@onkernel/sdk 0.129.0 → 0.131.0

package/resources/vaults/items.d.ts

@@ -234,6 +234,36 @@ export interface AgentcardCheckoutPreparation {
     expires_at?: string;
 }
 export type AgentcardPreparedProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'adyen';
+/**
+ * Let a browser attached to the item's vault sign in with a stored passkey. Only
+ * invoke when the item advertises `arm_passkey`. Returns immediately; there is no
+ * time limit. While armed, when a page in that browser whose origin matches the
+ * passkey's relying party asks for a passkey (`navigator.credentials.get`,
+ * including autofill requests made at page load), Kernel answers with this
+ * passkey. The private key never enters the browser: Kernel signs on its servers,
+ * using the origin Chrome reports for the requesting frame. Arming a passkey for a
+ * relying party replaces any passkey armed earlier in the browser for the same
+ * relying party. The arm lasts until `disarm_passkey`, the browser ends, the vault
+ * is detached, or the item or field is deleted. Drive the sign-in with your own
+ * browser tools and inspect the page to confirm it. A page opened in a new tab or
+ * window can run its first scripts before Kernel's handler attaches; if such a
+ * page asks for a passkey as soon as it loads, reload it. While armed, any script
+ * running on the relying party's pages can obtain a sign-in without user
+ * interaction, as with a password manager that fills automatically; disarm when
+ * the task is done. Passkeys report a signature counter of 0 and backup flags, as
+ * synced passkeys do.
+ */
+export interface ArmPasskeyVaultItemOperationRequest {
+    /**
+     * Browser session ID, not a reusable browser name.
+     */
+    browser_id: string;
+    type: 'arm_passkey';
+    /**
+     * Passkey field to arm. Required when more than one passkey field holds a passkey.
+     */
+    field?: string;
+}
 /**
  * Authorize a Link or Kernel card using its existing purchase specification. Use
  * only after explicit user approval and when the item advertises authorize; follow
@@ -279,7 +309,8 @@ export declare namespace CardVaultItemSpec {
      */
     interface LinkCardVaultItemSpec {
         /**
-         * Integer amount in minor currency units, at most 50000.
+         * Integer amount in minor currency units, at most 50000. With recurring, the
+         * spending limit per period, not a lifetime total.
          */
         amount: number;
         context: string;
@@ -301,6 +332,18 @@ export declare namespace CardVaultItemSpec {
         metadata?: {
             [key: string]: string;
         };
+        /**
+         * Recurring terms for a subscription or other repeated purchase. The amount
+         * becomes the spending limit for each period of interval_count intervals, for
+         * example every 2 weeks. The merchant schedules charges. The card stays ready
+         * after each charge until it expires or is deleted; do not create a new card each
+         * period. Deleting the card, its wallet or its vault first cancels the credential
+         * with Link, so later charges decline; if Link cannot be reached, deletion returns
+         * 409 provider_revocation_pending and should be retried. Deletion does not cancel
+         * the subscription with the merchant. Recurring terms cannot be changed once the
+         * card is authorized.
+         */
+        recurring?: LinkCardVaultItemSpec.Recurring;
         totals?: Array<LinkCardVaultItemSpec.Total>;
     }
     namespace LinkCardVaultItemSpec {
@@ -328,6 +371,24 @@ export declare namespace CardVaultItemSpec {
                 type: string;
             }
         }
+        /**
+         * Recurring terms for a subscription or other repeated purchase. The amount
+         * becomes the spending limit for each period of interval_count intervals, for
+         * example every 2 weeks. The merchant schedules charges. The card stays ready
+         * after each charge until it expires or is deleted; do not create a new card each
+         * period. Deleting the card, its wallet or its vault first cancels the credential
+         * with Link, so later charges decline; if Link cannot be reached, deletion returns
+         * 409 provider_revocation_pending and should be retried. Deletion does not cancel
+         * the subscription with the merchant. Recurring terms cannot be changed once the
+         * card is authorized.
+         */
+        interface Recurring {
+            interval: 'day' | 'week' | 'month' | 'year';
+            /**
+             * Number of intervals per period. Link defaults it to 1.
+             */
+            interval_count?: number;
+        }
         interface Total {
             /**
              * Total amount in minor currency units.
