Metadata-Version: 2.5
Name: aeo
Version: 0.1.0
Summary: Internal answer-engine-optimization CLI + SDK for Agent Berlin staff.
Requires-Python: >=3.10
Requires-Dist: click>=8.1
Requires-Dist: requests>=2.31
Provides-Extra: dev
Requires-Dist: black>=24.0.0; extra == 'dev'
Requires-Dist: isort>=5.13.0; extra == 'dev'
Requires-Dist: pytest>=8.0.0; extra == 'dev'
Description-Content-Type: text/markdown

# aeo

Internal answer-engine-optimization CLI + SDK for Agent Berlin staff
(`admin_users`, role `admin`). Sibling of `backend/sdk-python` — same transport
posture and the same OTP bootstrap, scoped to internal AEO work.

**Status: scaffold.** This release establishes the package on PyPI. The CLI has
only `aeo --version`; the SDK surface is not implemented yet.

## Auth

`aeo` authenticates with a **project-scoped token**, minted by exchanging a
one-time OTP from the aeo MCP server's `get_otp` tool:

```bash
aeo configure --otp <OTP> --domain <project_domain> --title "<what this session is for>"
```

This reuses the customer MCP's bootstrap wholesale — the OTP is an
`mcp_sessions` row and the exchange endpoint is the existing
`POST /cli/exchange-otp`. There is no aeo-specific session table, exchange
endpoint, or token type.

Two consequences follow, and both differ from how a platform-wide internal tool
would behave:

- **`aeo` is project-scoped.** `--domain` is required; the OTP is bound to that
  project when redeemed. An exchange without a domain cannot succeed.
- **SDK usage is billed to the project's owning org**, not to us — the minted
  token carries the customer's org claim.

Access is gated to `admin_users.role='admin'`. That bound is set by
`/cli/exchange-otp`, which authorizes via `IsAuthorizedForOrg` (admin, or an FDM
assigned to that specific org) — `marketing` would receive an OTP that then
fails at exchange, so the MCP refuses the role up front. Widening it means
changing an endpoint shared with the customer MCP; it is not a local decision.

## Release

Publishing is automated — see `.github/workflows/aeo-publish.yml`. Any push to
`main` touching `backend/aeo/**` bumps the minor version, commits the bump with
an `[aeo-release]` marker, builds with `uv build`, and publishes to PyPI via
Trusted Publishers (OIDC — no API token stored anywhere).

Do not edit `version` in `pyproject.toml` or `__version__` in
`src/aeo/__init__.py` by hand; the workflow rewrites both.
