getstack 1.3.0__tar.gz → 2.0.0__tar.gz

{getstack-1.3.0 → getstack-2.0.0}/.gitignore

@@ -89,3 +89,6 @@ scratchpad/
 
 # Local venv for the AgentDojo benchmark harness (never commit)
 .venv-agentdojo/
+
+# Isolated test-only LangChain, CrewAI and AutoGen verification environment.
+.tmp/fleet-framework-venv/

{getstack-1.3.0 → getstack-2.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: getstack
-Version: 1.3.0
+Version: 2.0.0
 Summary: Python SDK for STACK — trust infrastructure for AI agents
 Project-URL: Homepage, https://getstack.run
 Project-URL: Documentation, https://getstack.run/docs/sdk
@@ -44,32 +44,44 @@ npx -y @getstackrun/cli auth login
 ```
 
 ```python
-from getstack import Stack
-
-# Zero-arg constructor reads ~/.stack/credentials.json (OAuth refresh token).
-# Falls back to STACK_API_KEY env var, then constructor api_key= for CI.
-stack = Stack()
-
-# 1. Register an agent (one-time)
-agent = stack.agents.register("my-agent", accountability_mode="enforced")
-
-# 2. In your agent runtime, switch to per-agent keypair mode
-agent_stack = Stack(agent_id=agent.id)
-# First run: generates an Ed25519 keypair locally + enrolls the public
-# half via /v1/agents/<id>/enroll. Persisted at ~/.stack/agents/<id>.json
-# (mode 0600). Every subsequent call signs a fresh 60-second JWT.
-
-# 3. Run a mission with automatic checkpoints and checkout
-with agent_stack.passports.mission(
-    agent_id=agent.id,
-    intent="Process invoices from Slack",
-    services=["slack", "stripe"],
-    checkpoint_interval="5m",
-) as mission:
-    mission.log("slack", "read_channel", "#invoices")
-    mission.log("stripe", "create_invoice")
-    # Checkpoints are submitted automatically on schedule
-# Checkout is submitted automatically when the block exits
+import hashlib
+import json
+from getstack.errors import StackError
+
+
+def run_fleet_mission_example(stack, request, provider_url="https://slack.com/api/chat.postMessage"):
+    started = stack.missions.start(request)
+    repeated = stack.missions.start(request)
+    assert repeated["mission_id"] == started["mission_id"]
+    operation_id = hashlib.sha256(json.dumps([started["mission_id"], "support-update"]).encode()).hexdigest()
+    response = stack.proxy.request("slack", provider_url, "POST",
+        body={"channel": "C123", "text": "Support update"},
+        passport_token=started["passport"]["token"], authority_request_id=operation_id)
+    assert response.status == 200
+    try:
+        stack.proxy.request("slack", provider_url, "POST", body={"channel": "OTHER", "text": "Support update"},
+            passport_token=started["passport"]["token"], authority_request_id=operation_id + "_denied")
+    except StackError as error:
+        assert error.status_code == 403
+    else:
+        raise AssertionError("Expected channel restriction")
+    before = stack.missions.get(started["mission_id"])
+    renewed = stack.missions.renew(started["mission_id"])
+    after = stack.missions.get(renewed["mission_id"])
+    assert renewed["mission_id"] == started["mission_id"]
+    assert after["fleet"]["limits"] == before["fleet"]["limits"]
+    assert after["fleet"]["usage"] == before["fleet"]["usage"]
+    completed = stack.missions.complete(started["mission_id"], output={"done": True})
+    assert completed["terminal_state"] == "completed_successful"
+    stopped = stack.missions.start({**request, "idempotency_key": request["idempotency_key"] + "-stop"})
+    stack.missions.revoke(stopped["mission_id"], reason="operator_initiated_clean")
+    try:
+        stack.missions.renew(stopped["mission_id"])
+    except StackError:
+        pass
+    else:
+        raise AssertionError("Expected revoked Mission")
+    return {"mission_id": started["mission_id"], "operation_id": operation_id, "completed": True, "revoked": True}
 ```
 
 ## Authentication
@@ -94,23 +106,15 @@ stack = Stack()
 
 See [/docs/security/stack-auth](https://getstack.run/docs/security/stack-auth) for the full auth model and [/docs/security/agent-keys](https://getstack.run/docs/security/agent-keys) for the per-agent keypair story.
 
-## Continuous missions (24/7 agents)
+## Renew a Mission's Passport
 
