getstack 0.13.0__tar.gz → 0.14.0__tar.gz

getstack-0.14.0/CLAUDE.md

@@ -0,0 +1,76 @@
+# getstack (Python SDK)
+
+Published to PyPI as `getstack`. Not a workspace member of the main monorepo
+(Python has its own tooling via `pyproject.toml` + its own tests).
+
+## Purpose
+
+- Python ergonomic equivalent of `@getstackrun/sdk`
+- `with stack.passports.mission(...) as m:` context manager that handles
+  checkpoints + checkout automatically
+- **Feature-parity with the JS SDK** (GET-244, both sync `Stack` and async
+  `AsyncStack`): agents, passports (+ delegate + revoke-agent/session/all +
+  list_active), services (+ connect + grant/revoke/get_permissions),
+  credentials, drop-offs (+ expire), skills, identity, audit, notifications
+  (+ update), security-events, proxy, scan, intents, missions,
+  evidence-packs, llm gateway, inbound-webhooks, partner, **team**,
+  **delivery_methods**, **detector_config**.
+- **Offline / customer-managed crypto** (the JS headline features):
+  `verify_passport_offline` (`sdk-python/src/getstack/verify_offline.py` —
+  pyjwt/EdDSA, jwks_url OR public_jwk), `verify_passport_header`, and
+  `sign_claim_envelope` (`sdk-python/src/getstack/sign_claim.py` —
+  COSE_Sign1 for customer_managed agents; cbor2, and **byte-compatible with
+  the JS cbor-x / vault verifier** — proven by
+  `sdk-python/scripts/verify_sign_claim_crosslang.py`: Python signs, the TS
+  vault logic accepts, for all 5 claim types).
+
+## Parity discipline (HARD RULE — GET-244)
+
+Every service + method must exist on BOTH the sync modules under
+`sdk-python/src/getstack/` AND their async mirrors under
+`sdk-python/src/getstack/_async/`. The async surface silently drifted
+before (its `register` lacked profile/key_mode and always clobbered the
+preset). `sdk-python/tests/test_parity.py` is the guard: it asserts `Stack`
+and `AsyncStack` expose the same services + the integration-critical
+methods. Add to one client, add to the other, and the parity test stays
+green.
+
+Wire-field note: the API's grant field is `service_connection_id` (not
+`connection_id` — that was the JS SDK bug); services `list`/`disconnect`
+hit `/v1/services/connected` and `/v1/services/{id}/disconnect`. Notification
+*rules* are `/v1/notifications/channels` (Python's `notifications`);
+*delivery methods* are `/v1/notifications/destinations` (`delivery_methods`).
+
+## Where to look
+
+- Package metadata: `sdk-python/pyproject.toml`
+- Module entry: `sdk-python/src/getstack/`
+- User-facing quickstart + examples: `sdk-python/README.md`
+- License: `sdk-python/LICENSE`
+
+## Key divergence from JS SDK
+
+The Python SDK has a **mission context manager** the JS SDK doesn't have:
+
+```python
+with stack.passports.mission(
+    agent_id=agent.id,
+    intent="Process invoices from Slack",
+    services=["slack", "stripe"],
+    checkpoint_interval="5m",
+) as mission:
+    mission.log("slack", "read_channel", "#invoices")
+    mission.log("stripe", "create_invoice")
+    # Checkpoints submitted automatically on schedule
+# Checkout submitted automatically when the block exits
+```
+
+When the JS SDK adds an equivalent, align the shape (same keyword args,
+same method names) for cross-language familiarity.
+
+## Gotchas
+
+- **Not installed by `npm install` at monorepo root.** Python devs run `pip install -e sdk-python/` or `uv pip install -e sdk-python/`. The JS monorepo lockfile does not resolve Python deps.
+- **Published to PyPI separately.** There's no coordinated release between the JS + Python SDKs; they can (and sometimes do) drift in version numbers.
+- **Same authentication posture.** API keys, session JWTs, and the same `sk_live_*` prefix convention. Token type detection works identically to JS.
+- **Offline passport verification is also available** (mirrors `verify_passport_offline` from the JS SDK) — but confirm the exact function name in `sdk-python/src/getstack/` before citing.

