kernel 0.115.0__tar.gz → 0.117.0__tar.gz

kernel-0.117.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.117.0"
+}

{kernel-0.115.0 → kernel-0.117.0}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.117.0](https://github.com/kernel/kernel-python-sdk/compare/v0.116.0...v0.117.0) (2026-10-02)
+
+
+### Features
+
+* Invoke WebMCP tools with vault item fields ([a75eb77](https://github.com/kernel/kernel-python-sdk/commit/a75eb77bb3722e82b45836e1b9f5f6fc43dfa4ff))
+
+## [0.116.0](https://github.com/kernel/kernel-python-sdk/compare/v0.115.0...v0.116.0) (2026-10-01)
+
+
+### Features
+
+* chore(stlc): seal custom-code tracking files ([c053ce4](https://github.com/kernel/kernel-python-sdk/commit/c053ce45e5d6bfaa4577310d28b3ecf0a7c16f4e))
+
 ## [0.115.0](https://github.com/kernel/kernel-python-sdk/compare/v0.114.0...v0.115.0) (2026-09-30)
 
 

{kernel-0.115.0 → kernel-0.117.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.115.0
+Version: 0.117.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.115.0 → kernel-0.117.0}/api.md

@@ -596,8 +596,11 @@ from kernel.types.vaults import (
     VaultItemEvent,
     VaultItemOperationResponse,
     VaultPaymentMethod,
+    VaultWebmcpBinding,
     WalletVaultItemSpec,
     WalletVaultItemState,
+    WebmcpInvokeVaultItemOperationRequest,
+    WebmcpInvokeVaultItemOperationResult,
     ItemListResponse,
     ItemEventsResponse,
 )

{kernel-0.115.0 → kernel-0.117.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.115.0"
+version = "0.117.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.115.0 → kernel-0.117.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.115.0"  # x-release-please-version
+__version__ = "0.117.0"  # x-release-please-version

{kernel-0.115.0 → kernel-0.117.0}/src/kernel/resources/credentials.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from typing import Dict, Optional
+from typing_extensions import Literal
 
 import httpx
 
@@ -54,6 +55,9 @@ class CredentialsResource(SyncAPIResource):
         name: str,
         values: Dict[str, str],
         sso_provider: str | Omit = omit,
+        totp_algorithm: Literal["SHA1", "SHA256", "SHA512"] | Omit = omit,
+        totp_digits: int | Omit = omit,
+        totp_period: int | Omit = omit,
         totp_secret: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -77,8 +81,20 @@ class CredentialsResource(SyncAPIResource):
               button, it will be clicked first before filling credential values on the
               identity provider's login page.
 
-          totp_secret: Base32-encoded TOTP secret for generating one-time passwords. Used for automatic
-              2FA during login.
+          totp_algorithm: HMAC algorithm used to generate TOTP codes. Defaults to SHA1 and is ignored when
+              an `otpauth://` URI supplies the algorithm.
+
+          totp_digits: Number of digits in generated TOTP codes. Defaults to 6 and is ignored when an
+              `otpauth://` URI supplies the digit count.
+
+          totp_period: TOTP rotation period in seconds. Defaults to 30 and is ignored when an
+              `otpauth://` URI supplies the period.
+
+          totp_secret: Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+              URI. The range accepts existing shorter seeds and longer seeds regardless of
+              HMAC algorithm; RFC 6238 recommends unpadded base32 lengths of 32/52/103 for
+              SHA1/SHA256/SHA512. Only URI parameters present override the corresponding
+              explicit TOTP fields. Used for automatic 2FA during login.
 
           extra_headers: Send extra headers
 
@@ -96,6 +112,9 @@ class CredentialsResource(SyncAPIResource):
                     "name": name,
                     "values": values,
                     "sso_provider": sso_provider,
+                    "totp_algorithm": totp_algorithm,
+                    "totp_digits": totp_digits,
+                    "totp_period": totp_period,
                     "totp_secret": totp_secret,
                 },
                 credential_create_params.CredentialCreateParams,
@@ -147,6 +166,9 @@ class CredentialsResource(SyncAPIResource):
         name: str | Omit = omit,
         remove_value_keys: SequenceNotStr[str] | Omit = omit,
         sso_provider: Optional[str] | Omit = omit,
+        totp_algorithm: Literal["SHA1", "SHA256", "SHA512"] | Omit = omit,
+        totp_digits: int | Omit = omit,
+        totp_period: int | Omit = omit,
         totp_secret: str | Omit = omit,
         values: Dict[str, str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -170,8 +192,20 @@ class CredentialsResource(SyncAPIResource):
           sso_provider: If set, indicates this credential should be used with the specified SSO
               provider. Set to empty string or null to remove.
 
