aac-cli 0.1.0__py3-none-any.whl

aac_cli/__init__.py

@@ -0,0 +1,8 @@
+"""aac-cli — the `aac` platform CLI (Eng Spec §XII, Stage 2 subset).
+
+Import package is `aac_cli`, NOT `aac`: the SDK owns the `aac` import
+package, and the console script named `aac` is this package's
+entrypoint (`aac_cli.cli:entrypoint`).
+"""
+
+__version__ = "0.1.0"

aac_cli/__main__.py

@@ -0,0 +1,6 @@
+"""`python -m aac_cli` — same entrypoint as the `aac` console script."""
+
+from aac_cli.cli import entrypoint
+
+if __name__ == "__main__":
+    entrypoint()

aac_cli/cli.py

@@ -0,0 +1,575 @@
+"""The `aac` command surface — Stage 2 Python subset of Eng Spec §XII.
+
+Three commands ship in Stage 2:
+
+* ``aac configure`` (B117) — interactive writer for ``~/.aac/config``
+  with aws-configure semantics: prompts show ``[current-or-default]``,
+  Enter keeps the bracket value, all-flags = non-interactive.
+  ``aac configure list`` shows the effective settings + the source of
+  each. NEVER prompts for credentials (deliberate aws deviation —
+  api_keys are minted server-side at registration).
+* ``aac tenant register`` — POST /v1/tenants on the ADMIN surface;
+  stores the one-time api_key at ``~/.aac/credentials/{tenant_id}``
+  (0600) and prints it EXACTLY ONCE.
+* ``aac chain show`` — GET /v1/trace/{token_id}/cross-org-events on
+  the data-plane surface (participant-tenant Bearer auth, Week 12);
+  ``--render`` additionally fetches the interactive HTML AEG to a file
+  (headless-first per the Equifax requirement: writing a file is the
+  default deliverable; ``--open`` launches a browser for operators who
+  have one).
+
+Conventions (§XII, AWS-CLI-styled): JSON output by default,
+``--output table`` alternative, ``--profile`` for multi-tenant
+operators, and the originator-cli exit-code contract:
+
+    0 — success
+    1 — server rejected the request (4xx/5xx envelope printed)
+    2 — control plane unreachable
+    3 — CLI/user input error (bad flags, missing credential/profile)
+
+Timelines served here are §V.2.1 METADATA-TIER — summaries synthesized
+from redacted fields; the tenant's own SIEM stream carries the full
+narrative (§6.1 federated join). The table renderer says so in its
+footer rather than implying completeness.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+import webbrowser
+from pathlib import Path
+
+import httpx
+
+from aac_cli import __version__
+from aac_cli.config import (
+    DEFAULT_SETTINGS,
+    CliConfigError,
+    ResolvedConfig,
+    read_api_key,
+    read_profile_settings,
+    resolve_config,
+    resolve_settings,
+    write_api_key,
+    write_profile,
+)
+
+__all__ = ["build_parser", "entrypoint", "main"]
+
+_REQUEST_TIMEOUT_SECONDS = 10.0
+
+
+# ---------------------------------------------------------------------------
+# Shared helpers
+# ---------------------------------------------------------------------------
+
+
+def _print_error_envelope(response: httpx.Response) -> None:
+    """Render a non-2xx control-plane response (envelope-aware).
+
+    Robust to anything a proxy/LB might return (review M2): JSON
+    non-dicts, envelope-less dicts, and non-JSON all degrade to the
+    raw-body line — never a traceback.
+    """
+    try:
+        body = response.json()
+    except ValueError:
+        body = None
+    error = body.get("error") if isinstance(body, dict) else None
+    if isinstance(error, dict):
+        code = error.get("code", "?")
+        message = error.get("message", response.text[:200])
+        print(f"error {response.status_code} {code}: {message}", file=sys.stderr)
+    else:
+        print(
+            f"error {response.status_code}: {response.text[:200]}", file=sys.stderr
+        )
+
+
+def _add_common_flags(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument(
+        "--profile",
+        default="default",
+        help="Config profile in ~/.aac/config (AWS-CLI semantics).",
+    )
+    parser.add_argument(
+        "--admin-url", default=None, help="Admin-surface base URL (overrides profile)."
+    )
+    parser.add_argument(
+        "--data-plane-url",
+        default=None,
+        help="Data-plane-surface base URL (overrides profile).",
+    )
+    parser.add_argument(
+        "--output",
+        choices=("json", "table"),
+        default="json",
+        help="Output mode (§XII: JSON by default).",
+    )
+
+
+def _resolve(args: argparse.Namespace) -> ResolvedConfig:
+    return resolve_config(
+        profile=args.profile,
+        admin_url_flag=args.admin_url,
+        data_plane_url_flag=args.data_plane_url,
+        tenant_id_flag=getattr(args, "tenant_id", None),
+    )
+
+
+# ---------------------------------------------------------------------------
+# aac configure (B117 — aws-configure semantics)
+# ---------------------------------------------------------------------------
+
+
+def _cmd_configure(args: argparse.Namespace) -> int:
+    """Write the three settings to the target profile, aws-style.
+
+    Prompt semantics (D3, user-ratified 2026-07-16): the bracket shows
+    the profile's CURRENT file value, falling back to the built-in
+    default (localhost urls — real working dev-compose values, a
+    deliberate deviation from aws's ``[None]``), falling back to
+    ``None``. Empty input keeps the bracket value; keeping ``None``
+    writes nothing for that key. A setting supplied via flag is
+    written without prompting — all three flags = fully
+    non-interactive (scriptable).
+
+    Deliberately NOT here: credentials (D1 — minted server-side at
+    ``aac tenant register``, never typed) and any connectivity check
+    (aws configure doesn't dial; neither do we).
