release: 0.131.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.130.0"
+  ".": "0.131.0"
 }

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.131.0](https://github.com/kernel/kernel-python-sdk/compare/v0.130.0...v0.131.0) (2026-10-26)
+
+
+### Features
+
+* Arm vault passkeys in browsers and sign WebAuthn requests in metro-api ([b740930](https://github.com/kernel/kernel-python-sdk/commit/b7409304f4ed37a03004683db63b079052f387bb))
+
 ## [0.130.0](https://github.com/kernel/kernel-python-sdk/compare/v0.129.0...v0.130.0) (2026-10-24)
 
 

api.md

@@ -572,6 +572,7 @@ from kernel.types.vaults import (
     AgentcardCheckoutAuthorization,
     AgentcardCheckoutPreparation,
     AgentcardPreparedProcessor,
+    ArmPasskeyVaultItemOperationRequest,
     AuthorizeVaultItemOperationRequest,
     CardVaultItemSpec,
     CardVaultItemState,
@@ -593,6 +594,7 @@ from kernel.types.vaults import (
     CredentialVaultItemSpecUpdate,
     CredentialVaultItemState,
     CredentialVaultItemUpdateRequest,
+    DisarmPasskeyVaultItemOperationRequest,
     FillVaultItemOperationRequest,
     FillVaultItemOperationResult,
     KernelCardState,
@@ -618,7 +620,9 @@ from kernel.types.vaults import (
     OnePasswordOAuthAction,
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordRequestAccessVaultItemOperationRequest,
+    PasskeyVaultItemOperationResult,
     PrepareCheckoutVaultItemOperationRequest,
+    RegisterPasskeyVaultItemOperationRequest,
     RestartVerificationVaultItemOperationRequest,
     VaultCardAliases,
     VaultCardFillField,

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.130.0"
+version = "0.131.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.130.0"  # x-release-please-version
+__version__ = "0.131.0"  # x-release-please-version

src/kernel/types/vaults/__init__.py

@@ -51,6 +51,7 @@
 from .credential_vault_item_request_param import CredentialVaultItemRequestParam as CredentialVaultItemRequestParam
 from .kernel_wallet_vault_item_spec_param import KernelWalletVaultItemSpecParam as KernelWalletVaultItemSpecParam
 from .managed_auth_credential_vault_field import ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField
+from .passkey_vault_item_operation_result import PasskeyVaultItemOperationResult as PasskeyVaultItemOperationResult
 from .one_password_credential_account_spec import OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec
 from .one_password_credential_account_state import (
     OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
@@ -103,9 +104,15 @@
 from .one_password_fill_vault_item_operation_result import (
     OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult,
 )
+from .arm_passkey_vault_item_operation_request_param import (
+    ArmPasskeyVaultItemOperationRequestParam as ArmPasskeyVaultItemOperationRequestParam,
+)
 from .webmcp_invoke_vault_item_operation_request_param import (
     WebmcpInvokeVaultItemOperationRequestParam as WebmcpInvokeVaultItemOperationRequestParam,
 )
+from .disarm_passkey_vault_item_operation_request_param import (
+    DisarmPasskeyVaultItemOperationRequestParam as DisarmPasskeyVaultItemOperationRequestParam,
+)
 from .managed_auth_credential_vault_item_spec_input_param import (
     ManagedAuthCredentialVaultItemSpecInputParam as ManagedAuthCredentialVaultItemSpecInputParam,
 )
@@ -115,6 +122,9 @@
 from .prepare_checkout_vault_item_operation_request_param import (
     PrepareCheckoutVaultItemOperationRequestParam as PrepareCheckoutVaultItemOperationRequestParam,
 )
+from .register_passkey_vault_item_operation_request_param import (
+    RegisterPasskeyVaultItemOperationRequestParam as RegisterPasskeyVaultItemOperationRequestParam,
+)
 from .one_password_fill_vault_item_operation_request_param import (
     OnePasswordFillVaultItemOperationRequestParam as OnePasswordFillVaultItemOperationRequestParam,
 )

