vgs-cli 1.36.0.dev3__py3-none-any.whl → 1.37.0.dev1__py3-none-any.whl

{vgs_cli-1.36.0.dev3.data → vgs_cli-1.37.0.dev1.data}/data/vgscli/theme.tcss

@@ -339,6 +339,24 @@ Screen.home #content-scroll {
     color: $error;
 }
 
+#domain-create-options {
+    height: auto;
+    max-height: 12;
+    margin: 1 0;
+    background: $console-elevated;
+    border: none;
+}
+
+#domain-create-input {
+    height: 3;
+    margin: 1 0;
+}
+
+#domain-create-error {
+    height: auto;
+    color: $error;
+}
+
 #resource-yaml {
     height: 1fr;
     min-height: 12;

{vgs_cli-1.36.0.dev3.dist-info → vgs_cli-1.37.0.dev1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vgs-cli
-Version: 1.36.0.dev3
+Version: 1.37.0.dev1
 Summary: VGS Client
 Home-page: https://github.com/verygoodsecurity/vgs-cli
 Author: Very Good Security
@@ -176,8 +176,8 @@ access. The CLI masks generated webhook secrets in its output.
 
 | Command | Purpose |
 | --- | --- |
-| `vgs generate route --protocol http` | Generate an HTTP route template. |
-| `vgs generate route --protocol sftp` | Generate an SFTP route template. |
+| `vgs generate route --protocol http > http-route.yaml` | Generate an HTTP route template. |
+| `vgs generate route --protocol sftp > sftp-route.yaml` | Generate an SFTP route template. |
 | `vgs get routes -T <TENANT_ID>` | List tenant routes. |
 | `vgs apply routes -T <TENANT_ID> -f <FILE>` | Apply tenant routes. |
 | `vgs delete routes -T <TENANT_ID> <ROUTE_ID>` | Delete one tenant route. |
@@ -198,10 +198,23 @@ access. The CLI masks generated webhook secrets in its output.
 | Command | Purpose |
 | --- | --- |
 | `vgs get access-credentials -T <TENANT_ID>` | List tenant access credentials. |
-| `vgs generate access-credentials -T <TENANT_ID>` | Generate tenant access credentials. |
+| `vgs generate access-credentials -T <TENANT_ID>` | Generate tenant access credentials. Capture the output securely as shown below. |
 | `vgs logs access -T <TENANT_ID>` | View tenant access logs. |
 | `vgs logs operations -T <TENANT_ID> -R <REQUEST_ID>` | View request operation logs. |
 
+Access-credential generation is a live mutation that returns secret material.
+Write it to a new, approved absolute path outside version control with
+owner-only permissions, and do not display or inspect it in shared logs:
+
+```bash
+(
+  umask 077
+  set -o noclobber
+  vgs generate access-credentials -T <TENANT_ID> \
+    > /absolute/secure/new-access-credentials.yaml
+)
+```
+
 ### Service accounts
 
