kernel 0.130.0__tar.gz → 0.131.0__tar.gz

kernel-0.131.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.131.0"
+}

{kernel-0.130.0 → kernel-0.131.0}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.131.0](https://github.com/kernel/kernel-python-sdk/compare/v0.130.0...v0.131.0) (2026-10-26)
+
+
+### Features
+
+* Arm vault passkeys in browsers and sign WebAuthn requests in metro-api ([b740930](https://github.com/kernel/kernel-python-sdk/commit/b7409304f4ed37a03004683db63b079052f387bb))
+
 ## [0.130.0](https://github.com/kernel/kernel-python-sdk/compare/v0.129.0...v0.130.0) (2026-10-24)
 
 

{kernel-0.130.0 → kernel-0.131.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.130.0
+Version: 0.131.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.130.0 → kernel-0.131.0}/api.md

@@ -572,6 +572,7 @@ from kernel.types.vaults import (
     AgentcardCheckoutAuthorization,
     AgentcardCheckoutPreparation,
     AgentcardPreparedProcessor,
+    ArmPasskeyVaultItemOperationRequest,
     AuthorizeVaultItemOperationRequest,
     CardVaultItemSpec,
     CardVaultItemState,
@@ -593,6 +594,7 @@ from kernel.types.vaults import (
     CredentialVaultItemSpecUpdate,
     CredentialVaultItemState,
     CredentialVaultItemUpdateRequest,
+    DisarmPasskeyVaultItemOperationRequest,
     FillVaultItemOperationRequest,
     FillVaultItemOperationResult,
     KernelCardState,
@@ -618,7 +620,9 @@ from kernel.types.vaults import (
     OnePasswordOAuthAction,
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordRequestAccessVaultItemOperationRequest,
+    PasskeyVaultItemOperationResult,
     PrepareCheckoutVaultItemOperationRequest,
+    RegisterPasskeyVaultItemOperationRequest,
     RestartVerificationVaultItemOperationRequest,
     VaultCardAliases,
     VaultCardFillField,

{kernel-0.130.0 → kernel-0.131.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.130.0"
+version = "0.131.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.130.0 → kernel-0.131.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.130.0"  # x-release-please-version
+__version__ = "0.131.0"  # x-release-please-version

{kernel-0.130.0 → kernel-0.131.0}/src/kernel/resources/vaults/items.py

@@ -759,6 +759,179 @@ class ItemsResource(SyncAPIResource):
         """
         ...
 
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["arm_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Passkey field to arm. Required when more than one passkey field holds a passkey.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["register_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Empty passkey field to store the new passkey in. Required when more than one
+              passkey field is empty.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["disarm_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Limit disarming to one passkey field. Omit to disarm every passkey field of the
+              item.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @overload
     def perform_operation(
         self,
@@ -1125,6 +1298,9 @@ class ItemsResource(SyncAPIResource):
         | Literal["collect"]
         | Literal["prepare_checkout"]
         | Literal["fill"]
+        | Literal["arm_passkey"]
+        | Literal["register_passkey"]
+        | Literal["disarm_passkey"]
         | Literal["1pw_create_access_request"]
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
@@ -1144,6 +1320,7 @@ class ItemsResource(SyncAPIResource):
         checkout: VaultCheckoutContextParam | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
         timeout_ms: int | Omit = omit,
+        field: str | Omit = omit,
         goal: str | Omit = omit,
         keywords: SequenceNotStr[str] | Omit = omit,
         reason: str | Omit = omit,
@@ -1183,6 +1360,7 @@ class ItemsResource(SyncAPIResource):
                         "checkout": checkout,
                         "fields": fields,
                         "timeout_ms": timeout_ms,
+                        "field": field,
                         "goal": goal,
                         "keywords": keywords,
                         "reason": reason,
@@ -2141,6 +2319,179 @@ class AsyncItemsResource(AsyncAPIResource):
         """
         ...
 