src/kernel/types/vaults/arm_passkey_vault_item_operation_request_param.py

@@ -0,0 +1,41 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["ArmPasskeyVaultItemOperationRequestParam"]
+
+
+class ArmPasskeyVaultItemOperationRequestParam(TypedDict, total=False):
+    """
+    Let a browser attached to the item's vault sign in with a stored passkey.
+    Only invoke when the item advertises `arm_passkey`. Returns immediately;
+    there is no time limit. While armed, when a page in that browser whose
+    origin matches the passkey's relying party asks for a passkey
+    (`navigator.credentials.get`, including autofill requests made at page
+    load), Kernel answers with this passkey. The private key never enters the
+    browser: Kernel signs on its servers, using the origin Chrome reports for
+    the requesting frame. Arming a passkey for a relying party replaces any
+    passkey armed earlier in the browser for the same relying party. The arm
+    lasts until `disarm_passkey`, the browser ends, the vault is detached, or
+    the item or field is deleted. Drive the sign-in with your own browser
+    tools and inspect the page to confirm it. A page opened in a new tab
+    or window can run its first scripts before Kernel's handler attaches;
+    if such a page asks for a passkey as soon as it loads, reload it. While
+    armed, any script running on the relying party's pages can obtain a
+    sign-in without user interaction, as with a password manager that
+    fills automatically; disarm when the task is done. Passkeys report a
+    signature counter of 0 and backup flags, as synced passkeys do.
+    """
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    type: Required[Literal["arm_passkey"]]
+
+    field: str
+    """Passkey field to arm.
+
+    Required when more than one passkey field holds a passkey.
+    """

src/kernel/types/vaults/credential_account_vault_item.py

@@ -37,6 +37,9 @@ class AvailableOperation(BaseModel):
         "collect",
         "prepare_checkout",
         "fill",
+        "arm_passkey",
+        "register_passkey",
+        "disarm_passkey",
         "1pw_create_access_request",
         "1pw_access_request_status",
         "1pw_fill",

src/kernel/types/vaults/credential_vault_field_definition.py

@@ -37,7 +37,7 @@ class CredentialVaultFieldDefinition(BaseModel):
     `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
     private key), a lowercase `rpId` domain, and optional `username` and
     `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-    pages.
+    pages; use arm_passkey to sign in with one and register_passkey to create one.
     """
 
     label: Optional[str] = None

src/kernel/types/vaults/credential_vault_field_definition_input_param.py

@@ -32,7 +32,7 @@ class CredentialVaultFieldDefinitionInputParam(TypedDict, total=False):
     `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
     private key), a lowercase `rpId` domain, and optional `username` and
     `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-    pages.
+    pages; use arm_passkey to sign in with one and register_passkey to create one.
     """
 
     label: str

src/kernel/types/vaults/credential_vault_field_input_param.py

@@ -27,7 +27,7 @@ class CredentialVaultFieldInputParam(TypedDict, total=False):
     `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
     private key), a lowercase `rpId` domain, and optional `username` and
     `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-    pages.
+    pages; use arm_passkey to sign in with one and register_passkey to create one.
     """
 
     encrypted_value: str

src/kernel/types/vaults/credential_vault_item.py

@@ -44,6 +44,9 @@ class AvailableOperation(BaseModel):
         "collect",
         "prepare_checkout",
         "fill",
+        "arm_passkey",
+        "register_passkey",
+        "disarm_passkey",
         "1pw_create_access_request",
         "1pw_access_request_status",
         "1pw_fill",

src/kernel/types/vaults/disarm_passkey_vault_item_operation_request_param.py

@@ -0,0 +1,26 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["DisarmPasskeyVaultItemOperationRequestParam"]
+
+
+class DisarmPasskeyVaultItemOperationRequestParam(TypedDict, total=False):
+    """
+    Stop a browser from using this item's passkeys: removes its armed
+    passkeys and its pending registration into this item. Pages that already
+    loaded keep Kernel's WebAuthn handler but get the browser's own behavior.
+    """
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    type: Required[Literal["disarm_passkey"]]
+
+    field: str
+    """Limit disarming to one passkey field.
+
+    Omit to disarm every passkey field of the item.
+    """

src/kernel/types/vaults/item_perform_operation_params.py

@@ -20,6 +20,9 @@
     "CollectVaultItemOperationRequest",
     "PrepareCheckoutVaultItemOperationRequest",
     "FillVaultItemOperationRequest",
+    "ArmPasskeyVaultItemOperationRequest",
+    "RegisterPasskeyVaultItemOperationRequest",
+    "DisarmPasskeyVaultItemOperationRequest",
     "OnePasswordRequestAccessVaultItemOperationRequest",
     "OnePasswordPollAccessVaultItemOperationRequest",
     "OnePasswordFillVaultItemOperationRequest",
@@ -128,6 +131,51 @@ class FillVaultItemOperationRequest(TypedDict, total=False):
     """
 
