kernel 0.123.0__tar.gz → 0.125.0__tar.gz

kernel-0.125.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.125.0"
+}

{kernel-0.123.0 → kernel-0.125.0}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.125.0](https://github.com/kernel/kernel-python-sdk/compare/v0.124.0...v0.125.0) (2026-10-13)
+
+
+### Features
+
+* chore(stlc): seal custom-code tracking files ([a77f648](https://github.com/kernel/kernel-python-sdk/commit/a77f648fb68c7b4e6f93826238e9ac21ab39a4dd))
+
+## [0.124.0](https://github.com/kernel/kernel-python-sdk/compare/v0.123.0...v0.124.0) (2026-10-13)
+
+
+### Features
+
+* Accept intent creation without a fixed status ([e6e016a](https://github.com/kernel/kernel-python-sdk/commit/e6e016a5cea493c505b16a05cb8ad2fa6ed9f13b))
+* Complete Visa vault verification and transaction reporting ([fc4b0de](https://github.com/kernel/kernel-python-sdk/commit/fc4b0de79e3242361ef7b11acbd2cbaeb058265e))
+
+
+### Bug Fixes
+
+* seal browser pool acquire SDK results ([4d81af2](https://github.com/kernel/kernel-python-sdk/commit/4d81af2b6103571b59cd1bb520eb85e28488b51c))
+
 ## [0.123.0](https://github.com/kernel/kernel-python-sdk/compare/v0.122.0...v0.123.0) (2026-10-09)
 
 

{kernel-0.123.0 → kernel-0.125.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.123.0
+Version: 0.125.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.123.0 → kernel-0.125.0}/api.md

@@ -571,6 +571,7 @@ from kernel.types.vaults import (
     CardVaultItemSpec,
     CardVaultItemState,
     CollectVaultItemOperationRequest,
+    ConfirmTransactionVaultItemOperationRequest,
     CredentialAccountVaultItem,
     CredentialAccountVaultItemRequest,
     CredentialCollectionAction,
@@ -610,6 +611,7 @@ from kernel.types.vaults import (
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordRequestAccessVaultItemOperationRequest,
     PrepareCheckoutVaultItemOperationRequest,
+    RestartVerificationVaultItemOperationRequest,
     VaultCardAliases,
     VaultCardFillField,
     VaultCheckoutContext,

{kernel-0.123.0 → kernel-0.125.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.123.0"
+version = "0.125.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.123.0 → kernel-0.125.0}/src/kernel/_response.py

@@ -24,7 +24,7 @@ import anyio
 import httpx
 import pydantic
 
-from ._types import NoneType
+from ._types import NoneType, NoContentAsNone
 from ._utils import is_given, extract_type_arg, is_annotated_type, is_type_alias_type, extract_type_var_from_base
 from ._models import BaseModel, is_basemodel
 from ._constants import RAW_RESPONSE_HEADER, OVERRIDE_CAST_TO_HEADER
@@ -185,6 +185,13 @@ class BaseAPIResponse(Generic[R]):
             return cast(R, None)
 
         response = self.http_response
+        if (
+            response.status_code == 204
+            and to is None
+            and isinstance(origin, type)
+            and issubclass(origin, NoContentAsNone)
+        ):
+            return cast(R, None)
         if cast_to == str:
             return cast(R, response.text)
 

{kernel-0.123.0 → kernel-0.125.0}/src/kernel/_types.py

@@ -44,6 +44,12 @@ AsyncTransport = AsyncBaseTransport
 Query = Mapping[str, object]
 Body = object
 AnyMapping = Mapping[str, object]
+
+
+class NoContentAsNone:
+    pass
+
+
 ModelT = TypeVar("ModelT", bound=pydantic.BaseModel)
 _T = TypeVar("_T")
 

{kernel-0.123.0 → kernel-0.125.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.123.0"  # x-release-please-version
+__version__ = "0.125.0"  # x-release-please-version

{kernel-0.123.0 → kernel-0.125.0}/src/kernel/resources/api_keys.py

@@ -2,7 +2,8 @@
 
 from __future__ import annotations
 
-from typing import Optional
+from typing import Union, Optional
+from datetime import datetime
 from typing_extensions import Literal
 
 import httpx
@@ -59,6 +60,8 @@ class APIKeysResource(SyncAPIResource):
         *,
         name: str,
         days_to_expire: Optional[int] | Omit = omit,
+        expires_at: Union[str, datetime, None] | Omit = omit,
+        policy: api_key_create_params.Policy | Omit = omit,
         project_id: Optional[str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -67,13 +70,22 @@ class APIKeysResource(SyncAPIResource):
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> CreatedAPIKey:
-        """
-        Create a new API key within the authenticated organization.
+        """Create a new API key.
+
+        API keys may be scoped by project and may include a
+        policy.
 