 Generate a service-account resource and save the YAML so you can review it

{vgs_cli-1.36.0.dev3.dist-info → vgs_cli-1.37.0.dev1.dist-info}/RECORD

@@ -1,26 +1,26 @@
-vgs_cli-1.36.0.dev3.data/data/vgscli/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
-vgs_cli-1.36.0.dev3.data/data/vgscli/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
-vgs_cli-1.36.0.dev3.data/data/vgscli/console-route-schema.yaml,sha256=hKME9kKILXFWkf-zwbAAWwMoXZWnzFHG37_51SqPKKw,1305
-vgs_cli-1.36.0.dev3.data/data/vgscli/credentials-admin.yaml,sha256=acyLd54Cp7l2fpugfjVfYh07-MIE0BX-JVq4lHraE1s,869
-vgs_cli-1.36.0.dev3.data/data/vgscli/form-template.yaml,sha256=pY4gOd8jXJRohcpJYijBt4m5cPyHvEVlCBtHgs2AL8M,927
-vgs_cli-1.36.0.dev3.data/data/vgscli/http-route-template.yaml,sha256=vGHvBXA_6pwFtH1vVRWKiwxb4sahzuLvpqGAlavrStc,1085
-vgs_cli-1.36.0.dev3.data/data/vgscli/notification-integration-schema.yaml,sha256=1qHzS5ZxlhTdrDab6-qJhszwu7cpith2HleX3uAO_4E,1837
-vgs_cli-1.36.0.dev3.data/data/vgscli/notification-template.yaml,sha256=hr36msbrgiTjWligLHVDHMmO49QDzjTwBSLYoBw3WQE,1288
-vgs_cli-1.36.0.dev3.data/data/vgscli/public-credential-collect.yaml,sha256=CiorC-6TMx7M0TI8DHmoRSfVKDpOom2wIr_ilwmHQNA,696
-vgs_cli-1.36.0.dev3.data/data/vgscli/read-credentials-no-pci.yaml,sha256=_kWRne_ARh8v7A_jHG08gwgPG6NqZhrDRyq6L-ULs2M,769
-vgs_cli-1.36.0.dev3.data/data/vgscli/read-credentials-with-pci.yaml,sha256=jWXgFdcqZYisakAt9COM6cjf2-x_Q4eidDLaUh8CZOk,796
-vgs_cli-1.36.0.dev3.data/data/vgscli/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_1GmGcOvxn0nu49v7ersUjFno,1090
-vgs_cli-1.36.0.dev3.data/data/vgscli/sftp-route-template.yaml,sha256=zkT6lIVDgVyzLKgZ8QnyJJooy2egZk1cQthdjan_JrM,853
-vgs_cli-1.36.0.dev3.data/data/vgscli/tenant-schema.yaml,sha256=xqFEnG6Pcxj3EFsW8URNQexkTo6d6SQK0cMtqsAS5x8,1794
-vgs_cli-1.36.0.dev3.data/data/vgscli/tenant-template.yaml,sha256=ucEV4p2cZ1G43nh1Mt8dcNH4-xtrP9C1XW2LjVM5xD4,914
-vgs_cli-1.36.0.dev3.data/data/vgscli/theme.tcss,sha256=3J_y9kF-sb2tgiqCBZmhJeQrV3Tt9Ac1OB-VOM5r7Tw,7793
-vgs_cli-1.36.0.dev3.data/data/vgscli/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
-vgs_cli-1.36.0.dev3.data/data/vgscli/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
-vgs_cli-1.36.0.dev3.data/data/vgscli/vault-template.yaml,sha256=IlDisL3H5LXUDMkhUaouKMarRdu0-pJxpTz8ij_lp_M,383
-vgs_cli-1.36.0.dev3.data/data/vgscli/vgs-cli.yaml,sha256=5gCjjloyepaKI6zZfDLeUEWxuRExI-dGJI9RO3omP2k,484
-vgs_cli-1.36.0.dev3.dist-info/licenses/LICENSE,sha256=NwSyzgDYdzv6O2ns2C6UODGI8LN1VnVe_FPTnWS4eXY,1082
+vgs_cli-1.37.0.dev1.data/data/vgscli/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
+vgs_cli-1.37.0.dev1.data/data/vgscli/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
+vgs_cli-1.37.0.dev1.data/data/vgscli/console-route-schema.yaml,sha256=hKME9kKILXFWkf-zwbAAWwMoXZWnzFHG37_51SqPKKw,1305
+vgs_cli-1.37.0.dev1.data/data/vgscli/credentials-admin.yaml,sha256=acyLd54Cp7l2fpugfjVfYh07-MIE0BX-JVq4lHraE1s,869
+vgs_cli-1.37.0.dev1.data/data/vgscli/form-template.yaml,sha256=pY4gOd8jXJRohcpJYijBt4m5cPyHvEVlCBtHgs2AL8M,927
+vgs_cli-1.37.0.dev1.data/data/vgscli/http-route-template.yaml,sha256=vGHvBXA_6pwFtH1vVRWKiwxb4sahzuLvpqGAlavrStc,1085
+vgs_cli-1.37.0.dev1.data/data/vgscli/notification-integration-schema.yaml,sha256=1qHzS5ZxlhTdrDab6-qJhszwu7cpith2HleX3uAO_4E,1837
+vgs_cli-1.37.0.dev1.data/data/vgscli/notification-template.yaml,sha256=hr36msbrgiTjWligLHVDHMmO49QDzjTwBSLYoBw3WQE,1288