@@ -525,7 +586,7 @@ export declare namespace CredentialAccountVaultItem {
      */
     interface AvailableExpansion {
         description: string;
-        type: 'payment_methods';
+        type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
     }
     /**
      * An operation that is currently valid for this item. Read the description before
@@ -533,7 +594,7 @@ export declare namespace CredentialAccountVaultItem {
      */
     interface AvailableOperation {
         description: string;
-        type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
+        type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
     }
 }
 export interface CredentialAccountVaultItemRequest {
@@ -608,7 +669,7 @@ export interface CredentialVaultFieldDefinition {
      * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
      * private key), a lowercase `rpId` domain, and optional `username` and
      * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-     * pages.
+     * pages; use arm_passkey to sign in with one and register_passkey to create one.
      */
     type: CredentialVaultFieldType;
     /**
@@ -641,7 +702,7 @@ export interface CredentialVaultFieldDefinitionInput {
      * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
      * private key), a lowercase `rpId` domain, and optional `username` and
      * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-     * pages.
+     * pages; use arm_passkey to sign in with one and register_passkey to create one.
      */
     type: CredentialVaultFieldType;
     /**
@@ -679,7 +740,7 @@ export interface CredentialVaultFieldInput {
      * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
      * private key), a lowercase `rpId` domain, and optional `username` and
      * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-     * pages.
+     * pages; use arm_passkey to sign in with one and register_passkey to create one.
      */
     type: CredentialVaultFieldType;
     /**
@@ -744,7 +805,7 @@ export interface CredentialVaultFieldState {
  * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
  * private key), a lowercase `rpId` domain, and optional `username` and
  * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
- * pages.
+ * pages; use arm_passkey to sign in with one and register_passkey to create one.
  */
 export type CredentialVaultFieldType = 'text' | 'email' | 'password' | 'totp' | 'passkey';
 /**
@@ -846,7 +907,7 @@ export declare namespace CredentialVaultItem {
      */
     interface AvailableExpansion {
         description: string;
-        type: 'payment_methods';
+        type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
     }
     /**
      * An operation that is currently valid for this item. Read the description before
@@ -854,7 +915,7 @@ export declare namespace CredentialVaultItem {
      */
     interface AvailableOperation {
         description: string;
-        type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
+        type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
     }
     interface OnePasswordAccessApprovalAction {
         /**
@@ -963,6 +1024,23 @@ export interface CredentialVaultItemUpdateRequest {
      */
     expected_item_id?: string;
 }
+/**
+ * Stop a browser from using this item's passkeys: removes its armed passkeys and
+ * its pending registration into this item. Pages that already loaded keep Kernel's
+ * WebAuthn handler but get the browser's own behavior.
+ */
+export interface DisarmPasskeyVaultItemOperationRequest {
+    /**
+     * Browser session ID, not a reusable browser name.
+     */
+    browser_id: string;
+    type: 'disarm_passkey';
+    /**
+     * Limit disarming to one passkey field. Omit to disarm every passkey field of the
+     * item.
+     */
+    field?: string;
+}
 /**
  * Use a vault item in a browser session, for example to fill a login or payment
  * form. Only invoke when the item advertises `fill`; the advertised operation
@@ -1007,7 +1085,8 @@ export interface FillVaultItemOperationRequest {
      */
     page_url?: string;
     /**
-     * Total operation deadline in milliseconds, not a per-field timeout.
+     * @deprecated Ignored. Fill sets no operation deadline; typing pace adapts to the
+     * length of the values instead. Accepted for compatibility.
      */
     timeout_ms?: number;
 }
@@ -1038,8 +1117,11 @@ export interface FillVaultItemOperationResult {
 export interface KernelCardState {
     provider: 'kernel';
     /**
-     * pending_authorization on a Visa purchase waits for the cardholder to approve it
-     * through the spend_approval action; an unused link expires after 30 minutes.
+     * pending_authorization waits for cardholder approval on Visa purchases or fresh
+     * security-code collection on alias-mode purchases through the spend_approval
+     * action; an unused link expires after 30 minutes. Alias-mode cards become ready
+     * after collection and expire at the temporary security-code alias deadline, by
+     * default five minutes later. An expired alias purchase requires a new card.
