kernel 0.129.0__tar.gz → 0.131.0__tar.gz

kernel-0.131.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.131.0"
+}

{kernel-0.129.0 → kernel-0.131.0}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.131.0](https://github.com/kernel/kernel-python-sdk/compare/v0.130.0...v0.131.0) (2026-10-26)
+
+
+### Features
+
+* Arm vault passkeys in browsers and sign WebAuthn requests in metro-api ([b740930](https://github.com/kernel/kernel-python-sdk/commit/b7409304f4ed37a03004683db63b079052f387bb))
+
+## [0.130.0](https://github.com/kernel/kernel-python-sdk/compare/v0.129.0...v0.130.0) (2026-10-24)
+
+
+### Features
+
+* Fall back to aliases after network token enrollment failures ([5930892](https://github.com/kernel/kernel-python-sdk/commit/5930892a91a3f212f27dfdaab4412bf972a4973f))
+
+
+### Bug Fixes
+
+* continue offset pagination past empty pages ([80908e4](https://github.com/kernel/kernel-python-sdk/commit/80908e4a5fae05aedc1db65f67b70a34781273d2))
+* follow offset cursors in either direction ([bfcfa9a](https://github.com/kernel/kernel-python-sdk/commit/bfcfa9aac5a1420fced2960757ce80f197be257a))
+
 ## [0.129.0](https://github.com/kernel/kernel-python-sdk/compare/v0.128.0...v0.129.0) (2026-10-21)
 
 

{kernel-0.129.0 → kernel-0.131.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.129.0
+Version: 0.131.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.129.0 → kernel-0.131.0}/api.md

@@ -572,6 +572,7 @@ from kernel.types.vaults import (
     AgentcardCheckoutAuthorization,
     AgentcardCheckoutPreparation,
     AgentcardPreparedProcessor,
+    ArmPasskeyVaultItemOperationRequest,
     AuthorizeVaultItemOperationRequest,
     CardVaultItemSpec,
     CardVaultItemState,
@@ -593,6 +594,7 @@ from kernel.types.vaults import (
     CredentialVaultItemSpecUpdate,
     CredentialVaultItemState,
     CredentialVaultItemUpdateRequest,
+    DisarmPasskeyVaultItemOperationRequest,
     FillVaultItemOperationRequest,
     FillVaultItemOperationResult,
     KernelCardState,
@@ -602,6 +604,8 @@ from kernel.types.vaults import (
     KernelCredentialVaultItemState,
     KernelWalletState,
     KernelWalletVaultItemSpec,
+    LinkShippingAddress,
+    LinkUserInfo,
     ManagedAuthCredentialVaultField,
     ManagedAuthCredentialVaultItemSpec,
     ManagedAuthCredentialVaultItemSpecInput,
@@ -616,7 +620,9 @@ from kernel.types.vaults import (
     OnePasswordOAuthAction,
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordRequestAccessVaultItemOperationRequest,
+    PasskeyVaultItemOperationResult,
     PrepareCheckoutVaultItemOperationRequest,
+    RegisterPasskeyVaultItemOperationRequest,
     RestartVerificationVaultItemOperationRequest,
     VaultCardAliases,
     VaultCardFillField,

{kernel-0.129.0 → kernel-0.131.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.129.0"
+version = "0.131.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.129.0 → kernel-0.131.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.129.0"  # x-release-please-version
+__version__ = "0.131.0"  # x-release-please-version

{kernel-0.129.0 → kernel-0.131.0}/src/kernel/pagination.py

@@ -114,7 +114,7 @@ class SyncOffsetPagination(BaseSyncPage[_T], BasePage[_T], Generic[_T]):
         if has_more is not None and has_more is False:
             return False
 
-        return super().has_next_page()
+        return self.next_page_info() is not None
 
     @override
     def next_page_info(self) -> Optional[PageInfo]:
@@ -133,6 +133,12 @@ class SyncOffsetPagination(BaseSyncPage[_T], BasePage[_T], Generic[_T]):
         if next_offset == 0:
             return None
 
+        # Cursors can move in either direction. Stop only when the server repeats
+        # the cursor and would re-request the same page.
+        request_offset = self._options.params.get("offset")
+        if isinstance(request_offset, int) and next_offset == request_offset:
+            return None
+
         return PageInfo(params={"offset": next_offset})
 
     @classmethod
@@ -165,7 +171,7 @@ class AsyncOffsetPagination(BaseAsyncPage[_T], BasePage[_T], Generic[_T]):
         if has_more is not None and has_more is False:
             return False
 
-        return super().has_next_page()
+        return self.next_page_info() is not None
 
     @override
     def next_page_info(self) -> Optional[PageInfo]:
@@ -184,6 +190,12 @@ class AsyncOffsetPagination(BaseAsyncPage[_T], BasePage[_T], Generic[_T]):
         if next_offset == 0:
             return None
 
