feat: Select 1Password fill pages by target and return stored-token grants

Stainless-Generated-From: d4635fa160b38160e0eee5c369943c9509877c89

Author: kernel-internal[bot]

src/kernel/resources/vaults/items.py

@@ -1218,6 +1218,7 @@ def perform_operation(
         page_url: str,
         type: Literal["1pw_fill"],
         entry_id: str | Omit = omit,
+        target_id: str | Omit = omit,
         timeout_ms: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -1263,11 +1264,16 @@ def perform_operation(
           browser_id: Browser session ID, not a reusable browser name.
 
           page_url: Exact current top-level page URL. Must match exactly one open page in the
-              browser.
+              browser unless target_id is supplied.
 
           entry_id: ID of an approved request entry. Required when several approved entries have the
               page's origin.
 
+          target_id: CDP target ID of the page to fill, such as tab.target_id from
+              playwright.execute. Use it when several open pages have page_url. The page's
+              current URL must equal page_url. Kernel brings the page to the front of its
+              window before filling.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -1658,6 +1664,7 @@ def perform_operation(
         reason: str | Omit = omit,
         timeout_seconds: int | Omit = omit,
         entry_id: str | Omit = omit,
+        target_id: str | Omit = omit,
         access_token: str | Omit = omit,
         access_token_expires_at: Union[str, datetime] | Omit = omit,
         bindings: Iterable[VaultWebmcpBindingParam] | Omit = omit,
@@ -1700,6 +1707,7 @@ def perform_operation(
                         "reason": reason,
                         "timeout_seconds": timeout_seconds,
                         "entry_id": entry_id,
+                        "target_id": target_id,
                         "access_token": access_token,
                         "access_token_expires_at": access_token_expires_at,
                         "bindings": bindings,
@@ -3195,6 +3203,7 @@ async def perform_operation(
         page_url: str,
         type: Literal["1pw_fill"],
         entry_id: str | Omit = omit,
+        target_id: str | Omit = omit,
         timeout_ms: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -3240,11 +3249,16 @@ async def perform_operation(
           browser_id: Browser session ID, not a reusable browser name.
 
           page_url: Exact current top-level page URL. Must match exactly one open page in the
-              browser.
+              browser unless target_id is supplied.
 
           entry_id: ID of an approved request entry. Required when several approved entries have the
               page's origin.
 
+          target_id: CDP target ID of the page to fill, such as tab.target_id from
+              playwright.execute. Use it when several open pages have page_url. The page's
+              current URL must equal page_url. Kernel brings the page to the front of its
+              window before filling.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -3635,6 +3649,7 @@ async def perform_operation(
         reason: str | Omit = omit,
         timeout_seconds: int | Omit = omit,
         entry_id: str | Omit = omit,
+        target_id: str | Omit = omit,
         access_token: str | Omit = omit,
         access_token_expires_at: Union[str, datetime] | Omit = omit,
         bindings: Iterable[VaultWebmcpBindingParam] | Omit = omit,
@@ -3677,6 +3692,7 @@ async def perform_operation(
                         "reason": reason,
                         "timeout_seconds": timeout_seconds,
                         "entry_id": entry_id,
+                        "target_id": target_id,
                         "access_token": access_token,
                         "access_token_expires_at": access_token_expires_at,
                         "bindings": bindings,

src/kernel/types/vaults/item_perform_operation_params.py

@@ -207,7 +207,7 @@ class OnePasswordFillVaultItemOperationRequest(TypedDict, total=False):
     page_url: Required[str]
     """Exact current top-level page URL.
 
-    Must match exactly one open page in the browser.
+    Must match exactly one open page in the browser unless target_id is supplied.
     """
 
     type: Required[Literal["1pw_fill"]]
@@ -218,6 +218,14 @@ class OnePasswordFillVaultItemOperationRequest(TypedDict, total=False):
     Required when several approved entries have the page's origin.
     """
 
+    target_id: str
+    """CDP target ID of the page to fill, such as tab.target_id from
+    playwright.execute.
+
+    Use it when several open pages have page_url. The page's current URL must equal
+    page_url. Kernel brings the page to the front of its window before filling.
+    """
+
     timeout_ms: int
 
