@onkernel/sdk 0.117.0 → 0.119.0

package/src/resources/vaults/items.ts

@@ -87,10 +87,14 @@ export class Items extends APIResource {
 
   /**
    * Unresolved payment operations normally block deletion, including operations on
-   * child cards of a wallet. An AgentCard card in recovery_required whose checkout
-   * create response returned no authorization ID may be explicitly abandoned by
-   * deleting that card directly; deleting its wallet or vault remains blocked.
-   * Deleting or recreating an item is not proof that a payment did not occur.
+   * child cards of a wallet. Deleting a connected Kernel wallet first blocks new
+   * payments on it, then removes its enrolled card. If that fails, the wallet is
+   * kept and keeps refusing payments; retry the deletion. An AgentCard card in
+   * recovery_required whose checkout create response returned no authorization ID
+   * may be explicitly abandoned by deleting that card directly; deleting its wallet
+   * or vault remains blocked. Deleting or recreating an item is not proof that a
+   * payment did not occur. Deleting a managed auth credential item leaves the
+   * connection and its saved credential unchanged.
    *
    * @example
    * ```ts
@@ -182,8 +186,8 @@ export class Items extends APIResource {
    * ```ts
    * const vaultItem = await client.vaults.items.upsert('x', {
    *   id_or_name: 'id_or_name',
-   *   spec: { provider: 'link' },
-   *   type: 'card',
+   *   spec: { provider: 'managed_auth' },
+   *   type: 'credential',
    * });
    * ```
    */
@@ -304,8 +308,8 @@ export type AgentcardPreparedProcessor =
   | 'adyen';
 
 /**
- * Authorize a Link card using its existing purchase specification. Use only after
- * explicit user approval and when the item advertises authorize. Do not
+ * Authorize a Link or Kernel card using its existing purchase specification. Use
+ * only after explicit user approval and when the item advertises authorize. Do not
  * automatically retry provider failures or indeterminate outcomes. Checkout
  * context is not accepted.
  */
@@ -318,7 +322,8 @@ export interface AuthorizeVaultItemOperationRequest {
  */
 export type CardVaultItemSpec =
   | CardVaultItemSpec.LinkCardVaultItemSpec
-  | CardVaultItemSpec.AgentCardCardVaultItemSpec;
+  | CardVaultItemSpec.AgentCardCardVaultItemSpec
+  | KernelCardVaultItemSpec;
 
 export namespace CardVaultItemSpec {
   /**
@@ -462,7 +467,10 @@ export namespace CardVaultItemSpec {
  * Issued Link cards retain encrypted card material for the fill operation. Link
  * cards do not expose aliases or support egress substitution.
  */
-export type CardVaultItemState = CardVaultItemState.LinkCardState | CardVaultItemState.AgentCardCardState;
+export type CardVaultItemState =
+  | CardVaultItemState.LinkCardState
+  | CardVaultItemState.AgentCardCardState
+  | KernelCardState;
 
 export namespace CardVaultItemState {
   /**
@@ -501,6 +509,11 @@ export namespace CardVaultItemState {
 
       last4?: string;
 
+      /**
+       * Last four digits of the network token presented to the merchant.
+       */
+      token_last4?: string;
+
       [k: string]: string | undefined;
     }
   }
@@ -559,6 +572,11 @@ export namespace CardVaultItemState {
 
       last4?: string;
 
+      /**
+       * Last four digits of the network token presented to the merchant.
+       */
+      token_last4?: string;
+
       [k: string]: string | undefined;
     }
   }
@@ -822,7 +840,8 @@ export interface CredentialVaultItem {
    * Kernel credentials advertise collect and fill when eligible. 1Password
    * credentials advertise 1pw_create_access_request until a request is made,
    * 1pw_access_request_status while its approval is pending, and 1pw_fill after
-   * access is granted.
+   * access is granted. Managed auth credentials advertise fill while ready and
+   * nothing otherwise.
    */
   available_operations: Array<CredentialVaultItem.AvailableOperation>;
 
