@onkernel/sdk 0.115.0 → 0.117.0

package/src/resources/credentials.ts

@@ -139,8 +139,29 @@ export interface CreateCredentialRequest {
   sso_provider?: string;
 
   /**
-   * Base32-encoded TOTP secret for generating one-time passwords. Used for automatic
-   * 2FA during login.
+   * HMAC algorithm used to generate TOTP codes. Defaults to SHA1 and is ignored when
+   * an `otpauth://` URI supplies the algorithm.
+   */
+  totp_algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+
+  /**
+   * Number of digits in generated TOTP codes. Defaults to 6 and is ignored when an
+   * `otpauth://` URI supplies the digit count.
+   */
+  totp_digits?: number;
+
+  /**
+   * TOTP rotation period in seconds. Defaults to 30 and is ignored when an
+   * `otpauth://` URI supplies the period.
+   */
+  totp_period?: number;
+
+  /**
+   * Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+   * URI. The range accepts existing shorter seeds and longer seeds regardless of
+   * HMAC algorithm; RFC 6238 recommends unpadded base32 lengths of 32/52/103 for
+   * SHA1/SHA256/SHA512. Only URI parameters present override the corresponding
+   * explicit TOTP fields. Used for automatic 2FA during login.
    */
   totp_secret?: string;
 }
@@ -193,8 +214,14 @@ export interface Credential {
   sso_provider?: string | null;
 
   /**
-   * Current 6-digit TOTP code. Only included in create/update responses when
-   * totp_secret was just set.
+   * HMAC algorithm used to generate TOTP codes. Defaults to SHA1 for credentials
+   * created before this metadata was stored.
+   */
+  totp_algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+
+  /**
+   * Current TOTP code. Only included in create/update responses when totp_secret was
+   * just set.
    */
   totp_code?: string;
 
@@ -203,6 +230,18 @@ export interface Credential {
    */
   totp_code_expires_at?: string;
 
+  /**
+   * Number of digits in generated TOTP codes. Defaults to 6 for credentials created
+   * before this metadata was stored.
+   */
+  totp_digits?: number;
+
+  /**
+   * TOTP rotation period in seconds. Defaults to 30 for credentials created before
+   * this metadata was stored.
+   */
+  totp_period?: number;
+
   /**
    * The field names stored in this credential's values (e.g., username, password).
    * Values themselves are never returned. Included on single-credential responses
@@ -233,8 +272,29 @@ export interface UpdateCredentialRequest {
   sso_provider?: string | null;
 
   /**
-   * Base32-encoded TOTP secret for generating one-time passwords. Spaces and
-   * formatting are automatically normalized. Set to empty string to remove.
+   * HMAC algorithm used to generate TOTP codes. Requires totp_secret and is ignored
+   * when an `otpauth://` URI supplies the algorithm.
+   */
+  totp_algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+
+  /**
+   * Number of digits in generated TOTP codes. Requires totp_secret and is ignored
+   * when an `otpauth://` URI supplies the digit count.
+   */
+  totp_digits?: number;
+
+  /**
+   * TOTP rotation period in seconds. Requires totp_secret and is ignored when an
+   * `otpauth://` URI supplies the period.
+   */
+  totp_period?: number;
+
+  /**
+   * Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+   * URI. Only URI parameters present override the corresponding explicit TOTP
+   * fields. When rotating a raw secret, omitted fields preserve their existing
+   * values; a new URI defaults unspecified fields to SHA1/6/30. Set to empty string
+   * to remove the secret and its metadata.
    */
   totp_secret?: string;
 
@@ -282,8 +342,29 @@ export interface CredentialCreateParams {
   sso_provider?: string;
 
