@onkernel/sdk 0.118.0 → 0.120.0

package/src/resources/browsers/telemetry.ts

@@ -4325,12 +4325,13 @@ export namespace BrowserPlatformAPICallEvent {
 
 /**
  * A branded proxy-layer failure observed by the browser. Emitted when the metro
- * egress host-proxy serves a branded 5xx error page whose response carries the
- * X-Kernel-Proxy-Error header. Low-volume and carries a typed code. Its value is
- * per-session and per-URL attribution for sessions that already capture the
- * network stream: proxy failures are only observable while the CDP network
- * collector is running, so this is an opt-in refinement of the raw network events
- * rather than a default-on alerting signal.
+ * egress host-proxy serves a branded error page whose response carries the
+ * X-Kernel-Proxy-Error header: a 502 for proxy-layer failures, or a 403 when the
+ * session's network policy blocks the destination. Low-volume and carries a typed
+ * code. Its value is per-session and per-URL attribution for sessions that already
+ * capture the network stream: proxy failures are only observable while the CDP
+ * network collector is running, so this is an opt-in refinement of the raw network
+ * events rather than a default-on alerting signal.
  */
 export interface BrowserProxyErrorEvent {
   category: 'network';
@@ -4369,17 +4370,18 @@ export namespace BrowserProxyErrorEvent {
   export interface Data extends TelemetryAPI.BrowserEventContext {
     /**
      * Proxy-layer error code: the X-Kernel-Proxy-Error response header value from a
-     * branded 5xx error page served by the metro egress host-proxy. Values mirror what
-     * the proxy emits: destination_blocked, destination_route_unavailable,
-     * provider_blacklisted, provider_unreachable, provider_rejected,
-     * origin_tls_timeout, origin_response_incomplete, proxy_unavailable,
-     * restricted_route_unavailable, upstream_timeout, upstream_dns_failure,
-     * upstream_connect_failed. A header value the browser image does not recognize is
-     * reported as unknown, with the header value in raw_code.
+     * branded error page served by the metro egress host-proxy. Values mirror what the
+     * proxy emits: destination_blocked, destination_route_unavailable,
+     * network_policy_denied, provider_blacklisted, provider_unreachable,
+     * provider_rejected, origin_tls_timeout, origin_response_incomplete,
+     * proxy_unavailable, restricted_route_unavailable, upstream_timeout,
+     * upstream_dns_failure, upstream_connect_failed. A header value the browser image
+     * does not recognize is reported as unknown, with the header value in raw_code.
      */
     code:
       | 'destination_blocked'
       | 'destination_route_unavailable'
+      | 'network_policy_denied'
       | 'provider_blacklisted'
       | 'provider_unreachable'
       | 'provider_rejected'
@@ -4398,7 +4400,8 @@ export namespace BrowserProxyErrorEvent {
     request_id: string;
 
     /**
-     * HTTP response status of the branded error page (502).
+     * HTTP response status of the branded error page (502, or 403 for
+     * network_policy_denied).
      */
     status: number;
 

package/src/resources/invocations.ts

@@ -471,7 +471,7 @@ export namespace InvocationListBrowsersResponse {
     /**
      * Geographic region of the browser session. Fixed once the session is created.
      */
-    region: 'us-east' | 'eu-west' | 'ap-southeast';
+    region: 'us-east' | 'us-west' | 'eu-west' | 'ap-southeast';
 
     /**
      * Unique identifier for the browser session

package/src/resources/search/search.ts

@@ -202,7 +202,8 @@ export namespace ProviderTarget {
        */
       export interface Contents {
         /**
-         * Return query-relevant provider excerpts.
+         * Return query-relevant provider excerpts. Defaults to true for Exa search
+         * requests; set false to disable.
          */
         highlights?: boolean;
 
@@ -255,7 +256,8 @@ export namespace ProviderTarget {
       query?: Array<string>;
 