{getstack-0.13.0 → getstack-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: getstack
-Version: 0.13.0
+Version: 0.14.0
 Summary: Python SDK for STACK — trust infrastructure for AI agents
 Project-URL: Homepage, https://getstack.run
 Project-URL: Documentation, https://getstack.run/docs/sdk
@@ -19,6 +19,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.9
+Requires-Dist: cbor2>=5.6.0
 Requires-Dist: cryptography>=42.0.0
 Requires-Dist: httpx>=0.25.0
 Requires-Dist: pyjwt>=2.8.0

{getstack-0.13.0 → getstack-0.14.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "getstack"
-version = "0.13.0"
+version = "0.14.0"
 description = "Python SDK for STACK — trust infrastructure for AI agents"
 readme = "README.md"
 license = "MIT"
@@ -32,6 +32,11 @@ dependencies = [
     # PyJWT for agent JWT minting; pure-Python, tiny (~50KB), no native
     # deps beyond cryptography (which we already need).
     "pyjwt>=2.8.0",
+    # cbor2 for customer-managed COSE_Sign1 claim signing (sign_claim.py).
+    # Pure-Python CBOR; produces byte-compatible output with the JS SDK's
+    # cbor-x for the COSE sig structure (proven by the cross-language
+    # round-trip test).
+    "cbor2>=5.6.0",
 ]
 
 [project.urls]