 ```python
-for mission in stack.passports.continuous_mission(
-    agent_id=agent.id,
-    intent="Monitor Slack channels",
-    services=["slack"],
-    rotation_interval="4h",
-    checkpoint_interval="5m",
-):
-    while not mission.should_rotate:
-        event = wait_for_event()
-        mission.log("slack", "read_message")
-        process(event)
-    # Passport rotates automatically at the boundary
+renewed = stack.missions.renew(mission_id)
+passport_token = renewed["passport"]["token"]
 ```
 
+Renewal keeps the same Mission, permission and recorded usage. Its deadline and limits still apply. Start a new Mission for the next job.
+
 ## Services
 
 ```python

{getstack-1.3.0 → getstack-2.0.0}/README.md

@@ -17,32 +17,44 @@ npx -y @getstackrun/cli auth login
 ```
 
 ```python
-from getstack import Stack
-
-# Zero-arg constructor reads ~/.stack/credentials.json (OAuth refresh token).
-# Falls back to STACK_API_KEY env var, then constructor api_key= for CI.
-stack = Stack()
-
-# 1. Register an agent (one-time)
-agent = stack.agents.register("my-agent", accountability_mode="enforced")
-
-# 2. In your agent runtime, switch to per-agent keypair mode
-agent_stack = Stack(agent_id=agent.id)
-# First run: generates an Ed25519 keypair locally + enrolls the public
-# half via /v1/agents/<id>/enroll. Persisted at ~/.stack/agents/<id>.json
-# (mode 0600). Every subsequent call signs a fresh 60-second JWT.
-
-# 3. Run a mission with automatic checkpoints and checkout
-with agent_stack.passports.mission(
-    agent_id=agent.id,
-    intent="Process invoices from Slack",
-    services=["slack", "stripe"],
-    checkpoint_interval="5m",
-) as mission:
-    mission.log("slack", "read_channel", "#invoices")
-    mission.log("stripe", "create_invoice")
-    # Checkpoints are submitted automatically on schedule
-# Checkout is submitted automatically when the block exits
+import hashlib
+import json
+from getstack.errors import StackError
+
+
+def run_fleet_mission_example(stack, request, provider_url="https://slack.com/api/chat.postMessage"):
+    started = stack.missions.start(request)
+    repeated = stack.missions.start(request)
+    assert repeated["mission_id"] == started["mission_id"]
+    operation_id = hashlib.sha256(json.dumps([started["mission_id"], "support-update"]).encode()).hexdigest()
+    response = stack.proxy.request("slack", provider_url, "POST",
+        body={"channel": "C123", "text": "Support update"},
+        passport_token=started["passport"]["token"], authority_request_id=operation_id)
+    assert response.status == 200
+    try:
+        stack.proxy.request("slack", provider_url, "POST", body={"channel": "OTHER", "text": "Support update"},
+            passport_token=started["passport"]["token"], authority_request_id=operation_id + "_denied")
+    except StackError as error:
+        assert error.status_code == 403
+    else:
+        raise AssertionError("Expected channel restriction")
+    before = stack.missions.get(started["mission_id"])
+    renewed = stack.missions.renew(started["mission_id"])
+    after = stack.missions.get(renewed["mission_id"])
+    assert renewed["mission_id"] == started["mission_id"]
+    assert after["fleet"]["limits"] == before["fleet"]["limits"]
+    assert after["fleet"]["usage"] == before["fleet"]["usage"]
+    completed = stack.missions.complete(started["mission_id"], output={"done": True})
+    assert completed["terminal_state"] == "completed_successful"
+    stopped = stack.missions.start({**request, "idempotency_key": request["idempotency_key"] + "-stop"})
+    stack.missions.revoke(stopped["mission_id"], reason="operator_initiated_clean")
+    try:
+        stack.missions.renew(stopped["mission_id"])
+    except StackError:
+        pass
+    else:
+        raise AssertionError("Expected revoked Mission")
+    return {"mission_id": started["mission_id"], "operation_id": operation_id, "completed": True, "revoked": True}
 ```
 
 ## Authentication
@@ -67,23 +79,15 @@ stack = Stack()
 
 See [/docs/security/stack-auth](https://getstack.run/docs/security/stack-auth) for the full auth model and [/docs/security/agent-keys](https://getstack.run/docs/security/agent-keys) for the per-agent keypair story.
 
-## Continuous missions (24/7 agents)
+## Renew a Mission's Passport
 
