mammoth-cli 2.2.38__tar.gz → 2.2.40__tar.gz

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mammoth-cli
-Version: 2.2.38
+Version: 2.2.40
 Summary: Command-line interface for the Mammoth Analytics platform
 Project-URL: homepage, https://mammoth.io
 Project-URL: repository, https://github.com/EdgeMetric/mammothsdk
@@ -17,7 +17,7 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: <3.15,>=3.12
 Requires-Dist: jsonschema>=4.20
 Requires-Dist: keyring<26,>=25.7
-Requires-Dist: mammoth-io<0.9,>=0.8.20
+Requires-Dist: mammoth-io<0.9,>=0.8.21
 Requires-Dist: platformdirs<5,>=4.10
 Requires-Dist: pydantic<3,>=2.12.5
 Requires-Dist: pyyaml<7,>=6

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/mammoth_cli/__init__.py

@@ -6,7 +6,7 @@ not implement a second HTTP client and does not call private SDK members.
 
 from __future__ import annotations
 
-__version__ = "2.2.38"
+__version__ = "2.2.40"
 
 # The versioned machine output envelope contract.
 SCHEMA_VERSION = 1

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/mammoth_cli/app.py

@@ -74,6 +74,7 @@ _GROUP_DESCRIPTIONS = {
         "Manage the workspace's API keys (client apps): key + secret credentials "
         "for scripts and integrations."
     ),
+    "token": "Create, list, and revoke long-lived API keys (aliases of client-app).",
     "completion": "Install or print shell completion.",
     "config": "Read and update local CLI configuration.",
     "connector": "Manage data connectors and connector profiles.",
@@ -134,6 +135,7 @@ _ROOT_HELP_PANELS = {
     "annotation": "Manage resources",
     "billing": "Manage resources",
     "client-app": "Manage resources",
+    "token": "Manage resources",
     "external-key": "Manage resources",
     "notification": "Manage resources",
     "parameter": "Manage resources",

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/mammoth_cli/bundled_skill/mammoth-cli/SKILL.md

@@ -8,7 +8,7 @@ description: "Use Mammoth Analytics from a terminal: install or authenticate the
 
 Use this skill for Mammoth shell work, not Python SDK integration. The CLI
 is the contract: it validates requests locally and returns one JSON
-envelope, with no flag needed for that when piped.
+envelope (compact when piped).
 
 ## What Mammoth is
 
@@ -18,15 +18,15 @@ calculated in a **pipeline** of tasks on a **view**, and the result is
 published as a dashboard or delivered as a CSV, a database table, a BI feed
 or another dataset. The pipeline re-runs when new data arrives, so build the
 steps in Mammoth rather than computing a result locally. The web app and
-this CLI call the same API: every Transform-menu task is a `mammoth view
-transform` command. The data model, capabilities and full web-to-CLI map:
+this CLI call the same API: each Transform-menu task is a `view transform`
+command. The data model, capabilities and full web-to-CLI map:
 [about Mammoth](references/about-mammoth.md).
 
 ## Start
 
 ```bash
 mammoth doctor                          # auth, endpoint, connectivity; must succeed
-mammoth project ensure 'PROJECT NAME'   # get-or-create; active project
+mammoth project ensure 'PROJECT NAME'   # active project
 ```
 
 Never proceed if `doctor` fails.
@@ -53,16 +53,17 @@ downloads return `download_url`. On an auth error, ask the user to reload.
 
 ## Defaults you do not repeat
 
-- The CLI remembers which dataset owns each view from any read (`view list
-  DATASET_ID`, `view get VIEW_ID`, an upload). After that, no `dataset_id`
+- The CLI remembers which dataset owns each view from any read (`view list`,
+  `view get`, an upload). After that, no `dataset_id`
   on transforms, exports or deletes. If a command asks for the parent
   `DATASET_ID`, read the view once and repeat it; an explicit value wins.
-- Commands that start platform work wait up to 300 s for the job; on
-  `timeout` use the `job get` recovery command printed, do not resubmit.
+- Commands that start platform work wait up to 300 s; on `timeout` run the
+  `job get` recovery printed, never resubmit. `job wait` returns `outcome`
+  (view rows and state, copy `runs`): no `view get` after it.
 
