kernel 0.118.0__tar.gz → 0.119.0__tar.gz

kernel-0.119.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.119.0"
+}

{kernel-0.118.0 → kernel-0.119.0}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.119.0](https://github.com/kernel/kernel-python-sdk/compare/v0.118.0...v0.119.0) (2026-10-02)
+
+
+### Features
+
+* Add managed auth provider to vault credential items ([795d824](https://github.com/kernel/kernel-python-sdk/commit/795d8241dfd22dc7667d7fd74c70182cc7467928))
+
 ## [0.118.0](https://github.com/kernel/kernel-python-sdk/compare/v0.117.0...v0.118.0) (2026-10-02)
 
 

{kernel-0.118.0 → kernel-0.119.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.118.0
+Version: 0.119.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.118.0 → kernel-0.119.0}/api.md

@@ -579,6 +579,10 @@ from kernel.types.vaults import (
     KernelCredentialVaultItemState,
     KernelWalletState,
     KernelWalletVaultItemSpec,
+    ManagedAuthCredentialVaultField,
+    ManagedAuthCredentialVaultItemSpec,
+    ManagedAuthCredentialVaultItemSpecInput,
+    ManagedAuthCredentialVaultItemState,
     OnePasswordCredentialAccountSpec,
     OnePasswordCredentialAccountState,
     OnePasswordCredentialVaultItemSpec,

{kernel-0.118.0 → kernel-0.119.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.118.0"
+version = "0.119.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.118.0"  # x-release-please-version
+__version__ = "0.119.0"  # x-release-please-version

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/resources/vaults/items.py

@@ -93,6 +93,7 @@ class ItemsResource(SyncAPIResource):
               approval, or credential collection. Return the current item when ready or when
               the wait elapses. This does not wait for edits to an already-ready credential;
               poll GET without wait and compare version to observe changes after collect.
+              Managed auth credentials are created ready, so wait returns immediately.
 
           extra_headers: Send extra headers
 
@@ -315,7 +316,8 @@ class ItemsResource(SyncAPIResource):
         recovery_required whose checkout create response returned no authorization ID
         may be explicitly abandoned by deleting that card directly; deleting its wallet
         or vault remains blocked. Deleting or recreating an item is not proof that a
-        payment did not occur.
+        payment did not occur. Deleting a managed auth credential item leaves the
+        connection and its saved credential unchanged.
 
         Args:
           extra_headers: Send extra headers
@@ -1270,6 +1272,7 @@ class AsyncItemsResource(AsyncAPIResource):
               approval, or credential collection. Return the current item when ready or when
               the wait elapses. This does not wait for edits to an already-ready credential;
               poll GET without wait and compare version to observe changes after collect.
+              Managed auth credentials are created ready, so wait returns immediately.
 
           extra_headers: Send extra headers
 
@@ -1492,7 +1495,8 @@ class AsyncItemsResource(AsyncAPIResource):
         recovery_required whose checkout create response returned no authorization ID
         may be explicitly abandoned by deleting that card directly; deleting its wallet
         or vault remains blocked. Deleting or recreating an item is not proof that a
-        payment did not occur.
+        payment did not occur. Deleting a managed auth credential item leaves the
+        connection and its saved credential unchanged.
 