   /**
-   * Base32-encoded TOTP secret for generating one-time passwords. Used for automatic
-   * 2FA during login.
+   * HMAC algorithm used to generate TOTP codes. Defaults to SHA1 and is ignored when
+   * an `otpauth://` URI supplies the algorithm.
+   */
+  totp_algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+
+  /**
+   * Number of digits in generated TOTP codes. Defaults to 6 and is ignored when an
+   * `otpauth://` URI supplies the digit count.
+   */
+  totp_digits?: number;
+
+  /**
+   * TOTP rotation period in seconds. Defaults to 30 and is ignored when an
+   * `otpauth://` URI supplies the period.
+   */
+  totp_period?: number;
+
+  /**
+   * Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+   * URI. The range accepts existing shorter seeds and longer seeds regardless of
+   * HMAC algorithm; RFC 6238 recommends unpadded base32 lengths of 32/52/103 for
+   * SHA1/SHA256/SHA512. Only URI parameters present override the corresponding
+   * explicit TOTP fields. Used for automatic 2FA during login.
    */
   totp_secret?: string;
 }
@@ -307,8 +388,29 @@ export interface CredentialUpdateParams {
   sso_provider?: string | null;
 
   /**
-   * Base32-encoded TOTP secret for generating one-time passwords. Spaces and
-   * formatting are automatically normalized. Set to empty string to remove.
+   * HMAC algorithm used to generate TOTP codes. Requires totp_secret and is ignored
+   * when an `otpauth://` URI supplies the algorithm.
+   */
+  totp_algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+
+  /**
+   * Number of digits in generated TOTP codes. Requires totp_secret and is ignored
+   * when an `otpauth://` URI supplies the digit count.
+   */
+  totp_digits?: number;
+
+  /**
+   * TOTP rotation period in seconds. Requires totp_secret and is ignored when an
+   * `otpauth://` URI supplies the period.
+   */
+  totp_period?: number;
+
+  /**
+   * Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+   * URI. Only URI parameters present override the corresponding explicit TOTP
+   * fields. When rotating a raw secret, omitted fields preserve their existing
+   * values; a new URI defaults unspecified fields to SHA1/6/30. Set to empty string
+   * to remove the secret and its metadata.
    */
   totp_secret?: string;
 

package/src/resources/vaults/index.ts

@@ -50,8 +50,11 @@ export {
   type VaultItemEvent,
   type VaultItemOperationResponse,
   type VaultPaymentMethod,
+  type VaultWebmcpBinding,
   type WalletVaultItemSpec,
   type WalletVaultItemState,
+  type WebmcpInvokeVaultItemOperationRequest,
+  type WebmcpInvokeVaultItemOperationResult,
   type ItemListResponse,
   type ItemEventsResponse,
   type ItemRetrieveParams,

package/src/resources/vaults/items.ts

@@ -413,8 +413,9 @@ export namespace CardVaultItemSpec {
 
   /**
    * AgentCard reusable live payment card. Test-mode card creation is not supported.
-   * Each checkout creates an approval-gated authorization for spec.merchant /
-   * spec.amount. The card stays ready after each authorization.
+   * Each checkout creates an authorization for spec.merchant / spec.amount that the
+   * cardholder approves, unless AgentCard runs it under one of the cardholder's
+   * autopilot rules. The card stays ready after each authorization.
    */
   export interface AgentCardCardVaultItemSpec {
     /**
@@ -442,6 +443,18 @@ export namespace CardVaultItemSpec {
      * picks on the approval screen.
      */
     card_id?: string;
+
+    /**
+     * Origin of the top-level checkout page, such as https://shop.example.com: https,
+     * a lowercase host, a port only when it is not 443, and no path. http is accepted
+     * only for localhost test pages. Checkouts without a preparation send it to
+     * AgentCard, which uses it to match the cardholder's autopilot rules; prepared
+     * checkouts send the preparation's merchant_origin instead. Kernel sends the
+     * declared value and does not compare it with the page the browser has open.
+     * Omitted, those checkouts ask the cardholder to approve. Card updates replace the
+     * whole spec, so an update that omits it removes it.
+     */
+    checkout_origin?: string;
   }
 }
 
