kernel 0.115.0__tar.gz → 0.116.0__tar.gz

kernel-0.116.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.116.0"
+}

{kernel-0.115.0 → kernel-0.116.0}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.116.0](https://github.com/kernel/kernel-python-sdk/compare/v0.115.0...v0.116.0) (2026-10-01)
+
+
+### Features
+
+* chore(stlc): seal custom-code tracking files ([c053ce4](https://github.com/kernel/kernel-python-sdk/commit/c053ce45e5d6bfaa4577310d28b3ecf0a7c16f4e))
+
 ## [0.115.0](https://github.com/kernel/kernel-python-sdk/compare/v0.114.0...v0.115.0) (2026-09-30)
 
 

{kernel-0.115.0 → kernel-0.116.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.115.0
+Version: 0.116.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.115.0 → kernel-0.116.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.115.0"
+version = "0.116.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.115.0 → kernel-0.116.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.115.0"  # x-release-please-version
+__version__ = "0.116.0"  # x-release-please-version

{kernel-0.115.0 → kernel-0.116.0}/src/kernel/resources/credentials.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from typing import Dict, Optional
+from typing_extensions import Literal
 
 import httpx
 
@@ -54,6 +55,9 @@ class CredentialsResource(SyncAPIResource):
         name: str,
         values: Dict[str, str],
         sso_provider: str | Omit = omit,
+        totp_algorithm: Literal["SHA1", "SHA256", "SHA512"] | Omit = omit,
+        totp_digits: int | Omit = omit,
+        totp_period: int | Omit = omit,
         totp_secret: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -77,8 +81,20 @@ class CredentialsResource(SyncAPIResource):
               button, it will be clicked first before filling credential values on the
               identity provider's login page.
 
-          totp_secret: Base32-encoded TOTP secret for generating one-time passwords. Used for automatic
-              2FA during login.
+          totp_algorithm: HMAC algorithm used to generate TOTP codes. Defaults to SHA1 and is ignored when
+              an `otpauth://` URI supplies the algorithm.
+
+          totp_digits: Number of digits in generated TOTP codes. Defaults to 6 and is ignored when an
+              `otpauth://` URI supplies the digit count.
+
+          totp_period: TOTP rotation period in seconds. Defaults to 30 and is ignored when an
+              `otpauth://` URI supplies the period.
+
+          totp_secret: Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+              URI. The range accepts existing shorter seeds and longer seeds regardless of
+              HMAC algorithm; RFC 6238 recommends unpadded base32 lengths of 32/52/103 for
+              SHA1/SHA256/SHA512. Only URI parameters present override the corresponding
+              explicit TOTP fields. Used for automatic 2FA during login.
 
           extra_headers: Send extra headers
 
@@ -96,6 +112,9 @@ class CredentialsResource(SyncAPIResource):
                     "name": name,
                     "values": values,
                     "sso_provider": sso_provider,
+                    "totp_algorithm": totp_algorithm,
+                    "totp_digits": totp_digits,
+                    "totp_period": totp_period,
                     "totp_secret": totp_secret,
                 },
                 credential_create_params.CredentialCreateParams,
@@ -147,6 +166,9 @@ class CredentialsResource(SyncAPIResource):
         name: str | Omit = omit,
         remove_value_keys: SequenceNotStr[str] | Omit = omit,
         sso_provider: Optional[str] | Omit = omit,
+        totp_algorithm: Literal["SHA1", "SHA256", "SHA512"] | Omit = omit,
+        totp_digits: int | Omit = omit,
+        totp_period: int | Omit = omit,
         totp_secret: str | Omit = omit,
         values: Dict[str, str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -170,8 +192,20 @@ class CredentialsResource(SyncAPIResource):
           sso_provider: If set, indicates this credential should be used with the specified SSO
               provider. Set to empty string or null to remove.
 