         Args:
           extra_headers: Send extra headers

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/types/vaults/__init__.py

@@ -48,6 +48,7 @@ from .kernel_credential_vault_item_state import KernelCredentialVaultItemState a
 from .credential_vault_field_update_param import CredentialVaultFieldUpdateParam as CredentialVaultFieldUpdateParam
 from .credential_vault_item_request_param import CredentialVaultItemRequestParam as CredentialVaultItemRequestParam
 from .kernel_wallet_vault_item_spec_param import KernelWalletVaultItemSpecParam as KernelWalletVaultItemSpecParam
+from .managed_auth_credential_vault_field import ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField
 from .one_password_credential_account_spec import OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec
 from .one_password_credential_account_state import (
     OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
@@ -61,9 +62,15 @@ from .credential_vault_item_spec_update_param import (
 from .fill_vault_item_operation_request_param import (
     FillVaultItemOperationRequestParam as FillVaultItemOperationRequestParam,
 )
+from .managed_auth_credential_vault_item_spec import (
+    ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec,
+)
 from .one_password_credential_vault_item_spec import (
     OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec,
 )
+from .managed_auth_credential_vault_item_state import (
+    ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState,
+)
 from .one_password_credential_vault_item_state import (
     OnePasswordCredentialVaultItemState as OnePasswordCredentialVaultItemState,
 )
@@ -94,6 +101,9 @@ from .one_password_fill_vault_item_operation_result import (
 from .webmcp_invoke_vault_item_operation_request_param import (
     WebmcpInvokeVaultItemOperationRequestParam as WebmcpInvokeVaultItemOperationRequestParam,
 )
+from .managed_auth_credential_vault_item_spec_input_param import (
+    ManagedAuthCredentialVaultItemSpecInputParam as ManagedAuthCredentialVaultItemSpecInputParam,
+)
 from .one_password_credential_vault_item_spec_input_param import (
     OnePasswordCredentialVaultItemSpecInputParam as OnePasswordCredentialVaultItemSpecInputParam,
 )

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item.py

@@ -83,7 +83,8 @@ class CredentialVaultItem(BaseModel):
 
     1Password credentials advertise 1pw_create_access_request until a request is
     made, 1pw_access_request_status while its approval is pending, and 1pw_fill
-    after access is granted.
+    after access is granted. Managed auth credentials advertise fill while ready and
+    nothing otherwise.
     """
 
     created_at: datetime
@@ -106,7 +107,8 @@ class CredentialVaultItem(BaseModel):
     version: int
     """
     Starts at 1 and increments on PATCH and successful hosted submission, but not
-    collection-link renewal.
+    collection-link renewal. Managed auth credentials stay at 1; changes to the
+    underlying credential are read at fill time and do not change the version.
     """
 
     action: Optional[Action] = None

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item_request_param.py

@@ -20,9 +20,12 @@ class CredentialVaultItemRequestParam(TypedDict, total=False):
     Kernel credentials declare fields and may enter pending_collection.
     1Password credentials either reference a connected credential_account or
     store a supplied access token and integration key encrypted on the item.
-    They store no login values or selectors. Repeating the original creation
-    request returns the current item without overwriting later state. A
-    different request at the same key returns 409.
+    They store no login values or selectors.
+    Managed auth credentials reference a managed auth connection in the same
+    project that already has a saved credential, and read it at fill time;
+    they store no values.
+    Repeating the original creation request returns the current item without
+    overwriting later state. A different request at the same key returns 409.
     """
 
     spec: Required[CredentialVaultItemSpecInputParam]

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item_spec.py

@@ -5,10 +5,12 @@ from typing_extensions import Annotated, TypeAlias
 
 from ..._utils import PropertyInfo
 from .kernel_credential_vault_item_spec import KernelCredentialVaultItemSpec
+from .managed_auth_credential_vault_item_spec import ManagedAuthCredentialVaultItemSpec
 from .one_password_credential_vault_item_spec import OnePasswordCredentialVaultItemSpec
 
 __all__ = ["CredentialVaultItemSpec"]
 
 CredentialVaultItemSpec: TypeAlias = Annotated[
-    Union[KernelCredentialVaultItemSpec, OnePasswordCredentialVaultItemSpec], PropertyInfo(discriminator="provider")
+    Union[KernelCredentialVaultItemSpec, OnePasswordCredentialVaultItemSpec, ManagedAuthCredentialVaultItemSpec],
+    PropertyInfo(discriminator="provider"),
 ]