-          totp_secret: Base32-encoded TOTP secret for generating one-time passwords. Spaces and
-              formatting are automatically normalized. Set to empty string to remove.
+          totp_algorithm: HMAC algorithm used to generate TOTP codes. Requires totp_secret and is ignored
+              when an `otpauth://` URI supplies the algorithm.
+
+          totp_digits: Number of digits in generated TOTP codes. Requires totp_secret and is ignored
+              when an `otpauth://` URI supplies the digit count.
+
+          totp_period: TOTP rotation period in seconds. Requires totp_secret and is ignored when an
+              `otpauth://` URI supplies the period.
+
+          totp_secret: Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+              URI. Only URI parameters present override the corresponding explicit TOTP
+              fields. When rotating a raw secret, omitted fields preserve their existing
+              values; a new URI defaults unspecified fields to SHA1/6/30. Set to empty string
+              to remove the secret and its metadata.
 
           values: Field name to value mapping. Values are merged with existing values (new keys
               added, existing keys overwritten).
@@ -193,6 +227,9 @@ class CredentialsResource(SyncAPIResource):
                     "name": name,
                     "remove_value_keys": remove_value_keys,
                     "sso_provider": sso_provider,
+                    "totp_algorithm": totp_algorithm,
+                    "totp_digits": totp_digits,
+                    "totp_period": totp_period,
                     "totp_secret": totp_secret,
                     "values": values,
                 },
@@ -360,6 +397,9 @@ class AsyncCredentialsResource(AsyncAPIResource):
         name: str,
         values: Dict[str, str],
         sso_provider: str | Omit = omit,
+        totp_algorithm: Literal["SHA1", "SHA256", "SHA512"] | Omit = omit,
+        totp_digits: int | Omit = omit,
+        totp_period: int | Omit = omit,
         totp_secret: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -383,8 +423,20 @@ class AsyncCredentialsResource(AsyncAPIResource):
               button, it will be clicked first before filling credential values on the
               identity provider's login page.
 
-          totp_secret: Base32-encoded TOTP secret for generating one-time passwords. Used for automatic
-              2FA during login.
+          totp_algorithm: HMAC algorithm used to generate TOTP codes. Defaults to SHA1 and is ignored when
+              an `otpauth://` URI supplies the algorithm.
+
+          totp_digits: Number of digits in generated TOTP codes. Defaults to 6 and is ignored when an
+              `otpauth://` URI supplies the digit count.
+
+          totp_period: TOTP rotation period in seconds. Defaults to 30 and is ignored when an
+              `otpauth://` URI supplies the period.
+
+          totp_secret: Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+              URI. The range accepts existing shorter seeds and longer seeds regardless of
+              HMAC algorithm; RFC 6238 recommends unpadded base32 lengths of 32/52/103 for
+              SHA1/SHA256/SHA512. Only URI parameters present override the corresponding
+              explicit TOTP fields. Used for automatic 2FA during login.
 
           extra_headers: Send extra headers
 
@@ -402,6 +454,9 @@ class AsyncCredentialsResource(AsyncAPIResource):
                     "name": name,
                     "values": values,
                     "sso_provider": sso_provider,
+                    "totp_algorithm": totp_algorithm,
+                    "totp_digits": totp_digits,
+                    "totp_period": totp_period,
                     "totp_secret": totp_secret,
                 },
                 credential_create_params.CredentialCreateParams,
@@ -453,6 +508,9 @@ class AsyncCredentialsResource(AsyncAPIResource):
         name: str | Omit = omit,
         remove_value_keys: SequenceNotStr[str] | Omit = omit,
         sso_provider: Optional[str] | Omit = omit,
+        totp_algorithm: Literal["SHA1", "SHA256", "SHA512"] | Omit = omit,
+        totp_digits: int | Omit = omit,
+        totp_period: int | Omit = omit,
         totp_secret: str | Omit = omit,
         values: Dict[str, str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -476,8 +534,20 @@ class AsyncCredentialsResource(AsyncAPIResource):
           sso_provider: If set, indicates this credential should be used with the specified SSO
               provider. Set to empty string or null to remove.
 