+vgs_cli-1.37.0.dev1.data/data/vgscli/public-credential-collect.yaml,sha256=CiorC-6TMx7M0TI8DHmoRSfVKDpOom2wIr_ilwmHQNA,696
+vgs_cli-1.37.0.dev1.data/data/vgscli/read-credentials-no-pci.yaml,sha256=_kWRne_ARh8v7A_jHG08gwgPG6NqZhrDRyq6L-ULs2M,769
+vgs_cli-1.37.0.dev1.data/data/vgscli/read-credentials-with-pci.yaml,sha256=jWXgFdcqZYisakAt9COM6cjf2-x_Q4eidDLaUh8CZOk,796
+vgs_cli-1.37.0.dev1.data/data/vgscli/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_1GmGcOvxn0nu49v7ersUjFno,1090
+vgs_cli-1.37.0.dev1.data/data/vgscli/sftp-route-template.yaml,sha256=zkT6lIVDgVyzLKgZ8QnyJJooy2egZk1cQthdjan_JrM,853
+vgs_cli-1.37.0.dev1.data/data/vgscli/tenant-schema.yaml,sha256=xqFEnG6Pcxj3EFsW8URNQexkTo6d6SQK0cMtqsAS5x8,1794
+vgs_cli-1.37.0.dev1.data/data/vgscli/tenant-template.yaml,sha256=ucEV4p2cZ1G43nh1Mt8dcNH4-xtrP9C1XW2LjVM5xD4,914
+vgs_cli-1.37.0.dev1.data/data/vgscli/theme.tcss,sha256=6teLRfBJkyWzIx8y6OjB8MW_DjIujuLjj01OtfQApus,8050
+vgs_cli-1.37.0.dev1.data/data/vgscli/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
+vgs_cli-1.37.0.dev1.data/data/vgscli/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
+vgs_cli-1.37.0.dev1.data/data/vgscli/vault-template.yaml,sha256=IlDisL3H5LXUDMkhUaouKMarRdu0-pJxpTz8ij_lp_M,383
+vgs_cli-1.37.0.dev1.data/data/vgscli/vgs-cli.yaml,sha256=5gCjjloyepaKI6zZfDLeUEWxuRExI-dGJI9RO3omP2k,484
+vgs_cli-1.37.0.dev1.dist-info/licenses/LICENSE,sha256=NwSyzgDYdzv6O2ns2C6UODGI8LN1VnVe_FPTnWS4eXY,1082
 vgscli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-vgscli/_version.py,sha256=VnNtk3D2RWEWuquUhMYrSh-jqlwTpGSMQBsMNPfLl2A,1681
+vgscli/_version.py,sha256=xjR9tC_jCHh0Buw1P5a1jVVZFzFeTEVlQFb8oviRwos,1681
 vgscli/access_logs.py,sha256=G0GjlLjWiC-N6OzK6-RCvWddcVGQlLCLAcyO9pLWIOM,1928
 vgscli/audits_api.py,sha256=AaF5Go019TOerBlQzygwMeOxeW9vPPJPgxa95kttF-M,3215
 vgscli/auth.py,sha256=vdUZ12nqtefIuSHNmwCFvxoqwS3m6ZP5TqLZFNwKnSU,2104
@@ -28,7 +28,7 @@ vgscli/auth_server.py,sha256=J12vthy2FhOr4Kfyp1waxu3bFErV_kXAycE8rcBKYW8,4993
 vgscli/auth_utils.py,sha256=aC1VI0dFdFeupLS9Okz4uDz-wHhhFabqiLUg2R5vO2s,600
 vgscli/callback_server.py,sha256=yOB9YuAy1JcpMcsvuBQmF3EB1qQND-uiirAmbAjrulY,1533
 vgscli/calm_api.py,sha256=5ZZhJUCuA2E5X670L-EkB_mL2kqHPrYy-ca6WtwTacg,1384
-vgscli/cert_manager_api.py,sha256=b_IEIZFLY7Q4ygThWcUUR8Ynr02MXgVVe9qDFE7CQUc,1650
+vgscli/cert_manager_api.py,sha256=aIRS8d_uL7skTghqMwyfGZhz-TQqFExp6J786aRwP88,1725
 vgscli/cli_progress.py,sha256=Kpc7iZo0zO6YX3WynteBELuWSYGVvqEjKLq2E5x4lnE,2520
 vgscli/cli_utils.py,sha256=uwYzRSIMlPTM1WHlaWVebrg6mIIp0VaPu5YldkMmGUw,3779
 vgscli/click_extensions.py,sha256=m-RpaPaH69m4caYbuiu0j2blxeyy8c8hA0Tvygw1Mvc,7271
@@ -45,7 +45,7 @@ vgscli/notifications.py,sha256=6D8HFDEl3X4V0V9fYZT-9nWYe2KYVahfhRLMF0pbh4I,6252
 vgscli/notifications_api.py,sha256=1EXmRb2fOJrU1QOAZ6gmq8yMjBLhNZGSVs3kRtD2Dfw,2342
 vgscli/payment_accounts_api.py,sha256=wF6K3m7nlKtPmqO9RCpmGFSXYHWtwfhXqNfgI1IGqFI,1665
 vgscli/payment_credentials_api.py,sha256=Gwz5tLIS1gRc2Hzi877_mynznNOKEGF-VoKzxqkj-mM,2169
-vgscli/recovery_journal.py,sha256=FwDlu52YLvVRaQSqKX_xyUx48DRyez6mGOtTFbeu2b0,5485
+vgscli/personalization_api.py,sha256=mtbtJYX9pKG5CC7CBSiOfs6O1K8UOpergs6kAKUWaYI,1415
 vgscli/secure_store.py,sha256=wRLQv6qrTp1PJkb5N1zSmv2bA5NSJjEhqMNMFMoSbiY,3625
 vgscli/telemetry.py,sha256=BFkAe0Bxm96xiffIOsfPY6Q6Lv5xueJBIwGfLmctXRE,25755
