stackshift 1.2.0__py3-none-any.whl → 1.3.0__py3-none-any.whl

stackshift/__init__.py

@@ -13,6 +13,14 @@ from .mail_events_webhooks import MailEventsClient, MailWebhooksClient, verify_w
 from .mail_streams import MailStreamsClient
 from .mail_campaigns import MailAudiencesClient, MailCampaignsClient
 from .mail_exports import MailExportsClient
+from .mail_mailboxes import (
+    MailboxAliasesClient,
+    MailboxDomainsClient,
+    MailboxGroupsClient,
+    MailboxImportsClient,
+    MailboxesClient,
+    MailboxRoutesClient,
+)
 from .projects import ProjectsClient
 from .workload_security import WorkloadSecurityClient
 
@@ -35,6 +43,12 @@ __all__ = [
     "MailAudiencesClient",
     "MailCampaignsClient",
     "MailExportsClient",
+    "MailboxAliasesClient",
+    "MailboxDomainsClient",
+    "MailboxGroupsClient",
+    "MailboxImportsClient",
+    "MailboxesClient",
+    "MailboxRoutesClient",
     "ProjectsClient",
     "WorkloadSecurityClient",
     "asset_transform_options",
@@ -42,3 +56,13 @@ __all__ = [
     "get_asset_transform_preset",
     "verify_webhook_signature",
 ]
+
+from .support_actions import (ActionProtocolError, sign_action, verify_action, verify_receipt, encode_receipt)
+from .support_action_receiver import ActionClaim, ActionDurableStore, SignedActionResponse, receive_action
+from .support_action_sqlite import SQLiteActionStore
+from .support_action_types import ActionDescriptor, ActionField, ActionManifest, ActionRequest, ActionReceipt
+__all__ += ["ActionProtocolError", "sign_action", "verify_action", "verify_receipt", "encode_receipt", "ActionClaim", "ActionDurableStore", "SignedActionResponse", "receive_action", "SQLiteActionStore", "ActionDescriptor", "ActionField", "ActionManifest", "ActionRequest", "ActionReceipt"]
+from .support_action_manifest import validate_action_catalog
+__all__ += ['validate_action_catalog']
+from .support_action_types import ActionInstallationInput, ActionInstallationCredentials
+__all__ += ['ActionInstallationInput', 'ActionInstallationCredentials']

stackshift/client.py

@@ -12,7 +12,7 @@ class StackShift:
         *,
         api_key: str | None = None,
         base_url: str = "https://api.stackshift.cloud/api/v1",
-        mail_base_url: str = "https://api.stackshift.cloud/v1",
+        mail_base_url: str = "https://api.stackshift.cloud/api/v1",
         cdn_base_url: str = "https://cdn.stackshift.cloud",
         session: requests.Session | None = None,
     ) -> None:

stackshift/mail.py

@@ -13,6 +13,14 @@ from .mail_marketing import MailAutomationsClient, MailFormsClient, MailSegments
 from .mail_migration import MailMigrationClient
 from .mail_campaigns import MailAudiencesClient, MailCampaignsClient
 from .mail_exports import MailExportsClient
+from .mail_mailboxes import (
+    MailboxAliasesClient,
+    MailboxDomainsClient,
+    MailboxGroupsClient,
+    MailboxImportsClient,
+    MailboxesClient,
+    MailboxRoutesClient,
+)
 from .mail_tracking import MailTrackingClient
 
 
@@ -38,6 +46,12 @@ class MailClient:
         self.campaigns = MailCampaignsClient(client)
         self.tracking = MailTrackingClient(client)
         self.exports = MailExportsClient(client)
+        self.mailbox_domains = MailboxDomainsClient(client)
+        self.mailboxes = MailboxesClient(client)
+        self.aliases = MailboxAliasesClient(client)
+        self.groups = MailboxGroupsClient(client)
+        self.routes = MailboxRoutesClient(client)
+        self.mailbox_imports = MailboxImportsClient(client)
         self.limits = MailLimitsClient(client)
         self.reputation = MailReputationClient(client)
         self.scheduled = MailScheduledClient(client)

stackshift/mail_campaigns.py

@@ -58,8 +58,8 @@ class MailCampaignsClient:
     def create(
         self,
         *,
-        name: str,
         audience_id: str,
+        name: str | None = None,
         template: str = "",
         from_: str = "",
         version_id: str | None = None,