@@ -847,7 +866,8 @@ export interface CredentialVaultItem {
 
   /**
    * Starts at 1 and increments on PATCH and successful hosted submission, but not
-   * collection-link renewal.
+   * collection-link renewal. Managed auth credentials stay at 1; changes to the
+   * underlying credential are read at fill time and do not change the version.
    */
   version: number;
 
@@ -939,7 +959,9 @@ export namespace CredentialVaultItem {
  * declare fields and may enter pending_collection. 1Password credentials either
  * reference a connected credential_account or store a supplied access token and
  * integration key encrypted on the item. They store no login values or selectors.
- * Repeating the original creation request returns the current item without
+ * Managed auth credentials reference a managed auth connection in the same project
+ * that already has a saved credential, and read it at fill time; they store no
+ * values. Repeating the original creation request returns the current item without
  * overwriting later state. A different request at the same key returns 409.
  */
 export interface CredentialVaultItemRequest {
@@ -959,7 +981,10 @@ export interface CredentialVaultItemRequest {
  * Stored-token credentials omit account and never return access_token or
  * integration_key.
  */
-export type CredentialVaultItemSpec = KernelCredentialVaultItemSpec | OnePasswordCredentialVaultItemSpec;
+export type CredentialVaultItemSpec =
+  | KernelCredentialVaultItemSpec
+  | OnePasswordCredentialVaultItemSpec
+  | ManagedAuthCredentialVaultItemSpec;
 
 /**
  * Credential fields are for login and other non-payment credentials. Do not store,
@@ -970,7 +995,8 @@ export type CredentialVaultItemSpec = KernelCredentialVaultItemSpec | OnePasswor
  */
 export type CredentialVaultItemSpecInput =
   | KernelCredentialVaultItemSpecInput
-  | OnePasswordCredentialVaultItemSpecInput;
+  | OnePasswordCredentialVaultItemSpecInput
+  | ManagedAuthCredentialVaultItemSpecInput;
 
 export interface CredentialVaultItemSpecUpdate {
   /**
@@ -983,7 +1009,10 @@ export interface CredentialVaultItemSpecUpdate {
   fields?: { [key: string]: CredentialVaultFieldUpdate };
 }
 
-export type CredentialVaultItemState = KernelCredentialVaultItemState | OnePasswordCredentialVaultItemState;
+export type CredentialVaultItemState =
+  | KernelCredentialVaultItemState
+  | OnePasswordCredentialVaultItemState
+  | ManagedAuthCredentialVaultItemState;
 
 /**
  * Atomically update description and selected values. Omitted properties are
@@ -993,7 +1022,8 @@ export type CredentialVaultItemState = KernelCredentialVaultItemState | OnePassw
  * invalidates outstanding Kernel-hosted collection sessions. If required values
  * remain missing, return pending_collection and a fresh collection action.
  * Otherwise return ready without an action; collect can open the form again
- * without clearing values. Customer URLs have no Kernel-managed expiry.
+ * without clearing values. Customer URLs have no Kernel-managed expiry. 1Password
+ * and managed auth credentials return 409.
  */
 export interface CredentialVaultItemUpdateRequest {
   spec: CredentialVaultItemSpecUpdate;
@@ -1015,11 +1045,11 @@ export interface CredentialVaultItemUpdateRequest {
 }
 