@@ -628,7 +641,8 @@ export namespace CredentialAccountVaultItem {
       | '1pw_access_request_status'
       | '1pw_fill'
       | '1pw_recover'
-      | '1pw_update_access_token';
+      | '1pw_update_access_token'
+      | 'webmcp_invoke';
   }
 }
 
@@ -894,7 +908,8 @@ export namespace CredentialVaultItem {
       | '1pw_access_request_status'
       | '1pw_fill'
       | '1pw_recover'
-      | '1pw_update_access_token';
+      | '1pw_update_access_token'
+      | 'webmcp_invoke';
   }
 
   export interface OnePasswordAccessApprovalAction {
@@ -1759,7 +1774,8 @@ export namespace VaultItem {
         | '1pw_access_request_status'
         | '1pw_fill'
         | '1pw_recover'
-        | '1pw_update_access_token';
+        | '1pw_update_access_token'
+        | 'webmcp_invoke';
     }
 
     /**
@@ -1831,7 +1847,8 @@ export namespace VaultItem {
         | '1pw_access_request_status'
         | '1pw_fill'
         | '1pw_recover'
-        | '1pw_update_access_token';
+        | '1pw_update_access_token'
+        | 'webmcp_invoke';
     }
   }
 }
@@ -1898,9 +1915,9 @@ export interface VaultItemEvent {
 }
 
 /**
- * The submission result reported by the 1Password extension when available. Kernel
- * returns fill_unknown if the extension call has no conclusive result. Inspect the
- * page to determine successful authentication on the website.
+ * Authorization and preparation return the existing item shape. Fill returns a
+ * value-free result; WebMCP invocation returns the tool's output. Neither persists
+ * transient outcomes on the item.
  */
 export type VaultItemOperationResponse =
   | VaultItemOperationResponse.WalletVaultItem
@@ -1908,7 +1925,8 @@ export type VaultItemOperationResponse =
   | CredentialAccountVaultItem
   | CredentialVaultItem
   | FillVaultItemOperationResult
-  | OnePasswordFillVaultItemOperationResult;
+  | OnePasswordFillVaultItemOperationResult
+  | WebmcpInvokeVaultItemOperationResult;
 
 export namespace VaultItemOperationResponse {
   export interface WalletVaultItem {
@@ -1978,7 +1996,8 @@ export namespace VaultItemOperationResponse {
         | '1pw_access_request_status'
         | '1pw_fill'
         | '1pw_recover'
-        | '1pw_update_access_token';
+        | '1pw_update_access_token'
+        | 'webmcp_invoke';
     }
 
     /**
@@ -2050,7 +2069,8 @@ export namespace VaultItemOperationResponse {
         | '1pw_access_request_status'
         | '1pw_fill'
         | '1pw_recover'
-        | '1pw_update_access_token';
+        | '1pw_update_access_token'
+        | 'webmcp_invoke';
     }
   }
 }
@@ -2105,6 +2125,27 @@ export namespace VaultPaymentMethod {
   }
 }
 
+export interface VaultWebmcpBinding {
+  /**
+   * A declared, populated credential field or supported card field. A TOTP field
+   * supplies a fresh code, never its seed.
+   */
+  field: string;
+
+  /**
+   * RFC 6901 JSON Pointer to an existing null value in input. Object keys are exact;
+   * array indices must be canonical and in range. No root or array-append paths.
+   * Each path and each field may occur only once.
+   */
+  input_path: string;
+
+  /**
+   * Required for card expiration (MM/YY or MM/YYYY), forbidden for other fields.
+   * Invalid formats are rejected before invocation.
+   */
+  format?: string;
+}
+
 /**
  * AgentCard wallet. Omit provider_config to use Kernel-managed credentials, or
  * select a customer-owned configuration. Mode (sandbox vs live) is determined by
@@ -2222,6 +2263,85 @@ export namespace WalletVaultItemState {
   }
 }
 
