getstack 0.17.0__tar.gz → 0.19.0__tar.gz

{getstack-0.17.0 → getstack-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: getstack
-Version: 0.17.0
+Version: 0.19.0
 Summary: Python SDK for STACK — trust infrastructure for AI agents
 Project-URL: Homepage, https://getstack.run
 Project-URL: Documentation, https://getstack.run/docs/sdk

{getstack-0.17.0 → getstack-0.19.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "getstack"
-version = "0.17.0"
+version = "0.19.0"
 description = "Python SDK for STACK — trust infrastructure for AI agents"
 readme = "README.md"
 license = "MIT"

{getstack-0.17.0 → getstack-0.19.0}/src/getstack/__init__.py

@@ -55,6 +55,7 @@ from .skills import SkillService
 from .identity import IdentityService
 from .inbound_webhooks import InboundWebhookService
 from .partner_tenants import PartnerTenantsService
+from .partner_connect import PartnerConnectService
 from .passport_header_verify import verify_passport_header
 from .verify_offline import verify_passport_offline
 from .sign_claim import sign_claim_envelope
@@ -244,6 +245,7 @@ class Stack:
         self.llm = LlmService(self._client)
         self.inbound_webhooks = InboundWebhookService(self._client)
         self.partner_tenants = PartnerTenantsService(self._client)
+        self.partner_connect = PartnerConnectService(self._client)
         self.team = TeamService(self._client)
         self.delivery_methods = DeliveryMethodService(self._client)
         self.detector_config = DetectorConfigService(self._client)
@@ -389,6 +391,7 @@ class AsyncStack:
         from ._async.llm import AsyncLlmService
         from ._async.inbound_webhooks import AsyncInboundWebhookService
         from ._async.partner_tenants import AsyncPartnerTenantsService
+        from ._async.partner_connect import AsyncPartnerConnectService
         from ._async.evidence_packs import AsyncEvidencePacksService
         from ._async.team import AsyncTeamService
         from ._async.delivery_methods import AsyncDeliveryMethodService
@@ -414,6 +417,7 @@ class AsyncStack:
         self.llm = AsyncLlmService(self._client)
         self.inbound_webhooks = AsyncInboundWebhookService(self._client)
         self.partner_tenants = AsyncPartnerTenantsService(self._client)
+        self.partner_connect = AsyncPartnerConnectService(self._client)
         self.evidence_packs = AsyncEvidencePacksService(self._client)
         self.team = AsyncTeamService(self._client)
         self.delivery_methods = AsyncDeliveryMethodService(self._client)

{getstack-0.17.0 → getstack-0.19.0}/src/getstack/_async/agents.py

@@ -76,5 +76,6 @@ class AsyncAgentService:
     async def delete(self, agent_id: str) -> dict[str, Any]:
         return await self._client.delete(f"/v1/agents/{agent_id}")
 
-    async def unblock(self, agent_id: str) -> dict[str, Any]:
-        return await self._client.post(f"/v1/agents/{agent_id}/unblock")
+    async def unblock(self, agent_id: str, governance_approval_id: str | None = None) -> dict[str, Any]:
+        _gov_headers = {"X-Governance-Approval": governance_approval_id} if governance_approval_id else None
+        return await self._client.post(f"/v1/agents/{agent_id}/unblock", extra_headers=_gov_headers)

getstack-0.19.0/src/getstack/_async/detector_config.py

@@ -0,0 +1,35 @@
+"""Per-operator detector customization (async parity with the JS SDK's
+DetectorConfigService).
+"""
+
+from __future__ import annotations
+
+from typing import Any
+from urllib.parse import quote
+
+from ..client import AsyncHttpClient
+
+
+class AsyncDetectorConfigService:
+    def __init__(self, client: AsyncHttpClient):
+        self._client = client
+
+    async def list(self) -> dict[str, Any]:
+        return await self._client.get("/v1/detectors/config")
+
+    async def get(self, detector_key: str) -> dict[str, Any]:
+        return await self._client.get(f"/v1/detectors/{quote(detector_key)}/config")
+
+    async def upsert(
+        self, detector_key: str, governance_approval_id: str | None = None, **config: Any
+    ) -> dict[str, Any]:
+        _gov_headers = {"X-Governance-Approval": governance_approval_id} if governance_approval_id else None
+        return await self._client.put(
+            f"/v1/detectors/{quote(detector_key)}/config", json=config, extra_headers=_gov_headers
+        )
+
+    async def reset(self, detector_key: str, governance_approval_id: str | None = None) -> None:
+        _gov_headers = {"X-Governance-Approval": governance_approval_id} if governance_approval_id else None
+        await self._client.delete(
+            f"/v1/detectors/{quote(detector_key)}/config", extra_headers=_gov_headers
+        )