 ```python
-for mission in stack.passports.continuous_mission(
-    agent_id=agent.id,
-    intent="Monitor Slack channels",
-    services=["slack"],
-    rotation_interval="4h",
-    checkpoint_interval="5m",
-):
-    while not mission.should_rotate:
-        event = wait_for_event()
-        mission.log("slack", "read_message")
-        process(event)
-    # Passport rotates automatically at the boundary
+renewed = stack.missions.renew(mission_id)
+passport_token = renewed["passport"]["token"]
 ```
 
+Renewal keeps the same Mission, permission and recorded usage. Its deadline and limits still apply. Start a new Mission for the next job.
+
 ## Services
 
 ```python

{getstack-1.3.0 → getstack-2.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "getstack"
-version = "1.3.0"
+version = "2.0.0"
 description = "Python SDK for STACK — trust infrastructure for AI agents"
 readme = "README.md"
 license = "MIT"

{getstack-1.3.0 → getstack-2.0.0}/src/getstack/__init__.py

@@ -1,39 +1,51 @@
-"""STACK Python SDK — trust infrastructure for AI agents.
-
-Usage::
-
-    from getstack import Stack
-
-    stack = Stack(api_key="sk_live_...")
-    agent = stack.agents.register("my-agent")
-
-    with stack.passports.mission(
-        agent_id=agent.id,
-        intent="Process invoices",
-        services=["slack", "stripe"],
-    ) as mission:
-        mission.log("slack", "read_channel", "#invoices")
-        mission.log("stripe", "create_invoice")
-
-For OAuth auth::
-
-    stack = Stack.from_oauth(
-        client_id="...",
-        client_secret="...",
-        access_token="...",
-        refresh_token="...",
-    )
-
-For async usage::
-
-    from getstack import AsyncStack
-
-    stack = AsyncStack(api_key="sk_live_...")
+"""STACK Python SDK.
+
+Fleet Mission example::
+
+    import hashlib
+    import json
+    from getstack.errors import StackError
+
+
+    def run_fleet_mission_example(stack, request, provider_url="https://slack.com/api/chat.postMessage"):
+        started = stack.missions.start(request)
+        repeated = stack.missions.start(request)
+        assert repeated["mission_id"] == started["mission_id"]
+        operation_id = hashlib.sha256(json.dumps([started["mission_id"], "support-update"]).encode()).hexdigest()
+        response = stack.proxy.request("slack", provider_url, "POST",
+            body={"channel": "C123", "text": "Support update"},
+            passport_token=started["passport"]["token"], authority_request_id=operation_id)
+        assert response.status == 200
+        try:
+            stack.proxy.request("slack", provider_url, "POST", body={"channel": "OTHER", "text": "Support update"},
+                passport_token=started["passport"]["token"], authority_request_id=operation_id + "_denied")
+        except StackError as error:
+            assert error.status_code == 403
+        else:
+            raise AssertionError("Expected channel restriction")
+        before = stack.missions.get(started["mission_id"])
+        renewed = stack.missions.renew(started["mission_id"])
+        after = stack.missions.get(renewed["mission_id"])
+        assert renewed["mission_id"] == started["mission_id"]
+        assert after["fleet"]["limits"] == before["fleet"]["limits"]
+        assert after["fleet"]["usage"] == before["fleet"]["usage"]
+        completed = stack.missions.complete(started["mission_id"], output={"done": True})
+        assert completed["terminal_state"] == "completed_successful"
+        stopped = stack.missions.start({**request, "idempotency_key": request["idempotency_key"] + "-stop"})
+        stack.missions.revoke(stopped["mission_id"], reason="operator_initiated_clean")
+        try:
+            stack.missions.renew(stopped["mission_id"])
+        except StackError:
+            pass
+        else:
+            raise AssertionError("Expected revoked Mission")
+        return {"mission_id": started["mission_id"], "operation_id": operation_id, "completed": True, "revoked": True}
 """
 