+/**
+ * Invoke a WebMCP tool using values from a vaulted item. The browser must be
+ * attached to the item's vault. Discover the tool_ref, inputSchema, and source
+ * with GET /browsers/{id_or_name}/webmcp/tools or webmcp.listTools() in the
+ * Browser REPL (POST /browsers/{id_or_name}/repl) before invoking it. Input paths
+ * replace existing null slots in input. Tool output is returned without redaction
+ * and may include the supplied values. The tool may submit or perform other side
+ * effects. Any item destination restrictions apply to the tool's top-level page
+ * and registering frame (if any).
+ */
+export interface WebmcpInvokeVaultItemOperationRequest {
+  bindings: Array<VaultWebmcpBinding>;
+
+  /**
+   * Browser session ID, not a reusable browser name.
+   */
+  browser_id: string;
+
+  /**
+   * Public tool arguments with an existing null slot at each binding path. At most
+   * 64 KiB after JSON serialization, including substituted values. Never include
+   * vault values here.
+   */
+  input: { [key: string]: unknown };
+
+  /**
+   * Exact top-level URL from the discovered tool source (fragment omitted). This
+   * pins the target page; it does not authorize a destination.
+   */
+  page_url: string;
+
+  /**
+   * Opaque reference to the exact live WebMCP registration.
+   */
+  tool_ref: string;
+
+  type: 'webmcp_invoke';
+
+  /**
+   * Tool invocation timeout in seconds; preflight and response handling have an
+   * additional bounded allowance. An indeterminate outcome is not retried.
+   */
+  timeout_sec?: number;
+}
+
+/**
+ * Returns the same tool result fields as the browser WebMCP invoke API, plus the
+ * vault operation discriminator. Output and error text are untrusted page-provided
+ * data, returned without redaction; tools may include supplied vault values.
+ * Inspect the browser page to determine whether the intended site action
+ * succeeded.
+ */
+export interface WebmcpInvokeVaultItemOperationResult {
+  /**
+   * Unknown means invocation may have run; do not retry automatically. No status
+   * confirms that the website accepted the action.
+   */
+  status: 'completed' | 'canceled' | 'error' | 'awaiting_submission' | 'unknown';
+
+  type: 'webmcp_invoke';
+
+  /**
+   * Untrusted page-provided error text, returned without redaction. May contain
+   * supplied vault values.
+   */
+  error_text?: string;
+
+  /**
+   * Present when the browser reported one.
+   */
+  invocation_id?: string;
+
+  /**
+   * Untrusted page-provided output, returned without redaction. May contain supplied
+   * vault values.
+   */
+  output?: unknown;
+}
+
 export type ItemListResponse = Array<VaultItem>;
 
 export type ItemEventsResponse = Array<VaultItemEvent>;
@@ -2331,7 +2451,8 @@ export type ItemPerformOperationParams =
   | ItemPerformOperationParams.OnePasswordPollAccessVaultItemOperationRequest
   | ItemPerformOperationParams.OnePasswordFillVaultItemOperationRequest
   | ItemPerformOperationParams.OnePasswordRecoverVaultItemOperationRequest
-  | ItemPerformOperationParams.OnePasswordUpdateAccessTokenVaultItemOperationRequest;
+  | ItemPerformOperationParams.OnePasswordUpdateAccessTokenVaultItemOperationRequest
+  | ItemPerformOperationParams.WebmcpInvokeVaultItemOperationRequest;
 