stackshift/mail_mailboxes.py

@@ -0,0 +1,276 @@
+from __future__ import annotations
+
+from typing import Any
+from urllib.parse import quote
+
+
+def _seg(value: str) -> str:
+    return quote(value, safe="")
+
+
+def _camel(fields: dict[str, Any], names: dict[str, str], label: str) -> dict[str, Any]:
+    unknown = fields.keys() - names.keys() - set(names.values())
+    if unknown:
+        raise ValueError(f"Unknown {label} fields: " + ", ".join(sorted(unknown)))
+    return {names.get(key, key): value for key, value in fields.items()}
+
+
+def _present(payload: dict[str, Any]) -> dict[str, Any]:
+    return {key: value for key, value in payload.items() if value is not None}
+
+
+class MailboxDomainsClient:
+    def __init__(self, client: Any) -> None:
+        self._client = client
+
+    def create(self, domain: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", "/mail/mailbox-domains", json={"domain": domain})
+
+    def list(self) -> dict[str, Any]:
+        return self._client.mail_request("GET", "/mail/mailbox-domains")
+
+    def get(self, domain_id: str) -> dict[str, Any]:
+        return self._client.mail_request("GET", f"/mail/mailbox-domains/{_seg(domain_id)}")
+
+    def update(self, domain_id: str, **fields: Any) -> dict[str, Any]:
+        names = {"catch_all": "catchAll", "retention_days": "retentionDays", "addon_storage_units": "addonStorageUnits"}
+        return self._client.mail_request(
+            "PATCH", f"/mail/mailbox-domains/{_seg(domain_id)}", json=_camel(fields, names, "mailbox domain")
+        )
+
+    def verify(self, domain_id: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/mailbox-domains/{_seg(domain_id)}/verify")
+
+    def apply_dns(self, domain_id: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/mailbox-domains/{_seg(domain_id)}/dns/apply")
+
+    def dns_applications(self, domain_id: str) -> dict[str, Any]:
+        return self._client.mail_request("GET", f"/mail/mailbox-domains/{_seg(domain_id)}/dns/applications")
+
+    def delete(self, domain_id: str) -> None:
+        self._client.mail_request("DELETE", f"/mail/mailbox-domains/{_seg(domain_id)}")
+
+
+class MailboxesClient:
+    def __init__(self, client: Any) -> None:
+        self._client = client
+
+    def plans(self) -> dict[str, Any]:
+        return self._client.mail_request("GET", "/mail/mailbox-plans")
+
+    def client_settings(self) -> dict[str, Any]:
+        return self._client.mail_request("GET", "/mail/mailbox-client-settings")
+
+    def usage(self) -> dict[str, Any]:
+        return self._client.mail_request("GET", "/mail/mailbox-usage")
+
+    def create(
+        self,
+        *,
+        domain_id: str,
+        local_part: str,
+        display_name: str | None = None,
+        kind: str | None = None,
+        owner_user_id: str | None = None,
+        owner_email: str | None = None,
+        plan: str | None = None,
+        quota_bytes: int | None = None,
+        ai_enabled: bool | None = None,
+    ) -> dict[str, Any]:
+        payload = {
+            "domainId": domain_id,
+            "localPart": local_part,
+            "displayName": display_name,
+            "kind": kind,
+            "ownerUserId": owner_user_id,
+            "ownerEmail": owner_email,
+            "plan": plan,
+            "quotaBytes": quota_bytes,
+            "aiEnabled": ai_enabled,
+        }
+        return self._client.mail_request("POST", "/mail/mailboxes", json=_present(payload))
+
+    def list(self, *, domain_id: str | None = None) -> dict[str, Any]:
+        return self._client.mail_request("GET", "/mail/mailboxes", params=_present({"domainId": domain_id}))
+
+    def get(self, mailbox_id: str) -> dict[str, Any]:
+        return self._client.mail_request("GET", f"/mail/mailboxes/{_seg(mailbox_id)}")
+
+    def update(
+        self,
+        mailbox_id: str,
+        *,
+        display_name: str | None = None,
+        quota_bytes: int | None = None,
+        ai_enabled: bool | None = None,
+        plan: str | None = None,
+    ) -> dict[str, Any]:
+        payload = {"displayName": display_name, "quotaBytes": quota_bytes, "aiEnabled": ai_enabled, "plan": plan}
+        return self._client.mail_request("PATCH", f"/mail/mailboxes/{_seg(mailbox_id)}", json=_present(payload))
+
+    def delete(self, mailbox_id: str) -> None:
+        self._client.mail_request("DELETE", f"/mail/mailboxes/{_seg(mailbox_id)}")
+
+    def suspend(self, mailbox_id: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/mailboxes/{_seg(mailbox_id)}/suspend")
+
+    def resume(self, mailbox_id: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/mailboxes/{_seg(mailbox_id)}/resume")
+
+    def resend_invitation(self, mailbox_id: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/mailboxes/{_seg(mailbox_id)}/invitation/resend")
+
+    def reset_password(self, mailbox_id: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/mailboxes/{_seg(mailbox_id)}/password-reset")
+
+    def create_profile_link(self, mailbox_id: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/mailboxes/{_seg(mailbox_id)}/mobileconfig")
+
+    def list_devices(self, mailbox_id: str) -> dict[str, Any]:
+        return self._client.mail_request("GET", f"/mail/mailboxes/{_seg(mailbox_id)}/devices")
+
+    def revoke_device(self, mailbox_id: str, kind: str, device_id: str) -> None:
+        self._client.mail_request("DELETE", f"/mail/mailboxes/{_seg(mailbox_id)}/devices/{_seg(kind)}/{_seg(device_id)}")
+
+    def list_members(self, mailbox_id: str) -> dict[str, Any]:
+        return self._client.mail_request("GET", f"/mail/mailboxes/{_seg(mailbox_id)}/members")
+
+    def add_member(self, mailbox_id: str, user_id: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/mailboxes/{_seg(mailbox_id)}/members", json={"userId": user_id})
+
+    def remove_member(self, mailbox_id: str, user_id: str) -> None:
+        self._client.mail_request("DELETE", f"/mail/mailboxes/{_seg(mailbox_id)}/members/{_seg(user_id)}")