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["arm_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Passkey field to arm. Required when more than one passkey field holds a passkey.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["register_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Empty passkey field to store the new passkey in. Required when more than one
+              passkey field is empty.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        browser_id: str,
+        type: Literal["disarm_passkey"],
+        field: str | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize; pass browser_id and page_url from the final checkout
+        page so Kernel can inspect the checkout. Eligible unused AgentCard cards
+        advertise prepare_checkout, which requires checkout context and obtains device
+        approval before native Square Pay. Keep the returned approval page open, poll
+        until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Ready Kernel cards advertise fill. Fill delivers card details for a few minutes;
+        submit checkout promptly after filling. A repeated fill is safe.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          field: Limit disarming to one passkey field. Omit to disarm every passkey field of the
+              item.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @overload
     async def perform_operation(
         self,
@@ -2507,6 +2858,9 @@ class AsyncItemsResource(AsyncAPIResource):
         | Literal["collect"]
         | Literal["prepare_checkout"]
         | Literal["fill"]
+        | Literal["arm_passkey"]
+        | Literal["register_passkey"]
+        | Literal["disarm_passkey"]
         | Literal["1pw_create_access_request"]
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
@@ -2526,6 +2880,7 @@ class AsyncItemsResource(AsyncAPIResource):
         checkout: VaultCheckoutContextParam | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
         timeout_ms: int | Omit = omit,
+        field: str | Omit = omit,
         goal: str | Omit = omit,
         keywords: SequenceNotStr[str] | Omit = omit,
         reason: str | Omit = omit,
@@ -2565,6 +2920,7 @@ class AsyncItemsResource(AsyncAPIResource):
                         "checkout": checkout,
                         "fields": fields,
                         "timeout_ms": timeout_ms,
+                        "field": field,
                         "goal": goal,
                         "keywords": keywords,
                         "reason": reason,

{kernel-0.130.0 → kernel-0.131.0}/src/kernel/types/vaults/__init__.py

@@ -51,6 +51,7 @@ from .credential_vault_field_update_param import CredentialVaultFieldUpdateParam
 from .credential_vault_item_request_param import CredentialVaultItemRequestParam as CredentialVaultItemRequestParam
 from .kernel_wallet_vault_item_spec_param import KernelWalletVaultItemSpecParam as KernelWalletVaultItemSpecParam
 from .managed_auth_credential_vault_field import ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField
+from .passkey_vault_item_operation_result import PasskeyVaultItemOperationResult as PasskeyVaultItemOperationResult
 from .one_password_credential_account_spec import OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec
 from .one_password_credential_account_state import (
     OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
@@ -103,9 +104,15 @@ from .kernel_credential_vault_item_spec_input_param import (
 from .one_password_fill_vault_item_operation_result import (
     OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult,
 )
+from .arm_passkey_vault_item_operation_request_param import (
+    ArmPasskeyVaultItemOperationRequestParam as ArmPasskeyVaultItemOperationRequestParam,
+)
 from .webmcp_invoke_vault_item_operation_request_param import (
     WebmcpInvokeVaultItemOperationRequestParam as WebmcpInvokeVaultItemOperationRequestParam,
 )
+from .disarm_passkey_vault_item_operation_request_param import (
+    DisarmPasskeyVaultItemOperationRequestParam as DisarmPasskeyVaultItemOperationRequestParam,
+)
 from .managed_auth_credential_vault_item_spec_input_param import (
     ManagedAuthCredentialVaultItemSpecInputParam as ManagedAuthCredentialVaultItemSpecInputParam,
 )
@@ -115,6 +122,9 @@ from .one_password_credential_vault_item_spec_input_param import (
 from .prepare_checkout_vault_item_operation_request_param import (
     PrepareCheckoutVaultItemOperationRequestParam as PrepareCheckoutVaultItemOperationRequestParam,
 )
+from .register_passkey_vault_item_operation_request_param import (
+    RegisterPasskeyVaultItemOperationRequestParam as RegisterPasskeyVaultItemOperationRequestParam,
+)
 from .one_password_fill_vault_item_operation_request_param import (
     OnePasswordFillVaultItemOperationRequestParam as OnePasswordFillVaultItemOperationRequestParam,
 )

kernel-0.131.0/src/kernel/types/vaults/arm_passkey_vault_item_operation_request_param.py