+    """
+    current = read_profile_settings(args.profile)
+    flag_values = {
+        "admin_url": args.admin_url,
+        "data_plane_url": args.data_plane_url,
+        "tenant_id": args.tenant_id,
+    }
+
+    to_write: dict[str, str] = {}
+    for name, built_in_default in DEFAULT_SETTINGS.items():
+        if flag_values[name]:
+            to_write[name] = flag_values[name]
+            continue
+        bracket_value = current.get(name) or built_in_default
+        try:
+            typed = input(f"{name} [{bracket_value or 'None'}]: ").strip()
+        except (EOFError, KeyboardInterrupt):
+            # Piped-stdin underrun, Ctrl-D, or Ctrl-C mid-prompt: abort
+            # without writing — a half-answered configure must not
+            # half-write. KeyboardInterrupt handled HERE (review M2):
+            # it is a BaseException, so main()'s contract-preserving
+            # `except Exception` cannot keep it inside 0/1/2/3, and
+            # Ctrl-C is the natural abort gesture at a prompt.
+            print("\naac configure aborted; nothing written", file=sys.stderr)
+            return 3
+        if typed:
+            to_write[name] = typed
+        elif bracket_value is not None:
+            # Enter = accept the bracket value. For a brand-new profile
+            # this MATERIALIZES the built-in default into the file
+            # (ratified D3) — harmless, identical to the fallback.
+            to_write[name] = bracket_value
+        # Enter on [None] (tenant_id, fresh profile): stays unset.
+
+    config_path = write_profile(args.profile, to_write)
+    print(f"profile [{args.profile}] written to {config_path}", file=sys.stderr)
+    return 0
+
+
+def _cmd_configure_list(args: argparse.Namespace) -> int:
+    """Effective settings + the source of each (aws `configure list`).
+
+    Reuses `resolve_settings` — the SAME precedence walk every network
+    command uses — so what this prints is what `chain show` would do.
+    """
+    settings = resolve_settings(
+        profile=args.profile,
+        admin_url_flag=args.admin_url,
+        data_plane_url_flag=args.data_plane_url,
+        tenant_id_flag=args.tenant_id,
+    )
+    if args.output == "table":
+        print(f"{'setting':<16} {'value':<40} source")
+        for name, resolved in settings.items():
+            # `is None`, not falsy (review N2): an empty-string value
+            # should render as itself, matching the JSON branch.
+            shown = "<not set>" if resolved.value is None else resolved.value
+            print(f"{name:<16} {shown:<40} {resolved.source}")
+    else:
+        print(
+            json.dumps(
+                {
+                    "profile": args.profile,
+                    "settings": {
+                        name: {"value": resolved.value, "source": resolved.source}
+                        for name, resolved in settings.items()
+                    },
+                },
+                indent=2,
+            )
+        )
+    return 0
+
+
+# ---------------------------------------------------------------------------
+# aac tenant register
+# ---------------------------------------------------------------------------
+
+
+def _cmd_tenant_register(args: argparse.Namespace) -> int:
+    config = _resolve(args)
+    body: dict = {
+        "tenant_id": args.tenant_id,
+        "display_name": args.display_name,
+        "contact": args.contact,
+        "workloads": [
+            {"spiffe_id": spiffe_id} for spiffe_id in (args.workload_spiffe_id or [])
+        ],
+        "agents": [],
+    }
+    if args.parent_tenant_id:
+        body["parent_tenant_id"] = args.parent_tenant_id
+    if args.tenant_admin_pubkey_file:
+        try:
+            body["tenant_admin_pubkey_pem"] = Path(
+                args.tenant_admin_pubkey_file
+            ).read_text(encoding="utf-8")
+        except OSError as exc:
+            print(f"cannot read tenant-admin pubkey: {exc}", file=sys.stderr)
+            return 3
+
+    try:
+        response = httpx.post(
+            f"{config.admin_url}/v1/tenants",
+            json=body,
+            timeout=_REQUEST_TIMEOUT_SECONDS,
+        )
+    except httpx.HTTPError as exc:
+        print(
+            f"failed to reach the control plane admin surface at "
+            f"{config.admin_url}: {type(exc).__name__}: {exc}",
+            file=sys.stderr,
+        )
+        return 2
+    if response.status_code != 201:
+        _print_error_envelope(response)
+        return 1
+
+    payload = response.json()
+    api_key, key_id = payload["api_key"], payload["key_id"]
+    # Review H2: the key is shown EXACTLY ONCE and is unretrievable
+    # after this response — a failed credential WRITE must never
+    # swallow it. Print-despite-failure, warn loudly, exit 3.
+    try:
+        stored_at: Path | None = write_api_key(args.tenant_id, api_key)
+    except OSError as exc:
+        stored_at = None
+        print(
+            f"WARNING: could not store the credential ({exc}) — the "
+            f"api_key below is shown ONCE and is NOT retrievable again; "
+            f"store it by hand at ~/.aac/credentials/{args.tenant_id} "
+            f"(mode 0600).",
+            file=sys.stderr,
+        )
+
+    if args.output == "table":
+        print(f"tenant_id : {args.tenant_id}")
+        print(f"key_id    : {key_id}")
+        print(f"api_key   : {api_key}")
+        print(f"stored_at : {stored_at or 'NOT STORED — see warning'}")
+        print(
+            "\nNOTE: this api_key is shown EXACTLY ONCE and cannot be "
+            "retrieved again — only its peppered hash is stored server-side."