+
+    def list_app_passwords(self, mailbox_id: str) -> dict[str, Any]:
+        return self._client.mail_request("GET", f"/mail/mailboxes/{_seg(mailbox_id)}/app-passwords")
+
+    def create_app_password(self, mailbox_id: str, label: str) -> dict[str, Any]:
+        return self._client.mail_request(
+            "POST", f"/mail/mailboxes/{_seg(mailbox_id)}/app-passwords", json={"label": label}
+        )
+
+    def revoke_app_password(self, mailbox_id: str, password_id: str) -> None:
+        self._client.mail_request("DELETE", f"/mail/mailboxes/{_seg(mailbox_id)}/app-passwords/{_seg(password_id)}")
+
+
+class MailboxAliasesClient:
+    def __init__(self, client: Any) -> None:
+        self._client = client
+
+    def create(
+        self, *, mailbox_id: str, local_part: str, domain_id: str | None = None, send_as: bool | None = None
+    ) -> dict[str, Any]:
+        payload = {"mailboxId": mailbox_id, "localPart": local_part, "domainId": domain_id, "sendAs": send_as}
+        return self._client.mail_request("POST", "/mail/aliases", json=_present(payload))
+
+    def list(self, *, mailbox_id: str | None = None) -> dict[str, Any]:
+        return self._client.mail_request("GET", "/mail/aliases", params=_present({"mailboxId": mailbox_id}))
+
+    def update(self, alias_id: str, *, send_as: bool) -> dict[str, Any]:
+        return self._client.mail_request("PATCH", f"/mail/aliases/{_seg(alias_id)}", json={"sendAs": send_as})
+
+    def delete(self, alias_id: str) -> None:
+        self._client.mail_request("DELETE", f"/mail/aliases/{_seg(alias_id)}")
+
+
+class MailboxGroupsClient:
+    def __init__(self, client: Any) -> None:
+        self._client = client
+
+    def create(
+        self,
+        *,
+        domain_id: str,
+        local_part: str,
+        display_name: str | None = None,
+        member_ids: list[str] | None = None,
+        moderator_id: str | None = None,
+    ) -> dict[str, Any]:
+        payload = {
+            "domainId": domain_id,
+            "localPart": local_part,
+            "displayName": display_name,
+            "memberIds": member_ids,
+            "moderatorId": moderator_id,
+        }
+        return self._client.mail_request("POST", "/mail/groups", json=_present(payload))
+
+    def list(self, *, domain_id: str | None = None) -> dict[str, Any]:
+        return self._client.mail_request("GET", "/mail/groups", params=_present({"domainId": domain_id}))
+
+    def get(self, group_id: str) -> dict[str, Any]:
+        return self._client.mail_request("GET", f"/mail/groups/{_seg(group_id)}")
+
+    def update(self, group_id: str, **fields: Any) -> dict[str, Any]:
+        names = {"display_name": "displayName", "moderator_id": "moderatorId", "member_ids": "memberIds"}
+        return self._client.mail_request("PATCH", f"/mail/groups/{_seg(group_id)}", json=_camel(fields, names, "group"))
+
+    def delete(self, group_id: str) -> None:
+        self._client.mail_request("DELETE", f"/mail/groups/{_seg(group_id)}")
+
+
+class MailboxRoutesClient:
+    def __init__(self, client: Any) -> None:
+        self._client = client
+
+    def create(
+        self, *, domain_id: str, pattern: str, targets: list[dict[str, Any]], priority: int | None = None
+    ) -> dict[str, Any]:
+        payload = {"domainId": domain_id, "pattern": pattern, "targets": targets, "priority": priority}
+        return self._client.mail_request("POST", "/mail/routes", json=_present(payload))
+
+    def list(self, *, domain_id: str | None = None) -> dict[str, Any]:
+        return self._client.mail_request("GET", "/mail/routes", params=_present({"domainId": domain_id}))
+
+    def get(self, route_id: str) -> dict[str, Any]:
+        return self._client.mail_request("GET", f"/mail/routes/{_seg(route_id)}")
+
+    def update(
+        self, route_id: str, *, priority: int | None = None, targets: list[dict[str, Any]] | None = None
+    ) -> dict[str, Any]:
+        return self._client.mail_request(
+            "PATCH", f"/mail/routes/{_seg(route_id)}", json=_present({"priority": priority, "targets": targets})
+        )
+
+    def delete(self, route_id: str) -> None:
+        self._client.mail_request("DELETE", f"/mail/routes/{_seg(route_id)}")
+
+    def app_health(self, domain_id: str) -> dict[str, Any]:
+        return self._client.mail_request("GET", "/mail/routes/app-health", params={"domainId": domain_id})
+
+    def retry_deliveries(self, route_id: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/routes/{_seg(route_id)}/retry-deliveries")
+
+
+class MailboxImportsClient:
+    def __init__(self, client: Any) -> None:
+        self._client = client
+
+    def start(
+        self,
+        *,
+        domain_id: str,
+        source: str,
+        accounts: list[dict[str, Any]],
+        host: str | None = None,
+        port: int | None = None,
+    ) -> dict[str, Any]:
+        payload = {"domainId": domain_id, "source": source, "accounts": accounts, "host": host, "port": port}
+        return self._client.mail_request("POST", "/mail/mailbox-imports", json=_present(payload))
+
+    def list(self) -> dict[str, Any]:
+        return self._client.mail_request("GET", "/mail/mailbox-imports")
+
+    def get(self, import_id: str) -> dict[str, Any]:
+        return self._client.mail_request("GET", f"/mail/mailbox-imports/{_seg(import_id)}")
+
+    def cancel(self, import_id: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/mailbox-imports/{_seg(import_id)}/cancel")
+
+    def skip(self, import_id: str, mailbox_id: str) -> dict[str, Any]:
+        return self._client.mail_request(
+            "POST", f"/mail/mailbox-imports/{_seg(import_id)}/mailboxes/{_seg(mailbox_id)}/skip"
+        )
+
+    def switch(self, import_id: str, when: str) -> dict[str, Any]:
+        return self._client.mail_request("POST", f"/mail/mailbox-imports/{_seg(import_id)}/switch", json={"when": when})

