@hyperbrowser/sdk 1.2.2 → 1.4.0

package/dist/types/credential.d.ts

@@ -0,0 +1,120 @@
+/** A secret attached to a browser session, which fill may type into its pages. */
+export interface SessionCredential {
+    id: string;
+    name: string;
+}
+/**
+ * What to attach to a browser session at creation: a secret by name (or
+ * `{ secret }`), `{ vault }` for the secrets a vault's entries name, or
+ * `{ onePassword }` for an `op_token` secret that fills may read 1Password
+ * fields with.
+ */
+export type SessionCredentialSource = string | {
+    secret: string;
+} | {
+    vault: string;
+} | {
+    onePassword: string;
+};
+/**
+ * A field of an item in the fill's 1Password vault. Names and IDs are 1-256
+ * characters without '/' or '?', and not "." or "..". The field may end
+ * with a query such as `?attribute=otp`.
+ */
+export interface CredentialFillRef {
+    /** The item's name or ID. */
+    item: string;
+    /** The section's name or ID, when the field is in one. */
+    section?: string;
+    /** The field's name or ID, optionally with a query such as `?attribute=otp`. */
+    field: string;
+}
+/** Which input to fill and, with a vault or 1Password, from which entry or field. */
+export interface CredentialFillField {
+    /** A CSS selector for the input, 1-1024 UTF-8 bytes. Each selector at most once. */
+    selector: string;
+    /**
+     * The vault entry (its environment variable name, such as `PASSWORD`) to
+     * type. Required with `vault`, not allowed otherwise.
+     */
+    field?: string;
+    /** The 1Password field to type. Required with `onePassword`, not allowed otherwise. */
+    ref?: CredentialFillRef;
+}
+/**
+ * Fill 1Password fields, read with an `op_token` secret attached to the
+ * session. Nothing on the platform says where a 1Password value belongs, so
+ * the request names the origins it may be typed on.
+ */
+export interface CredentialFillOnePassword {
+    /** The `op_token` secret attached to the session, by name; its latest version is used. */
+    token: string;
+    /** The 1Password vault's name or ID. */
+    vault: string;
+    /**
+     * Origins the values may be filled into, 1-20, with the same rules as a
+     * secret's: `scheme://host[:port]`, https (http only for localhost), and a
+     * leading `*.` matching subdomains of a registrable domain.
+     */
+    allowedOrigins: string[];
+}
+export interface FillCredentialParams {
+    /** A secret attached to the session, by name or ID. Pass one of this, `vault` or `onePassword`. */
+    credential?: string;
+    /** A vault attached to the session, by name. Pass one of this, `credential` or `onePassword`. */
+    vault?: string;
+    /**
+     * 1Password fields, each named by its field's `ref`. Pass one of this,
+     * `credential` or `vault`.
+     */
+    onePassword?: CredentialFillOnePassword;
+    /** 1-16 inputs. */
+    fields: CredentialFillField[];
+    /**
+     * The tab to fill (a CDP target ID). Needed when several tabs could be the
+     * target; see `CREDENTIAL_PAGE_AMBIGUOUS`. Not with `pageUrl`.
+     */
+    pageId?: string;
+    /** Fill the tab whose URL starts with this. Not with `pageId`. */
+    pageUrl?: string;
+    /** Fill inside the iframe whose URL starts with this. */
+    frameUrl?: string;
+}
+/**
+ * - `filled`: the input holds the value (for a TOTP secret, the current code).
+ * - `not_found`: no input matched the selector.
+ * - `ambiguous`: several visible inputs matched.
+ * - `not_editable`: disabled, read-only, hidden or not a text input.
+ * - `not_accepted`: the page didn't keep the value (for example `maxlength`).
+ *
+ * Outcomes added later come through as other strings.
+ */
+export type CredentialFillOutcome = "filled" | "not_found" | "ambiguous" | "not_editable" | "not_accepted" | (string & {});
+export interface CredentialFillFieldResult {
+    selector: string;
+    outcome: CredentialFillOutcome;
+    /** The secret typed into this input; for 1Password, the `op_token` secret read with. */
+    secretId: string;
+    /** Its version. */
+    version: number;
+    /** The vault entry, for vault fills. */
+    field?: string;
+    /** The `op://vault/item/[section/]field` reference read, for 1Password fills. */
+    reference?: string;
+    /** For a TOTP secret, when the code that was typed stops being valid. */
+    expiresAt?: string;
+}
+/** Outcomes per input; never values. */
+export interface CredentialFillResult {
+    /** The secret version filled, for a single-secret fill. Absent for vault and 1Password fills. */
+    version?: number;
+    pageId: string;
+    origin: string;
+    fields: CredentialFillFieldResult[];
+}
+/** One candidate tab in a `CREDENTIAL_PAGE_AMBIGUOUS` error's `details.pages`. */
+export interface CredentialFillPage {
+    pageId: string;
+    url: string;
+    title: string;
+}