-          totp_secret: Base32-encoded TOTP secret for generating one-time passwords. Spaces and
-              formatting are automatically normalized. Set to empty string to remove.
+          totp_algorithm: HMAC algorithm used to generate TOTP codes. Requires totp_secret and is ignored
+              when an `otpauth://` URI supplies the algorithm.
+
+          totp_digits: Number of digits in generated TOTP codes. Requires totp_secret and is ignored
+              when an `otpauth://` URI supplies the digit count.
+
+          totp_period: TOTP rotation period in seconds. Requires totp_secret and is ignored when an
+              `otpauth://` URI supplies the period.
+
+          totp_secret: Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+              URI. Only URI parameters present override the corresponding explicit TOTP
+              fields. When rotating a raw secret, omitted fields preserve their existing
+              values; a new URI defaults unspecified fields to SHA1/6/30. Set to empty string
+              to remove the secret and its metadata.
 
           values: Field name to value mapping. Values are merged with existing values (new keys
               added, existing keys overwritten).
@@ -499,6 +569,9 @@ class AsyncCredentialsResource(AsyncAPIResource):
                     "name": name,
                     "remove_value_keys": remove_value_keys,
                     "sso_provider": sso_provider,
+                    "totp_algorithm": totp_algorithm,
+                    "totp_digits": totp_digits,
+                    "totp_period": totp_period,
                     "totp_secret": totp_secret,
                     "values": values,
                 },

{kernel-0.115.0 → kernel-0.117.0}/src/kernel/resources/vaults/items.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from typing import Any, List, Union, Iterable, cast
+from typing import Any, Dict, List, Union, Iterable, cast
 from datetime import datetime
 from typing_extensions import Literal, overload
 
@@ -31,6 +31,7 @@ from ...types.vaults.item_list_response import ItemListResponse
 from ...types.vaults.item_events_response import ItemEventsResponse
 from ...types.vaults.vault_fill_field_param import VaultFillFieldParam
 from ...types.vaults.card_vault_item_spec_param import CardVaultItemSpecParam
+from ...types.vaults.vault_webmcp_binding_param import VaultWebmcpBindingParam
 from ...types.vaults.vault_checkout_context_param import VaultCheckoutContextParam
 from ...types.vaults.vault_item_operation_response import VaultItemOperationResponse
 from ...types.vaults.credential_vault_item_spec_input_param import CredentialVaultItemSpecInputParam
@@ -857,6 +858,73 @@ class ItemsResource(SyncAPIResource):
         """
         ...
 
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        bindings: Iterable[VaultWebmcpBindingParam],
+        browser_id: str,
+        input: Dict[str, object],
+        page_url: str,
+        tool_ref: str,
+        type: Literal["webmcp_invoke"],
+        timeout_sec: int | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`, not an automatic-retry signal. A transport error may
+        leave the outcome unknown; do not automatically retry.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          input: Public tool arguments with an existing null slot at each binding path. At most
+              64 KiB after JSON serialization, including substituted values. Never include
+              vault values here.
+
+          page_url: Exact top-level URL from the discovered tool source (fragment omitted). This
+              pins the target page; it does not authorize a destination.
+
+          tool_ref: Opaque reference to the exact live WebMCP registration.
+
+          timeout_sec: Tool invocation timeout in seconds; preflight and response handling have an
+              additional bounded allowance. An indeterminate outcome is not retried.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @required_args(
         ["id_or_name", "type"],
         ["id_or_name", "checkout", "type"],
@@ -864,6 +932,7 @@ class ItemsResource(SyncAPIResource):
         ["id_or_name", "browser_id", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
         ["id_or_name", "access_token", "type"],
+        ["id_or_name", "bindings", "browser_id", "input", "page_url", "tool_ref", "type"],
     )
     def perform_operation(
         self,
@@ -878,7 +947,8 @@ class ItemsResource(SyncAPIResource):
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
         | Literal["1pw_recover"]
-        | Literal["1pw_update_access_token"],
+        | Literal["1pw_update_access_token"]
+        | Literal["webmcp_invoke"],
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -891,6 +961,10 @@ class ItemsResource(SyncAPIResource):
         entry_id: str | Omit = omit,
         access_token: str | Omit = omit,
         access_token_expires_at: Union[str, datetime] | Omit = omit,
+        bindings: Iterable[VaultWebmcpBindingParam] | Omit = omit,
+        input: Dict[str, object] | Omit = omit,
+        tool_ref: str | Omit = omit,
+        timeout_sec: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -921,6 +995,10 @@ class ItemsResource(SyncAPIResource):
                         "entry_id": entry_id,
                         "access_token": access_token,
                         "access_token_expires_at": access_token_expires_at,
+                        "bindings": bindings,
+                        "input": input,
+                        "tool_ref": tool_ref,
+                        "timeout_sec": timeout_sec,
                     },
                     item_perform_operation_params.ItemPerformOperationParams,
                 ),
@@ -1954,6 +2032,73 @@ class AsyncItemsResource(AsyncAPIResource):
         """
         ...
 