stackshift/support_action_manifest.py

@@ -0,0 +1,40 @@
+"""Local catalog validation; server registration and destination policy remain authoritative."""
+import math
+import re
+from urllib.parse import urlsplit
+from .support_actions import _check
+
+_RESERVED = {'customer', 'customer_id', 'external_customer_id', 'external_id', 'contact_id', 'workspace_id', 'environment_id', 'inbox_id', 'conversation_id', 'installation_id', 'tenant_id', 'user_id', 'organization_id', 'authorization', 'scope', 'identity', 'credentials', 'secret', 'token'}
+def _endpoint(value):
+    if not isinstance(value, str) or len(value) > 2048: return False
+    try:
+        url = urlsplit(value)
+        return url.scheme == 'https' and bool(url.hostname) and not url.username and not url.password and '?' not in value and '#' not in value
+    except ValueError: return False
+
+def _fields(schema, input_schema):
+    _check(type(schema) is dict and len(schema) <= 32, 'invalid_catalog')
+    for name, field in schema.items():
+        _check(bool(re.fullmatch(r'[a-z][a-z0-9_]{0,63}', name)) and (not input_schema or name not in _RESERVED and not name.startswith(('customer_', 'tenant_', 'auth_'))), 'invalid_catalog')
+        _check(type(field) is dict and {'type', 'required'} <= field.keys() and field.keys() <= {'type', 'required', 'max_length', 'minimum', 'maximum', 'enum'} and type(field['required']) is bool, 'invalid_catalog')
+        kind = field['type']; values = field.get('enum', [])
+        if kind == 'string':
+            limit = field.get('max_length')
+            _check(type(limit) is int and 1 <= limit <= 16000 and 'minimum' not in field and 'maximum' not in field and type(values) is list and len(values) <= 64 and all(type(v) is str and len(v) <= limit for v in values) and len(set(values)) == len(values), 'invalid_catalog')
+        elif kind in ('number', 'integer'):
+            bounds = [field[key] for key in ('minimum', 'maximum') if key in field]
+            _check(not field.get('max_length') and not values and all(type(n) in (int, float) and abs(n) < math.inf and (kind != 'integer' or int(n) == n and abs(n) <= 9007199254740991) for n in bounds) and field.get('minimum', -math.inf) <= field.get('maximum', math.inf), 'invalid_catalog')
+        else:
+            _check(kind == 'boolean' and not field.get('max_length') and not values and 'minimum' not in field and 'maximum' not in field, 'invalid_catalog')
+
+def validate_action_catalog(version: str, actions: list) -> None:
+    _check(isinstance(version, str) and len(version) <= 32 and bool(re.fullmatch(r'(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)', version)) and type(actions) is list and 1 <= len(actions) <= 32, 'invalid_catalog')
+    names = set()
+    for action in actions:
+        _check(type(action) is dict and all(key in action for key in ('name', 'version', 'identity_required', 'risk', 'idempotency_supported', 'safe_retry', 'timeout_seconds', 'endpoint', 'input', 'output')), 'invalid_catalog')
+        name = action['name']
+        _check(type(name) is str and bool(re.fullmatch(r'[a-z][a-z0-9_.]{0,79}', name)) and name not in names and action['version'] == version and action['identity_required'] is True and action['risk'] in ('read', 'bounded_write', 'customer_change', 'financial', 'security') and type(action['idempotency_supported']) is bool and type(action['safe_retry']) is bool and type(action['timeout_seconds']) is int and 1 <= action['timeout_seconds'] <= 30 and _endpoint(action['endpoint']), 'invalid_catalog')
+        _check((action['risk'] == 'read' or action['idempotency_supported'] and _endpoint(action.get('reconciliation_endpoint')) and action.get('verification_operation')) and (not action['safe_retry'] or action['idempotency_supported']) and (not action.get('reconciliation_endpoint') or _endpoint(action['reconciliation_endpoint'])), 'invalid_catalog')
+        _fields(action['input'], True); _fields(action['output'], False); names.add(name)
+    for action in actions:
+        _check(not action.get('verification_operation') or any(a['name'] == action['verification_operation'] and a['risk'] == 'read' for a in actions), 'invalid_catalog')

stackshift/support_action_receiver.py

@@ -0,0 +1,58 @@
+"""Durable claims are required; no in-memory fallback or automatic lease takeover."""
+import hashlib
+import time
+from dataclasses import dataclass
+from typing import Callable, Optional, Protocol
+from .support_actions import (ActionProtocolError, REQUEST_CONTEXT, RECEIPT_CONTEXT, encode_receipt,
+                              sign_action, validate_fields, verify_action)
+
+@dataclass(frozen=True)
+class ActionClaim:
+    state: str  # acquired, completed, running, unknown, conflict
+    fence: str = ""
+    response: Optional[bytes] = None
+
+class ActionDurableStore(Protocol):
+    def claim(self, namespace: str, key: str, digest: str) -> ActionClaim: ...
+    def complete(self, namespace: str, key: str, fence: str, response: bytes, unknown: bool = False) -> None: ...
+
+@dataclass(frozen=True)
+class SignedActionResponse:
+    body: bytes
+    headers: dict
+
+def receive_action(raw: bytes, headers: dict, *, store: ActionDurableStore, execute: Callable,
+                   reconcile: Callable, verification: dict) -> SignedActionResponse:
+    options = dict(verification)
+    now = options.setdefault("now", int(time.time()))
+    request = verify_action(raw, headers, **options)
+    normalized = {name.lower(): value for name, value in headers.items()}
+    delivery = normalized["x-stackshift-delivery-id"]
+    digest = hashlib.sha256(raw).hexdigest()
+    delivery_key = request["installation_id"] + ":" + delivery
+    delivery_claim = store.claim("delivery", delivery_key, digest)
+    if delivery_claim.state != "acquired":
+        raise ActionProtocolError("delivery_replay")
+    key = ":".join((request["installation_id"], request["action"]["name"], request["action"]["version"], request["request_id"], request["mode"]))
+    claim = store.claim("execution", key, digest)
+    if claim.state == "conflict":
+        raise ActionProtocolError("idempotency_conflict")
+    if claim.state in ("completed", "unknown") and claim.response is not None:
+        response = claim.response
+    elif claim.state in ("running", "unknown"):
+        response = encode_receipt(request["request_id"], "unknown" if claim.state == "unknown" else "accepted", {}, "execution_unknown" if claim.state == "unknown" else "execution_in_progress")
+    elif claim.state == "acquired":
+        try:
+            handler = reconcile if request["mode"] == "reconcile" else execute
+            state, result, code = handler(request)
+            action = next(a for a in options["actions"] if a["name"] == request["action"]["name"] and a["version"] == request["action"]["version"])
+            if state == "succeeded": validate_fields(result, action["output"])
+            response = encode_receipt(request["request_id"], state, result, code)
+        except Exception:
+            response = encode_receipt(request["request_id"], "unknown", {}, "handler_outcome_unknown")
+            state = "unknown"
+        store.complete("execution", key, claim.fence, response, state == "unknown")
+    else:
+        raise ActionProtocolError("invalid_store_claim")
+    store.complete("delivery", delivery_key, delivery_claim.fence, response)
+    return SignedActionResponse(response, sign_action(response, RECEIPT_CONTEXT, options["key_id"], options["secret"], now, delivery))