      * recovery_required means verification, approving the purchase or issuing the
      * one-time code has an unresolved outcome. A server-classified initial attestation
      * failure before intent dispatch may advertise restart_verification to prepare a
@@ -1082,12 +1164,13 @@ export declare namespace KernelCardState {
  * spend_approval action: the cardholder approves it with a Visa passkey, and
  * Kernel registers a Visa intent for one transaction up to the amount before
  * issuing the code. For supported cards whose network cannot be enrolled for
- * agentic tokens, authorize prepares checkout details without issuing a one-time
- * code. The card can be filled into one checkout before its expires_at, one hour
- * after authorization. Fill types those details on merchant_url's origin. The
- * amount, merchant_url and merchant_country are recorded but do not restrict
- * payment requests sent by the browser. Card updates are not supported; delete and
- * create a new item instead.
+ * agentic tokens, authorize returns pending_authorization with a spend_approval
+ * action to collect a fresh security code in a hosted field. Once collected, the
+ * card is ready and can be filled before its expires_at, by default five minutes
+ * after collection. An expired card requires a new purchase. Fill types those
+ * details on merchant_url's origin. The amount, merchant_url and merchant_country
+ * are recorded but do not restrict payment requests sent by the browser. Card
+ * updates are not supported; delete and create a new item instead.
  */
 export interface KernelCardVaultItemSpec {
     /**
@@ -1203,6 +1286,154 @@ export interface KernelWalletState {
 export interface KernelWalletVaultItemSpec {
     provider: 'kernel';
 }
+/**
+ * One entry of Link's `GET /shipping_addresses` response, passed through as Link
+ * reports it. Kernel never stores it.
+ */
+export interface LinkShippingAddress {
+    /**
+     * Link shipping address ID.
+     */
+    id: string;
+    is_default: boolean;
+    nickname: string | null;
+    /**
+     * Link's nullable postal address fields. Omitted from the shipping address when
+     * Link reports null.
+     */
+    address?: LinkShippingAddress.Address;
+}
+export declare namespace LinkShippingAddress {
+    /**
+     * Link's nullable postal address fields. Omitted from the shipping address when
+     * Link reports null.
+     */
+    interface Address {
+        /**
+         * State, province or region.
+         */
+        administrative_area: string | null;
+        country_code: string | null;
+        dependent_locality: string | null;
+        line_1: string | null;
+        line_2: string | null;
+        /**
+         * City or town.
+         */
+        locality: string | null;
+        name: string | null;
+        postal_code: string | null;
+        sorting_code: string | null;
+    }
+}
+/**
+ * Link's `GET /userinfo` response for the connected wallet, passed through as Link
+ * reports it when the `link_user_info` expansion is requested. Kernel never stores
+ * it. Null fields are null at Link; omitted fields were not reported. Amounts are
+ * in the minor unit of `default_spend_request_currency`.
+ */
+export interface LinkUserInfo {
+    /**
+     * Stable Link user ID.
+     */
+    id: string | null;
+    email: string | null;
+    first_name: string | null;
+    last_name: string | null;
+    name: string | null;
+    phone: string | null;
+    /**
+     * The Link user's postal address. Omitted when Link reports none.
+     */
+    address?: LinkUserInfo.Address;
+    /**
+     * Link's agent wallet spend limits, per transaction and over rolling periods.
+     */
+    agent_wallet_spend_limits?: LinkUserInfo.AgentWalletSpendLimits;
+    /**
+     * Verification Link requires from the user before the agent wallet can spend.
+     */
+    agent_wallet_step_up?: LinkUserInfo.AgentWalletStepUp;
+    /**
+     * Lowercase ISO currency Link applies to a spend request created without one.
+     */
+    default_spend_request_currency?: string;
+    /**
+     * Whether the user can fund purchases from a Link balance.
+     */
+    eligible_for_balance?: boolean;
+}
+export declare namespace LinkUserInfo {
+    /**
+     * The Link user's postal address. Omitted when Link reports none.
+     */
+    interface Address {
+        city: string | null;
+        country: string | null;
+        line1: string | null;
+        line2: string | null;
+        postal_code: string | null;
+        state: string | null;
+    }
+    /**
+     * Link's agent wallet spend limits, per transaction and over rolling periods.
+     */
+    interface AgentWalletSpendLimits {
+        daily: AgentWalletSpendLimits.Daily;
+        per_transaction: AgentWalletSpendLimits.PerTransaction;
+        thirty_day: AgentWalletSpendLimits.ThirtyDay;
+    }
+    namespace AgentWalletSpendLimits {
+        interface Daily {
+            /**
+             * Null means unlimited.
+             */
+            limit: number | null;
+            /**
+             * Amount still available in the rolling period; null means unlimited.
+             */
+            remaining: number | null;
+            /**
+             * Amount already spent in the rolling period.