 from __future__ import annotations
 
 import os
+from importlib.metadata import PackageNotFoundError, version
 from typing import Any
 
 from .auth import ApiKeyAuth, SessionAuth, OAuthAuth, CredentialsFileAuth
@@ -62,6 +74,8 @@ from .verify_offline import verify_passport_offline
 from .sign_claim import sign_claim_envelope
 from .intents import IntentsService
 from .missions import MissionsService
+from .fleets import FleetsService
+from ._async.fleets import AsyncFleetsService
 from .evidence_packs import EvidencePacksService
 from .llm import LlmService
 from .team import TeamService
@@ -107,7 +121,10 @@ from .errors import (
     PassportBlockedError,
 )
 
-__version__ = "0.2.0"
+try:
+    __version__ = version("getstack")
+except PackageNotFoundError:
+    __version__ = "0+unknown"
 
 
 def _build_static_auth(
@@ -191,6 +208,8 @@ __all__ = [
     "DetectorConfigService",
     "PiiConfigService",
     "AuthorityService",
+    "FleetsService",
+    "AsyncFleetsService",
     "AsyncAuthorityService",
     # Offline / customer-managed crypto (parity with the JS SDK)
     "verify_passport_offline",
@@ -234,11 +253,10 @@ class Stack:
         if _auth:
             auth: ApiKeyAuth | SessionAuth | OAuthAuth | CredentialsFileAuth | AgentKeypairAuth = _auth
         elif agent_id:
-            static_auth = _build_static_auth(api_key=api_key, base_url=base_url)
             auth = AgentKeypairAuth(
                 agent_id=agent_id,
                 api_base_url=base_url,
-                bearer_provider=lambda: static_auth.get_headers()["Authorization"].split(" ", 1)[1],
+                bearer_provider=lambda: _build_static_auth(api_key=api_key, base_url=base_url).get_headers()["Authorization"].split(" ", 1)[1],
             )
         elif api_key or os.environ.get("STACK_API_KEY"):
             auth = ApiKeyAuth(api_key or os.environ["STACK_API_KEY"])
@@ -262,6 +280,7 @@ class Stack:
         self.identity = IdentityService(self._client)
         self.intents = IntentsService(self._client)
         self.missions = MissionsService(self._client)
+        self.fleets = FleetsService(self._client)
         self.evidence_packs = EvidencePacksService(self._client)
         self.llm = LlmService(self._client)
         self.inbound_webhooks = InboundWebhookService(self._client)
@@ -381,11 +400,10 @@ class AsyncStack:
         if _auth:
             auth: ApiKeyAuth | SessionAuth | OAuthAuth | CredentialsFileAuth | AgentKeypairAuth = _auth
         elif agent_id:
-            static_auth = _build_static_auth(api_key=api_key, base_url=base_url)
             auth = AgentKeypairAuth(
                 agent_id=agent_id,
                 api_base_url=base_url,
-                bearer_provider=lambda: static_auth.get_headers()["Authorization"].split(" ", 1)[1],
+                bearer_provider=lambda: _build_static_auth(api_key=api_key, base_url=base_url).get_headers()["Authorization"].split(" ", 1)[1],
             )
         elif api_key or os.environ.get("STACK_API_KEY"):
             auth = ApiKeyAuth(api_key or os.environ["STACK_API_KEY"])
@@ -441,6 +459,7 @@ class AsyncStack:
         self.identity = AsyncIdentityService(self._client)
         self.intents = AsyncIntentsService(self._client)
         self.missions = AsyncMissionsService(self._client)
+        self.fleets = AsyncFleetsService(self._client)
         self.llm = AsyncLlmService(self._client)
         self.inbound_webhooks = AsyncInboundWebhookService(self._client)
         self.partner_tenants = AsyncPartnerTenantsService(self._client)

