release: 0.103.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.102.0"
+  ".": "0.103.0"
 }

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.103.0 (2026-09-15)
+
+Full Changelog: [v0.102.0...v0.103.0](https://github.com/kernel/kernel-python-sdk/compare/v0.102.0...v0.103.0)
+
+### Features
+
+* chore(stlc): seal custom-code tracking files ([4ce4ab9](https://github.com/kernel/kernel-python-sdk/commit/4ce4ab9f533b4f5d9fe420f91f1a0054c0e13c1b))
+* Expose managed auth field input modes ([c110358](https://github.com/kernel/kernel-python-sdk/commit/c11035847c9f6dd23b7cdd5efa0a8b188d5a850a))
+* Return working config registry configurations ([0737fe9](https://github.com/kernel/kernel-python-sdk/commit/0737fe974b15c6e422c8722d1d76c97c811533d7))
+
 ## [0.102.0](https://github.com/kernel/kernel-python-sdk/compare/v0.101.0...v0.102.0) (2026-09-14)
 
 

api.md

@@ -529,12 +529,27 @@ from kernel.types.vaults import (
     AuthorizeVaultItemOperationRequest,
     CardVaultItemSpec,
     CardVaultItemState,
+    CollectVaultItemOperationRequest,
+    CredentialCollectionAction,
+    CredentialVaultFieldDefinition,
+    CredentialVaultFieldInput,
+    CredentialVaultFieldState,
+    CredentialVaultFieldType,
+    CredentialVaultFieldUpdate,
+    CredentialVaultItem,
+    CredentialVaultItemRequest,
+    CredentialVaultItemSpec,
+    CredentialVaultItemSpecInput,
+    CredentialVaultItemSpecUpdate,
+    CredentialVaultItemState,
+    CredentialVaultItemUpdateRequest,
     FillVaultItemOperationRequest,
     FillVaultItemOperationResult,
     PrepareCheckoutVaultItemOperationRequest,
     VaultCardAliases,
     VaultCardFillField,
     VaultCheckoutContext,
+    VaultFillField,
     VaultFillFieldResult,
     VaultItem,
     VaultItemAction,

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.102.0"
+version = "0.103.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.102.0"  # x-release-please-version
+__version__ = "0.103.0"  # x-release-please-version

src/kernel/types/auth/connection_follow_response.py

@@ -109,6 +109,9 @@ class ManagedAuthStateEventField(BaseModel):
     hint: Optional[str] = None
     """Context shown near the field, including a masked code destination."""
 
+    input_mode: Optional[Literal["text", "email", "tel", "numeric"]] = None
+    """Virtual keyboard hint, independent of field type and browser validation."""
+
     label: Optional[str] = None
     """Human-readable label shown to the user."""
 

src/kernel/types/auth/managed_auth.py

@@ -218,6 +218,9 @@ class Field(BaseModel):
     hint: Optional[str] = None
     """Context shown near the field, including a masked code destination."""
 
+    input_mode: Optional[Literal["text", "email", "tel", "numeric"]] = None
+    """Virtual keyboard hint, independent of field type and browser validation."""
+
     label: Optional[str] = None
     """Human-readable label shown to the user."""
 

src/kernel/types/config_registry_response.py

@@ -1,11 +1,12 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
-from typing import Optional
+from typing import List, Optional
 from typing_extensions import Literal
 
 from .target import Target
 from .._models import BaseModel
 from .analysis import Analysis
+from .recommendation import Recommendation
 from .recommendation_result import RecommendationResult
 
 __all__ = ["ConfigRegistryResponse"]
@@ -23,6 +24,12 @@ class ConfigRegistryResponse(BaseModel):
 
     target: Target
 
+    working_configurations: List[Recommendation]
+    """
+    Working configurations for the target, ordered with the recommended
+    configuration first.
+    """
+
     guidance: Optional[str] = None
     """Short advisory markdown to facilitate navigating this target.
 