         Args:
           name: Label for the API key (1-255 characters). API keys are not addressable by name.
 
-          days_to_expire: Number of days until expiry, up to 3650. Use null for never.
+          days_to_expire: Number of days until expiry, up to 3650. Use null for never. Cannot be combined
+              with expires_at.
+
+          expires_at: Exact expiry time. Must be in the future and no later than the issuing
+              credential's own expiry. Cannot be combined with days_to_expire.
+
+          policy: Issue a scoped key that may only perform the listed actions on the listed
+              resources.
 
           project_id: Unique project identifier
 
@@ -91,6 +103,8 @@ class APIKeysResource(SyncAPIResource):
                 {
                     "name": name,
                     "days_to_expire": days_to_expire,
+                    "expires_at": expires_at,
+                    "policy": policy,
                     "project_id": project_id,
                 },
                 api_key_create_params.APIKeyCreateParams,
@@ -377,6 +391,8 @@ class AsyncAPIKeysResource(AsyncAPIResource):
         *,
         name: str,
         days_to_expire: Optional[int] | Omit = omit,
+        expires_at: Union[str, datetime, None] | Omit = omit,
+        policy: api_key_create_params.Policy | Omit = omit,
         project_id: Optional[str] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -385,13 +401,22 @@ class AsyncAPIKeysResource(AsyncAPIResource):
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> CreatedAPIKey:
-        """
-        Create a new API key within the authenticated organization.
+        """Create a new API key.
+
+        API keys may be scoped by project and may include a
+        policy.
 
         Args:
           name: Label for the API key (1-255 characters). API keys are not addressable by name.
 
-          days_to_expire: Number of days until expiry, up to 3650. Use null for never.
+          days_to_expire: Number of days until expiry, up to 3650. Use null for never. Cannot be combined
+              with expires_at.
+
+          expires_at: Exact expiry time. Must be in the future and no later than the issuing
+              credential's own expiry. Cannot be combined with days_to_expire.
+
+          policy: Issue a scoped key that may only perform the listed actions on the listed
+              resources.
 
           project_id: Unique project identifier
 
@@ -409,6 +434,8 @@ class AsyncAPIKeysResource(AsyncAPIResource):
                 {
                     "name": name,
                     "days_to_expire": days_to_expire,
+                    "expires_at": expires_at,
+                    "policy": policy,
                     "project_id": project_id,
                 },
                 api_key_create_params.APIKeyCreateParams,

{kernel-0.123.0 → kernel-0.125.0}/src/kernel/resources/browser_pools.py

@@ -542,7 +542,7 @@ class BrowserPoolsResource(SyncAPIResource):
         extra_query: Query | None = None,
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
-    ) -> BrowserPoolAcquireResponse:
+    ) -> Optional[BrowserPoolAcquireResponse]:
         """Long-polling endpoint to acquire a browser from the pool.
 
         Returns immediately
@@ -1199,7 +1199,7 @@ class AsyncBrowserPoolsResource(AsyncAPIResource):
         extra_query: Query | None = None,
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
-    ) -> BrowserPoolAcquireResponse:
+    ) -> Optional[BrowserPoolAcquireResponse]:
         """Long-polling endpoint to acquire a browser from the pool.
 
         Returns immediately

{kernel-0.123.0 → kernel-0.125.0}/src/kernel/resources/browsers/playwright/playwright.py

@@ -114,10 +114,6 @@ class PlaywrightResource(SyncAPIResource):
         executors are not removed automatically while the browser runs; when it shuts
         down, they are removed and their tabs closed.
 
-        A named call to a browser whose image predates executors fails with 400 instead
-        of running on the active tab; calls without 'executor' keep working on every
-        image.
-
         Args:
           code: TypeScript/JavaScript code to execute. The code has access to 'page', 'context',
               and 'browser' variables. It runs within a function, so you can use a return
@@ -244,10 +240,6 @@ class AsyncPlaywrightResource(AsyncAPIResource):
         executors are not removed automatically while the browser runs; when it shuts
         down, they are removed and their tabs closed.
 