package/dist/types/credential.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/types/index.d.ts

@@ -12,9 +12,11 @@ export { StartGrokComputerUseTaskParams, StartGrokComputerUseTaskResponse, GrokC
 export { StartMetaComputerUseTaskParams, StartMetaComputerUseTaskResponse, MetaComputerUseTaskStatusResponse, MetaComputerUseTaskResponse, MetaComputerUseTaskData, MetaComputerUseStepResponse, MetaComputerUseStepError, MetaComputerUseStepIncompleteDetails, MetaComputerUseStepReasoning, MetaComputerUseApiKeys, MetaComputerUseTaskMetadata, } from "./agents/meta-computer-use";
 export { StartJevComputerUseTaskParams, StartJevComputerUseTaskResponse, JevComputerUseTaskStatusResponse, JevComputerUseTaskResponse, JevComputerUseTaskData, JevComputerUseStepResponse, JevComputerUseApiKeys, JevComputerUseTaskMetadata, } from "./agents/jev-computer-use";
 export { BasicResponse, BrowserMemorySize, SessionStatus, Session, SessionDetail, SessionGetParams, SessionListParams, SessionListResponse, ScreenConfig, CaptchaEvaluationPageResult, CaptchaEvaluationParams, CaptchaEvaluationResponse, CaptchaEvaluationTarget, CaptchaEvaluationType, CaptchaSolverType, CreateSessionParams, CreateSessionSnapshotResponse, GetSessionDownloadsUrlResponse, GetSessionVideoRecordingUrlResponse, GetSessionRecordingUrlResponse, ImageCaptchaParam, UploadFileResponse, UploadFileOptions, GetActiveSessionsCountResponse, SessionEventLogListParams, SessionEventLogListResponse, SessionEventLog, SessionProfile, SessionLaunchState, SessionWebBotAuth, SessionCreditBreakdown, StartSessionFromSnapshotParams, WebBotAuthParams, ProxyRoute, UpdateSessionProfileParams, UpdateSessionProxyLocationParams, UpdateSessionProxyParams, UpdateSessionScreenParams, UpdateSessionSolveCaptchasParams, UpdateSessionSolveCaptchasResponse, } from "./session";
-export { SandboxStatus, SandboxRuntimeTarget, SandboxNetworkPolicy, SandboxNetworkPolicyPatch, SandboxNetworkUpdateResult, Sandbox, SandboxDetail, SandboxVolumeMountType, SandboxVolumeMount, SandboxSecretReference, SandboxSecrets, SandboxResolvedSecret, SandboxListParams, SandboxListResponse, SandboxImageSource, SandboxImageSummary, SandboxImageListParams, SandboxImageListResponse, SandboxSnapshotStatus, SandboxSnapshotSummary, SandboxSnapshotListParams, SandboxSnapshotListResponse, SandboxSnapshotDeleteResult, SandboxImageDeleteResult, SandboxImageInit, SandboxImageBuildStatus, SandboxImageBuildInputFormat, SandboxImageBuildSourcePlatform, SandboxImageBuildUpload, SandboxImageBuild, SandboxBuildContextBundle, SandboxBuildContextMode, SandboxBuildContextManifest, SandboxDockerImageConfig, SandboxDockerImageLayer, SandboxDockerImageManifest, CreateSandboxImageBuildParams, ReuseSandboxDockerImageParams, CompleteSandboxImageBuildParams, SandboxImageBuildCreateResult, SandboxDockerImageReuseResult, SandboxImageBuildResolutionOutcome, SandboxImageBuildResolution, SandboxImageBuildWaitOptions, BuildSandboxImageFromDockerImageOptions, BuildSandboxImageFromDockerfileOptions, GetOrBuildSandboxImageOptions, SandboxImageBuildListParams, SandboxImageBuildListResponse, CreateSandboxParams, SandboxMemorySnapshotParams, SandboxMemorySnapshotResult, SandboxExposeParams, SandboxExposeResult, SandboxUnexposeResult, SandboxProcessStatus, SandboxExecParams, SandboxExecOptions, SandboxProcessSummary, SandboxProcessResult, SandboxProcessListParams, SandboxProcessListResponse, SandboxProcessWaitParams, SandboxProcessSignal, SandboxProcessStdinParams, SandboxProcessOutputEvent, SandboxProcessExitEvent, SandboxProcessStreamEvent, SandboxFileType, SandboxFileInfo, SandboxFileWriteInfo, SandboxFileListOptions, SandboxFileReadFormat, SandboxFileReadOptions, SandboxFileWriteData, SandboxFileWriteEntry, SandboxFileTextWriteOptions, SandboxFileBytesWriteOptions, SandboxFileMakeDirOptions, SandboxFileCopyParams, SandboxFileChmodParams, SandboxFileChownParams, SandboxFileTransferResult, SandboxFileSystemEventType, SandboxFileSystemEvent, SandboxWatchDirOptions, SandboxPresignFileParams, SandboxPresignedUrl, SandboxTerminalCreateParams, SandboxTerminalOutputChunk, SandboxTerminalStatus, SandboxTerminalWaitParams, SandboxTerminalKillParams, SandboxTerminalEvent, } from "./sandbox";
+export { SandboxStatus, SandboxRuntimeTarget, SandboxNetworkPolicy, SandboxNetworkPolicyPatch, SandboxNetworkUpdateResult, Sandbox, SandboxDetail, SandboxVolumeMountType, SandboxVolumeMount, SandboxSecretReference, SandboxSecrets, SandboxResolvedSecret, SandboxStoredSecretBinding, SandboxOnePasswordBinding, SandboxSecretSource, SandboxOnePassword, SandboxOnePasswordField, SandboxListParams, SandboxListResponse, SandboxImageSource, SandboxImageSummary, SandboxImageListParams, SandboxImageListResponse, SandboxSnapshotStatus, SandboxSnapshotSummary, SandboxSnapshotListParams, SandboxSnapshotListResponse, SandboxSnapshotDeleteResult, SandboxImageDeleteResult, SandboxImageInit, SandboxImageBuildStatus, SandboxImageBuildInputFormat, SandboxImageBuildSourcePlatform, SandboxImageBuildUpload, SandboxImageBuild, SandboxBuildContextBundle, SandboxBuildContextMode, SandboxBuildContextManifest, SandboxDockerImageConfig, SandboxDockerImageLayer, SandboxDockerImageManifest, CreateSandboxImageBuildParams, ReuseSandboxDockerImageParams, CompleteSandboxImageBuildParams, SandboxImageBuildCreateResult, SandboxDockerImageReuseResult, SandboxImageBuildResolutionOutcome, SandboxImageBuildResolution, SandboxImageBuildWaitOptions, BuildSandboxImageFromDockerImageOptions, BuildSandboxImageFromDockerfileOptions, GetOrBuildSandboxImageOptions, SandboxImageBuildListParams, SandboxImageBuildListResponse, CreateSandboxParams, SandboxMemorySnapshotParams, SandboxMemorySnapshotResult, SandboxExposeParams, SandboxExposeResult, SandboxUnexposeResult, SandboxProcessStatus, SandboxExecParams, SandboxExecOptions, SandboxProcessSummary, SandboxProcessResult, SandboxProcessListParams, SandboxProcessListResponse, SandboxProcessWaitParams, SandboxProcessSignal, SandboxProcessStdinParams, SandboxProcessOutputEvent, SandboxProcessExitEvent, SandboxProcessStreamEvent, SandboxFileType, SandboxFileInfo, SandboxFileWriteInfo, SandboxFileListOptions, SandboxFileReadFormat, SandboxFileReadOptions, SandboxFileWriteData, SandboxFileWriteEntry, SandboxFileTextWriteOptions, SandboxFileBytesWriteOptions, SandboxFileMakeDirOptions, SandboxFileCopyParams, SandboxFileChmodParams, SandboxFileChownParams, SandboxFileTransferResult, SandboxFileSystemEventType, SandboxFileSystemEvent, SandboxWatchDirOptions, SandboxPresignFileParams, SandboxPresignedUrl, SandboxTerminalCreateParams, SandboxTerminalOutputChunk, SandboxTerminalStatus, SandboxTerminalWaitParams, SandboxTerminalKillParams, SandboxTerminalEvent, } from "./sandbox";
 export { CreateVolumeParams, Volume, VolumeListParams, VolumeListResponse, VolumeDeleteResult, } from "./volume";
-export { SecretValue, SecretsPublicKey, SecretsPublicKeyJwk, Secret, SecretVersion, SecretDetail, CreateSecretParams, UpdateSecretParams, SecretListParams, SecretListResponse, SecretDeleteResult, SecretVersionDeleteResult, } from "./secret";
+export { SecretValue, SecretType, SecretBrowserMetadata, SecretMetadata, UpdateSecretMetadata, SecretsPublicKey, SecretsPublicKeyJwk, Secret, SecretVersion, SecretDetail, CreateSecretParams, UpdateSecretParams, SecretListParams, SecretListResponse, SecretDeleteResult, SecretVersionDeleteResult, } from "./secret";
+export { SessionCredential, SessionCredentialSource, CredentialFillField, CredentialFillRef, CredentialFillOnePassword, FillCredentialParams, CredentialFillOutcome, CredentialFillFieldResult, CredentialFillResult, CredentialFillPage, } from "./credential";
+export { Vault, VaultEntry, VaultEntryParams, CreateVaultParams, UpdateVaultParams, VaultListParams, VaultListResponse, VaultDeleteResult, } from "./vault";
 export { CreateProfileParams, ForkProfileParams, ProfileResponse, CreateProfileResponse, ProfileListParams, ProfileListResponse, } from "./profile";
 export { CreateExtensionParams, CreateExtensionResponse, ListExtensionsResponse, } from "./extension";
 export { ExtractJobStatus, BrowserUseTaskStatus, BrowserUseLlm, ClaudeComputerUseLlm, ClaudeComputerUseReasoningEffort, CuaLlm, CuaReasoningEffort, GeminiComputerUseLlm, GeminiComputerUseReasoningEffort, GrokComputerUseLlm, GrokReasoningEffort, MetaComputerUseLlm, MetaReasoningEffort, JevComputerUseLlm, JevTextLlm, ScrapeScreenshotFormat, ScrapeJobStatus, CrawlJobStatus, Country, State, ISO639_1, OperatingSystem, Platform, ScrapeFormat, ScrapeWaitUntil, ScrapePageStatus, CrawlPageStatus, RecordingStatus, DownloadsStatus, HyperAgentLlm, HyperAgentTaskStatus, ClaudeComputerUseTaskStatus, CuaTaskStatus, GeminiComputerUseTaskStatus, GrokComputerUseTaskStatus, MetaComputerUseTaskStatus, JevComputerUseTaskStatus, SessionEventLogType, SessionRegion, BrowserUseVersion, HyperAgentVersion, } from "./constants";