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        bindings: Iterable[VaultWebmcpBindingParam],
+        browser_id: str,
+        input: Dict[str, object],
+        page_url: str,
+        tool_ref: str,
+        type: Literal["webmcp_invoke"],
+        timeout_sec: int | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`, not an automatic-retry signal. A transport error may
+        leave the outcome unknown; do not automatically retry.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          input: Public tool arguments with an existing null slot at each binding path. At most
+              64 KiB after JSON serialization, including substituted values. Never include
+              vault values here.
+
+          page_url: Exact top-level URL from the discovered tool source (fragment omitted). This
+              pins the target page; it does not authorize a destination.
+
+          tool_ref: Opaque reference to the exact live WebMCP registration.
+
+          timeout_sec: Tool invocation timeout in seconds; preflight and response handling have an
+              additional bounded allowance. An indeterminate outcome is not retried.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @required_args(
         ["id_or_name", "type"],
         ["id_or_name", "checkout", "type"],
@@ -1961,6 +2106,7 @@ class AsyncItemsResource(AsyncAPIResource):
         ["id_or_name", "browser_id", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
         ["id_or_name", "access_token", "type"],
+        ["id_or_name", "bindings", "browser_id", "input", "page_url", "tool_ref", "type"],
     )
     async def perform_operation(
         self,
@@ -1975,7 +2121,8 @@ class AsyncItemsResource(AsyncAPIResource):
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
         | Literal["1pw_recover"]
-        | Literal["1pw_update_access_token"],
+        | Literal["1pw_update_access_token"]
+        | Literal["webmcp_invoke"],
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -1988,6 +2135,10 @@ class AsyncItemsResource(AsyncAPIResource):
         entry_id: str | Omit = omit,
         access_token: str | Omit = omit,
         access_token_expires_at: Union[str, datetime] | Omit = omit,
+        bindings: Iterable[VaultWebmcpBindingParam] | Omit = omit,
+        input: Dict[str, object] | Omit = omit,
+        tool_ref: str | Omit = omit,
+        timeout_sec: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -2018,6 +2169,10 @@ class AsyncItemsResource(AsyncAPIResource):
                         "entry_id": entry_id,
                         "access_token": access_token,
                         "access_token_expires_at": access_token_expires_at,
+                        "bindings": bindings,
+                        "input": input,
+                        "tool_ref": tool_ref,
+                        "timeout_sec": timeout_sec,
                     },
                     item_perform_operation_params.ItemPerformOperationParams,
                 ),

{kernel-0.115.0 → kernel-0.117.0}/src/kernel/types/credential.py

@@ -2,6 +2,7 @@
 
 from typing import List, Optional
 from datetime import datetime
+from typing_extensions import Literal
 
 from .._models import BaseModel
 
@@ -40,8 +41,14 @@ class Credential(BaseModel):
     identity provider's login page.
     """
 
+    totp_algorithm: Optional[Literal["SHA1", "SHA256", "SHA512"]] = None
+    """HMAC algorithm used to generate TOTP codes.
+
+    Defaults to SHA1 for credentials created before this metadata was stored.
+    """
+
     totp_code: Optional[str] = None
-    """Current 6-digit TOTP code.
+    """Current TOTP code.
 
