release: 0.131.0

.github/tests/update-coverage-security.test.mjs

@@ -61,9 +61,15 @@ test('changes are restricted to the allowlist before validation', () => {
   assert.ok(jobs.generate.indexOf(snapshot) < jobs.generate.indexOf(verify));
   assert.match(snapshot, /mcp-update-disallowed-paths\.sh/);
   assert.match(snapshot, /git reset -q --hard\n\s+git clean -fdq/);
-  assert.match(snapshot, /AGENT_BASE: \$\{\{ steps\.prepare\.outputs\.agent_base \}\}/);
-  assert.match(snapshot, /git reset -q --soft "\$AGENT_BASE"\n\s+git add -A/);
-  assert.match(step('generate', 'Prepare update branch and SDK diff'), /agent_base=\$\(git rev-parse HEAD\)/);
+  assert.match(snapshot, /MAIN_SHA: \$\{\{ steps\.prepare\.outputs\.main_sha \}\}/);
+  assert.match(snapshot, /git reset -q --soft "\$MAIN_SHA"\n\s+git add -A/);
+  const prepare = step('generate', 'Prepare update branch and SDK diff');
+  assert.match(prepare, /main_sha=\$\(git rev-parse origin\/main\)/);
+  // Only a branch without human commits may be regenerated from main.
+  assert.match(
+    prepare,
+    /git rebase --abort\n[\s\S]*grep -qvxF '260533166\+kernel-internal\[bot\]@users\.noreply\.github\.com'[\s\S]*exit 1\n[\s\S]*git switch -C /,
+  );
   const scriptCalls = workflow.match(/^.*disallowed-paths\.sh.*$/gm);
   assert.equal(scriptCalls.length, 2);
   for (const line of scriptCalls) assert.match(line, /\| bash /);
@@ -106,7 +112,7 @@ test('publishing runs in a separate job that never executes repository code', ()
   assert.doesNotMatch(jobs.publish.slice(0, mint).join(''), /GH_TOKEN:/);
   const publish = step('publish', 'Open or update MCP coverage PR');
   assert.match(publish, /GH_TOKEN: \$\{\{ steps\.app-token\.outputs\.token \}\}/);
-  assert.match(publish, /gh auth setup-git\n\s+git push/);
+  assert.match(publish, /gh auth setup-git\n\s+git push --force-with-lease="\$UPDATE_BRANCH:\$UPDATE_SHA"/);
   for (const entry of jobs.publish) {
     assert.doesNotMatch(entry, /continue-on-error: true|always\(\)/);
   }

.github/workflows/update-mcp-coverage.yml

@@ -38,6 +38,17 @@ jobs:
             echo "Skipping non-stable SDK version: $version"
             exit 0
           fi
+          # A just-published version can take a few minutes to become installable.
+          for attempt in $(seq 1 30); do
+            if [[ "$(npm view "@onkernel/sdk@$version" version 2>/dev/null)" == "$version" ]]; then
+              break
+            fi
+            if [[ "$attempt" == 30 ]]; then
+              echo "::error::@onkernel/sdk@$version is not available on npm after 15 minutes."
+              exit 1
+            fi
+            sleep 30
+          done
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
@@ -104,14 +115,21 @@ jobs:
           if git show-ref --verify --quiet "refs/remotes/origin/$UPDATE_BRANCH"; then
             echo "update_sha=$(git rev-parse "origin/$UPDATE_BRANCH")" >> "$GITHUB_OUTPUT"
             git switch --track "origin/$UPDATE_BRANCH"
-            if ! git merge origin/main --no-edit; then
-              echo "::error::$UPDATE_BRANCH conflicts with main. Resolve the conflicts on that branch, or delete it to start fresh, then rerun this workflow."
-              exit 1
+            if ! git rebase origin/main; then
+              git rebase --abort
+              # The agent covers everything since main's SDK version, so a bot-only
+              # branch can be regenerated from main. Human commits must be kept.
+              if git log --no-merges --format=%ae "origin/main..origin/$UPDATE_BRANCH" \
+                | grep -qvxF '260533166+kernel-internal[bot]@users.noreply.github.com'; then
+                echo "::error::$UPDATE_BRANCH has human commits that conflict with main. Resolve the conflicts on that branch, then rerun this workflow."
+                exit 1
+              fi
+              echo "::warning::$UPDATE_BRANCH conflicts with main; regenerating it from main."
+              git switch -C "$UPDATE_BRANCH" origin/main
             fi
           else
             git switch -c "$UPDATE_BRANCH" origin/main
           fi
-          echo "agent_base=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
           old_version=$(jq -er '.dependencies["@onkernel/sdk"]' package.json)
           if [[ "$old_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] &&
@@ -203,9 +221,9 @@ jobs:
         id: snapshot
         working-directory: mcp
         env:
-          AGENT_BASE: ${{ steps.prepare.outputs.agent_base }}
+          MAIN_SHA: ${{ steps.prepare.outputs.main_sha }}
         run: |
-          git reset -q --soft "$AGENT_BASE"
+          git reset -q --soft "$MAIN_SHA"
           git add -A
           git diff --cached --name-only --no-renames -z \
             | bash ../.github/scripts/mcp-update-disallowed-paths.sh > "$RUNNER_TEMP/excluded-paths"
@@ -284,12 +302,7 @@ jobs:
         run: |
           git config user.name 'kernel-internal[bot]'
           git config user.email '260533166+kernel-internal[bot]@users.noreply.github.com'
-          if [[ -n "$UPDATE_SHA" ]]; then
-            git switch -c "$UPDATE_BRANCH" "$UPDATE_SHA"
-            git merge --no-edit "$MAIN_SHA"
-          else
-            git switch -c "$UPDATE_BRANCH" "$MAIN_SHA"
-          fi
+          git switch -c "$UPDATE_BRANCH" "$MAIN_SHA"
           git apply --index "$RUNNER_TEMP/mcp-coverage-update/changes.patch"
           git diff --cached --name-only --no-renames -z \
             | bash ../.github/scripts/mcp-update-disallowed-paths.sh > "$RUNNER_TEMP/disallowed-paths"
@@ -325,7 +338,7 @@ jobs:
             exit 0
           fi
           gh auth setup-git
-          git push origin "$UPDATE_BRANCH"
+          git push --force-with-lease="$UPDATE_BRANCH:$UPDATE_SHA" origin "$UPDATE_BRANCH"
 