getstack-0.19.0/src/getstack/_async/partner_connect.py

@@ -0,0 +1,43 @@
+"""Async mirror of PartnerConnectService (GET-210)."""
+
+from __future__ import annotations
+
+from typing import Any, Optional
+
+from ..client import AsyncHttpClient
+
+
+class AsyncPartnerConnectService:
+    def __init__(self, client: AsyncHttpClient):
+        self._client = client
+
+    async def connect(
+        self,
+        email: str,
+        external_customer_id: Optional[str] = None,
+        scopes: Optional[list[str]] = None,
+        providers: Optional[list[str]] = None,
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"email": email}
+        if external_customer_id is not None:
+            body["external_customer_id"] = external_customer_id
+        if scopes is not None:
+            body["scopes"] = scopes
+        if providers is not None:
+            body["providers"] = providers
+        return await self._client.post("/v1/partner/connect", json=body)
+
+    async def list_connections(self) -> list[dict[str, Any]]:
+        res = await self._client.get("/v1/partner/connections")
+        return list(res.get("connections", []))
+
+    async def get_connection(self, grant_id: str) -> dict[str, Any]:
+        return await self._client.get(f"/v1/partner/connections/{grant_id}")
+
+    async def revoke_connection(self, grant_id: str) -> dict[str, Any]:
+        return await self._client.delete(f"/v1/partner/connections/{grant_id}")
+
+    async def rotate_token(self, grant_id: str) -> dict[str, Any]:
+        return await self._client.post(
+            f"/v1/partner/connections/{grant_id}/rotate-token", json={}
+        )

{getstack-0.17.0 → getstack-0.19.0}/src/getstack/_async/reviews.py

@@ -38,13 +38,17 @@ class AsyncReviewService:
         decision: str,
         notes: str | None = None,
         block_future: bool = False,
+        governance_approval_id: str | None = None,
     ) -> ReviewDecisionResult:
         body: dict[str, Any] = {"decision": decision}
         if notes:
             body["notes"] = notes
         if block_future:
             body["block_future"] = True
-        data = await self._client.post(f"/v1/passports/reviews/{checkout_id}/decide", json=body)
+        _gov_headers = {"X-Governance-Approval": governance_approval_id} if governance_approval_id else None
+        data = await self._client.post(
+            f"/v1/passports/reviews/{checkout_id}/decide", json=body, extra_headers=_gov_headers
+        )
         return ReviewDecisionResult(
             review_id=data["review_id"],
             agent_id=data["agent_id"],

{getstack-0.17.0 → getstack-0.19.0}/src/getstack/agents.py

@@ -120,5 +120,9 @@ class AgentService:
     def delete(self, agent_id: str) -> dict[str, Any]:
         return self._client.delete(f"/v1/agents/{agent_id}")
 
-    def unblock(self, agent_id: str) -> dict[str, Any]:
-        return self._client.post(f"/v1/agents/{agent_id}/unblock")
+    def unblock(self, agent_id: str, governance_approval_id: str | None = None) -> dict[str, Any]:
+        """GET-230: from API-key sessions this 403s with
+        GOVERNANCE_APPROVAL_REQUIRED - retry with governance_approval_id
+        after human approval in the dashboard."""
+        _gov_headers = {"X-Governance-Approval": governance_approval_id} if governance_approval_id else None
+        return self._client.post(f"/v1/agents/{agent_id}/unblock", extra_headers=_gov_headers)