       /**
-       * Provider context size supported by the selected model.
+       * Amount of page content Perplexity extracts per result. Defaults to medium unless
+       * max_tokens or max_tokens_per_page is set.
        */
       search_context_size?: 'low' | 'medium' | 'high';
 

package/src/resources/vaults/index.ts

@@ -33,6 +33,10 @@ export {
   type KernelCredentialVaultItemState,
   type KernelWalletState,
   type KernelWalletVaultItemSpec,
+  type ManagedAuthCredentialVaultField,
+  type ManagedAuthCredentialVaultItemSpec,
+  type ManagedAuthCredentialVaultItemSpecInput,
+  type ManagedAuthCredentialVaultItemState,
   type OnePasswordCredentialAccountSpec,
   type OnePasswordCredentialAccountState,
   type OnePasswordCredentialVaultItemSpec,

package/src/resources/vaults/items.ts

@@ -93,7 +93,8 @@ export class Items extends APIResource {
    * recovery_required whose checkout create response returned no authorization ID
    * may be explicitly abandoned by deleting that card directly; deleting its wallet
    * or vault remains blocked. Deleting or recreating an item is not proof that a
-   * payment did not occur.
+   * payment did not occur. Deleting a managed auth credential item leaves the
+   * connection and its saved credential unchanged.
    *
    * @example
    * ```ts
@@ -185,8 +186,8 @@ export class Items extends APIResource {
    * ```ts
    * const vaultItem = await client.vaults.items.upsert('x', {
    *   id_or_name: 'id_or_name',
-   *   spec: { provider: 'link' },
-   *   type: 'card',
+   *   spec: { provider: 'managed_auth' },
+   *   type: 'credential',
    * });
    * ```
    */
@@ -839,7 +840,8 @@ export interface CredentialVaultItem {
    * Kernel credentials advertise collect and fill when eligible. 1Password
    * credentials advertise 1pw_create_access_request until a request is made,
    * 1pw_access_request_status while its approval is pending, and 1pw_fill after
-   * access is granted.
+   * access is granted. Managed auth credentials advertise fill while ready and
+   * nothing otherwise.
    */
   available_operations: Array<CredentialVaultItem.AvailableOperation>;
 
@@ -864,7 +866,8 @@ export interface CredentialVaultItem {
 
   /**
    * Starts at 1 and increments on PATCH and successful hosted submission, but not
-   * collection-link renewal.
+   * collection-link renewal. Managed auth credentials stay at 1; changes to the
+   * underlying credential are read at fill time and do not change the version.
    */
   version: number;
 
@@ -956,7 +959,9 @@ export namespace CredentialVaultItem {
  * declare fields and may enter pending_collection. 1Password credentials either
  * reference a connected credential_account or store a supplied access token and
  * integration key encrypted on the item. They store no login values or selectors.
- * Repeating the original creation request returns the current item without
+ * Managed auth credentials reference a managed auth connection in the same project
+ * that already has a saved credential, and read it at fill time; they store no
+ * values. Repeating the original creation request returns the current item without
  * overwriting later state. A different request at the same key returns 409.
  */
 export interface CredentialVaultItemRequest {
@@ -976,7 +981,10 @@ export interface CredentialVaultItemRequest {
  * Stored-token credentials omit account and never return access_token or
  * integration_key.
  */
-export type CredentialVaultItemSpec = KernelCredentialVaultItemSpec | OnePasswordCredentialVaultItemSpec;
+export type CredentialVaultItemSpec =
+  | KernelCredentialVaultItemSpec
+  | OnePasswordCredentialVaultItemSpec
+  | ManagedAuthCredentialVaultItemSpec;
 
 /**
  * Credential fields are for login and other non-payment credentials. Do not store,
@@ -987,7 +995,8 @@ export type CredentialVaultItemSpec = KernelCredentialVaultItemSpec | OnePasswor
  */
 export type CredentialVaultItemSpecInput =
   | KernelCredentialVaultItemSpecInput
-  | OnePasswordCredentialVaultItemSpecInput;
+  | OnePasswordCredentialVaultItemSpecInput
+  | ManagedAuthCredentialVaultItemSpecInput;
 
 export interface CredentialVaultItemSpecUpdate {
   /**
@@ -1000,7 +1009,10 @@ export interface CredentialVaultItemSpecUpdate {
   fields?: { [key: string]: CredentialVaultFieldUpdate };
 }
 
-export type CredentialVaultItemState = KernelCredentialVaultItemState | OnePasswordCredentialVaultItemState;
+export type CredentialVaultItemState =
+  | KernelCredentialVaultItemState
+  | OnePasswordCredentialVaultItemState
+  | ManagedAuthCredentialVaultItemState;
 
