@onkernel/sdk 0.129.0 → 0.131.0

package/src/resources/vaults/items.ts

@@ -316,6 +316,39 @@ export type AgentcardPreparedProcessor =
   | 'mercado_pago'
   | 'adyen';
 
+/**
+ * Let a browser attached to the item's vault sign in with a stored passkey. Only
+ * invoke when the item advertises `arm_passkey`. Returns immediately; there is no
+ * time limit. While armed, when a page in that browser whose origin matches the
+ * passkey's relying party asks for a passkey (`navigator.credentials.get`,
+ * including autofill requests made at page load), Kernel answers with this
+ * passkey. The private key never enters the browser: Kernel signs on its servers,
+ * using the origin Chrome reports for the requesting frame. Arming a passkey for a
+ * relying party replaces any passkey armed earlier in the browser for the same
+ * relying party. The arm lasts until `disarm_passkey`, the browser ends, the vault
+ * is detached, or the item or field is deleted. Drive the sign-in with your own
+ * browser tools and inspect the page to confirm it. A page opened in a new tab or
+ * window can run its first scripts before Kernel's handler attaches; if such a
+ * page asks for a passkey as soon as it loads, reload it. While armed, any script
+ * running on the relying party's pages can obtain a sign-in without user
+ * interaction, as with a password manager that fills automatically; disarm when
+ * the task is done. Passkeys report a signature counter of 0 and backup flags, as
+ * synced passkeys do.
+ */
+export interface ArmPasskeyVaultItemOperationRequest {
+  /**
+   * Browser session ID, not a reusable browser name.
+   */
+  browser_id: string;
+
+  type: 'arm_passkey';
+
+  /**
+   * Passkey field to arm. Required when more than one passkey field holds a passkey.
+   */
+  field?: string;
+}
+
 /**
  * Authorize a Link or Kernel card using its existing purchase specification. Use
  * only after explicit user approval and when the item advertises authorize; follow
@@ -368,7 +401,8 @@ export namespace CardVaultItemSpec {
    */
   export interface LinkCardVaultItemSpec {
     /**
-     * Integer amount in minor currency units, at most 50000.
+     * Integer amount in minor currency units, at most 50000. With recurring, the
+     * spending limit per period, not a lifetime total.
      */
     amount: number;
 
@@ -398,6 +432,19 @@ export namespace CardVaultItemSpec {
 
     metadata?: { [key: string]: string };
 
+    /**
+     * Recurring terms for a subscription or other repeated purchase. The amount
+     * becomes the spending limit for each period of interval_count intervals, for
+     * example every 2 weeks. The merchant schedules charges. The card stays ready
+     * after each charge until it expires or is deleted; do not create a new card each
+     * period. Deleting the card, its wallet or its vault first cancels the credential
+     * with Link, so later charges decline; if Link cannot be reached, deletion returns
+     * 409 provider_revocation_pending and should be retried. Deletion does not cancel
+     * the subscription with the merchant. Recurring terms cannot be changed once the
+     * card is authorized.
+     */
+    recurring?: LinkCardVaultItemSpec.Recurring;
+
     totals?: Array<LinkCardVaultItemSpec.Total>;
   }
 
@@ -438,6 +485,26 @@ export namespace CardVaultItemSpec {
       }
     }
 
+    /**
+     * Recurring terms for a subscription or other repeated purchase. The amount
+     * becomes the spending limit for each period of interval_count intervals, for
+     * example every 2 weeks. The merchant schedules charges. The card stays ready
+     * after each charge until it expires or is deleted; do not create a new card each
+     * period. Deleting the card, its wallet or its vault first cancels the credential
+     * with Link, so later charges decline; if Link cannot be reached, deletion returns
+     * 409 provider_revocation_pending and should be retried. Deletion does not cancel
+     * the subscription with the merchant. Recurring terms cannot be changed once the
+     * card is authorized.
+     */
+    export interface Recurring {
+      interval: 'day' | 'week' | 'month' | 'year';
+
+      /**
+       * Number of intervals per period. Link defaults it to 1.
+       */
+      interval_count?: number;
+    }
+
     export interface Total {
       /**
        * Total amount in minor currency units.
@@ -713,7 +780,7 @@ export namespace CredentialAccountVaultItem {
   export interface AvailableExpansion {
     description: string;
 