+             */
+            used: number;
+        }
+        interface PerTransaction {
+            /**
+             * Null means unlimited.
+             */
+            limit: number | null;
+        }
+        interface ThirtyDay {
+            /**
+             * Null means unlimited.
+             */
+            limit: number | null;
+            /**
+             * Amount still available in the rolling period; null means unlimited.
+             */
+            remaining: number | null;
+            /**
+             * Amount already spent in the rolling period.
+             */
+            used: number;
+        }
+    }
+    /**
+     * Verification Link requires from the user before the agent wallet can spend.
+     */
+    interface AgentWalletStepUp {
+        /**
+         * URL where the user completes verification; null when no action is available.
+         */
+        action_url: string | null;
+        /**
+         * Link status such as not_required, ssn_verification, identity_verification,
+         * contact_support or complete.
+         */
+        status: string;
+    }
+}
 export interface ManagedAuthCredentialVaultField {
     /**
      * Text, email, and password have form inputs; totp and passkey do not and are
@@ -1217,7 +1448,7 @@ export interface ManagedAuthCredentialVaultField {
      * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
      * private key), a lowercase `rpId` domain, and optional `username` and
      * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-     * pages.
+     * pages; use arm_passkey to sign in with one and register_passkey to create one.
      */
     type: CredentialVaultFieldType;
 }
@@ -1593,6 +1824,19 @@ export interface OnePasswordRequestAccessVaultItemOperationRequest {
     keywords?: Array<string>;
     reason?: string;
 }
+export interface PasskeyVaultItemOperationResult {
+    /**
+     * armed means the browser will answer matching passkey requests; it does not mean
+     * a page has asked yet. disarmed means the browser no longer uses this item's
+     * passkeys.
+     */
+    status: 'armed' | 'disarmed';
+    type: 'arm_passkey' | 'register_passkey' | 'disarm_passkey';
+    /**
+     * Relying party the armed passkey answers for. Returned by arm_passkey.
+     */
+    rp_id?: string;
+}
 /**
  * Prepare an unused AgentCard card for a supported checkout. Deliver the returned
  * approval URL and keep the approval page open. Poll the item until
@@ -1612,6 +1856,32 @@ export interface PrepareCheckoutVaultItemOperationRequest {
     checkout: VaultCheckoutContext;
     type: 'prepare_checkout';
 }
+/**
+ * Let a browser attached to the item's vault create a passkey on a website and
+ * store it in an empty passkey field. Only invoke when the item advertises
+ * `register_passkey`; declare the field first, for example by adding an optional
+ * passkey field with a credential update. Returns immediately; there is no time
+ * limit. The next passkey a page in that browser creates
+ * (`navigator.credentials.create`) is generated by Kernel, stored in the field,
+ * and only then returned to the page, so the website never receives a passkey
+ * Kernel failed to store. Each browser has one pending registration; a later
+ * `register_passkey` replaces it. Drive the website's "add a passkey" flow with
+ * your own browser tools, then confirm by reading the item (the field reports
+ * `has_value`) or its `credential_passkey_registered` event, and by signing in
+ * with `arm_passkey`. Only ES256 passkeys are created.
+ */
+export interface RegisterPasskeyVaultItemOperationRequest {
+    /**
+     * Browser session ID, not a reusable browser name.
+     */
+    browser_id: string;
+    type: 'register_passkey';
+    /**
+     * Empty passkey field to store the new passkey in. Required when more than one
+     * passkey field is empty.
+     */
+    field?: string;
+}
 /**
  * Explicitly prepare a fresh local verification session for the same Kernel Visa
  * purchase and connected wallet, only when restart_verification is advertised.
@@ -1780,7 +2050,7 @@ export declare namespace VaultItem {
          */
         interface AvailableExpansion {
             description: string;
-            type: 'payment_methods';
+            type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
         }
         /**
          * An operation that is currently valid for this item. Read the description before
@@ -1788,12 +2058,24 @@ export declare namespace VaultItem {
          */
         interface AvailableOperation {
             description: string;
-            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
+            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
         }
         /**
          * Live, non-persisted data requested through the item GET expand parameter.
          */
         interface Expanded {
+            /**
+             * Link's saved shipping addresses, present when the `link_shipping_addresses`
+             * expansion is requested.