 /**
  * Atomically update description and selected values. Omitted properties are
@@ -1010,7 +1022,8 @@ export type CredentialVaultItemState = KernelCredentialVaultItemState | OnePassw
  * invalidates outstanding Kernel-hosted collection sessions. If required values
  * remain missing, return pending_collection and a fresh collection action.
  * Otherwise return ready without an action; collect can open the form again
- * without clearing values. Customer URLs have no Kernel-managed expiry.
+ * without clearing values. Customer URLs have no Kernel-managed expiry. 1Password
+ * and managed auth credentials return 409.
  */
 export interface CredentialVaultItemUpdateRequest {
   spec: CredentialVaultItemSpecUpdate;
@@ -1110,22 +1123,24 @@ export interface FillVaultItemOperationResult {
 /**
  * A ready Kernel card retains its encrypted network token and one-time code for
  * the fill operation until the item's expires_at. Fill and submit checkout before
- * then. Visa cards can be enrolled, but Visa purchases are not yet supported and
- * authorize returns 400; supported Mastercard purchases need no cardholder
- * approval. masks.last4 is the enrolled card's last four digits; masks.token_last4
- * is the network token's last four digits shown to the merchant. Kernel cards do
- * not expose aliases or support egress substitution. Kernel does not observe
- * whether the merchant charged the card.
+ * then. Visa purchases require a spend_approval action before the code is issued;
+ * Mastercard purchases need no hosted approval. masks.last4 is the enrolled card's
+ * last four digits; masks.token_last4 is the network token's last four digits
+ * shown to the merchant. Kernel cards do not expose aliases or support egress
+ * substitution. Kernel does not observe whether the merchant charged the card.
  */
 export interface KernelCardState {
   provider: 'kernel';
 
   /**
-   * recovery_required means issuing the one-time code has an unresolved outcome.
-   * Kernel never issues another code for the item automatically, and the item cannot
-   * be deleted or replaced until the original attempt is reconciled with support.
-   * When status_reason says the provider refused retrieval before acceptance, no
-   * code was issued and a later read retries.
+   * pending_authorization on a Visa purchase waits for the cardholder to approve it
+   * through the spend_approval action; an unused link expires after 30 minutes.
+   * recovery_required means approving the purchase or issuing the one-time code has
+   * an unresolved outcome. Kernel never approves again or issues another code for
+   * the item automatically, and the item cannot be deleted or replaced until the
+   * original attempt is reconciled with support. When status_reason says the
+   * provider refused retrieval before acceptance, no code was issued and a later
+   * read retries. declined means the card network refused to issue a code.
    */
   status:
     | 'requested'
@@ -1166,10 +1181,12 @@ export namespace KernelCardState {
  * network token number, expiry and one-time 3-digit code. They are stored
  * encrypted for the fill operation, which types them only on merchant_url's
  * origin; the merchant's own checkout submits the payment. The one-time code is
- * valid until the item's expires_at; fill and submit checkout before then. Visa
- * cards can be enrolled, but Visa purchases are not yet supported: authorize
- * returns 400. Supported Mastercard purchases need no cardholder approval. Card
- * updates are not supported; delete and create a new item instead.
+ * valid until the item's expires_at; fill and submit checkout before then.
+ * Mastercard purchases need no cardholder approval. A Visa purchase returns a
+ * spend_approval action: the cardholder approves it with a Visa passkey, and
+ * Kernel registers a Visa intent for one transaction up to the amount before
+ * issuing the code. Card updates are not supported; delete and create a new item
+ * instead.
  */
 export interface KernelCardVaultItemSpec {
   /**
@@ -1197,6 +1214,12 @@ export interface KernelCardVaultItemSpec {
    * Key of the Kernel wallet item whose enrolled card pays.
    */
   wallet: string;
+
+  /**
+   * The merchant's ISO 3166-1 alpha-2 country code. Required for Visa cards, whose
+   * one-time code is issued for the merchant's country.
+   */
+  merchant_country?: string;
 }
 
 export interface KernelCredentialVaultItemSpec {
@@ -1260,10 +1283,11 @@ export interface KernelWalletState {
 