getstack-2.0.0/src/getstack/_async/fleets.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+from typing import Any
+from urllib.parse import quote
+from .._fleet_key import prepare_fleet_key
+from ..client import AsyncHttpClient
+
+
+class AsyncFleetsService:
+    def __init__(self, client: AsyncHttpClient):
+        self._client = client
+
+    async def session(self, fleet_policy_id: str | None = None) -> dict[str, Any]:
+        return await self._client.request("POST", "/v1/fleets/session", json={"fleet_policy_id": fleet_policy_id} if fleet_policy_id else {})
+
+    async def workload_enrollment_challenge(self, policy_id: str) -> dict[str, Any]:
+        return await self._client.request("POST", f"/v1/fleets/{quote(policy_id, safe='')}/workload/enrollment-challenges", json={})
+
+    async def enroll_workload(self, policy_id: str, request: dict[str, Any]) -> dict[str, Any]:
+        return await self._client.request("POST", f"/v1/fleets/{quote(policy_id, safe='')}/workload/enroll", json=request)
+
+    async def enroll_workload_local(self, policy_id: str, *, name: str, idempotency_key: str) -> dict[str, Any]:
+        public_key, sign, persist = prepare_fleet_key(policy_id, idempotency_key)
+        challenge = await self.workload_enrollment_challenge(policy_id)
+        result = await self.enroll_workload(policy_id, {"name": name, "idempotency_key": idempotency_key,
+            "public_key": public_key, "challenge_id": challenge["challenge_id"], "proof": sign(challenge["challenge"])})
+        persist(result["agent_id"])
+        return result
+
+    async def enroll_local(self, policy_id: str, *, name: str, idempotency_key: str) -> dict[str, Any]:
+        public_key, sign, persist = prepare_fleet_key(policy_id, idempotency_key)
+        challenge = await self.enrollment_challenge(policy_id)
+        result = await self.enroll(policy_id, {"name": name, "idempotency_key": idempotency_key,
+            "public_key": public_key, "challenge_id": challenge["challenge_id"], "proof": sign(challenge["challenge"])})
+        persist(result["agent_id"])
+        return result
+
+    async def list(self) -> list[dict[str, Any]]:
+        return await self._client.request("GET", "/v1/fleets")
+
+    async def list_page(self, page: int = 1, limit: int = 20) -> dict[str, Any]:
+        return await self._client.request("GET", "/v1/fleets", params={"page": page, "limit": limit})
+
+    async def get(self, policy_id: str) -> dict[str, Any]:
+        return await self._client.request("GET", f"/v1/fleets/{quote(policy_id, safe='')}")
+
+    async def membership(self, agent_id: str) -> dict[str, Any] | None:
+        return await self._client.request("GET", f"/v1/fleets/membership/{quote(agent_id, safe='')}")
+
+    async def members_page(self, policy_id: str, page: int = 1, limit: int = 20) -> dict[str, Any]:
+        return await self._client.request("GET", f"/v1/fleets/{quote(policy_id, safe='')}/members", params={"page": page, "limit": limit})
+
+    async def activate(self, definition: dict[str, Any], *, idempotency_key: str,
+                 governance_approval_id: str | None = None) -> dict[str, Any]:
+        headers = {"Idempotency-Key": idempotency_key}
+        if governance_approval_id is not None:
+            headers["X-Governance-Approval"] = governance_approval_id
+        return await self._client.request("POST", "/v1/fleets", json=definition, extra_headers=headers)
+
+    async def revise(self, policy_id: str, definition: dict[str, Any], *,
+               expected_revision: int, idempotency_key: str,
+               governance_approval_id: str | None = None) -> dict[str, Any]:
+        headers = {"If-Match": str(expected_revision), "Idempotency-Key": idempotency_key}
+        if governance_approval_id is not None:
+            headers["X-Governance-Approval"] = governance_approval_id
+        return await self._client.request("PUT", f"/v1/fleets/{quote(policy_id, safe='')}",
+                                    json=definition, extra_headers=headers)
+
+    async def members(self, policy_id: str) -> list[dict[str, Any]]:
+        return await self._client.request("GET", f"/v1/fleets/{quote(policy_id, safe='')}/members")
+
+    async def revoke_member(self, policy_id: str, agent_id: str) -> dict[str, Any]:
+        return await self._client.request("POST", f"/v1/fleets/{quote(policy_id, safe='')}/members/{quote(agent_id, safe='')}/revoke", json={})
+
+    async def revoke(self, policy_id: str) -> dict[str, Any]:
+        return await self._client.request("POST", f"/v1/fleets/{quote(policy_id, safe='')}/revoke", json={})
+
+    async def enrollment_challenge(self, policy_id: str) -> dict[str, Any]:
+        return await self._client.request("POST", f"/v1/fleets/{quote(policy_id, safe='')}/enrollment-challenges", json={})
+
+    async def enroll(self, policy_id: str, request: dict[str, Any]) -> dict[str, Any]:
+        return await self._client.request("POST", f"/v1/fleets/{quote(policy_id, safe='')}/enroll", json=request)