+        )
+    else:
+        print(
+            json.dumps(
+                {
+                    "tenant_id": args.tenant_id,
+                    "key_id": key_id,
+                    "api_key": api_key,
+                    "stored_at": str(stored_at) if stored_at else None,
+                    "note": "api_key shown exactly once; not retrievable again",
+                },
+                indent=2,
+            )
+        )
+    return 0 if stored_at else 3
+
+
+# ---------------------------------------------------------------------------
+# aac chain show
+# ---------------------------------------------------------------------------
+
+
+def _render_timeline_table(body: dict) -> str:
+    lines = [
+        f"root_token_id: {body['root_token_id']}",
+        f"events: {body['event_count']}",
+        "",
+        f"{'timestamp':<27} {'event_type':<16} {'tenant':<18} {'token':<10} summary",
+    ]
+    for event in body["events"]:
+        raw = event.get("raw_event") or {}
+        lines.append(
+            f"{event['timestamp_iso']:<27} "
+            f"{event['event_type']:<16} "
+            f"{(raw.get('tenant_id') or '-'):<18} "
+            f"{event['token_id'][:8]:<10} "
+            f"{event['summary']}"
+        )
+    lines.append("")
+    lines.append(
+        "(metadata-tier view — §V.2.1: predicates/business narratives stay "
+        "in your tenant SIEM stream; §6.1 federated join is the full story)"
+    )
+    return "\n".join(lines)
+
+
+def _cmd_chain_show(args: argparse.Namespace) -> int:
+    # Review S2: render-only flags without --render would silently
+    # no-op — an operator who typed --open expected a browser.
+    if (args.open or args.render_out) and not args.render:
+        print("--open/--render-out require --render", file=sys.stderr)
+        return 3
+    config = _resolve(args)
+    tenant_id = config.tenant_id
+    if not tenant_id:
+        print(
+            "no tenant identity: pass --tenant-id, set AAC_TENANT_ID, or add "
+            "tenant_id to the profile in ~/.aac/config",
+            file=sys.stderr,
+        )
+        return 3
+    try:
+        api_key = read_api_key(tenant_id)
+    except CliConfigError as exc:
+        print(str(exc), file=sys.stderr)
+        return 3
+
+    headers = {"Authorization": f"Bearer {api_key}"}
+    events_url = (
+        f"{config.data_plane_url}/v1/trace/{args.token_id}/cross-org-events"
+    )
+    try:
+        response = httpx.get(
+            events_url, headers=headers, timeout=_REQUEST_TIMEOUT_SECONDS
+        )
+    except httpx.HTTPError as exc:
+        print(
+            f"failed to reach the control plane data-plane surface at "
+            f"{config.data_plane_url}: {type(exc).__name__}: {exc}",
+            file=sys.stderr,
+        )
+        return 2
+    if response.status_code != 200:
+        _print_error_envelope(response)
+        return 1
+    body = response.json()
+
+    if args.output == "table":
+        print(_render_timeline_table(body))
+    else:
+        print(json.dumps(body, indent=2))
+
+    if args.render:
+        render_url = f"{config.data_plane_url}/v1/trace/{args.token_id}/render"
+        try:
+            render_response = httpx.get(
+                render_url, headers=headers, timeout=_REQUEST_TIMEOUT_SECONDS * 3
+            )
+        except httpx.HTTPError as exc:
+            print(f"render fetch failed: {type(exc).__name__}: {exc}", file=sys.stderr)
+            return 2
+        if render_response.status_code != 200:
+            _print_error_envelope(render_response)
+            return 1
+        out_path = Path(
+            args.render_out or f"aeg_{body['root_token_id'][:16]}.html"
+        )
+        try:
+            out_path.write_text(render_response.text, encoding="utf-8")
+        except OSError as exc:  # review M3: unwritable path = CLI error
+            print(f"cannot write AEG to {out_path}: {exc}", file=sys.stderr)
+            return 3
+        # Headless-first (Equifax/KPI 6): the FILE is the deliverable;
+        # --open is the optional convenience for browser-ful operators.
+        print(f"AEG written to {out_path}", file=sys.stderr)
+        if args.open and not webbrowser.open(out_path.resolve().as_uri()):
+            print(
+                "(no browser available — the file above is the deliverable)",
+                file=sys.stderr,
+            )
+    return 0
+
+
+# ---------------------------------------------------------------------------
+# Parser + entrypoints
+# ---------------------------------------------------------------------------
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="aac",
+        description=(
+            "AAC platform CLI (Stage 2 subset of Eng Spec §XII): tenant "
+            "registration + chain audit, headless-first."
+        ),
+    )
+    parser.add_argument("--version", action="version", version=f"aac {__version__}")
+    nouns = parser.add_subparsers(dest="noun", required=True)
+
+    configure = nouns.add_parser(
+        "configure",
+        help="Write ~/.aac/config interactively (aws-configure semantics).",
+    )
+    # These are VALUES TO WRITE (skipping that setting's prompt), not
+    # the runtime overrides the other commands' identically-named
+    # flags are — help text carries the distinction.
+    configure.add_argument(
+        "--profile",
+        default="default",
+        help="Config profile section to create/update.",
+    )
+    configure.add_argument(
+        "--admin-url", default=None, help="Write this admin_url (skips its prompt)."
+    )
+    configure.add_argument(