 /**
- * Fill selected fields from one ready credential or ready, unexpired Link card
- * into a browser linked to its vault. Only invoke when the item advertises `fill`.
- * Browser and vault must belong to the same project. Kernel checks access and
- * allowed destinations before filling; providing a page URL does not authorize a
- * destination.
+ * Fill selected fields from one ready credential or ready, unexpired Link or
+ * Kernel card into a browser linked to its vault. Only invoke when the item
+ * advertises `fill`. Browser and vault must belong to the same project. Kernel
+ * checks access and allowed destinations before filling; providing a page URL does
+ * not authorize a destination.
  *
  * Find exactly one open page matching `page_url`. Credential items may omit
  * `page_url` to require exactly one open page; cards require an HTTPS page URL.
@@ -1035,9 +1065,10 @@ export interface CredentialVaultItemUpdateRequest {
  *
  * Fill in request order and stop on the first failure. This operation is not
  * atomic: previously filled fields are not rolled back. Never submit the form or
- * click buttons, though input/change events may trigger site behavior. Link cards
- * use fill for browser checkout and do not expose aliases or support egress
- * substitution. Do not automatically retry a failed or indeterminate operation.
+ * click buttons, though input/change events may trigger site behavior. Link and
+ * Kernel cards use fill for browser checkout and do not expose aliases or support
+ * egress substitution. Do not automatically retry a failed or indeterminate
+ * operation.
  *
  * Secret values are never returned or included in operation logs, traces, audit
  * events, or error details. This does not prevent an agent with unrestricted
@@ -1089,6 +1120,98 @@ export interface FillVaultItemOperationResult {
   type: 'fill';
 }
 
+/**
+ * A ready Kernel card retains its encrypted network token and one-time code for
+ * the fill operation until the item's expires_at. Fill and submit checkout before
+ * then. Visa cards can be enrolled, but Visa purchases are not yet supported and
+ * authorize returns 400; supported Mastercard purchases need no cardholder
+ * approval. masks.last4 is the enrolled card's last four digits; masks.token_last4
+ * is the network token's last four digits shown to the merchant. Kernel cards do
+ * not expose aliases or support egress substitution. Kernel does not observe
+ * whether the merchant charged the card.
+ */
+export interface KernelCardState {
+  provider: 'kernel';
+
+  /**
+   * recovery_required means issuing the one-time code has an unresolved outcome.
+   * Kernel never issues another code for the item automatically, and the item cannot
+   * be deleted or replaced until the original attempt is reconciled with support.
+   * When status_reason says the provider refused retrieval before acceptance, no
+   * code was issued and a later read retries.
+   */
+  status:
+    | 'requested'
+    | 'pending_authorization'
+    | 'ready'
+    | 'consumed'
+    | 'expired'
+    | 'declined'
+    | 'recovery_required';
+
+  /**
+   * Informational registrable domain. Fill is locked to merchant_url's exact origin.
+   */
+  domains?: Array<string>;
+
+  masks?: KernelCardState.Masks;
+
+  status_reason?: string;
+}
+
+export namespace KernelCardState {
+  export interface Masks {
+    brand?: string;
+
+    last4?: string;
+
+    /**
+     * Last four digits of the network token presented to the merchant.
+     */
+    token_last4?: string;
+
+    [k: string]: string | undefined;
+  }
+}
+
+/**
+ * One live purchase with a Kernel-enrolled card. Authorization obtains an agentic
+ * network token number, expiry and one-time 3-digit code. They are stored
+ * encrypted for the fill operation, which types them only on merchant_url's
+ * origin; the merchant's own checkout submits the payment. The one-time code is
+ * valid until the item's expires_at; fill and submit checkout before then. Visa
+ * cards can be enrolled, but Visa purchases are not yet supported: authorize
+ * returns 400. Supported Mastercard purchases need no cardholder approval. Card
+ * updates are not supported; delete and create a new item instead.
+ */
+export interface KernelCardVaultItemSpec {
+  /**
+   * Integer amount in minor currency units (at most 50000), bound to the one-time
+   * code.
+   */
+  amount: number;
+
+  /**
+   * ISO 4217 code. Supported: aud, brl, cad, chf, czk, dkk, eur, gbp, hkd, inr, jpy,
+   * krw, mxn, nok, nzd, pln, sek, sgd, usd, zar.
+   */
+  currency: string;
+
+  merchant_name: string;
+
+  /**
+   * Merchant checkout URL. Fill is allowed only on this URL's origin.
+   */
+  merchant_url: string;
+
+  provider: 'kernel';
+
+  /**
+   * Key of the Kernel wallet item whose enrolled card pays.
+   */
+  wallet: string;
+}
+
 export interface KernelCredentialVaultItemSpec {
   /**
    * Ordered field definitions rendered in this order by credential collection forms.
@@ -1145,6 +1268,122 @@ export interface KernelCredentialVaultItemState {
   status: 'pending_collection' | 'ready';
 }
 