 vgscli/tenant_configuration.py,sha256=mX6DUFNOr8Rnppzpw6SMV_FADLWm8w543_jYvipOxdE,6404
@@ -58,7 +58,7 @@ vgscli/vgs.py,sha256=pciuwbJGV0i-4HhpirTfyqa8JTdM12Zrcm8ulHD-kN0,7395
 vgscli/cli/__init__.py,sha256=da9LPKYdnal26ntEP22PNn-dZYBbsNkP7tzOwzD6kY4,3915
 vgscli/cli/commands/__init__.py,sha256=8ptc9-Vzdx0HU3ZeMcKERYjmJyuB5IMjBSF3Igx5yQ4,206
 vgscli/cli/commands/apply.py,sha256=_BKC1cRLbDGF1T05UEnqTGLKllfGYY6Piw6qr0YJYTU,26193
-vgscli/cli/commands/certificate.py,sha256=cy8oRiEkUYfFExCG5GdjYqEJ91rCgA6hy98cpHkorHM,22994
+vgscli/cli/commands/certificate.py,sha256=JjZFLvfMKeAL65s-y7DwtqpkTrmGKJ84ywdZyVT5ajQ,30038
 vgscli/cli/commands/delete.py,sha256=6cfYVczMmXo8nv6yXRsHP6Na8fsJJsPovfos_9JPTxw,4080
 vgscli/cli/commands/generate.py,sha256=6SkeXN7lyzllezjYliWQ_CUncMWbDFX1Jx_1vlwDCh8,5512
 vgscli/cli/commands/get.py,sha256=EuFeEw0oLHht9b0IbWwkF2gxABbaGKcKxCEingK5MPw,9790
@@ -66,34 +66,38 @@ vgscli/cli/types/__init__.py,sha256=a-P-SoGHpLzMg7CL1hhg5x_nf6sHq0qAuGm_AtIITmw,
 vgscli/cli/types/resource_id.py,sha256=7JILR-KjoVGQDHB40tXJfTcU53iR8wM9Zr24fY5le3o,1172
 vgscli/cli/types/variable.py,sha256=IVcszPoWmTjeo_evDsLN06LuUZGTLL-wcZCVfBNBP8I,414
 vgscli/console/__init__.py,sha256=X48mjIkHuvVqtCrsN4vJ7CubJrL4xAE678jm1AFSm1o,44
-vgscli/console/app.py,sha256=WqYlMesMbN5GDqO9Iv4k_j80QN2xyfxbs2PLm6SpePE,116429
+vgscli/console/app.py,sha256=r72EeHI57VJy1J9OyoYbRWcUW2o9cN5t-PC6Dfbe5UE,122762
 vgscli/console/auth.py,sha256=PpIvuFCxTLSHiDmmOSU67nbsdru78pT4cmaD_TmBbU0,1517
-vgscli/console/backend.py,sha256=DHelXVKwySaVQUgU6qMpmoKmrzgKf1cqttIAnVU-xvw,13010
+vgscli/console/backend.py,sha256=HY8g87bg_aRiQyDE3JzRg8JFhlWok6H-JSs_dm7cN-M,17866
 vgscli/console/bootstrap.py,sha256=R75enSa2MrAJ4jWl-IDvpansglIa02R28N7CfKCh3Vs,1121
-vgscli/console/capability_screen.py,sha256=3hQdHB2imt6UnlHMbw3U1fkqIIti5HMVXJiVc8Yj9Tg,7578
-vgscli/console/commands.py,sha256=3sAWTmNCiRby37bQ9edpyp6CR_-VVKwyP3RfVT2VTJY,3946
+vgscli/console/capability_screen.py,sha256=QiXPDQlzRW250-yYq2XqKbrIhezE_Gf_gfe85_iRGU0,7324
+vgscli/console/commands.py,sha256=GF_7DzZIAJzaGTZqODV6oErIF5Wrtp2jCJAqXhMTUEI,3867
 vgscli/console/context.py,sha256=TgDgsqt52pbSeLsTZ-VX6PHuQFJTSUSrl4y2I36tquk,1719
+vgscli/console/domain_create_screen.py,sha256=usrqHea97RmjRG11u-2ro5cxySEEF7EVDFUoll0TYik,10438
+vgscli/console/domain_delete_screen.py,sha256=-0RH2tnTXCQiLVKrodfCqQ_lBbBioyAaWeI-Hly0YLc,5684
+vgscli/console/domain_screen.py,sha256=GSHE0D5MqYXmYd0KbvXVVRU1Eaeq2j9J83B-1zulb4Q,5579
 vgscli/console/form_editor.py,sha256=o5u4aUWWOOaCAyI7Djco0yLR4po2bHLapyVwbMbHFNk,5268
 vgscli/console/intro.py,sha256=cZ93gvP0czRpoGbu9HB1QGrJYJ6DMtvX_EVlTg9DEvQ,5348
-vgscli/console/mutation_screen.py,sha256=21xwQNZuWnAOidzYC4konDMSPQdcNf1CfiHY04pp1eM,28417
+vgscli/console/mutation_screen.py,sha256=7uhUS7t-53i-bTa9YKKHnWfJV6c2oQpv7YNRqXF1h9c,24819
 vgscli/console/responsive.py,sha256=C1jVLg_kunp8maeQl9W2KumDuKWFev2iL-ZXiQvyN4w,688
-vgscli/console/tenant_onboarding_screen.py,sha256=b-nxzUL7PtB_ZJnIGEKzX8PL8eBATvROCuWLQrrvF0A,26180
-vgscli/console/theme.tcss,sha256=3J_y9kF-sb2tgiqCBZmhJeQrV3Tt9Ac1OB-VOM5r7Tw,7793
+vgscli/console/tenant_onboarding_screen.py,sha256=7tiXgqkRRBdrkhQBEiJU91lopGs_LYs701RakHrxhts,24155
+vgscli/console/theme.tcss,sha256=6teLRfBJkyWzIx8y6OjB8MW_DjIujuLjj01OtfQApus,8050
 vgscli/console/workflows/__init__.py,sha256=NGtIiPpn-y2EQKXlt40G4nLlLZ1y9se_KewknReDiKI,212
-vgscli/console/workflows/forms.py,sha256=ob7GpX8Ig7h6WFaAzW663Lge8RVEGbtwGa4Z3N_AZj0,1310