+        "--data-plane-url",
+        default=None,
+        help="Write this data_plane_url (skips its prompt).",
+    )
+    configure.add_argument(
+        "--tenant-id", default=None, help="Write this tenant_id (skips its prompt)."
+    )
+    configure.set_defaults(handler=_cmd_configure)
+    configure_verbs = configure.add_subparsers(dest="verb", required=False)
+    configure_list = configure_verbs.add_parser(
+        "list", help="Show effective settings and where each came from."
+    )
+    # default=SUPPRESS on every flag that ALSO exists on the parent
+    # `configure` parser (review M1): argparse parses a subcommand into
+    # a FRESH namespace and copies every set attribute back, so a
+    # plain default here would clobber a parent-parsed value —
+    # `aac configure --profile staging list` would silently list
+    # [default]. SUPPRESS keeps untyped child flags out of the copy;
+    # the parent's parse (which always runs first) supplies the values.
+    for flag, help_text in (
+        ("--profile", "Config profile in ~/.aac/config (AWS-CLI semantics)."),
+        ("--admin-url", "Admin-surface base URL (overrides profile)."),
+        ("--data-plane-url", "Data-plane-surface base URL (overrides profile)."),
+        ("--tenant-id", "Runtime override (shown as source=flag)."),
+    ):
+        configure_list.add_argument(flag, default=argparse.SUPPRESS, help=help_text)
+    configure_list.add_argument(
+        "--output",
+        choices=("json", "table"),
+        default="json",
+        help="Output mode (§XII: JSON by default).",
+    )
+    configure_list.set_defaults(handler=_cmd_configure_list)
+
+    tenant = nouns.add_parser("tenant", help="Tenant administration.")
+    tenant_verbs = tenant.add_subparsers(dest="verb", required=True)
+    register = tenant_verbs.add_parser(
+        "register",
+        help="Register a tenant; store + print its one-time api_key.",
+        epilog=(
+            "tenant_id is the org's FEDERATION IDENTIFIER — the stable "
+            "handle other tenants verify your signatures under (X-AAC "
+            "headers, .well-known paths, SIEM streams). Grammar: 1-64 "
+            "chars of [a-z0-9._-], starting and ending alphanumeric; "
+            "an org domain like acme.com is the convention. It cannot "
+            "be renamed later (B118 D3)."
+        ),
+    )
+    _add_common_flags(register)
+    register.add_argument(
+        "--tenant-id",
+        required=True,
+        help=(
+            "Federation identifier: 1-64 chars of [a-z0-9._-], starting "
+            "and ending alphanumeric (e.g. acme.com). See below."
+        ),
+    )
+    register.add_argument("--display-name", required=True)
+    # Required (review N1): a fabricated ops@<tenant> default would be
+    # invented data stored server-side as a real operator contact.
+    register.add_argument("--contact", required=True)
+    register.add_argument(
+        "--workload-spiffe-id",
+        action="append",
+        help="Concrete workload SPIFFE ID (repeatable).",
+    )
+    register.add_argument(
+        "--parent-tenant-id",
+        default=None,
+        help=(
+            "Parent org's tenant_id (same grammar). The server resolves "
+            "the handle to its row internally — you always type the "
+            "identifier, never a database id."
+        ),
+    )
+    register.add_argument(
+        "--tenant-admin-pubkey-file",
+        default=None,
+        help="PEM path — registers the tenant-admin key for publisher ingest.",
+    )
+    register.set_defaults(handler=_cmd_tenant_register)
+
+    chain = nouns.add_parser("chain", help="Per-chain audit operations.")
+    chain_verbs = chain.add_subparsers(dest="verb", required=True)
+    show = chain_verbs.add_parser(
+        "show", help="Chronological cross-org timeline (participant tenants only)."
+    )
+    _add_common_flags(show)
+    show.add_argument(
+        "--token-id",
+        "--root-token-id",  # the plan's original flag name — same endpoint
+        dest="token_id",
+        required=True,
+        help="Any hop's token id OR a chain root id (64-char hex).",
+    )
+    show.add_argument("--tenant-id", default=None, help="Credential to present.")
+    show.add_argument(
+        "--render",
+        action="store_true",
+        help="Also fetch the interactive HTML AEG to a file (headless-first).",
+    )
+    show.add_argument(
+        "--render-out", default=None, help="HTML output path (default aeg_<root>.html)."
+    )
+    show.add_argument(
+        "--open", action="store_true", help="Open the rendered AEG in a browser."
+    )
+    show.set_defaults(handler=_cmd_chain_show)
+
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    try:
+        return args.handler(args)
+    except CliConfigError as exc:
+        print(str(exc), file=sys.stderr)
+        return 3
+    except httpx.InvalidURL as exc:
+        # Review M3: NOT an httpx.HTTPError subclass — a malformed
+        # --admin-url/profile URL is a CLI-input error, not exit 1.
+        print(f"invalid URL: {exc}", file=sys.stderr)
+        return 3
+    except Exception as exc:  # noqa: BLE001 — review M3: the 0/1/2/3
+        # contract is what automation scripts branch on; an unexpected
+        # bug must exit INSIDE the contract with one stderr line, not
+        # traceback out with the interpreter's exit 1 (= "server
+        # rejected" to a script).
+        print(f"aac: unexpected error: {type(exc).__name__}: {exc}", file=sys.stderr)
+        return 3
+
+
+def entrypoint() -> None:  # console-script shim
+    sys.exit(main())