+        # Cursors can move in either direction. Stop only when the server repeats
+        # the cursor and would re-request the same page.
+        request_offset = self._options.params.get("offset")
+        if isinstance(request_offset, int) and next_offset == request_offset:
+            return None
+
         return PageInfo(params={"offset": next_offset})
 
     @classmethod

{kernel-0.129.0 → kernel-0.131.0}/src/kernel/resources/vaults/items.py

@@ -66,7 +66,7 @@ class ItemsResource(SyncAPIResource):
         key: str,
         *,
         id_or_name: str,
-        expand: List[Literal["payment_methods"]] | Omit = omit,
+        expand: List[Literal["payment_methods", "link_user_info", "link_shipping_addresses"]] | Omit = omit,
         wait: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -746,7 +746,181 @@ class ItemsResource(SyncAPIResource):
               prefix or glob matching. When an item allows omitting it, the browser must have
               exactly one open page.
 
-          timeout_ms: Total operation deadline in milliseconds, not a per-field timeout.
+          timeout_ms: Ignored. Fill sets no operation deadline; typing pace adapts to the length of
+              the values instead. Accepted for compatibility.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["arm_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Passkey field to arm. Required when more than one passkey field holds a passkey.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["register_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Empty passkey field to store the new passkey in. Required when more than one
+              passkey field is empty.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["disarm_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Limit disarming to one passkey field. Omit to disarm every passkey field of the
+              item.
 
           extra_headers: Send extra headers
 
@@ -1124,6 +1298,9 @@ class ItemsResource(SyncAPIResource):
         | Literal["collect"]
         | Literal["prepare_checkout"]
         | Literal["fill"]
+        | Literal["arm_passkey"]
+        | Literal["register_passkey"]
+        | Literal["disarm_passkey"]
         | Literal["1pw_create_access_request"]
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
@@ -1143,6 +1320,7 @@ class ItemsResource(SyncAPIResource):
         checkout: VaultCheckoutContextParam | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
         timeout_ms: int | Omit = omit,
+        field: str | Omit = omit,
         goal: str | Omit = omit,
         keywords: SequenceNotStr[str] | Omit = omit,
         reason: str | Omit = omit,
@@ -1182,6 +1360,7 @@ class ItemsResource(SyncAPIResource):
                         "checkout": checkout,
                         "fields": fields,
                         "timeout_ms": timeout_ms,
+                        "field": field,
                         "goal": goal,
                         "keywords": keywords,
                         "reason": reason,
@@ -1447,7 +1626,7 @@ class AsyncItemsResource(AsyncAPIResource):
         key: str,
         *,
         id_or_name: str,
-        expand: List[Literal["payment_methods"]] | Omit = omit,
+        expand: List[Literal["payment_methods", "link_user_info", "link_shipping_addresses"]] | Omit = omit,
         wait: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -2127,7 +2306,181 @@ class AsyncItemsResource(AsyncAPIResource):
               prefix or glob matching. When an item allows omitting it, the browser must have
               exactly one open page.
 
-          timeout_ms: Total operation deadline in milliseconds, not a per-field timeout.
+          timeout_ms: Ignored. Fill sets no operation deadline; typing pace adapts to the length of
+              the values instead. Accepted for compatibility.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["arm_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Passkey field to arm. Required when more than one passkey field holds a passkey.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["register_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Empty passkey field to store the new passkey in. Required when more than one
+              passkey field is empty.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["disarm_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Limit disarming to one passkey field. Omit to disarm every passkey field of the
+              item.
 
           extra_headers: Send extra headers
 
@@ -2505,6 +2858,9 @@ class AsyncItemsResource(AsyncAPIResource):
         | Literal["collect"]
         | Literal["prepare_checkout"]
         | Literal["fill"]
+        | Literal["arm_passkey"]
+        | Literal["register_passkey"]
+        | Literal["disarm_passkey"]
         | Literal["1pw_create_access_request"]
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
@@ -2524,6 +2880,7 @@ class AsyncItemsResource(AsyncAPIResource):
         checkout: VaultCheckoutContextParam | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
         timeout_ms: int | Omit = omit,
+        field: str | Omit = omit,
         goal: str | Omit = omit,
         keywords: SequenceNotStr[str] | Omit = omit,
         reason: str | Omit = omit,
@@ -2563,6 +2920,7 @@ class AsyncItemsResource(AsyncAPIResource):
                         "checkout": checkout,
                         "fields": fields,
                         "timeout_ms": timeout_ms,
+                        "field": field,
                         "goal": goal,
                         "keywords": keywords,
                         "reason": reason,

