diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 82876bd8..c8f1da56 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.115.0" + ".": "0.116.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index b1fe798f..76c7c22a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [0.116.0](https://github.com/kernel/kernel-node-sdk/compare/v0.115.0...v0.116.0) (2026-10-01) + + +### Features + +* chore(stlc): seal custom-code tracking files ([4616669](https://github.com/kernel/kernel-node-sdk/commit/461666905f32dd676b482af118c0e1bdf8d70f07)) + ## [0.115.0](https://github.com/kernel/kernel-node-sdk/compare/v0.114.0...v0.115.0) (2026-09-30) diff --git a/package.json b/package.json index 766022a9..06cb0113 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@onkernel/sdk", - "version": "0.115.0", + "version": "0.116.0", "description": "The official TypeScript library for the Kernel API", "author": "Kernel <>", "types": "dist/index.d.ts", diff --git a/src/resources/credentials.ts b/src/resources/credentials.ts index da4992a1..10f6a0a9 100644 --- a/src/resources/credentials.ts +++ b/src/resources/credentials.ts @@ -139,8 +139,29 @@ export interface CreateCredentialRequest { sso_provider?: string; /** - * Base32-encoded TOTP secret for generating one-time passwords. Used for automatic - * 2FA during login. + * HMAC algorithm used to generate TOTP codes. Defaults to SHA1 and is ignored when + * an `otpauth://` URI supplies the algorithm. + */ + totp_algorithm?: 'SHA1' | 'SHA256' | 'SHA512'; + + /** + * Number of digits in generated TOTP codes. Defaults to 6 and is ignored when an + * `otpauth://` URI supplies the digit count. + */ + totp_digits?: number; + + /** + * TOTP rotation period in seconds. Defaults to 30 and is ignored when an + * `otpauth://` URI supplies the period. + */ + totp_period?: number; + + /** + * Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...` + * URI. The range accepts existing shorter seeds and longer seeds regardless of + * HMAC algorithm; RFC 6238 recommends unpadded base32 lengths of 32/52/103 for + * SHA1/SHA256/SHA512. Only URI parameters present override the corresponding + * explicit TOTP fields. Used for automatic 2FA during login. */ totp_secret?: string; } @@ -193,8 +214,14 @@ export interface Credential { sso_provider?: string | null; /** - * Current 6-digit TOTP code. Only included in create/update responses when - * totp_secret was just set. + * HMAC algorithm used to generate TOTP codes. Defaults to SHA1 for credentials + * created before this metadata was stored. + */ + totp_algorithm?: 'SHA1' | 'SHA256' | 'SHA512'; + + /** + * Current TOTP code. Only included in create/update responses when totp_secret was + * just set. */ totp_code?: string; @@ -203,6 +230,18 @@ export interface Credential { */ totp_code_expires_at?: string; + /** + * Number of digits in generated TOTP codes. Defaults to 6 for credentials created + * before this metadata was stored. + */ + totp_digits?: number; + + /** + * TOTP rotation period in seconds. Defaults to 30 for credentials created before + * this metadata was stored. + */ + totp_period?: number; + /** * The field names stored in this credential's values (e.g., username, password). * Values themselves are never returned. Included on single-credential responses @@ -233,8 +272,29 @@ export interface UpdateCredentialRequest { sso_provider?: string | null; /** - * Base32-encoded TOTP secret for generating one-time passwords. Spaces and - * formatting are automatically normalized. Set to empty string to remove. + * HMAC algorithm used to generate TOTP codes. Requires totp_secret and is ignored + * when an `otpauth://` URI supplies the algorithm. + */ + totp_algorithm?: 'SHA1' | 'SHA256' | 'SHA512'; + + /** + * Number of digits in generated TOTP codes. Requires totp_secret and is ignored + * when an `otpauth://` URI supplies the digit count. + */ + totp_digits?: number; + + /** + * TOTP rotation period in seconds. Requires totp_secret and is ignored when an + * `otpauth://` URI supplies the period. + */ + totp_period?: number; + + /** + * Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...