 
+class ArmPasskeyVaultItemOperationRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    type: Required[Literal["arm_passkey"]]
+
+    field: str
+    """Passkey field to arm.
+
+    Required when more than one passkey field holds a passkey.
+    """
+
+
+class RegisterPasskeyVaultItemOperationRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    type: Required[Literal["register_passkey"]]
+
+    field: str
+    """Empty passkey field to store the new passkey in.
+
+    Required when more than one passkey field is empty.
+    """
+
+
+class DisarmPasskeyVaultItemOperationRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    type: Required[Literal["disarm_passkey"]]
+
+    field: str
+    """Limit disarming to one passkey field.
+
+    Omit to disarm every passkey field of the item.
+    """
+
+
 class OnePasswordRequestAccessVaultItemOperationRequest(TypedDict, total=False):
     id_or_name: Required[str]
 
@@ -228,6 +276,9 @@ class WebmcpInvokeVaultItemOperationRequest(TypedDict, total=False):
     CollectVaultItemOperationRequest,
     PrepareCheckoutVaultItemOperationRequest,
     FillVaultItemOperationRequest,
+    ArmPasskeyVaultItemOperationRequest,
+    RegisterPasskeyVaultItemOperationRequest,
+    DisarmPasskeyVaultItemOperationRequest,
     OnePasswordRequestAccessVaultItemOperationRequest,
     OnePasswordPollAccessVaultItemOperationRequest,
     OnePasswordFillVaultItemOperationRequest,

src/kernel/types/vaults/managed_auth_credential_vault_field.py

@@ -21,5 +21,5 @@ class ManagedAuthCredentialVaultField(BaseModel):
     `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
     private key), a lowercase `rpId` domain, and optional `username` and
     `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-    pages.
+    pages; use arm_passkey to sign in with one and register_passkey to create one.
     """

src/kernel/types/vaults/passkey_vault_item_operation_result.py

@@ -0,0 +1,22 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import Optional
+from typing_extensions import Literal
+
+from ..._models import BaseModel
+
+__all__ = ["PasskeyVaultItemOperationResult"]
+
+
+class PasskeyVaultItemOperationResult(BaseModel):
+    status: Literal["armed", "disarmed"]
+    """
+    armed means the browser will answer matching passkey requests; it does not mean
+    a page has asked yet. disarmed means the browser no longer uses this item's
+    passkeys.
+    """
+
+    type: Literal["arm_passkey", "register_passkey", "disarm_passkey"]
+
+    rp_id: Optional[str] = None
+    """Relying party the armed passkey answers for. Returned by arm_passkey."""

src/kernel/types/vaults/register_passkey_vault_item_operation_request_param.py

@@ -0,0 +1,36 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["RegisterPasskeyVaultItemOperationRequestParam"]
+
+
+class RegisterPasskeyVaultItemOperationRequestParam(TypedDict, total=False):
+    """
+    Let a browser attached to the item's vault create a passkey on a website
+    and store it in an empty passkey field. Only invoke when the item
+    advertises `register_passkey`; declare the field first, for example by
+    adding an optional passkey field with a credential update. Returns
+    immediately; there is no time limit. The next passkey a page in that
+    browser creates (`navigator.credentials.create`) is generated by Kernel,
+    stored in the field, and only then returned to the page, so the website
+    never receives a passkey Kernel failed to store. Each browser has one
+    pending registration; a later `register_passkey` replaces it. Drive the
+    website's "add a passkey" flow with your own browser tools, then confirm
+    by reading the item (the field reports `has_value`) or its
+    `credential_passkey_registered` event, and by signing in with
+    `arm_passkey`. Only ES256 passkeys are created.
+    """
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    type: Required[Literal["register_passkey"]]
+
+    field: str
+    """Empty passkey field to store the new passkey in.
+
+    Required when more than one passkey field is empty.
+    """

src/kernel/types/vaults/vault_item.py

@@ -54,6 +54,9 @@ class WalletVaultItemAvailableOperation(BaseModel):
         "collect",
         "prepare_checkout",
         "fill",
+        "arm_passkey",
+        "register_passkey",
+        "disarm_passkey",
         "1pw_create_access_request",
         "1pw_access_request_status",
         "1pw_fill",
@@ -156,6 +159,9 @@ class CardVaultItemAvailableOperation(BaseModel):
         "collect",
         "prepare_checkout",
         "fill",
+        "arm_passkey",
+        "register_passkey",
+        "disarm_passkey",
         "1pw_create_access_request",
         "1pw_access_request_status",
         "1pw_fill",