-    type: 'payment_methods';
+    type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
   }
 
   /**
@@ -730,6 +797,9 @@ export namespace CredentialAccountVaultItem {
       | 'collect'
       | 'prepare_checkout'
       | 'fill'
+      | 'arm_passkey'
+      | 'register_passkey'
+      | 'disarm_passkey'
       | '1pw_create_access_request'
       | '1pw_access_request_status'
       | '1pw_fill'
@@ -819,7 +889,7 @@ export interface CredentialVaultFieldDefinition {
    * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
    * private key), a lowercase `rpId` domain, and optional `username` and
    * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-   * pages.
+   * pages; use arm_passkey to sign in with one and register_passkey to create one.
    */
   type: CredentialVaultFieldType;
 
@@ -855,7 +925,7 @@ export interface CredentialVaultFieldDefinitionInput {
    * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
    * private key), a lowercase `rpId` domain, and optional `username` and
    * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-   * pages.
+   * pages; use arm_passkey to sign in with one and register_passkey to create one.
    */
   type: CredentialVaultFieldType;
 
@@ -898,7 +968,7 @@ export interface CredentialVaultFieldInput {
    * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
    * private key), a lowercase `rpId` domain, and optional `username` and
    * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-   * pages.
+   * pages; use arm_passkey to sign in with one and register_passkey to create one.
    */
   type: CredentialVaultFieldType;
 
@@ -971,7 +1041,7 @@ export interface CredentialVaultFieldState {
  * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
  * private key), a lowercase `rpId` domain, and optional `username` and
  * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
- * pages.
+ * pages; use arm_passkey to sign in with one and register_passkey to create one.
  */
 export type CredentialVaultFieldType = 'text' | 'email' | 'password' | 'totp' | 'passkey';
 
@@ -1088,7 +1158,7 @@ export namespace CredentialVaultItem {
   export interface AvailableExpansion {
     description: string;
 
-    type: 'payment_methods';
+    type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
   }
 
   /**
@@ -1105,6 +1175,9 @@ export namespace CredentialVaultItem {
       | 'collect'
       | 'prepare_checkout'
       | 'fill'
+      | 'arm_passkey'
+      | 'register_passkey'
+      | 'disarm_passkey'
       | '1pw_create_access_request'
       | '1pw_access_request_status'
       | '1pw_fill'
@@ -1243,6 +1316,26 @@ export interface CredentialVaultItemUpdateRequest {
   expected_item_id?: string;
 }
 
+/**
+ * Stop a browser from using this item's passkeys: removes its armed passkeys and
+ * its pending registration into this item. Pages that already loaded keep Kernel's
+ * WebAuthn handler but get the browser's own behavior.
+ */
+export interface DisarmPasskeyVaultItemOperationRequest {
+  /**
+   * Browser session ID, not a reusable browser name.
+   */
+  browser_id: string;
+
+  type: 'disarm_passkey';
+
+  /**
+   * Limit disarming to one passkey field. Omit to disarm every passkey field of the
+   * item.
+   */
+  field?: string;
+}
+
 /**
  * Use a vault item in a browser session, for example to fill a login or payment
  * form. Only invoke when the item advertises `fill`; the advertised operation
@@ -1291,7 +1384,8 @@ export interface FillVaultItemOperationRequest {
   page_url?: string;
 
   /**
-   * Total operation deadline in milliseconds, not a per-field timeout.
+   * @deprecated Ignored. Fill sets no operation deadline; typing pace adapts to the
+   * length of the values instead. Accepted for compatibility.
    */
   timeout_ms?: number;
 }
@@ -1327,8 +1421,11 @@ export interface KernelCardState {
   provider: 'kernel';
 