getstack-0.14.0/scripts/verify_sign_claim_crosslang.py

@@ -0,0 +1,125 @@
+"""Cross-language COSE byte-compat proof for sign_claim_envelope.
+
+Python signs claim envelopes; the JS SDK's cbor-x + node:crypto verify
+logic (identical to @stack/vault AgentSigner.verifyPreSigned) must accept
+them. This is the load-bearing guarantee that a customer_managed agent
+signing claims in Python is accepted by STACK server-side.
+
+Run from the repo root (needs the JS SDK's node_modules for cbor-x):
+    python sdk-python/scripts/verify_sign_claim_crosslang.py
+
+Exit 0 = all claim types round-tripped; non-zero = a byte-compat mismatch.
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(REPO / "sdk-python" / "src"))
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey  # noqa: E402
+from cryptography.hazmat.primitives.serialization import (  # noqa: E402
+    Encoding,
+    NoEncryption,
+    PrivateFormat,
+    PublicFormat,
+)
+
+from getstack.sign_claim import sign_claim_envelope  # noqa: E402
+
+NODE_VERIFIER = r"""
+import { readFileSync } from 'node:fs';
+import { encode as cborEncode, decode as cborDecode } from 'cbor-x';
+import { createPublicKey, verify as cryptoVerify } from 'node:crypto';
+const rows = JSON.parse(readFileSync(process.argv[2], 'utf8'));
+const getH = (h, k) => (h instanceof Map ? h.get(k) : h?.[k]);
+let allPass = true;
+for (const { cose, publicJwk, claim_type } of rows) {
+  const [protectedBytes, , payloadBytes, sig] = cborDecode(Buffer.from(cose, 'base64url'));
+  const pm = cborDecode(protectedBytes);
+  const kidRaw = getH(pm, 4);
+  const kid = kidRaw instanceof Uint8Array ? Buffer.from(kidRaw).toString('utf8') : kidRaw;
+  const ssb = cborEncode(['Signature1', protectedBytes, Buffer.alloc(0), payloadBytes]);
+  const valid = cryptoVerify(null, ssb, createPublicKey({ key: publicJwk, format: 'jwk' }), sig);
+  const env = cborDecode(payloadBytes);
+  const ok = valid && getH(pm, 1) === -8 && getH(pm, 16) === 'stack/claim+cose'
+    && kid === 'agent:ag_cust:v1' && env.claim_type === claim_type;
+  console.log((ok ? 'PASS' : 'FAIL') + ' ' + claim_type + ' sigValid=' + valid);
+  if (!ok) allPass = false;
+}
+process.exit(allPass ? 0 : 1);
+"""
+
+
+def _b64url(b: bytes) -> str:
+    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()
+
+
+def main() -> int:
+    priv = Ed25519PrivateKey.generate()
+    pub = priv.public_key()
+    x = _b64url(pub.public_bytes(Encoding.Raw, PublicFormat.Raw))
+    priv_jwk = {
+        "kty": "OKP",
+        "crv": "Ed25519",
+        "d": _b64url(priv.private_bytes(Encoding.Raw, PrivateFormat.Raw, NoEncryption())),
+        "x": x,
+    }
+    pub_jwk = {"kty": "OKP", "crv": "Ed25519", "x": x}
+
+    env = {
+        "envelope_version": 1,
+        "issuer": "op_cust",
+        "subject": "s",
+        "issued_at": 1778600000000,
+        "claim_type": "intent_claim",
+        "claim_version": 1,
+        "payload": {"intent_type": "http_call"},
+        "receipt": None,
+        "co_signatures": [],
+    }
+    rows = []
+    for ct in ["intent_claim", "intent_outcome", "detector_signal", "intent_denial", "intent_simulation"]:
+        env["claim_type"] = ct
+        rows.append(
+            {
+                "cose": sign_claim_envelope(env, private_key=priv_jwk, agent_id="ag_cust"),
+                "publicJwk": pub_jwk,
+                "claim_type": ct,
+            }
+        )
+
+    # Node resolves modules relative to the SCRIPT FILE, so the verifier
+    # must live inside packages/sdk/ for its cbor-x import to resolve. Write
+    # it there transiently and clean up.
+    sdk_dir = REPO / "packages" / "sdk"
+    verifier_path = sdk_dir / "_crosslang_verify.mjs"
+    data_path = sdk_dir / "_crosslang_rows.json"
+    try:
+        data_path.write_text(json.dumps(rows))
+        verifier_path.write_text(NODE_VERIFIER)
+        proc = subprocess.run(
+            ["node", str(verifier_path), str(data_path)],
+            cwd=str(sdk_dir),
+            capture_output=True,
+            text=True,
+        )
+        print(proc.stdout, end="")
+        if proc.returncode != 0:
+            print(proc.stderr, file=sys.stderr)
+            print("\n  [FAIL] CROSS-LANGUAGE BYTE-COMPAT FAILED", file=sys.stderr)
+            return proc.returncode
+    finally:
+        verifier_path.unlink(missing_ok=True)
+        data_path.unlink(missing_ok=True)
+    print("\n  [OK] Python-signed COSE verifies under the JS/vault logic for all claim types.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{getstack-0.13.0 → getstack-0.14.0}/src/getstack/__init__.py

@@ -55,10 +55,15 @@ from .identity import IdentityService
 from .inbound_webhooks import InboundWebhookService
 from .partner_tenants import PartnerTenantsService
 from .passport_header_verify import verify_passport_header
+from .verify_offline import verify_passport_offline
+from .sign_claim import sign_claim_envelope
 from .intents import IntentsService
 from .missions import MissionsService
 from .evidence_packs import EvidencePacksService
 from .llm import LlmService
+from .team import TeamService
+from .delivery_methods import DeliveryMethodService
+from .detector_config import DetectorConfigService
 from .passport_session import PassportSession
 from .types import (
     Agent,
@@ -160,6 +165,14 @@ __all__ = [
     "IdentityClaim",
     "IdentitySettings",
     "VerificationSession",
+    # Service classes (for typing / direct construction)
+    "TeamService",
+    "DeliveryMethodService",
+    "DetectorConfigService",
+    # Offline / customer-managed crypto (parity with the JS SDK)
+    "verify_passport_offline",
+    "verify_passport_header",
+    "sign_claim_envelope",
     # Errors
     "StackError",
     "NotFoundError",
@@ -229,6 +242,9 @@ class Stack:
         self.llm = LlmService(self._client)
         self.inbound_webhooks = InboundWebhookService(self._client)
         self.partner_tenants = PartnerTenantsService(self._client)
+        self.team = TeamService(self._client)
+        self.delivery_methods = DeliveryMethodService(self._client)
+        self.detector_config = DetectorConfigService(self._client)
 