 ## Find the command for a goal
 
-State the goal in plain words; the search knows common phrasing, and
+State the goal in plain words;
 `view transform --help` is the Transform menu with one line per task:
 
 ```bash
@@ -73,20 +74,21 @@ mammoth schema find "join two datasets; remove duplicates; build a dashboard"
 
 | Goal | Command |
 |---|---|
-| Combine two datasets on a key (merge, VLOOKUP) | `view transform join`; one value per key: `view transform lookup` |
+| Combine two datasets on a key | `view transform join`; one value per key: `view transform lookup` |
 | Add rows to an existing dataset, or combine sources | Local file: `file upload FILE --input '{"append_to_ds_id": DATASET_ID}'`. Already in Mammoth: `view export dataset VIEW_ID --input '{"dataset_name": "NAME"}'`, then per further source `view export dataset VIEW_ID --input '{"dataset_name": "NAME", "target_ds_id": DATASET_ID, "save_as_mode": "APPEND_TO_DS"}'` — combine first, clean once; then `discard-duplicates` and diff `row_count` before/after ([about Mammoth](references/about-mammoth.md#view-settings-and-what-has-no-command)) |
 | Keep or remove rows | `view transform filter` |
 | Remove duplicate rows | read `duplicates`; 0: stop. Else `view transform discard-duplicates` |
-| Totals, counts, averages per group — just to read the number | `view data aggregate` (read-only: `--input '{"group_by": [...], "aggregations": [{"column": ..., "function": "SUM"}]}'` or `{"metric": {...}}`); never add a `pivot` task just to answer a question |
+| Totals, counts, averages per group, to read | `view data aggregate` (read-only: `--input '{"group_by": [...], "aggregations": [{"column": ..., "function": "SUM"}]}'` or `{"metric": {...}}`); never a `pivot` task |
+| Top values, distribution, trend, earliest/latest date, unique count, filter a column | `view data explore VIEW_ID COLUMN` (read-only; `--help` lists the options; `-o csv`) |
 | Totals, counts, averages per group — as a lasting change to the pipeline | `view transform pivot` |
 | A calculated column | `view transform math` |
 | Blanks to a constant, or to the previous row's value | `view transform set-values` (`IS_EMPTY`), `view transform fill-missing` |
 | Clean text | `view transform text`, `replace`, `bulk-replace` |
 | Change a column's type | `view transform convert-type` |
-| Rename a column, sort the rows (view settings, not tasks) | `view transform rename-columns`, `view transform sort` |
+| Rename a column, sort the rows | `view transform rename-columns`, `view transform sort` |
 | Rank, running total, previous row | `view transform window` |
 | A dashboard, or its PDF or slides | `dashboard v3 generate`, then `chat edit` ([dashboards](references/recipes/dashboards.md)) |
-| Deliver the rows | `view export csv`, `view export postgres` (and more), `view export dataset` |
+| Deliver the rows | `view export csv`, `view export postgres`, `view export dataset` |
 | Run something on a schedule or on new data (refresh, append, alert) | `automation create`: a condition (`at_specific_time`, new file in a folder, ...) and tasks (`run_data_retrieval`, `append_data`, `send_an_alert`, `pull_cloud_files`). `schedule create` only pulls a connector's data. A dataset from an uploaded file or URL is a one-time copy with no source to refresh; say so. Recipe and caveats: [recurring work](references/recipes/scheduling.md) |
 
 Call a find result (or `suggestions` entry) from its `accepted_fields` and
@@ -103,9 +105,9 @@ dashboard from t_a and t_b"). Work it out from the data before building:
 
 1. Upload every file, or find the ones already uploaded. An upload result
    carries a `view` preview of what Mammoth made of it (`view_id`, column
-   types, sample rows, `column_warnings`, `before_dashboard`). What Mammoth
-   made of the files is what counts, not the raw files. Run `view data get VIEW_ID` per view;
-   warnings list numbers/dates stored as text, and blanks, each with its fix.