aac_cli/config.py

@@ -0,0 +1,327 @@
+"""CLI configuration + credentials store (Eng Spec §XII conventions).
+
+Two on-disk artifacts under ``~/.aac/`` (override the directory with
+``AAC_CLI_HOME`` — tests and multi-account operators):
+
+* ``~/.aac/config`` — INI, profile-sectioned (the AWS-CLI idiom;
+  user-ratified Week 13 over TOML/YAML — stdlib configparser, zero
+  deps). ``--profile`` selects a section; ``[default]`` otherwise::
+
+      [default]
+      admin_url = http://127.0.0.1:8000
+      data_plane_url = http://127.0.0.1:9000
+      tenant_id = acme.com
+
+  TWO urls, not one base: the admin and data-plane surfaces genuinely
+  live on different ports (Eng Spec §XVI) and 1C may split them into
+  separate deployments.
+
+* ``~/.aac/credentials/{tenant_id}`` — one file per tenant holding the
+  bare ``aac_ak_...`` string, mode 0600 (§XII Mode-B posture).
+  DELIBERATELY the same bare-string format the joined compose smoke
+  writes into the sidecar keys dir — one credential format everywhere.
+
+Precedence for every setting: explicit flag > environment
+(``AAC_ADMIN_URL`` / ``AAC_DATA_PLANE_URL`` / ``AAC_TENANT_ID``) >
+config-file profile > built-in localhost defaults.
+
+``aac configure`` (B117, aws-configure semantics) is the primary
+WRITER of the config file: it prompts for the three settings (never
+credentials — those are minted server-side at ``aac tenant register``,
+a deliberate aws deviation) and rewrites only the target profile
+section. The file stays plain INI and hand-editing stays legal;
+``configparser`` does NOT round-trip comments, so a rewrite drops
+them (disclosed trade-off, aws-cli behaves the same). B98's
+``aac sso login`` later writes the SAME file on first login — any
+future writer must stay section-preserving like this one.
+"""
+
+from __future__ import annotations
+
+import configparser
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+__all__ = [
+    "CliConfigError",
+    "DEFAULT_SETTINGS",
+    "ResolvedConfig",
+    "ResolvedSetting",
+    "cli_home",
+    "credentials_path",
+    "read_api_key",
+    "read_profile_settings",
+    "resolve_config",
+    "resolve_settings",
+    "write_api_key",
+    "write_profile",
+]
+
+_DEFAULT_ADMIN_URL = "http://127.0.0.1:8000"
+_DEFAULT_DATA_PLANE_URL = "http://127.0.0.1:9000"
+
+# The three settings `aac configure` manages, with their built-in
+# defaults (None = no default; tenant_id has no sensible one).
+# Ordering is the PROMPT ordering — keep admin_url first (it is the
+# first thing a fresh operator needs for `tenant register`).
+DEFAULT_SETTINGS: dict[str, str | None] = {
+    "admin_url": _DEFAULT_ADMIN_URL,
+    "data_plane_url": _DEFAULT_DATA_PLANE_URL,
+    "tenant_id": None,
+}
+
+_ENV_VAR_BY_SETTING = {
+    "admin_url": "AAC_ADMIN_URL",
+    "data_plane_url": "AAC_DATA_PLANE_URL",
+    "tenant_id": "AAC_TENANT_ID",
+}
+
+
+class CliConfigError(Exception):
+    """Configuration the CLI cannot proceed with (exit 3 at the top level)."""
+
+
+@dataclass(frozen=True)
+class ResolvedConfig:
+    """The effective settings after flag/env/file/default precedence."""
+
+    admin_url: str
+    data_plane_url: str
+    tenant_id: str | None
+
+
+@dataclass(frozen=True)
+class ResolvedSetting:
+    """One effective setting plus WHERE it came from.
+
+    `source` is a human-readable provenance label for `aac configure
+    list` (aws-parity: value + Type/Location columns): ``"flag"``,
+    ``"env:AAC_ADMIN_URL"``, ``"profile:default"``, ``"default"``, or
+    ``"unset"`` (tenant_id only — it has no built-in default).
+    """
+
+    value: str | None
+    source: str
+
+
+def cli_home() -> Path:
+    """``~/.aac`` (or ``AAC_CLI_HOME`` — tests, multi-account operators)."""
+    override = os.environ.get("AAC_CLI_HOME")
+    return Path(override) if override else Path.home() / ".aac"
+
+
+def _load_config_parser(config_path: Path) -> configparser.ConfigParser:
+    """Parse ``~/.aac/config``; an absent file parses as empty.
+
+    read_text + read_string (review M1): ConfigParser.read() silently
+    SKIPS an unreadable file and raises raw configparser errors on
+    malformed INI — both must surface as CliConfigError (exit 3),
+    never a traceback or a silent fallback to localhost defaults.
+
+    interpolation=None (review H1): configparser's default
+    BasicInterpolation treats ``%`` as syntax, making percent-encoded
+    URLs unstorable AND unreadable. No AAC setting wants
+    interpolation; aws-cli's INI handling does none either.
+    """
+    parser = configparser.ConfigParser(interpolation=None)
+    if config_path.is_file():
+        try:
+            parser.read_string(config_path.read_text(encoding="utf-8"))
+        except OSError as exc:
+            raise CliConfigError(f"cannot read {config_path}: {exc}") from exc
+        except configparser.Error as exc:
+            raise CliConfigError(f"malformed config {config_path}: {exc}") from exc
+    return parser
+
+
+def resolve_settings(
+    *,
+    profile: str = "default",
+    admin_url_flag: str | None = None,
+    data_plane_url_flag: str | None = None,
+    tenant_id_flag: str | None = None,
+) -> dict[str, ResolvedSetting]:
+    """Apply the documented precedence, tracking each value's source.
+
+    THE single precedence implementation — `resolve_config` (every
+    network command) and `aac configure list` both call this, so the
+    displayed provenance can never drift from the lived behavior.
+
+    A missing config file is fine (localhost defaults — the dev-compose
+    posture); a NAMED profile missing from an existing file is an error
+    (the operator asked for something that isn't there).
+    """
+    config_path = cli_home() / "config"
+    parser = _load_config_parser(config_path)
+    file_section: configparser.SectionProxy | None = None
+    if parser.has_section(profile):
+        file_section = parser[profile]
+    elif profile != "default" and config_path.is_file():
+        raise CliConfigError(
+            f"profile {profile!r} not found in {config_path} "
+            f"(sections: {parser.sections() or 'none'})"
+        )
+
+    flags = {
+        "admin_url": admin_url_flag,
+        "data_plane_url": data_plane_url_flag,
+        "tenant_id": tenant_id_flag,
+    }
+
+    def _setting(name: str) -> ResolvedSetting:
+        if flags[name]:
+            value = flags[name]
+            source = "flag"