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item_spec_input_param.py

@@ -6,10 +6,13 @@ from typing import Union
 from typing_extensions import TypeAlias
 
 from .kernel_credential_vault_item_spec_input_param import KernelCredentialVaultItemSpecInputParam
+from .managed_auth_credential_vault_item_spec_input_param import ManagedAuthCredentialVaultItemSpecInputParam
 from .one_password_credential_vault_item_spec_input_param import OnePasswordCredentialVaultItemSpecInputParam
 
 __all__ = ["CredentialVaultItemSpecInputParam"]
 
 CredentialVaultItemSpecInputParam: TypeAlias = Union[
-    KernelCredentialVaultItemSpecInputParam, OnePasswordCredentialVaultItemSpecInputParam
+    KernelCredentialVaultItemSpecInputParam,
+    OnePasswordCredentialVaultItemSpecInputParam,
+    ManagedAuthCredentialVaultItemSpecInputParam,
 ]

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item_state.py

@@ -5,10 +5,12 @@ from typing_extensions import Annotated, TypeAlias
 
 from ..._utils import PropertyInfo
 from .kernel_credential_vault_item_state import KernelCredentialVaultItemState
+from .managed_auth_credential_vault_item_state import ManagedAuthCredentialVaultItemState
 from .one_password_credential_vault_item_state import OnePasswordCredentialVaultItemState
 
 __all__ = ["CredentialVaultItemState"]
 
 CredentialVaultItemState: TypeAlias = Annotated[
-    Union[KernelCredentialVaultItemState, OnePasswordCredentialVaultItemState], PropertyInfo(discriminator="provider")
+    Union[KernelCredentialVaultItemState, OnePasswordCredentialVaultItemState, ManagedAuthCredentialVaultItemState],
+    PropertyInfo(discriminator="provider"),
 ]

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item_update_request_param.py

@@ -20,6 +20,7 @@ class CredentialVaultItemUpdateRequestParam(TypedDict, total=False):
     values remain missing, return pending_collection and a fresh collection
     action. Otherwise return ready without an action; collect can open the form
     again without clearing values. Customer URLs have no Kernel-managed expiry.
+    1Password and managed auth credentials return 409.
     """
 
     spec: Required[CredentialVaultItemSpecUpdateParam]

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/types/vaults/item_retrieve_params.py

@@ -20,4 +20,5 @@ class ItemRetrieveParams(TypedDict, total=False):
     approval, or credential collection. Return the current item when ready or when
     the wait elapses. This does not wait for edits to an already-ready credential;
     poll GET without wait and compare version to observe changes after collect.
+    Managed auth credentials are created ready, so wait returns immediately.
     """

kernel-0.119.0/src/kernel/types/vaults/managed_auth_credential_vault_field.py

@@ -0,0 +1,20 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from ..._models import BaseModel
+from .credential_vault_field_type import CredentialVaultFieldType
+
+__all__ = ["ManagedAuthCredentialVaultField"]
+
+
+class ManagedAuthCredentialVaultField(BaseModel):
+    type: CredentialVaultFieldType
+    """
+    Text, email, and password have form inputs; totp does not and is omitted from
+    both Kernel-hosted and customer React forms. Password and totp must be
+    sensitive. A totp value is an RFC 4648 Base32 generator seed (case-insensitive,
+    optional trailing padding), not an otpauth URI or current code. Reject invalid
+    or empty decoded seeds. Browser fill generates an RFC 6238 code at execution
+    time using HMAC-SHA1, 6 digits, and a 30-second period. Preserve leading zeros;
+    never fill the seed. Custom algorithms, digits, periods, and form enrollment are
+    unsupported.
+    """

kernel-0.119.0/src/kernel/types/vaults/managed_auth_credential_vault_item_spec.py

@@ -0,0 +1,21 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import Optional
+from typing_extensions import Literal
+
+from ..._models import BaseModel
+
+__all__ = ["ManagedAuthCredentialVaultItemSpec"]
+
+
+class ManagedAuthCredentialVaultItemSpec(BaseModel):
+    connection_id: str
+    """ID of the managed auth connection whose saved credential this item reads.
+
+    List connections with `GET /auth/connections`.
+    """
+
+    provider: Literal["managed_auth"]
+
+    description: Optional[str] = None
+    """Display text supplied when the item was created. Omitted when none was given."""