 export declare namespace ItemPerformOperationParams {
   export interface AuthorizeVaultItemOperationRequest {
@@ -2538,6 +2659,52 @@ export declare namespace ItemPerformOperationParams {
      */
     access_token_expires_at?: string;
   }
+
+  export interface WebmcpInvokeVaultItemOperationRequest {
+    /**
+     * Path param
+     */
+    id_or_name: string;
+
+    /**
+     * Body param
+     */
+    bindings: Array<VaultWebmcpBinding>;
+
+    /**
+     * Body param: Browser session ID, not a reusable browser name.
+     */
+    browser_id: string;
+
+    /**
+     * Body param: Public tool arguments with an existing null slot at each binding
+     * path. At most 64 KiB after JSON serialization, including substituted values.
+     * Never include vault values here.
+     */
+    input: { [key: string]: unknown };
+
+    /**
+     * Body param: Exact top-level URL from the discovered tool source (fragment
+     * omitted). This pins the target page; it does not authorize a destination.
+     */
+    page_url: string;
+
+    /**
+     * Body param: Opaque reference to the exact live WebMCP registration.
+     */
+    tool_ref: string;
+
+    /**
+     * Body param
+     */
+    type: 'webmcp_invoke';
+
+    /**
+     * Body param: Tool invocation timeout in seconds; preflight and response handling
+     * have an additional bounded allowance. An indeterminate outcome is not retried.
+     */
+    timeout_sec?: number;
+  }
 }
 
 export type ItemUpsertParams =
@@ -2821,8 +2988,11 @@ export declare namespace Items {
     type VaultItemEvent as VaultItemEvent,
     type VaultItemOperationResponse as VaultItemOperationResponse,
     type VaultPaymentMethod as VaultPaymentMethod,
+    type VaultWebmcpBinding as VaultWebmcpBinding,
     type WalletVaultItemSpec as WalletVaultItemSpec,
     type WalletVaultItemState as WalletVaultItemState,
+    type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest,
+    type WebmcpInvokeVaultItemOperationResult as WebmcpInvokeVaultItemOperationResult,
     type ItemListResponse as ItemListResponse,
     type ItemEventsResponse as ItemEventsResponse,
     type ItemRetrieveParams as ItemRetrieveParams,

package/src/resources/vaults/vaults.ts

@@ -60,8 +60,11 @@ import {
   VaultItemEvent,
   VaultItemOperationResponse,
   VaultPaymentMethod,
+  VaultWebmcpBinding,
   WalletVaultItemSpec,
   WalletVaultItemState,
+  WebmcpInvokeVaultItemOperationRequest,
+  WebmcpInvokeVaultItemOperationResult,
 } from './items';
 import { APIPromise } from '../../core/api-promise';
 import { OffsetPagination, type OffsetPaginationParams, PagePromise } from '../../core/pagination';
@@ -220,8 +223,11 @@ export declare namespace Vaults {
     type VaultItemEvent as VaultItemEvent,
     type VaultItemOperationResponse as VaultItemOperationResponse,
     type VaultPaymentMethod as VaultPaymentMethod,
+    type VaultWebmcpBinding as VaultWebmcpBinding,
     type WalletVaultItemSpec as WalletVaultItemSpec,
     type WalletVaultItemState as WalletVaultItemState,
+    type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest,
+    type WebmcpInvokeVaultItemOperationResult as WebmcpInvokeVaultItemOperationResult,
     type ItemListResponse as ItemListResponse,
     type ItemEventsResponse as ItemEventsResponse,
     type ItemRetrieveParams as ItemRetrieveParams,

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.115.0'; // x-release-please-version
+export const VERSION = '0.117.0'; // x-release-please-version

package/version.d.mts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.115.0";
+export declare const VERSION = "0.117.0";
 //# sourceMappingURL=version.d.mts.map

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.115.0";
+export declare const VERSION = "0.117.0";
 //# sourceMappingURL=version.d.ts.map

package/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = '0.115.0'; // x-release-please-version
+exports.VERSION = '0.117.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/version.mjs

@@ -1,2 +1,2 @@
-export const VERSION = '0.115.0'; // x-release-please-version
+export const VERSION = '0.117.0'; // x-release-please-version
 //# sourceMappingURL=version.mjs.map