` + * URI. Only URI parameters present override the corresponding explicit TOTP + * fields. When rotating a raw secret, omitted fields preserve their existing + * values; a new URI defaults unspecified fields to SHA1/6/30. Set to empty string + * to remove the secret and its metadata. */ totp_secret?: string; @@ -282,8 +342,29 @@ export interface CredentialCreateParams { sso_provider?: string; /** - * Base32-encoded TOTP secret for generating one-time passwords. Used for automatic - * 2FA during login. + * HMAC algorithm used to generate TOTP codes. Defaults to SHA1 and is ignored when + * an `otpauth://` URI supplies the algorithm. + */ + totp_algorithm?: 'SHA1' | 'SHA256' | 'SHA512'; + + /** + * Number of digits in generated TOTP codes. Defaults to 6 and is ignored when an + * `otpauth://` URI supplies the digit count. + */ + totp_digits?: number; + + /** + * TOTP rotation period in seconds. Defaults to 30 and is ignored when an + * `otpauth://` URI supplies the period. + */ + totp_period?: number; + + /** + * Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...` + * URI. The range accepts existing shorter seeds and longer seeds regardless of + * HMAC algorithm; RFC 6238 recommends unpadded base32 lengths of 32/52/103 for + * SHA1/SHA256/SHA512. Only URI parameters present override the corresponding + * explicit TOTP fields. Used for automatic 2FA during login. */ totp_secret?: string; } @@ -307,8 +388,29 @@ export interface CredentialUpdateParams { sso_provider?: string | null; /** - * Base32-encoded TOTP secret for generating one-time passwords. Spaces and - * formatting are automatically normalized. Set to empty string to remove. + * HMAC algorithm used to generate TOTP codes. Requires totp_secret and is ignored + * when an `otpauth://` URI supplies the algorithm. + */ + totp_algorithm?: 'SHA1' | 'SHA256' | 'SHA512'; + + /** + * Number of digits in generated TOTP codes. Requires totp_secret and is ignored + * when an `otpauth://` URI supplies the digit count. + */ + totp_digits?: number; + + /** + * TOTP rotation period in seconds. Requires totp_secret and is ignored when an + * `otpauth://` URI supplies the period. + */ + totp_period?: number; + + /** + * Accepts a 16-128 character base32-encoded TOTP secret or an `otpauth://totp/...` + * URI. Only URI parameters present override the corresponding explicit TOTP + * fields. When rotating a raw secret, omitted fields preserve their existing + * values; a new URI defaults unspecified fields to SHA1/6/30. Set to empty string + * to remove the secret and its metadata. */ totp_secret?: string; diff --git a/src/resources/vaults/items.ts b/src/resources/vaults/items.ts index 01fe78d2..05a29073 100644 --- a/src/resources/vaults/items.ts +++ b/src/resources/vaults/items.ts @@ -413,8 +413,9 @@ export namespace CardVaultItemSpec { /** * AgentCard reusable live payment card. Test-mode card creation is not supported. - * Each checkout creates an approval-gated authorization for spec.merchant / - * spec.amount. The card stays ready after each authorization. + * Each checkout creates an authorization for spec.merchant / spec.amount that the + * cardholder approves, unless AgentCard runs it under one of the cardholder's + * autopilot rules. The card stays ready after each authorization. */ export interface AgentCardCardVaultItemSpec { /** @@ -442,6 +443,18 @@ export namespace CardVaultItemSpec { * picks on the approval screen. */ card_id?: string; + + /** + * Origin of the top-level checkout page, such as https://shop.example.com: https, + * a lowercase host, a port only when it is not 443, and no path. http is accepted + * only for localhost test pages. Checkouts without a preparation send it to + * AgentCard, which uses it to match the cardholder's autopilot rules; prepared + * checkouts send the preparation's merchant_origin instead. Kernel sends the + * declared value and does not compare it with the page the browser has open. + * Omitted, those checkouts ask the cardholder to approve. Card updates replace the + * whole spec, so an update that omits it removes it. + */ + checkout_origin?: string; } } diff --git a/src/version.ts b/src/version.ts index bf0d1fb8..e15e6528 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const VERSION = '0.115.0'; // x-release-please-version +export const VERSION = '0.116.0'; // x-release-please-version diff --git a/tests/api-resources/credentials.test.ts b/tests/api-resources/credentials.test.ts index 5bd00bbc..5908c109 100644 --- a/tests/api-resources/credentials.test.ts +++ b/tests/api-resources/credentials.test.ts @@ -31,6 +31,9 @@ describe('resource credentials', () => { name: 'my-netflix-login', values: { username: 'user@example.com', password: 'mysecretpassword' }, sso_provider: 'google', + totp_algorithm: 'SHA1', + totp_digits: 6, + totp_period: 30, totp_secret: 'JBSWY3DPEHPK3PXP', }); });