-vgscli/console/workflows/mutation.py,sha256=mkjrWnEpRGgb1SRuWs2xh37NdSCx71gsV2GTpZFR7pg,9195
-vgscli/console/workflows/routes.py,sha256=kliVIEj9KzznRZ5KRkA91vzsihnq9UpCv3k_2zavmXw,1499
-vgscli/console/workflows/tenant.py,sha256=8sdsaKKPiThQLhwG123g6F8f4xUWdYZzJcsVewpFdx8,7997
+vgscli/console/workflows/forms.py,sha256=_sxRraE_jVg67chsYA4txdcBZPqjxReIPQy5XjqVJVE,201
+vgscli/console/workflows/mutation.py,sha256=1fdkKTrj-sg-IIAVVuPNLHIU_kQCwnWhDFnY9evxCFQ,6956
+vgscli/console/workflows/routes.py,sha256=Pz-wg7nkj2BACyDLpS-52TQnoU52LJ0rZLmOCMxdG-k,205
+vgscli/console/workflows/tenant.py,sha256=dHH7iv_oaGZcSXOoSQpCc8V1OVsuGtv3ujomYXCwCKo,4167
 vgscli/operations/__init__.py,sha256=o5WOygn8wXdVcpKXqVL8kLDc0MS1jZumb1yGECiupiw,74
+vgscli/operations/certificates.py,sha256=2G9-iEYzYKWQZgVZTs4JsEkGmgHBop3I30Eh_QD6BUw,7721
 vgscli/operations/context.py,sha256=jA8BToRVCx-ZCsEV05tfENuTaYGzaw0acjokuCVxpbQ,1538
 vgscli/operations/documents.py,sha256=sfHmI4uyDH1weDFkLeF4QmwDjzp0Op_XA8kYQ5RnDtU,827
 vgscli/operations/errors.py,sha256=4MQN71x7COJSAz7wEYd8Wxq2D5spT8VaGM8eukMbncE,3744
 vgscli/operations/form_documents.py,sha256=IZucBFeGLCzsXS_NukA_8fmHycjDq-dpC_I8kj8ZnXU,3695
-vgscli/operations/forms.py,sha256=cN5oJLvPDDNqoiYP8d-N8q5-kJ8Awo53YoRSlWikrsg,5585
+vgscli/operations/forms.py,sha256=ocIenT2xlE-TtmrCP-q4Bfmz_uX9JnjwZzz4nkGiiJQ,5184
 vgscli/operations/logs.py,sha256=69gIjPhjjtLcoZFITUEYXnMMaRQbE5hEGsMgeNoGMfg,5956
-vgscli/operations/models.py,sha256=NoyAIe3iC56t8f0u77rJC5TsgnNKhO1lD3TDI9jKXi8,1396
+vgscli/operations/models.py,sha256=YVpYAO7xxCMgHYItIPR5oW-GtCledBlQRC9oB5aGTy8,1618
 vgscli/operations/payment_credentials.py,sha256=b0iH68UeAdfUpR_B4Da2Wpj-lwcNsEEH11Xrvb-HPw0,10798
-vgscli/operations/routes.py,sha256=HgVbxYufi2Em0odqG3fM-SyBY8j_kQmUBiXwnLwRU58,8165
+vgscli/operations/routes.py,sha256=oJ0EbG_M9mjXex_aBA2TNXO7XVbp7UD1jkIO2G_YyrU,7309
 vgscli/operations/tenant_details.py,sha256=vtzxYjUFyjToweKf3ZqdBMB14P87USpqNzxWW1SuL_U,3364
 vgscli/resource-templates/form-template.yaml,sha256=pY4gOd8jXJRohcpJYijBt4m5cPyHvEVlCBtHgs2AL8M,927
 vgscli/resource-templates/http-route-template.yaml,sha256=vGHvBXA_6pwFtH1vVRWKiwxb4sahzuLvpqGAlavrStc,1085
@@ -114,8 +118,8 @@ vgscli/validation-schemas/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_
 vgscli/validation-schemas/tenant-schema.yaml,sha256=xqFEnG6Pcxj3EFsW8URNQexkTo6d6SQK0cMtqsAS5x8,1794
 vgscli/validation-schemas/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
 vgscli/validation-schemas/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
-vgs_cli-1.36.0.dev3.dist-info/METADATA,sha256=RFTdfTZri8fVGIcyZqDNzex1fpkEU5Qz8xYwfJW_Hwg,9969
-vgs_cli-1.36.0.dev3.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-vgs_cli-1.36.0.dev3.dist-info/entry_points.txt,sha256=wCWhRQiMX4Ja6kkqJlYr8LbuiywpmXyyRAZPsau-_RY,39
-vgs_cli-1.36.0.dev3.dist-info/top_level.txt,sha256=gabTxCWMkl80q6ha_m-hs_1wQMfGntZcv5DEmkl8JEw,7
-vgs_cli-1.36.0.dev3.dist-info/RECORD,,
+vgs_cli-1.37.0.dev1.dist-info/METADATA,sha256=IU_6ZwK1MoqaKvmFQkG1skQ7jVkT3UK7T3b-aqaCSlg,10422
+vgs_cli-1.37.0.dev1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+vgs_cli-1.37.0.dev1.dist-info/entry_points.txt,sha256=wCWhRQiMX4Ja6kkqJlYr8LbuiywpmXyyRAZPsau-_RY,39
+vgs_cli-1.37.0.dev1.dist-info/top_level.txt,sha256=gabTxCWMkl80q6ha_m-hs_1wQMfGntZcv5DEmkl8JEw,7
+vgs_cli-1.37.0.dev1.dist-info/RECORD,,