-          totp_secret: Base32-encoded TOTP secret for generating one-time passwords. Spaces and
-              formatting are automatically normalized. Set to empty string to remove.
+          totp_algorithm: HMAC algorithm used to generate TOTP codes. Requires totp_secret and is ignored
+              when an `otpauth://` URI supplies the algorithm.
+
+          totp_digits: Number of digits in generated TOTP codes. Requires totp_secret and is ignored
+              when an `otpauth://` URI supplies the digit count.
+
+          totp_period: TOTP rotation period in seconds. Requires totp_secret and is ignored when an
+              `otpauth://` URI supplies the period.
+
+          totp_secret: Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+              URI. Only URI parameters present override the corresponding explicit TOTP
+              fields. When rotating a raw secret, omitted fields preserve their existing
+              values; a new URI defaults unspecified fields to SHA1/6/30. Set to empty string
+              to remove the secret and its metadata.
 
           values: Field name to value mapping. Values are merged with existing values (new keys
               added, existing keys overwritten).
@@ -193,6 +227,9 @@ class CredentialsResource(SyncAPIResource):
                     "name": name,
                     "remove_value_keys": remove_value_keys,
                     "sso_provider": sso_provider,
+                    "totp_algorithm": totp_algorithm,
+                    "totp_digits": totp_digits,
+                    "totp_period": totp_period,
                     "totp_secret": totp_secret,
                     "values": values,
                 },
@@ -360,6 +397,9 @@ class AsyncCredentialsResource(AsyncAPIResource):
         name: str,
         values: Dict[str, str],
         sso_provider: str | Omit = omit,
+        totp_algorithm: Literal["SHA1", "SHA256", "SHA512"] | Omit = omit,
+        totp_digits: int | Omit = omit,
+        totp_period: int | Omit = omit,
         totp_secret: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -383,8 +423,20 @@ class AsyncCredentialsResource(AsyncAPIResource):
               button, it will be clicked first before filling credential values on the
               identity provider's login page.
 
-          totp_secret: Base32-encoded TOTP secret for generating one-time passwords. Used for automatic
-              2FA during login.
+          totp_algorithm: HMAC algorithm used to generate TOTP codes. Defaults to SHA1 and is ignored when
+              an `otpauth://` URI supplies the algorithm.
+
+          totp_digits: Number of digits in generated TOTP codes. Defaults to 6 and is ignored when an
+              `otpauth://` URI supplies the digit count.
+
+          totp_period: TOTP rotation period in seconds. Defaults to 30 and is ignored when an
+              `otpauth://` URI supplies the period.
+
+          totp_secret: Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+              URI. The range accepts existing shorter seeds and longer seeds regardless of
+              HMAC algorithm; RFC 6238 recommends unpadded base32 lengths of 32/52/103 for
+              SHA1/SHA256/SHA512. Only URI parameters present override the corresponding
+              explicit TOTP fields. Used for automatic 2FA during login.
 
           extra_headers: Send extra headers
 
@@ -402,6 +454,9 @@ class AsyncCredentialsResource(AsyncAPIResource):
                     "name": name,
                     "values": values,
                     "sso_provider": sso_provider,
+                    "totp_algorithm": totp_algorithm,
+                    "totp_digits": totp_digits,
+                    "totp_period": totp_period,
                     "totp_secret": totp_secret,
                 },
                 credential_create_params.CredentialCreateParams,
@@ -453,6 +508,9 @@ class AsyncCredentialsResource(AsyncAPIResource):
         name: str | Omit = omit,
         remove_value_keys: SequenceNotStr[str] | Omit = omit,
         sso_provider: Optional[str] | Omit = omit,
+        totp_algorithm: Literal["SHA1", "SHA256", "SHA512"] | Omit = omit,
+        totp_digits: int | Omit = omit,
+        totp_period: int | Omit = omit,
         totp_secret: str | Omit = omit,
         values: Dict[str, str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -476,8 +534,20 @@ class AsyncCredentialsResource(AsyncAPIResource):
           sso_provider: If set, indicates this credential should be used with the specified SSO
               provider. Set to empty string or null to remove.
 
-          totp_secret: Base32-encoded TOTP secret for generating one-time passwords. Spaces and
-              formatting are automatically normalized. Set to empty string to remove.
+          totp_algorithm: HMAC algorithm used to generate TOTP codes. Requires totp_secret and is ignored
+              when an `otpauth://` URI supplies the algorithm.
+
+          totp_digits: Number of digits in generated TOTP codes. Requires totp_secret and is ignored
+              when an `otpauth://` URI supplies the digit count.
+
+          totp_period: TOTP rotation period in seconds. Requires totp_secret and is ignored when an
+              `otpauth://` URI supplies the period.
+
+          totp_secret: Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+              URI. Only URI parameters present override the corresponding explicit TOTP
+              fields. When rotating a raw secret, omitted fields preserve their existing
+              values; a new URI defaults unspecified fields to SHA1/6/30. Set to empty string
+              to remove the secret and its metadata.
 