src/kernel/types/lookup_response.py

@@ -1,9 +1,10 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
-from typing import Optional
+from typing import List, Optional
 
 from .target import Target
 from .._models import BaseModel
+from .recommendation import Recommendation
 from .recommendation_result import RecommendationResult
 
 __all__ = ["LookupResponse"]
@@ -15,6 +16,12 @@ class LookupResponse(BaseModel):
 
     target: Target
 
+    working_configurations: List[Recommendation]
+    """
+    Working configurations for the target, ordered with the recommended
+    configuration first.
+    """
+
     guidance: Optional[str] = None
     """Short advisory markdown to facilitate navigating this target.
 

src/kernel/types/vaults/__init__.py

@@ -15,20 +15,42 @@
 from .item_retrieve_params import ItemRetrieveParams as ItemRetrieveParams
 from .vault_payment_method import VaultPaymentMethod as VaultPaymentMethod
 from .card_vault_item_state import CardVaultItemState as CardVaultItemState
+from .credential_vault_item import CredentialVaultItem as CredentialVaultItem
+from .vault_fill_field_param import VaultFillFieldParam as VaultFillFieldParam
 from .wallet_vault_item_spec import WalletVaultItemSpec as WalletVaultItemSpec
 from .vault_fill_field_result import VaultFillFieldResult as VaultFillFieldResult
 from .wallet_vault_item_state import WalletVaultItemState as WalletVaultItemState
 from .card_vault_item_spec_param import CardVaultItemSpecParam as CardVaultItemSpecParam
-from .vault_card_fill_field_param import VaultCardFillFieldParam as VaultCardFillFieldParam
+from .credential_vault_item_spec import CredentialVaultItemSpec as CredentialVaultItemSpec
+from .credential_vault_field_type import CredentialVaultFieldType as CredentialVaultFieldType
+from .credential_vault_item_state import CredentialVaultItemState as CredentialVaultItemState
+from .credential_collection_action import CredentialCollectionAction as CredentialCollectionAction
+from .credential_vault_field_state import CredentialVaultFieldState as CredentialVaultFieldState
 from .vault_checkout_context_param import VaultCheckoutContextParam as VaultCheckoutContextParam
 from .item_perform_operation_params import ItemPerformOperationParams as ItemPerformOperationParams
 from .vault_item_operation_response import VaultItemOperationResponse as VaultItemOperationResponse
 from .agentcard_checkout_preparation import AgentcardCheckoutPreparation as AgentcardCheckoutPreparation
 from .agentcard_checkout_authorization import AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization
 from .fill_vault_item_operation_result import FillVaultItemOperationResult as FillVaultItemOperationResult
+from .credential_vault_field_definition import CredentialVaultFieldDefinition as CredentialVaultFieldDefinition
+from .credential_vault_field_input_param import CredentialVaultFieldInputParam as CredentialVaultFieldInputParam
+from .credential_vault_field_update_param import CredentialVaultFieldUpdateParam as CredentialVaultFieldUpdateParam
+from .credential_vault_item_request_param import CredentialVaultItemRequestParam as CredentialVaultItemRequestParam
+from .credential_vault_item_spec_input_param import (
+    CredentialVaultItemSpecInputParam as CredentialVaultItemSpecInputParam,
+)
+from .credential_vault_item_spec_update_param import (
+    CredentialVaultItemSpecUpdateParam as CredentialVaultItemSpecUpdateParam,
+)
 from .fill_vault_item_operation_request_param import (
     FillVaultItemOperationRequestParam as FillVaultItemOperationRequestParam,
 )
+from .collect_vault_item_operation_request_param import (
+    CollectVaultItemOperationRequestParam as CollectVaultItemOperationRequestParam,
+)
+from .credential_vault_item_update_request_param import (
+    CredentialVaultItemUpdateRequestParam as CredentialVaultItemUpdateRequestParam,
+)
 from .authorize_vault_item_operation_request_param import (
     AuthorizeVaultItemOperationRequestParam as AuthorizeVaultItemOperationRequestParam,
 )