vgscli/_version.py

@@ -6,7 +6,7 @@ from packaging.version import InvalidVersion, Version
 
 from vgscli.text import bold, green
 
-__version__ = "1.36.0.dev3"
+__version__ = "1.37.0.dev1"
 
 
 # noinspection PyBroadException

vgscli/cert_manager_api.py

@@ -20,6 +20,7 @@ class CertificatesResource(Resource):
             "url": "api/certificates/{}/certificate",
         },
         "create_csr": {"method": "POST", "url": "api/certificates/csr"},
+        "metadata": {"method": "GET", "url": "api/certificates/metadata"},
     }
 
 

vgscli/cli/commands/certificate.py

@@ -10,13 +10,22 @@ from pathlib import Path
 from typing import Any
 
 import click
+import requests
 
 from vgscli.auth import token_util
 from vgscli.cert_manager_api import create_cert_manager_api
 from vgscli.cli_utils import dump_camelized_yaml
 from vgscli.click_extensions import tenant_option
 from vgscli.errors import handle_errors
-from vgscli.telemetry import TelemetryGroup
+from vgscli.operations.certificates import (
+    BRANDED_DOMAIN_TYPE,
+    COLLECT_CDN_URLS,
+    SDK_ENABLEABLE_STATUSES,
+    allowed_vgs_domains,
+    validate_domain_name,
+)
+from vgscli.personalization_api import create_personalization_api
+from vgscli.telemetry import TelemetryGroup, request_headers
 
 logger = logging.getLogger(__name__)
 
@@ -231,6 +240,59 @@ def _assert_certificate_is_downloadable(
         )
 