@@ -0,0 +1,41 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["ArmPasskeyVaultItemOperationRequestParam"]
+
+
+class ArmPasskeyVaultItemOperationRequestParam(TypedDict, total=False):
+    """
+    Let a browser attached to the item's vault sign in with a stored passkey.
+    Only invoke when the item advertises `arm_passkey`. Returns immediately;
+    there is no time limit. While armed, when a page in that browser whose
+    origin matches the passkey's relying party asks for a passkey
+    (`navigator.credentials.get`, including autofill requests made at page
+    load), Kernel answers with this passkey. The private key never enters the
+    browser: Kernel signs on its servers, using the origin Chrome reports for
+    the requesting frame. Arming a passkey for a relying party replaces any
+    passkey armed earlier in the browser for the same relying party. The arm
+    lasts until `disarm_passkey`, the browser ends, the vault is detached, or
+    the item or field is deleted. Drive the sign-in with your own browser
+    tools and inspect the page to confirm it. A page opened in a new tab
+    or window can run its first scripts before Kernel's handler attaches;
+    if such a page asks for a passkey as soon as it loads, reload it. While
+    armed, any script running on the relying party's pages can obtain a
+    sign-in without user interaction, as with a password manager that
+    fills automatically; disarm when the task is done. Passkeys report a
+    signature counter of 0 and backup flags, as synced passkeys do.
+    """
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    type: Required[Literal["arm_passkey"]]
+
+    field: str
+    """Passkey field to arm.
+
+    Required when more than one passkey field holds a passkey.
+    """

{kernel-0.130.0 → kernel-0.131.0}/src/kernel/types/vaults/credential_account_vault_item.py

@@ -37,6 +37,9 @@ class AvailableOperation(BaseModel):
         "collect",
         "prepare_checkout",
         "fill",
+        "arm_passkey",
+        "register_passkey",
+        "disarm_passkey",
         "1pw_create_access_request",
         "1pw_access_request_status",
         "1pw_fill",

{kernel-0.130.0 → kernel-0.131.0}/src/kernel/types/vaults/credential_vault_field_definition.py

@@ -37,7 +37,7 @@ class CredentialVaultFieldDefinition(BaseModel):
     `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
     private key), a lowercase `rpId` domain, and optional `username` and
     `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-    pages.
+    pages; use arm_passkey to sign in with one and register_passkey to create one.
     """
 
     label: Optional[str] = None

{kernel-0.130.0 → kernel-0.131.0}/src/kernel/types/vaults/credential_vault_field_definition_input_param.py

@@ -32,7 +32,7 @@ class CredentialVaultFieldDefinitionInputParam(TypedDict, total=False):
     `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
     private key), a lowercase `rpId` domain, and optional `username` and
     `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-    pages.
+    pages; use arm_passkey to sign in with one and register_passkey to create one.
     """
 
     label: str

{kernel-0.130.0 → kernel-0.131.0}/src/kernel/types/vaults/credential_vault_field_input_param.py

@@ -27,7 +27,7 @@ class CredentialVaultFieldInputParam(TypedDict, total=False):
     `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
     private key), a lowercase `rpId` domain, and optional `username` and
     `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-    pages.
+    pages; use arm_passkey to sign in with one and register_passkey to create one.
     """
 
     encrypted_value: str

{kernel-0.130.0 → kernel-0.131.0}/src/kernel/types/vaults/credential_vault_item.py

@@ -44,6 +44,9 @@ class AvailableOperation(BaseModel):
         "collect",
         "prepare_checkout",
         "fill",
+        "arm_passkey",
+        "register_passkey",
+        "disarm_passkey",
         "1pw_create_access_request",
         "1pw_access_request_status",
         "1pw_fill",

kernel-0.131.0/src/kernel/types/vaults/disarm_passkey_vault_item_operation_request_param.py

@@ -0,0 +1,26 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["DisarmPasskeyVaultItemOperationRequestParam"]
+
+
+class DisarmPasskeyVaultItemOperationRequestParam(TypedDict, total=False):
+    """
+    Stop a browser from using this item's passkeys: removes its armed
+    passkeys and its pending registration into this item. Pages that already
+    loaded keep Kernel's WebAuthn handler but get the browser's own behavior.
+    """
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    type: Required[Literal["disarm_passkey"]]
+
+    field: str
+    """Limit disarming to one passkey field.
+
+    Omit to disarm every passkey field of the item.
+    """