   /**
    * pending_authorization asks the cardholder to use the card_enrollment action.
-   * connected is ready for supported purchases. reconnect_required asks the
-   * cardholder to use a new card_enrollment action after an uncertain enrollment was
-   * safely removed. degraded means the enrollment outcome is unknown and the wallet
-   * must be deleted before adding another card.
+   * connected means the card is stored; it can pay once payment_methods reports
+   * capabilities.single_use_card.eligible. reconnect_required asks the cardholder to
+   * use a new card_enrollment action after an uncertain enrollment was safely
+   * removed. degraded means the enrollment outcome is unknown and the wallet must be
+   * deleted before adding another card.
    */
   status: 'pending_authorization' | 'connected' | 'reconnect_required' | 'degraded';
 
@@ -1271,18 +1295,109 @@ export interface KernelWalletState {
 }
 
 /**
- * One card Kernel enrolls for Visa or Mastercard agentic network tokens using
- * Kernel-managed credentials. Creation returns a card_enrollment action: the
- * cardholder enters the card and their email on a Kernel-hosted page, then Kernel
- * enrolls the securely stored card. The card number never reaches Kernel. The
- * connected wallet's payment_methods expansion lists the enrolled card. Visa cards
- * can be enrolled, but Visa purchases are not yet supported: authorize
- * returns 400.
+ * One card stored with Kernel-managed credentials. Creation returns a
+ * card*enrollment action: the cardholder enters the card and their email on a
+ * Kernel-hosted page, and the wallet connects once the card is stored. Kernel then
+ * enrolls it for an agentic network token when the issuer supports it. The card
+ * number never reaches Kernel. The connected wallet's payment_methods expansion
+ * lists the card; capabilities.single_use_card.eligible is false, with a
+ * network_token*\* reason, until the card has a network token, and authorize
+ * returns 400 for such a card. Visa purchases require the cardholder to complete a
+ * spend_approval action before Kernel issues a one-time code; Mastercard purchases
+ * need no hosted approval.
  */
 export interface KernelWalletVaultItemSpec {
   provider: 'kernel';
 }
 
+export interface ManagedAuthCredentialVaultField {
+  /**
+   * Text, email, and password have form inputs; totp does not and is omitted from
+   * both Kernel-hosted and customer React forms. Password and totp must be
+   * sensitive. A totp value is an RFC 4648 Base32 generator seed (case-insensitive,
+   * optional trailing padding), not an otpauth URI or current code. Reject invalid
+   * or empty decoded seeds. Browser fill generates an RFC 6238 code at execution
+   * time using HMAC-SHA1, 6 digits, and a 30-second period. Preserve leading zeros;
+   * never fill the seed. Custom algorithms, digits, periods, and form enrollment are
+   * unsupported.
+   */
+  type: CredentialVaultFieldType;
+}
+
+export interface ManagedAuthCredentialVaultItemSpec {
+  /**
+   * ID of the managed auth connection whose saved credential this item reads. List
+   * connections with `GET /auth/connections`.
+   */
+  connection_id: string;
+
+  provider: 'managed_auth';
+
+  /**
+   * Display text supplied when the item was created. Omitted when none was given.
+   */
+  description?: string;
+}
+
+/**
+ * A credential backed by a managed auth connection. The item stores no values: it
+ * reads the connection's saved credential at fill time, so updates made through
+ * managed auth apply immediately. The connection must be in the vault's project
+ * and hold a saved Kernel credential. The check is the saved credential, not
+ * connection status: a connection that needs re-authentication qualifies, and an
+ * authenticated one without a saved credential does not. Returns 404 for an
+ * unknown connection, and 409 when the connection is in another project, has no
+ * saved credential yet, or uses an external credential provider such as 1Password.
+ * No collection form is offered; managed auth collects the login.
+ */
+export interface ManagedAuthCredentialVaultItemSpecInput {
+  /**
+   * ID of the managed auth connection whose saved credential this item reads. List
+   * connections with `GET /auth/connections`.
+   */
+  connection_id: string;
+
+  provider: 'managed_auth';
+
+  /**
+   * Optional display text for the item, such as the site or service name. Set at
+   * creation and cannot be changed later; repeating the request with a different
+   * description returns 409. At most 16 KiB in UTF-8 bytes.
+   */
+  description?: string;
+}
+
+export interface ManagedAuthCredentialVaultItemState {
+  provider: 'managed_auth';
+
+  /**
+   * Items are created ready, which means the connection has a saved Kernel
+   * credential that stores values or a TOTP seed (what has_values or has_totp_secret
+   * report on credentials), not that a login succeeded. Unavailable means it no
+   * longer does; such items advertise no operations.
+   */
+  status: 'ready' | 'unavailable';
+
+  /**
+   * One entry per non-empty value on the connection's saved credential, keyed by the
+   * field name to use in fill bindings. Included on single-item responses (create
+   * and get) and omitted from list responses, like `value_keys` on credentials.
+   * Empty when unavailable or when every stored value is empty. A stored value named
+   * totp_secret is never listed or filled. Values are never returned. A totp entry
+   * is present when the credential has a TOTP seed; fill writes a generated code for
+   * it. Entries follow the connection's credential.
+   */
+  fields?: { [key: string]: ManagedAuthCredentialVaultField };
+
+  /**
+   * Present when status is unavailable. connection_not_found means the connection
+   * was deleted. no_credential means the connection's credential was deleted or
+   * emptied after the item was created. external_credential means the connection was
+   * moved to an external credential provider.
+   */
+  status_reason?: 'connection_not_found' | 'no_credential' | 'external_credential';
+}
+
 export interface OnePasswordCredentialAccountSpec {
   authorization: OnePasswordCredentialAccountSpec.Authorization;
 