+   types, sample rows, `column_warnings`, `before_dashboard`). Run `view
+   data get VIEW_ID` per view; warnings list numbers/dates stored as text,
+   and blanks, each with its fix.
 2. Find the keys. A column in one view whose values appear in a column of
    the other (`customer_id` and `id`, `order_ref` and `order_no`) is a
    foreign key; the view with many rows per key is the main one.
@@ -140,15 +142,15 @@ your report. If no column links the files, ask before you combine them.
 - Ids are positionals; request fields are one `--input '{...}'` document;
   no per-field flags (`project create NAME`, not `--name`).
 - `COMMAND --help` lists input fields; `schema find WORDS` inlines
-  `accepted_fields`/`agent_example` for top matches, else `mammoth schema
-  get COMMAND_ID` (`--input '{"full": true}'` for the schema); `schema
-  list`/`schema list view` list families.
+  `accepted_fields`/`agent_example` for top matches, else `schema get
+  ID,ID` (one call; `--input '{"full": true}'` for all
+  fields); `schema list`/`schema list view` list families.
 - Uploads return a **dataset** id; transforms, joins, exports and previews
   take the **view** id from `view list DATASET_ID`.
-- `view list` and `view get` return the brief record (id, ds_id, name,
-  status, row_count, `metadata` columns and types, pipeline state);
-  `view get ... --input '{"fields": "__full"}'` or `view list ... --input
-  '{"full": true}'` returns the dependency and display trees too.
+- `view list` gives rows, columns, samples, `built_from`/`feeds`; `view get`
+  the brief record; `view analyze A,B` adds `view` and `steps`. `view get
+  ... --input '{"fields": "__full"}'` or `view list ... --input '{"full":
+  true}'` adds the dependency and display trees.
 - Column inputs/expressions use the exact **display names** the view
   returns, never backend aliases.
 - `--dry-run` on any API-backed command resolves and reports the request

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/mammoth_cli/bundled_skill/mammoth-cli/references/auth.md

@@ -12,6 +12,20 @@ created. When that happens, stop creating projects: ask the operator which
 project the token belongs to and pass `--project ID`, or ask for a token
 created without a project.
 
+## Browser sign-in
+
+`mammoth auth login --method oauth` signs the operator in through the browser (PKCE, loopback
+`127.0.0.1`). The CLI keeps a 1 h `mm_` token and refreshes it under a file lock. `auth status`
+reports `credential: oauth` and `expires_at`. A refresh that fails exits 4 with `login_expired`:
+tell the operator to run `mammoth auth login` again. `--no-browser` prints the URL. Browser sign-in
+is for the operator's own terminal; an agent never runs it. `auth logout` also revokes the
+connection on the server, and warns (still clearing local state) if it cannot.
+
+`mammoth token create NAME`, `token list`, `token revoke KEY` are aliases of `client-app create`,
+`list`, `delete`. `cli_keys_not_allowed` means this server does not let a browser sign-in create
+keys: the operator creates one in **Settings → API keys** and runs
+`mammoth auth login --method token`.
+
 ## Precedence
 1. Explicit login handed to the current command (secure prompt or `--input`).
 2. The selected or `--profile` profile's saved credentials.

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/mammoth_cli/bundled_skill/mammoth-cli/references/capabilities.md

@@ -1,7 +1,7 @@
 # What is proven on release
 
 Generated from `docs/release-capability-matrix.json`; do not edit by hand.
-The CLI publishes 652 commands. 516 of them bind one of the 545 API operations in the matrix; the remainder are local commands (`schema`, `auth`, `doctor`, `log`, ...) or typed variants that share an operation (`view transform *` commands submit through `view.task.add`, except `rename-columns` and `sort`, which set view display properties through `view.update`). 262 bound commands ran once successfully on release, 1 are not supported there, and the rest are untried. Untried is not broken: discover the contract with `mammoth schema get COMMAND_ID`, run it, and treat the structured error envelope as the answer. Use an untried command normally: confirm a write with the user first, check its result with a read afterwards, and never refuse a command only because it is untried.