-        A named call to a browser whose image predates executors fails with 400 instead
-        of running on the active tab; calls without 'executor' keep working on every
-        image.
-
         Args:
           code: TypeScript/JavaScript code to execute. The code has access to 'page', 'context',
               and 'browser' variables. It runs within a function, so you can use a return

{kernel-0.123.0 → kernel-0.125.0}/src/kernel/resources/vaults/items.py

@@ -440,6 +440,113 @@ class ItemsResource(SyncAPIResource):
         """
         ...
 
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        type: Literal["restart_verification"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        amount: int,
+        currency: str,
+        occurred_at: Union[str, datetime],
+        status: Literal["APPROVED", "DECLINED", "PENDING", "ERROR", "CANCELLED"],
+        transaction_type: Literal[
+            "PURCHASE", "AUTHORIZATION", "CAPTURE", "REFUND", "REVERSAL", "VERIFICATION", "CHARGEBACK", "FRAUD"
+        ],
+        type: Literal["confirm_transaction"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          amount: Actual transaction amount in minor units, no greater than the approved limit.
+
+          currency: Must match the approved purchase currency.
+
+          occurred_at: Time the merchant outcome was observed.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @overload
     def perform_operation(
         self,
@@ -928,6 +1035,7 @@ class ItemsResource(SyncAPIResource):
 
     @required_args(
         ["id_or_name", "type"],
+        ["id_or_name", "amount", "currency", "occurred_at", "status", "transaction_type", "type"],
         ["id_or_name", "checkout", "type"],
         ["id_or_name", "browser_id", "fields", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
@@ -940,6 +1048,8 @@ class ItemsResource(SyncAPIResource):
         *,
         id_or_name: str,
         type: Literal["authorize"]
+        | Literal["restart_verification"]
+        | Literal["confirm_transaction"]
         | Literal["collect"]
         | Literal["prepare_checkout"]
         | Literal["fill"]
@@ -949,6 +1059,14 @@ class ItemsResource(SyncAPIResource):
         | Literal["1pw_recover"]
         | Literal["1pw_update_access_token"]
         | Literal["webmcp_invoke"],
+        amount: int | Omit = omit,
+        currency: str | Omit = omit,
+        occurred_at: Union[str, datetime] | Omit = omit,
+        status: Literal["APPROVED", "DECLINED", "PENDING", "ERROR", "CANCELLED"] | Omit = omit,
+        transaction_type: Literal[
+            "PURCHASE", "AUTHORIZATION", "CAPTURE", "REFUND", "REVERSAL", "VERIFICATION", "CHARGEBACK", "FRAUD"
+        ]
+        | Omit = omit,
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -983,6 +1101,11 @@ class ItemsResource(SyncAPIResource):
                 body=maybe_transform(
                     {
                         "type": type,
+                        "amount": amount,
+                        "currency": currency,
+                        "occurred_at": occurred_at,
+                        "status": status,
+                        "transaction_type": transaction_type,
                         "checkout": checkout,
                         "browser_id": browser_id,
                         "fields": fields,
@@ -1614,6 +1737,113 @@ class AsyncItemsResource(AsyncAPIResource):
         """
         ...
 
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        type: Literal["restart_verification"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        amount: int,
+        currency: str,
+        occurred_at: Union[str, datetime],
+        status: Literal["APPROVED", "DECLINED", "PENDING", "ERROR", "CANCELLED"],
+        transaction_type: Literal[
+            "PURCHASE", "AUTHORIZATION", "CAPTURE", "REFUND", "REVERSAL", "VERIFICATION", "CHARGEBACK", "FRAUD"
+        ],
+        type: Literal["confirm_transaction"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          amount: Actual transaction amount in minor units, no greater than the approved limit.
+
+          currency: Must match the approved purchase currency.
+
+          occurred_at: Time the merchant outcome was observed.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @overload
     async def perform_operation(
         self,
@@ -2102,6 +2332,7 @@ class AsyncItemsResource(AsyncAPIResource):
 