   /**
-   * pending_authorization on a Visa purchase waits for the cardholder to approve it
-   * through the spend_approval action; an unused link expires after 30 minutes.
+   * pending_authorization waits for cardholder approval on Visa purchases or fresh
+   * security-code collection on alias-mode purchases through the spend_approval
+   * action; an unused link expires after 30 minutes. Alias-mode cards become ready
+   * after collection and expire at the temporary security-code alias deadline, by
+   * default five minutes later. An expired alias purchase requires a new card.
    * recovery_required means verification, approving the purchase or issuing the
    * one-time code has an unresolved outcome. A server-classified initial attestation
    * failure before intent dispatch may advertise restart_verification to prepare a
@@ -1386,12 +1483,13 @@ export namespace KernelCardState {
  * spend_approval action: the cardholder approves it with a Visa passkey, and
  * Kernel registers a Visa intent for one transaction up to the amount before
  * issuing the code. For supported cards whose network cannot be enrolled for
- * agentic tokens, authorize prepares checkout details without issuing a one-time
- * code. The card can be filled into one checkout before its expires_at, one hour
- * after authorization. Fill types those details on merchant_url's origin. The
- * amount, merchant_url and merchant_country are recorded but do not restrict
- * payment requests sent by the browser. Card updates are not supported; delete and
- * create a new item instead.
+ * agentic tokens, authorize returns pending_authorization with a spend_approval
+ * action to collect a fresh security code in a hosted field. Once collected, the
+ * card is ready and can be filled before its expires_at, by default five minutes
+ * after collection. An expired card requires a new purchase. Fill types those
+ * details on merchant_url's origin. The amount, merchant_url and merchant_country
+ * are recorded but do not restrict payment requests sent by the browser. Card
+ * updates are not supported; delete and create a new item instead.
  */
 export interface KernelCardVaultItemSpec {
   /**
@@ -1527,6 +1625,196 @@ export interface KernelWalletVaultItemSpec {
   provider: 'kernel';
 }
 
+/**
+ * One entry of Link's `GET /shipping_addresses` response, passed through as Link
+ * reports it. Kernel never stores it.
+ */
+export interface LinkShippingAddress {
+  /**
+   * Link shipping address ID.
+   */
+  id: string;
+
+  is_default: boolean;
+
+  nickname: string | null;
+
+  /**
+   * Link's nullable postal address fields. Omitted from the shipping address when
+   * Link reports null.
+   */
+  address?: LinkShippingAddress.Address;
+}
+
+export namespace LinkShippingAddress {
+  /**
+   * Link's nullable postal address fields. Omitted from the shipping address when
+   * Link reports null.
+   */
+  export interface Address {
+    /**
+     * State, province or region.
+     */
+    administrative_area: string | null;
+
+    country_code: string | null;
+
+    dependent_locality: string | null;
+
+    line_1: string | null;
+
+    line_2: string | null;
+
+    /**
+     * City or town.
+     */
+    locality: string | null;
+
+    name: string | null;
+
+    postal_code: string | null;
+
+    sorting_code: string | null;
+  }
+}
+
+/**
+ * Link's `GET /userinfo` response for the connected wallet, passed through as Link
+ * reports it when the `link_user_info` expansion is requested. Kernel never stores
+ * it. Null fields are null at Link; omitted fields were not reported. Amounts are
+ * in the minor unit of `default_spend_request_currency`.
+ */
+export interface LinkUserInfo {
+  /**
+   * Stable Link user ID.
+   */
+  id: string | null;
+
+  email: string | null;
+
+  first_name: string | null;
+
+  last_name: string | null;
+
+  name: string | null;
+
+  phone: string | null;
+
+  /**
+   * The Link user's postal address. Omitted when Link reports none.
+   */
+  address?: LinkUserInfo.Address;
+
+  /**
+   * Link's agent wallet spend limits, per transaction and over rolling periods.
+   */
+  agent_wallet_spend_limits?: LinkUserInfo.AgentWalletSpendLimits;
+
+  /**
+   * Verification Link requires from the user before the agent wallet can spend.
+   */
+  agent_wallet_step_up?: LinkUserInfo.AgentWalletStepUp;
+
+  /**
+   * Lowercase ISO currency Link applies to a spend request created without one.
+   */
+  default_spend_request_currency?: string;
+
+  /**
+   * Whether the user can fund purchases from a Link balance.
+   */
+  eligible_for_balance?: boolean;
+}
+
+export namespace LinkUserInfo {
+  /**
+   * The Link user's postal address. Omitted when Link reports none.
+   */
+  export interface Address {
+    city: string | null;
+
+    country: string | null;
+
+    line1: string | null;
+
+    line2: string | null;
+
+    postal_code: string | null;
+
+    state: string | null;
+  }
+
+  /**
+   * Link's agent wallet spend limits, per transaction and over rolling periods.
+   */
+  export interface AgentWalletSpendLimits {
+    daily: AgentWalletSpendLimits.Daily;
+
+    per_transaction: AgentWalletSpendLimits.PerTransaction;
+
+    thirty_day: AgentWalletSpendLimits.ThirtyDay;
+  }
+
+  export namespace AgentWalletSpendLimits {
+    export interface Daily {
+      /**
+       * Null means unlimited.
+       */
+      limit: number | null;
+
+      /**
+       * Amount still available in the rolling period; null means unlimited.
+       */
+      remaining: number | null;
+
+      /**
+       * Amount already spent in the rolling period.
+       */
+      used: number;
+    }
+
+    export interface PerTransaction {
+      /**
+       * Null means unlimited.
+       */
+      limit: number | null;
+    }
+
+    export interface ThirtyDay {
+      /**
+       * Null means unlimited.
+       */
+      limit: number | null;
+
+      /**
+       * Amount still available in the rolling period; null means unlimited.
+       */
+      remaining: number | null;
+
+      /**
+       * Amount already spent in the rolling period.
+       */
+      used: number;
+    }
+  }
+
+  /**
+   * Verification Link requires from the user before the agent wallet can spend.
+   */
+  export interface AgentWalletStepUp {
+    /**
+     * URL where the user completes verification; null when no action is available.
+     */
+    action_url: string | null;
+
+    /**
+     * Link status such as not_required, ssn_verification, identity_verification,
+     * contact_support or complete.
+     */
+    status: string;
+  }
+}
+
 export interface ManagedAuthCredentialVaultField {
   /**
    * Text, email, and password have form inputs; totp and passkey do not and are
@@ -1541,7 +1829,7 @@ export interface ManagedAuthCredentialVaultField {
    * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
    * private key), a lowercase `rpId` domain, and optional `username` and
    * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-   * pages.
+   * pages; use arm_passkey to sign in with one and register_passkey to create one.
    */
   type: CredentialVaultFieldType;
 }
@@ -2006,6 +2294,22 @@ export interface OnePasswordRequestAccessVaultItemOperationRequest {
   reason?: string;
 }
 
+export interface PasskeyVaultItemOperationResult {
+  /**
+   * armed means the browser will answer matching passkey requests; it does not mean
+   * a page has asked yet. disarmed means the browser no longer uses this item's
+   * passkeys.
+   */
+  status: 'armed' | 'disarmed';
+
+  type: 'arm_passkey' | 'register_passkey' | 'disarm_passkey';
+
+  /**
+   * Relying party the armed passkey answers for. Returned by arm_passkey.
+   */
+  rp_id?: string;
+}
+
 /**
  * Prepare an unused AgentCard card for a supported checkout. Deliver the returned
  * approval URL and keep the approval page open. Poll the item until
@@ -2027,6 +2331,35 @@ export interface PrepareCheckoutVaultItemOperationRequest {
   type: 'prepare_checkout';
 }
 