+The CLI publishes 655 commands. 516 of them bind one of the 545 API operations in the matrix; the remainder are local commands (`schema`, `auth`, `doctor`, `log`, ...) or typed variants that share an operation (`view transform *` commands submit through `view.task.add`, except `rename-columns` and `sort`, which set view display properties through `view.update`). 262 bound commands ran once successfully on release, 1 are not supported there, and the rest are untried. Untried is not broken: discover the contract with `mammoth schema get COMMAND_ID`, run it, and treat the structured error envelope as the answer. Use an untried command normally: confirm a write with the user first, check its result with a read afterwards, and never refuse a command only because it is untried.
 
 Status meanings:
 

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/mammoth_cli/bundled_skill/mammoth-cli/references/command-index.md

@@ -1,6 +1,6 @@
 # Published CLI command catalog
 
-This generated catalog is a lookup table for every command in the published CLI manifest, currently 652; each entry carries its release status line. It is a command-contract index, not an assertion that every backend/OpenAPI operation has a CLI binding. For an exact local CLI contract, run `mammoth schema get COMMAND_ID`; `mammoth capability list` is an API-binding inventory and can omit typed/local CLI routes. For focused workflows, read the [recipes index](recipes/index.md). Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
+This generated catalog is a lookup table for every command in the published CLI manifest, currently 655; each entry carries its release status line. It is a command-contract index, not an assertion that every backend/OpenAPI operation has a CLI binding. For an exact local CLI contract, run `mammoth schema get COMMAND_ID`; `mammoth capability list` is an API-binding inventory and can omit typed/local CLI routes. For focused workflows, read the [recipes index](recipes/index.md). Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Load only the applicable domain file:
 
@@ -44,6 +44,7 @@ Load only the applicable domain file:
 - [snippet](commands/snippet.md) — 8 published commands
 - [support](commands/support.md) — 66 published commands
 - [template](commands/template.md) — 5 published commands
+- [token](commands/token.md) — 3 published commands
 - [trash](commands/trash.md) — 3 published commands
 - [upgrade](commands/upgrade.md) — 1 published commands
 - [user](commands/user.md) — 8 published commands

mammoth_cli-2.2.40/mammoth_cli/bundled_skill/mammoth-cli/references/commands/token.md

@@ -0,0 +1,33 @@
+# `token` commands
+
+Every command returns the standard JSON envelope. On nonzero exit, read the error envelope and its `recovery_commands`; do not guess request fields. "Status on release" is joined from `docs/release-capability-matrix.json`: *ran once* means one bounded live run succeeded on the named CLI release, *untried* means nobody has run it (use it normally: confirm writes with the user, check the result afterwards), *not supported* means the backend refuses it. When this file disagrees with [capabilities](../capabilities.md) or a recipe, they win. Envelope shapes: [machine output](../machine-output.md).
+
+### `token.create`
+
+Run: `mammoth token create`. Exact input fields: `mammoth schema get token.create`.
+
+Example: `mammoth token create 'Revenue report'`. Illustrative only: append `--yes --confirm <EXACT_TARGET>` after observing the target.
+
+Result: `ClientAppCreateResult`; mutation `high_impact`, confirmation `confirm_target`, wait policy `not_async`.
+
+Status on release: untried; no live run recorded.