{kernel-0.129.0 → kernel-0.131.0}/src/kernel/types/vaults/__init__.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from .vault_item import VaultItem as VaultItem
+from .link_user_info import LinkUserInfo as LinkUserInfo
 from .vault_item_event import VaultItemEvent as VaultItemEvent
 from .kernel_card_state import KernelCardState as KernelCardState
 from .vault_item_action import VaultItemAction as VaultItemAction
@@ -18,6 +19,7 @@ from .item_retrieve_params import ItemRetrieveParams as ItemRetrieveParams
 from .vault_payment_method import VaultPaymentMethod as VaultPaymentMethod
 from .card_vault_item_state import CardVaultItemState as CardVaultItemState
 from .credential_vault_item import CredentialVaultItem as CredentialVaultItem
+from .link_shipping_address import LinkShippingAddress as LinkShippingAddress
 from .vault_fill_field_param import VaultFillFieldParam as VaultFillFieldParam
 from .wallet_vault_item_spec import WalletVaultItemSpec as WalletVaultItemSpec
 from .vault_fill_field_result import VaultFillFieldResult as VaultFillFieldResult
@@ -49,6 +51,7 @@ from .credential_vault_field_update_param import CredentialVaultFieldUpdateParam
 from .credential_vault_item_request_param import CredentialVaultItemRequestParam as CredentialVaultItemRequestParam
 from .kernel_wallet_vault_item_spec_param import KernelWalletVaultItemSpecParam as KernelWalletVaultItemSpecParam
 from .managed_auth_credential_vault_field import ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField
+from .passkey_vault_item_operation_result import PasskeyVaultItemOperationResult as PasskeyVaultItemOperationResult
 from .one_password_credential_account_spec import OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec
 from .one_password_credential_account_state import (
     OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
@@ -101,9 +104,15 @@ from .kernel_credential_vault_item_spec_input_param import (
 from .one_password_fill_vault_item_operation_result import (
     OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult,
 )
+from .arm_passkey_vault_item_operation_request_param import (
+    ArmPasskeyVaultItemOperationRequestParam as ArmPasskeyVaultItemOperationRequestParam,
+)
 from .webmcp_invoke_vault_item_operation_request_param import (
     WebmcpInvokeVaultItemOperationRequestParam as WebmcpInvokeVaultItemOperationRequestParam,
 )
+from .disarm_passkey_vault_item_operation_request_param import (
+    DisarmPasskeyVaultItemOperationRequestParam as DisarmPasskeyVaultItemOperationRequestParam,
+)
 from .managed_auth_credential_vault_item_spec_input_param import (
     ManagedAuthCredentialVaultItemSpecInputParam as ManagedAuthCredentialVaultItemSpecInputParam,
 )
@@ -113,6 +122,9 @@ from .one_password_credential_vault_item_spec_input_param import (
 from .prepare_checkout_vault_item_operation_request_param import (
     PrepareCheckoutVaultItemOperationRequestParam as PrepareCheckoutVaultItemOperationRequestParam,
 )
+from .register_passkey_vault_item_operation_request_param import (
+    RegisterPasskeyVaultItemOperationRequestParam as RegisterPasskeyVaultItemOperationRequestParam,
+)
 from .one_password_fill_vault_item_operation_request_param import (
     OnePasswordFillVaultItemOperationRequestParam as OnePasswordFillVaultItemOperationRequestParam,
 )

kernel-0.131.0/src/kernel/types/vaults/arm_passkey_vault_item_operation_request_param.py

@@ -0,0 +1,41 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["ArmPasskeyVaultItemOperationRequestParam"]
+
+
+class ArmPasskeyVaultItemOperationRequestParam(TypedDict, total=False):
+    """
+    Let a browser attached to the item's vault sign in with a stored passkey.
+    Only invoke when the item advertises `arm_passkey`. Returns immediately;
+    there is no time limit. While armed, when a page in that browser whose
+    origin matches the passkey's relying party asks for a passkey
+    (`navigator.credentials.get`, including autofill requests made at page
+    load), Kernel answers with this passkey. The private key never enters the
+    browser: Kernel signs on its servers, using the origin Chrome reports for
+    the requesting frame. Arming a passkey for a relying party replaces any
+    passkey armed earlier in the browser for the same relying party. The arm
+    lasts until `disarm_passkey`, the browser ends, the vault is detached, or
+    the item or field is deleted. Drive the sign-in with your own browser
+    tools and inspect the page to confirm it. A page opened in a new tab
+    or window can run its first scripts before Kernel's handler attaches;
+    if such a page asks for a passkey as soon as it loads, reload it. While
+    armed, any script running on the relying party's pages can obtain a
+    sign-in without user interaction, as with a password manager that
+    fills automatically; disarm when the task is done. Passkeys report a
+    signature counter of 0 and backup flags, as synced passkeys do.
+    """
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    type: Required[Literal["arm_passkey"]]
+
+    field: str
+    """Passkey field to arm.
+
+    Required when more than one passkey field holds a passkey.
+    """