+             */
+            link_shipping_addresses?: Array<ItemsAPI.LinkShippingAddress>;
+            /**
+             * Link's `GET /userinfo` response for the connected wallet, passed through as Link
+             * reports it when the `link_user_info` expansion is requested. Kernel never stores
+             * it. Null fields are null at Link; omitted fields were not reported. Amounts are
+             * in the minor unit of `default_spend_request_currency`.
+             */
+            link_user_info?: ItemsAPI.LinkUserInfo;
             payment_methods?: Array<ItemsAPI.VaultPaymentMethod>;
         }
     }
@@ -1832,7 +2114,7 @@ export declare namespace VaultItem {
          */
         interface AvailableExpansion {
             description: string;
-            type: 'payment_methods';
+            type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
         }
         /**
          * An operation that is currently valid for this item. Read the description before
@@ -1840,7 +2122,7 @@ export declare namespace VaultItem {
          */
         interface AvailableOperation {
             description: string;
-            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
+            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
         }
     }
 }
@@ -1890,11 +2172,11 @@ export interface VaultItemEvent {
     };
 }
 /**
- * Authorization and preparation return the existing item shape. Fill returns a
- * value-free result; WebMCP invocation returns the tool's output. Neither persists
- * transient outcomes on the item.
+ * Authorization and preparation return the existing item shape. Fill and passkey
+ * operations return value-free results; WebMCP invocation returns the tool's
+ * output. None persist transient outcomes on the item.
  */
-export type VaultItemOperationResponse = VaultItemOperationResponse.WalletVaultItem | VaultItemOperationResponse.CardVaultItem | CredentialAccountVaultItem | CredentialVaultItem | FillVaultItemOperationResult | OnePasswordFillVaultItemOperationResult | WebmcpInvokeVaultItemOperationResult;
+export type VaultItemOperationResponse = VaultItemOperationResponse.WalletVaultItem | VaultItemOperationResponse.CardVaultItem | CredentialAccountVaultItem | CredentialVaultItem | FillVaultItemOperationResult | PasskeyVaultItemOperationResult | OnePasswordFillVaultItemOperationResult | WebmcpInvokeVaultItemOperationResult;
 export declare namespace VaultItemOperationResponse {
     interface WalletVaultItem {
         id: string;
@@ -1943,7 +2225,7 @@ export declare namespace VaultItemOperationResponse {
          */
         interface AvailableExpansion {
             description: string;
-            type: 'payment_methods';
+            type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
         }
         /**
          * An operation that is currently valid for this item. Read the description before
@@ -1951,12 +2233,24 @@ export declare namespace VaultItemOperationResponse {
          */
         interface AvailableOperation {
             description: string;
-            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
+            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
         }
         /**
          * Live, non-persisted data requested through the item GET expand parameter.
          */
         interface Expanded {
+            /**
+             * Link's saved shipping addresses, present when the `link_shipping_addresses`
+             * expansion is requested.
+             */
+            link_shipping_addresses?: Array<ItemsAPI.LinkShippingAddress>;
+            /**
+             * Link's `GET /userinfo` response for the connected wallet, passed through as Link
+             * reports it when the `link_user_info` expansion is requested. Kernel never stores
+             * it. Null fields are null at Link; omitted fields were not reported. Amounts are
+             * in the minor unit of `default_spend_request_currency`.
+             */
+            link_user_info?: ItemsAPI.LinkUserInfo;
             payment_methods?: Array<ItemsAPI.VaultPaymentMethod>;
         }
     }
@@ -1995,7 +2289,7 @@ export declare namespace VaultItemOperationResponse {
          */
         interface AvailableExpansion {
             description: string;
-            type: 'payment_methods';
+            type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
         }
         /**
          * An operation that is currently valid for this item. Read the description before
@@ -2003,7 +2297,7 @@ export declare namespace VaultItemOperationResponse {
          */
         interface AvailableOperation {
             description: string;
-            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
+            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke';
         }
     }
 }
@@ -2249,7 +2543,7 @@ export interface ItemRetrieveParams {
      * Query param: Live fields advertised by `available_expansions` to include in
      * `expanded`.