           values: Field name to value mapping. Values are merged with existing values (new keys
               added, existing keys overwritten).
@@ -499,6 +569,9 @@ class AsyncCredentialsResource(AsyncAPIResource):
                     "name": name,
                     "remove_value_keys": remove_value_keys,
                     "sso_provider": sso_provider,
+                    "totp_algorithm": totp_algorithm,
+                    "totp_digits": totp_digits,
+                    "totp_period": totp_period,
                     "totp_secret": totp_secret,
                     "values": values,
                 },

{kernel-0.115.0 → kernel-0.116.0}/src/kernel/types/credential.py

@@ -2,6 +2,7 @@
 
 from typing import List, Optional
 from datetime import datetime
+from typing_extensions import Literal
 
 from .._models import BaseModel
 
@@ -40,8 +41,14 @@ class Credential(BaseModel):
     identity provider's login page.
     """
 
+    totp_algorithm: Optional[Literal["SHA1", "SHA256", "SHA512"]] = None
+    """HMAC algorithm used to generate TOTP codes.
+
+    Defaults to SHA1 for credentials created before this metadata was stored.
+    """
+
     totp_code: Optional[str] = None
-    """Current 6-digit TOTP code.
+    """Current TOTP code.
 
     Only included in create/update responses when totp_secret was just set.
     """
@@ -49,6 +56,18 @@ class Credential(BaseModel):
     totp_code_expires_at: Optional[datetime] = None
     """When the totp_code expires. Only included when totp_code is present."""
 
+    totp_digits: Optional[int] = None
+    """Number of digits in generated TOTP codes.
+
+    Defaults to 6 for credentials created before this metadata was stored.
+    """
+
+    totp_period: Optional[int] = None
+    """TOTP rotation period in seconds.
+
+    Defaults to 30 for credentials created before this metadata was stored.
+    """
+
     value_keys: Optional[List[str]] = None
     """The field names stored in this credential's values (e.g., username, password).
 

kernel-0.116.0/src/kernel/types/credential_create_params.py

@@ -0,0 +1,54 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Dict
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["CredentialCreateParams"]
+
+
+class CredentialCreateParams(TypedDict, total=False):
+    domain: Required[str]
+    """Target domain this credential is for"""
+
+    name: Required[str]
+    """Unique name for the credential within the project"""
+
+    values: Required[Dict[str, str]]
+    """Field name to value mapping (e.g., username, password)"""
+
+    sso_provider: str
+    """
+    If set, indicates this credential should be used with the specified SSO provider
+    (e.g., google, github, microsoft). When the target site has a matching SSO
+    button, it will be clicked first before filling credential values on the
+    identity provider's login page.
+    """
+
+    totp_algorithm: Literal["SHA1", "SHA256", "SHA512"]
+    """HMAC algorithm used to generate TOTP codes.
+
+    Defaults to SHA1 and is ignored when an `otpauth://` URI supplies the algorithm.
+    """
+
+    totp_digits: int
+    """Number of digits in generated TOTP codes.
+
+    Defaults to 6 and is ignored when an `otpauth://` URI supplies the digit count.
+    """
+
+    totp_period: int
+    """TOTP rotation period in seconds.
+
+    Defaults to 30 and is ignored when an `otpauth://` URI supplies the period.
+    """
+
+    totp_secret: str
+    """
+    Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+    URI. The range accepts existing shorter seeds and longer seeds regardless of
+    HMAC algorithm; RFC 6238 recommends unpadded base32 lengths of 32/52/103 for
+    SHA1/SHA256/SHA512. Only URI parameters present override the corresponding
+    explicit TOTP fields. Used for automatic 2FA during login.
+    """