 

src/kernel/types/vaults/one_password_credential_vault_item_state.py

@@ -15,6 +15,7 @@
     "AccessRequestRequest",
     "AccessRequestRequestEntry",
     "AccessRequestRequestEntryParameters",
+    "AccessRequestResolved",
 ]
 
 
@@ -63,10 +64,22 @@ class AccessRequestRequest(BaseModel):
     version: Optional[int] = None
 
 
+class AccessRequestResolved(BaseModel):
+    reference: str
+    """1Password credential reference.
+
+    Pass it unchanged as resourcePath to the extension's fillCredential or to the
+    1Password SDK.
+    """
+
+    entry_id: Optional[str] = FieldInfo(alias="entryId", default=None)
+    """The requested entry this login satisfies, when known."""
+
+
 class AccessRequest(BaseModel):
     """Non-secret broker state.
 
-    Granted credential references stay encrypted server-side and can only be used by the fill operation.
+    Granted credential references are returned in resolved only for credentials with a customer-supplied access token; otherwise they stay encrypted server-side and can only be used by the fill operation.
     """
 
     id: str
@@ -103,6 +116,14 @@ class AccessRequest(BaseModel):
     The observed create response may omit entries; no entry IDs are invented.
     """
 
+    resolved: Optional[List[AccessRequestResolved]] = None
+    """Granted logins in the shape 1Password's getAccessRequestStatus returns.
+
+    Present only for ready credentials with a customer-supplied access token, on
+    single-item responses to callers that can use the vault. Each reference works
+    only with that credential's access token and integration key.
+    """
+
 
 class OnePasswordCredentialVaultItemState(BaseModel):
     provider: Literal["1password"]
@@ -112,8 +133,9 @@ class OnePasswordCredentialVaultItemState(BaseModel):
     access_request: Optional[AccessRequest] = None
     """Non-secret broker state.
 
-    Granted credential references stay encrypted server-side and can only be used by
-    the fill operation.
+    Granted credential references are returned in resolved only for credentials with
+    a customer-supplied access token; otherwise they stay encrypted server-side and
+    can only be used by the fill operation.
     """
 
     access_request_id: Optional[str] = None

src/kernel/types/vaults/one_password_fill_vault_item_operation_request_param.py

@@ -10,7 +10,7 @@
 class OnePasswordFillVaultItemOperationRequestParam(TypedDict, total=False):
     """Fill and submit an approved 1Password login in the selected browser page.
 
-    The page must share the selected entry's login origin. Supply entry_id when more than one approved entry matches the page origin. The extension selects fields; callers cannot supply selectors or secret values. Submission does not confirm website authentication.
+    The page must share the selected entry's login origin. Supply entry_id when more than one approved entry matches the page origin, and target_id when more than one open page has page_url. The extension selects fields; callers cannot supply selectors or secret values. Submission does not confirm website authentication.
     """
 
     browser_id: Required[str]
@@ -19,7 +19,7 @@ class OnePasswordFillVaultItemOperationRequestParam(TypedDict, total=False):
     page_url: Required[str]
     """Exact current top-level page URL.
 
-    Must match exactly one open page in the browser.
+    Must match exactly one open page in the browser unless target_id is supplied.
     """
 
     type: Required[Literal["1pw_fill"]]
@@ -30,4 +30,12 @@ class OnePasswordFillVaultItemOperationRequestParam(TypedDict, total=False):
     Required when several approved entries have the page's origin.
     """
 
+    target_id: str
+    """CDP target ID of the page to fill, such as tab.target_id from
+    playwright.execute.
+
+    Use it when several open pages have page_url. The page's current URL must equal
+    page_url. Kernel brings the page to the front of its window before filling.
+    """
+
     timeout_ms: int

tests/api_resources/vaults/test_items.py

@@ -1494,6 +1494,7 @@ def test_method_perform_operation_with_all_params_overload_12(self, client: Kern
             page_url="https://example.com",
             type="1pw_fill",
             entry_id="x",
+            target_id="x",
             timeout_ms=1,
         )
         assert_matches_type(VaultItemOperationResponse, item, path=["response"])
@@ -4096,6 +4097,7 @@ async def test_method_perform_operation_with_all_params_overload_12(self, async_
             page_url="https://example.com",
             type="1pw_fill",
             entry_id="x",
+            target_id="x",
             timeout_ms=1,
         )
         assert_matches_type(VaultItemOperationResponse, item, path=["response"])