+
+### `token.list`
+
+Run: `mammoth token list`. Exact input fields: `mammoth schema get token.list`.
+
+Example: `mammoth token list`. Placeholders are illustrative; resolve IDs and input from observed reads.
+
+Result: `ClientAppListResult`; mutation `read`, confirmation `none`, wait policy `not_async`.
+
+Status on release: untried; no live run recorded.
+
+### `token.revoke`
+
+Run: `mammoth token revoke`. Exact input fields: `mammoth schema get token.revoke`.
+
+Example: `mammoth token revoke sample`. Illustrative only: append `--yes` after observing an owned target.
+
+Result: `ClientAppDeleteResult`; mutation `destructive`, confirmation `prompt_or_yes`, wait policy `not_async`.
+
+Status on release: untried; no live run recorded.

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/mammoth_cli/bundled_skill/mammoth-cli/references/operations.md

@@ -150,7 +150,12 @@ applied.
 
 - A trend, distribution or top-values answer: `view data explore VIEW_ID
   COLUMN` (read-only; `level` sets the date bucket). `{"cumulative": true}`
-  adds a running total per bucket, whatever `sort` or `limit` shows. Figures
+  adds a running total per bucket, whatever `sort` or `limit` shows.
+  `{"range": true}` adds the exact earliest and latest value;
+  `{"percentage_of": "metric"}` shares by the `metric`; `sort` `metric_desc`
+  ranks by it; `-o csv` saves the buckets. Excluding a value (`NE`, `not`)
+  drops blank rows, which the web card keeps: `or` it with `IS_EMPTY`. To
+  put a card on a dashboard, say it to `dashboard chat edit`. Figures
   from `explore` and `view data aggregate` are rounded for display (2
   decimals; 4 below 1); `view data compare` keeps full precision.
 - "Who changed X": `activity list` (a change list of time, user, action and a

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/mammoth_cli/commands/auth.py

@@ -1,11 +1,13 @@
 """Bespoke `auth` command family: login, status, logout.
 
-Authentication needs only an API token (``mm_...``, sent as ``Authorization:
-Bearer``), plus an optional server prefix (default ``app``). The token names its
-own workspace, which login learns from the server. There is no environment
-credential path. These commands never accept a secret as an
-ordinary command-line value: it comes from a hidden TTY prompt or a
-permission-checked JSON/YAML login document read through ``--input``.
+Two ways in. A browser sign-in (OAuth, PKCE) stores a refreshable ``mm_`` access
+token; pasting an API token (``mm_...``, sent as ``Authorization: Bearer``)
+stores that token. Either way the token names its own workspace, which login
+learns from the server, and there is an optional server prefix (default
+``app``). There is no environment credential path. These commands never accept
+a secret as an ordinary command-line value: it comes from the browser, a hidden
+TTY prompt, or a permission-checked JSON/YAML login document read through
+``--input``.
 """
 
 from __future__ import annotations
@@ -13,13 +15,14 @@ from __future__ import annotations
 import os
 import stat
 import sys
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any, cast
 
 import typer
 from pydantic import ValidationError
 
-from mammoth_cli.context import credentials, profiles, resolver
+from mammoth_cli.context import credentials, oauth, profiles, resolver
 from mammoth_cli.context.endpoint import resolve_base_url
 from mammoth_cli.context.resolver import ResolvedAuth, resolve_auth
 from mammoth_cli.contracts.auth import LoginRequest
@@ -267,11 +270,114 @@ def _verify_login(invocation: Invocation, *, base_url: str, api_token: str) -> i
     return workspace_id
 
 
+_LOGIN_METHODS = ("oauth", "token")
+
+
+def _choose_method(
+    method: str | None, invocation: Invocation, *, server_prefix: str | None, blockers: list[str]
+) -> str:
+    """Pick ``oauth`` or ``token``: explicit, implied by ``--input``, or asked.
+
+    A server with no CLI OAuth client, a non-interactive run, and ``--input``