{getstack-1.3.0 → getstack-2.0.0}/src/getstack/_async/missions.py

@@ -12,6 +12,12 @@ class AsyncMissionsService:
     def __init__(self, client: AsyncHttpClient):
         self._client = client
 
+    async def start(self, request: dict[str, Any]) -> dict[str, Any]:
+        return await self._client.request("POST", "/v1/missions/start", json=request)
+
+    async def renew(self, mission_id: str) -> dict[str, Any]:
+        return await self._client.request("POST", f"/v1/missions/{quote(mission_id, safe='')}/renew", json={})
+
     async def open(
         self,
         intent_summary: str,
@@ -29,6 +35,12 @@ class AsyncMissionsService:
         cap_behavior: dict[str, str] | None = None,
         expires_in_seconds: int | None = None,
         parent_passport_services: list[str] | None = None,
+        fleet_policy_id: str | None = None,
+        idempotency_key: str | None = None,
+        requested_access: list[dict[str, Any]] | None = None,
+        requested_operations: list[dict[str, Any]] | None = None,
+        limits: dict[str, Any] | None = None,
+        authority_binding_ids: list[str] | None = None,
     ) -> dict[str, Any]:
         body: dict[str, Any] = {"intent_summary": intent_summary}
         if intent_services is not None:
@@ -57,6 +69,11 @@ class AsyncMissionsService:
             body["expires_in_seconds"] = expires_in_seconds
         if parent_passport_services is not None:
             body["parent_passport_services"] = parent_passport_services
+        for key, value in {"fleet_policy_id": fleet_policy_id, "idempotency_key": idempotency_key,
+            "requested_access": requested_access, "requested_operations": requested_operations,
+            "limits": limits, "authority_binding_ids": authority_binding_ids}.items():
+            if value is not None:
+                body[key] = value
         return await self._client.request("POST", "/v1/missions", json=body)
 
     async def complete(

{getstack-1.3.0 → getstack-2.0.0}/src/getstack/_async/partner_tenants.py

@@ -1,4 +1,4 @@
-"""Async mirror of PartnerTenantsService (Phase 5.6)."""
+"""Async mirror of PartnerTenantsService (white-label tenants)."""
 
 from __future__ import annotations
 
@@ -8,8 +8,6 @@ from urllib.parse import quote
 from ..client import AsyncHttpClient
 
 
-Tier = Literal["free", "developer", "pro", "business", "enterprise"]
-
 
 class AsyncPartnerTenantsService:
     def __init__(self, client: AsyncHttpClient):
@@ -18,23 +16,36 @@ class AsyncPartnerTenantsService:
     async def create(
         self,
         external_customer_id: Optional[str] = None,
-        tier: Optional[Tier] = None,
     ) -> dict[str, Any]:
+        """Create a white-label tenant.
+
+        Tenants have no plan of their own; they draw from your allowance
+        and wallet. Returns operator_id, api_key (shown once — store it),
+        external_customer_id, tier ('partner'), billing ('partner') and
+        created_at. Raises with code TENANT_LIMIT_REACHED (409) when your
+        deal caps the tenant count.
+        """
         body: dict[str, Any] = {}
         if external_customer_id is not None:
             body["external_customer_id"] = external_customer_id
-        if tier is not None:
-            body["tier"] = tier
         return await self._client.post("/v1/partner/tenants", json=body)
 
     async def list(self) -> list[dict[str, Any]]:
+        """List your tenants. Each carries ``usage`` ({period, actions}):
+        its month-to-date share of your action pool, when available."""
         res = await self._client.get("/v1/partner/tenants")
         return list(res.get("tenants", []))
 
     async def get(self, tenant_id: str) -> dict[str, Any]:
+        """Fetch one tenant (same shape as a ``list`` entry)."""
         return await self._client.get(f"/v1/partner/tenants/{tenant_id}")
 