     def issue_passport(
         self,
@@ -370,6 +386,10 @@ class AsyncStack:
         from ._async.llm import AsyncLlmService
         from ._async.inbound_webhooks import AsyncInboundWebhookService
         from ._async.partner_tenants import AsyncPartnerTenantsService
+        from ._async.evidence_packs import AsyncEvidencePacksService
+        from ._async.team import AsyncTeamService
+        from ._async.delivery_methods import AsyncDeliveryMethodService
+        from ._async.detector_config import AsyncDetectorConfigService
         from ._async.passport_session import AsyncPassportSession
 
         self.agents = AsyncAgentService(self._client)
@@ -390,6 +410,10 @@ class AsyncStack:
         self.llm = AsyncLlmService(self._client)
         self.inbound_webhooks = AsyncInboundWebhookService(self._client)
         self.partner_tenants = AsyncPartnerTenantsService(self._client)
+        self.evidence_packs = AsyncEvidencePacksService(self._client)
+        self.team = AsyncTeamService(self._client)
+        self.delivery_methods = AsyncDeliveryMethodService(self._client)
+        self.detector_config = AsyncDetectorConfigService(self._client)
         # Stash for issue_passport() — Python doesn't easily expose the
         # class binding without re-importing inside the method body.
         self._AsyncPassportSession = AsyncPassportSession

{getstack-0.13.0 → getstack-0.14.0}/src/getstack/_async/agents.py

@@ -17,13 +17,27 @@ class AsyncAgentService:
         self,
         name: str,
         description: str | None = None,
-        accountability_mode: str = "enforced",
+        profile: str | None = None,
+        accountability_mode: str | None = None,
+        credential_access: str | None = None,
+        key_mode: str | None = None,
         on_warning: str = "notify",
         on_critical: str = "notify",
     ) -> Agent:
-        body: dict[str, Any] = {"name": name, "accountability_mode": accountability_mode}
+        """Register an agent. See the sync :meth:`AgentService.register`
+        docstring — pass ``profile="proxied-llm-bot"`` for a bot that just
+        runs. Unset fields are not sent, so they never clobber a preset."""
+        body: dict[str, Any] = {"name": name}
         if description:
             body["description"] = description
+        if profile is not None:
+            body["profile"] = profile
+        if accountability_mode is not None:
+            body["accountability_mode"] = accountability_mode
+        if credential_access is not None:
+            body["credential_access"] = credential_access
+        if key_mode is not None:
+            body["key_mode"] = key_mode
         if on_warning != "notify":
             body["on_warning"] = on_warning
         if on_critical != "notify":

getstack-0.14.0/src/getstack/_async/delivery_methods.py

@@ -0,0 +1,35 @@
+"""Notification delivery methods (async parity with the JS SDK's
+DeliveryMethodService).
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ..client import AsyncHttpClient
+
+
+class AsyncDeliveryMethodService:
+    def __init__(self, client: AsyncHttpClient):
+        self._client = client
+
+    async def add(self, kind: str, destination: str, **fields: Any) -> dict[str, Any]:
+        body: dict[str, Any] = {"kind": kind, "destination": destination, **fields}
+        return await self._client.post("/v1/notifications/destinations", json=body)
+
+    async def list(self) -> list[dict[str, Any]]:
+        return await self._client.get("/v1/notifications/destinations")
+
+    async def delete(self, destination_id: str) -> dict[str, Any]:
+        return await self._client.delete(f"/v1/notifications/destinations/{destination_id}")
+
+    async def send_verification_code(self, destination_id: str) -> dict[str, Any]:
+        return await self._client.post(f"/v1/notifications/destinations/{destination_id}/send-code")
+
+    async def verify(self, destination_id: str, code: str) -> dict[str, Any]:
+        return await self._client.post(
+            f"/v1/notifications/destinations/{destination_id}/verify", json={"code": code}
+        )
+
+    async def test(self, destination_id: str) -> dict[str, Any]:
+        return await self._client.post(f"/v1/notifications/destinations/{destination_id}/test")

getstack-0.14.0/src/getstack/_async/detector_config.py

@@ -0,0 +1,27 @@
+"""Per-operator detector customization (async parity with the JS SDK's
+DetectorConfigService).
+"""
+
+from __future__ import annotations
+
+from typing import Any
+from urllib.parse import quote
+
+from ..client import AsyncHttpClient
+
+
+class AsyncDetectorConfigService:
+    def __init__(self, client: AsyncHttpClient):
+        self._client = client
+
+    async def list(self) -> dict[str, Any]:
+        return await self._client.get("/v1/detectors/config")
+
+    async def get(self, detector_key: str) -> dict[str, Any]:
+        return await self._client.get(f"/v1/detectors/{quote(detector_key)}/config")
+
+    async def upsert(self, detector_key: str, **config: Any) -> dict[str, Any]:
+        return await self._client.put(f"/v1/detectors/{quote(detector_key)}/config", json=config)
+
+    async def reset(self, detector_key: str) -> None:
+        await self._client.delete(f"/v1/detectors/{quote(detector_key)}/config")

{getstack-0.13.0 → getstack-0.14.0}/src/getstack/_async/dropoffs.py

@@ -42,6 +42,9 @@ class AsyncDropoffService:
             json={"agent_id": agent_id},
         )
 
+    async def expire(self, dropoff_id: str) -> dict[str, Any]:
+        return await self._client.post(f"/v1/dropoffs/{dropoff_id}/expire")
+
     async def get(self, dropoff_id: str) -> dict[str, Any]:
         return await self._client.get(f"/v1/dropoffs/{dropoff_id}")
 

getstack-0.14.0/src/getstack/_async/evidence_packs.py

@@ -0,0 +1,44 @@
+"""Evidence packs — export, get, list (async mirror of EvidencePacksService)."""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+from ..client import AsyncHttpClient
+
+
+class AsyncEvidencePacksService:
+    def __init__(self, client: AsyncHttpClient):
+        self._client = client
+
+    async def export(
+        self,
+        *,
+        scope_kind: str,
+        scope_ref: str,
+        supersedes: str | None = None,
+        air_gap: bool | None = None,
+        output_path: str | None = None,
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"scope": {"kind": scope_kind, "ref": scope_ref}}
+        if supersedes is not None:
+            body["supersedes"] = supersedes
+        if air_gap is not None:
+            body["air_gap"] = air_gap
+        result = await self._client.request("POST", "/v1/evidence-packs", json=body)
+        if output_path is not None and "manifest" in result:
+            with open(output_path, "w", encoding="utf-8") as f:
+                json.dump(result["manifest"], f, indent=2)
+        return result
+
+    async def get(self, pack_id: str) -> dict[str, Any]:
+        return await self._client.request("GET", f"/v1/evidence-packs/{pack_id}")
+
+    async def list(self, *, scope: str | None = None) -> dict[str, Any]:
+        path = "/v1/evidence-packs"
+        if scope is not None:
+            from urllib.parse import urlencode
+
+            path = f"{path}?{urlencode({'scope': scope})}"
+        return await self._client.request("GET", path)

