort, page_all):
         return
 
     headers = ["Name", "Version", "Status", "Owner / Repository (Identifier)"]
+    sorted_packages = sorted(packages_, key=itemgetter("namespace", "slug"))
     rows = [
         [
             click.style(_get_package_name(package), fg="cyan"),
@@ -250,8 +265,12 @@ def packages(ctx, opts, owner_repo, page, page_size, query, sort, page_all):
                 slug=click.style(package["slug"], fg="green"),
             ),
         ]
-        for package in sorted(packages_, key=itemgetter("namespace", "slug"))
+        for package in sorted_packages
     ]
+    if include_connected:
+        headers.append("Origin Repository")
+        for row, package in zip(rows, sorted_packages):
+            row.append(click.style(_get_origin_repository(package), fg="magenta"))
 
     if packages_:
         click.echo()
@@ -316,3 +335,8 @@ def _get_package_status(package):
 def _get_package_version(package):
     """Get the version for a package (if any)."""
     return package["version"] or "None"
+
+
+def _get_origin_repository(package):
+    """Get the repository that a package physically lives in."""
+    return package["origin_repository"] or package["repository"]

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/main.py

@@ -2,6 +2,7 @@
 
 import click
 
+from ...core import update_check
 from ...core.api.version import get_version as get_api_version
 from ...core.utils import get_github_website, get_help_website
 from ...core.version import get_version as get_cli_version
@@ -56,13 +57,22 @@ For issues/contributing: {get_github_website()}
     is_flag=True,
     is_eager=True,
 )
+@click.option(
+    "--no-check-update",
+    is_flag=True,
+    default=False,
+    envvar="CLOUDSMITH_NO_UPDATE_CHECK",
+    help="Disable the once-a-day check for a newer version of the CLI.",
+)
 @decorators.common_cli_config_options
 @decorators.common_cli_output_options
 @click.pass_context
-def main(ctx, opts, version):
+def main(ctx, opts, version, no_check_update):
     """Handle entrypoint to CLI."""
     # pylint: disable=unused-argument
 
+    update_check.arm(ctx, opts, no_check_update)
+
     if version:
         print_version(opts)
     elif ctx.invoked_subcommand is None:

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/mcp.py

@@ -200,6 +200,7 @@ def configure(ctx, opts, client, is_global):  # pylint: disable=unused-argument
     """
     Configure the Cloudsmith MCP server for supported clients.
 
+    \b
     This command automatically adds the Cloudsmith MCP server configuration
     to the specified client's configuration file. Supported clients are:
     - Claude Desktop
@@ -211,11 +212,12 @@ def configure(ctx, opts, client, is_global):  # pylint: disable=unused-argument
     For Claude Code, --global edits ~/.claude.json (user scope) and
     --local writes ./.mcp.json (project scope, intended to be committed).
 
-    Examples:\n
-        cloudsmith mcp configure --client claude\n
-        cloudsmith mcp configure --client claude-code\n
-        cloudsmith mcp configure --client cursor --local\n
-        cloudsmith mcp configure --client gemini-cli\n
+    \b
+    Examples:
+        cloudsmith mcp configure --client claude
+        cloudsmith mcp configure --client claude-code
+        cloudsmith mcp configure --client cursor --local
+        cloudsmith mcp configure --client gemini-cli
         cloudsmith mcp configure  # Auto-detect and configure all
     """
 

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/metadata.py

@@ -183,7 +183,9 @@ def list_metadata(
             slug_perm = api_get_package_slug_perm(
                 owner=owner, repo=repo, identifier=package
             )
-            entry = api_get_metadata(slug_perm, metadata_slug_perm)
+            entry = api_get_metadata(
+                slug_perm, metadata_slug_perm, credential=opts.credential
+            )
 
         click.secho("OK", fg="green", err=use_stderr)
         _print_metadata_entry(opts, entry)
@@ -208,6 +210,7 @@ def list_metadata(
             page=page,
             page_size=page_size,
             package_slug_perm=slug_perm,
+            credential=opts.credential,
             source_kind=source_kind,
             classification=classification,
         )
@@ -328,6 +331,7 @@ def add_metadata(
         )
         entry = api_create_metadata(
             slug_perm,
+            credential=opts.credential,
             content=metadata.content,
             content_type=metadata.content_type,
             source_identity=metadata.source_identity,
@@ -434,7 +438,9 @@ def update_metadata(
         slug_perm = api_get_package_slug_perm(
             owner=owner, repo=repo, identifier=package
         )
-        entry = api_update_metadata(slug_perm, metadata_slug_perm, **patch_kwargs)
+        entry = api_update_metadata(
+            slug_perm, metadata_slug_perm, credential=opts.credential, **patch_kwargs
+        )
 
     click.secho("OK", fg="green", err=use_stderr)
     _print_metadata_entry(opts, entry)
@@ -463,6 +469,7 @@ def remove_metadata(ctx, opts, owner_repo_package, metadata_slug_perm, yes):
     """
     Remove package metadata.
 