src/kernel/types/vaults/collect_vault_item_operation_request_param.py

@@ -0,0 +1,27 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["CollectVaultItemOperationRequestParam"]
+
+
+class CollectVaultItemOperationRequestParam(TypedDict, total=False):
+    """Return the credential item with its collection action.
+
+    Supported for ready
+    and pending_collection credential items. Always render the same form from
+    every form-supported field; totp fields have no form input and are omitted.
+    No caller-selected field subsets or form overrides are accepted.
+    Reuse an active Kernel-hosted session or renew an expired session atomically.
+    Customer-hosted forms use their own backend and ordinary item GET/PATCH. Opening
+    the form does not clear values or change readiness or item version.
+    To observe edits on a ready item, record its version and poll GET without
+    wait until the version changes, then reconcile the returned state. Version
+    changes may also come from PATCH; they do not identify a particular form
+    submission. Customer-hosted apps use their own submission callback, including
+    for unchanged forms. The wait parameter waits for readiness, not edits.
+    """
+
+    type: Required[Literal["collect"]]

src/kernel/types/vaults/credential_collection_action.py

@@ -0,0 +1,50 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from datetime import datetime
+from typing_extensions import Literal
+
+from ..._models import BaseModel
+
+__all__ = ["CredentialCollectionAction"]
+
+
+class CredentialCollectionAction(BaseModel):
+    """
+    One schema-derived form for the item, available in ready or pending_collection
+    state. Render every form-supported field as editable; omit totp fields and
+    preserve their stored seeds. Prefill non-sensitive values,
+    and allow existing sensitive values to be preserved or replaced without ever
+    revealing them. No field subsets or per-request form configuration exist.
+    Validate required fields against the resulting values, including preserved
+    secrets. Submit changed values only, using the version used to render the form.
+    Scoped hosted submission rejects totp edits; seed writes require the ordinary
+    authenticated item API. Customer forms likewise omit totp from their payloads.
+    Save edits atomically. A successful hosted submission increments the version,
+    marks ready, and consumes the session; an empty edit may complete collection
+    while preserving values. A customer form uses PATCH for changed values and
+    does not send an empty PATCH when nothing changed.
+    Kernel-hosted bearer sessions require no Kernel account and are bound to the
+    item version. Expired, superseded, consumed, or deleted-item sessions cannot
+    submit. Authenticated item GET renews expired active sessions for ready or pending items; pending
+    items always receive an action. A ready item with no active session omits the
+    action until collect is invoked. Concurrent renewals return the same link.
+    Renewal changes neither values nor item version. An expired link cannot renew
+    itself. The hosted form handles its collection protocol; callers only open
+    the returned URL and do not extract or submit its token through the public API.
+    For customer-hosted forms, use @onkernel/vault-react and an authenticated
+    customer backend calling the ordinary item GET/PATCH API. Kernel does not
+    store customer collection URLs or authenticate the customer's end users.
+    Treat URLs and submitted values as secrets and exclude them from logs,
+    traces, and errors.
+    """
+
+    expires_at: datetime
+    """Expiry of the Kernel-hosted collection link (30 minutes after issuance)."""
+
+    name: Literal["collect"]
+
+    url: str
+    """Time-scoped hosted form URL (vault.kernel.sh in production).
+
+    Open this URL as returned; treat it as a secret.
+    """