{getstack-0.17.0 → getstack-0.19.0}/src/getstack/client.py

@@ -72,11 +72,11 @@ class HttpClient:
     def patch(self, path: str, json: Any = None) -> Any:
         return self.request("PATCH", path, json=json)
 
-    def put(self, path: str, json: Any = None) -> Any:
-        return self.request("PUT", path, json=json)
+    def put(self, path: str, json: Any = None, extra_headers: dict[str, str] | None = None) -> Any:
+        return self.request("PUT", path, json=json, extra_headers=extra_headers)
 
-    def delete(self, path: str) -> Any:
-        return self.request("DELETE", path)
+    def delete(self, path: str, extra_headers: dict[str, str] | None = None) -> Any:
+        return self.request("DELETE", path, extra_headers=extra_headers)
 
     def close(self) -> None:
         self._client.close()

{getstack-0.17.0 → getstack-0.19.0}/src/getstack/detector_config.py

@@ -27,13 +27,26 @@ class DetectorConfigService:
         built-in defaults)."""
         return self._client.get(f"/v1/detectors/{quote(detector_key)}/config")
 
-    def upsert(self, detector_key: str, **config: Any) -> dict[str, Any]:
+    def upsert(
+        self, detector_key: str, governance_approval_id: str | None = None, **config: Any
+    ) -> dict[str, Any]:
         """Upsert this operator's customization for the named detector.
         studio+ only. Accepts custom_patterns / whitelist_patterns /
-        severity_overrides / enabled."""
-        return self._client.put(f"/v1/detectors/{quote(detector_key)}/config", json=config)
+        severity_overrides / enabled.
 
-    def reset(self, detector_key: str) -> None:
+        GET-230: loosening changes 403 with GOVERNANCE_APPROVAL_REQUIRED
+        from API-key sessions - retry with governance_approval_id after a
+        human approves in the dashboard (/governance/approvals)."""
+        _gov_headers = {"X-Governance-Approval": governance_approval_id} if governance_approval_id else None
+        return self._client.put(
+            f"/v1/detectors/{quote(detector_key)}/config", json=config, extra_headers=_gov_headers
+        )
+
+    def reset(self, detector_key: str, governance_approval_id: str | None = None) -> None:
         """Reset a detector to built-in defaults (deletes the row). studio+
-        only."""
-        self._client.delete(f"/v1/detectors/{quote(detector_key)}/config")
+        only. GET-230: always requires a governance approval from API-key
+        sessions."""
+        _gov_headers = {"X-Governance-Approval": governance_approval_id} if governance_approval_id else None
+        self._client.delete(
+            f"/v1/detectors/{quote(detector_key)}/config", extra_headers=_gov_headers
+        )