+        elif os.environ.get(_ENV_VAR_BY_SETTING[name]):
+            value = os.environ[_ENV_VAR_BY_SETTING[name]]
+            source = f"env:{_ENV_VAR_BY_SETTING[name]}"
+        elif file_section is not None and name in file_section:
+            value = file_section[name]
+            source = f"profile:{profile}"
+        elif DEFAULT_SETTINGS[name] is not None:
+            value = DEFAULT_SETTINGS[name]
+            source = "default"
+        else:
+            return ResolvedSetting(value=None, source="unset")
+        # Urls tolerate a trailing slash from any source (hand-edited
+        # files, env); normalize once here so every consumer sees the
+        # same effective value.
+        assert value is not None
+        if name.endswith("_url"):
+            value = value.rstrip("/")
+        return ResolvedSetting(value=value, source=source)
+
+    return {name: _setting(name) for name in DEFAULT_SETTINGS}
+
+
+def resolve_config(
+    *,
+    profile: str = "default",
+    admin_url_flag: str | None = None,
+    data_plane_url_flag: str | None = None,
+    tenant_id_flag: str | None = None,
+) -> ResolvedConfig:
+    """The effective config (see `resolve_settings` for the mechanics)."""
+    settings = resolve_settings(
+        profile=profile,
+        admin_url_flag=admin_url_flag,
+        data_plane_url_flag=data_plane_url_flag,
+        tenant_id_flag=tenant_id_flag,
+    )
+    admin_url = settings["admin_url"].value
+    data_plane_url = settings["data_plane_url"].value
+    assert admin_url is not None and data_plane_url is not None  # defaults exist
+    return ResolvedConfig(
+        admin_url=admin_url,
+        data_plane_url=data_plane_url,
+        tenant_id=settings["tenant_id"].value,
+    )
+
+
+def read_profile_settings(profile: str) -> dict[str, str]:
+    """The file-stored values for `profile` — the configure prompt's
+    "current" bracket values.
+
+    Tolerant where `resolve_settings` is strict: an absent file OR an
+    absent section returns ``{}``, because `aac configure --profile x`
+    on a new profile is CREATION, not an error. Malformed INI still
+    raises (the writer must not destroy a file it cannot parse).
+    """
+    parser = _load_config_parser(cli_home() / "config")
+    if not parser.has_section(profile):
+        return {}
+    return {key: parser[profile][key] for key in DEFAULT_SETTINGS if key in parser[profile]}
+
+
+def write_profile(profile: str, settings: dict[str, str]) -> Path:
+    """Create/update the `profile` section; every OTHER section survives.
+
+    Section-preserving by contract: B98's `aac sso login` becomes the
+    second writer of this file, and multi-profile operators hand-edit
+    it — rewriting only the target section's keys (plus configparser's
+    reformatting) is the strongest guarantee configparser affords.
+    Comments are NOT round-tripped (disclosed B117 trade-off).
+
+    Atomic replace (review M3): the file may hold OTHER profiles'
+    sections, so a torn in-place write (disk full, SIGKILL mid-write)
+    could lose data this call never touched. Write to a same-directory
+    temp file, then os.replace() — readers see the old file or the new
+    one, never a truncation. Recorded trade-off: os.replace converts a
+    symlinked ``~/.aac/config`` into a regular file; operators who
+    symlink dotfiles should symlink the DIRECTORY (or use
+    AAC_CLI_HOME). Losing sibling profiles is the worse failure.
+
+    File mode 0600 (aws-cli parity for its config file): nothing here
+    is secret TODAY, but tightening costs nothing and the B98 writer
+    inherits the posture. The replace also HEALS a looser pre-existing
+    mode (review S2) — the new inode is always 0600.
+    """
+    config_path = cli_home() / "config"
+    parser = _load_config_parser(config_path)
+    if not parser.has_section(profile):
+        parser.add_section(profile)
+    for key, value in settings.items():
+        parser[profile][key] = value
+    config_path.parent.mkdir(parents=True, exist_ok=True)
+    temp_path = config_path.with_name(config_path.name + ".tmp")
+    temp_path.unlink(missing_ok=True)
+    fd = os.open(temp_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            parser.write(handle)
+    except BaseException:
+        temp_path.unlink(missing_ok=True)
+        raise
+    os.replace(temp_path, config_path)
+    return config_path
+
+
+def credentials_path(tenant_id: str) -> Path:
+    # Server-side TENANT_ID_PATTERN admits no separators, but the store
+    # is safe on its own terms (review N2): reject anything path-like.
+    if "/" in tenant_id or "\\" in tenant_id or tenant_id in (".", ".."):
+        raise CliConfigError(f"tenant_id {tenant_id!r} is not a valid filename")
+    return cli_home() / "credentials" / tenant_id
+
+
+def write_api_key(tenant_id: str, api_key: str) -> Path:
+    """Store a tenant's api_key at mode 0600 (§XII Mode-B posture).
+
+    Atomic-mode create (review S1): O_NOFOLLOW + mode=0o600 at open
+    time — no umask window between create and chmod, no symlink
+    following. O_TRUNC overwrites an existing file (re-registration
+    under the same tenant_id only happens against a fresh control
+    plane; the old key is dead there anyway). The credentials
+    DIRECTORY is 0700 — defense in depth for umask-permissive machines.
+    """
+    path = credentials_path(tenant_id)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.parent.chmod(0o700)
+    fd = os.open(
+        path,
+        os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_NOFOLLOW,
+        0o600,
+    )
+    try:
+        os.write(fd, api_key.encode("utf-8"))
+    finally:
+        os.close(fd)
+    path.chmod(0o600)  # heal pre-existing files created before S1
+    return path
+
+
+def read_api_key(tenant_id: str) -> str:
+    """The stored api_key for `tenant_id`, or CliConfigError with the fix."""
+    path = credentials_path(tenant_id)
+    try:
+        api_key = path.read_text(encoding="utf-8").strip()
+    except OSError as exc:
+        raise CliConfigError(
+            f"no stored credential for tenant {tenant_id!r} ({exc}). "
+            f"Run `aac tenant register` first, or place the api_key at {path} "
+            f"(mode 0600)."
+        ) from exc
+    if not api_key:
+        raise CliConfigError(f"credential file {path} is empty")
+    return api_key