      */
-    expand?: Array<'payment_methods'>;
+    expand?: Array<'payment_methods' | 'link_user_info' | 'link_shipping_addresses'>;
     /**
      * Query param: Hold for up to this many seconds while the item is pending
      * authorization, approval, or credential collection. Return the current item when
@@ -2324,7 +2618,7 @@ export interface ItemEventsParams {
      */
     wait?: number;
 }
-export type ItemPerformOperationParams = ItemPerformOperationParams.AuthorizeVaultItemOperationRequest | ItemPerformOperationParams.RestartVerificationVaultItemOperationRequest | ItemPerformOperationParams.ConfirmTransactionVaultItemOperationRequest | ItemPerformOperationParams.CollectVaultItemOperationRequest | ItemPerformOperationParams.PrepareCheckoutVaultItemOperationRequest | ItemPerformOperationParams.FillVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordRequestAccessVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordPollAccessVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordFillVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordRecoverVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordUpdateAccessTokenVaultItemOperationRequest | ItemPerformOperationParams.WebmcpInvokeVaultItemOperationRequest;
+export type ItemPerformOperationParams = ItemPerformOperationParams.AuthorizeVaultItemOperationRequest | ItemPerformOperationParams.RestartVerificationVaultItemOperationRequest | ItemPerformOperationParams.ConfirmTransactionVaultItemOperationRequest | ItemPerformOperationParams.CollectVaultItemOperationRequest | ItemPerformOperationParams.PrepareCheckoutVaultItemOperationRequest | ItemPerformOperationParams.FillVaultItemOperationRequest | ItemPerformOperationParams.ArmPasskeyVaultItemOperationRequest | ItemPerformOperationParams.RegisterPasskeyVaultItemOperationRequest | ItemPerformOperationParams.DisarmPasskeyVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordRequestAccessVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordPollAccessVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordFillVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordRecoverVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordUpdateAccessTokenVaultItemOperationRequest | ItemPerformOperationParams.WebmcpInvokeVaultItemOperationRequest;
 export declare namespace ItemPerformOperationParams {
     interface AuthorizeVaultItemOperationRequest {
         /**
@@ -2448,10 +2742,68 @@ export declare namespace ItemPerformOperationParams {
          */
         page_url?: string;
         /**
-         * Body param: Total operation deadline in milliseconds, not a per-field timeout.
+         * @deprecated Body param: Ignored. Fill sets no operation deadline; typing pace
+         * adapts to the length of the values instead. Accepted for compatibility.
          */
         timeout_ms?: number;
     }
+    interface ArmPasskeyVaultItemOperationRequest {
+        /**
+         * Path param
+         */
+        id_or_name: string;
+        /**
+         * Body param: Browser session ID, not a reusable browser name.
+         */
+        browser_id: string;
+        /**
+         * Body param
+         */
+        type: 'arm_passkey';
+        /**
+         * Body param: Passkey field to arm. Required when more than one passkey field
+         * holds a passkey.
+         */
+        field?: string;
+    }
+    interface RegisterPasskeyVaultItemOperationRequest {
+        /**
+         * Path param
+         */
+        id_or_name: string;
+        /**
+         * Body param: Browser session ID, not a reusable browser name.
+         */
+        browser_id: string;
+        /**
+         * Body param
+         */
+        type: 'register_passkey';
+        /**
+         * Body param: Empty passkey field to store the new passkey in. Required when more
+         * than one passkey field is empty.
+         */
+        field?: string;
+    }
+    interface DisarmPasskeyVaultItemOperationRequest {
+        /**
+         * Path param
+         */
+        id_or_name: string;
+        /**
+         * Body param: Browser session ID, not a reusable browser name.
+         */
+        browser_id: string;
+        /**
+         * Body param
+         */
+        type: 'disarm_passkey';
+        /**
+         * Body param: Limit disarming to one passkey field. Omit to disarm every passkey
+         * field of the item.