           body="$RUNNER_TEMP/mcp-coverage-pr.md"
           {

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.130.0"
+  ".": "0.131.0"
 }

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.131.0](https://github.com/kernel/kernel-node-sdk/compare/v0.130.0...v0.131.0) (2026-10-26)
+
+
+### Features
+
+* Arm vault passkeys in browsers and sign WebAuthn requests in metro-api ([1423392](https://github.com/kernel/kernel-node-sdk/commit/14233922402fca4668216fc64bf222ab9947ad60))
+
 ## [0.130.0](https://github.com/kernel/kernel-node-sdk/compare/v0.129.0...v0.130.0) (2026-10-24)
 
 

api.md

@@ -515,6 +515,7 @@ Types:
 - <code><a href="./src/resources/vaults/items.ts">AgentcardCheckoutAuthorization</a></code>
 - <code><a href="./src/resources/vaults/items.ts">AgentcardCheckoutPreparation</a></code>
 - <code><a href="./src/resources/vaults/items.ts">AgentcardPreparedProcessor</a></code>
+- <code><a href="./src/resources/vaults/items.ts">ArmPasskeyVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">AuthorizeVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">CardVaultItemSpec</a></code>
 - <code><a href="./src/resources/vaults/items.ts">CardVaultItemState</a></code>
@@ -536,6 +537,7 @@ Types:
 - <code><a href="./src/resources/vaults/items.ts">CredentialVaultItemSpecUpdate</a></code>
 - <code><a href="./src/resources/vaults/items.ts">CredentialVaultItemState</a></code>
 - <code><a href="./src/resources/vaults/items.ts">CredentialVaultItemUpdateRequest</a></code>
+- <code><a href="./src/resources/vaults/items.ts">DisarmPasskeyVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">FillVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">FillVaultItemOperationResult</a></code>
 - <code><a href="./src/resources/vaults/items.ts">KernelCardState</a></code>
@@ -561,7 +563,9 @@ Types:
 - <code><a href="./src/resources/vaults/items.ts">OnePasswordOAuthAction</a></code>
 - <code><a href="./src/resources/vaults/items.ts">OnePasswordRecoverVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">OnePasswordRequestAccessVaultItemOperationRequest</a></code>
+- <code><a href="./src/resources/vaults/items.ts">PasskeyVaultItemOperationResult</a></code>
 - <code><a href="./src/resources/vaults/items.ts">PrepareCheckoutVaultItemOperationRequest</a></code>
+- <code><a href="./src/resources/vaults/items.ts">RegisterPasskeyVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">RestartVerificationVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">VaultCardAliases</a></code>
 - <code><a href="./src/resources/vaults/items.ts">VaultCardFillField</a></code>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.130.0",
+  "version": "0.131.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/resources/vaults/index.ts

@@ -5,6 +5,7 @@ export {
   type AgentcardCheckoutAuthorization,
   type AgentcardCheckoutPreparation,
   type AgentcardPreparedProcessor,
+  type ArmPasskeyVaultItemOperationRequest,
   type AuthorizeVaultItemOperationRequest,
   type CardVaultItemSpec,
   type CardVaultItemState,
@@ -26,6 +27,7 @@ export {
   type CredentialVaultItemSpecUpdate,
   type CredentialVaultItemState,
   type CredentialVaultItemUpdateRequest,
+  type DisarmPasskeyVaultItemOperationRequest,
   type FillVaultItemOperationRequest,
   type FillVaultItemOperationResult,
   type KernelCardState,
@@ -51,7 +53,9 @@ export {
   type OnePasswordOAuthAction,
   type OnePasswordRecoverVaultItemOperationRequest,
   type OnePasswordRequestAccessVaultItemOperationRequest,
+  type PasskeyVaultItemOperationResult,
   type PrepareCheckoutVaultItemOperationRequest,
+  type RegisterPasskeyVaultItemOperationRequest,
   type RestartVerificationVaultItemOperationRequest,
   type VaultCardAliases,
   type VaultCardFillField,