 
+def _assert_certificate_sdk_enableable(
+    api: Any, *, vault: str, domain_or_id: str
+) -> str:
+    """
+    Enabling for SDKs requires an issued, currently-valid branded domain
+    certificate. Returns the resolved domain name to enable.
+    """
+    cert_item = _resolve_certificate_metadata(
+        api, vault=vault, domain_or_id=domain_or_id
+    )
+
+    if _is_csr_resource(cert_item):
+        cert_id = cert_item.get("id") or domain_or_id
+        raise click.ClickException(
+            f"Cannot enable a CSR for SDKs. Target '{cert_id}' is a CSR, not an "
+            "issued branded domain certificate."
+        )
+
+    attrs = (
+        cert_item.get("attributes")
+        if isinstance(cert_item.get("attributes"), dict)
+        else {}
+    )
+    cert_id = cert_item.get("id") or domain_or_id
+    cert_type = attrs.get("type")
+    if (
+        not isinstance(cert_type, str)
+        or cert_type.strip().upper() != BRANDED_DOMAIN_TYPE
+    ):
+        raise click.ClickException(
+            f"Certificate '{cert_id}' is not a branded domain certificate. "
+            "Only branded domains can be enabled for SDKs."
+        )
+
+    try:
+        resolved_domain = validate_domain_name(attrs.get("domain"))
+    except ValueError:
+        raise click.ClickException(
+            f"Certificate '{cert_id}' has no valid hostname. "
+            "Only branded domains with a hostname can be enabled for SDKs."
+        )
+
+    status = attrs.get("status")
+    if status not in SDK_ENABLEABLE_STATUSES:
+        cert_id = cert_item.get("id") or domain_or_id
+        raise click.ClickException(
+            f"Certificate '{cert_id}' has status '{status}'. Enabling for SDKs "
+            "requires status VALID or RENEWAL_REQUIRED."
+        )
+
+    return resolved_domain
+
+
 def _looks_like_backend_500(exc: BaseException) -> bool:
     status = getattr(exc, "status", None) or getattr(exc, "status_code", None)
     if status == 500:
@@ -276,22 +338,29 @@ def _fetch_public_certificate_payload(
         raise
 
 
-def _get_api(ctx: click.Context, vault: str):
+def _resolve_env(ctx: click.Context) -> str:
     """
     Env resolution order:
       1) ctx.obj.env (normal CLI flow)
       2) root click params (if ctx.obj isn't initialized)
       3) DEFAULT_ENV ("prod")
     """
-    token = token_util.get_access_token()
-
     env = getattr(getattr(ctx, "obj", None), "env", None)
     if not env:
         env = (ctx.find_root().params or {}).get("environment")
     if not env:
         env = DEFAULT_ENV
+    return env
+
+
+def _get_api(ctx: click.Context, vault: str):
+    token = token_util.get_access_token()
+    return create_cert_manager_api(vault, _resolve_env(ctx), token)
 
-    return create_cert_manager_api(vault, env, token)
+
+def _get_personalization_api(ctx: click.Context, vault: str):
+    token = token_util.get_access_token()
+    return create_personalization_api(vault, _resolve_env(ctx), token)
 
 
 def _der_to_pem_certificate(der_bytes: bytes) -> str:
@@ -341,9 +410,47 @@ def certificate_list(ctx: click.Context, vault: str) -> None:
     )
 