+/**
+ * Let a browser attached to the item's vault create a passkey on a website and
+ * store it in an empty passkey field. Only invoke when the item advertises
+ * `register_passkey`; declare the field first, for example by adding an optional
+ * passkey field with a credential update. Returns immediately; there is no time
+ * limit. The next passkey a page in that browser creates
+ * (`navigator.credentials.create`) is generated by Kernel, stored in the field,
+ * and only then returned to the page, so the website never receives a passkey
+ * Kernel failed to store. Each browser has one pending registration; a later
+ * `register_passkey` replaces it. Drive the website's "add a passkey" flow with
+ * your own browser tools, then confirm by reading the item (the field reports
+ * `has_value`) or its `credential_passkey_registered` event, and by signing in
+ * with `arm_passkey`. Only ES256 passkeys are created.
+ */
+export interface RegisterPasskeyVaultItemOperationRequest {
+  /**
+   * Browser session ID, not a reusable browser name.
+   */
+  browser_id: string;
+
+  type: 'register_passkey';
+
+  /**
+   * Empty passkey field to store the new passkey in. Required when more than one
+   * passkey field is empty.
+   */
+  field?: string;
+}
+
 /**
  * Explicitly prepare a fresh local verification session for the same Kernel Visa
  * purchase and connected wallet, only when restart_verification is advertised.
@@ -2255,7 +2588,7 @@ export namespace VaultItem {
     export interface AvailableExpansion {
       description: string;
 
-      type: 'payment_methods';
+      type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
     }
 
     /**
@@ -2272,6 +2605,9 @@ export namespace VaultItem {
         | 'collect'
         | 'prepare_checkout'
         | 'fill'
+        | 'arm_passkey'
+        | 'register_passkey'
+        | 'disarm_passkey'
         | '1pw_create_access_request'
         | '1pw_access_request_status'
         | '1pw_fill'
@@ -2284,6 +2620,20 @@ export namespace VaultItem {
      * Live, non-persisted data requested through the item GET expand parameter.
      */
     export interface Expanded {
+      /**
+       * Link's saved shipping addresses, present when the `link_shipping_addresses`
+       * expansion is requested.
+       */
+      link_shipping_addresses?: Array<ItemsAPI.LinkShippingAddress>;
+
+      /**
+       * Link's `GET /userinfo` response for the connected wallet, passed through as Link
+       * reports it when the `link_user_info` expansion is requested. Kernel never stores
+       * it. Null fields are null at Link; omitted fields were not reported. Amounts are
+       * in the minor unit of `default_spend_request_currency`.
+       */
+      link_user_info?: ItemsAPI.LinkUserInfo;
+
       payment_methods?: Array<ItemsAPI.VaultPaymentMethod>;
     }
   }
@@ -2335,7 +2685,7 @@ export namespace VaultItem {
     export interface AvailableExpansion {
       description: string;
 
-      type: 'payment_methods';
+      type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
     }
 
     /**
@@ -2352,6 +2702,9 @@ export namespace VaultItem {
         | 'collect'
         | 'prepare_checkout'
         | 'fill'
+        | 'arm_passkey'
+        | 'register_passkey'
+        | 'disarm_passkey'
         | '1pw_create_access_request'
         | '1pw_access_request_status'
         | '1pw_fill'
@@ -2431,9 +2784,9 @@ export interface VaultItemEvent {
 }
 
 /**
- * Authorization and preparation return the existing item shape. Fill returns a
- * value-free result; WebMCP invocation returns the tool's output. Neither persists
- * transient outcomes on the item.
+ * Authorization and preparation return the existing item shape. Fill and passkey
+ * operations return value-free results; WebMCP invocation returns the tool's
+ * output. None persist transient outcomes on the item.
  */
 export type VaultItemOperationResponse =
   | VaultItemOperationResponse.WalletVaultItem
@@ -2441,6 +2794,7 @@ export type VaultItemOperationResponse =
   | CredentialAccountVaultItem
   | CredentialVaultItem
   | FillVaultItemOperationResult
+  | PasskeyVaultItemOperationResult
   | OnePasswordFillVaultItemOperationResult
   | WebmcpInvokeVaultItemOperationResult;
 