{getstack-0.13.0 → getstack-0.14.0}/src/getstack/_async/notifications.py

@@ -45,5 +45,8 @@ class AsyncNotificationService:
     async def test(self, channel_id: str) -> dict[str, Any]:
         return await self._client.post(f"/v1/notifications/channels/{channel_id}/test")
 
+    async def update(self, channel_id: str, **fields: Any) -> dict[str, Any]:
+        return await self._client.patch(f"/v1/notifications/channels/{channel_id}", json=fields)
+
     async def delete(self, channel_id: str) -> dict[str, Any]:
         return await self._client.delete(f"/v1/notifications/channels/{channel_id}")

{getstack-0.13.0 → getstack-0.14.0}/src/getstack/_async/passports.py

@@ -294,6 +294,41 @@ class AsyncPassportService:
     async def revoke(self, jti: str, reason: str | None = None) -> dict[str, Any]:
         return await self._client.post("/v1/passports/revoke", json={"jti": jti, "reason": reason})
 
+    async def revoke_agent(self, agent_id: str, reason: str | None = None) -> dict[str, Any]:
+        return await self._client.post(f"/v1/passports/revoke-agent/{agent_id}", json={"reason": reason})
+
+    async def revoke_session(self, session_id: str, reason: str | None = None) -> dict[str, Any]:
+        return await self._client.post(
+            f"/v1/passports/revoke-session/{session_id}", json={"reason": reason}
+        )
+
+    async def revoke_all(self, reason: str | None = None) -> dict[str, Any]:
+        return await self._client.post("/v1/passports/revoke-all", json={"reason": reason})
+
+    async def delegate(
+        self,
+        parent_token: str,
+        child_agent_id: str,
+        scopes: list[str] | None = None,
+        ttl_seconds: int | None = None,
+    ) -> Passport:
+        body: dict[str, Any] = {"parent_token": parent_token, "child_agent_id": child_agent_id}
+        if scopes is not None:
+            body["scopes"] = scopes
+        if ttl_seconds is not None:
+            body["ttl_seconds"] = ttl_seconds
+        return _to_passport(await self._client.post("/v1/passports/delegate", json=body))
+
+    async def list_active(
+        self, agent_id: str | None = None, session_id: str | None = None
+    ) -> list[dict[str, Any]]:
+        params: dict[str, Any] = {}
+        if agent_id is not None:
+            params["agent_id"] = agent_id
+        if session_id is not None:
+            params["session_id"] = session_id
+        return await self._client.get("/v1/passports/active", params=params or None)
+
     async def refresh(self, token: str, ttl_seconds: int | None = None) -> Passport:
         body: dict[str, Any] = {"token": token}
         if ttl_seconds:

getstack-0.14.0/src/getstack/_async/services.py

@@ -0,0 +1,81 @@
+"""Async mirror of ServiceService."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ..client import AsyncHttpClient
+
+
+class AsyncServiceService:
+    def __init__(self, client: AsyncHttpClient):
+        self._client = client
+
+    async def list(self) -> list[dict[str, Any]]:
+        # /v1/services/connected (was wrongly /v1/services/connections → 404).
+        return await self._client.get("/v1/services/connected")
+
+    async def list_available(self) -> list[dict[str, Any]]:
+        return await self._client.get("/v1/services")
+
+    async def list_templates(self) -> list[dict[str, Any]]:
+        return await self._client.get("/v1/services/templates")
+
+    async def connect(
+        self,
+        service_id: str,
+        provider: str,
+        credential: str,
+        scopes: list[str] | None = None,
+    ) -> dict[str, Any]:
+        """Connect a catalog (OAuth-family) service by supplying the
+        credential directly. For services not in the catalog, use
+        :meth:`connect_custom`."""
+        body: dict[str, Any] = {
+            "service_id": service_id,
+            "provider": provider,
+            "credential": credential,
+        }
+        if scopes is not None:
+            body["scopes"] = scopes
+        return await self._client.post("/v1/services/connect", json=body)
+
+    async def connect_custom(
+        self,
+        name: str,
+        credential: str | dict[str, str],
+        description: str | None = None,
+        scopes: list[str] | None = None,
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"name": name, "credential": credential}
+        if description:
+            body["description"] = description
+        if scopes:
+            body["scopes"] = scopes
+        return await self._client.post("/v1/services/custom", json=body)
+
+    async def verify(self, connection_id: str) -> dict[str, Any]:
+        return await self._client.post(f"/v1/services/{connection_id}/verify")
+
+    async def disconnect(self, connection_id: str) -> dict[str, Any]:
+        return await self._client.delete(f"/v1/services/{connection_id}/disconnect")
+
+    async def grant_agent_access(
+        self,
+        agent_id: str,
+        service_connection_id: str,
+        scopes: list[str] | None = None,
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {
+            "agent_id": agent_id,
+            "service_connection_id": service_connection_id,
+        }
+        if scopes is not None:
+            body["scopes"] = scopes
+        return await self._client.post("/v1/services/grant", json=body)
+
+    async def revoke_agent_access(self, agent_id: str) -> dict[str, Any]:
+        return await self._client.delete(f"/v1/services/agents/{agent_id}/revoke")
+
+    async def get_agent_permissions(self, agent_id: str) -> dict[str, Any]:
+        return await self._client.get(f"/v1/agents/{agent_id}/permissions")

getstack-0.14.0/src/getstack/_async/team.py

@@ -0,0 +1,37 @@
+"""Team member management (async parity with the JS SDK's TeamService)."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ..client import AsyncHttpClient
+
+
+class AsyncTeamService:
+    def __init__(self, client: AsyncHttpClient):
+        self._client = client
+
+    async def invite(
+        self,
+        email: str,
+        role: str | None = None,
+        allowed_connections: list[str] | None = None,
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"email": email}
+        if role is not None:
+            body["role"] = role
+        if allowed_connections is not None:
+            body["allowed_connections"] = allowed_connections
+        return await self._client.post("/v1/team/members", json=body)
+
+    async def list(self) -> list[dict[str, Any]]:
+        return await self._client.get("/v1/team/members")
+
+    async def update(self, member_id: str, **fields: Any) -> dict[str, Any]:
+        return await self._client.patch(f"/v1/team/members/{member_id}", json=fields)
+
+    async def revoke(self, member_id: str) -> dict[str, Any]:
+        return await self._client.delete(f"/v1/team/members/{member_id}")
+
+    async def accept_invite(self, member_id: str) -> dict[str, Any]:
+        return await self._client.post(f"/v1/team/members/{member_id}/accept")

{getstack-0.13.0 → getstack-0.14.0}/src/getstack/agents.py

@@ -27,6 +27,7 @@ def _to_agent(data: dict[str, Any]) -> Agent:
         created_at=data["created_at"],
         updated_at=data["updated_at"],
         credential_access=data.get("credential_access", "direct"),
+        key_mode=data.get("key_mode", "stack_managed"),
     )
 
 
@@ -41,6 +42,7 @@ class AgentService:
         profile: str | None = None,
         accountability_mode: str | None = None,
         credential_access: str | None = None,
+        key_mode: str | None = None,
         on_warning: str = "notify",
         on_critical: str = "notify",
     ) -> Agent:
@@ -67,6 +69,8 @@ class AgentService:
             body["accountability_mode"] = accountability_mode
         if credential_access is not None:
             body["credential_access"] = credential_access
+        if key_mode is not None:
+            body["key_mode"] = key_mode
         if on_warning != "notify":
             body["on_warning"] = on_warning
         if on_critical != "notify":