+    all keep the token login that existed before browser sign-in.
+    """
+    if method is not None:
+        if method not in _LOGIN_METHODS:
+            raise CliError(
+                code="invalid_login_method",
+                message=f"'{method}' is not a valid --method value.",
+                exit_status=EXIT_USAGE,
+                hint=f"Use one of: {', '.join(_LOGIN_METHODS)}.",
+            )
+        if method == "oauth" and invocation.input_file is not None:
+            raise CliError(
+                code="invalid_argument_combination",
+                message="--input is for token logins; it cannot be used with --method oauth.",
+                exit_status=EXIT_USAGE,
+            )
+        return method
+    if invocation.input_file is not None or blockers:
+        return "token"
+    if not oauth.has_client_id(server_prefix):
+        return "token"
+    typer.echo("How do you want to sign in?", err=True)
+    typer.echo("  1) Browser (OAuth)      recommended", err=True)
+    typer.echo("  3) Paste an API token   for CI and scripts", err=True)
+    choice = typer.prompt("Choose", default="1", show_default=False).strip()
+    if choice not in ("1", "3"):
+        raise CliError(
+            code="invalid_login_method",
+            message=f"'{choice}' is not one of the choices.",
+            exit_status=EXIT_USAGE,
+            hint="Enter 1 for the browser or 3 to paste an API token.",
+        )
+    return "oauth" if choice == "1" else "token"
+
+
+def _iso(epoch: int) -> str:
+    return datetime.fromtimestamp(epoch, UTC).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _run_oauth_login(
+    invocation: Invocation,
+    *,
+    server_prefix: str | None,
+    storage: str,
+    open_browser: bool,
+    interactive: bool,
+) -> tuple[dict[str, Any], dict[str, Any]]:
+    """Sign in through the browser and persist the refreshable session."""
+    base_url = resolve_base_url(server_prefix)
+    client_id = oauth.client_id_for(server_prefix)
+    session = oauth.browser_login(
+        base_url,
+        client_id=client_id,
+        open_browser=open_browser,
+        say=lambda line: typer.echo(line, err=True),
+    )
+    workspace_id = _verify_login(invocation, base_url=base_url, api_token=session.access)
+
+    profile_name = invocation.profile or profiles.DEFAULT_PROFILE_NAME
+    profiles.validate_profile_name(profile_name)
+    existing = profiles.get_profile(profile_name)
+    profiles.save_profile(
+        profiles.ProfileRecord(
+            name=profile_name,
+            workspace_id=workspace_id,
+            server_prefix=server_prefix,
+            project_id=existing.project_id if existing is not None else None,
+        ),
+        select=True,
+    )
+    storage_used = credentials.store_credentials(
+        profile_name,
+        storage=cast(credentials.StorageMode, storage),
+        interactive=interactive,
+        oauth=session,
+    )
+    typer.echo(
+        f"Signed in to workspace {workspace_id}. Credential stored in {storage_used} "
+        f'(profile "{profile_name}"). The token refreshes automatically.',
+        err=True,
+    )
+    data = {
+        "profile": profile_name,
+        "workspace_id": workspace_id,
+        "base_url": base_url,
+        "storage": storage_used,
+        "credential": "oauth",
+        "expires_at": _iso(session.expires_at),
+    }
+    return data, {"profile": profile_name, "workspace_id": workspace_id}
+
+
 def _run_login(
     invocation: Invocation,
     *,
     server_prefix: str | None,
     storage: str,
+    method: str | None = None,
+    no_browser: bool = False,
 ) -> tuple[dict[str, Any], dict[str, Any]]:
     """Validate, connection-check, and persist one `auth login` invocation."""
     if storage not in _STORAGE_MODES:
@@ -284,6 +390,18 @@ def _run_login(
 
     blockers = _prompt_blockers(invocation)
 
+    if (
+        _choose_method(method, invocation, server_prefix=server_prefix, blockers=blockers)