     @required_args(
         ["id_or_name", "type"],
+        ["id_or_name", "amount", "currency", "occurred_at", "status", "transaction_type", "type"],
         ["id_or_name", "checkout", "type"],
         ["id_or_name", "browser_id", "fields", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
@@ -2114,6 +2345,8 @@ class AsyncItemsResource(AsyncAPIResource):
         *,
         id_or_name: str,
         type: Literal["authorize"]
+        | Literal["restart_verification"]
+        | Literal["confirm_transaction"]
         | Literal["collect"]
         | Literal["prepare_checkout"]
         | Literal["fill"]
@@ -2123,6 +2356,14 @@ class AsyncItemsResource(AsyncAPIResource):
         | Literal["1pw_recover"]
         | Literal["1pw_update_access_token"]
         | Literal["webmcp_invoke"],
+        amount: int | Omit = omit,
+        currency: str | Omit = omit,
+        occurred_at: Union[str, datetime] | Omit = omit,
+        status: Literal["APPROVED", "DECLINED", "PENDING", "ERROR", "CANCELLED"] | Omit = omit,
+        transaction_type: Literal[
+            "PURCHASE", "AUTHORIZATION", "CAPTURE", "REFUND", "REVERSAL", "VERIFICATION", "CHARGEBACK", "FRAUD"
+        ]
+        | Omit = omit,
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -2157,6 +2398,11 @@ class AsyncItemsResource(AsyncAPIResource):
                 body=await async_maybe_transform(
                     {
                         "type": type,
+                        "amount": amount,
+                        "currency": currency,
+                        "occurred_at": occurred_at,
+                        "status": status,
+                        "transaction_type": transaction_type,
                         "checkout": checkout,
                         "browser_id": browser_id,
                         "fields": fields,

{kernel-0.123.0 → kernel-0.125.0}/src/kernel/types/api_key.py

@@ -1,11 +1,11 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
-from typing import Optional
+from typing import List, Optional
 from datetime import datetime
 
 from .._models import BaseModel
 
-__all__ = ["APIKey", "CreatedBy"]
+__all__ = ["APIKey", "CreatedBy", "Policy", "PolicyStatement"]
 
 
 class CreatedBy(BaseModel):
@@ -19,6 +19,27 @@ class CreatedBy(BaseModel):
     """Display name of the creator, if available."""
 
 
+class PolicyStatement(BaseModel):
+    action: str
+    """Permitted action, such as browsers:use or vaults:read."""
+
+    resource: str
+    """Resource the action applies to, in the format projects/{project_id}/{kind}/{id}.
+
+    Wildcards are supported.
+    """
+
+
+class Policy(BaseModel):
+    """Permissions granted to a scoped API key.
+
+    Absent for an ordinary key, which keeps unrestricted access within its organization or project.
+    """
+
+    statements: List[PolicyStatement]
+    """Allow statements. Every action and resource not listed is denied."""
+
+
 class APIKey(BaseModel):
     id: str
     """Unique API key identifier"""
@@ -55,3 +76,10 @@ class APIKey(BaseModel):
 
     Null means the key is org-wide or the project name is unavailable.
     """
+
+    policy: Optional[Policy] = None
+    """Permissions granted to a scoped API key.
+
+    Absent for an ordinary key, which keeps unrestricted access within its
+    organization or project.
+    """

kernel-0.125.0/src/kernel/types/api_key_create_params.py

@@ -0,0 +1,58 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Union, Iterable, Optional
+from datetime import datetime
+from typing_extensions import Required, Annotated, TypedDict
+
+from .._utils import PropertyInfo
+
+__all__ = ["APIKeyCreateParams", "Policy", "PolicyStatement"]
+
+
+class APIKeyCreateParams(TypedDict, total=False):
+    name: Required[str]
+    """Label for the API key (1-255 characters). API keys are not addressable by name."""
+
+    days_to_expire: Optional[int]
+    """Number of days until expiry, up to 3650.
+
+    Use null for never. Cannot be combined with expires_at.
+    """
+
+    expires_at: Annotated[Union[str, datetime, None], PropertyInfo(format="iso8601")]
+    """Exact expiry time.
+
+    Must be in the future and no later than the issuing credential's own expiry.
+    Cannot be combined with days_to_expire.
+    """
+
+    policy: Policy
+    """
+    Issue a scoped key that may only perform the listed actions on the listed
+    resources.
+    """
+
+    project_id: Optional[str]
+    """Unique project identifier"""
+
+
+class PolicyStatement(TypedDict, total=False):
+    action: Required[str]
+    """Permitted action, such as browsers:use or vaults:read."""
+
+    resource: Required[str]
+    """Resource the action applies to, in the format projects/{project_id}/{kind}/{id}.
+
+    Wildcards are supported.
+    """
+
+
+class Policy(TypedDict, total=False):
+    """
+    Issue a scoped key that may only perform the listed actions on the listed resources.
+    """
+
+    statements: Required[Iterable[PolicyStatement]]
+    """Allow statements. Every action and resource not listed is denied."""