package/dist/types/sandbox.d.ts

@@ -68,6 +68,8 @@ export interface Sandbox {
 export interface SandboxDetail extends Sandbox {
     token: string | null;
     tokenExpiresAt: string | null;
+    /** On create with `secrets`, `vault` or `onePassword`: what the startup command received. */
+    startupSecrets?: SandboxResolvedSecret[];
 }
 export type SandboxVolumeMountType = "rw" | "ro";
 /**
@@ -80,13 +82,75 @@ export type SandboxSecretReference = string | {
 };
 /** Environment variable name to secret, at most 32 per process or sandbox. */
 export type SandboxSecrets = Record<string, SandboxSecretReference>;
-/** The secret version an environment variable received. */
-export interface SandboxResolvedSecret {
+/**
+ * Fields of one 1Password vault to deliver as environment variables, read
+ * with a service account token kept as an `op_token` secret when the process
+ * starts. Nothing about it is stored.
+ */
+export interface SandboxOnePassword {
+    /** The name of the `op_token` secret; its latest version is used. */
+    token: string;
+    /** The 1Password vault's name or ID. */
+    vault: string;
+    /**
+     * Environment variable name to field, 1-32. A variable set here can't also
+     * be set by `vault`, `secrets` or `env`.
+     */
+    fields: Record<string, SandboxOnePasswordField>;
+}
+/**
+ * A field of an item in the 1Password vault. Names and IDs are 1-256
+ * characters without '/' or '?', and not "." or "..". The field may end
+ * with a query such as `?attribute=totp`.
+ */
+export interface SandboxOnePasswordField {
+    /** The item's name or ID. */
+    item: string;
+    /** The section's name or ID, when the field is in one. */
+    section?: string;
+    /** The field's name or ID, optionally with a query such as `?attribute=otp`. */
+    field: string;
+}
+/** Where a delivered variable came from: a vault, `onePassword` or the request's `secrets`. */
+export type SandboxSecretSource = {
+    type: "vault";
+    name: string;
+} | {
+    type: "secrets";
+} | {
+    type: "onePassword";
+};
+/** What a variable from a vault or `secrets` received: a stored secret's version. */
+export interface SandboxStoredSecretBinding {
     env: string;
+    /** The stored secret's name. */
     name: string;
     secretId: string;
     version: number;
+    /** `"totp"` when the variable holds a TOTP secret's code from process start. */
+    secretType?: string;
+    source: {
+        type: "vault";
+        name: string;
+    } | {
+        type: "secrets";
+    };
+    /** Earlier sources that set the same variable and were overridden, oldest first. */
+    overrides?: SandboxSecretSource[];
+}
+/** What a variable from `onePassword` received: the `op://` reference that was read. */
+export interface SandboxOnePasswordBinding {
+    env: string;
+    /** The 1Password reference, such as `op://Engineering/Postgres/password`. */
+    reference: string;
+    /** The name of the `op_token` secret that signed in to 1Password. */
+    tokenSecret: string;
+    source: {
+        type: "onePassword";
+    };
 }
+/** What an environment variable received. Never a value. */
+export type SandboxResolvedSecret = SandboxStoredSecretBinding | SandboxOnePasswordBinding;
 export interface SandboxVolumeMount {
     id: string;
     type?: SandboxVolumeMountType;
@@ -112,6 +176,8 @@ export type CreateSandboxParams = (SandboxCreateCommonParams & {
     memoryMiB?: never;
     diskMiB?: never;
     secrets?: never;
+    vault?: never;
+    onePassword?: never;
 }) | (SandboxCreateCommonParams & {
     snapshotName?: never;
     snapshotId?: never;
@@ -126,6 +192,14 @@ export type CreateSandboxParams = (SandboxCreateCommonParams & {
      * "gvisor-cpu"`. The sandbox is marked as containing secrets.
      */
     secrets?: SandboxSecrets;
+    /**
+     * A vault, by name, whose entries become the startup command's
+     * environment variables; `secrets` is merged over it and wins on a
+     * clash. Same requirements as `secrets`.
+     */
+    vault?: string;
+    /** 1Password fields for the startup command. Same requirements as `secrets`. */
+    onePassword?: SandboxOnePassword;
 });
 export interface SandboxListParams {
     status?: SandboxStatus;
@@ -451,6 +525,19 @@ export interface SandboxExecParams {
      * start stream, so `maxOutputBytes` does not apply.
      */
     secrets?: SandboxSecrets;
+    /**
+     * A vault, by name, whose entries become environment variables of this
+     * process, delivered like `secrets`. `secrets` is merged over it and wins
+     * on a clash; `env` can't set a variable either of them sets. Together
+     * they hold at most 32 variables.
+     */
+    vault?: string;
+    /**
+     * Fields of a 1Password vault, read with an `op_token` secret when the
+     * process starts and delivered like `secrets`. A variable set here can't
+     * also be set by `vault`, `secrets` or `env`.
+     */
+    onePassword?: SandboxOnePassword;
     /** @deprecated Ignored for process APIs. */
     useShell?: boolean;
 }