+         */
+        field?: string;
+    }
     interface OnePasswordRequestAccessVaultItemOperationRequest {
         /**
          * Path param
@@ -2798,6 +3150,6 @@ export declare namespace ItemUpsertParams {
     }
 }
 export declare namespace Items {
-    export { type AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization, type AgentcardCheckoutPreparation as AgentcardCheckoutPreparation, type AgentcardPreparedProcessor as AgentcardPreparedProcessor, type AuthorizeVaultItemOperationRequest as AuthorizeVaultItemOperationRequest, type CardVaultItemSpec as CardVaultItemSpec, type CardVaultItemState as CardVaultItemState, type CollectVaultItemOperationRequest as CollectVaultItemOperationRequest, type ConfirmTransactionVaultItemOperationRequest as ConfirmTransactionVaultItemOperationRequest, type CredentialAccountVaultItem as CredentialAccountVaultItem, type CredentialAccountVaultItemRequest as CredentialAccountVaultItemRequest, type CredentialCollectionAction as CredentialCollectionAction, type CredentialVaultFieldDefinition as CredentialVaultFieldDefinition, type CredentialVaultFieldDefinitionInput as CredentialVaultFieldDefinitionInput, type CredentialVaultFieldInput as CredentialVaultFieldInput, type CredentialVaultFieldState as CredentialVaultFieldState, type CredentialVaultFieldType as CredentialVaultFieldType, type CredentialVaultFieldUpdate as CredentialVaultFieldUpdate, type CredentialVaultItem as CredentialVaultItem, type CredentialVaultItemRequest as CredentialVaultItemRequest, type CredentialVaultItemSpec as CredentialVaultItemSpec, type CredentialVaultItemSpecInput as CredentialVaultItemSpecInput, type CredentialVaultItemSpecUpdate as CredentialVaultItemSpecUpdate, type CredentialVaultItemState as CredentialVaultItemState, type CredentialVaultItemUpdateRequest as CredentialVaultItemUpdateRequest, type FillVaultItemOperationRequest as FillVaultItemOperationRequest, type FillVaultItemOperationResult as FillVaultItemOperationResult, type KernelCardState as KernelCardState, type KernelCardVaultItemSpec as KernelCardVaultItemSpec, type KernelCredentialVaultItemSpec as KernelCredentialVaultItemSpec, type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput, type KernelCredentialVaultItemState as KernelCredentialVaultItemState, type KernelWalletState as KernelWalletState, type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec, type ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField, type ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec, type ManagedAuthCredentialVaultItemSpecInput as ManagedAuthCredentialVaultItemSpecInput, type ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState, type OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec, type OnePasswordCredentialAccountState as OnePasswordCredentialAccountState, type OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec, type OnePasswordCredentialVaultItemSpecInput as OnePasswordCredentialVaultItemSpecInput, type OnePasswordCredentialVaultItemState as OnePasswordCredentialVaultItemState, type OnePasswordFillVaultItemOperationRequest as OnePasswordFillVaultItemOperationRequest, type OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult, type OnePasswordOAuthAction as OnePasswordOAuthAction, type OnePasswordRecoverVaultItemOperationRequest as OnePasswordRecoverVaultItemOperationRequest, type OnePasswordRequestAccessVaultItemOperationRequest as OnePasswordRequestAccessVaultItemOperationRequest, type PrepareCheckoutVaultItemOperationRequest as PrepareCheckoutVaultItemOperationRequest, type RestartVerificationVaultItemOperationRequest as RestartVerificationVaultItemOperationRequest, type VaultCardAliases as VaultCardAliases, type VaultCardFillField as VaultCardFillField, type VaultCheckoutContext as VaultCheckoutContext, type VaultFillField as VaultFillField, type VaultFillFieldResult as VaultFillFieldResult, type VaultItem as VaultItem, type VaultItemAction as VaultItemAction, type VaultItemEvent as VaultItemEvent, type VaultItemOperationResponse as VaultItemOperationResponse, type VaultPaymentMethod as VaultPaymentMethod, type VaultWebmcpBinding as VaultWebmcpBinding, type WalletVaultItemSpec as WalletVaultItemSpec, type WalletVaultItemState as WalletVaultItemState, type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest, type WebmcpInvokeVaultItemOperationResult as WebmcpInvokeVaultItemOperationResult, type ItemListResponse as ItemListResponse, type ItemEventsResponse as ItemEventsResponse, type ItemRetrieveParams as ItemRetrieveParams, type ItemUpdateParams as ItemUpdateParams, type ItemDeleteParams as ItemDeleteParams, type ItemEventsParams as ItemEventsParams, type ItemPerformOperationParams as ItemPerformOperationParams, type ItemUpsertParams as ItemUpsertParams, };