kernel-0.116.0/src/kernel/types/credential_update_params.py

@@ -0,0 +1,66 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Dict, Optional
+from typing_extensions import Literal, TypedDict
+
+from .._types import SequenceNotStr
+
+__all__ = ["CredentialUpdateParams"]
+
+
+class CredentialUpdateParams(TypedDict, total=False):
+    name: str
+    """New name for the credential"""
+
+    remove_value_keys: SequenceNotStr[str]
+    """Field names to remove from the credential's stored values.
+
+    Removals are applied before `values` are merged, so a key present in both is
+    kept with its new value.
+    """
+
+    sso_provider: Optional[str]
+    """If set, indicates this credential should be used with the specified SSO
+    provider.
+
+    Set to empty string or null to remove.
+    """
+
+    totp_algorithm: Literal["SHA1", "SHA256", "SHA512"]
+    """HMAC algorithm used to generate TOTP codes.
+
+    Requires totp_secret and is ignored when an `otpauth://` URI supplies the
+    algorithm.
+    """
+
+    totp_digits: int
+    """Number of digits in generated TOTP codes.
+
+    Requires totp_secret and is ignored when an `otpauth://` URI supplies the digit
+    count.
+    """
+
+    totp_period: int
+    """TOTP rotation period in seconds.
+
+    Requires totp_secret and is ignored when an `otpauth://` URI supplies the
+    period.
+    """
+
+    totp_secret: str
+    """
+    Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+    URI. Only URI parameters present override the corresponding explicit TOTP
+    fields. When rotating a raw secret, omitted fields preserve their existing
+    values; a new URI defaults unspecified fields to SHA1/6/30. Set to empty string
+    to remove the secret and its metadata.
+    """
+
+    values: Dict[str, str]
+    """Field name to value mapping.
+
+    Values are merged with existing values (new keys added, existing keys
+    overwritten).
+    """

{kernel-0.115.0 → kernel-0.116.0}/src/kernel/types/vaults/card_vault_item_spec.py

@@ -96,7 +96,7 @@ class LinkCardVaultItemSpec(BaseModel):
 class AgentCardCardVaultItemSpec(BaseModel):
     """AgentCard reusable live payment card.
 
-    Test-mode card creation is not supported. Each checkout creates an approval-gated authorization for spec.merchant / spec.amount. The card stays ready after each authorization.
+    Test-mode card creation is not supported. Each checkout creates an authorization for spec.merchant / spec.amount that the cardholder approves, unless AgentCard runs it under one of the cardholder's autopilot rules. The card stays ready after each authorization.
     """
 
     amount: int
@@ -119,6 +119,18 @@ class AgentCardCardVaultItemSpec(BaseModel):
     cardholder picks on the approval screen.
     """
 
+    checkout_origin: Optional[str] = None
+    """
+    Origin of the top-level checkout page, such as https://shop.example.com: https,
+    a lowercase host, a port only when it is not 443, and no path. http is accepted
+    only for localhost test pages. Checkouts without a preparation send it to
+    AgentCard, which uses it to match the cardholder's autopilot rules; prepared
+    checkouts send the preparation's merchant_origin instead. Kernel sends the
+    declared value and does not compare it with the page the browser has open.
+    Omitted, those checkouts ask the cardholder to approve. Card updates replace the
+    whole spec, so an update that omits it removes it.
+    """
+
 
 CardVaultItemSpec: TypeAlias = Annotated[
     Union[LinkCardVaultItemSpec, AgentCardCardVaultItemSpec], PropertyInfo(discriminator="provider")

{kernel-0.115.0 → kernel-0.116.0}/src/kernel/types/vaults/card_vault_item_spec_param.py

@@ -95,7 +95,7 @@ class LinkCardVaultItemSpec(TypedDict, total=False):
 class AgentCardCardVaultItemSpec(TypedDict, total=False):
     """AgentCard reusable live payment card.
 
-    Test-mode card creation is not supported. Each checkout creates an approval-gated authorization for spec.merchant / spec.amount. The card stays ready after each authorization.
+    Test-mode card creation is not supported. Each checkout creates an authorization for spec.merchant / spec.amount that the cardholder approves, unless AgentCard runs it under one of the cardholder's autopilot rules. The card stays ready after each authorization.
     """
 
     amount: Required[int]
@@ -118,5 +118,17 @@ class AgentCardCardVaultItemSpec(TypedDict, total=False):
     cardholder picks on the approval screen.
     """
 