stackshift/support_action_sqlite.py

@@ -0,0 +1,46 @@
+"""SQLite durable claims. Keep this database for the complete request/retry horizon."""
+import sqlite3
+import threading
+import uuid
+from .support_actions import ActionProtocolError
+from .support_action_receiver import ActionClaim
+
+class SQLiteActionStore:
+    def __init__(self, path: str):
+        if not path or path == ":memory:" or path.startswith("file:"):
+            raise ActionProtocolError("durable_database_required")
+        self._lock = threading.Lock()
+        self._db = sqlite3.connect(path, timeout=10, check_same_thread=False, isolation_level=None)
+        self._db.execute("PRAGMA journal_mode=WAL")
+        self._db.execute("PRAGMA synchronous=FULL")
+        self._db.execute("""CREATE TABLE IF NOT EXISTS support_action_claims (
+          namespace TEXT NOT NULL, claim_key TEXT NOT NULL, digest TEXT NOT NULL,
+          state TEXT NOT NULL, fence TEXT NOT NULL, response BLOB,
+          PRIMARY KEY(namespace,claim_key))""")
+
+    def claim(self, namespace: str, key: str, digest: str) -> ActionClaim:
+        with self._lock:
+            self._db.execute("BEGIN IMMEDIATE")
+            try:
+                fence = str(uuid.uuid4())
+                cursor = self._db.execute("INSERT OR IGNORE INTO support_action_claims VALUES(?,?,?,'running',?,NULL)", (namespace, key, digest, fence))
+                if cursor.rowcount == 1:
+                    result = ActionClaim("acquired", fence)
+                else:
+                    row = self._db.execute("SELECT digest,state,fence,response FROM support_action_claims WHERE namespace=? AND claim_key=?", (namespace, key)).fetchone()
+                    result = ActionClaim("conflict" if row[0] != digest else row[1], row[2], row[3])
+                self._db.execute("COMMIT")
+                return result
+            except BaseException:
+                self._db.execute("ROLLBACK")
+                raise
+
+    def complete(self, namespace: str, key: str, fence: str, response: bytes, unknown: bool = False) -> None:
+        with self._lock:
+            cursor = self._db.execute("UPDATE support_action_claims SET state=?,response=? WHERE namespace=? AND claim_key=? AND fence=? AND state='running'", ("unknown" if unknown else "completed", response, namespace, key, fence))
+            if cursor.rowcount != 1:
+                raise ActionProtocolError("fence_lost")
+
+    def close(self) -> None:
+        with self._lock:
+            self._db.close()

stackshift/support_action_types.py

@@ -0,0 +1,83 @@
+"""Support app/v2 registration and signed action protocol types."""
+from typing import Any, Dict, List, Literal, Optional, TypedDict
+
+class ActionField(TypedDict, total=False):
+    type: Literal["string", "number", "integer", "boolean"]
+    required: bool
+    max_length: int
+    minimum: float
+    maximum: float
+    enum: List[str]
+
+class ActionDescriptor(TypedDict, total=False):
+    name: str
+    version: str
+    endpoint: str
+    reconciliation_endpoint: str
+    input: Dict[str, ActionField]
+    output: Dict[str, ActionField]
+    risk: Literal["read", "bounded_write", "customer_change", "financial", "security"]
+    identity_required: bool
+    idempotency_supported: bool
+    safe_retry: bool
+    timeout_seconds: int
+    verification_operation: str
+
+class ActionManifest(TypedDict):
+    schema: str
+    version: str
+    permissions: List[str]
+    event_types: List[str]
+    placements: List[str]
+    webhook_url: str
+    description: str
+    actions: List[ActionDescriptor]
+
+class ActionScope(TypedDict):
+    workspace_id: str
+    environment_id: str
+    inbox_id: str
+    conversation_id: str
+    contact_id: str
+
+class ActionAuthorization(TypedDict, total=False):
+    grant_id: str
+    revision: int
+    mode: Literal["automatic", "customer", "staff"]
+
+class ActionRequest(TypedDict, total=False):
+    schema: str
+    request_id: str
+    installation_id: str
+    installation_revision: int
+    app_version_id: str
+    action: Dict[str, str]
+    scope: ActionScope
+    customer: Dict[str, str]
+    arguments: Dict[str, Any]
+    authorization: ActionAuthorization
+    issued_at: int
+    expires_at: int
+    mode: Literal["execute", "reconcile"]
+    target_request_id: str
+
+class ActionReceipt(TypedDict, total=False):
+    schema: str
+    request_id: str
+    state: Literal["accepted", "succeeded", "failed", "unknown"]
+    result: Dict[str, Any]
+    error_code: str
+
+class ActionInstallationInput(TypedDict):
+    version_id: str
+    environment_id: str
+    inbox_id: str
+    permissions: List[str]
+    action_operations: List[str]
+    confirm_consent: bool
+    revision: int
+
+class ActionInstallationCredentials(TypedDict):
+    action_key_id: str
+    action_secret: str
+    action_operations: List[str]