+        == "oauth"
+    ):
+        return _run_oauth_login(
+            invocation,
+            server_prefix=server_prefix,
+            storage=storage,
+            open_browser=not no_browser,
+            interactive=not blockers,
+        )
+
     if invocation.input_file is not None:
         # The permission check is deliberately separate from parsing so a
         # secret-bearing file is rejected before any bytes are read.  The
@@ -367,11 +485,21 @@ def auth_login(
     storage: str = typer.Option(
         "auto", "--storage", help="Credential storage backend.", metavar="auto|keyring|file"
     ),
+    method: str | None = typer.Option(
+        None,
+        "--method",
+        help="How to sign in: a browser (oauth) or a pasted API token (token).",
+        metavar="oauth|token",
+    ),
+    no_browser: bool = typer.Option(
+        False, "--no-browser", help="Print the sign-in URL instead of opening a browser."
+    ),
 ) -> None:
     """Log in and store one profile's credentials.
 
-    Prompts for the API token (mm_..., from Workspace settings -> API Tokens)
-    in a terminal; the token names its workspace. For non-interactive use
+    In a terminal, choose a browser sign-in (OAuth; the CLI keeps a token that
+    refreshes itself) or paste an API token (mm_..., from Workspace settings ->
+    API Tokens). The token names its workspace. For non-interactive use
     (agents, CI), pass ``--input FILE`` with {"api_token": ...} instead.
     Performs a lightweight connection check before saving anything; a failed
     check leaves existing profile state unchanged.
@@ -401,6 +529,8 @@ def auth_login(
             invocation,
             server_prefix=server_prefix,
             storage=storage,
+            method=method,
+            no_browser=no_browser,
         )
 
     executor.run(
@@ -435,6 +565,9 @@ def _run_status(invocation: Invocation, *, check: bool) -> tuple[dict[str, Any],
         "checked": False,
         "connected": None,
     }
+    if credential is not None and credential.oauth is not None:
+        data["expires_at"] = _iso(credential.oauth.expires_at)
+        data["client_id"] = credential.oauth.client_id
     if credential is not None and credential.kind == "key_secret":
         data["recommendation"] = (
             "This profile uses a legacy API key + secret. Create an API token in "
@@ -501,6 +634,29 @@ def auth_status(
     )
 
 
+def _revoke_oauth_connection(profile_name: str, warnings: list[str]) -> None:
+    """Revoke a browser login's server-side connection; warn on failure, never raise.
+
+    Logout must always clear local state, so every failure here (no record, an
+    unreadable keyring, a refused or unreachable server) becomes a warning.
+    """
+    try:
+        credential = credentials.load_credential(profile_name)
+        record = profiles.get_profile(profile_name)
+        if credential is None or credential.oauth is None or record is None:
+            return
+        base_url = resolve_base_url(record.server_prefix)
+        session = credential.oauth
+        if not oauth.is_fresh(session):
+            session = oauth.refresh_session(profile_name, base_url)
+        problem = oauth.revoke_grant(base_url, session)
+    except CliError as exc:
+        problem = f"Could not revoke the connection on the server: {exc.message}"
+    if problem is not None:
+        warnings.append(problem)
+        typer.echo(f"Warning: {problem} Local credentials are still removed.", err=True)
+
+
 def _run_logout(
     invocation: Invocation, *, all_profiles: bool, yes: bool
 ) -> tuple[dict[str, Any], dict[str, Any]]:
@@ -533,21 +689,26 @@ def _run_logout(
             )
 
     removed: list[str] = []
+    warnings: list[str] = []
     if all_profiles:
         # Iterate raw profile names so an unparseable legacy profile (for
         # example one with an unsupported base_url) is still cleaned up rather
         # than blocking the very command meant to remove it.