@@ -1798,8 +1913,9 @@ export interface VaultCheckoutContext {
 
 export interface VaultFillField {
   /**
-   * A declared credential field name or a supported card field. Unset credential
-   * fields cannot be filled.
+   * A credential field name from the item's declared fields (Kernel) or state.fields
+   * from a single-item read (managed auth), or a supported card field. Unset
+   * credential fields cannot be filled.
    */
   field: string;
 
@@ -2503,7 +2619,8 @@ export interface ItemRetrieveParams {
    * authorization, approval, or credential collection. Return the current item when
    * ready or when the wait elapses. This does not wait for edits to an already-ready
    * credential; poll GET without wait and compare version to observe changes after
-   * collect.
+   * collect. Managed auth credentials are created ready, so wait returns
+   * immediately.
    */
   wait?: number;
 }
@@ -3112,6 +3229,10 @@ export declare namespace Items {
     type KernelCredentialVaultItemState as KernelCredentialVaultItemState,
     type KernelWalletState as KernelWalletState,
     type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec,
+    type ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField,
+    type ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec,
+    type ManagedAuthCredentialVaultItemSpecInput as ManagedAuthCredentialVaultItemSpecInput,
+    type ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState,
     type OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec,
     type OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
     type OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec,

package/src/resources/vaults/vaults.ts

@@ -43,6 +43,10 @@ import {
   KernelCredentialVaultItemState,
   KernelWalletState,
   KernelWalletVaultItemSpec,
+  ManagedAuthCredentialVaultField,
+  ManagedAuthCredentialVaultItemSpec,
+  ManagedAuthCredentialVaultItemSpecInput,
+  ManagedAuthCredentialVaultItemState,
   OnePasswordCredentialAccountSpec,
   OnePasswordCredentialAccountState,
   OnePasswordCredentialVaultItemSpec,
@@ -217,6 +221,10 @@ export declare namespace Vaults {
     type KernelCredentialVaultItemState as KernelCredentialVaultItemState,
     type KernelWalletState as KernelWalletState,
     type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec,
+    type ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField,
+    type ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec,
+    type ManagedAuthCredentialVaultItemSpecInput as ManagedAuthCredentialVaultItemSpecInput,
+    type ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState,
     type OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec,
     type OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
     type OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec,

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.118.0'; // x-release-please-version
+export const VERSION = '0.120.0'; // x-release-please-version

package/version.d.mts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.118.0";
+export declare const VERSION = "0.120.0";
 //# sourceMappingURL=version.d.mts.map

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.118.0";
+export declare const VERSION = "0.120.0";
 //# sourceMappingURL=version.d.ts.map

package/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = '0.118.0'; // x-release-please-version
+exports.VERSION = '0.120.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/version.mjs

@@ -1,2 +1,2 @@
-export const VERSION = '0.118.0'; // x-release-please-version
+export const VERSION = '0.120.0'; // x-release-please-version
 //# sourceMappingURL=version.mjs.map