     Only included in create/update responses when totp_secret was just set.
     """
@@ -49,6 +56,18 @@ class Credential(BaseModel):
     totp_code_expires_at: Optional[datetime] = None
     """When the totp_code expires. Only included when totp_code is present."""
 
+    totp_digits: Optional[int] = None
+    """Number of digits in generated TOTP codes.
+
+    Defaults to 6 for credentials created before this metadata was stored.
+    """
+
+    totp_period: Optional[int] = None
+    """TOTP rotation period in seconds.
+
+    Defaults to 30 for credentials created before this metadata was stored.
+    """
+
     value_keys: Optional[List[str]] = None
     """The field names stored in this credential's values (e.g., username, password).
 

kernel-0.117.0/src/kernel/types/credential_create_params.py

@@ -0,0 +1,54 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Dict
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["CredentialCreateParams"]
+
+
+class CredentialCreateParams(TypedDict, total=False):
+    domain: Required[str]
+    """Target domain this credential is for"""
+
+    name: Required[str]
+    """Unique name for the credential within the project"""
+
+    values: Required[Dict[str, str]]
+    """Field name to value mapping (e.g., username, password)"""
+
+    sso_provider: str
+    """
+    If set, indicates this credential should be used with the specified SSO provider
+    (e.g., google, github, microsoft). When the target site has a matching SSO
+    button, it will be clicked first before filling credential values on the
+    identity provider's login page.
+    """
+
+    totp_algorithm: Literal["SHA1", "SHA256", "SHA512"]
+    """HMAC algorithm used to generate TOTP codes.
+
+    Defaults to SHA1 and is ignored when an `otpauth://` URI supplies the algorithm.
+    """
+
+    totp_digits: int
+    """Number of digits in generated TOTP codes.
+
+    Defaults to 6 and is ignored when an `otpauth://` URI supplies the digit count.
+    """
+
+    totp_period: int
+    """TOTP rotation period in seconds.
+
+    Defaults to 30 and is ignored when an `otpauth://` URI supplies the period.
+    """
+
+    totp_secret: str
+    """
+    Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+    URI. The range accepts existing shorter seeds and longer seeds regardless of
+    HMAC algorithm; RFC 6238 recommends unpadded base32 lengths of 32/52/103 for
+    SHA1/SHA256/SHA512. Only URI parameters present override the corresponding
+    explicit TOTP fields. Used for automatic 2FA during login.
+    """

kernel-0.117.0/src/kernel/types/credential_update_params.py

@@ -0,0 +1,66 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Dict, Optional
+from typing_extensions import Literal, TypedDict
+
+from .._types import SequenceNotStr
+
+__all__ = ["CredentialUpdateParams"]
+
+
+class CredentialUpdateParams(TypedDict, total=False):
+    name: str
+    """New name for the credential"""
+
+    remove_value_keys: SequenceNotStr[str]
+    """Field names to remove from the credential's stored values.
+
+    Removals are applied before `values` are merged, so a key present in both is
+    kept with its new value.
+    """
+
+    sso_provider: Optional[str]
+    """If set, indicates this credential should be used with the specified SSO
+    provider.
+
+    Set to empty string or null to remove.
+    """
+
+    totp_algorithm: Literal["SHA1", "SHA256", "SHA512"]
+    """HMAC algorithm used to generate TOTP codes.
+
+    Requires totp_secret and is ignored when an `otpauth://` URI supplies the
+    algorithm.
+    """
+
+    totp_digits: int
+    """Number of digits in generated TOTP codes.
+
+    Requires totp_secret and is ignored when an `otpauth://` URI supplies the digit
+    count.
+    """
+
+    totp_period: int
+    """TOTP rotation period in seconds.
+
+    Requires totp_secret and is ignored when an `otpauth://` URI supplies the
+    period.
+    """
+
+    totp_secret: str
+    """
+    Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...`
+    URI. Only URI parameters present override the corresponding explicit TOTP
+    fields. When rotating a raw secret, omitted fields preserve their existing
+    values; a new URI defaults unspecified fields to SHA1/6/30. Set to empty string
+    to remove the secret and its metadata.
+    """
+
+    values: Dict[str, str]
+    """Field name to value mapping.
+
+    Values are merged with existing values (new keys added, existing keys
+    overwritten).
+    """