stackshift/support_actions.py

@@ -0,0 +1,141 @@
+"""Signed, bounded Support action envelopes. No network or business execution."""
+import hashlib
+import hmac
+import json
+import math
+import re
+import time
+from typing import Any, Mapping, Sequence
+from .support_action_types import ActionDescriptor
+
+REQUEST_CONTEXT = "stackshift.support.action/v1"
+RECEIPT_CONTEXT = "stackshift.support.action-receipt/v1"
+REQUEST_LIMIT = 256 * 1024
+RECEIPT_LIMIT = 64 * 1024
+UUID = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$")
+KEY = re.compile(r"^[A-Za-z0-9_-]{1,128}$")
+NAME = re.compile(r"^[a-z][a-z0-9_.-]{0,95}$")
+VERSION = re.compile(r"^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$")
+PREFIX = "x-stackshift-"
+
+class ActionProtocolError(ValueError):
+    """Stable safe protocol code, without payload/secret material."""
+
+def _check(ok: bool, code: str = "invalid_request") -> None:
+    if not ok:
+        raise ActionProtocolError(code)
+
+def _uuid(value: Any) -> bool:
+    return isinstance(value, str) and bool(UUID.fullmatch(value)) and value != "00000000-0000-0000-0000-000000000000"
+
+def _integer(value: Any) -> bool:
+    return type(value) is int and 0 <= value <= 9007199254740991
+
+def _object(value: Any, required: Sequence[str], optional: Sequence[str] = ()) -> None:
+    _check(type(value) is dict and set(required) <= value.keys() and value.keys() <= set(required) | set(optional))
+
+def _unique(pairs):
+    result = {}
+    for key, value in pairs:
+        _check(key not in result)
+        result[key] = value
+    return result
+
+def _decode(raw: bytes):
+    try:
+        value = json.loads(raw.decode("utf-8"), object_pairs_hook=_unique, parse_constant=lambda _: (_ for _ in ()).throw(ActionProtocolError("invalid_request")))
+        def bounded(item, depth=0):
+            _check(depth <= 32)
+            if isinstance(item, dict):
+                for child in item.values(): bounded(child, depth + 1)
+            elif isinstance(item, list):
+                for child in item: bounded(child, depth + 1)
+            elif isinstance(item, float): _check(math.isfinite(item))
+        bounded(value)
+        return value
+    except (ValueError, UnicodeError, RecursionError) as error:
+        raise ActionProtocolError("invalid_request") from error
+
+def sign_action(raw: bytes, context: str, key_id: str, secret: str, timestamp: int, delivery_id: str) -> dict:
+    _check(context in (REQUEST_CONTEXT, RECEIPT_CONTEXT) and bool(KEY.fullmatch(key_id)) and _uuid(delivery_id) and _integer(timestamp) and timestamp > 0 and len(secret) >= 32)
+    stamp = str(timestamp)
+    signed = (context + "\n" + key_id + "\n" + stamp + "\n" + delivery_id + "\n").encode() + raw
+    signature = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
+    return {PREFIX + "action-key-id": key_id, PREFIX + "timestamp": stamp, PREFIX + "delivery-id": delivery_id, PREFIX + "action-signature": "v1=" + signature}
+
+def _verify(raw: bytes, headers: Mapping[str, str], context: str, key_id: str, secret: str, now: int, tolerance: int, limit: int) -> str:
+    _check(type(raw) is bytes and 0 < len(raw) <= limit, "body_limit")
+    _check(_integer(now) and type(tolerance) is int and 0 < tolerance <= 300)
+    normalized = {}
+    for name, value in headers.items():
+        lower = name.lower()
+        _check(lower not in normalized, "invalid_headers")
+        normalized[lower] = value
+    stamp = normalized.get(PREFIX + "timestamp", "")
+    delivery = normalized.get(PREFIX + "delivery-id", "")
+    _check(isinstance(stamp, str) and re.fullmatch(r"[1-9][0-9]{0,15}", stamp) is not None, "invalid_headers")
+    _check(normalized.get(PREFIX + "action-key-id") == key_id and _uuid(delivery), "binding_mismatch")
+    _check(abs(now - int(stamp)) <= tolerance, "stale_signature")
+    expected = sign_action(raw, context, key_id, secret, int(stamp), delivery)[PREFIX + "action-signature"]
+    provided = normalized.get(PREFIX + "action-signature", "")
+    _check(isinstance(provided, str) and bool(re.fullmatch(r"v1=[0-9a-f]{64}", provided)) and hmac.compare_digest(expected, provided), "invalid_signature")
+    return delivery
+
+def validate_fields(value: dict, fields: Mapping[str, dict]) -> None:
+    _check(type(value) is dict and value.keys() <= fields.keys())
+    for name, spec in fields.items():
+        if name not in value:
+            _check(not spec.get("required", False)); continue
+        item = value[name]; kind = spec["type"]
+        _check((kind == "string" and isinstance(item, str)) or (kind == "boolean" and type(item) is bool) or (kind == "integer" and type(item) is int and abs(item) <= 9007199254740991) or (kind == "number" and type(item) in (int, float) and abs(item) < math.inf))
+        if kind == "string":
+            _check(len(item) <= spec.get("max_length", 16000))
+            _check(not spec.get("enum") or item in spec["enum"])
+        if kind in ("number", "integer"):
+            _check(item >= spec.get("minimum", -math.inf) and item <= spec.get("maximum", math.inf))
+
+def verify_action(raw: bytes, headers: Mapping[str, str], *, key_id: str, secret: str, installation_id: str, actions: Sequence[ActionDescriptor], expected_customer_external_id: str, now: int = None, tolerance: int = 300) -> dict:
+    now = int(time.time()) if now is None else now
+    _verify(raw, headers, REQUEST_CONTEXT, key_id, secret, now, tolerance, REQUEST_LIMIT)
+    body = _decode(raw)
+    _object(body, ("schema", "request_id", "installation_id", "installation_revision", "app_version_id", "action", "scope", "customer", "arguments", "authorization", "issued_at", "expires_at", "mode"), ("target_request_id",))
+    _check(body["schema"] == REQUEST_CONTEXT and body["installation_id"] == installation_id, "binding_mismatch")
+    _check(all(_uuid(body[key]) for key in ("request_id", "installation_id", "app_version_id")))
+    _check(_integer(body["installation_revision"]) and body["installation_revision"] > 0)
+    _object(body["action"], ("name", "version")); _object(body["scope"], ("workspace_id", "environment_id", "inbox_id", "conversation_id", "contact_id"))
+    _check(all(_uuid(value) for value in body["scope"].values()))
+    _object(body["customer"], ("external_id",))
+    _check(isinstance(expected_customer_external_id, str) and 0 < len(expected_customer_external_id) <= 256 and body["customer"]["external_id"] == expected_customer_external_id, "binding_mismatch")
+    auth = body["authorization"]; _object(auth, ("revision", "mode"), ("grant_id",))
+    _check(_integer(auth["revision"]) and auth["revision"] > 0 and auth["mode"] in ("automatic", "customer", "staff") and ("grant_id" not in auth or _uuid(auth["grant_id"])))
+    issued, expiry = body["issued_at"], body["expires_at"]
+    _check(_integer(issued) and _integer(expiry) and issued <= now + tolerance and expiry > now and expiry > issued, "request_expired")
+    action = next((item for item in actions if item["name"] == body["action"]["name"] and item["version"] == body["action"]["version"]), None)
+    _check(action is not None, "action_not_registered")
+    if body["mode"] == "reconcile":
+        _check(_uuid(body.get("target_request_id")) and body["target_request_id"] != body["request_id"] and body["arguments"] == {})
+    else:
+        _check(body["mode"] == "execute" and "target_request_id" not in body)
+        validate_fields(body["arguments"], action["input"])
+    return body
+
+def encode_receipt(request_id: str, state: str, result: dict, error_code: str = None) -> bytes:
+    body = {"schema": RECEIPT_CONTEXT, "request_id": request_id, "state": state, "result": result}
+    if error_code is not None: body["error_code"] = error_code
+    validate_receipt(body)
+    raw = json.dumps(body, separators=(",", ":"), ensure_ascii=False, allow_nan=False).encode()
+    _check(len(raw) <= RECEIPT_LIMIT, "body_limit")
+    _decode(raw)
+    return raw
+
+def validate_receipt(body: dict) -> None:
+    _object(body, ("schema", "request_id", "state", "result"), ("error_code",))
+    _check(body["schema"] == RECEIPT_CONTEXT and _uuid(body["request_id"]) and body["state"] in ("accepted", "succeeded", "failed", "unknown") and type(body["result"]) is dict)
+    _check(body["state"] == "succeeded" or not body["result"])
+    _check("error_code" not in body or isinstance(body["error_code"], str) and re.fullmatch(r"[a-z][a-z0-9_]{0,79}", body["error_code"]) is not None)
+
+def verify_receipt(raw: bytes, headers: Mapping[str, str], *, key_id: str, secret: str, request_id: str, delivery_id: str, now: int, tolerance: int = 300) -> dict:
+    actual = _verify(raw, headers, RECEIPT_CONTEXT, key_id, secret, now, tolerance, RECEIPT_LIMIT)
+    body = _decode(raw); validate_receipt(body)
+    _check(actual == delivery_id and body["request_id"] == request_id, "binding_mismatch")
+    return body

