aeo

Internal answer-engine-optimization CLI + SDK for Agent Berlin staff (admin_users, role admin). Sibling of backend/sdk-python — same transport posture and the same OTP bootstrap, scoped to internal AEO work.

Status: scaffold. This release establishes the package on PyPI. The CLI has only aeo --version; the SDK surface is not implemented yet.

Auth

aeo authenticates with a project-scoped token, minted by exchanging a one-time OTP from the aeo MCP server's get_otp tool:

aeo configure --otp <OTP> --domain <project_domain> --title "<what this session is for>"

This reuses the customer MCP's bootstrap wholesale — the OTP is an mcp_sessions row and the exchange endpoint is the existing POST /cli/exchange-otp. There is no aeo-specific session table, exchange endpoint, or token type.

Two consequences follow, and both differ from how a platform-wide internal tool would behave:

• aeo is project-scoped. --domain is required; the OTP is bound to that project when redeemed. An exchange without a domain cannot succeed.
• SDK usage is billed to the project's owning org, not to us — the minted token carries the customer's org claim.

Access is gated to admin_users.role='admin'. That bound is set by /cli/exchange-otp, which authorizes via IsAuthorizedForOrg (admin, or an FDM assigned to that specific org) — marketing would receive an OTP that then fails at exchange, so the MCP refuses the role up front. Widening it means changing an endpoint shared with the customer MCP; it is not a local decision.

Release

Publishing is automated — see .github/workflows/aeo-publish.yml. Any push to main touching backend/aeo/** bumps the minor version, commits the bump with an [aeo-release] marker, builds with uv build, and publishes to PyPI via Trusted Publishers (OIDC — no API token stored anywhere).

Do not edit version in pyproject.toml or __version__ in src/aeo/__init__.py by hand; the workflow rewrites both.