@onkernel/sdk 0.120.0 → 0.122.0

package/src/resources/vaults/items.ts

@@ -146,8 +146,8 @@ export class Items extends APIResource {
    * return 400 (invalid request or targets), 403 (access or destination denied), 404
    * (resource not found), or 409 (item or browser not ready). Once writing starts,
    * known partial failures and indeterminate field outcomes return 200 with status
-   * `failed` or `unknown`, not an automatic-retry signal. A transport error may
-   * leave the outcome unknown; do not automatically retry.
+   * `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+   * a failure, an `unknown` outcome, or a transport error.
    *
    * @example
    * ```ts
@@ -769,6 +769,22 @@ export interface CredentialVaultFieldInput {
    */
   type: CredentialVaultFieldType;
 
+  /**
+   * Alternative to value for custom credential collection web apps. Use this only if
+   * you run your own credential collection web app and want values encrypted in the
+   * browser, sent to your backend still encrypted, and forwarded to Kernel's API
+   * still encrypted. In every other case, including server-side code that already
+   * holds the plaintext, use value. The field's value encrypted client-side as a
+   * compact JWE with alg ECDH-ES and enc A256GCM to the key from GET
+   * /vaults/{id_or_name}/encryption_key, with that key's kid in the protected
+   * header. Compression is not supported. The decrypted value follows the same rules
+   * as value, including that an empty string clears the field on update. A kid that
+   * is not this vault's key returns 400 encryption_key_mismatch; fetch the key again
+   * and re-encrypt. Other malformed or undecryptable values return 400
+   * invalid_request. The whole request body is limited to 128 KiB.
+   */
+  encrypted_value?: string;
+
   /**
    * Optional human-readable display label. It is returned as non-secret metadata and
    * never affects value keys, updates, or browser fills. Use single-line, trimmed
@@ -791,7 +807,9 @@ export interface CredentialVaultFieldInput {
   /**
    * Optional initial value satisfying the declared type, at most 16 KiB in UTF-8
    * bytes. Omit to leave unset; null and empty strings are rejected on creation.
-   * Sensitive values are encrypted and never copied into the returned spec.
+   * Sensitive values are encrypted and never copied into the returned spec. Use this
+   * unless your own credential collection web app encrypts values in the browser;
+   * mutually exclusive with encrypted_value.
    */
   value?: string;
 }
@@ -819,7 +837,28 @@ export interface CredentialVaultFieldState {
  */
 export type CredentialVaultFieldType = 'text' | 'email' | 'password' | 'totp';
 
+/**
+ * Set exactly one of value or encrypted_value. Use value unless the update comes
+ * from your own credential collection web app that encrypts values in the browser;
+ * see encrypted_value.
+ */
 export interface CredentialVaultFieldUpdate {
+  /**
+   * Alternative to value for custom credential collection web apps. Use this only if
+   * you run your own credential collection web app and want values encrypted in the
+   * browser, sent to your backend still encrypted, and forwarded to Kernel's API
+   * still encrypted. In every other case, including server-side code that already
+   * holds the plaintext, use value. The field's value encrypted client-side as a
+   * compact JWE with alg ECDH-ES and enc A256GCM to the key from GET
+   * /vaults/{id_or_name}/encryption_key, with that key's kid in the protected
+   * header. Compression is not supported. The decrypted value follows the same rules
+   * as value, including that an empty string clears the field on update. A kid that
+   * is not this vault's key returns 400 encryption_key_mismatch; fetch the key again
+   * and re-encrypt. Other malformed or undecryptable values return 400
+   * invalid_request. The whole request body is limited to 128 KiB.
+   */
+  encrypted_value?: string;
+
   /**
    * Replacement value (at most 16 KiB in UTF-8 bytes), or null or an empty string to
    * immediately clear the stored value. Clearing a required form-supported field
@@ -828,7 +867,7 @@ export interface CredentialVaultFieldUpdate {
    * seed, never a current code. Clearing a required totp field returns 400 because
    * it cannot be collected in a form.
    */
-  value: string | null;
+  value?: string | null;
 }
 
 export interface CredentialVaultItem {
@@ -1067,8 +1106,10 @@ export interface CredentialVaultItemUpdateRequest {
  * atomic: previously filled fields are not rolled back. Never submit the form or
  * click buttons, though input/change events may trigger site behavior. Link and
  * Kernel cards use fill for browser checkout and do not expose aliases or support
- * egress substitution. Do not automatically retry a failed or indeterminate
- * operation.
+ * egress substitution. Fill does not consume the item, so a failed or
+ * indeterminate fill is safe to retry; a retry rewrites the same fields. A retry
+ * right after an indeterminate fill may wait up to 15 seconds for the earlier
+ * attempt's browser lock to expire.
  *
  * Secret values are never returned or included in operation logs, traces, audit
  * events, or error details. This does not prevent an agent with unrestricted
@@ -1768,17 +1809,11 @@ export interface OnePasswordRecoverVaultItemOperationRequest {
 