+    export { type AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization, type AgentcardCheckoutPreparation as AgentcardCheckoutPreparation, type AgentcardPreparedProcessor as AgentcardPreparedProcessor, type ArmPasskeyVaultItemOperationRequest as ArmPasskeyVaultItemOperationRequest, type AuthorizeVaultItemOperationRequest as AuthorizeVaultItemOperationRequest, type CardVaultItemSpec as CardVaultItemSpec, type CardVaultItemState as CardVaultItemState, type CollectVaultItemOperationRequest as CollectVaultItemOperationRequest, type ConfirmTransactionVaultItemOperationRequest as ConfirmTransactionVaultItemOperationRequest, type CredentialAccountVaultItem as CredentialAccountVaultItem, type CredentialAccountVaultItemRequest as CredentialAccountVaultItemRequest, type CredentialCollectionAction as CredentialCollectionAction, type CredentialVaultFieldDefinition as CredentialVaultFieldDefinition, type CredentialVaultFieldDefinitionInput as CredentialVaultFieldDefinitionInput, type CredentialVaultFieldInput as CredentialVaultFieldInput, type CredentialVaultFieldState as CredentialVaultFieldState, type CredentialVaultFieldType as CredentialVaultFieldType, type CredentialVaultFieldUpdate as CredentialVaultFieldUpdate, type CredentialVaultItem as CredentialVaultItem, type CredentialVaultItemRequest as CredentialVaultItemRequest, type CredentialVaultItemSpec as CredentialVaultItemSpec, type CredentialVaultItemSpecInput as CredentialVaultItemSpecInput, type CredentialVaultItemSpecUpdate as CredentialVaultItemSpecUpdate, type CredentialVaultItemState as CredentialVaultItemState, type CredentialVaultItemUpdateRequest as CredentialVaultItemUpdateRequest, type DisarmPasskeyVaultItemOperationRequest as DisarmPasskeyVaultItemOperationRequest, type FillVaultItemOperationRequest as FillVaultItemOperationRequest, type FillVaultItemOperationResult as FillVaultItemOperationResult, type KernelCardState as KernelCardState, type KernelCardVaultItemSpec as KernelCardVaultItemSpec, type KernelCredentialVaultItemSpec as KernelCredentialVaultItemSpec, type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput, type KernelCredentialVaultItemState as KernelCredentialVaultItemState, type KernelWalletState as KernelWalletState, type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec, type LinkShippingAddress as LinkShippingAddress, type LinkUserInfo as LinkUserInfo, type ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField, type ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec, type ManagedAuthCredentialVaultItemSpecInput as ManagedAuthCredentialVaultItemSpecInput, type ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState, type OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec, type OnePasswordCredentialAccountState as OnePasswordCredentialAccountState, type OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec, type OnePasswordCredentialVaultItemSpecInput as OnePasswordCredentialVaultItemSpecInput, type OnePasswordCredentialVaultItemState as OnePasswordCredentialVaultItemState, type OnePasswordFillVaultItemOperationRequest as OnePasswordFillVaultItemOperationRequest, type OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult, type OnePasswordOAuthAction as OnePasswordOAuthAction, type OnePasswordRecoverVaultItemOperationRequest as OnePasswordRecoverVaultItemOperationRequest, type OnePasswordRequestAccessVaultItemOperationRequest as OnePasswordRequestAccessVaultItemOperationRequest, type PasskeyVaultItemOperationResult as PasskeyVaultItemOperationResult, type PrepareCheckoutVaultItemOperationRequest as PrepareCheckoutVaultItemOperationRequest, type RegisterPasskeyVaultItemOperationRequest as RegisterPasskeyVaultItemOperationRequest, type RestartVerificationVaultItemOperationRequest as RestartVerificationVaultItemOperationRequest, type VaultCardAliases as VaultCardAliases, type VaultCardFillField as VaultCardFillField, type VaultCheckoutContext as VaultCheckoutContext, type VaultFillField as VaultFillField, type VaultFillFieldResult as VaultFillFieldResult, type VaultItem as VaultItem, type VaultItemAction as VaultItemAction, type VaultItemEvent as VaultItemEvent, type VaultItemOperationResponse as VaultItemOperationResponse, type VaultPaymentMethod as VaultPaymentMethod, type VaultWebmcpBinding as VaultWebmcpBinding, type WalletVaultItemSpec as WalletVaultItemSpec, type WalletVaultItemState as WalletVaultItemState, type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest, type WebmcpInvokeVaultItemOperationResult as WebmcpInvokeVaultItemOperationResult, type ItemListResponse as ItemListResponse, type ItemEventsResponse as ItemEventsResponse, type ItemRetrieveParams as ItemRetrieveParams, type ItemUpdateParams as ItemUpdateParams, type ItemDeleteParams as ItemDeleteParams, type ItemEventsParams as ItemEventsParams, type ItemPerformOperationParams as ItemPerformOperationParams, type ItemUpsertParams as ItemUpsertParams, };
 }
 //# sourceMappingURL=items.d.ts.map