kernel-0.119.0/src/kernel/types/vaults/managed_auth_credential_vault_item_spec_input_param.py

@@ -0,0 +1,37 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["ManagedAuthCredentialVaultItemSpecInputParam"]
+
+
+class ManagedAuthCredentialVaultItemSpecInputParam(TypedDict, total=False):
+    """A credential backed by a managed auth connection.
+
+    The item stores no values:
+    it reads the connection's saved credential at fill time, so updates made
+    through managed auth apply immediately. The connection must be in the vault's
+    project and hold a saved Kernel credential. The check is the saved credential,
+    not connection status: a connection that needs re-authentication qualifies,
+    and an authenticated one without a saved credential does not. Returns 404 for
+    an unknown connection, and 409 when the connection is in another project, has
+    no saved credential yet, or uses an external credential provider such as
+    1Password. No collection form is offered; managed auth collects the login.
+    """
+
+    connection_id: Required[str]
+    """ID of the managed auth connection whose saved credential this item reads.
+
+    List connections with `GET /auth/connections`.
+    """
+
+    provider: Required[Literal["managed_auth"]]
+
+    description: str
+    """Optional display text for the item, such as the site or service name.
+
+    Set at creation and cannot be changed later; repeating the request with a
+    different description returns 409. At most 16 KiB in UTF-8 bytes.
+    """

kernel-0.119.0/src/kernel/types/vaults/managed_auth_credential_vault_item_state.py

@@ -0,0 +1,41 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import Dict, Optional
+from typing_extensions import Literal
+
+from ..._models import BaseModel
+from .managed_auth_credential_vault_field import ManagedAuthCredentialVaultField
+
+__all__ = ["ManagedAuthCredentialVaultItemState"]
+
+
+class ManagedAuthCredentialVaultItemState(BaseModel):
+    provider: Literal["managed_auth"]
+
+    status: Literal["ready", "unavailable"]
+    """
+    Items are created ready, which means the connection has a saved Kernel
+    credential that stores values or a TOTP seed (what has_values or has_totp_secret
+    report on credentials), not that a login succeeded. Unavailable means it no
+    longer does; such items advertise no operations.
+    """
+
+    fields: Optional[Dict[str, ManagedAuthCredentialVaultField]] = None
+    """
+    One entry per non-empty value on the connection's saved credential, keyed by the
+    field name to use in fill bindings. Included on single-item responses (create
+    and get) and omitted from list responses, like `value_keys` on credentials.
+    Empty when unavailable or when every stored value is empty. A stored value named
+    totp_secret is never listed or filled. Values are never returned. A totp entry
+    is present when the credential has a TOTP seed; fill writes a generated code for
+    it. Entries follow the connection's credential.
+    """
+
+    status_reason: Optional[Literal["connection_not_found", "no_credential", "external_credential"]] = None
+    """Present when status is unavailable.
+
+    connection_not_found means the connection was deleted. no_credential means the
+    connection's credential was deleted or emptied after the item was created.
+    external_credential means the connection was moved to an external credential
+    provider.
+    """

{kernel-0.118.0 → kernel-0.119.0}/src/kernel/types/vaults/vault_fill_field_param.py

@@ -9,9 +9,10 @@ __all__ = ["VaultFillFieldParam"]
 
 class VaultFillFieldParam(TypedDict, total=False):
     field: Required[str]
-    """A declared credential field name or a supported card field.
-
-    Unset credential fields cannot be filled.
+    """
+    A credential field name from the item's declared fields (Kernel) or state.fields
+    from a single-item read (managed auth), or a supported card field. Unset
+    credential fields cannot be filled.
     """
 
     selector: Required[str]

kernel-0.118.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.118.0"
-}