@@ -2506,7 +2860,7 @@ export namespace VaultItemOperationResponse {
     export interface AvailableExpansion {
       description: string;
 
-      type: 'payment_methods';
+      type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
     }
 
     /**
@@ -2523,6 +2877,9 @@ export namespace VaultItemOperationResponse {
         | 'collect'
         | 'prepare_checkout'
         | 'fill'
+        | 'arm_passkey'
+        | 'register_passkey'
+        | 'disarm_passkey'
         | '1pw_create_access_request'
         | '1pw_access_request_status'
         | '1pw_fill'
@@ -2535,6 +2892,20 @@ export namespace VaultItemOperationResponse {
      * Live, non-persisted data requested through the item GET expand parameter.
      */
     export interface Expanded {
+      /**
+       * Link's saved shipping addresses, present when the `link_shipping_addresses`
+       * expansion is requested.
+       */
+      link_shipping_addresses?: Array<ItemsAPI.LinkShippingAddress>;
+
+      /**
+       * Link's `GET /userinfo` response for the connected wallet, passed through as Link
+       * reports it when the `link_user_info` expansion is requested. Kernel never stores
+       * it. Null fields are null at Link; omitted fields were not reported. Amounts are
+       * in the minor unit of `default_spend_request_currency`.
+       */
+      link_user_info?: ItemsAPI.LinkUserInfo;
+
       payment_methods?: Array<ItemsAPI.VaultPaymentMethod>;
     }
   }
@@ -2586,7 +2957,7 @@ export namespace VaultItemOperationResponse {
     export interface AvailableExpansion {
       description: string;
 
-      type: 'payment_methods';
+      type: 'payment_methods' | 'link_user_info' | 'link_shipping_addresses';
     }
 
     /**
@@ -2603,6 +2974,9 @@ export namespace VaultItemOperationResponse {
         | 'collect'
         | 'prepare_checkout'
         | 'fill'
+        | 'arm_passkey'
+        | 'register_passkey'
+        | 'disarm_passkey'
         | '1pw_create_access_request'
         | '1pw_access_request_status'
         | '1pw_fill'
@@ -2912,7 +3286,7 @@ export interface ItemRetrieveParams {
    * Query param: Live fields advertised by `available_expansions` to include in
    * `expanded`.
    */
-  expand?: Array<'payment_methods'>;
+  expand?: Array<'payment_methods' | 'link_user_info' | 'link_shipping_addresses'>;
 
   /**
    * Query param: Hold for up to this many seconds while the item is pending
@@ -3011,6 +3385,9 @@ export type ItemPerformOperationParams =
   | ItemPerformOperationParams.CollectVaultItemOperationRequest
   | ItemPerformOperationParams.PrepareCheckoutVaultItemOperationRequest
   | ItemPerformOperationParams.FillVaultItemOperationRequest
+  | ItemPerformOperationParams.ArmPasskeyVaultItemOperationRequest
+  | ItemPerformOperationParams.RegisterPasskeyVaultItemOperationRequest
+  | ItemPerformOperationParams.DisarmPasskeyVaultItemOperationRequest
   | ItemPerformOperationParams.OnePasswordRequestAccessVaultItemOperationRequest
   | ItemPerformOperationParams.OnePasswordPollAccessVaultItemOperationRequest
   | ItemPerformOperationParams.OnePasswordFillVaultItemOperationRequest
@@ -3172,11 +3549,81 @@ export declare namespace ItemPerformOperationParams {
     page_url?: string;
 
     /**
-     * Body param: Total operation deadline in milliseconds, not a per-field timeout.
+     * @deprecated Body param: Ignored. Fill sets no operation deadline; typing pace
+     * adapts to the length of the values instead. Accepted for compatibility.
      */
     timeout_ms?: number;
   }
 