{stackshift-1.2.0.dist-info → stackshift-1.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackshift
-Version: 1.2.0
+Version: 1.3.0
 Summary: Official Python SDK for StackShift.
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
@@ -101,6 +101,35 @@ valid = stackshift.mail.webhooks.verify_signature(
 
 Webhook handlers should be idempotent. StackShift retries non-2xx responses. Delivery events do not include full email bodies or OTP codes by default.
 
+## Mailboxes
+
+Host real mailboxes on your own domain. The mailbox owner gets an invitation by email and sets their own password.
+
+```python
+domain = stackshift.mail.mailbox_domains.create("acme.com")
+print(domain["records"])
+stackshift.mail.mailbox_domains.verify(domain["id"])
+
+mailbox = stackshift.mail.mailboxes.create(
+    domain_id=domain["id"],
+    local_part="ada",
+    owner_email="ada@personal.example",
+    plan="basic",
+)
+
+stackshift.mail.aliases.create(mailbox_id=mailbox["id"], local_part="sales", send_as=True)
+stackshift.mail.routes.create(
+    domain_id=domain["id"],
+    pattern="orders-*",
+    targets=[{"kind": "app", "webhookUrl": "https://app.example.com/inbound"}],
+)
+
+devices = stackshift.mail.mailboxes.list_devices(mailbox["id"])
+stackshift.mail.mailboxes.suspend(mailbox["id"])
+```
+
+`stackshift.mail.groups` manages team addresses, and `stackshift.mail.mailbox_imports` copies mail from Google, Microsoft or any IMAP server.
+
 ## Send a template
 