+export interface KernelWalletState {
+  provider: 'kernel';
+
+  /**
+   * pending_authorization asks the cardholder to use the card_enrollment action.
+   * connected is ready for supported purchases. reconnect_required asks the
+   * cardholder to use a new card_enrollment action after an uncertain enrollment was
+   * safely removed. degraded means the enrollment outcome is unknown and the wallet
+   * must be deleted before adding another card.
+   */
+  status: 'pending_authorization' | 'connected' | 'reconnect_required' | 'degraded';
+
+  status_reason?: string;
+}
+
+/**
+ * One card Kernel enrolls for Visa or Mastercard agentic network tokens using
+ * Kernel-managed credentials. Creation returns a card_enrollment action: the
+ * cardholder enters the card and their email on a Kernel-hosted page, then Kernel
+ * enrolls the securely stored card. The card number never reaches Kernel. The
+ * connected wallet's payment_methods expansion lists the enrolled card. Visa cards
+ * can be enrolled, but Visa purchases are not yet supported: authorize
+ * returns 400.
+ */
+export interface KernelWalletVaultItemSpec {
+  provider: 'kernel';
+}
+
+export interface ManagedAuthCredentialVaultField {
+  /**
+   * Text, email, and password have form inputs; totp does not and is omitted from
+   * both Kernel-hosted and customer React forms. Password and totp must be
+   * sensitive. A totp value is an RFC 4648 Base32 generator seed (case-insensitive,
+   * optional trailing padding), not an otpauth URI or current code. Reject invalid
+   * or empty decoded seeds. Browser fill generates an RFC 6238 code at execution
+   * time using HMAC-SHA1, 6 digits, and a 30-second period. Preserve leading zeros;
+   * never fill the seed. Custom algorithms, digits, periods, and form enrollment are
+   * unsupported.
+   */
+  type: CredentialVaultFieldType;
+}
+
+export interface ManagedAuthCredentialVaultItemSpec {
+  /**
+   * ID of the managed auth connection whose saved credential this item reads. List
+   * connections with `GET /auth/connections`.
+   */
+  connection_id: string;
+
+  provider: 'managed_auth';
+
+  /**
+   * Display text supplied when the item was created. Omitted when none was given.
+   */
+  description?: string;
+}
+
+/**
+ * A credential backed by a managed auth connection. The item stores no values: it
+ * reads the connection's saved credential at fill time, so updates made through
+ * managed auth apply immediately. The connection must be in the vault's project
+ * and hold a saved Kernel credential. The check is the saved credential, not
+ * connection status: a connection that needs re-authentication qualifies, and an
+ * authenticated one without a saved credential does not. Returns 404 for an
+ * unknown connection, and 409 when the connection is in another project, has no
+ * saved credential yet, or uses an external credential provider such as 1Password.
+ * No collection form is offered; managed auth collects the login.
+ */
+export interface ManagedAuthCredentialVaultItemSpecInput {
+  /**
+   * ID of the managed auth connection whose saved credential this item reads. List
+   * connections with `GET /auth/connections`.
+   */
+  connection_id: string;
+
+  provider: 'managed_auth';
+
+  /**
+   * Optional display text for the item, such as the site or service name. Set at
+   * creation and cannot be changed later; repeating the request with a different
+   * description returns 409. At most 16 KiB in UTF-8 bytes.
+   */
+  description?: string;
+}
+
+export interface ManagedAuthCredentialVaultItemState {
+  provider: 'managed_auth';
+
+  /**
+   * Items are created ready, which means the connection has a saved Kernel
+   * credential that stores values or a TOTP seed (what has_values or has_totp_secret
+   * report on credentials), not that a login succeeded. Unavailable means it no
+   * longer does; such items advertise no operations.
+   */
+  status: 'ready' | 'unavailable';
+
+  /**
+   * One entry per non-empty value on the connection's saved credential, keyed by the
+   * field name to use in fill bindings. Included on single-item responses (create
+   * and get) and omitted from list responses, like `value_keys` on credentials.
+   * Empty when unavailable or when every stored value is empty. A stored value named
+   * totp_secret is never listed or filled. Values are never returned. A totp entry
+   * is present when the credential has a TOTP seed; fill writes a generated code for
+   * it. Entries follow the connection's credential.
+   */
+  fields?: { [key: string]: ManagedAuthCredentialVaultField };
+
+  /**
+   * Present when status is unavailable. connection_not_found means the connection
+   * was deleted. no_credential means the connection's credential was deleted or
+   * emptied after the item was created. external_credential means the connection was
+   * moved to an external credential provider.
+   */
+  status_reason?: 'connection_not_found' | 'no_credential' | 'external_credential';
+}
+
 export interface OnePasswordCredentialAccountSpec {
   authorization: OnePasswordCredentialAccountSpec.Authorization;
 