+  export interface ArmPasskeyVaultItemOperationRequest {
+    /**
+     * Path param
+     */
+    id_or_name: string;
+
+    /**
+     * Body param: Browser session ID, not a reusable browser name.
+     */
+    browser_id: string;
+
+    /**
+     * Body param
+     */
+    type: 'arm_passkey';
+
+    /**
+     * Body param: Passkey field to arm. Required when more than one passkey field
+     * holds a passkey.
+     */
+    field?: string;
+  }
+
+  export interface RegisterPasskeyVaultItemOperationRequest {
+    /**
+     * Path param
+     */
+    id_or_name: string;
+
+    /**
+     * Body param: Browser session ID, not a reusable browser name.
+     */
+    browser_id: string;
+
+    /**
+     * Body param
+     */
+    type: 'register_passkey';
+
+    /**
+     * Body param: Empty passkey field to store the new passkey in. Required when more
+     * than one passkey field is empty.
+     */
+    field?: string;
+  }
+
+  export interface DisarmPasskeyVaultItemOperationRequest {
+    /**
+     * Path param
+     */
+    id_or_name: string;
+
+    /**
+     * Body param: Browser session ID, not a reusable browser name.
+     */
+    browser_id: string;
+
+    /**
+     * Body param
+     */
+    type: 'disarm_passkey';
+
+    /**
+     * Body param: Limit disarming to one passkey field. Omit to disarm every passkey
+     * field of the item.
+     */
+    field?: string;
+  }
+
   export interface OnePasswordRequestAccessVaultItemOperationRequest {
     /**
      * Path param
@@ -3594,6 +4041,7 @@ export declare namespace Items {
     type AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization,
     type AgentcardCheckoutPreparation as AgentcardCheckoutPreparation,
     type AgentcardPreparedProcessor as AgentcardPreparedProcessor,
+    type ArmPasskeyVaultItemOperationRequest as ArmPasskeyVaultItemOperationRequest,
     type AuthorizeVaultItemOperationRequest as AuthorizeVaultItemOperationRequest,
     type CardVaultItemSpec as CardVaultItemSpec,
     type CardVaultItemState as CardVaultItemState,
@@ -3615,6 +4063,7 @@ export declare namespace Items {
     type CredentialVaultItemSpecUpdate as CredentialVaultItemSpecUpdate,
     type CredentialVaultItemState as CredentialVaultItemState,
     type CredentialVaultItemUpdateRequest as CredentialVaultItemUpdateRequest,
+    type DisarmPasskeyVaultItemOperationRequest as DisarmPasskeyVaultItemOperationRequest,
     type FillVaultItemOperationRequest as FillVaultItemOperationRequest,
     type FillVaultItemOperationResult as FillVaultItemOperationResult,
     type KernelCardState as KernelCardState,
@@ -3624,6 +4073,8 @@ export declare namespace Items {
     type KernelCredentialVaultItemState as KernelCredentialVaultItemState,
     type KernelWalletState as KernelWalletState,
     type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec,
+    type LinkShippingAddress as LinkShippingAddress,
+    type LinkUserInfo as LinkUserInfo,
     type ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField,
     type ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec,
     type ManagedAuthCredentialVaultItemSpecInput as ManagedAuthCredentialVaultItemSpecInput,
@@ -3638,7 +4089,9 @@ export declare namespace Items {
     type OnePasswordOAuthAction as OnePasswordOAuthAction,
     type OnePasswordRecoverVaultItemOperationRequest as OnePasswordRecoverVaultItemOperationRequest,
     type OnePasswordRequestAccessVaultItemOperationRequest as OnePasswordRequestAccessVaultItemOperationRequest,
+    type PasskeyVaultItemOperationResult as PasskeyVaultItemOperationResult,
     type PrepareCheckoutVaultItemOperationRequest as PrepareCheckoutVaultItemOperationRequest,
+    type RegisterPasskeyVaultItemOperationRequest as RegisterPasskeyVaultItemOperationRequest,
     type RestartVerificationVaultItemOperationRequest as RestartVerificationVaultItemOperationRequest,
     type VaultCardAliases as VaultCardAliases,
     type VaultCardFillField as VaultCardFillField,