+    checkout_origin: str
+    """
+    Origin of the top-level checkout page, such as https://shop.example.com: https,
+    a lowercase host, a port only when it is not 443, and no path. http is accepted
+    only for localhost test pages. Checkouts without a preparation send it to
+    AgentCard, which uses it to match the cardholder's autopilot rules; prepared
+    checkouts send the preparation's merchant_origin instead. Kernel sends the
+    declared value and does not compare it with the page the browser has open.
+    Omitted, those checkouts ask the cardholder to approve. Card updates replace the
+    whole spec, so an update that omits it removes it.
+    """
+
 
 CardVaultItemSpecParam: TypeAlias = Union[LinkCardVaultItemSpec, AgentCardCardVaultItemSpec]

{kernel-0.115.0 → kernel-0.116.0}/tests/api_resources/test_credentials.py

@@ -45,6 +45,9 @@ class TestCredentials:
                 "password": "mysecretpassword",
             },
             sso_provider="google",
+            totp_algorithm="SHA1",
+            totp_digits=6,
+            totp_period=30,
             totp_secret="JBSWY3DPEHPK3PXP",
         )
         assert_matches_type(Credential, credential, path=["response"])
@@ -143,6 +146,9 @@ class TestCredentials:
             name="my-updated-login",
             remove_value_keys=["old_field"],
             sso_provider="google",
+            totp_algorithm="SHA1",
+            totp_digits=6,
+            totp_period=30,
             totp_secret="JBSWY3DPEHPK3PXP",
             values={
                 "username": "user@example.com",
@@ -338,6 +344,9 @@ class TestAsyncCredentials:
                 "password": "mysecretpassword",
             },
             sso_provider="google",
+            totp_algorithm="SHA1",
+            totp_digits=6,
+            totp_period=30,
             totp_secret="JBSWY3DPEHPK3PXP",
         )
         assert_matches_type(Credential, credential, path=["response"])
@@ -436,6 +445,9 @@ class TestAsyncCredentials:
             name="my-updated-login",
             remove_value_keys=["old_field"],
             sso_provider="google",
+            totp_algorithm="SHA1",
+            totp_digits=6,
+            totp_period=30,
             totp_secret="JBSWY3DPEHPK3PXP",
             values={
                 "username": "user@example.com",

kernel-0.115.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.115.0"
-}

kernel-0.115.0/src/kernel/types/credential_create_params.py

@@ -1,33 +0,0 @@
-# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
-
-from __future__ import annotations
-
-from typing import Dict
-from typing_extensions import Required, TypedDict
-
-__all__ = ["CredentialCreateParams"]
-
-
-class CredentialCreateParams(TypedDict, total=False):
-    domain: Required[str]
-    """Target domain this credential is for"""
-
-    name: Required[str]
-    """Unique name for the credential within the project"""
-
-    values: Required[Dict[str, str]]
-    """Field name to value mapping (e.g., username, password)"""
-
-    sso_provider: str
-    """
-    If set, indicates this credential should be used with the specified SSO provider
-    (e.g., google, github, microsoft). When the target site has a matching SSO
-    button, it will be clicked first before filling credential values on the
-    identity provider's login page.
-    """
-
-    totp_secret: str
-    """Base32-encoded TOTP secret for generating one-time passwords.
-
-    Used for automatic 2FA during login.
-    """

kernel-0.115.0/src/kernel/types/credential_update_params.py

@@ -1,43 +0,0 @@
-# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
-
-from __future__ import annotations
-
-from typing import Dict, Optional
-from typing_extensions import TypedDict
-
-from .._types import SequenceNotStr
-
-__all__ = ["CredentialUpdateParams"]
-
-
-class CredentialUpdateParams(TypedDict, total=False):
-    name: str
-    """New name for the credential"""
-
-    remove_value_keys: SequenceNotStr[str]
-    """Field names to remove from the credential's stored values.
-
-    Removals are applied before `values` are merged, so a key present in both is
-    kept with its new value.
-    """
-
-    sso_provider: Optional[str]
-    """If set, indicates this credential should be used with the specified SSO
-    provider.
-
-    Set to empty string or null to remove.
-    """
-
-    totp_secret: str
-    """Base32-encoded TOTP secret for generating one-time passwords.
-
-    Spaces and formatting are automatically normalized. Set to empty string to
-    remove.
-    """
-
-    values: Dict[str, str]
-    """Field name to value mapping.
-
-    Values are merged with existing values (new keys added, existing keys
-    overwritten).
-    """