@@ -1660,8 +1899,9 @@ export interface VaultCheckoutContext {
 
 export interface VaultFillField {
   /**
-   * A declared credential field name or a supported card field. Unset credential
-   * fields cannot be filled.
+   * A credential field name from the item's declared fields (Kernel) or state.fields
+   * from a single-item read (managed auth), or a supported card field. Unset
+   * credential fields cannot be filled.
    */
   field: string;
 
@@ -2156,7 +2396,8 @@ export interface VaultWebmcpBinding {
  */
 export type WalletVaultItemSpec =
   | WalletVaultItemSpec.LinkWalletVaultItemSpec
-  | WalletVaultItemSpec.AgentCardWalletVaultItemSpec;
+  | WalletVaultItemSpec.AgentCardWalletVaultItemSpec
+  | KernelWalletVaultItemSpec;
 
 export namespace WalletVaultItemSpec {
   export interface LinkWalletVaultItemSpec {
@@ -2238,7 +2479,8 @@ export namespace WalletVaultItemSpec {
 
 export type WalletVaultItemState =
   | WalletVaultItemState.LinkWalletState
-  | WalletVaultItemState.AgentCardWalletState;
+  | WalletVaultItemState.AgentCardWalletState
+  | KernelWalletState;
 
 export namespace WalletVaultItemState {
   export interface LinkWalletState {
@@ -2363,7 +2605,8 @@ export interface ItemRetrieveParams {
    * authorization, approval, or credential collection. Return the current item when
    * ready or when the wait elapses. This does not wait for edits to an already-ready
    * credential; poll GET without wait and compare version to observe changes after
-   * collect.
+   * collect. Managed auth credentials are created ready, so wait returns
+   * immediately.
    */
   wait?: number;
 }
@@ -2730,7 +2973,8 @@ export declare namespace ItemUpsertParams {
      */
     spec:
       | WalletVaultItemRequest.LinkWalletVaultItemRequestSpec
-      | WalletVaultItemRequest.AgentCardWalletVaultItemSpec;
+      | WalletVaultItemRequest.AgentCardWalletVaultItemSpec
+      | KernelWalletVaultItemSpec;
 