+    \b
     OWNER/REPO/PACKAGE: target package.
     METADATA_SLUG_PERM: permanent slug for the metadata entry.
 
@@ -495,7 +502,7 @@ def remove_metadata(ctx, opts, owner_repo_package, metadata_slug_perm, yes):
         slug_perm = api_get_package_slug_perm(
             owner=owner, repo=repo, identifier=package
         )
-        api_delete_metadata(slug_perm, metadata_slug_perm)
+        api_delete_metadata(slug_perm, metadata_slug_perm, credential=opts.credential)
 
     click.secho("OK", fg="green", err=use_stderr)
 

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/push.py

@@ -7,7 +7,7 @@ import math
 import os
 import shlex
 import time
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 import click
 
@@ -300,7 +300,9 @@ def validate_metadata_payload(
 
     try:
         with maybe_spinner(opts):
-            api_validate_metadata(content=content, content_type=content_type)
+            api_validate_metadata(
+                credential=opts.credential, content=content, content_type=content_type
+            )
     except ApiException as exc:
         http_status = getattr(exc, "status", None)
         detail = (
@@ -385,6 +387,7 @@ def attach_metadata_to_package(
         with maybe_spinner(opts):
             entry = api_create_metadata(
                 slug_perm,
+                credential=opts.credential,
                 content=content,
                 content_type=content_type,
                 source_identity=source_identity,
@@ -681,7 +684,7 @@ def wait_for_package_sync(
             fg="cyan",
         )
 
-    start = datetime.now(tz=timezone.utc)
+    start = datetime.now(tz=UTC)
     context_msg = "Failed to synchronise file!"
     with handle_api_exceptions(
         ctx, opts=opts, context_msg=context_msg, reraise_on_error=skip_errors
@@ -738,7 +741,7 @@ def wait_for_package_sync(
                 if left > 0:
                     pb.update(left)
 
-    end = datetime.now(tz=timezone.utc)
+    end = datetime.now(tz=UTC)
     seconds = (end - start).total_seconds()
 
     click.echo(err=use_stderr)

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/registry.py

@@ -37,6 +37,7 @@ LAZY_COMMANDS = {
     "status": f"{_PACKAGE}.status",
     "tags": f"{_PACKAGE}.tags",
     "tokens": f"{_PACKAGE}.tokens",
+    "update": f"{_PACKAGE}.update",
     "upstream": f"{_PACKAGE}.upstream",
     "vulnerabilities": f"{_PACKAGE}.vulnerabilities",
     "whoami": f"{_PACKAGE}.whoami",
@@ -56,4 +57,5 @@ LAZY_ALIASES = {
     "quarantine": ["block"],
     "repositories": ["repos"],
     "tags": ["tag"],
+    "update": ["upgrade"],
 }

{cloudsmith_cli-1.27.0 → cloudsmith_cli-1.29.0}/cloudsmith_cli/cli/commands/repos.py

@@ -16,27 +16,25 @@ from .main import main
 def print_repositories(opts, data, page_info=None, show_list_info=True, page_all=False):
     """Print repositories as a table or output in another format."""
     headers = [
-        "Name",
+        "Owner / Repository (Identifier)",
         "Type",
         "Packages",
         "Groups",
         "Downloads",
         "Size",
-        "Owner / Repository (Identifier)",
     ]
 
     rows = [
         [
-            click.style(repo["name"], fg="cyan"),
+            "{owner_slug}/{slug}".format(
+                owner_slug=click.style(repo["namespace"], fg="magenta"),
+                slug=click.style(repo["slug"], fg="green"),
+            ),
             click.style(repo["repository_type_str"], fg="yellow"),
             click.style(str(repo["package_count"]), fg="blue"),
             click.style(str(repo["package_group_count"]), fg="blue"),
             click.style(str(repo["num_downloads"]), fg="blue"),
             click.style(str(repo["size_str"]), fg="blue"),
-            "{owner_slug}/{slug}".format(
-                owner_slug=click.style(repo["namespace"], fg="magenta"),
-                slug=click.style(repo["slug"], fg="green"),
-            ),
         ]
         for repo in sorted(data, key=itemgetter("namespace", "slug"))
     ]