src/kernel/types/vaults/credential_vault_field_definition.py

@@ -0,0 +1,31 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from ..._models import BaseModel
+from .credential_vault_field_type import CredentialVaultFieldType
+
+__all__ = ["CredentialVaultFieldDefinition"]
+
+
+class CredentialVaultFieldDefinition(BaseModel):
+    required: bool
+    """Whether a nonempty value is required for readiness and form submission."""
+
+    sensitive: bool
+    """Whether the value is omitted from every item response.
+
+    Reserve true for secrets such as passwords, API tokens, and TOTP seeds. Ordinary
+    usernames and email addresses should be false so the form can display and
+    prefill them.
+    """
+
+    type: CredentialVaultFieldType
+    """
+    Text, email, and password have form inputs; totp does not and is omitted from
+    both Kernel-hosted and customer React forms. Password and totp must be
+    sensitive. A totp value is an RFC 4648 Base32 generator seed (case-insensitive,
+    optional trailing padding), not an otpauth URI or current code. Reject invalid
+    or empty decoded seeds. Browser fill generates an RFC 6238 code at execution
+    time using HMAC-SHA1, 6 digits, and a 30-second period. Preserve leading zeros;
+    never fill the seed. Custom algorithms, digits, periods, and form enrollment are
+    unsupported.
+    """

src/kernel/types/vaults/credential_vault_field_input_param.py

@@ -0,0 +1,41 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Required, TypedDict
+
+from .credential_vault_field_type import CredentialVaultFieldType
+
+__all__ = ["CredentialVaultFieldInputParam"]
+
+
+class CredentialVaultFieldInputParam(TypedDict, total=False):
+    type: Required[CredentialVaultFieldType]
+    """
+    Text, email, and password have form inputs; totp does not and is omitted from
+    both Kernel-hosted and customer React forms. Password and totp must be
+    sensitive. A totp value is an RFC 4648 Base32 generator seed (case-insensitive,
+    optional trailing padding), not an otpauth URI or current code. Reject invalid
+    or empty decoded seeds. Browser fill generates an RFC 6238 code at execution
+    time using HMAC-SHA1, 6 digits, and a 30-second period. Preserve leading zeros;
+    never fill the seed. Custom algorithms, digits, periods, and form enrollment are
+    unsupported.
+    """
+
+    required: bool
+
+    sensitive: bool
+    """
+    Set false explicitly for ordinary usernames, email addresses, and other
+    non-secret identifiers. Reserve true for secrets such as passwords, API tokens,
+    and TOTP seeds. Password and totp fields must be true. Omission defaults to true
+    for safety; do not rely on that default for every field. False permits API reads
+    and form prefilling.
+    """
+
+    value: str
+    """
+    Optional initial value satisfying the declared type, at most 16 KiB in UTF-8
+    bytes. Omit to leave unset; null and empty strings are rejected on creation.
+    Sensitive values are encrypted and never copied into the returned spec.
+    """

src/kernel/types/vaults/credential_vault_field_state.py

@@ -0,0 +1,18 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import Optional
+
+from ..._models import BaseModel
+
+__all__ = ["CredentialVaultFieldState"]
+
+
+class CredentialVaultFieldState(BaseModel):
+    has_value: bool
+
+    value: Optional[str] = None
+    """Present exactly when has_value is true and the field is not sensitive.
+
+    Reflects the latest developer or human edit. For totp, has_value indicates a
+    stored seed; neither the seed nor a generated code is returned.
+    """

src/kernel/types/vaults/credential_vault_field_type.py

@@ -0,0 +1,7 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing_extensions import Literal, TypeAlias
+
+__all__ = ["CredentialVaultFieldType"]
+
+CredentialVaultFieldType: TypeAlias = Literal["text", "email", "password", "totp"]

src/kernel/types/vaults/credential_vault_field_update_param.py

@@ -0,0 +1,20 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Optional
+from typing_extensions import Required, TypedDict
+
+__all__ = ["CredentialVaultFieldUpdateParam"]
+
+
+class CredentialVaultFieldUpdateParam(TypedDict, total=False):
+    value: Required[Optional[str]]
+    """
+    Replacement value (at most 16 KiB in UTF-8 bytes), or null or an empty string to
+    immediately clear the stored value. Clearing a required form-supported field
+    reopens collection; clearing an optional field does not prevent readiness.
+    Values must satisfy the declared field type. For totp, value is the generator
+    seed, never a current code. Clearing a required totp field returns 400 because
+    it cannot be collected in a form.
+    """