     /**
      * Body param
@@ -2964,9 +3208,17 @@ export declare namespace Items {
     type CredentialVaultItemUpdateRequest as CredentialVaultItemUpdateRequest,
     type FillVaultItemOperationRequest as FillVaultItemOperationRequest,
     type FillVaultItemOperationResult as FillVaultItemOperationResult,
+    type KernelCardState as KernelCardState,
+    type KernelCardVaultItemSpec as KernelCardVaultItemSpec,
     type KernelCredentialVaultItemSpec as KernelCredentialVaultItemSpec,
     type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput,
     type KernelCredentialVaultItemState as KernelCredentialVaultItemState,
+    type KernelWalletState as KernelWalletState,
+    type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec,
+    type ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField,
+    type ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec,
+    type ManagedAuthCredentialVaultItemSpecInput as ManagedAuthCredentialVaultItemSpecInput,
+    type ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState,
     type OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec,
     type OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
     type OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec,

package/src/resources/vaults/vaults.ts

@@ -36,9 +36,17 @@ import {
   ItemUpdateParams,
   ItemUpsertParams,
   Items,
+  KernelCardState,
+  KernelCardVaultItemSpec,
   KernelCredentialVaultItemSpec,
   KernelCredentialVaultItemSpecInput,
   KernelCredentialVaultItemState,
+  KernelWalletState,
+  KernelWalletVaultItemSpec,
+  ManagedAuthCredentialVaultField,
+  ManagedAuthCredentialVaultItemSpec,
+  ManagedAuthCredentialVaultItemSpecInput,
+  ManagedAuthCredentialVaultItemState,
   OnePasswordCredentialAccountSpec,
   OnePasswordCredentialAccountState,
   OnePasswordCredentialVaultItemSpec,
@@ -106,9 +114,11 @@ export class Vaults extends APIResource {
   }
 
   /**
-   * Unresolved payment operations block deletion. Reconcile the original attempt
-   * with the provider or support first; deleting or recreating an item is not proof
-   * that a payment did not occur.
+   * Unresolved payment operations block deletion. Deleting a connected Kernel wallet
+   * first blocks new payments on it, then removes its enrolled card. If that fails,
+   * the wallet is kept and keeps refusing payments; retry the deletion. Reconcile
+   * the original attempt with the provider or support first; deleting or recreating
+   * an item is not proof that a payment did not occur.
    *
    * @example
    * ```ts
@@ -154,7 +164,12 @@ export interface Vault {
   updated_at: string;
 }
 
-export interface VaultListParams extends OffsetPaginationParams {}
+export interface VaultListParams extends OffsetPaginationParams {
+  /**
+   * Case-insensitive substring match against vault name. IDs match by exact value.
+   */
+  query?: string;
+}
 
 export interface VaultUpsertParams {
   /**
@@ -199,9 +214,17 @@ export declare namespace Vaults {
     type CredentialVaultItemUpdateRequest as CredentialVaultItemUpdateRequest,
     type FillVaultItemOperationRequest as FillVaultItemOperationRequest,
     type FillVaultItemOperationResult as FillVaultItemOperationResult,
+    type KernelCardState as KernelCardState,
+    type KernelCardVaultItemSpec as KernelCardVaultItemSpec,
     type KernelCredentialVaultItemSpec as KernelCredentialVaultItemSpec,
     type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput,
     type KernelCredentialVaultItemState as KernelCredentialVaultItemState,
+    type KernelWalletState as KernelWalletState,
+    type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec,
+    type ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField,
+    type ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec,
+    type ManagedAuthCredentialVaultItemSpecInput as ManagedAuthCredentialVaultItemSpecInput,
+    type ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState,
     type OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec,
     type OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
     type OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec,

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.117.0'; // x-release-please-version
+export const VERSION = '0.119.0'; // x-release-please-version

package/version.d.mts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.117.0";
+export declare const VERSION = "0.119.0";
 //# sourceMappingURL=version.d.mts.map

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.117.0";
+export declare const VERSION = "0.119.0";
 //# sourceMappingURL=version.d.ts.map

package/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = '0.117.0'; // x-release-please-version
+exports.VERSION = '0.119.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/version.mjs

@@ -1,2 +1,2 @@
-export const VERSION = '0.117.0'; // x-release-please-version
+export const VERSION = '0.119.0'; // x-release-please-version
 //# sourceMappingURL=version.mjs.map