 Templates are rendered by StackShift servers. The Python SDK only calls the REST API.
@@ -282,3 +311,20 @@ preview = platform.migrations.start({"source_connection_id": connection_id,
     "destination_bucket_id": bucket_id, "source_prefix": "campaigns/2026", "dry_run": True})
 report = platform.migrations.report(preview["id"])
 ```
+
+## Support action receivers (unreleased)
+
+`ActionManifest`, `ActionDescriptor`, installation consent types and `validate_action_catalog` describe `stackshift.support.app/v2`. V1 remains actionless. Registered writes require idempotency, a reconciliation endpoint and a registered read verifier; installations explicitly select `action_operations`. These SDK helpers perform no registration or network calls.
+
+Use `receive_action(raw_bytes, headers, store=..., execute=..., reconcile=..., verification=...)`. Verification requires `key_id`, `secret` (the installation action secret, not webhook secret), `installation_id`, `actions`, and a trusted `expected_customer_external_id`. Do not derive that expectation from unverified request JSON. Each synchronous handler returns `(state, result_dict, optional_safe_error_code)`. Success output is checked against the registered flat schema. Receipt helpers `encode_receipt`, `sign_action`, and `verify_receipt` are also exported.
+
+`SQLiteActionStore('/absolute/path/claims.sqlite')` uses standard-library sqlite3, WAL and FULL synchronization. Never use an in-memory database for restart safety. The runnable stdin receiver in `examples/support_action_receiver.py` intentionally returns `demo_not_implemented`; replace its handlers with authorized customer-bound business transactions. Set `ACTION_KEY_ID`, `ACTION_SECRET`, `ACTION_INSTALLATION_ID`, and trusted `EXPECTED_CUSTOMER_EXTERNAL_ID`:
+
+```sh
+PYTHONPATH=. python examples/support_action_receiver.py /absolute/path/claims.sqlite headers.json actions.json < body.json
+.venv/bin/python -m unittest discover -s tests -p test_support_actions.py -v
+```
+
+Send the returned `body` unchanged with `headers`. Execution retries retain exact original bytes and request ID with fresh delivery IDs. A handler error is stored as unknown; running/unknown work is never dispatched again. Reconciliation is a separate handler with empty arguments and the original target request ID, and must query actual downstream state. Accepted results remain replayable; there is no asynchronous callback endpoint yet. Disk claims do not make remote side effects atomic: use downstream idempotency or one transactional business/receipt store, and preserve uncertain claims for reconciliation/human review. This is a single-host SQLite example; distributed receivers need a shared durable store.
+
+See `../support-actions-conformance/README.md` for exact signatures and adapter requirements. Seven action tests pass, including shared vectors, two-connection concurrency, restart and fenced completion. The existing virtualenv is required here because system Python lacks the SDK's declared `requests` dependency. No live installation/provider qualification was performed; unreleased.

{stackshift-1.2.0.dist-info → stackshift-1.3.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-stackshift/__init__.py,sha256=6w_s5ELWH4aYV4NXysotLKIX1XdHif0ny_3WGaiGZSY,1425
+stackshift/__init__.py,sha256=ZCrX0NbSdv2Df1hQ3ctmhqk0ocdTAPG6CTHVKxhxDx8,2700
 stackshift/ai_credits.py,sha256=2u5zGSBo_spHqgYJhtmChaEiBq9jUVaTjR1uprxMpNQ,1142
 stackshift/assets.py,sha256=qjV59NFxQEF6_56GdMZVrN_QadExFbDWbcbiBFYXCt0,23292
 stackshift/assets_dam.py,sha256=dz0QgSZuQcwSSYoWFqy1pCx3xgMGYZLc9tCcQE0_kYo,6659
@@ -6,22 +6,28 @@ stackshift/assets_media.py,sha256=S_7TWu6hm5I8WUPMfQsGE9U15mDiYRG4ygXJzWqwbDE,15
 stackshift/assets_platform.py,sha256=w2Eke0YFXinmtHt1oaZlaiP_J32VymfhVWWLOYrX93M,4125
 stackshift/assets_video.py,sha256=KBIOTsVspHcMltkELsbTmfu-VB6_36dpYQ7HKTqAa2E,2374
 stackshift/assets_workflows.py,sha256=6L8_1d9huhfSrKovwP26tfGKc38o0sbSM-75dt__HRE,6950
-stackshift/client.py,sha256=4osuRDTVvBoZGKKhYBmZkx-oCAezg9zWxB2olXlnqsM,3220
-stackshift/mail.py,sha256=Ny8aEE846vzanT0B8uqyBB0BGm1p4OmERC0zX_6mGPg,15989
+stackshift/client.py,sha256=hY-1AQjyiiim6zMQi4JriDQ7HfK5zyPE_WkkhbOkmvw,3224
+stackshift/mail.py,sha256=XWqEwmmlKEmKVLMpXKeJvkqb3el1KLAHkdUTzyryjQE,16491
 stackshift/mail_advanced.py,sha256=sLte3we0Oy3pSuwjl5c4lfELH6gzaSUKug_WZDUB2DE,4363
 stackshift/mail_billing.py,sha256=n1SMNTHW5lVs7phJhZBiKw6ok-T3kbW0A3-4uF1w6Yg,232
 stackshift/mail_brands.py,sha256=aaOzETtfix0pFpaWBOHYPVrfUZezWqt53ZXJQk1F7mY,1627
-stackshift/mail_campaigns.py,sha256=WAMMQxKt7BvsPzJuJE-uCiLFoyJ1RKh_pD3azWINGXA,5424
+stackshift/mail_campaigns.py,sha256=wgEz2MD3k5db6p1jh-bMYP_aNxM73gekwmi4cNxTvBA,5438
 stackshift/mail_events_webhooks.py,sha256=iVYz_5DvGaE-Acw5uh_JN7P5LWvgfN-2bLnb_z1CMRU,5712
 stackshift/mail_exports.py,sha256=sbwBbypS1APv2DnunYmyViEjUHP1PMSrM0tVcbxcits,1054
+stackshift/mail_mailboxes.py,sha256=I5L1C2LyU0MGDZu6VZCh0J7oOqMiCnLSVWlbnkJZxq0,11872
 stackshift/mail_marketing.py,sha256=7uMZQYjU0siMyqFas_i5YWJTrwT9eYMrWElRThxZMr4,1077
 stackshift/mail_migration.py,sha256=j-VvEbJP92ndQ5HMhdu7obJ4S_4gka7oqNRirIvYkyE,1121
 stackshift/mail_reputation.py,sha256=mPvPkZeqcQc5808PhBK7gYsgf4Fk_U19nRxSsJ60MGU,1112
 stackshift/mail_streams.py,sha256=F7iBzHtWhCFw1cTjwPixNJfCvxdjvsDprZQG2A9-NIs,504
 stackshift/mail_tracking.py,sha256=SRcWTI9Otm5fBIY7nJJ-5qZA13aybUuMdh_PqakBpUg,1575
 stackshift/projects.py,sha256=oYWaE7xNRR6OXuPEwJH-oFFeOmDA9ozq6jJY09ANIHA,498
+stackshift/support_action_manifest.py,sha256=tCm3Qi_R3MidcJBPcsdKE-g8iaXw2xeU2PzxNuAaYbs,4088
+stackshift/support_action_receiver.py,sha256=PJtXpwt6XurE2sYE-mvjOeAhzWLUoBZsejwHGoC_dFI,3228
+stackshift/support_action_sqlite.py,sha256=Ict1yNNbzp2eEGNF8S7QSlKb9-dQIYiFhJ2ETFy57t8,2423
+stackshift/support_action_types.py,sha256=i7xADrXFSIHJaqwcS77LU4jvni5JKrRUzot5WaWpLLU,2213
+stackshift/support_actions.py,sha256=tZYlb8gdE875SKZdzfN01jfEfIQTyH08XThgCYQ820o,8744
 stackshift/workload_security.py,sha256=5JtJH9fX1kqSY3ipXUa79JslUULWsN5_gyn9tTGfzlA,2941
-stackshift-1.2.0.dist-info/METADATA,sha256=DZCSjepFeKmKNajeXmUZbNsMaxoG8en0kcxOit3JCPk,10250
-stackshift-1.2.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-stackshift-1.2.0.dist-info/top_level.txt,sha256=qe3uWsu_O9mNtq7bIck9Y8rjTIMrH0kzgAlGFDoRGqs,11
-stackshift-1.2.0.dist-info/RECORD,,
+stackshift-1.3.0.dist-info/METADATA,sha256=ClHPib_juMAge4YKZ2AOnQVQAx0F9p8ejnnnRxVUZTo,13959
+stackshift-1.3.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+stackshift-1.3.0.dist-info/top_level.txt,sha256=qe3uWsu_O9mNtq7bIck9Y8rjTIMrH0kzgAlGFDoRGqs,11
+stackshift-1.3.0.dist-info/RECORD,,

{stackshift-1.2.0.dist-info → stackshift-1.3.0.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (84.0.0)
+Generator: setuptools (84.2.1)
 Root-Is-Purelib: true
 Tag: py3-none-any