release: 0.136.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.135.0"
+  ".": "0.136.0"
 }

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.136.0](https://github.com/kernel/kernel-node-sdk/compare/v0.135.0...v0.136.0) (2026-10-28)
+
+
+### Features
+
+* Import approved 1Password logins onto stored-token credentials ([efee572](https://github.com/kernel/kernel-node-sdk/commit/efee572e2333b46badb52e4c8f4cca944d55a92f))
+
 ## [0.135.0](https://github.com/kernel/kernel-node-sdk/compare/v0.134.0...v0.135.0) (2026-10-28)
 
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.135.0",
+  "version": "0.136.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/resources/vaults/items.ts

@@ -2113,6 +2113,12 @@ export namespace OnePasswordCredentialVaultItemSpec {
        */
       type: string;
 
+      /**
+       * 1Password's ID for this entry in an access request you created. Supply it only
+       * with resolved.
+       */
+      id?: string;
+
       keywords?: Array<string>;
 
       reason?: string;
@@ -2131,11 +2137,20 @@ export namespace OnePasswordCredentialVaultItemSpec {
  * customer-supplied access token and matching integration key. Supply either
  * account or both secrets, never both. Supplied secrets are write-only and never
  * returned. Supply requests for new items; website remains supported for existing
- * account-backed callers.
+ * account-backed callers. To use an access request you already created and the
+ * user approved with the same access token and integration key, also supply
+ * access_request_id, resolved, and each requests entry's id; the item is created
+ * ready and Kernel doesn't create an access request.
  */
 export interface OnePasswordCredentialVaultItemSpecInput {
   provider: '1password';
 
+  /**
+   * ID of an approved access request you created with this access_token and
+   * integration_key. Requires resolved.
+   */
+  access_request_id?: string;
+
   /**
    * Customer-supplied 1Password broker token. Requires integration_key; stored
    * encrypted on this item. Omit if providing a connected credential_account item
@@ -2168,6 +2183,14 @@ export interface OnePasswordCredentialVaultItemSpecInput {
    */
   requests?: OnePasswordCredentialVaultItemSpecInput.Requests;
 
+  /**
+   * Granted logins from 1Password's status for access_request_id, as returned by the
+   * 1Password SDK or extension. Requires access_request_id and an id on every
+   * requests entry. entryId may be omitted only when requests has one entry. Kernel
+   * doesn't verify the references; 1Password checks them when filling.
+   */
+  resolved?: Array<OnePasswordCredentialVaultItemSpecInput.Resolved>;
+
   /**
    * @deprecated Legacy single-login shorthand. Supply requests instead.
    */
@@ -2199,6 +2222,12 @@ export namespace OnePasswordCredentialVaultItemSpecInput {
        */
       type: string;
 
+      /**
+       * 1Password's ID for this entry in an access request you created. Supply it only
+       * with resolved.
+       */
+      id?: string;
+
       keywords?: Array<string>;
 
       reason?: string;
@@ -2210,6 +2239,19 @@ export namespace OnePasswordCredentialVaultItemSpecInput {
       }
     }
   }
+
+  export interface Resolved {
+    /**
+     * 1Password credential reference. Pass it unchanged as resourcePath to the
+     * extension's fillCredential or to the 1Password SDK.
+     */
+    reference: string;
+
+    /**
+     * The requested entry this login satisfies, when known.
+     */
+    entryId?: string;
+  }
 }
 
 export interface OnePasswordCredentialVaultItemState {

src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.135.0'; // x-release-please-version
+export const VERSION = '0.136.0'; // x-release-please-version