getstack-0.19.0/src/getstack/partner_connect.py

@@ -0,0 +1,69 @@
+"""GET-210 — "Connect with STACK" partner surface (sync).
+
+connect(email) creates a USER-OWNED STACK account on the customer's
+real email (Express model, notice email) or opens a consent flow when
+the account exists, and returns an opaque ``sk_grant_*`` token you
+attach to the calls you already make — same Bearer header, scoped to
+what the grant created, revocable by the user under /services.
+
+Supersedes the Phase 5.6 child-tenant OWNERSHIP semantics; the tenant
+surface remains available through its deprecation window.
+
+Near-zero integration::
+
+    res = stack.partner_connect.connect(email="customer@example.com")
+    user_stack = Stack(api_key=res["grant_token"])
+    # register agents, connect your provider, issue passports, proxy.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Optional
+
+from .client import HttpClient
+
+
+class PartnerConnectService:
+    def __init__(self, client: HttpClient):
+        self._client = client
+
+    def connect(
+        self,
+        email: str,
+        external_customer_id: Optional[str] = None,
+        scopes: Optional[list[str]] = None,
+        providers: Optional[list[str]] = None,
+    ) -> dict[str, Any]:
+        """One call: create-on-email or consent-request.
+
+        The response's ``grant_token`` is present EXACTLY ONCE, on the
+        call that created the grant. ``status`` is ``active`` (new
+        account) or ``pending_consent`` (existing account — the token
+        authenticates nothing until the user approves).
+        """
+        body: dict[str, Any] = {"email": email}
+        if external_customer_id is not None:
+            body["external_customer_id"] = external_customer_id
+        if scopes is not None:
+            body["scopes"] = scopes
+        if providers is not None:
+            body["providers"] = providers
+        return self._client.post("/v1/partner/connect", json=body)
+
+    def list_connections(self) -> list[dict[str, Any]]:
+        res = self._client.get("/v1/partner/connections")
+        return list(res.get("connections", []))
+
+    def get_connection(self, grant_id: str) -> dict[str, Any]:
+        return self._client.get(f"/v1/partner/connections/{grant_id}")
+
+    def revoke_connection(self, grant_id: str) -> dict[str, Any]:
+        """Revoke the edge. Cascades: grant-created agents' passports,
+        webhooks, and connections all die with it."""
+        return self._client.delete(f"/v1/partner/connections/{grant_id}")
+
+    def rotate_token(self, grant_id: str) -> dict[str, Any]:
+        """Rotate the grant token (lost/leaked). New plaintext returned once."""
+        return self._client.post(
+            f"/v1/partner/connections/{grant_id}/rotate-token", json={}
+        )

{getstack-0.17.0 → getstack-0.19.0}/src/getstack/reviews.py

@@ -39,13 +39,20 @@ class ReviewService:
         decision: str,
         notes: str | None = None,
         block_future: bool = False,
+        governance_approval_id: str | None = None,
     ) -> ReviewDecisionResult:
+        """GET-230: decision='approved' from API-key sessions 403s with
+        GOVERNANCE_APPROVAL_REQUIRED - retry with governance_approval_id
+        after human approval. 'blocked' needs no approval."""
         body: dict[str, Any] = {"decision": decision}
         if notes:
             body["notes"] = notes
         if block_future:
             body["block_future"] = True
-        data = self._client.post(f"/v1/passports/reviews/{checkout_id}/decide", json=body)
+        _gov_headers = {"X-Governance-Approval": governance_approval_id} if governance_approval_id else None
+        data = self._client.post(
+            f"/v1/passports/reviews/{checkout_id}/decide", json=body, extra_headers=_gov_headers
+        )
         return ReviewDecisionResult(
             review_id=data["review_id"],
             agent_id=data["agent_id"],

{getstack-0.17.0 → getstack-0.19.0}/tests/test_parity.py

@@ -34,7 +34,8 @@ EXPECTED_SERVICES = [
     "agents", "passports", "credentials", "services", "dropoffs", "reviews",
     "notifications", "audit", "proxy", "scan", "usage", "security_events",
     "skills", "identity", "intents", "missions", "evidence_packs", "llm",
-    "inbound_webhooks", "partner_tenants", "team", "delivery_methods",
+    "inbound_webhooks", "partner_tenants",
+    "partner_connect", "team", "delivery_methods",
     "detector_config",
 ]
 

getstack-0.17.0/src/getstack/_async/detector_config.py

@@ -1,27 +0,0 @@
-"""Per-operator detector customization (async parity with the JS SDK's
-DetectorConfigService).
-"""
-
-from __future__ import annotations
-
-from typing import Any
-from urllib.parse import quote
-
-from ..client import AsyncHttpClient
-
-
-class AsyncDetectorConfigService:
-    def __init__(self, client: AsyncHttpClient):
-        self._client = client
-
-    async def list(self) -> dict[str, Any]:
-        return await self._client.get("/v1/detectors/config")
-
-    async def get(self, detector_key: str) -> dict[str, Any]:
-        return await self._client.get(f"/v1/detectors/{quote(detector_key)}/config")
-
-    async def upsert(self, detector_key: str, **config: Any) -> dict[str, Any]:
-        return await self._client.put(f"/v1/detectors/{quote(detector_key)}/config", json=config)
-
-    async def reset(self, detector_key: str) -> None:
-        await self._client.delete(f"/v1/detectors/{quote(detector_key)}/config")