     async def revoke(self, tenant_id: str) -> dict[str, Any]:
+        """Revoke a tenant. Cascades to its inbound webhooks and passports.
+
+        Returns {transitioned, webhooks_revoked, passports_revoked}.
+        Idempotent: a retry finishes a cascade that failed part-way.
+        """
         return await self._client.delete(f"/v1/partner/tenants/{tenant_id}")
 
     async def create_inbound_webhook(

{getstack-1.3.0 → getstack-2.0.0}/src/getstack/_async/passports.py

@@ -14,7 +14,7 @@ from contextlib import asynccontextmanager
 from typing import Any, AsyncGenerator, Awaitable, Callable
 
 from ..client import AsyncHttpClient
-from ..passports import _parse_duration, _to_passport
+from ..passports import _parse_duration, _to_passport, _delegation_scopes
 from ..proxy import ProxyResponse
 from .proxy import AsyncProxyService
 from ..types import Passport, CheckpointResult, CheckoutResult, PassportReport, ToolCall
@@ -217,6 +217,7 @@ class AsyncPassportService:
         ttl_seconds: int | None = None,
         scopes: list[dict[str, Any]] | None = None,
         authority_binding_ids: list[str] | None = None,
+        mission_ids: list[str] | None = None,
     ) -> Passport:
         """Issue a signed passport for an agent (async mirror of ``Stack``).
 
@@ -246,6 +247,8 @@ class AsyncPassportService:
             body["scopes"] = scopes
         if authority_binding_ids is not None:
             body["authority_binding_ids"] = authority_binding_ids
+        if mission_ids is not None:
+            body["mission_ids"] = mission_ids
         if ttl_seconds:
             body["ttl_seconds"] = ttl_seconds
         if intent or services:
@@ -339,12 +342,11 @@ class AsyncPassportService:
         self,
         parent_token: str,
         child_agent_id: str,
-        scopes: list[str] | None = None,
+        scopes: list[dict[str, Any]] | list[str] | None = None,
         ttl_seconds: int | None = None,
     ) -> Passport:
-        body: dict[str, Any] = {"parent_token": parent_token, "child_agent_id": child_agent_id}
-        if scopes is not None:
-            body["scopes"] = scopes
+        body: dict[str, Any] = {"parent_passport_token": parent_token, "child_agent_id": child_agent_id,
+            "scopes": _delegation_scopes(parent_token, scopes)}
         if ttl_seconds is not None:
             body["ttl_seconds"] = ttl_seconds
         return _to_passport(await self._client.post("/v1/passports/delegate", json=body))

getstack-2.0.0/src/getstack/_fleet_key.py

@@ -0,0 +1,44 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import time
+
+from .agent_auth import _generate_keypair, _key_path, _load_stored, _persist_stored, _privkey_from_jwk, _b64url_no_pad
+
+
+def prepare_fleet_key(policy_id: str, idempotency_key: str):
+    key_id = "fleet_" + hashlib.sha256(json.dumps([policy_id, idempotency_key], separators=(",", ":")).encode()).hexdigest()
+    stored = _load_stored(key_id)
+    if stored is None:
+        _, public_key, private_key = _generate_keypair()
+        candidate = {"agent_id": key_id, "publicKey": public_key, "privateKey": private_key, "enrolled_at": time.time()}
+        path = _key_path(key_id)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        try:
+            fd = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+            with os.fdopen(fd, "w", encoding="utf8") as stream:
+                json.dump(candidate, stream)
+        except FileExistsError:
+            pass
+        stored = _load_stored(key_id)
+        for _ in range(20):
+            if stored is not None:
+                break
+            time.sleep(0.025)
+            stored = _load_stored(key_id)
+    if stored is None:
+        raise ValueError("Invalid input")
+    key = _privkey_from_jwk(stored["privateKey"])
+
+    def sign(challenge: str) -> str:
+        return _b64url_no_pad(key.sign(challenge.encode()))
+
+    def persist(agent_id: str) -> None:
+        if not re.fullmatch(r"agt_[\w-]+", agent_id):
+            raise ValueError("Invalid input")
+        _persist_stored(agent_id, {**stored, "agent_id": agent_id})
+
+    return stored["publicKey"], sign, persist