aac_cli-0.1.0.dist-info/METADATA

@@ -0,0 +1,157 @@
+Metadata-Version: 2.4
+Name: aac-cli
+Version: 0.1.0
+Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
+Author: Agent Authority Cloud Project
+License-Expression: Apache-2.0
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: httpx>=0.28
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == "test"
+Requires-Dist: pytest-httpx>=0.30; extra == "test"
+Dynamic: license-file
+
+# aac-cli — the `aac` platform CLI
+
+The headless operator interface to the AAC control plane (Eng Spec
+§XII; Equifax/KPI-6 requirement: every operational task doable without
+a web console).
+
+## Install
+
+```bash
+pip install aac-cli
+```
+
+> **Careful with the name:** `pip install aac` installs an UNRELATED
+> project (an MBSE modeling tool that happens to share the acronym).
+> The AAC platform CLI's PyPI distribution is **`aac-cli`**; the
+> command it installs is `aac` — the awscli precedent (dist name ≠
+> command name).
+
+Two personas, two invocation styles:
+
+* **Installed operators** (`pip install aac-cli`) run the bare
+  command: `aac tenant register ...`
+* **Repo developers** run it through the workspace without installing:
+  `uv run aac ...`
+
+The examples below use the bare form; prefix `uv run` if you're in the
+repo.
+
+Week 13 ships the Python argparse SUBSET of §XII's full command
+surface — the production Go CLI is V5+ scope:
+
+```bash
+aac configure                      # interactive; aws-configure semantics
+aac configure --profile staging    # create/update the [staging] profile
+aac configure list                 # effective settings + source of each
+
+aac tenant register --tenant-id acme.com --display-name "ACME Corporation" \
+    --workload-spiffe-id spiffe://acme.com/treasury-agent/v1 \
+    --tenant-admin-pubkey-file ./tenant-admin.public.pem
+
+aac chain show --token-id <64-hex token or chain root> --tenant-id acme.com
+aac chain show --token-id <id> --output table
+aac chain show --token-id <id> --render --render-out ./aeg.html   # headless
+aac chain show --token-id <id> --render --open                    # + browser
+```
+
+Naming: console script = `aac` (the §XVI-reserved name); import
+package = `aac_cli` (the SDK owns the `aac` import package);
+distribution = `aac-cli` (decided at first release, B119: bare `aac`
+on PyPI belongs to an unrelated active project and is not claimable).
+
+## Configuration
+
+`aac configure` writes `~/.aac/config` (INI, profile-sectioned —
+AWS-CLI idiom; override the directory with `AAC_CLI_HOME`). Prompts
+show `[current-or-default]`; Enter keeps the bracket value:
+
+```console
+$ aac configure
+admin_url [http://127.0.0.1:8000]:
+data_plane_url [http://127.0.0.1:9000]:
+tenant_id [None]: acme.com
+```
+
+```ini
+[default]
+admin_url = http://127.0.0.1:8000
+data_plane_url = http://127.0.0.1:9000
+tenant_id = acme.com
+```
+
+Supplying all three flags (`--admin-url` / `--data-plane-url` /
+`--tenant-id`) skips every prompt — scriptable. `--profile staging`
+creates/updates `[staging]`, leaving other sections intact. The file
+stays hand-editable INI, but note a rewrite does not preserve
+comments (aws-cli behaves the same). `aac configure` never prompts
+for credentials — api_keys are minted at `aac tenant register`
+(deliberate deviation from `aws configure`).
+
+Precedence: flag > env (`AAC_ADMIN_URL` / `AAC_DATA_PLANE_URL` /
+`AAC_TENANT_ID`) > profile > localhost defaults. `--profile` selects a
+section. `aac configure list` prints each effective setting with its
+source (`flag` / `env:AAC_*` / `profile:<name>` / `default` / `unset`).
+
+### `AAC_CLI_HOME` — isolated homes
+
+`AAC_CLI_HOME` relocates the whole `~/.aac` tree (config +
+credentials). Two everyday uses:
+
+```bash
+# 1. Throwaway smoke/test home — nothing touches your real config:
+AAC_CLI_HOME=/tmp/aac-smoke aac tenant register --tenant-id smoke.example ...
+
+# 2. Multi-account operators — hard-wall separation beyond profiles
+#    (separate credential files, not just separate config sections):
+alias aac-prod='AAC_CLI_HOME=$HOME/.aac-prod aac'
+alias aac-staging='AAC_CLI_HOME=$HOME/.aac-staging aac'
+```
+
+Profiles share one credentials directory; `AAC_CLI_HOME` gives each
+context its own.
+
+Credentials: `~/.aac/credentials/{tenant_id}`, the bare `aac_ak_...`
+string at mode 0600, written by `aac tenant register` (the key is
+printed EXACTLY ONCE — only its peppered hash exists server-side) and
+presented as `Authorization: Bearer` by `aac chain show`. Same bare-
+string format the joined compose smoke writes into sidecar key dirs.
+
+## Choosing a tenant_id
+
+`tenant_id` is your org's FEDERATION IDENTIFIER — the stable handle
+every other tenant verifies your signatures under: it appears in
+`X-AAC-Originator-Tenant-Id` headers, `/.well-known/aac-root-keys/
+{tenant_id}` paths, SIEM stream directories, and supplier whitelists.
+Grammar: **1-64 characters of `[a-z0-9._-]`, starting and ending
+alphanumeric**; an org domain like `acme.com` is the convention. Pick
+it like an AWS account ID: it identifies you to the federation and
+cannot be renamed later. `--parent-tenant-id` takes the parent org's
+`tenant_id` (same grammar) — the server resolves handles to internal
+row ids; no database identifier ever crosses the API (B118 D3/D4).
+Domain ownership verification (DNS TXT) is a separate, additive
+control tracked in the `tenant_domains` table — the challenge flow
+ships in a follow-up increment.
+
+## Semantics worth knowing
+
+* `aac chain show` accepts ANY hop's token id or the chain root id
+  (`--root-token-id` is an accepted alias); visibility is
+  participant-tenant over the symmetric composite closure (Week 12) —
+  non-participants get the same 404 as unknown tokens.
+* Timelines are §V.2.1 METADATA-TIER: predicates and business
+  narratives stay in your tenant SIEM stream; the table output's
+  footer says so (§6.1 federated join is the full-fidelity story).
+* Exit codes (originator-cli convention): 0 success / 1 server
+  rejected / 2 unreachable / 3 CLI-input error.
+
+## Tests
+
+`uv run pytest cli/aac/tests/` — pytest-httpx mocks; no control plane
+needed. Against a live stack: bring up the joined topology
+(`./bin/run-wedge-a-control-plane-compose.sh --keep-up`) and point the
+flags at localhost.

aac_cli-0.1.0.dist-info/RECORD

@@ -0,0 +1,10 @@
+aac_cli/__init__.py,sha256=q2dYQofeGHHkeUFEKoy7yWvA4_fhTiuywYE7RDd7ZBY,271
+aac_cli/__main__.py,sha256=iZrK_3EnviGoJv0bB5mzd1FeimIKhwp-_dvzsuGQL_0,156
+aac_cli/cli.py,sha256=56q47Hbti7oCANGFaAYzNnf5l4ri23yOWv3J5jcY67Y,21687
+aac_cli/config.py,sha256=f2zlS6ra6n6y4FZ3HYP_q9gsaWqosuoAzO7oauEsb7Y,12570
+aac_cli-0.1.0.dist-info/licenses/LICENSE,sha256=DVQuDIgE45qn836wDaWnYhSdxoLXgpRRKH4RuTjpRZQ,10174
+aac_cli-0.1.0.dist-info/METADATA,sha256=5AWs6Ox3BzMpQobpaZoQt65G25KExK-8k-yzQ0kznEc,6269
+aac_cli-0.1.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+aac_cli-0.1.0.dist-info/entry_points.txt,sha256=f6JNWD9QbmHelzouQAAgb7gVY6iw9-RYdFuh7oWV8jE,47
+aac_cli-0.1.0.dist-info/top_level.txt,sha256=XDP5oOHG6T35TmrH4oU9z_K76k8-PhA7UiQDyGHtOA4,8
+aac_cli-0.1.0.dist-info/RECORD,,

aac_cli-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (83.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

aac_cli-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+aac = aac_cli.cli:entrypoint

aac_cli-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

aac_cli-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+aac_cli