package/dist/types/secret.d.ts

@@ -1,5 +1,28 @@
 /** A secret value: a UTF-8 string or its raw bytes, used byte-for-byte. */
 export type SecretValue = string | Uint8Array;
+/**
+ * What a secret's value is, fixed at creation:
+ * - `"secret"`: an opaque value. It can be a sandbox environment variable,
+ *   and once it has allowed origins it can be filled into browser pages.
+ * - `"totp"`: a TOTP seed, as base32 or an `otpauth://totp/` URI. Sandboxes
+ *   and browser fills get its current one-time code, never the seed.
+ * - `"op_token"`: a 1Password service account token, used only as the
+ *   `token` of a sandbox's or a browser fill's `onePassword` fields. It is
+ *   never an environment variable or filled into a page itself.
+ */
+export type SecretType = "secret" | "totp" | "op_token";
+export interface SecretBrowserMetadata {
+    /**
+     * Origins the secret may be filled into, as `scheme://host[:port]`. A
+     * leading `*.` matches any subdomain (not the domain itself).
+     */
+    allowedOrigins: string[];
+}
+/** `{}` until allowed origins are set. */
+export interface SecretMetadata {
+    browser?: SecretBrowserMetadata;
+    [member: string]: unknown;
+}
 export interface SecretsPublicKeyJwk {
     kty: string;
     n: string;
@@ -16,6 +39,12 @@ export interface Secret {
     id: string;
     name: string;
     description: string;
+    /**
+     * A `SecretType`. Typed as a string so secrets of types added later are
+     * still read.
+     */
+    type: string;
+    metadata: SecretMetadata;
     /** Bound into every envelope for this secret; the SDK uses it when encrypting. */
     encryptionContext: string;
     /** Null until a value is stored. */
@@ -35,17 +64,46 @@ export interface CreateSecretParams {
     /** 1-128 letters, digits, '_' or '-', starting with a letter or digit. */
     name: string;
     description?: string;
+    /** Defaults to `"secret"`. */
+    type?: SecretType;
     /**
-     * The first version's value. It is validated and the platform key is checked
-     * before the secret is created, then encrypted locally and uploaded.
+     * The first version's value. It is checked against the type's rules and
+     * the platform key is checked before the secret is created; then it is
+     * encrypted locally and uploaded.
+     *
+     * - `"secret"`: any string or bytes.
+     * - `"totp"`: a base32 seed (spaces, hyphens, lowercase and trailing `=`
+     *   padding are fine) or an `otpauth://totp/...?secret=...` URI, optionally
+     *   with `algorithm` (SHA1, SHA256 or SHA512), `digits` (6 or 8) and
+     *   `period` (1-300). A seed whose length can't be whole base32 (1, 3 or 6
+     *   characters past a multiple of 8) is refused as incompletely copied.
+     *   Seeds under 10 bytes (16 characters) are accepted but unusually short.
+     * - `"op_token"`: a 1Password service account token. These start with
+     *   `ops_`, but other values are not refused.
      */
     value?: SecretValue;
+    /**
+     * Origins the secret may be filled into in browser sessions, such as
+     * `["https://github.com"]`; 1-20 entries. Not for `"op_token"` secrets.
+     */
+    allowedOrigins?: string[];
+}
+/**
+ * Metadata members sent replace the stored ones, `null` removes a member, and
+ * members not sent are kept.
+ */
+export interface UpdateSecretMetadata {
+    browser?: SecretBrowserMetadata | null;
 }
+/** At least one field. */
 export interface UpdateSecretParams {
-    description: string;
+    description?: string;
+    metadata?: UpdateSecretMetadata;
 }
 export interface SecretListParams {
     search?: string;
+    /** Only secrets of this type. */
+    type?: SecretType;
     page?: number;
     /** At most 100. */
     limit?: number;