 
+@certificate.command("metadata")
+@tenant_option
+@click.pass_context
+@handle_errors()
+def certificate_metadata(ctx: click.Context, vault: str) -> None:
+    """
+    Show this tenant's allowed certificate authorities and VGS domain
+    suffixes for branded domains (used to build DigiCert subdomains and to
+    check which authorities `certificate create --authority` may use).
+    """
+    api = _get_api(ctx, vault)
+    response = api.certificates.metadata(params={"vault_identifier": vault})
+
+    click.echo(
+        dump_camelized_yaml(
+            {
+                "apiVersion": "1.0.0",
+                "kind": "CertificateMetadata",
+                "data": response.body,
+            }
+        )
+    )
+
+
 @certificate.command("create")
 @tenant_option
-@click.option("--domain", "-d", required=True)
+@click.option(
+    "--domain",
+    "-d",
+    required=False,
+    help="Full branded domain name. Required unless --subdomain is used with --authority digicert.",
+)
+@click.option(
+    "--subdomain",
+    required=False,
+    help=(
+        "Subdomain to combine with this tenant's allowed VGS domain suffix "
+        "(DigiCert branded domains only). Mutually exclusive with --domain. "
+        "See `vgs certificate metadata` for the allowed suffix."
+    ),
+)
 @click.option(
     "--authority",
     "-a",
@@ -353,20 +460,53 @@ def certificate_list(ctx: click.Context, vault: str) -> None:
 @click.pass_context
 @handle_errors()
 def certificate_create(
-    ctx: click.Context, vault: str, domain: str, authority: str
+    ctx: click.Context,
+    vault: str,
+    domain: str | None,
+    subdomain: str | None,
+    authority: str,
 ) -> None:
+    normalized_authority = authority.upper().replace("-", "_")
+
+    if domain and subdomain:
+        raise click.UsageError("Use either --domain or --subdomain, not both.")
+
+    if subdomain and normalized_authority != "DIGICERT":
+        raise click.UsageError(
+            "--subdomain is only supported with --authority digicert."
+        )
+
+    if not domain and not subdomain:
+        raise click.UsageError(
+            "Missing option '--domain' / '-d' (or use --subdomain with "
+            "--authority digicert)."
+        )
+
+    api = _get_api(ctx, vault)
+
+    if subdomain:
+        metadata_response = api.certificates.metadata(
+            params={"vault_identifier": vault}
+        )
+        vgs_domains = allowed_vgs_domains(metadata_response.body)
+        if not vgs_domains:
+            raise click.ClickException(
+                "No VGS domain suffix is available for this tenant's DigiCert "
+                "certificates."
+            )
+        domain = f"{subdomain}.{vgs_domains[0]}"
+
     payload = {
         "data": {
             "type": "certificate",
             "attributes": {
                 "vault_identifier": vault,
                 "domain": domain,
-                "authority": authority.upper().replace("-", "_"),
+                "authority": normalized_authority,
             },
         }
     }
 
-    api = _get_api(ctx, vault)
     response = api.certificates.create(body=payload)
 
     click.secho(f"Certificate for {domain} created successfully.", fg="green", err=True)
@@ -547,6 +687,86 @@ def certificate_download(
     click.echo(output)
 
 
+@certificate.command("enable-sdk")
+@tenant_option
+@click.option(
+    "--domain",
+    "-d",
+    required=True,
+    help="Certificate ID (CRTxxxx) or branded domain to enable for VGS Collect, Show, and Checkout SDKs.",
+)
+@click.option("--confirm", "-y", is_flag=True, help="Skip confirmation prompt")
+@click.pass_context
+@handle_errors()
+def certificate_enable_sdk(
+    ctx: click.Context, vault: str, domain: str, confirm: bool
+) -> None:
+    """
+    Enable a branded domain for VGS Collect, Show, and Checkout SDKs.
+
+    The certificate must already be issued (status VALID or
+    RENEWAL_REQUIRED). This action cannot be undone from the API; to disable
+    it, delete and recreate the branded domain.
+    """
+    cert_api = _get_api(ctx, vault)
+    resolved_domain = _assert_certificate_sdk_enableable(
+        cert_api, vault=vault, domain_or_id=domain
+    )
+
+    if not confirm:
+        click.confirm(
+            f"Enable SDKs for {resolved_domain}? This cannot be undone "
+            "(disabling requires deleting and recreating the branded domain).",
+            abort=True,
+        )
+
+    personalization_api = _get_personalization_api(ctx, vault)
+    personalization_api.hostnames.create(body={"data": {"hostname": resolved_domain}})
+
+    click.secho(f"{resolved_domain} enabled for SDKs successfully.", fg="green")
+
+
+@certificate.command("sdk-status")
+@tenant_option
+@click.option(
+    "--domain",
+    "-d",
+    required=True,
+    help="Branded domain to check SDK activation status for.",
+)
+@click.pass_context
+@handle_errors()
+def certificate_sdk_status(ctx: click.Context, vault: str, domain: str) -> None:
+    """Check whether a branded domain is enabled for VGS Collect, Show, and Checkout SDKs."""
+    cdn_base = COLLECT_CDN_URLS.get(_resolve_env(ctx).lower(), COLLECT_CDN_URLS["prod"])
+    config_url = f"{cdn_base}/collect-configs/{domain}__{vault}.txt"
+
+    try:
+        response = requests.get(config_url, headers=request_headers({}), timeout=10)
+    except requests.RequestException as e:
+        raise click.ClickException(f"Unable to determine SDK activation status: {e}")
+
+    if response.status_code == 200:
+        enabled = True
+    elif response.status_code in (403, 404):
+        enabled = False
+    else:
+        raise click.ClickException(
+            "Unable to determine SDK activation status "
+            f"(HTTP {response.status_code})."
+        )
+
+    click.echo(
+        dump_camelized_yaml(
+            {
+                "apiVersion": "1.0.0",
+                "kind": "CertificateSdkStatus",
+                "data": {"domain": domain, "enabled": enabled},
+            }
+        )
+    )
+
+
 @certificate.command("generate-csr")
 @tenant_option
 @click.option(