 /**
  * Request access to login entries in the end-user's own, non-shared 1Password
- * vault through the browser extension, auto-loaded into the browser. The end-user
- * approves access in the 1Password app. Shared-vault items and passkeys are not
- * supported. Per-entry reason and keywords overrides are only supported for a
- * single login entry.
+ * vault. No browser is needed; the end-user approves access in the 1Password app.
+ * Shared-vault items and passkeys are not supported. Per-entry reason and keywords
+ * overrides are only supported for a single login entry.
  */
 export interface OnePasswordRequestAccessVaultItemOperationRequest {
-  /**
-   * Kernel browser session used to invoke the extension.
-   */
-  browser_id: string;
-
   type: '1pw_create_access_request';
 
   goal?: string;
@@ -2801,11 +2836,6 @@ export declare namespace ItemPerformOperationParams {
      */
     id_or_name: string;
 
-    /**
-     * Body param: Kernel browser session used to invoke the extension.
-     */
-    browser_id: string;
-
     /**
      * Body param
      */
@@ -2833,11 +2863,6 @@ export declare namespace ItemPerformOperationParams {
      */
     id_or_name: string;
 
-    /**
-     * Body param
-     */
-    browser_id: string;
-
     /**
      * Body param
      */

package/src/resources/vaults/vaults.ts

@@ -132,6 +132,26 @@ export class Vaults extends APIResource {
     });
   }
 
+  /**
+   * Returns the public key that custom credential collection web apps use to encrypt
+   * values in the browser. Use this only if you run your own credential collection
+   * web app and want values encrypted in the browser, sent to your backend still
+   * encrypted, and forwarded to Kernel's API still encrypted. In every other case,
+   * including server-side code that already holds the plaintext, use value. The page
+   * encrypts each value to this key, your backend forwards the ciphertext unchanged
+   * as encrypted_value when creating or updating a credential item in this vault,
+   * and Kernel decrypts it.
+   *
+   * @example
+   * ```ts
+   * const vaultEncryptionKey =
+   *   await client.vaults.retrieveEncryptionKey('id_or_name');
+   * ```
+   */
+  retrieveEncryptionKey(idOrName: string, options?: RequestOptions): APIPromise<VaultEncryptionKey> {
+    return this._client.get(path`/vaults/${idOrName}/encryption_key`, options);
+  }
+
   /**
    * Free organizations can store up to 3 non-deleted vaults across all projects.
    * Paid plans and active trials have no vault cap. Retrieving an existing vault by
@@ -164,6 +184,58 @@ export interface Vault {
   updated_at: string;
 }
 
+/**
+ * Public key for encrypted_value on credential fields. Use this only if you run
+ * your own credential collection web app and want values encrypted in the browser,
+ * sent to your backend still encrypted, and forwarded to Kernel's API still
+ * encrypted. In every other case, including server-side code that already holds
+ * the plaintext, use value. Each vault has its own key; a value encrypted for one
+ * vault is rejected by every other vault. The key is created on first request and
+ * stays the same for the vault's lifetime, so it may be cached.
+ */
+export interface VaultEncryptionKey {
+  /**
+   * JWE key management algorithm.
+   */
+  alg: 'ECDH-ES';
+
+  /**
+   * JWE content encryption algorithm.
+   */
+  enc: 'A256GCM';
+
+  /**
+   * P-256 public key in JWK form.
+   */
+  jwk: VaultEncryptionKey.Jwk;
+
+  /**
+   * Key ID. Set it as the kid protected header of every encrypted_value.
+   */
+  kid: string;
+}
+
+export namespace VaultEncryptionKey {
+  /**
+   * P-256 public key in JWK form.
+   */
+  export interface Jwk {
+    crv: 'P-256';
+
+    kty: 'EC';
+
+    /**
+     * Base64url-encoded x coordinate.
+     */
+    x: string;
+
+    /**
+     * Base64url-encoded y coordinate.
+     */
+    y: string;
+  }
+}
+
 export interface VaultListParams extends OffsetPaginationParams {
   /**
    * Case-insensitive substring match against vault name. IDs match by exact value.
@@ -183,6 +255,7 @@ Vaults.Items = Items;
 export declare namespace Vaults {
   export {
     type Vault as Vault,
+    type VaultEncryptionKey as VaultEncryptionKey,
     type VaultsOffsetPagination as VaultsOffsetPagination,
     type VaultListParams as VaultListParams,
     type VaultUpsertParams as VaultUpsertParams,

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.120.0'; // x-release-please-version
+export const VERSION = '0.122.0'; // x-release-please-version

package/version.d.mts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.120.0";
+export declare const VERSION = "0.122.0";
 //# sourceMappingURL=version.d.mts.map

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.120.0";
+export declare const VERSION = "0.122.0";
 //# sourceMappingURL=version.d.ts.map

package/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = '0.120.0'; // x-release-please-version
+exports.VERSION = '0.122.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/version.mjs

@@ -1,2 +1,2 @@
-export const VERSION = '0.120.0'; // x-release-please-version
+export const VERSION = '0.122.0'; // x-release-please-version
 //# sourceMappingURL=version.mjs.map