package/dist/types/session.d.ts

@@ -1,5 +1,6 @@
 import fs from "fs";
 import { Country, DownloadsStatus, ISO639_1, OperatingSystem, Platform, RecordingStatus, SessionEventLogType, SessionRegion, State } from "./constants";
+import { SessionCredential, SessionCredentialSource } from "./credential";
 export type SessionStatus = "active" | "closed" | "close-error" | "error";
 export type BrowserMemorySize = "small" | "medium" | "large";
 export interface BasicResponse {
@@ -73,6 +74,8 @@ export interface SessionDetail extends Session {
     liveUrl?: string;
     liveDomain?: string;
     token: string;
+    /** The secrets attached at creation, when any were requested. */
+    credentials?: SessionCredential[];
 }
 export interface SessionGetParams {
     liveViewTtlSeconds?: number;
@@ -225,6 +228,17 @@ export interface CreateSessionParams {
     disablePostQuantumKeyAgreement?: boolean;
     browserMemorySize?: BrowserMemorySize;
     startFromSnapshot?: StartSessionFromSnapshotParams;
+    /**
+     * Secrets that `sessions.credentials.fill` may type into pages, at most 20:
+     * a secret's name (or `{ secret: name }`), `{ vault: name }` for the
+     * secrets a vault's entries name when the session is created, or
+     * `{ onePassword: name }` for an `op_token` secret whose 1Password fields
+     * fills may read.
+     * Secrets need allowed origins to be filled. They can only be attached at
+     * creation; the session runs on Firecracker with Chrome's password manager
+     * off.
+     */
+    credentials?: SessionCredentialSource[];
 }
 export interface CreateSessionSnapshotResponse {
     snapshotName: string;

package/dist/types/vault.d.ts

@@ -0,0 +1,55 @@
+/** An entry of a vault: a stored secret. */
+export interface VaultEntry {
+    /** The secret's name. */
+    name: string;
+    secretId: string;
+    /** A pinned version, or null to follow the secret's latest version. */
+    version: number | null;
+}
+/** Named environment variables whose values come from stored secrets. A vault holds no values itself. */
+export interface Vault {
+    id: string;
+    name: string;
+    description: string;
+    /** Environment variable name to entry. */
+    entries: Record<string, VaultEntry>;
+    createdAt: string;
+    updatedAt: string;
+}
+/** A stored secret, following its latest version unless one is pinned. */
+export interface VaultEntryParams {
+    /** The secret's name. */
+    name: string;
+    version?: number | "latest";
+}
+export interface CreateVaultParams {
+    /** 1-128 letters, digits, '_' or '-', starting with a letter or digit. */
+    name: string;
+    description?: string;
+    /** Environment variable name to secret, at most 32. */
+    entries?: Record<string, VaultEntryParams>;
+}
+/** At least one field. */
+export interface UpdateVaultParams {
+    description?: string;
+    /** Each entry given replaces that variable; `null` removes it. Others are kept. */
+    entries?: Record<string, VaultEntryParams | null>;
+}
+export interface VaultListParams {
+    /** Vaults whose name contains this. */
+    search?: string;
+    page?: number;
+    /** At most 100. */
+    limit?: number;
+}
+export interface VaultListResponse {
+    vaults: Vault[];
+    totalCount: number;
+    page: number;
+    perPage: number;
+}
+export interface VaultDeleteResult {
+    deleted: boolean;
+    id: string;
+    name: string;
+}

package/dist/types/vault.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperbrowser/sdk",
-  "version": "1.2.2",
+  "version": "1.4.0",
   "description": "Node SDK for Hyperbrowser API",
   "author": "",
   "repository": {