         for name in profiles.list_profile_names():
+            _revoke_oauth_connection(name, warnings)
             if credentials.delete_credentials(name):
                 removed.append(name)
             profiles.delete_profile(name)
     else:
         profile_name = invocation.profile or profiles.get_selected()
+        _revoke_oauth_connection(profile_name, warnings)
         if credentials.delete_credentials(profile_name):
             removed.append(profile_name)
         profiles.delete_profile(profile_name)
 
-    data = {"removed_profiles": sorted(removed), "all": all_profiles}
+    data: dict[str, Any] = {"removed_profiles": sorted(removed), "all": all_profiles}
+    if warnings:
+        data["warnings"] = warnings
     return data, {}
 
 

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/mammoth_cli/commands/job.py

@@ -26,6 +26,7 @@ from mammoth_cli.errors.envelope import (
 from mammoth_cli.manifest.loader import command_by_id
 from mammoth_cli.runtime.invocation import Invocation
 from mammoth_cli.runtime.session import open_service
+from mammoth_cli.services import job_outcome
 from mammoth_cli.services.board_values import board_values, dashboard_link
 
 HandlerResult = tuple[Any, dict[str, Any]]
@@ -171,6 +172,7 @@ def job_wait(invocation: Invocation) -> HandlerResult:
     try:
         with open_service(invocation) as (service, auth):
             data = _with_board(service, auth, _wait_result(job_id, service.call(symbol, **kwargs)))
+            data = _with_outcome(service, data)
     except KeyboardInterrupt as exc:
         # Keep the explicit handle even when the polling implementation raises
         # a bare SIGINT.  A caller can inspect/resume it without replaying the
@@ -187,6 +189,34 @@ def job_wait(invocation: Invocation) -> HandlerResult:
     return data, _meta(invocation, auth.workspace_id)
 
 
+_DATAVIEW_GET_SYMBOL = "mammoth.api.dataviews.DataviewsAPI.get"
+
+
+def _with_outcome(service: Any, data: dict[str, Any]) -> dict[str, Any]:
+    """Add ``outcome``: the state of what the finished job acted on.
+
+    A job on a view gets that view's rows, columns and state (one read); a project copy
+    gets its copied counts and per-view runs (no read). The job succeeded either way, so
+    a view that cannot be read is an ``outcome_error``, never a failed wait.
+    """
+    copied = job_outcome.copy_outcome(data.get("result"))
+    if copied is not None and data.get("operation") == job_outcome.COPY_PROJECT_OPERATION:
+        return {**data, "outcome": copied}
+    target = job_outcome.view_target(data)
+    if target is None:
+        return data
+    try:
+        record = service.call(
+            _DATAVIEW_GET_SYMBOL,
+            dataset_id=target.dataset_id,
+            dataview_id=target.view_id,
+            project_id=target.project_id,
+        )
+    except CliError as error:
+        return {**data, "outcome_error": f"{error.code}: {error.message}"}
+    return {**data, "outcome": job_outcome.view_outcome(record, target)}
+
+
 #: Jobs that build a board. A build that outlived its own wait hands back a running
 #: job; waiting on it here must report what the build would have: the board's link
 #: and its evaluated numbers (UQA-RT2-05).

{mammoth_cli-2.2.38 → mammoth_cli-2.2.40}/mammoth_cli/commands/project.py

@@ -281,6 +281,9 @@ def project_copy(invocation: Invocation) -> HandlerResult:
     ``PROJECT_ID NAME`` are positional; ``dataset_ids``, ``include_dashboards`` and
     ``exclude_data`` come from ``--input``. The result is the job's:
     ``project_id``, ``dataset_map``, ``view_map``, ``skipped`` and ``dashboards``.
+
+    A taken NAME is not an error: the server names the copy with the next free suffix
+    ("NAME 2", "NAME 3", ...), so there is no need to check the name first.
     """
     source_id = _int_positional(invocation, "project id")
     name = invocation.extra_args[1] if len(invocation.extra_args) > 1 else None